CVEs published January 18, 2022
85 CVEs were published on January 18, 2022: 1 critical, 16 high.
- Published
- 85
- Critical
- 1
- High
- 16
- Medium
- 33
- Low
- 7
- Unrated
- 28
- Now in CISA KEV
- 0
- Fix available
- 41
Most affected products
- GitLab
- 13
- onionshare · onionshare-cli
- 9
- NVIDIA SHIELD TV
- 6
- pimcore/pimcore
- 4
- Apache Software Foundation Apache Log4j 1.x · log4j:log4j +1
- 3
- M-Files Server
- 2
- Mattermost
- 2
- Mattermost Boards
- 2
- Umbraco CMS · Umbraco.Cms.Core
- 2
- codechecker-api · codechecker
- 1
Critical 1
High 16
- CVE-2022-21690Cross-Site Scripting in Onionshareonionshare · onionshare-cli
- CVE-2022-21689Denial of Service in Onionshareonionshare · onionshare-cli
- CVE-2022-21688Out-of-bounds Read in Onionshareonionshare · onionshare-cli
- CVE-2021-34404Android images for T210 provided by NVIDIA contain a vulnerability in BROM, where failure to limit access to AHB-DMA when BROM fails may allNVIDIA SHIELD TV
- CVE-2021-34403NVIDIA Linux distributions contain a vulnerability in nvmap ioctl, which allows any user with a local account to exploit a use-after-free coNVIDIA SHIELD TV
- CVE-2021-34401NVIDIA Linux kernel distributions contain a vulnerability in nvmap NVGPU_IOCTL_CHANNEL_SET_ERROR_NOTIFIER, where improper access control mayNVIDIA SHIELD TV
- CVE-2022-0215XootiX Plugins <= Various Versions Cross-Site Request Forgery to Arbitrary Options UpdateXootiX Login/Signup Popup · XootiX Waitlist Woocommerce +1
- CVE-2021-43353Crisp Live Chat <= 0.31 Cross-Site Request Forgery to Stored Cross-Site ScriptingCrisp Live Chat
- CVE-2022-0236WP Import Export (Lite) <= 3.9.15 Unauthenticated Sensitive Data Disclosurevjinfotech WP Import Export
- CVE-2022-22690Umbraco Remote ApplicationURL OverwriteUmbraco CMS · Umbraco.Cms.Core
- CVE-2021-39946Improper neutralization of user input in GitLab CE/EE versions 14.3 to 14.3.6, 14.4 to 14.4.4, and 14.5 to 14.5.2 allowed an attacker to expGitLab
- CVE-2022-0154An issue has been discovered in GitLab affecting all versions starting from 7.7 before 14.4.5, all versions starting from 14.5.0 before 14.5GitLab
- CVE-2022-0244An issue has been discovered in GitLab CE/EE affecting all versions starting with 14.5.GitLab
- CVE-2021-41807Lack of rate limiting in M-Files Server and M-Files Web products with versions before 21.12.10873.0, allows brute-forcing of certain type of user accounts.M-Files Server · M-Files Web
- CVE-2022-23307A deserialization flaw in the Chainsaw component of Log4j 1 can lead to malicious code execution.Apache Software Foundation Apache Log4j 1.x · log4j:log4j +1
- CVE-2022-23302Deserialization of untrusted data in JMSSink in Apache Log4j 1.xApache Software Foundation Apache Log4j 1.x · log4j:log4j +1
Medium, low and unrated 68
- CVE-2022-21694OTF-006: Broken Website Hardening Control: The CSP can be turned on or off but not configured for the specific needs of the websiteonionshare · onionshare-cli
- CVE-2022-21700Memory leak in micronaut-coremicronaut-projects micronaut-core · io.micronaut:micronaut-…
- CVE-2022-21692Improper Access Control in Onionshareonionshare · onionshare-cli
- CVE-2022-21693Path traversal in Onionshareonionshare · onionshare-cli
- CVE-2022-21691Improper Access Control in Onionshareonionshare · onionshare-cli
- CVE-2022-21695Improper Access Control in Onionshareonionshare · onionshare-cli
- CVE-2022-21673OAuth Identity Token exposure in Grafanagrafana
- CVE-2022-23408wolfSSL 5.x before 5.1.1 uses non-random IV values in certain situations.
- CVE-2022-21696Username spoofing in OnionShareonionshare · onionshare-cli
- CVE-2021-44836An issue was discovered in Delta RM 1.2.
- CVE-2021-44839An issue was discovered in Delta RM 1.2.
- CVE-2021-44838An issue was discovered in Delta RM 1.2.
- CVE-2021-44840An issue was discovered in Delta RM 1.2.
- CVE-2021-34406NVIDIA Tegra kernel driver contains a vulnerability in NVHost, where a specific race condition can lead to a null pointer dereference, whichNVIDIA SHIELD TV
- CVE-2021-34405NVIDIA Linux distributions contain a vulnerability in TrustZone’s TEE_Malloc function, where an unchecked return value causing a null pointeNVIDIA SHIELD TV
- CVE-2021-34402NVIDIA Tegra kernel driver contains a vulnerability in NVIDIA NVDEC, where a user with high privileges might be able to read from or write tNVIDIA SHIELD TV
- CVE-2021-46013An unrestricted file upload vulnerability exists in Sourcecodester Free school management software 1.0.
- CVE-2021-46005Sourcecodester Car Rental Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via vehicalorcview parameter.
- CVE-2022-21683Comment reply notifications sent to incorrect users in wagtailwagtail
- CVE-2022-23083NetMaster 12.2 Network Management for TCP/IP and NetMaster File Transfer Management contain a XSS (Cross-Site Scripting) vulnerability in ReNetMaster Network Management for TCP/IP and NetMaster File…
- CVE-2021-29215A potential security vulnerability in HPE Ezmeral Data Fabric that may allow a remote access restriction bypass in the TEZ MapR ecosystem coHPE Ezmeral Data Fabric
- CVE-2022-0210Random Banner <= 4.1.4 Admin+ Stored Cross-Site ScriptingRandom Banner
- CVE-2022-0233ProfileGrid – User Profiles, Memberships, Groups and Communities <= 4.7.4 Authenticated Stored Cross-Site ScriptingProfileGrid – User Profiles, Memberships, Groups and Commun…
- CVE-2021-4074WHMCS Bridge <= 6.1 Subscriber+ Stored Cross-Site ScriptingWHMCS Bridge
- CVE-2022-0232User Registration, Login & Landing Pages – LeadMagic <= 1.2.7 Admin+ Stored Cross-Site ScriptingUser Registration, Login & Landing Pages – LeadMagic
- CVE-2022-22691Umbraco Password Reset URL PoisonUmbraco CMS · Umbraco.Cms.Core
- CVE-2021-37864Users can view the contents of an archived channel when access is explicitly denied by the system adminMattermost
- CVE-2021-37867Emails of all users are exposed via one of the Boards APIsMattermost Boards
- CVE-2021-37866Session is not invalidated on server-side when user logged out of BoardsMattermost Boards
- CVE-2020-14107A stack overflow in the HTTP server of Cast can be exploited to make the app crash in LAN.Xiaomi mirror screen
- CVE-2021-39892In all versions of GitLab CE/EE since version 12.0, a lower privileged user can import users from projects that they don't have a maintainerGitLab
- CVE-2021-39942A denial of service vulnerability in GitLab CE/EE affecting all versions starting from 12.0 before 14.3.6, all versions starting from 14.4 bGitLab
- CVE-2022-0090An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1.GitLab
- CVE-2022-0093An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1.GitLab
- CVE-2022-0125An issue has been discovered in GitLab affecting all versions starting from 12.0 before 14.4.5, all versions starting from 14.5.0 before 14.GitLab
- CVE-2022-0124An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1.GitLab
- CVE-2022-0151An issue has been discovered in GitLab affecting all versions starting from 12.10 before 14.4.5, all versions starting from 14.5.0 before 14GitLab
- CVE-2022-0152An issue has been discovered in GitLab affecting all versions starting from 13.10 before 14.4.5, all versions starting from 14.5.0 before 14GitLab
- CVE-2021-39927Server side request forgery protections in GitLab CE/EE versions between 8.4 and 14.4.4, between 14.5.0 and 14.5.2, and between 14.6.0 and 1GitLab
- CVE-2022-0172An issue has been discovered in GitLab CE/EE affecting all versions starting with 12.3.GitLab
- CVE-2021-41808In M-Files Server product with versions before 21.11.10775.0, enabling logging of federated authentication would write sensitive information to event logs.M-Files Server
- CVE-2021-41809SSRF vulnerability in M-Files Server products with versions before 22.1.11017.1, allows requests from server.M-Files Server
- CVE-2021-37865Server-side Denial of Service while processing a specifically crafted GIF fileMattermost
- CVE-2021-4083A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket file handlers in the way users call kernel
- CVE-2021-29632In FreeBSD 13.0-STABLE before n247428-9352de39c3dc, 12.2-STABLE before r370674, 13.0-RELEASE before p6, and 12.2-RELEASE before p12, certainFreeBSD
- CVE-2020-14110AX3600 router sensitive information leaked.There is an unauthorized interface through luci to obtain sensitive information and log in to themiwifi6 AX3600
- CVE-2021-29872IBM Cloud Pak for Automation 21.0.1 and 21.0.2 - Business Automation Studio Component is vulnerable to HTTP header injection, caused by imprIBM Cloud Pak for Automation
- CVE-2022-0263Unrestricted Upload of File with Dangerous Type in pimcore/pimcorepimcore/pimcore
- CVE-2022-0262Cross-site Scripting (XSS) - Stored in pimcore/pimcorepimcore/pimcore
- CVE-2021-4146Business Logic Errors in pimcore/pimcorepimcore/pimcore
- CVE-2021-44217In Ericsson CodeChecker through 6.18.0, a Stored Cross-site scripting (XSS) vulnerability in the comments component of the reports viewer alcodechecker-api · codechecker
- CVE-2022-0260Cross-site Scripting (XSS) - Stored in pimcore/pimcorepimcore/pimcore
- CVE-2021-41550Leostream Connection Broker 9.0.40.17 allows administrator to upload and execute Perl code.
- CVE-2021-41551Leostream Connection Broker 9.0.40.17 allows administrators to conduct directory traversal attacks by uploading z ZIP file that contains a s
- CVE-2021-38697SoftVibe SARABAN for INFOMA 1.1 allows Unauthenticated unrestricted File Upload, that allows attackers to upload files with any file extensi
- CVE-2021-38696SoftVibe SARABAN for INFOMA 1.1 has Incorrect Access Control vulnerability, that allows attackers to access signature files on the applicati
- CVE-2021-22566Incorrect mapping of Executable bits in Fuchsia KernelGoogle Fuchsia
- CVE-2021-38695SoftVibe SARABAN for INFOMA 1.1 is vulnerable to stored cross-site scripting (XSS) that allows users to store scripts in certain fields (e.g
- CVE-2021-38694SoftVibe SARABAN for INFOMA 1.1 allows SQL Injection.
- CVE-2021-38785There is a NULL pointer deference in the Allwinner R818 SoC Android Q SDK V1.0 camera driver /dev/cedar_dev that could use the ioctl cmd IOC
- CVE-2021-38784There is a NULL pointer dereference in the syscall open_exec function of Allwinner R818 SoC Android Q SDK V1.0 that could executable a malic
- CVE-2021-38783There is a Out-of-Bound Write in the Allwinner R818 SoC Android Q SDK V1.0 camera driver "/dev/cedar_dev" through iotcl cmd IOCTL_SET_PROC_I
- CVE-2021-33965China Mobile An Lianbao WF-1 V1.0.1 router provides a web interface /api/ZRMesh/set_ZRMesh which receives parameters by POST request, and th
- CVE-2021-33964China Mobile An Lianbao WF-1 V1.0.1 router provides a web interface /api/ZRRuleFilter/set_firewall_level which receives parameters by POST r
- CVE-2021-45394An issue was discovered in Spipu HTML2PDF before 5.2.4.spipu/html2pdf
- CVE-2021-44757Zoho ManageEngine Desktop Central before 10.1.2137.9 and Desktop Central MSP before 10.1.2137.9 allow attackers to bypass authentication, an
- CVE-2022-0245Cross-Site Request Forgery (CSRF) in livehelperchat/livehelperchatlivehelperchat/livehelperchat
- CVE-2022-0261Heap-based Buffer Overflow in vim/vimvim/vim