# CVEs published 2022-01-17

35 CVEs were published on January 17, 2022: 0 critical, 6 high. Days are UTC.

- [CVE-2022-22703](https://cve.now/CVE-2022-22703.md): In Stormshield SSO Agent 2.x before 2.1.1 and 3.x before 3.0.2, the cleartext user password and PSK are contained in the log file of the .ex (no CVSS)
- [CVE-2021-42357](https://cve.now/CVE-2021-42357.md): DOM based XSS Vulnerability in Apache Knox (no CVSS, Apache Software Foundation Apache Knox · org.apache.knox:ga…)
- [CVE-2022-0242](https://cve.now/CVE-2022-0242.md): Unrestricted Upload of File with Dangerous Type in crater-invoice/crater (CVSS 7.2, crater-invoice/crater · bytefury/crater)
- [CVE-2021-38965](https://cve.now/CVE-2021-38965.md): IBM FileNet Content Manager 5.5.4, 5.5.6, and 5.5.7 could allow a remote authenticated attacker to execute arbitrary commands on the system (CVSS 6.3, IBM FileNet Content Manager)
- [CVE-2021-33040](https://cve.now/CVE-2021-33040.md): managers/views/iframe.js in FuturePress EPub.js before 0.3.89 allows XSS. (no CVSS, epubjs)
- [CVE-2022-0257](https://cve.now/CVE-2022-0257.md): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (CVSS 6.1, pimcore/pimcore)
- [CVE-2022-0258](https://cve.now/CVE-2022-0258.md): SQL Injection in pimcore/pimcore (CVSS 8.3, pimcore/pimcore)
- [CVE-2022-0256](https://cve.now/CVE-2022-0256.md): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (CVSS 5.3, pimcore/pimcore)
- [CVE-2021-3862](https://cve.now/CVE-2021-3862.md): Cross-site Scripting (XSS) - Reflected in icecoder/icecoder (CVSS 5.4, icecoder/icecoder)
- [CVE-2022-0240](https://cve.now/CVE-2022-0240.md): NULL Pointer Dereference in mruby/mruby (CVSS 6.2, mruby/mruby)
- [CVE-2022-0253](https://cve.now/CVE-2022-0253.md): Cross-site Scripting (XSS) - Stored in livehelperchat/livehelperchat (CVSS 7.1, livehelperchat/livehelperchat · remdex/livehelperchat)
- [CVE-2021-25067](https://cve.now/CVE-2021-25067.md): Landing Page Builder \< 1.4.9.6 - Authenticated Reflected Cross-Site Scripting (XSS) (no CVSS, Landing Page Builder – Lead Page – Optin Page – Squeeze Pag…)
- [CVE-2021-25065](https://cve.now/CVE-2021-25065.md): Smash Balloon Social Post Feed \< 4.1.1 - Authenticated Reflected Cross-Site Scripting (XSS) (no CVSS, Smash Balloon Social Post Feed)
- [CVE-2021-25061](https://cve.now/CVE-2021-25061.md): WP Booking System – Booking Calendar \< 2.0.15 - Authenticated Reflected Cross-Site Scripting (XSS) (no CVSS, WP Booking System – Booking Calendar)
- [CVE-2021-25046](https://cve.now/CVE-2021-25046.md): Modern Events Calendar Lite \< 6.2.0 - Subscriber+ Category Add Leading to Stored XSS (no CVSS, Modern Events Calendar Lite)
- [CVE-2021-25037](https://cve.now/CVE-2021-25037.md): All In One SEO \< 4.1.5.3 - Authenticated SQL Injection (no CVSS, All in One SEO – Best WordPress SEO Plugin – Easily Improve…)
- [CVE-2021-25036](https://cve.now/CVE-2021-25036.md): All In One SEO \< 4.1.5.3 - Authenticated Privilege Escalation (no CVSS, All in One SEO – Best WordPress SEO Plugin – Easily Improve…)
- [CVE-2021-25024](https://cve.now/CVE-2021-25024.md): Event Calendar \< 1.1.51 - Reflected Cross-Site Scripting (no CVSS, EventCalendar)
- [CVE-2021-25005](https://cve.now/CVE-2021-25005.md): SEUR Oficial \< 1.7.0 - Admin+ Stored Cross-Site Scripting (no CVSS, SEUR Oficial)
- [CVE-2021-24909](https://cve.now/CVE-2021-24909.md): ACF Photo Gallery Field \< 1.7.5 - Reflected Cross-Site Scripting (no CVSS, ACF Photo Gallery Field)
- [CVE-2021-24838](https://cve.now/CVE-2021-24838.md): AnyComment \< 0.3.5 - Open Redirect (no CVSS, AnyComment)
- [CVE-2021-4164](https://cve.now/CVE-2021-4164.md): Cross-Site Request Forgery (CSRF) in janeczku/calibre-web (CVSS 7.6, janeczku/calibre-web · calibreweb)
- [CVE-2021-3857](https://cve.now/CVE-2021-3857.md): Cross-site Scripting (XSS) - Stored in chaskiq/chaskiq (CVSS 7.3, chaskiq/chaskiq)
- [CVE-2021-3853](https://cve.now/CVE-2021-3853.md): Cross-site Scripting (XSS) - Stored in chaskiq/chaskiq (CVSS 6.5, chaskiq/chaskiq)
- [CVE-2021-4171](https://cve.now/CVE-2021-4171.md): Business Logic Errors in janeczku/calibre-web (CVSS 7.7, janeczku/calibre-web · calibreweb)
- [CVE-2022-0184](https://cve.now/CVE-2022-0184.md): Insufficiently protected credentials vulnerability in 'TEPRA' PRO SR5900P Ver.1.080 and earlier and 'TEPRA' PRO SR-R7900P Ver.1.030 and earl (no CVSS, KING JIM CO. TEPRA PRO)
- [CVE-2022-0183](https://cve.now/CVE-2022-0183.md): Missing encryption of sensitive data vulnerability in 'MIRUPASS' PW10 firmware all versions and 'MIRUPASS' PW20 firmware all versions allows (no CVSS, KING JIM CO. MIRUPASS)
- [CVE-2022-0182](https://cve.now/CVE-2022-0182.md): Stored cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote authenticated attacker to inject (no CVSS, ExpressTech Quiz And Survey Master)
- [CVE-2022-0181](https://cve.now/CVE-2022-0181.md): Reflected cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote attacker to inject an arbitra (no CVSS, ExpressTech Quiz And Survey Master)
- [CVE-2022-0180](https://cve.now/CVE-2022-0180.md): Cross-site request forgery (CSRF) vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote attacker to hijack the aut (no CVSS, ExpressTech Quiz And Survey Master)
- [CVE-2022-0131](https://cve.now/CVE-2022-0131.md): Jimoty App for Android versions prior to 3.7.42 uses a hard-coded API key for an external service. (no CVSS, Jimoty App for Android)
- [CVE-2022-0239](https://cve.now/CVE-2022-0239.md): Improper Restriction of XML External Entity Reference in stanfordnlp/corenlp (CVSS 4.7, stanfordnlp/corenlp · edu.stanford.nlp:stanford-corenlp)
- [CVE-2021-25025](https://cve.now/CVE-2021-25025.md): Event Calendar \< 1.1.51 - Subscriber+ Event Creation (no CVSS, EventCalendar)
- [CVE-2022-23303](https://cve.now/CVE-2022-23303.md): The implementations of SAE in hostapd before 2.10 and wpa\_supplicant before 2.10 are vulnerable to side channel attacks as a result of cache (no CVSS)
- [CVE-2022-23304](https://cve.now/CVE-2022-23304.md): The implementations of EAP-pwd in hostapd before 2.10 and wpa\_supplicant before 2.10 are vulnerable to side-channel attacks as a result of c (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-01-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.