# CVEs published 2022-01-20

72 CVEs were published on January 20, 2022: 0 critical, 3 high. Days are UTC.

- [CVE-2022-22930](https://cve.now/CVE-2022-22930.md): A remote code execution (RCE) vulnerability in the Template Management function of MCMS v5.2.4 allows attackers to execute arbitrary code vi (no CVSS, net.mingsoft:ms-mcms)
- [CVE-2022-23314](https://cve.now/CVE-2022-23314.md): MCMS v5.2.4 was discovered to contain a SQL injection vulnerability via /ms/mdiy/model/importJson.do. (no CVSS)
- [CVE-2022-23315](https://cve.now/CVE-2022-23315.md): MCMS v5.2.4 was discovered to contain an arbitrary file upload vulnerability via the component /ms/template/writeFileContent.do. (no CVSS, net.mingsoft:ms-mcms)
- [CVE-2022-22929](https://cve.now/CVE-2022-22929.md): MCMS v5.2.4 was discovered to have an arbitrary file upload vulnerability in the New Template module, which allows attackers to execute arbi (no CVSS, net.mingsoft:ms-mcms)
- [CVE-2022-22928](https://cve.now/CVE-2022-22928.md): MCMS v5.2.4 was discovered to have a hardcoded shiro-key, allowing attackers to exploit the key and execute arbitrary code. (no CVSS)
- [CVE-2022-22895](https://cve.now/CVE-2022-22895.md): Jerryscript 3.0.0 was discovered to contain a heap-buffer-overflow via ecma\_utf8\_string\_to\_number\_by\_radix in /jerry-core/ecma/base/ecma-hel (no CVSS)
- [CVE-2022-22894](https://cve.now/CVE-2022-22894.md): Jerryscript 3.0.0 was discovered to contain a stack overflow via ecma\_lcache\_lookup in /jerry-core/ecma/base/ecma-lcache.c. (no CVSS)
- [CVE-2022-22893](https://cve.now/CVE-2022-22893.md): Jerryscript 3.0.0 was discovered to contain a stack overflow via vm\_loop.lto\_priv.304 in /jerry-core/vm/vm.c. (no CVSS)
- [CVE-2022-22891](https://cve.now/CVE-2022-22891.md): Jerryscript 3.0.0 was discovered to contain a SEGV vulnerability via ecma\_ref\_object\_inline in /jerry-core/ecma/base/ecma-gc.c. (no CVSS)
- [CVE-2022-22892](https://cve.now/CVE-2022-22892.md): There is an Assertion 'ecma\_is\_value\_undefined (value) || ecma\_is\_value\_null (value) || ecma\_is\_value\_boolean (value) || ecma\_is\_value\_numbe (no CVSS)
- [CVE-2022-22890](https://cve.now/CVE-2022-22890.md): There is an Assertion 'arguments\_type != SCANNER\_ARGUMENTS\_PRESENT && arguments\_type != SCANNER\_ARGUMENTS\_PRESENT\_NO\_REG' failed at /jerry-c (no CVSS)
- [CVE-2022-22888](https://cve.now/CVE-2022-22888.md): Jerryscript 3.0.0 was discovered to contain a stack overflow via ecma\_op\_object\_find\_own in /ecma/operations/ecma-objects.c. (no CVSS)
- [CVE-2020-23315](https://cve.now/CVE-2020-23315.md): There is an ASSERTION (pFuncBody-\>GetYieldRegister() == oldYieldRegister) failed in Js::DebugContext::RundownSourcesAndReparse in ChakraCore (no CVSS)
- [CVE-2021-46351](https://cve.now/CVE-2021-46351.md): There is an Assertion 'local\_tza == ecma\_date\_local\_time\_zone\_adjustment (date\_value)' failed at /jerry-core/ecma/builtin-objects/ecma-built (no CVSS)
- [CVE-2021-46349](https://cve.now/CVE-2021-46349.md): There is an Assertion 'type == ECMA\_OBJECT\_TYPE\_GENERAL || type == ECMA\_OBJECT\_TYPE\_PROXY' failed at /jerry-core/ecma/operations/ecma-object (no CVSS)
- [CVE-2021-46350](https://cve.now/CVE-2021-46350.md): There is an Assertion 'ecma\_is\_value\_object (value)' failed at jerryscript/jerry-core/ecma/base/ecma-helpers-value.c in JerryScript 3.0.0. (no CVSS)
- [CVE-2021-46347](https://cve.now/CVE-2021-46347.md): There is an Assertion 'ecma\_object\_check\_class\_name\_is\_object (obj\_p)' failed at /jerry-core/ecma/operations/ecma-objects.c in JerryScript 3 (no CVSS)
- [CVE-2021-46348](https://cve.now/CVE-2021-46348.md): There is an Assertion 'ECMA\_STRING\_IS\_REF\_EQUALS\_TO\_ONE (string\_p)' failed at /jerry-core/ecma/base/ecma-literal-storage.c in JerryScript 3. (no CVSS)
- [CVE-2021-46346](https://cve.now/CVE-2021-46346.md): There is an Assertion 'local\_tza == ecma\_date\_local\_time\_zone\_adjustment (date\_value)' failed at /jerry-core/ecma/builtin-objects/ecma-built (no CVSS)
- [CVE-2021-46344](https://cve.now/CVE-2021-46344.md): There is an Assertion 'flags & PARSER\_PATTERN\_HAS\_REST\_ELEMENT' failed at /jerry-core/parser/js/js-parser-expr.c in JerryScript 3.0.0. (no CVSS)
- [CVE-2021-46345](https://cve.now/CVE-2021-46345.md): There is an Assertion 'cesu8\_cursor\_p == cesu8\_end\_p' failed at /jerry-core/lit/lit-strings.c in JerryScript 3.0.0. (no CVSS)
- [CVE-2021-46343](https://cve.now/CVE-2021-46343.md): There is an Assertion 'context\_p-\>token.type == LEXER\_LITERAL' failed at /jerry-core/parser/js/js-parser-expr.c in JerryScript 3.0.0. (no CVSS)
- [CVE-2021-46340](https://cve.now/CVE-2021-46340.md): There is an Assertion 'context\_p-\>stack\_top\_uint8 == SCAN\_STACK\_TRY\_STATEMENT || context\_p-\>stack\_top\_uint8 == SCAN\_STACK\_CATCH\_STATEMENT' f (no CVSS)
- [CVE-2021-46342](https://cve.now/CVE-2021-46342.md): There is an Assertion 'ecma\_is\_lexical\_environment (obj\_p) || !ecma\_op\_object\_is\_fast\_array (obj\_p)' failed at /jerry-core/ecma/base/ecma-he (no CVSS)
- [CVE-2021-46339](https://cve.now/CVE-2021-46339.md): There is an Assertion 'lit\_is\_valid\_cesu8\_string (string\_p, string\_size)' failed at /base/ecma-helpers-string.c(ecma\_new\_ecma\_string\_from\_ut (no CVSS)
- [CVE-2021-46338](https://cve.now/CVE-2021-46338.md): There is an Assertion 'ecma\_is\_lexical\_environment (object\_p)' failed at /base/ecma-helpers.c(ecma\_get\_lex\_env\_type) in JerryScript 3.0.0. (no CVSS)
- [CVE-2021-46337](https://cve.now/CVE-2021-46337.md): There is an Assertion 'page\_p != NULL' failed at /parser/js/js-parser-mem.c(parser\_list\_get) in JerryScript 3.0.0. (no CVSS)
- [CVE-2021-46334](https://cve.now/CVE-2021-46334.md): Moddable SDK v11.5.0 was discovered to contain a stack buffer overflow via the component \_\_interceptor\_strcat. (no CVSS)
- [CVE-2021-46336](https://cve.now/CVE-2021-46336.md): There is an Assertion 'opts & PARSER\_CLASS\_LITERAL\_CTOR\_PRESENT' failed at /parser/js/js-parser-expr.c(parser\_parse\_class\_body) in JerryScri (no CVSS)
- [CVE-2021-46335](https://cve.now/CVE-2021-46335.md): Moddable SDK v11.5.0 was discovered to contain a NULL pointer dereference in the component fx\_Function\_prototype\_hasInstance. (no CVSS)
- [CVE-2021-46333](https://cve.now/CVE-2021-46333.md): Moddable SDK v11.5.0 was discovered to contain an invalid memory access vulnerability via the component \_\_asan\_memmove. (no CVSS)
- [CVE-2021-46331](https://cve.now/CVE-2021-46331.md): Moddable SDK v11.5.0 was discovered to contain a SEGV vulnerability via xs/sources/xsProxy.c in fxProxyGetPrototype. (no CVSS)
- [CVE-2021-46332](https://cve.now/CVE-2021-46332.md): Moddable SDK v11.5.0 was discovered to contain a heap-buffer-overflow via xs/sources/xsDataView.c in fxUint8Getter. (no CVSS)
- [CVE-2021-46330](https://cve.now/CVE-2021-46330.md): Moddable SDK v11.5.0 was discovered to contain a SEGV vulnerability via xs/sources/xsDataView.c in fx\_ArrayBuffer\_prototype\_concat. (no CVSS)
- [CVE-2021-46327](https://cve.now/CVE-2021-46327.md): Moddable SDK v11.5.0 was discovered to contain a SEGV vulnerability via xs/sources/xsArray.c in fx\_Array\_prototype\_sort. (no CVSS)
- [CVE-2021-46328](https://cve.now/CVE-2021-46328.md): Moddable SDK v11.5.0 was discovered to contain a heap-buffer-overflow via the component \_\_libc\_start\_main. (no CVSS)
- [CVE-2021-46329](https://cve.now/CVE-2021-46329.md): Moddable SDK v11.5.0 was discovered to contain a SEGV vulnerability via the component \_fini. (no CVSS)
- [CVE-2021-46326](https://cve.now/CVE-2021-46326.md): Moddable SDK v11.5.0 was discovered to contain a heap-buffer-overflow via the component \_\_asan\_memcpy. (no CVSS)
- [CVE-2021-46325](https://cve.now/CVE-2021-46325.md): Espruino 2v10.246 was discovered to contain a stack buffer overflow via src/jsutils.c in vcbprintf. (no CVSS)
- [CVE-2021-46324](https://cve.now/CVE-2021-46324.md): Espruino 2v11.251 was discovered to contain a stack buffer overflow via src/jsvar.c in jsvNewFromString. (no CVSS)
- [CVE-2021-46323](https://cve.now/CVE-2021-46323.md): Espruino 2v11.251 was discovered to contain a SEGV vulnerability via src/jsinteractive.c in jsiGetDeviceFromClass. (no CVSS)
- [CVE-2021-29785](https://cve.now/CVE-2021-29785.md): IBM Security SOAR V42 and V43could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP St (CVSS 5.9, IBM Security SOAR)
- [CVE-2021-46061](https://cve.now/CVE-2021-46061.md): An SQL Injection vulnerability exists in Sourcecodester Computer and Mobile Repair Shop Management system (RSMS) 1.0 via the code parameter (no CVSS)
- [CVE-2021-44090](https://cve.now/CVE-2021-44090.md): An SQL Injection vulnerability exists in Sourcecodester Online Reviewer System 1.0 via the password parameter. (no CVSS)
- [CVE-2021-44245](https://cve.now/CVE-2021-44245.md): An SQL Injection vulnerability exists in Courcecodester COVID 19 Testing Management System (CTMS) 1.0 via the (1) username and (2) contactno (no CVSS)
- [CVE-2021-44244](https://cve.now/CVE-2021-44244.md): An SQL Injection vulnerabiity exists in Sourcecodester Logistic Hub Parcel's Management System 1.0 via the username parameter in login.php. (no CVSS)
- [CVE-2022-23120](https://cve.now/CVE-2022-23120.md): A code injection vulnerability in Trend Micro Deep Security and Cloud One - Workload Security Agent for Linux version 20 and below could all (no CVSS, Trend Micro Deep Security Agent for Linux)
- [CVE-2022-23119](https://cve.now/CVE-2022-23119.md): A directory traversal vulnerability in Trend Micro Deep Security and Cloud One - Workload Security Agent for Linux version 20 and below coul (no CVSS, Trend Micro Deep Security Agent for Linux)
- [CVE-2021-44092](https://cve.now/CVE-2021-44092.md): An SQL Injection vulnerability exists in code-projects Pharmacy Management 1.0 via the username parameter in the administer login form. (no CVSS)
- [CVE-2021-44091](https://cve.now/CVE-2021-44091.md): A Cross-Site Scripting (XSS) vulnerability exists in Courcecodester Multi Restaurant Table Reservation System 1.0 in register.php via the (1 (no CVSS)
- [CVE-2022-0219](https://cve.now/CVE-2022-0219.md): Improper Restriction of XML External Entity Reference in skylot/jadx (CVSS 5.5, skylot/jadx · io.github.skylot:jadx-core)
- [CVE-2021-44829](https://cve.now/CVE-2021-44829.md): Cross Site Scripting (XSS) vulnerability exists in index.html in AFI WebACMS through 2.1.0 via the the ID parameter. (no CVSS)
- [CVE-2021-44734](https://cve.now/CVE-2021-44734.md): Embedded web server input sanitization vulnerability in Lexmark devices through 2021-12-07, which can which can lead to remote code executio (no CVSS)
- [CVE-2021-44736](https://cve.now/CVE-2021-44736.md): The initial admin account setup wizard on Lexmark devices allow unauthenticated access to the “out of service erase” feature. (no CVSS)
- [CVE-2021-44735](https://cve.now/CVE-2021-44735.md): Embedded web server command injection vulnerability in Lexmark devices through 2021-12-07. (no CVSS)
- [CVE-2021-44737](https://cve.now/CVE-2021-44737.md): PJL directory traversal vulnerability in Lexmark devices through 2021-12-07 that can be leveraged to overwrite internal configuration files. (no CVSS)
- [CVE-2021-44738](https://cve.now/CVE-2021-44738.md): Buffer overflow vulnerability has been identified in Lexmark devices through 2021-12-07 in postscript interpreter. (no CVSS)
- [CVE-2022-0285](https://cve.now/CVE-2022-0285.md): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (CVSS 6.6, pimcore/pimcore)
- [CVE-2021-32039](https://cve.now/CVE-2021-32039.md): MongoDB Extension for VS Code may unexpectedly store credentials locally in clear text (CVSS 5.5, MongoDB for VS Code)
- [CVE-2022-22820](https://cve.now/CVE-2022-22820.md): Due to the lack of media file checks before rendering, it was possible for an attacker to cause abnormal CPU consumption for message recipie (no CVSS, LINE for Windows)
- [CVE-2021-34600](https://cve.now/CVE-2021-34600.md): Telenot complex: Insecure AES Key Generation (CVSS 5.5, Telenot Electronic CompasX)
- [CVE-2022-0282](https://cve.now/CVE-2022-0282.md): Cross-site Scripting in microweber/microweber (CVSS 4.3, microweber/microweber)
- [CVE-2022-0281](https://cve.now/CVE-2022-0281.md): Exposure of Sensitive Information to an Unauthorized Actor in microweber/microweber (CVSS 7.5, microweber/microweber)
- [CVE-2021-3866](https://cve.now/CVE-2021-3866.md): Cross-site Scripting (XSS) - Stored in zulip/zulip (CVSS 6.8, zulip/zulip)
- [CVE-2022-22733](https://cve.now/CVE-2022-22733.md): Access-Token in ElasticJob UI causes password disclosure (no CVSS, Apache Software Foundation Apache ShardingSphere ElasticJob…)
- [CVE-2021-45230](https://cve.now/CVE-2021-45230.md): Apache Airflow: Creating DagRuns didn't respect Dag-level permissions in the Webserver (no CVSS, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2022-0278](https://cve.now/CVE-2022-0278.md): Cross-site Scripting (XSS) - Stored in microweber/microweber (CVSS 7.2, microweber/microweber)
- [CVE-2021-43269](https://cve.now/CVE-2021-43269.md): In Code42 app before 8.8.0, eval injection allows an attacker to change a device’s proxy configuration to use a malicious proxy auto-config (no CVSS)
- [CVE-2021-45417](https://cve.now/CVE-2021-45417.md): AIDE before 0.17.4 allows local users to obtain root privileges via crafted file metadata (such as XFS extended attributes or tmpfs ACLs), b (no CVSS)
- [CVE-2021-46322](https://cve.now/CVE-2021-46322.md): Duktape v2.99.99 was discovered to contain a SEGV vulnerability via the component duk\_push\_tval in duktape/duk\_api\_stack.c. (no CVSS)
- [CVE-2022-0277](https://cve.now/CVE-2022-0277.md): Incorrect Permission Assignment for Critical Resource in microweber/microweber (CVSS 6.5, microweber/microweber)
- [CVE-2022-21658](https://cve.now/CVE-2022-21658.md): Race condition in std::fs::remove\_dir\_all in rustlang (CVSS 7.3, rust-lang rust)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-01-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.