CVEs published January 20, 2022
72 CVEs were published on January 20, 2022: 0 critical, 3 high.
- Published
- 72
- Critical
- 0
- High
- 3
- Medium
- 8
- Low
- 0
- Unrated
- 61
- Now in CISA KEV
- 0
- Fix available
- 10
Most affected products
- microweber/microweber
- 4
- net.mingsoft:ms-mcms
- 3
- Trend Micro Deep Security Agent for Linux
- 2
- Apache Software Foundation Apache Airflow · apache-airflow
- 1
- Apache Software Foundation Apache ShardingSphere ElasticJob…
- 1
- IBM Security SOAR
- 1
- LINE for Windows
- 1
- MongoDB for VS Code
- 1
- pimcore/pimcore
- 1
- rust-lang rust
- 1
High 3
Medium, low and unrated 69
- CVE-2022-22930A remote code execution (RCE) vulnerability in the Template Management function of MCMS v5.2.4 allows attackers to execute arbitrary code vinet.mingsoft:ms-mcms
- CVE-2022-23314MCMS v5.2.4 was discovered to contain a SQL injection vulnerability via /ms/mdiy/model/importJson.do.
- CVE-2022-23315MCMS v5.2.4 was discovered to contain an arbitrary file upload vulnerability via the component /ms/template/writeFileContent.do.net.mingsoft:ms-mcms
- CVE-2022-22929MCMS v5.2.4 was discovered to have an arbitrary file upload vulnerability in the New Template module, which allows attackers to execute arbinet.mingsoft:ms-mcms
- CVE-2022-22928MCMS v5.2.4 was discovered to have a hardcoded shiro-key, allowing attackers to exploit the key and execute arbitrary code.
- CVE-2022-22895Jerryscript 3.0.0 was discovered to contain a heap-buffer-overflow via ecma_utf8_string_to_number_by_radix in /jerry-core/ecma/base/ecma-hel
- CVE-2022-22894Jerryscript 3.0.0 was discovered to contain a stack overflow via ecma_lcache_lookup in /jerry-core/ecma/base/ecma-lcache.c.
- CVE-2022-22893Jerryscript 3.0.0 was discovered to contain a stack overflow via vm_loop.lto_priv.304 in /jerry-core/vm/vm.c.
- CVE-2022-22891Jerryscript 3.0.0 was discovered to contain a SEGV vulnerability via ecma_ref_object_inline in /jerry-core/ecma/base/ecma-gc.c.
- CVE-2022-22892There is an Assertion 'ecma_is_value_undefined (value) || ecma_is_value_null (value) || ecma_is_value_boolean (value) || ecma_is_value_numbe
- CVE-2022-22890There is an Assertion 'arguments_type != SCANNER_ARGUMENTS_PRESENT && arguments_type != SCANNER_ARGUMENTS_PRESENT_NO_REG' failed at /jerry-c
- CVE-2022-22888Jerryscript 3.0.0 was discovered to contain a stack overflow via ecma_op_object_find_own in /ecma/operations/ecma-objects.c.
- CVE-2020-23315There is an ASSERTION (pFuncBody->GetYieldRegister() == oldYieldRegister) failed in Js::DebugContext::RundownSourcesAndReparse in ChakraCore
- CVE-2021-46351There is an Assertion 'local_tza == ecma_date_local_time_zone_adjustment (date_value)' failed at /jerry-core/ecma/builtin-objects/ecma-built
- CVE-2021-46349There is an Assertion 'type == ECMA_OBJECT_TYPE_GENERAL || type == ECMA_OBJECT_TYPE_PROXY' failed at /jerry-core/ecma/operations/ecma-object
- CVE-2021-46350There is an Assertion 'ecma_is_value_object (value)' failed at jerryscript/jerry-core/ecma/base/ecma-helpers-value.c in JerryScript 3.0.0.
- CVE-2021-46347There is an Assertion 'ecma_object_check_class_name_is_object (obj_p)' failed at /jerry-core/ecma/operations/ecma-objects.c in JerryScript 3
- CVE-2021-46348There is an Assertion 'ECMA_STRING_IS_REF_EQUALS_TO_ONE (string_p)' failed at /jerry-core/ecma/base/ecma-literal-storage.c in JerryScript 3.
- CVE-2021-46346There is an Assertion 'local_tza == ecma_date_local_time_zone_adjustment (date_value)' failed at /jerry-core/ecma/builtin-objects/ecma-built
- CVE-2021-46344There is an Assertion 'flags & PARSER_PATTERN_HAS_REST_ELEMENT' failed at /jerry-core/parser/js/js-parser-expr.c in JerryScript 3.0.0.
- CVE-2021-46345There is an Assertion 'cesu8_cursor_p == cesu8_end_p' failed at /jerry-core/lit/lit-strings.c in JerryScript 3.0.0.
- CVE-2021-46343There is an Assertion 'context_p->token.type == LEXER_LITERAL' failed at /jerry-core/parser/js/js-parser-expr.c in JerryScript 3.0.0.
- CVE-2021-46340There is an Assertion 'context_p->stack_top_uint8 == SCAN_STACK_TRY_STATEMENT || context_p->stack_top_uint8 == SCAN_STACK_CATCH_STATEMENT' f
- CVE-2021-46342There is an Assertion 'ecma_is_lexical_environment (obj_p) || !ecma_op_object_is_fast_array (obj_p)' failed at /jerry-core/ecma/base/ecma-he
- CVE-2021-46339There is an Assertion 'lit_is_valid_cesu8_string (string_p, string_size)' failed at /base/ecma-helpers-string.c(ecma_new_ecma_string_from_ut
- CVE-2021-46338There is an Assertion 'ecma_is_lexical_environment (object_p)' failed at /base/ecma-helpers.c(ecma_get_lex_env_type) in JerryScript 3.0.0.
- CVE-2021-46337There is an Assertion 'page_p != NULL' failed at /parser/js/js-parser-mem.c(parser_list_get) in JerryScript 3.0.0.
- CVE-2021-46334Moddable SDK v11.5.0 was discovered to contain a stack buffer overflow via the component __interceptor_strcat.
- CVE-2021-46336There is an Assertion 'opts & PARSER_CLASS_LITERAL_CTOR_PRESENT' failed at /parser/js/js-parser-expr.c(parser_parse_class_body) in JerryScri
- CVE-2021-46335Moddable SDK v11.5.0 was discovered to contain a NULL pointer dereference in the component fx_Function_prototype_hasInstance.
- CVE-2021-46333Moddable SDK v11.5.0 was discovered to contain an invalid memory access vulnerability via the component __asan_memmove.
- CVE-2021-46331Moddable SDK v11.5.0 was discovered to contain a SEGV vulnerability via xs/sources/xsProxy.c in fxProxyGetPrototype.
- CVE-2021-46332Moddable SDK v11.5.0 was discovered to contain a heap-buffer-overflow via xs/sources/xsDataView.c in fxUint8Getter.
- CVE-2021-46330Moddable SDK v11.5.0 was discovered to contain a SEGV vulnerability via xs/sources/xsDataView.c in fx_ArrayBuffer_prototype_concat.
- CVE-2021-46327Moddable SDK v11.5.0 was discovered to contain a SEGV vulnerability via xs/sources/xsArray.c in fx_Array_prototype_sort.
- CVE-2021-46328Moddable SDK v11.5.0 was discovered to contain a heap-buffer-overflow via the component __libc_start_main.
- CVE-2021-46329Moddable SDK v11.5.0 was discovered to contain a SEGV vulnerability via the component _fini.
- CVE-2021-46326Moddable SDK v11.5.0 was discovered to contain a heap-buffer-overflow via the component __asan_memcpy.
- CVE-2021-46325Espruino 2v10.246 was discovered to contain a stack buffer overflow via src/jsutils.c in vcbprintf.
- CVE-2021-46324Espruino 2v11.251 was discovered to contain a stack buffer overflow via src/jsvar.c in jsvNewFromString.
- CVE-2021-46323Espruino 2v11.251 was discovered to contain a SEGV vulnerability via src/jsinteractive.c in jsiGetDeviceFromClass.
- CVE-2021-29785IBM Security SOAR V42 and V43could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP StIBM Security SOAR
- CVE-2021-46061An SQL Injection vulnerability exists in Sourcecodester Computer and Mobile Repair Shop Management system (RSMS) 1.0 via the code parameter
- CVE-2021-44090An SQL Injection vulnerability exists in Sourcecodester Online Reviewer System 1.0 via the password parameter.
- CVE-2021-44245An SQL Injection vulnerability exists in Courcecodester COVID 19 Testing Management System (CTMS) 1.0 via the (1) username and (2) contactno
- CVE-2021-44244An SQL Injection vulnerabiity exists in Sourcecodester Logistic Hub Parcel's Management System 1.0 via the username parameter in login.php.
- CVE-2022-23120A code injection vulnerability in Trend Micro Deep Security and Cloud One - Workload Security Agent for Linux version 20 and below could allTrend Micro Deep Security Agent for Linux
- CVE-2022-23119A directory traversal vulnerability in Trend Micro Deep Security and Cloud One - Workload Security Agent for Linux version 20 and below coulTrend Micro Deep Security Agent for Linux
- CVE-2021-44092An SQL Injection vulnerability exists in code-projects Pharmacy Management 1.0 via the username parameter in the administer login form.
- CVE-2021-44091A Cross-Site Scripting (XSS) vulnerability exists in Courcecodester Multi Restaurant Table Reservation System 1.0 in register.php via the (1
- CVE-2022-0219Improper Restriction of XML External Entity Reference in skylot/jadxskylot/jadx · io.github.skylot:jadx-core
- CVE-2021-44829Cross Site Scripting (XSS) vulnerability exists in index.html in AFI WebACMS through 2.1.0 via the the ID parameter.
- CVE-2021-44734Embedded web server input sanitization vulnerability in Lexmark devices through 2021-12-07, which can which can lead to remote code executio
- CVE-2021-44736The initial admin account setup wizard on Lexmark devices allow unauthenticated access to the “out of service erase” feature.
- CVE-2021-44735Embedded web server command injection vulnerability in Lexmark devices through 2021-12-07.
- CVE-2021-44737PJL directory traversal vulnerability in Lexmark devices through 2021-12-07 that can be leveraged to overwrite internal configuration files.
- CVE-2021-44738Buffer overflow vulnerability has been identified in Lexmark devices through 2021-12-07 in postscript interpreter.
- CVE-2022-0285Cross-site Scripting (XSS) - Stored in pimcore/pimcorepimcore/pimcore
- CVE-2021-32039MongoDB Extension for VS Code may unexpectedly store credentials locally in clear textMongoDB for VS Code
- CVE-2022-22820Due to the lack of media file checks before rendering, it was possible for an attacker to cause abnormal CPU consumption for message recipieLINE for Windows
- CVE-2021-34600Telenot complex: Insecure AES Key GenerationTelenot Electronic CompasX
- CVE-2022-0282Cross-site Scripting in microweber/microwebermicroweber/microweber
- CVE-2021-3866Cross-site Scripting (XSS) - Stored in zulip/zulipzulip/zulip
- CVE-2022-22733Access-Token in ElasticJob UI causes password disclosureApache Software Foundation Apache ShardingSphere ElasticJob…
- CVE-2021-45230Apache Airflow: Creating DagRuns didn't respect Dag-level permissions in the WebserverApache Software Foundation Apache Airflow · apache-airflow
- CVE-2021-43269In Code42 app before 8.8.0, eval injection allows an attacker to change a device’s proxy configuration to use a malicious proxy auto-config
- CVE-2021-45417AIDE before 0.17.4 allows local users to obtain root privileges via crafted file metadata (such as XFS extended attributes or tmpfs ACLs), b
- CVE-2021-46322Duktape v2.99.99 was discovered to contain a SEGV vulnerability via the component duk_push_tval in duktape/duk_api_stack.c.
- CVE-2022-0277Incorrect Permission Assignment for Critical Resource in microweber/microwebermicroweber/microweber