CVEs published January 24, 2022
78 CVEs were published on January 24, 2022: 1 critical, 6 high.
- Published
- 78
- Critical
- 1
- High
- 6
- Medium
- 5
- Low
- 1
- Unrated
- 65
- Now in CISA KEV
- 0
- Fix available
- 46
Most affected products
- Contact Form Entries – Contact Form 7, WPforms and more
- 2
- Dell CPG BIOS
- 2
- Dell Data Protection Central
- 2
- Simple Download Monitor
- 2
- Accept Donations with PayPal
- 1
- Advanced Custom Fields: Extended
- 1
- Affiliates Manager
- 1
- Apache Software Foundation Apache Xerces · xerces:xercesImpl
- 1
- Asgaros Forum
- 1
- Backup and Staging by WP Time Capsule
- 1
Critical 1
High 6
- CVE-2022-22554Dell EMC System Update, version 1.9.2 and prior, contain an Unprotected Storage of Credentials vulnerability.DellEMC System Update - DSU
- CVE-2021-36343Dell BIOS contains an improper input validation vulnerability.Dell CPG BIOS
- CVE-2021-36342Dell BIOS contains an improper input validation vulnerability.Dell CPG BIOS
- CVE-2022-21711Out-of-bounds Read lead to application crashes or information leakage in ELF parsing.liyansong2018 elfspirit
- CVE-2021-4088Blind SQL injection in DLP ePO extensionMcAfee Data Loss Prevention (DLP) ePO Extension
- CVE-2022-0269Cross-Site Request Forgery (CSRF) in yetiforcecompany/yetiforcecrmyetiforcecompany/yetiforcecrm · yetiforce/yetiforce-crm
Medium, low and unrated 71
- CVE-2021-43394Unisys OS 2200 Messaging Integration Services (NTSI) 7R3B IC3 and IC4, 7R3C, and 7R3D has an Incorrect Implementation of an Authentication A
- CVE-2021-43589Dell EMC Unity, Dell EMC UnityVSA and Dell EMC Unity XT versions prior to 5.1.2.0.5.007 contain an operating system (OS) command injection VDell Unity
- CVE-2021-43588Dell EMC Data Protection Central version 19.5 contains an Improper Input Validation Vulnerability.Dell Data Protection Central
- CVE-2021-36349Dell EMC Data Protection Central versions 19.5 and prior contain a Server Side Request Forgery vulnerability in the DPC DNS client processinDell Data Protection Central
- CVE-2021-45224An issue was discovered in COINS Construction Cloud 11.12.
- CVE-2021-45225An issue was discovered in COINS Construction Cloud 11.12.
- CVE-2021-45226An issue was discovered in COINS Construction Cloud 11.12.
- CVE-2021-45223An issue was discovered in COINS Construction Cloud 11.12.
- CVE-2021-45222An issue was discovered in COINS Construction Cloud 11.12.
- CVE-2022-21715Cross-site Scripting Vulnerability in CodeIgniter4CodeIgniter4 · codeigniter4/framework
- CVE-2022-21710Cross-site Scripting in ShortDescription extensionStarCitizenTools mediawiki-extensions-ShortDescription
- CVE-2020-17383A directory traversal vulnerability on Telos Z/IP One devices through 4.0.0r grants an unauthenticated individual root level access to the d
- CVE-2021-46451An SQL Injection vulnerabilty exists in Sourcecodester Online Project Time Management System 1.0 via the pid parameter in the load_file func
- CVE-2021-43420SQL injection vulnerability in Login.php in Sourcecodester Online Payment Hub v1 by oretnom23, allows attackers to execute arbitrary SQL com
- CVE-2021-41928SQL injection in Sourcecodester Try My Recipe (Recipe Sharing Website - CMS) 1.0 by oretnom23, allows attackers to execute arbitrary code vi
- CVE-2021-42168Cross Site Scripting (XSS) in Sourcecodester Try My Recipe (Recipe Sharing Website - CMS) by oretnom23, allows attackers to gain the PHPSESI
- CVE-2021-35005This vulnerability allows local attackers to disclose sensitive information on affected installations of TeamViewer.TeamViewer
- CVE-2022-23126TeslaMate before 1.25.1 (when using the default Docker configuration) allows attackers to open doors of Tesla vehicles, start Keyless Drivin
- CVE-2021-41930Cross site scripting (XSS) vulnerability in Sourcecodester Online Covid Vaccination Scheduler System v1 by oretnom23, allows attackers to ex
- CVE-2021-41929Cross Site Scripting (XSS) in Sourcecodester The Electric Billing Management System 1.0 by oretnom23, allows attackers to execute arbitrary
- CVE-2021-41660SQL injection vulnerability in Sourcecodester Patient Appointment Scheduler System v1 by oretnom23, allows attackers to execute arbitrary SQ
- CVE-2021-41659SQL injection vulnerability in Sourcecodester Banking System v1 by oretnom23, allows attackers to execute arbitrary SQL commands via the use
- CVE-2021-41658Cross Site Scripting (XSS) in Sourcecodester Student Quarterly Grading System by oretnom23, allows attackers to execute arbitrary code via t
- CVE-2021-41472SQL injection vulnerability in Sourcecodester Simple Membership System v1 by oretnom23, allows attackers to execute arbitrary SQL commands v
- CVE-2021-41471SQL injection vulnerability in Sourcecodester South Gate Inn Online Reservation System v1 by oretnom23, allows attackers to execute arbitrar
- CVE-2021-40909Cross site scripting (XSS) vulnerability in sourcecodester PHP CRUD without Refresh/Reload using Ajax and DataTables Tutorial v1 by oretnom2
- CVE-2021-40908SQL injection vulnerability in Login.php in Sourcecodester Purchase Order Management System v1 by oretnom23, allows attackers to execute arb
- CVE-2021-40907SQL injection vulnerability in Sourcecodester Storage Unit Rental Management System v1 by oretnom23, allows attackers to execute arbitrary S
- CVE-2021-40596SQL injection vulnerability in Login.php in sourcecodester Online Learning System v2 by oretnom23, allows attackers to execute arbitrary SQL
- CVE-2022-22296Sourcecodester Hospital's Patient Records Management System 1.0 is vulnerable to Insecure Permissions via the id parameter in manage_user en
- CVE-2021-44981In QuickBox Pro v2.5.8 and below, the config.php file has a variable which takes a GET parameter value and parses it into a shell_exec('');
- CVE-2021-25083Registrations for the Events Calendar < 2.7.10 - Reflected Cross-Site ScriptingRegistrations for the Events Calendar – Event Registration…
- CVE-2021-25080Contact Form Entries < 1.1.7 - Unauthenticated Stored Cross-Site ScriptingContact Form Entries – Contact Form 7, WPforms and more
- CVE-2021-25079Contact Form Entries < 1.2.4 - Reflected Cross-Site ScriptingContact Form Entries – Contact Form 7, WPforms and more
- CVE-2021-25078Affiliates Manager < 2.9.0 - Unauthenticated Stored Cross-Site ScriptingAffiliates Manager
- CVE-2021-25076WP User Frontend < 3.5.26 - SQL Injection to Reflected Cross-Site ScriptingWP User Frontend – Membership, Profile, Registration & Post…
- CVE-2021-25074WebP Converter for Media < 4.0.3 - Unauthenticated Open redirectWebP Converter for Media – Convert WebP and AVIF & Optimize…
- CVE-2021-25073WP125 < 1.5.5 - Arbitrary Ad Deletion via CSRFWP125
- CVE-2021-25062Orders Tracking for WooCommerce < 1.1.10 - Reflected Cross-Site ScriptingOrders Tracking for WooCommerce
- CVE-2021-25049Mobile Events Manager < 1.4.4 - Admin+ Stored Cross-Site ScriptingMobile Events Manager
- CVE-2021-25045Asgaros Forum < 1.15.15 - Admin+ SQL Injection via forum_idAsgaros Forum
- CVE-2021-25035Backup and Staging by WP Time Capsule < 1.22.7 - Reflected Cross-Site ScriptingBackup and Staging by WP Time Capsule
- CVE-2021-25031Image Hover Effects Ultimate < 9.7.1 - Reflected Cross-Site ScriptingImage Hover Effects Ultimate
- CVE-2021-25028Event Tickets < 5.2.2 - Open RedirectEvent Tickets
- CVE-2021-25017Tutor LMS < 1.9.12 - Reflected Cross-Site ScriptingTutor LMS – eLearning and online course solution
- CVE-2021-25015myCred < 2.4 - Reflected Cross-Site ScriptingmyCred – Points, Rewards, Gamification, Ranks, Badges & Loy…
- CVE-2021-25013Qubely < 1.7.8 - Subscriber+ Arbitrary Post DeletionQubely – Advanced Gutenberg Blocks
- CVE-2021-25008Code Snippets < 2.14.3 - Reflected Cross-Site ScriptingCode Snippets
- CVE-2021-24989Accept Donations with PayPal < 1.3.4 - Arbitrary Post Deletion via CSRFAccept Donations with PayPal
- CVE-2021-24985Easy Forms for Mailchimp < 6.8.6 - Reflected Cross-Site ScriptingEasy Forms for Mailchimp
- CVE-2021-24976Smart SEO Tool < 3.0.6 - Reflected Cross-Site ScriptingSmart SEO Tool – SEO优化插件
- CVE-2021-24974Product Feed PRO for WooCommerce < 11.0.7 - Subscriber+ Settings Update to Stored XSSProduct Feed PRO for WooCommerce
- CVE-2021-24968Ultimate FAQ < 2.1.2 - Subscriber+ Arbitrary FAQ CreationUltimate FAQ – WordPress FAQ and Accordion Plugin
- CVE-2021-24965Five Star Restaurant Reservations < 2.4.8 - Subscriber+ Stored Cross-Site ScriptingFive Star Restaurant Reservations – WordPress Booking Plugin
- CVE-2021-24936WP Extra File Types < 0.5.1 - CSRF to Stored Cross-Site ScriptingWP Extra File Types
- CVE-2021-24923Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue < 3.1.25 - Reflected XSSNewsletter, SMTP, Email marketing and Subscribe forms by Se…
- CVE-2021-24906Protect WP Admin < 3.6.2 - Unauthenticated Plugin DeactivationProtect WP Admin
- CVE-2021-24865Advanced Custom Fields: Extended < 0.8.8.7 - Admin+ SQL InjectionAdvanced Custom Fields: Extended
- CVE-2021-24858WP Cookie User Info < 1.0.9 - Admin+ SQL InjectionCookie Notification Plugin for WordPress – WP Cookie User I…
- CVE-2021-24733WP Post Page Clone < 1.2 - Unauthorised Post AccessWP Post Page Clone
- CVE-2021-24696Simple Download Monitor < 3.9.9 - Multiple CSRFSimple Download Monitor
- CVE-2021-24694Simple Download Monitor < 3.9.11 - Contributor+ Stored Cross-Site Scripting via ShortcodesSimple Download Monitor
- CVE-2021-24423UpdraftPlus < 1.16.59 - Admin+ Stored Cross-Site ScriptingUpdraftPlus WordPress Backup Plugin
- CVE-2022-23858A flaw was found in the REST API.
- CVE-2022-23857model/criteria/criteria.go in Navidrome before 0.47.5 is vulnerable to SQL injection attacks when processing crafted Smart Playlists.github.com/navidrome/navidrome
- CVE-2022-23855An issue was discovered in Saviynt Enterprise Identity Cloud (EIC) 5.5 SP2.x.
- CVE-2022-23856An issue was discovered in Saviynt Enterprise Identity Cloud (EIC) 5.5 SP2.x.
- CVE-2021-30636In MediaTek LinkIt SDK before 4.6.1, there is a possible memory corruption due to an integer overflow during mishandled memory allocation by
- CVE-2021-26706An issue was discovered in lib_mem.c in Micrium uC/OS uC/LIB 1.38.x and 1.39.00.
- CVE-2021-39293In archive/zip in Go before 1.16.8 and 1.17.x before 1.17.1, a crafted archive header (falsely designating that many files are present) can stdlib
- CVE-2022-23437Infinite loop within Apache XercesJ xml parserApache Software Foundation Apache Xerces · xerces:xercesImpl