CVEs published January 25, 2022
102 CVEs were published on January 25, 2022: 2 critical, 13 high.
- Published
- 102
- Critical
- 2
- High
- 13
- Medium
- 11
- Low
- 0
- Unrated
- 76
- Now in CISA KEV
- 0
- Fix available
- 27
Most affected products
- BIG-IP
- 14
- Apache Software Foundation Apache ShenYu · org.apache.sheny…
- 4
- Dell VNX Control Station
- 4
- moodle · moodle/moodle
- 4
- BIG-IP AFM
- 3
- Integrated Dell Remote Access Controller
- 3
- Parallels Desktop
- 3
- xen
- 3
- Inventor
- 2
- adodb/adodb · adodb/adodb-php
- 1
Critical 2
High 13
- CVE-2021-36296Dell VNX2 OE for File versions 8.1.21.266 and earlier, contain an authenticated remote code execution vulnerability.Dell VNX Control Station
- CVE-2021-36295Dell VNX2 OE for File versions 8.1.21.266 and earlier, contain an authenticated remote code execution vulnerability.Dell VNX Control Station
- CVE-2021-36289Dell VNX2 OE for File versions 8.1.21.266 and earlier, contain a sensitive information disclosure vulnerability.Dell VNX Control Station
- CVE-2021-43799RabbitMQ exposes ports with weak default secrets in Zulip Serverzulip
- CVE-2022-0270Improper header sanitization in bored-agent causes escalation of privilegeMirantis bored-agent
- CVE-2021-39031IBM WebSphere Application Server - Liberty 17.0.0.3 through 22.0.0.1 could allow a remote authenticated attacker to conduct an LDAP injectioIBM WebSphere Application Server Liberty
- CVE-2021-34869This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3-49160.Parallels Desktop
- CVE-2021-34868This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3-49160.Parallels Desktop
- CVE-2021-34867This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3-49160.Parallels Desktop
- CVE-2021-34866This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel 5.14-rc3.Linux Kernel · :linux_kernel:
- CVE-2021-34865This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of multiple NETGEAR routers.NETGEAR Multiple Routers
- CVE-2021-43863SQL Injection in FileContentProvider (GHSL-2021-1007)nextcloud android
- CVE-2022-0351Access of Memory Location Before Start of Buffer in vim/vimvim/vim
Medium, low and unrated 87
- CVE-2021-36348iDRAC9 versions prior to 5.00.20.00 contain an input injection vulnerability.Integrated Dell Remote Access Controller
- CVE-2021-36347iDRAC9 versions prior to 5.00.20.00 and iDRAC8 versions prior to 2.82.82.82 contain a stack-based buffer overflow vulnerability.Integrated Dell Remote Access Controller
- CVE-2021-36346Dell iDRAC 8 prior to version 2.82.82.82 contain a denial of service vulnerability.Integrated Dell Remote Access Controller
- CVE-2022-23258Microsoft Edge for Android Spoofing VulnerabilityMicrosoft Edge for Android
- CVE-2021-41598UI misrepresentation of granted permissions in GitHub Enterprise Server leading to unauthorized access to userGitHub Enterprise Server
- CVE-2022-23029On BIG-IP version 16.x before 16.1.0, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.4, and all versions of 13.1.x, 12.1.x, and 11.6.x, when aBIG-IP
- CVE-2022-23028On BIG-IP AFM version 16.x before 16.1.0, 15.1.x before 15.1.5, 14.1.x before 14.1.4.5, and all versions of 13.1.x, when global AFM SYN cookBIG-IP AFM
- CVE-2022-23030On version 16.1.x before 16.1.2, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.5, and all versions of 13.1.x, when the BIG-IP Virtual EditionBIG-IP
- CVE-2022-23032In all versions before 7.2.1.4, when proxy settings are configured in the network access resource of a BIG-IP APM system, connecting BIG-IP BIG-IP Edge Client for Mac and Windows
- CVE-2022-23031On BIG-IP FPS, ASM, and Advanced WAF versions 16.1.x before 16.1.1, 15.1.x before 15.1.4, and 14.1.x before 14.1.4.4, an XML External EntityBIG-IP FPS, ASM, and Advanced WAF
- CVE-2022-23027On BIG-IP versions 15.1.x before 15.1.4, 14.1.x before 14.1.4.4, 13.1.x beginning in 13.1.3.6, 12.1.5.3-12.1.6, and 11.6.5.2, when a FastL4 BIG-IP
- CVE-2022-23019On BIG-IP version 16.1.x before 16.1.2, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.4, and all versions of 13.1.x and 12.1.x, when a messagBIG-IP
- CVE-2022-23021On BIG-IP version 16.1.x before 16.1.2, when any of the following configurations are configured on a virtual server, undisclosed requests caBIG-IP
- CVE-2022-23020On BIG-IP version 16.1.x before 16.1.2, when the 'Respond on Error' setting is enabled on the Request Logging profile and configured on a viBIG-IP
- CVE-2022-23025On BIG-IP version 16.1.x before 16.1.1, 15.1.x before 15.1.4, 14.1.x before 14.1.4.4, and all versions of 13.1.x, when a SIP ALG profile is BIG-IP
- CVE-2022-23023On BIG-IP version 16.1.x before 16.1.2.1, 15.1.x before 15.1.5, 14.1.x before 14.1.4.5, and all versions of 13.1.x and 12.1.x, and BIG-IQ alBIG-IP & BIG-IQ
- CVE-2022-23024On BIG-IP AFM version 16.x before 16.1.0, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.2, and all versions of 13.1.x, when the IPsec applicaBIG-IP AFM
- CVE-2022-23022On BIG-IP version 16.1.x before 16.1.2, when an HTTP profile is configured on a virtual server, undisclosed requests can cause the Traffic MBIG-IP
- CVE-2022-23026On BIG-IP ASM & Advanced WAF version 16.1.x before 16.1.2, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.5, and all versions of 13.1.x and 12BIG-IP ASM & Advanced WAF
- CVE-2022-23017On BIG-IP version 16.x before 16.1.0, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.5, and all versions of 13.1.x, when a virtual server is cBIG-IP
- CVE-2022-23018On BIG-IP AFM version 16.1.x before 16.1.2, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.5, and 13.1.x beginning in 13.1.3.4, when a virtualBIG-IP AFM
- CVE-2022-23013On BIG-IP DNS & GTM version 16.x before 16.1.0, 15.1.x before 15.1.4, 14.1.x before 14.1.4.4, and all versions of 13.1.x, 12.1.x, and 11.6.xBIG-IP DNS & GTM
- CVE-2022-23012On BIG-IP versions 15.1.x before 15.1.4.1 and 14.1.x before 14.1.4.5, when the HTTP/2 profile is configured on a virtual server, undisclosedBIG-IP
- CVE-2022-23015On BIG-IP versions 16.x before 16.1.0, 15.1.x before 15.1.4.1, and 14.1.2.6-14.1.4.4, when a Client SSL profile is configured on a virtual sBIG-IP
- CVE-2022-23016On versions 16.1.x before 16.1.2 and 15.1.x before 15.1.4.1, when BIG-IP SSL Forward Proxy with TLS 1.3 is configured on a virtual server, uBIG-IP
- CVE-2022-23014On versions 16.1.x before 16.1.2 and 15.1.x before 15.1.4.1, when BIG-IP APM portal access is configured on a virtual server, undisclosed reBIG-IP APM
- CVE-2022-23011On certain hardware BIG-IP platforms, in version 15.1.x before 15.1.4 and 14.1.x before 14.1.3, virtual servers may stop responding while prBIG-IP
- CVE-2022-23008On NGINX Controller API Management versions 3.18.0-3.19.0, an authenticated attacker with access to the "user" or "admin" role can use undisNGINX Controller API Management
- CVE-2022-23010On BIG-IP versions 16.x before 16.1.0, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.4, and all versions of 13.1.x, 12.1.x, and 11.6.x, when BIG-IP
- CVE-2022-23009On BIG-IQ Centralized Management 8.x before 8.1.0, an authenticated administrative role user on a BIG-IQ managed BIG-IP device can access otBIG-IQ Centralized Management
- CVE-2021-43298The code that performs password matching when using 'Basic' HTTP authentication does not use a constant-time memcmp and has no rate-limitingembedthis goahead
- CVE-2021-45729WordPress WP Google Map plugin <= 1.8.0 - Privilege Escalation vulnerabilityWP Google Map
- CVE-2021-40337OWASP Related Vulnerabilities in Hitachi Energy’s LinkOne ProductHitachi Energy LinkOne
- CVE-2021-4145A NULL pointer dereference issue was found in the block mirror layer of QEMU in versions prior to 6.2.0.QEMU
- CVE-2021-4133A flaw was found in Keycloak in versions from 12.0.0 and before 15.1.1 which allows an attacker with any existing user account to create newKeycloak · org.keycloak:keycloak-services
- CVE-2022-0335A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions.moodle · moodle/moodle
- CVE-2022-0333A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions.moodle · moodle/moodle
- CVE-2022-0334A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions.moodle · moodle/moodle
- CVE-2022-0332A flaw was found in Moodle in versions 3.11 to 3.11.4.moodle · moodle/moodle
- CVE-2022-22789Charactell - FormStorm Enterprise Account Take OverCharactell FormStorm Enterprise
- CVE-2021-38129Escalation of privileges vulnerability in Micro Focus in Micro Focus Operations Agent, affecting versions 12.x up to and including 12.21.Micro Focus Operations Agent.
- CVE-2021-40167A malicious crafted dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by reaAutodesk® Design Review
- CVE-2021-46087In jfinal_cms >= 5.1 0, there is a storage XSS vulnerability in the background system of CMS.
- CVE-2021-46085OneBlog <= 2.2.8 is vulnerable to Insecure Permissions.
- CVE-2021-46083uscat, as of 2021-12-28, is vulnerable to Cross Site Scripting (XSS) via the input box of the statistical code.
- CVE-2021-46084uscat, as of 2021-12-28, is vulnerable to Cross Site Scripting (XSS) via "close registration information" input box.
- CVE-2021-46086xzs-mysql >= t3.4.0 is vulnerable to Insecure Permissions.
- CVE-2021-34870This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of NETGEAR XR1000 1.0.0.52_NETGEAR XR1000
- CVE-2021-46034A problem was found in ForestBlog, as of 2021-12-29, there is a XSS vulnerability that can be injected through the nickname input box.
- CVE-2021-46033In ForestBlog, as of 2021-12-28, File upload can bypass verification.
- CVE-2021-46089In JeecgBoot 3.0, there is a SQL injection vulnerability that can operate the database with root privileges.org.jeecgframework.boot:jeecg-boot-base · org.jeecgframewor…
- CVE-2022-21697SSRF vulnerability (requires authentication)jupyterhub jupyter-server-proxy · jupyter-server-proxy
- CVE-2022-23035Insufficient cleanup of passed-through device IRQs The management of IRQs associated with physical devices exposed to x86 HVM guests involvexen
- CVE-2022-23034A PV guest could DoS Xen while unmapping a grant To address XSA-380, reference counting was introduced for grant mappings for the case wherexen
- CVE-2022-23033arm: guest_physmap_remove_page not removing the p2m mappings The functions to remove one or more entries from a guest p2m pagetable on Arm (xen
- CVE-2021-45847Several missing input validations in the 3MF parser component of Slic3r libslic3r 1.3.0 can each allow an attacker to cause an application c
- CVE-2021-45846A flaw in the AMF parser of Slic3r libslic3r 1.3.0 allows an attacker to cause an application crash using a crafted AMF document, where a me
- CVE-2022-23945Apache ShenYu missing authentication allows gateway registrationApache Software Foundation Apache ShenYu · org.apache.sheny…
- CVE-2022-23944Apache ShenYu 2.4.1 Improper access controlApache Software Foundation Apache ShenYu · org.apache.sheny…
- CVE-2022-23223Apache ShenYu Password leakageApache Software Foundation Apache ShenYu · org.apache.sheny…
- CVE-2021-45029Apache ShenYu 2.4.1 Groovy Code Injection & SpEL InjectionApache Software Foundation Apache ShenYu · org.apache.sheny…
- CVE-2021-46113In MartDevelopers KEA-Hotel-ERP open source as of 12-31-2021, a remote code execution vulnerability can be exploited by uploading PHP files
- CVE-2021-45803MartDevelopers iResturant 1.0 is vulnerable to SQL Injection.
- CVE-2021-45802MartDevelopers iResturant 1.0 is vulnerable to SQL Injection.
- CVE-2021-45845The Path Sanity Check script of FreeCAD 0.19 is vulnerable to OS command injection, allowing an attacker to execute arbitrary commands via a
- CVE-2021-45844Improper sanitization in the invocation of ODA File Converter from FreeCAD 0.19 allows an attacker to inject OS commands via a crafted filen
- CVE-2021-45340In Libsixel prior to and including v1.10.3, a NULL pointer dereference in the stb_image.h component of libsixel allows attackers to cause a
- CVE-2022-0268Cross-site Scripting (XSS) - Stored in getgrav/gravgetgrav/grav
- CVE-2022-0338Insertion of Sensitive Information into Log File in delgan/logurudelgan/loguru · loguru
- CVE-2022-23935lib/Image/ExifTool.pm in ExifTool before 12.38 mishandles a $file =~ /\|$/ check, leading to command injection.
- CVE-2021-46483Jsish v3.5.0 was discovered to contain a heap buffer overflow via BooleanConstructor at src/jsiBool.c.
- CVE-2021-46481Jsish v3.5.0 was discovered to contain a memory leak via linenoise at src/linenoise.c.
- CVE-2021-46482Jsish v3.5.0 was discovered to contain a heap buffer overflow via NumberConstructor at src/jsiNumber.c.
- CVE-2021-46480Jsish v3.5.0 was discovered to contain a heap buffer overflow via jsiValueObjDelete in src/jsiEval.c.
- CVE-2021-46478Jsish v3.5.0 was discovered to contain a heap buffer overflow via jsiClearStack in src/jsiEval.c.
- CVE-2021-46475Jsish v3.5.0 was discovered to contain a heap buffer overflow via jsi_ArraySliceCmd in src/jsiArray.c.
- CVE-2021-46477Jsish v3.5.0 was discovered to contain a heap buffer overflow via RegExp_constructor in src/jsiRegexp.c.
- CVE-2021-46474Jsish v3.5.0 was discovered to contain a heap buffer overflow via jsiEvalCodeSub in src/jsiEval.c.
- CVE-2021-44994There is an Assertion ''JERRY_CONTEXT (jmem_heap_allocated_size) == 0'' failed at /jerry-core/jmem/jmem-heap.c in Jerryscript 3.0.0.
- CVE-2021-44993There is an Assertion ''ecma_is_value_boolean (base_value)'' failed at /jerry-core/ecma/operations/ecma-get-put-value.c in Jerryscript 3.0.0
- CVE-2021-44992There is an Assertion ''ecma_object_is_typedarray (obj_p)'' failed at /jerry-core/ecma/operations/ecma-typedarray-object.c in Jerryscript 3.
- CVE-2021-44988Jerryscript v3.0.0 and below was discovered to contain a stack overflow via ecma_find_named_property in ecma-helpers.c.
- CVE-2021-40158A maliciously crafted JT file in Autodesk Inventor 2022, 2021, 2020, 2019 and AutoCAD 2022 may be forced to read beyond allocated boundariesInventor
- CVE-2021-40159An Information Disclosure vulnerability for JT files in Autodesk Inventor 2022, 2021, 2020, 2019 in conjunction with other vulnerabilities mInventor
- CVE-2021-45341A buffer overflow vulnerability in CDataMoji of the jwwlib component of LibreCAD 2.2.0-rc3 and older allows an attacker to achieve Remote Co
- CVE-2021-45342A buffer overflow vulnerability in CDataList of the jwwlib component of LibreCAD 2.2.0-rc3 and older allows an attacker to achieve Remote Co
- CVE-2021-45343In LibreCAD 2.2.0, a NULL pointer dereference in the HATCH handling of libdxfrw allows an attacker to crash the application using a crafted