# CVEs published 2022-01-21

79 CVEs were published on January 21, 2022: 1 critical, 17 high. Days are UTC.

- [CVE-2022-21708](https://cve.now/CVE-2022-21708.md): Denial of Service in graphql-go (CVSS 6.5, graph-gophers graphql-go · github.com/graph-gophers/graphql…)
- [CVE-2022-21707](https://cve.now/CVE-2022-21707.md): Incorrect Authorization in wasmCloud (CVSS 6.3, wasmcloud-otp)
- [CVE-2022-23366](https://cve.now/CVE-2022-23366.md): HMS v1.0 was discovered to contain a SQL injection vulnerability via patientlogin.php. (no CVSS)
- [CVE-2022-23365](https://cve.now/CVE-2022-23365.md): HMS v1.0 was discovered to contain a SQL injection vulnerability via doctorlogin.php. (no CVSS)
- [CVE-2022-23364](https://cve.now/CVE-2022-23364.md): HMS v1.0 was discovered to contain a SQL injection vulnerability via adminlogin.php. (no CVSS)
- [CVE-2022-23363](https://cve.now/CVE-2022-23363.md): Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via index.php. (no CVSS)
- [CVE-2021-39480](https://cve.now/CVE-2021-39480.md): Bingrep v0.8.5 was discovered to contain a memory allocation failure which can cause a Denial of Service (DoS). (no CVSS, bingrep)
- [CVE-2021-46313](https://cve.now/CVE-2021-46313.md): The binary MP4Box in GPAC v1.0.1 was discovered to contain a segmentation fault via the function \_\_memmove\_avx\_unaligned\_erms (). (no CVSS)
- [CVE-2021-46311](https://cve.now/CVE-2021-46311.md): A NULL pointer dereference vulnerability exists in GPAC v1.1.0 via the function gf\_sg\_destroy\_routes () at scenegraph/vrml\_route.c. (no CVSS)
- [CVE-2021-46244](https://cve.now/CVE-2021-46244.md): A Divide By Zero vulnerability exists in HDF5 v1.13.1-1 vis the function H5T\_\_complete\_copy () at /hdf5/src/H5T.c. (no CVSS)
- [CVE-2021-46242](https://cve.now/CVE-2021-46242.md): HDF5 v1.13.1-1 was discovered to contain a heap-use-after free via the component H5AC\_unpin\_entry. (no CVSS)
- [CVE-2021-46243](https://cve.now/CVE-2021-46243.md): An untrusted pointer dereference vulnerability exists in HDF5 v1.13.1-1 via the function H5O\_\_dtype\_decode\_helper () at hdf5/src/H5Odtype.c. (no CVSS)
- [CVE-2021-46240](https://cve.now/CVE-2021-46240.md): A NULL pointer dereference vulnerability exists in GPAC v1.1.0 via the function gf\_dump\_vrml\_sffield () at scene\_manager/scene\_dump.c. (no CVSS)
- [CVE-2021-46239](https://cve.now/CVE-2021-46239.md): The binary MP4Box in GPAC v1.1.0 was discovered to contain an invalid free vulnerability via the function gf\_free () at utils/alloc.c. (no CVSS)
- [CVE-2021-46238](https://cve.now/CVE-2021-46238.md): GPAC v1.1.0 was discovered to contain a stack overflow via the function gf\_node\_get\_name () at scenegraph/base\_scenegraph.c. (no CVSS)
- [CVE-2021-46237](https://cve.now/CVE-2021-46237.md): An untrusted pointer dereference vulnerability exists in GPAC v1.1.0 via the function gf\_node\_unregister () at scenegraph/base\_scenegraph.c. (no CVSS)
- [CVE-2021-46236](https://cve.now/CVE-2021-46236.md): A NULL pointer dereference vulnerability exists in GPAC v1.1.0 via the function gf\_sg\_vrml\_field\_pointer\_del () at scenegraph/vrml\_tools.c. (no CVSS)
- [CVE-2021-46234](https://cve.now/CVE-2021-46234.md): A NULL pointer dereference vulnerability exists in GPAC v1.1.0 via the function gf\_node\_unregister () at scenegraph/base\_scenegraph.c. (no CVSS)
- [CVE-2022-22553](https://cve.now/CVE-2022-22553.md): Dell EMC AppSync versions 3.9 to 4.3 contain an Improper Restriction of Excessive Authentication Attempts Vulnerability that can be exploite (CVSS 8.1, Dell AppSync)
- [CVE-2022-22552](https://cve.now/CVE-2022-22552.md): Dell EMC AppSync versions 3.9 to 4.3 contain a clickjacking vulnerability in AppSync. (CVSS 6.9, Dell AppSync)
- [CVE-2022-22551](https://cve.now/CVE-2022-22551.md): DELL EMC AppSync versions 3.9 to 4.3 use GET request method with sensitive query strings. (CVSS 8.3, Dell AppSync)
- [CVE-2021-36339](https://cve.now/CVE-2021-36339.md): The Dell EMC Virtual Appliances before 9.2.2.2 contain undocumented user accounts. (CVSS 7.8, Dell Solutions Enabler vApp)
- [CVE-2021-36338](https://cve.now/CVE-2021-36338.md): Unisphere for PowerMax versions prior to 9.2.2.2 contains a privilege escalation vulnerability. (CVSS 6.3, Dell Unisphere for PowerMax)
- [CVE-2021-23518](https://cve.now/CVE-2021-23518.md): Prototype Pollution (CVSS 7.3, cached-path-relative)
- [CVE-2021-23631](https://cve.now/CVE-2021-23631.md): Directory Traversal (CVSS 7.5, convert-svg-core · convert-svg-to-png +1)
- [CVE-2021-23460](https://cve.now/CVE-2021-23460.md): Prototype Pollution (CVSS 7.5, min-dash · org.webjars.npm:min-dash)
- [CVE-2021-23664](https://cve.now/CVE-2021-23664.md): Server-side Request Forgery (SSRF) (CVSS 8.6, @isomorphic-git/cors-proxy)
- [CVE-2021-40595](https://cve.now/CVE-2021-40595.md): SQL injection vulnerability in Sourcecodester Online Leave Management System v1 by oretnom23, allows attackers to execute arbitrary SQL comm (no CVSS)
- [CVE-2021-40247](https://cve.now/CVE-2021-40247.md): SQL injection vulnerability in Sourcecodester Budget and Expense Tracker System v1 by oretnom23, allows attackers to execute arbitrary SQL c (no CVSS)
- [CVE-2021-33966](https://cve.now/CVE-2021-33966.md): Cross site scripting (XSS) vulnerability in spotweb 1.4.9, allows authenticated attackers to execute arbitrary code via crafted GET request (no CVSS)
- [CVE-2021-40691](https://cve.now/CVE-2021-40691.md): A session hijack risk was identified in the Shibboleth authentication plugin. (no CVSS, moodle · moodle/moodle)
- [CVE-2021-40695](https://cve.now/CVE-2021-40695.md): It was possible for a student to view their quiz grade before it had been released, using a quiz web service. (no CVSS, moodle · moodle/moodle)
- [CVE-2021-40692](https://cve.now/CVE-2021-40692.md): Insufficient capability checks made it possible for teachers to download users outside of their courses. (no CVSS, moodle · moodle/moodle)
- [CVE-2021-40693](https://cve.now/CVE-2021-40693.md): An authentication bypass risk was identified in the external database authentication functionality, due to a type juggling vulnerability. (no CVSS, moodle · moodle/moodle)
- [CVE-2021-41835](https://cve.now/CVE-2021-41835.md): Fresenius Kabi Agilia Connect Infusion System use of a broken or risky cryptographic algorithm (CVSS 7.3, Fresenius Kabi Agilia Link+)
- [CVE-2021-43355](https://cve.now/CVE-2021-43355.md): Fresenius Kabi Agilia Connect Infusion System use of client side authentication (CVSS 7.3, Fresenius Kabi Vigilant Software Suite)
- [CVE-2021-33848](https://cve.now/CVE-2021-33848.md): Fresenius Kabi Agilia Connect Infusion System cross site scripting (CVSS 5.4, Fresenius Kabi Vigilant Software Suite)
- [CVE-2021-44464](https://cve.now/CVE-2021-44464.md): Fresenius Kabi Agilia Connect Infusion System hard coded credentials (CVSS 6.3, Fresenius Kabi Vigilant Software Suite)
- [CVE-2021-33843](https://cve.now/CVE-2021-33843.md): Fresenius Kabi Agilia Connect Infusion System files or directories accessible to external parties (CVSS 5.3, Fresenius Kabi Agilia Connect WiFi)
- [CVE-2021-31562](https://cve.now/CVE-2021-31562.md): Fresenius Kabi Agilia Connect Infusion System use of a broken or risky cryptographic algorithm (CVSS 6.5, Fresenius Kabi Agilia Link+)
- [CVE-2021-23207](https://cve.now/CVE-2021-23207.md): Fresenius Kabi Agilia Connect Infusion System plaintext storage of a password (CVSS 6.5, Fresenius Kabi Vigilant Software Suite · Fresenius Kabi Agi…)
- [CVE-2021-23195](https://cve.now/CVE-2021-23195.md): Fresenius Kabi Agilia Connect Infusion System exposure of information through directory listing (CVSS 5.3, Fresenius Kabi Vigilant Software Suite)
- [CVE-2021-23233](https://cve.now/CVE-2021-23233.md): Fresenius Kabi Agilia Connect Infusion System (CVSS 7.3, Fresenius Kabi Agilia Link+)
- [CVE-2021-33846](https://cve.now/CVE-2021-33846.md): Fresenius Kabi Agilia Connect Infusion System use of a broken or risky cryptographic algorithm (CVSS 5.9, Fresenius Kabi Vigilant Software Suite)
- [CVE-2021-23196](https://cve.now/CVE-2021-23196.md): Fresenius Kabi Agilia Connect Infusion System insufficiently protected credentials (CVSS 7.3, Fresenius Kabi Agilia Link+)
- [CVE-2021-23236](https://cve.now/CVE-2021-23236.md): Fresenius Kabi Agilia Connect Infusion System uncontrolled resource consumption (CVSS 7.5, Fresenius Kabi Agilia Link+)
- [CVE-2021-40694](https://cve.now/CVE-2021-40694.md): Insufficient escaping of the LaTeX preamble made it possible for site administrators to read files available to the HTTP server system accou (no CVSS, moodle · moodle/moodle)
- [CVE-2022-23128](https://cve.now/CVE-2022-23128.md): Incomplete List of Disallowed Inputs vulnerability in Mitsubishi Electric MC Works64 versions 4.00A (10.95.201.23) to 4.04E (10.95.210.01), (no CVSS, Mitsubishi Electric MC Works64; ICONICS GENESIS64; ICONICS…)
- [CVE-2022-23127](https://cve.now/CVE-2022-23127.md): Cross-site Scripting vulnerability in Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior and ICONICS MobileHMI versions (no CVSS, Mitsubishi Electric MC Works64; ICONICS MobileHMI)
- [CVE-2022-23129](https://cve.now/CVE-2022-23129.md): Plaintext Storage of a Password vulnerability in Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior and ICONICS GENESIS6 (no CVSS, Mitsubishi Electric MC Works64; ICONICS GENESIS64)
- [CVE-2022-23130](https://cve.now/CVE-2022-23130.md): Buffer Over-read vulnerability in Mitsubishi Electric MC Works64 versions 4.00A to 4.04E, Mitsubishi Electric GENESIS64 versions 10.97 and p (CVSS 5.9, Mitsubishi Electric GENESIS64 · Mitsubishi Electric Icon… +5)
- [CVE-2022-23728](https://cve.now/CVE-2022-23728.md): Attacker can reset the device with AT Command in the process of rebooting the device. (no CVSS, LG mobile devices)
- [CVE-2021-4032](https://cve.now/CVE-2021-4032.md): A vulnerability was found in the Linux kernel's KVM subsystem in arch/x86/kvm/lapic.c kvm\_free\_lapic when a failure allocation was detected. (no CVSS, kernel)
- [CVE-2021-44593](https://cve.now/CVE-2021-44593.md): Simple College Website 1.0 is vulnerable to unauthenticated file upload & remote code execution via UNION-based SQL injection in the usernam (no CVSS)
- [CVE-2022-0323](https://cve.now/CVE-2022-0323.md): Improper Neutralization of Special Elements Used in a Template Engine in bobthecow/mustache.php (CVSS 5.3, bobthecow/mustache.php · mustache/mustache)
- [CVE-2021-4016](https://cve.now/CVE-2021-4016.md): Rapid7 Insight Agent Improper Access Control (CVSS 4.0, Rapid7 Insight Agent)
- [CVE-2020-4879](https://cve.now/CVE-2020-4879.md): IBM Cognos Controller 10.4.0, 10.4.1, and 10.4.2 could allow a remote attacker to bypass security restrictions, caused by improper validatio (CVSS 7.3, IBM Cognos Controller)
- [CVE-2020-4877](https://cve.now/CVE-2020-4877.md): IBM Cognos Controller 10.4.0, 10.4.1, and 10.4.2 could be vulnerable to unauthorized modifications by using public fields in public classes. (CVSS 7.3, IBM Cognos Controller)
- [CVE-2020-4876](https://cve.now/CVE-2020-4876.md): IBM Cognos Controller 10.4.0, 10.4.1, and 10.4.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. (CVSS 7.1, IBM Cognos Controller)
- [CVE-2020-4875](https://cve.now/CVE-2020-4875.md): IBM Cognos Controller 10.4.0, 10.4.1, and 10.4.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. (CVSS 7.1, IBM Cognos Controller)
- [CVE-2021-46309](https://cve.now/CVE-2021-46309.md): An SQL Injection vulnerability exists in Sourcecodester Employee and Visitor Gate Pass Logging System 1.0 via the username parameter. (no CVSS)
- [CVE-2021-46308](https://cve.now/CVE-2021-46308.md): An SQL Injection vulnerability exists in Sourcecodester Online Railway Reservation Sysytem 1.0 via the sid parameter. (no CVSS)
- [CVE-2021-46307](https://cve.now/CVE-2021-46307.md): An SQL Injection vulnerability exists in Projectworlds Online Examination System 1.0 via the eid parameter in account.php. (no CVSS)
- [CVE-2021-46201](https://cve.now/CVE-2021-46201.md): An SQL Injection vulnerability exists in Sourcecodester Online Resort Management System 1.0 via the id parameterv in /orms/ node. (no CVSS)
- [CVE-2021-35004](https://cve.now/CVE-2021-35004.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-Link TL-WA1201 1.0.1 Build 20200709 rel (CVSS 8.8, TP-Link TL-WA1201)
- [CVE-2021-35003](https://cve.now/CVE-2021-35003.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-Link Archer C90 1.0.6 Build 20200114 re (CVSS 9.8, TP-Link Archer C90)
- [CVE-2021-46200](https://cve.now/CVE-2021-46200.md): An SQL Injection vulnerability exists in Sourcecodester Simple Music Clour Community System 1.0 via the email parameter in /music/ajax.php. (no CVSS)
- [CVE-2021-40855](https://cve.now/CVE-2021-40855.md): The EU Technical Specifications for Digital COVID Certificates before 1.1 mishandle certificate governance. (no CVSS)
- [CVE-2021-46198](https://cve.now/CVE-2021-46198.md): An SQL Injection vulnerability exists in Sourceodester Courier Management System 1.0 via the email parameter in /cms/ajax.php app. (no CVSS)
- [CVE-2020-19861](https://cve.now/CVE-2020-19861.md): When a zone file in ldns 1.7.1 is parsed, the function ldns\_nsec3\_salt\_data is too trusted for the length value obtained from the zone file. (no CVSS)
- [CVE-2020-19860](https://cve.now/CVE-2020-19860.md): When ldns version 1.7.1 verifies a zone file, the ldns\_rr\_new\_frm\_str\_internal function has a heap out of bounds read vulnerability. (no CVSS)
- [CVE-2020-19858](https://cve.now/CVE-2020-19858.md): Platinum Upnp SDK through 1.2.0 has a directory traversal vulnerability. (no CVSS)
- [CVE-2022-21933](https://cve.now/CVE-2022-21933.md): ASUS VivoMini/Mini PC - improper input validation (CVSS 6.7, ASUS VC65-C1 · ASUS PB60V +11)
- [CVE-2022-0326](https://cve.now/CVE-2022-0326.md): NULL Pointer Dereference in mruby/mruby (CVSS 5.5, mruby/mruby)
- [CVE-2021-4001](https://cve.now/CVE-2021-4001.md): A race condition was found in the Linux kernel's ebpf verifier between bpf\_map\_update\_elem and bpf\_map\_freeze due to a missing lock in kerne (no CVSS, kernel)
- [CVE-2022-0318](https://cve.now/CVE-2022-0318.md): Heap-based Buffer Overflow in vim/vim (CVSS 6.6, vim/vim)
- [CVE-2022-0319](https://cve.now/CVE-2022-0319.md): Out-of-bounds Read in vim/vim (CVSS 5.5, vim/vim)
- [CVE-2022-23220](https://cve.now/CVE-2022-23220.md): USBView 2.1 before 2.2 allows some local users (e.g., ones logged in via SSH) to execute arbitrary code as root because certain Polkit setti (no CVSS)
- [CVE-2022-23837](https://cve.now/CVE-2022-23837.md): In api.rb in Sidekiq before 5.2.10 and 6.4.0, there is no limit on the number of days when requesting stats for the graph. (no CVSS, sidekiq)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-01-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.