# CVEs published 2022-01-18

85 CVEs were published on January 18, 2022: 1 critical, 16 high. Days are UTC.

- [CVE-2022-21694](https://cve.now/CVE-2022-21694.md): OTF-006: Broken Website Hardening Control: The CSP can be turned on or off but not configured for the specific needs of the website (CVSS 3.7, onionshare · onionshare-cli)
- [CVE-2022-21690](https://cve.now/CVE-2022-21690.md): Cross-Site Scripting in Onionshare (CVSS 8.7, onionshare · onionshare-cli)
- [CVE-2022-21700](https://cve.now/CVE-2022-21700.md): Memory leak in micronaut-core (CVSS 5.3, micronaut-projects micronaut-core · io.micronaut:micronaut-…)
- [CVE-2022-21692](https://cve.now/CVE-2022-21692.md): Improper Access Control in Onionshare (CVSS 4.3, onionshare · onionshare-cli)
- [CVE-2022-21689](https://cve.now/CVE-2022-21689.md): Denial of Service in Onionshare (CVSS 7.5, onionshare · onionshare-cli)
- [CVE-2022-21693](https://cve.now/CVE-2022-21693.md): Path traversal in Onionshare (CVSS 6.3, onionshare · onionshare-cli)
- [CVE-2022-21691](https://cve.now/CVE-2022-21691.md): Improper Access Control in Onionshare (CVSS 4.3, onionshare · onionshare-cli)
- [CVE-2022-21695](https://cve.now/CVE-2022-21695.md): Improper Access Control in Onionshare (CVSS 4.3, onionshare · onionshare-cli)
- [CVE-2022-21688](https://cve.now/CVE-2022-21688.md): Out-of-bounds Read in Onionshare (CVSS 7.5, onionshare · onionshare-cli)
- [CVE-2022-21673](https://cve.now/CVE-2022-21673.md): OAuth Identity Token exposure in Grafana (CVSS 4.3, grafana)
- [CVE-2022-23408](https://cve.now/CVE-2022-23408.md): wolfSSL 5.x before 5.1.1 uses non-random IV values in certain situations. (no CVSS)
- [CVE-2022-21696](https://cve.now/CVE-2022-21696.md): Username spoofing in OnionShare (CVSS 4.3, onionshare · onionshare-cli)
- [CVE-2021-44836](https://cve.now/CVE-2021-44836.md): An issue was discovered in Delta RM 1.2. (no CVSS)
- [CVE-2021-44839](https://cve.now/CVE-2021-44839.md): An issue was discovered in Delta RM 1.2. (no CVSS)
- [CVE-2021-44838](https://cve.now/CVE-2021-44838.md): An issue was discovered in Delta RM 1.2. (no CVSS)
- [CVE-2021-44840](https://cve.now/CVE-2021-44840.md): An issue was discovered in Delta RM 1.2. (no CVSS)
- [CVE-2021-34406](https://cve.now/CVE-2021-34406.md): NVIDIA Tegra kernel driver contains a vulnerability in NVHost, where a specific race condition can lead to a null pointer dereference, which (CVSS 4.7, NVIDIA SHIELD TV)
- [CVE-2021-34405](https://cve.now/CVE-2021-34405.md): NVIDIA Linux distributions contain a vulnerability in TrustZone’s TEE\_Malloc function, where an unchecked return value causing a null pointe (CVSS 5.5, NVIDIA SHIELD TV)
- [CVE-2021-34404](https://cve.now/CVE-2021-34404.md): Android images for T210 provided by NVIDIA contain a vulnerability in BROM, where failure to limit access to AHB-DMA when BROM fails may all (CVSS 7.1, NVIDIA SHIELD TV)
- [CVE-2021-34403](https://cve.now/CVE-2021-34403.md): NVIDIA Linux distributions contain a vulnerability in nvmap ioctl, which allows any user with a local account to exploit a use-after-free co (CVSS 7.8, NVIDIA SHIELD TV)
- [CVE-2021-34402](https://cve.now/CVE-2021-34402.md): NVIDIA Tegra kernel driver contains a vulnerability in NVIDIA NVDEC, where a user with high privileges might be able to read from or write t (CVSS 6.7, NVIDIA SHIELD TV)
- [CVE-2021-34401](https://cve.now/CVE-2021-34401.md): NVIDIA Linux kernel distributions contain a vulnerability in nvmap NVGPU\_IOCTL\_CHANNEL\_SET\_ERROR\_NOTIFIER, where improper access control may (CVSS 7.8, NVIDIA SHIELD TV)
- [CVE-2021-46013](https://cve.now/CVE-2021-46013.md): An unrestricted file upload vulnerability exists in Sourcecodester Free school management software 1.0. (no CVSS)
- [CVE-2021-46005](https://cve.now/CVE-2021-46005.md): Sourcecodester Car Rental Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via vehicalorcview parameter. (no CVSS)
- [CVE-2022-21683](https://cve.now/CVE-2022-21683.md): Comment reply notifications sent to incorrect users in wagtail (CVSS 3.5, wagtail)
- [CVE-2022-23083](https://cve.now/CVE-2022-23083.md): NetMaster 12.2 Network Management for TCP/IP and NetMaster File Transfer Management contain a XSS (Cross-Site Scripting) vulnerability in Re (no CVSS, NetMaster Network Management for TCP/IP and NetMaster File…)
- [CVE-2021-29215](https://cve.now/CVE-2021-29215.md): A potential security vulnerability in HPE Ezmeral Data Fabric that may allow a remote access restriction bypass in the TEZ MapR ecosystem co (no CVSS, HPE Ezmeral Data Fabric)
- [CVE-2022-0215](https://cve.now/CVE-2022-0215.md): XootiX Plugins \<= Various Versions Cross-Site Request Forgery to Arbitrary Options Update (CVSS 8.8, XootiX Login/Signup Popup · XootiX Waitlist Woocommerce +1)
- [CVE-2022-0210](https://cve.now/CVE-2022-0210.md): Random Banner \<= 4.1.4 Admin+ Stored Cross-Site Scripting (CVSS 4.8, Random Banner)
- [CVE-2022-0233](https://cve.now/CVE-2022-0233.md): ProfileGrid – User Profiles, Memberships, Groups and Communities \<= 4.7.4 Authenticated Stored Cross-Site Scripting (CVSS 6.4, ProfileGrid – User Profiles, Memberships, Groups and Commun…)
- [CVE-2021-4074](https://cve.now/CVE-2021-4074.md): WHMCS Bridge \<= 6.1 Subscriber+ Stored Cross-Site Scripting (CVSS 6.4, WHMCS Bridge)
- [CVE-2022-0232](https://cve.now/CVE-2022-0232.md): User Registration, Login & Landing Pages – LeadMagic \<= 1.2.7 Admin+ Stored Cross-Site Scripting (CVSS 4.8, User Registration, Login & Landing Pages – LeadMagic)
- [CVE-2021-43353](https://cve.now/CVE-2021-43353.md): Crisp Live Chat \<= 0.31 Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 8.8, Crisp Live Chat)
- [CVE-2022-0236](https://cve.now/CVE-2022-0236.md): WP Import Export (Lite) \<= 3.9.15 Unauthenticated Sensitive Data Disclosure (CVSS 7.5, vjinfotech WP Import Export)
- [CVE-2022-22690](https://cve.now/CVE-2022-22690.md): Umbraco Remote ApplicationURL Overwrite (CVSS 8.6, Umbraco CMS · Umbraco.Cms.Core)
- [CVE-2022-22691](https://cve.now/CVE-2022-22691.md): Umbraco Password Reset URL Poison (CVSS 6.8, Umbraco CMS · Umbraco.Cms.Core)
- [CVE-2021-37864](https://cve.now/CVE-2021-37864.md): Users can view the contents of an archived channel when access is explicitly denied by the system admin (CVSS 2.6, Mattermost)
- [CVE-2021-37867](https://cve.now/CVE-2021-37867.md): Emails of all users are exposed via one of the Boards APIs (CVSS 4.3, Mattermost Boards)
- [CVE-2021-37866](https://cve.now/CVE-2021-37866.md): Session is not invalidated on server-side when user logged out of Boards (CVSS 4.7, Mattermost Boards)
- [CVE-2020-14107](https://cve.now/CVE-2020-14107.md): A stack overflow in the HTTP server of Cast can be exploited to make the app crash in LAN. (no CVSS, Xiaomi mirror screen)
- [CVE-2021-39892](https://cve.now/CVE-2021-39892.md): In all versions of GitLab CE/EE since version 12.0, a lower privileged user can import users from projects that they don't have a maintainer (CVSS 4.3, GitLab)
- [CVE-2021-39942](https://cve.now/CVE-2021-39942.md): A denial of service vulnerability in GitLab CE/EE affecting all versions starting from 12.0 before 14.3.6, all versions starting from 14.4 b (CVSS 4.3, GitLab)
- [CVE-2021-39946](https://cve.now/CVE-2021-39946.md): Improper neutralization of user input in GitLab CE/EE versions 14.3 to 14.3.6, 14.4 to 14.4.4, and 14.5 to 14.5.2 allowed an attacker to exp (CVSS 8.7, GitLab)
- [CVE-2022-0090](https://cve.now/CVE-2022-0090.md): An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. (CVSS 6.5, GitLab)
- [CVE-2022-0093](https://cve.now/CVE-2022-0093.md): An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. (CVSS 3.5, GitLab)
- [CVE-2022-0125](https://cve.now/CVE-2022-0125.md): An issue has been discovered in GitLab affecting all versions starting from 12.0 before 14.4.5, all versions starting from 14.5.0 before 14. (CVSS 4.3, GitLab)
- [CVE-2022-0154](https://cve.now/CVE-2022-0154.md): An issue has been discovered in GitLab affecting all versions starting from 7.7 before 14.4.5, all versions starting from 14.5.0 before 14.5 (CVSS 7.5, GitLab)
- [CVE-2022-0124](https://cve.now/CVE-2022-0124.md): An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. (CVSS 4.3, GitLab)
- [CVE-2022-0244](https://cve.now/CVE-2022-0244.md): An issue has been discovered in GitLab CE/EE affecting all versions starting with 14.5. (CVSS 8.6, GitLab)
- [CVE-2022-0151](https://cve.now/CVE-2022-0151.md): An issue has been discovered in GitLab affecting all versions starting from 12.10 before 14.4.5, all versions starting from 14.5.0 before 14 (CVSS 6.5, GitLab)
- [CVE-2022-0152](https://cve.now/CVE-2022-0152.md): An issue has been discovered in GitLab affecting all versions starting from 13.10 before 14.4.5, all versions starting from 14.5.0 before 14 (CVSS 6.5, GitLab)
- [CVE-2021-39927](https://cve.now/CVE-2021-39927.md): Server side request forgery protections in GitLab CE/EE versions between 8.4 and 14.4.4, between 14.5.0 and 14.5.2, and between 14.6.0 and 1 (CVSS 3.5, GitLab)
- [CVE-2022-0172](https://cve.now/CVE-2022-0172.md): An issue has been discovered in GitLab CE/EE affecting all versions starting with 12.3. (CVSS 5.3, GitLab)
- [CVE-2021-41808](https://cve.now/CVE-2021-41808.md): In M-Files Server product with versions before 21.11.10775.0, enabling logging of federated authentication would write sensitive information to event logs. (CVSS 2.0, M-Files Server)
- [CVE-2021-41807](https://cve.now/CVE-2021-41807.md): Lack of rate limiting in M-Files Server and M-Files Web products with versions before 21.12.10873.0, allows brute-forcing of certain type of user accounts. (CVSS 7.5, M-Files Server · M-Files Web)
- [CVE-2021-41809](https://cve.now/CVE-2021-41809.md): SSRF vulnerability in M-Files Server products with versions before 22.1.11017.1, allows requests from server. (CVSS 3.5, M-Files Server)
- [CVE-2021-37865](https://cve.now/CVE-2021-37865.md): Server-side Denial of Service while processing a specifically crafted GIF file (CVSS 4.3, Mattermost)
- [CVE-2021-4083](https://cve.now/CVE-2021-4083.md): A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket file handlers in the way users call (no CVSS, kernel)
- [CVE-2021-29632](https://cve.now/CVE-2021-29632.md): In FreeBSD 13.0-STABLE before n247428-9352de39c3dc, 12.2-STABLE before r370674, 13.0-RELEASE before p6, and 12.2-RELEASE before p12, certain (no CVSS, FreeBSD)
- [CVE-2020-14110](https://cve.now/CVE-2020-14110.md): AX3600 router sensitive information leaked.There is an unauthorized interface through luci to obtain sensitive information and log in to the (no CVSS, miwifi6 AX3600)
- [CVE-2021-29872](https://cve.now/CVE-2021-29872.md): IBM Cloud Pak for Automation 21.0.1 and 21.0.2 - Business Automation Studio Component is vulnerable to HTTP header injection, caused by impr (CVSS 5.4, IBM Cloud Pak for Automation)
- [CVE-2022-0263](https://cve.now/CVE-2022-0263.md): Unrestricted Upload of File with Dangerous Type in pimcore/pimcore (CVSS 6.6, pimcore/pimcore)
- [CVE-2022-0262](https://cve.now/CVE-2022-0262.md): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (CVSS 6.6, pimcore/pimcore)
- [CVE-2021-4146](https://cve.now/CVE-2021-4146.md): Business Logic Errors in pimcore/pimcore (CVSS 4.3, pimcore/pimcore)
- [CVE-2022-23307](https://cve.now/CVE-2022-23307.md): A deserialization flaw in the Chainsaw component of Log4j 1 can lead to malicious code execution. (CVSS 8.8, Apache Software Foundation Apache Log4j 1.x · log4j:log4j +1)
- [CVE-2022-23305](https://cve.now/CVE-2022-23305.md): SQL injection in JDBC Appender in Apache Log4j V1 (CVSS 9.8, Apache Software Foundation Apache Log4j 1.x · log4j:log4j +1)
- [CVE-2022-23302](https://cve.now/CVE-2022-23302.md): Deserialization of untrusted data in JMSSink in Apache Log4j 1.x (CVSS 8.8, Apache Software Foundation Apache Log4j 1.x · log4j:log4j +1)
- [CVE-2021-44217](https://cve.now/CVE-2021-44217.md): In Ericsson CodeChecker through 6.18.0, a Stored Cross-site scripting (XSS) vulnerability in the comments component of the reports viewer al (no CVSS, codechecker-api · codechecker)
- [CVE-2022-0260](https://cve.now/CVE-2022-0260.md): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (CVSS 6.5, pimcore/pimcore)
- [CVE-2021-41550](https://cve.now/CVE-2021-41550.md): Leostream Connection Broker 9.0.40.17 allows administrator to upload and execute Perl code. (no CVSS)
- [CVE-2021-41551](https://cve.now/CVE-2021-41551.md): Leostream Connection Broker 9.0.40.17 allows administrators to conduct directory traversal attacks by uploading z ZIP file that contains a s (no CVSS)
- [CVE-2021-38697](https://cve.now/CVE-2021-38697.md): SoftVibe SARABAN for INFOMA 1.1 allows Unauthenticated unrestricted File Upload, that allows attackers to upload files with any file extensi (no CVSS)
- [CVE-2021-38696](https://cve.now/CVE-2021-38696.md): SoftVibe SARABAN for INFOMA 1.1 has Incorrect Access Control vulnerability, that allows attackers to access signature files on the applicati (no CVSS)
- [CVE-2021-22566](https://cve.now/CVE-2021-22566.md): Incorrect mapping of Executable bits in Fuchsia Kernel (CVSS 5.1, Google Fuchsia)
- [CVE-2021-38695](https://cve.now/CVE-2021-38695.md): SoftVibe SARABAN for INFOMA 1.1 is vulnerable to stored cross-site scripting (XSS) that allows users to store scripts in certain fields (e.g (no CVSS)
- [CVE-2021-38694](https://cve.now/CVE-2021-38694.md): SoftVibe SARABAN for INFOMA 1.1 allows SQL Injection. (no CVSS)
- [CVE-2021-38785](https://cve.now/CVE-2021-38785.md): There is a NULL pointer deference in the Allwinner R818 SoC Android Q SDK V1.0 camera driver /dev/cedar\_dev that could use the ioctl cmd IOC (no CVSS)
- [CVE-2021-38784](https://cve.now/CVE-2021-38784.md): There is a NULL pointer dereference in the syscall open\_exec function of Allwinner R818 SoC Android Q SDK V1.0 that could executable a malic (no CVSS)
- [CVE-2021-38783](https://cve.now/CVE-2021-38783.md): There is a Out-of-Bound Write in the Allwinner R818 SoC Android Q SDK V1.0 camera driver "/dev/cedar\_dev" through iotcl cmd IOCTL\_SET\_PROC\_I (no CVSS)
- [CVE-2021-33965](https://cve.now/CVE-2021-33965.md): China Mobile An Lianbao WF-1 V1.0.1 router provides a web interface /api/ZRMesh/set\_ZRMesh which receives parameters by POST request, and th (no CVSS)
- [CVE-2021-33964](https://cve.now/CVE-2021-33964.md): China Mobile An Lianbao WF-1 V1.0.1 router provides a web interface /api/ZRRuleFilter/set\_firewall\_level which receives parameters by POST r (no CVSS)
- [CVE-2021-45394](https://cve.now/CVE-2021-45394.md): An issue was discovered in Spipu HTML2PDF before 5.2.4. (no CVSS, spipu/html2pdf)
- [CVE-2021-44757](https://cve.now/CVE-2021-44757.md): Zoho ManageEngine Desktop Central before 10.1.2137.9 and Desktop Central MSP before 10.1.2137.9 allow attackers to bypass authentication, an (no CVSS)
- [CVE-2022-0245](https://cve.now/CVE-2022-0245.md): Cross-Site Request Forgery (CSRF) in livehelperchat/livehelperchat (CVSS 5.7, livehelperchat/livehelperchat)
- [CVE-2022-0261](https://cve.now/CVE-2022-0261.md): Heap-based Buffer Overflow in vim/vim (no CVSS, vim/vim)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-01-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.