# CVEs published 2022-01-24

78 CVEs were published on January 24, 2022: 1 critical, 6 high. Days are UTC.

- [CVE-2021-43394](https://cve.now/CVE-2021-43394.md): Unisys OS 2200 Messaging Integration Services (NTSI) 7R3B IC3 and IC4, 7R3C, and 7R3D has an Incorrect Implementation of an Authentication A (no CVSS)
- [CVE-2022-22554](https://cve.now/CVE-2022-22554.md): Dell EMC System Update, version 1.9.2 and prior, contain an Unprotected Storage of Credentials vulnerability. (CVSS 8.2, DellEMC System Update - DSU)
- [CVE-2021-43589](https://cve.now/CVE-2021-43589.md): Dell EMC Unity, Dell EMC UnityVSA and Dell EMC Unity XT versions prior to 5.1.2.0.5.007 contain an operating system (OS) command injection V (CVSS 6.0, Dell Unity)
- [CVE-2021-43588](https://cve.now/CVE-2021-43588.md): Dell EMC Data Protection Central version 19.5 contains an Improper Input Validation Vulnerability. (CVSS 4.3, Dell Data Protection Central)
- [CVE-2021-36349](https://cve.now/CVE-2021-36349.md): Dell EMC Data Protection Central versions 19.5 and prior contain a Server Side Request Forgery vulnerability in the DPC DNS client processin (CVSS 4.3, Dell Data Protection Central)
- [CVE-2021-36343](https://cve.now/CVE-2021-36343.md): Dell BIOS contains an improper input validation vulnerability. (CVSS 7.5, Dell CPG BIOS)
- [CVE-2021-36342](https://cve.now/CVE-2021-36342.md): Dell BIOS contains an improper input validation vulnerability. (CVSS 7.5, Dell CPG BIOS)
- [CVE-2021-45224](https://cve.now/CVE-2021-45224.md): An issue was discovered in COINS Construction Cloud 11.12. (no CVSS)
- [CVE-2021-45225](https://cve.now/CVE-2021-45225.md): An issue was discovered in COINS Construction Cloud 11.12. (no CVSS)
- [CVE-2021-45226](https://cve.now/CVE-2021-45226.md): An issue was discovered in COINS Construction Cloud 11.12. (no CVSS)
- [CVE-2021-45223](https://cve.now/CVE-2021-45223.md): An issue was discovered in COINS Construction Cloud 11.12. (no CVSS)
- [CVE-2021-45222](https://cve.now/CVE-2021-45222.md): An issue was discovered in COINS Construction Cloud 11.12. (no CVSS)
- [CVE-2022-21715](https://cve.now/CVE-2022-21715.md): Cross-site Scripting Vulnerability in CodeIgniter4 (CVSS 5.4, CodeIgniter4 · codeigniter4/framework)
- [CVE-2022-21711](https://cve.now/CVE-2022-21711.md): Out-of-bounds Read lead to application crashes or information leakage in ELF parsing. (CVSS 7.1, liyansong2018 elfspirit)
- [CVE-2022-21710](https://cve.now/CVE-2022-21710.md): Cross-site Scripting in ShortDescription extension (CVSS 4.7, StarCitizenTools mediawiki-extensions-ShortDescription)
- [CVE-2020-17383](https://cve.now/CVE-2020-17383.md): A directory traversal vulnerability on Telos Z/IP One devices through 4.0.0r grants an unauthenticated individual root level access to the d (no CVSS)
- [CVE-2021-46451](https://cve.now/CVE-2021-46451.md): An SQL Injection vulnerabilty exists in Sourcecodester Online Project Time Management System 1.0 via the pid parameter in the load\_file func (no CVSS)
- [CVE-2021-43420](https://cve.now/CVE-2021-43420.md): SQL injection vulnerability in Login.php in Sourcecodester Online Payment Hub v1 by oretnom23, allows attackers to execute arbitrary SQL com (no CVSS)
- [CVE-2021-41928](https://cve.now/CVE-2021-41928.md): SQL injection in Sourcecodester Try My Recipe (Recipe Sharing Website - CMS) 1.0 by oretnom23, allows attackers to execute arbitrary code vi (no CVSS)
- [CVE-2021-42168](https://cve.now/CVE-2021-42168.md): Cross Site Scripting (XSS) in Sourcecodester Try My Recipe (Recipe Sharing Website - CMS) by oretnom23, allows attackers to gain the PHPSESI (no CVSS)
- [CVE-2021-35005](https://cve.now/CVE-2021-35005.md): This vulnerability allows local attackers to disclose sensitive information on affected installations of TeamViewer. (CVSS 3.3, TeamViewer)
- [CVE-2022-23126](https://cve.now/CVE-2022-23126.md): TeslaMate before 1.25.1 (when using the default Docker configuration) allows attackers to open doors of Tesla vehicles, start Keyless Drivin (no CVSS)
- [CVE-2021-41930](https://cve.now/CVE-2021-41930.md): Cross site scripting (XSS) vulnerability in Sourcecodester Online Covid Vaccination Scheduler System v1 by oretnom23, allows attackers to ex (no CVSS)
- [CVE-2021-41929](https://cve.now/CVE-2021-41929.md): Cross Site Scripting (XSS) in Sourcecodester The Electric Billing Management System 1.0 by oretnom23, allows attackers to execute arbitrary (no CVSS)
- [CVE-2021-41660](https://cve.now/CVE-2021-41660.md): SQL injection vulnerability in Sourcecodester Patient Appointment Scheduler System v1 by oretnom23, allows attackers to execute arbitrary SQ (no CVSS)
- [CVE-2021-41659](https://cve.now/CVE-2021-41659.md): SQL injection vulnerability in Sourcecodester Banking System v1 by oretnom23, allows attackers to execute arbitrary SQL commands via the use (no CVSS)
- [CVE-2021-41658](https://cve.now/CVE-2021-41658.md): Cross Site Scripting (XSS) in Sourcecodester Student Quarterly Grading System by oretnom23, allows attackers to execute arbitrary code via t (no CVSS)
- [CVE-2021-4088](https://cve.now/CVE-2021-4088.md): Blind SQL injection in DLP ePO extension (CVSS 8.4, McAfee Data Loss Prevention (DLP) ePO Extension)
- [CVE-2021-41472](https://cve.now/CVE-2021-41472.md): SQL injection vulnerability in Sourcecodester Simple Membership System v1 by oretnom23, allows attackers to execute arbitrary SQL commands v (no CVSS)
- [CVE-2021-41471](https://cve.now/CVE-2021-41471.md): SQL injection vulnerability in Sourcecodester South Gate Inn Online Reservation System v1 by oretnom23, allows attackers to execute arbitrar (no CVSS)
- [CVE-2021-40909](https://cve.now/CVE-2021-40909.md): Cross site scripting (XSS) vulnerability in sourcecodester PHP CRUD without Refresh/Reload using Ajax and DataTables Tutorial v1 by oretnom2 (no CVSS)
- [CVE-2021-40908](https://cve.now/CVE-2021-40908.md): SQL injection vulnerability in Login.php in Sourcecodester Purchase Order Management System v1 by oretnom23, allows attackers to execute arb (no CVSS)
- [CVE-2021-40907](https://cve.now/CVE-2021-40907.md): SQL injection vulnerability in Sourcecodester Storage Unit Rental Management System v1 by oretnom23, allows attackers to execute arbitrary S (no CVSS)
- [CVE-2021-40596](https://cve.now/CVE-2021-40596.md): SQL injection vulnerability in Login.php in sourcecodester Online Learning System v2 by oretnom23, allows attackers to execute arbitrary SQL (no CVSS)
- [CVE-2022-22296](https://cve.now/CVE-2022-22296.md): Sourcecodester Hospital's Patient Records Management System 1.0 is vulnerable to Insecure Permissions via the id parameter in manage\_user en (no CVSS)
- [CVE-2021-44981](https://cve.now/CVE-2021-44981.md): In QuickBox Pro v2.5.8 and below, the config.php file has a variable which takes a GET parameter value and parses it into a shell\_exec(''); (no CVSS)
- [CVE-2022-0269](https://cve.now/CVE-2022-0269.md): Cross-Site Request Forgery (CSRF) in yetiforcecompany/yetiforcecrm (CVSS 8.0, yetiforcecompany/yetiforcecrm · yetiforce/yetiforce-crm)
- [CVE-2021-25083](https://cve.now/CVE-2021-25083.md): Registrations for the Events Calendar \< 2.7.10 - Reflected Cross-Site Scripting (no CVSS, Registrations for the Events Calendar – Event Registration…)
- [CVE-2021-25080](https://cve.now/CVE-2021-25080.md): Contact Form Entries \< 1.1.7 - Unauthenticated Stored Cross-Site Scripting (no CVSS, Contact Form Entries – Contact Form 7, WPforms and more)
- [CVE-2021-25079](https://cve.now/CVE-2021-25079.md): Contact Form Entries \< 1.2.4 - Reflected Cross-Site Scripting (no CVSS, Contact Form Entries – Contact Form 7, WPforms and more)
- [CVE-2021-25078](https://cve.now/CVE-2021-25078.md): Affiliates Manager \< 2.9.0 - Unauthenticated Stored Cross-Site Scripting (no CVSS, Affiliates Manager)
- [CVE-2021-25076](https://cve.now/CVE-2021-25076.md): WP User Frontend \< 3.5.26 - SQL Injection to Reflected Cross-Site Scripting (no CVSS, WP User Frontend – Membership, Profile, Registration & Post…)
- [CVE-2021-25074](https://cve.now/CVE-2021-25074.md): WebP Converter for Media \< 4.0.3 - Unauthenticated Open redirect (no CVSS, WebP Converter for Media – Convert WebP and AVIF & Optimize…)
- [CVE-2021-25073](https://cve.now/CVE-2021-25073.md): WP125 \< 1.5.5 - Arbitrary Ad Deletion via CSRF (no CVSS, WP125)
- [CVE-2021-25062](https://cve.now/CVE-2021-25062.md): Orders Tracking for WooCommerce \< 1.1.10 - Reflected Cross-Site Scripting (no CVSS, Orders Tracking for WooCommerce)
- [CVE-2021-25049](https://cve.now/CVE-2021-25049.md): Mobile Events Manager \< 1.4.4 - Admin+ Stored Cross-Site Scripting (no CVSS, Mobile Events Manager)
- [CVE-2021-25045](https://cve.now/CVE-2021-25045.md): Asgaros Forum \< 1.15.15 - Admin+ SQL Injection via forum\_id (no CVSS, Asgaros Forum)
- [CVE-2021-25035](https://cve.now/CVE-2021-25035.md): Backup and Staging by WP Time Capsule \< 1.22.7 - Reflected Cross-Site Scripting (no CVSS, Backup and Staging by WP Time Capsule)
- [CVE-2021-25031](https://cve.now/CVE-2021-25031.md): Image Hover Effects Ultimate \< 9.7.1 - Reflected Cross-Site Scripting (no CVSS, Image Hover Effects Ultimate)
- [CVE-2021-25028](https://cve.now/CVE-2021-25028.md): Event Tickets \< 5.2.2 - Open Redirect (no CVSS, Event Tickets)
- [CVE-2021-25017](https://cve.now/CVE-2021-25017.md): Tutor LMS \< 1.9.12 - Reflected Cross-Site Scripting (no CVSS, Tutor LMS – eLearning and online course solution)
- [CVE-2021-25015](https://cve.now/CVE-2021-25015.md): myCred \< 2.4 - Reflected Cross-Site Scripting (no CVSS, myCred – Points, Rewards, Gamification, Ranks, Badges & Loy…)
- [CVE-2021-25013](https://cve.now/CVE-2021-25013.md): Qubely \< 1.7.8 - Subscriber+ Arbitrary Post Deletion (no CVSS, Qubely – Advanced Gutenberg Blocks)
- [CVE-2021-25008](https://cve.now/CVE-2021-25008.md): Code Snippets \< 2.14.3 - Reflected Cross-Site Scripting (no CVSS, Code Snippets)
- [CVE-2021-24989](https://cve.now/CVE-2021-24989.md): Accept Donations with PayPal \< 1.3.4 - Arbitrary Post Deletion via CSRF (no CVSS, Accept Donations with PayPal)
- [CVE-2021-24985](https://cve.now/CVE-2021-24985.md): Easy Forms for Mailchimp \< 6.8.6 - Reflected Cross-Site Scripting (no CVSS, Easy Forms for Mailchimp)
- [CVE-2021-24976](https://cve.now/CVE-2021-24976.md): Smart SEO Tool \< 3.0.6 - Reflected Cross-Site Scripting (no CVSS, Smart SEO Tool – SEO优化插件)
- [CVE-2021-24974](https://cve.now/CVE-2021-24974.md): Product Feed PRO for WooCommerce \< 11.0.7 - Subscriber+ Settings Update to Stored XSS (no CVSS, Product Feed PRO for WooCommerce)
- [CVE-2021-24968](https://cve.now/CVE-2021-24968.md): Ultimate FAQ \< 2.1.2 - Subscriber+ Arbitrary FAQ Creation (no CVSS, Ultimate FAQ – WordPress FAQ and Accordion Plugin)
- [CVE-2021-24965](https://cve.now/CVE-2021-24965.md): Five Star Restaurant Reservations \< 2.4.8 - Subscriber+ Stored Cross-Site Scripting (no CVSS, Five Star Restaurant Reservations – WordPress Booking Plugin)
- [CVE-2021-24936](https://cve.now/CVE-2021-24936.md): WP Extra File Types \< 0.5.1 - CSRF to Stored Cross-Site Scripting (no CVSS, WP Extra File Types)
- [CVE-2021-24923](https://cve.now/CVE-2021-24923.md): Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue \< 3.1.25 - Reflected XSS (no CVSS, Newsletter, SMTP, Email marketing and Subscribe forms by Se…)
- [CVE-2021-24906](https://cve.now/CVE-2021-24906.md): Protect WP Admin \< 3.6.2 - Unauthenticated Plugin Deactivation (no CVSS, Protect WP Admin)
- [CVE-2021-24865](https://cve.now/CVE-2021-24865.md): Advanced Custom Fields: Extended \< 0.8.8.7 - Admin+ SQL Injection (no CVSS, Advanced Custom Fields: Extended)
- [CVE-2021-24858](https://cve.now/CVE-2021-24858.md): WP Cookie User Info \< 1.0.9 - Admin+ SQL Injection (no CVSS, Cookie Notification Plugin for WordPress – WP Cookie User I…)
- [CVE-2021-24733](https://cve.now/CVE-2021-24733.md): WP Post Page Clone \< 1.2 - Unauthorised Post Access (no CVSS, WP Post Page Clone)
- [CVE-2021-24696](https://cve.now/CVE-2021-24696.md): Simple Download Monitor \< 3.9.9 - Multiple CSRF (no CVSS, Simple Download Monitor)
- [CVE-2021-24694](https://cve.now/CVE-2021-24694.md): Simple Download Monitor \< 3.9.11 - Contributor+ Stored Cross-Site Scripting via Shortcodes (no CVSS, Simple Download Monitor)
- [CVE-2021-24423](https://cve.now/CVE-2021-24423.md): UpdraftPlus \< 1.16.59 - Admin+ Stored Cross-Site Scripting (no CVSS, UpdraftPlus WordPress Backup Plugin)
- [CVE-2022-23858](https://cve.now/CVE-2022-23858.md): A flaw was found in the REST API. (no CVSS)
- [CVE-2022-23857](https://cve.now/CVE-2022-23857.md): model/criteria/criteria.go in Navidrome before 0.47.5 is vulnerable to SQL injection attacks when processing crafted Smart Playlists. (no CVSS, github.com/navidrome/navidrome)
- [CVE-2022-23855](https://cve.now/CVE-2022-23855.md): An issue was discovered in Saviynt Enterprise Identity Cloud (EIC) 5.5 SP2.x. (no CVSS)
- [CVE-2022-23856](https://cve.now/CVE-2022-23856.md): An issue was discovered in Saviynt Enterprise Identity Cloud (EIC) 5.5 SP2.x. (no CVSS)
- [CVE-2022-23852](https://cve.now/CVE-2022-23852.md): Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML\_GetBuffer, for configurations with a nonzero XML\_CONTEXT\_BYTES. (CVSS 9.8, platform/external/expat)
- [CVE-2021-30636](https://cve.now/CVE-2021-30636.md): In MediaTek LinkIt SDK before 4.6.1, there is a possible memory corruption due to an integer overflow during mishandled memory allocation by (no CVSS)
- [CVE-2021-26706](https://cve.now/CVE-2021-26706.md): An issue was discovered in lib\_mem.c in Micrium uC/OS uC/LIB 1.38.x and 1.39.00. (no CVSS)
- [CVE-2021-39293](https://cve.now/CVE-2021-39293.md): In archive/zip in Go before 1.16.8 and 1.17.x before 1.17.1, a crafted archive header (falsely designating that many files are present) can (no CVSS, stdlib)
- [CVE-2022-23437](https://cve.now/CVE-2022-23437.md): Infinite loop within Apache XercesJ xml parser (no CVSS, Apache Software Foundation Apache Xerces · xerces:xercesImpl)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-01-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.