CVEs published January 17, 2022
35 CVEs were published on January 17, 2022: 0 critical, 6 high.
- Published
- 35
- Critical
- 0
- High
- 6
- Medium
- 7
- Low
- 0
- Unrated
- 22
- Now in CISA KEV
- 0
- Fix available
- 23
Most affected products
- ExpressTech Quiz And Survey Master
- 3
- pimcore/pimcore
- 3
- All in One SEO – Best WordPress SEO Plugin – Easily Improve…
- 2
- chaskiq/chaskiq
- 2
- EventCalendar
- 2
- janeczku/calibre-web · calibreweb
- 2
- ACF Photo Gallery Field
- 1
- AnyComment
- 1
- Apache Software Foundation Apache Knox · org.apache.knox:ga…
- 1
- crater-invoice/crater · bytefury/crater
- 1
High 6
- CVE-2022-0242Unrestricted Upload of File with Dangerous Type in crater-invoice/cratercrater-invoice/crater · bytefury/crater
- CVE-2022-0258SQL Injection in pimcore/pimcorepimcore/pimcore
- CVE-2022-0253Cross-site Scripting (XSS) - Stored in livehelperchat/livehelperchatlivehelperchat/livehelperchat · remdex/livehelperchat
- CVE-2021-4164Cross-Site Request Forgery (CSRF) in janeczku/calibre-webjaneczku/calibre-web · calibreweb
- CVE-2021-3857Cross-site Scripting (XSS) - Stored in chaskiq/chaskiqchaskiq/chaskiq
- CVE-2021-4171Business Logic Errors in janeczku/calibre-webjaneczku/calibre-web · calibreweb
Medium, low and unrated 29
- CVE-2022-22703In Stormshield SSO Agent 2.x before 2.1.1 and 3.x before 3.0.2, the cleartext user password and PSK are contained in the log file of the .ex
- CVE-2021-42357DOM based XSS Vulnerability in Apache KnoxApache Software Foundation Apache Knox · org.apache.knox:ga…
- CVE-2021-38965IBM FileNet Content Manager 5.5.4, 5.5.6, and 5.5.7 could allow a remote authenticated attacker to execute arbitrary commands on the system IBM FileNet Content Manager
- CVE-2021-33040managers/views/iframe.js in FuturePress EPub.js before 0.3.89 allows XSS.epubjs
- CVE-2022-0257Cross-site Scripting (XSS) - Stored in pimcore/pimcorepimcore/pimcore
- CVE-2022-0256Cross-site Scripting (XSS) - Stored in pimcore/pimcorepimcore/pimcore
- CVE-2021-3862Cross-site Scripting (XSS) - Reflected in icecoder/icecodericecoder/icecoder
- CVE-2022-0240NULL Pointer Dereference in mruby/mrubymruby/mruby
- CVE-2021-25067Landing Page Builder < 1.4.9.6 - Authenticated Reflected Cross-Site Scripting (XSS)Landing Page Builder – Lead Page – Optin Page – Squeeze Pag…
- CVE-2021-25065Smash Balloon Social Post Feed < 4.1.1 - Authenticated Reflected Cross-Site Scripting (XSS)Smash Balloon Social Post Feed
- CVE-2021-25061WP Booking System – Booking Calendar < 2.0.15 - Authenticated Reflected Cross-Site Scripting (XSS)WP Booking System – Booking Calendar
- CVE-2021-25046Modern Events Calendar Lite < 6.2.0 - Subscriber+ Category Add Leading to Stored XSSModern Events Calendar Lite
- CVE-2021-25037All In One SEO < 4.1.5.3 - Authenticated SQL InjectionAll in One SEO – Best WordPress SEO Plugin – Easily Improve…
- CVE-2021-25036All In One SEO < 4.1.5.3 - Authenticated Privilege EscalationAll in One SEO – Best WordPress SEO Plugin – Easily Improve…
- CVE-2021-25024Event Calendar < 1.1.51 - Reflected Cross-Site ScriptingEventCalendar
- CVE-2021-25005SEUR Oficial < 1.7.0 - Admin+ Stored Cross-Site ScriptingSEUR Oficial
- CVE-2021-24909ACF Photo Gallery Field < 1.7.5 - Reflected Cross-Site ScriptingACF Photo Gallery Field
- CVE-2021-24838AnyComment < 0.3.5 - Open RedirectAnyComment
- CVE-2021-3853Cross-site Scripting (XSS) - Stored in chaskiq/chaskiqchaskiq/chaskiq
- CVE-2022-0184Insufficiently protected credentials vulnerability in 'TEPRA' PRO SR5900P Ver.1.080 and earlier and 'TEPRA' PRO SR-R7900P Ver.1.030 and earlKING JIM CO. TEPRA PRO
- CVE-2022-0183Missing encryption of sensitive data vulnerability in 'MIRUPASS' PW10 firmware all versions and 'MIRUPASS' PW20 firmware all versions allowsKING JIM CO. MIRUPASS
- CVE-2022-0182Stored cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote authenticated attacker to injectExpressTech Quiz And Survey Master
- CVE-2022-0181Reflected cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote attacker to inject an arbitraExpressTech Quiz And Survey Master
- CVE-2022-0180Cross-site request forgery (CSRF) vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote attacker to hijack the autExpressTech Quiz And Survey Master
- CVE-2022-0131Jimoty App for Android versions prior to 3.7.42 uses a hard-coded API key for an external service.Jimoty App for Android
- CVE-2022-0239Improper Restriction of XML External Entity Reference in stanfordnlp/corenlpstanfordnlp/corenlp · edu.stanford.nlp:stanford-corenlp
- CVE-2021-25025Event Calendar < 1.1.51 - Subscriber+ Event CreationEventCalendar
- CVE-2022-23303The implementations of SAE in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side channel attacks as a result of cache
- CVE-2022-23304The implementations of EAP-pwd in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side-channel attacks as a result of c