CVEs published January 21, 2022
79 CVEs were published on January 21, 2022: 1 critical, 17 high.
- Published
- 79
- Critical
- 1
- High
- 17
- Medium
- 18
- Low
- 0
- Unrated
- 43
- Now in CISA KEV
- 0
- Fix available
- 34
Most affected products
- Fresenius Kabi Agilia Link+
- 5
- Fresenius Kabi Vigilant Software Suite
- 5
- moodle · moodle/moodle
- 5
- IBM Cognos Controller
- 4
- Dell AppSync
- 3
- kernel
- 2
- vim/vim
- 2
- @isomorphic-git/cors-proxy
- 1
- ASUS VC65-C1 · ASUS PB60V +11
- 1
- bingrep
- 1
Critical 1
High 17
- CVE-2022-22553Dell EMC AppSync versions 3.9 to 4.3 contain an Improper Restriction of Excessive Authentication Attempts Vulnerability that can be exploiteDell AppSync
- CVE-2022-22551DELL EMC AppSync versions 3.9 to 4.3 use GET request method with sensitive query strings.Dell AppSync
- CVE-2021-36339The Dell EMC Virtual Appliances before 9.2.2.2 contain undocumented user accounts.Dell Solutions Enabler vApp
- CVE-2021-23518Prototype Pollutioncached-path-relative
- CVE-2021-23631Directory Traversalconvert-svg-core · convert-svg-to-png +1
- CVE-2021-23460Prototype Pollutionmin-dash · org.webjars.npm:min-dash
- CVE-2021-23664Server-side Request Forgery (SSRF)@isomorphic-git/cors-proxy
- CVE-2021-41835Fresenius Kabi Agilia Connect Infusion System use of a broken or risky cryptographic algorithmFresenius Kabi Agilia Link+
- CVE-2021-43355Fresenius Kabi Agilia Connect Infusion System use of client side authenticationFresenius Kabi Vigilant Software Suite
- CVE-2021-23233Fresenius Kabi Agilia Connect Infusion System Fresenius Kabi Agilia Link+
- CVE-2021-23196Fresenius Kabi Agilia Connect Infusion System insufficiently protected credentialsFresenius Kabi Agilia Link+
- CVE-2021-23236Fresenius Kabi Agilia Connect Infusion System uncontrolled resource consumptionFresenius Kabi Agilia Link+
- CVE-2020-4879IBM Cognos Controller 10.4.0, 10.4.1, and 10.4.2 could allow a remote attacker to bypass security restrictions, caused by improper validatioIBM Cognos Controller
- CVE-2020-4877IBM Cognos Controller 10.4.0, 10.4.1, and 10.4.2 could be vulnerable to unauthorized modifications by using public fields in public classes.IBM Cognos Controller
- CVE-2020-4876IBM Cognos Controller 10.4.0, 10.4.1, and 10.4.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data.IBM Cognos Controller
- CVE-2020-4875IBM Cognos Controller 10.4.0, 10.4.1, and 10.4.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data.IBM Cognos Controller
- CVE-2021-35004This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-Link TL-WA1201 1.0.1 Build 20200709 relTP-Link TL-WA1201
Medium, low and unrated 61
- CVE-2022-21708Denial of Service in graphql-gograph-gophers graphql-go · github.com/graph-gophers/graphql…
- CVE-2022-21707Incorrect Authorization in wasmCloudwasmcloud-otp
- CVE-2022-23366HMS v1.0 was discovered to contain a SQL injection vulnerability via patientlogin.php.
- CVE-2022-23365HMS v1.0 was discovered to contain a SQL injection vulnerability via doctorlogin.php.
- CVE-2022-23364HMS v1.0 was discovered to contain a SQL injection vulnerability via adminlogin.php.
- CVE-2022-23363Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via index.php.
- CVE-2021-39480Bingrep v0.8.5 was discovered to contain a memory allocation failure which can cause a Denial of Service (DoS).bingrep
- CVE-2021-46313The binary MP4Box in GPAC v1.0.1 was discovered to contain a segmentation fault via the function __memmove_avx_unaligned_erms ().
- CVE-2021-46311A NULL pointer dereference vulnerability exists in GPAC v1.1.0 via the function gf_sg_destroy_routes () at scenegraph/vrml_route.c.
- CVE-2021-46244A Divide By Zero vulnerability exists in HDF5 v1.13.1-1 vis the function H5T__complete_copy () at /hdf5/src/H5T.c.
- CVE-2021-46242HDF5 v1.13.1-1 was discovered to contain a heap-use-after free via the component H5AC_unpin_entry.
- CVE-2021-46243An untrusted pointer dereference vulnerability exists in HDF5 v1.13.1-1 via the function H5O__dtype_decode_helper () at hdf5/src/H5Odtype.c.
- CVE-2021-46240A NULL pointer dereference vulnerability exists in GPAC v1.1.0 via the function gf_dump_vrml_sffield () at scene_manager/scene_dump.c.
- CVE-2021-46239The binary MP4Box in GPAC v1.1.0 was discovered to contain an invalid free vulnerability via the function gf_free () at utils/alloc.c.
- CVE-2021-46238GPAC v1.1.0 was discovered to contain a stack overflow via the function gf_node_get_name () at scenegraph/base_scenegraph.c.
- CVE-2021-46237An untrusted pointer dereference vulnerability exists in GPAC v1.1.0 via the function gf_node_unregister () at scenegraph/base_scenegraph.c.
- CVE-2021-46236A NULL pointer dereference vulnerability exists in GPAC v1.1.0 via the function gf_sg_vrml_field_pointer_del () at scenegraph/vrml_tools.c.
- CVE-2021-46234A NULL pointer dereference vulnerability exists in GPAC v1.1.0 via the function gf_node_unregister () at scenegraph/base_scenegraph.c.
- CVE-2022-22552Dell EMC AppSync versions 3.9 to 4.3 contain a clickjacking vulnerability in AppSync.Dell AppSync
- CVE-2021-36338Unisphere for PowerMax versions prior to 9.2.2.2 contains a privilege escalation vulnerability.Dell Unisphere for PowerMax
- CVE-2021-40595SQL injection vulnerability in Sourcecodester Online Leave Management System v1 by oretnom23, allows attackers to execute arbitrary SQL comm
- CVE-2021-40247SQL injection vulnerability in Sourcecodester Budget and Expense Tracker System v1 by oretnom23, allows attackers to execute arbitrary SQL c
- CVE-2021-33966Cross site scripting (XSS) vulnerability in spotweb 1.4.9, allows authenticated attackers to execute arbitrary code via crafted GET request
- CVE-2021-40691A session hijack risk was identified in the Shibboleth authentication plugin.moodle · moodle/moodle
- CVE-2021-40695It was possible for a student to view their quiz grade before it had been released, using a quiz web service.moodle · moodle/moodle
- CVE-2021-40692Insufficient capability checks made it possible for teachers to download users outside of their courses.moodle · moodle/moodle
- CVE-2021-40693An authentication bypass risk was identified in the external database authentication functionality, due to a type juggling vulnerability.moodle · moodle/moodle
- CVE-2021-33848Fresenius Kabi Agilia Connect Infusion System cross site scriptingFresenius Kabi Vigilant Software Suite
- CVE-2021-44464Fresenius Kabi Agilia Connect Infusion System hard coded credentialsFresenius Kabi Vigilant Software Suite
- CVE-2021-33843Fresenius Kabi Agilia Connect Infusion System files or directories accessible to external partiesFresenius Kabi Agilia Connect WiFi
- CVE-2021-31562Fresenius Kabi Agilia Connect Infusion System use of a broken or risky cryptographic algorithmFresenius Kabi Agilia Link+
- CVE-2021-23207Fresenius Kabi Agilia Connect Infusion System plaintext storage of a passwordFresenius Kabi Vigilant Software Suite · Fresenius Kabi Agi…
- CVE-2021-23195Fresenius Kabi Agilia Connect Infusion System exposure of information through directory listingFresenius Kabi Vigilant Software Suite
- CVE-2021-33846Fresenius Kabi Agilia Connect Infusion System use of a broken or risky cryptographic algorithmFresenius Kabi Vigilant Software Suite
- CVE-2021-40694Insufficient escaping of the LaTeX preamble made it possible for site administrators to read files available to the HTTP server system accoumoodle · moodle/moodle
- CVE-2022-23128Incomplete List of Disallowed Inputs vulnerability in Mitsubishi Electric MC Works64 versions 4.00A (10.95.201.23) to 4.04E (10.95.210.01), Mitsubishi Electric MC Works64; ICONICS GENESIS64; ICONICS…
- CVE-2022-23127Cross-site Scripting vulnerability in Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior and ICONICS MobileHMI versions Mitsubishi Electric MC Works64; ICONICS MobileHMI
- CVE-2022-23129Plaintext Storage of a Password vulnerability in Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior and ICONICS GENESIS6Mitsubishi Electric MC Works64; ICONICS GENESIS64
- CVE-2022-23130Buffer Over-read vulnerability in Mitsubishi Electric MC Works64 versions 4.00A to 4.04E, Mitsubishi Electric GENESIS64 versions 10.97 and pMitsubishi Electric GENESIS64 · Mitsubishi Electric Icon… +5
- CVE-2022-23728Attacker can reset the device with AT Command in the process of rebooting the device.LG mobile devices
- CVE-2021-4032A vulnerability was found in the Linux kernel's KVM subsystem in arch/x86/kvm/lapic.c kvm_free_lapic when a failure allocation was detected.kernel
- CVE-2021-44593Simple College Website 1.0 is vulnerable to unauthenticated file upload & remote code execution via UNION-based SQL injection in the usernam
- CVE-2022-0323Improper Neutralization of Special Elements Used in a Template Engine in bobthecow/mustache.phpbobthecow/mustache.php · mustache/mustache
- CVE-2021-4016Rapid7 Insight Agent Improper Access ControlRapid7 Insight Agent
- CVE-2021-46309An SQL Injection vulnerability exists in Sourcecodester Employee and Visitor Gate Pass Logging System 1.0 via the username parameter.
- CVE-2021-46308An SQL Injection vulnerability exists in Sourcecodester Online Railway Reservation Sysytem 1.0 via the sid parameter.
- CVE-2021-46307An SQL Injection vulnerability exists in Projectworlds Online Examination System 1.0 via the eid parameter in account.php.
- CVE-2021-46201An SQL Injection vulnerability exists in Sourcecodester Online Resort Management System 1.0 via the id parameterv in /orms/ node.
- CVE-2021-46200An SQL Injection vulnerability exists in Sourcecodester Simple Music Clour Community System 1.0 via the email parameter in /music/ajax.php.
- CVE-2021-40855The EU Technical Specifications for Digital COVID Certificates before 1.1 mishandle certificate governance.
- CVE-2021-46198An SQL Injection vulnerability exists in Sourceodester Courier Management System 1.0 via the email parameter in /cms/ajax.php app.
- CVE-2020-19861When a zone file in ldns 1.7.1 is parsed, the function ldns_nsec3_salt_data is too trusted for the length value obtained from the zone file.
- CVE-2020-19860When ldns version 1.7.1 verifies a zone file, the ldns_rr_new_frm_str_internal function has a heap out of bounds read vulnerability.
- CVE-2020-19858Platinum Upnp SDK through 1.2.0 has a directory traversal vulnerability.
- CVE-2022-21933ASUS VivoMini/Mini PC - improper input validationASUS VC65-C1 · ASUS PB60V +11
- CVE-2022-0326NULL Pointer Dereference in mruby/mrubymruby/mruby
- CVE-2021-4001A race condition was found in the Linux kernel's ebpf verifier between bpf_map_update_elem and bpf_map_freeze due to a missing lock in kernekernel
- CVE-2022-0318Heap-based Buffer Overflow in vim/vimvim/vim
- CVE-2022-0319Out-of-bounds Read in vim/vimvim/vim
- CVE-2022-23220USBView 2.1 before 2.2 allows some local users (e.g., ones logged in via SSH) to execute arbitrary code as root because certain Polkit setti
- CVE-2022-23837In api.rb in Sidekiq before 5.2.10 and 6.4.0, there is no limit on the number of days when requesting stats for the graph.sidekiq