CVEs published January 26, 2022
51 CVEs were published on January 26, 2022: 1 critical, 10 high. 1 is now in CISA KEV.
- Published
- 51
- Critical
- 1
- High
- 10
- Medium
- 12
- Low
- 1
- Unrated
- 27
- Now in CISA KEV
- 1
- Fix available
- 24
Most affected products
- IBM Security Guardium Insights
- 3
- icsharpcode sharpziplib · SharpZipLib
- 3
- net.mingsoft:ms-mcms
- 3
- vim/vim
- 3
- livehelperchat/livehelperchat · remdex/livehelperchat
- 2
- microweber/microweber
- 2
- Apache Software Foundation Apache Karaf · org.apache.karaf:…
- 1
- Apache Software Foundation Apache Karaf · org.apache.karaf.…
- 1
- crater-invoice/crater · bytefury/crater
- 1
- feross/simple-get · simple-get
- 1
Critical 1
High 10
- CVE-2021-32849Arbitrary command execution in Gerapygerapy
- CVE-2021-32840Path Traversal in SharpZipLibicsharpcode sharpziplib · SharpZipLib
- CVE-2022-23990Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.platform/external/expat
- CVE-2022-0378Cross-site Scripting (XSS) - Reflected in microweber/microwebermicroweber/microweber
- CVE-2022-0379Cross-site Scripting (XSS) - Stored in microweber/microwebermicroweber/microweber
- CVE-2022-0203Improper Access Control in crater-invoice/cratercrater-invoice/crater · bytefury/crater
- CVE-2022-0251Cross-site Scripting (XSS) - Stored in pimcore/pimcorepimcore/pimcore
- CVE-2022-21944watchman: chown in watchman@.socket unit allows symlink attackopenSUSE Backports SLE-15-SP3 · openSUSE Factory
- CVE-2022-0355Improper Removal of Sensitive Information Before Storage or Transfer in feross/simple-getfeross/simple-get · simple-get
- CVE-2022-0361Heap-based Buffer Overflow in vim/vimvim/vim
Medium, low and unrated 40
- CVE-2021-41166Permission bypass in Nextcloud Android Appnextcloud security-advisories
- CVE-2021-32841Path Traversal in SharpZipLibicsharpcode sharpziplib · SharpZipLib
- CVE-2021-32842Path Traversal in SharpZipLibicsharpcode sharpziplib · SharpZipLib
- CVE-2022-22852A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodtester Hospital's Patient Records Management System 1.0 via the descrip
- CVE-2021-46114jpress v 4.2.0 is vulnerable to RCE via io.jpress.module.product.ProductNotifyKit#doSendEmail.
- CVE-2021-46385https://gitee.com/mingSoft/MCMS MCMS <=5.2.5 is affected by: SQL Injection.net.mingsoft:ms-mcms
- CVE-2022-22850A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodtester Hospital's Patient Records Management System 1.0 via the descrip
- CVE-2022-23993/usr/local/www/pkg.php in pfSense CE before 2.6.0 and pfSense Plus before 22.01 uses $_REQUEST['pkg_filter'] in a PHP echo call, causing XSS
- CVE-2021-46561controller/org.controller/org.controller.js in the CVE Services API 1.1.1 before 5c50baf3bda28133a3bc90b854765a64fb538304 allows an organiza
- CVE-2021-29846IBM Security Guardium Insights 3.0 could allow an authenticated user to obtain sensitive information due to insufficient session expiration.IBM Security Guardium Insights
- CVE-2021-29845IBM Security Guardium Insights 3.0 could allow an authenticated user to perform unauthorized actions due to improper input validation.IBM Security Guardium Insights
- CVE-2021-29838IBM Security Guardium Insights 3.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HIBM Security Guardium Insights
- CVE-2021-46115jpress 4.2.0 is vulnerable to RCE via io.jpress.web.admin._TemplateController#doUploadFile.
- CVE-2021-46116jpress 4.2.0 is vulnerable to remote code execution via io.jpress.web.admin._TemplateController#doInstall.
- CVE-2021-46383https://gitee.com/mingSoft/MCMS MCMS <=5.2.5 is affected by: SQL Injection.net.mingsoft:ms-mcms
- CVE-2021-46118jpress 4.2.0 is vulnerable to remote code execution via io.jpress.module.article.kit.ArticleNotifyKit#doSendEmail.
- CVE-2022-22851A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodtester Hospital's Patient Records Management System 1.0 via the special
- CVE-2021-43334BuddyBoss Platform through 1.8.0 allows XSS via the Group Name or Group Description field.
- CVE-2021-44692BuddyBoss Platform through 1.8.0 allows remote attackers to obtain the email address of each user.
- CVE-2021-46117jpress 4.2.0 is vulnerable to remote code execution via io.jpress.module.page.PageNotifyKit#doSendEmail.
- CVE-2021-45975In ListCheck.exe in Acer Care Center 4.x before 4.00.3038, a vulnerability in the loading mechanism of Windows DLLs could allow a local atta
- CVE-2022-0362SQL Injection in star7th/showdocstar7th/showdoc · showdoc/showdoc
- CVE-2021-44123SPIP 4.0.0 is affected by a remote command execution vulnerability.
- CVE-2021-44122SPIP 4.0.0 is affected by a Cross Site Request Forgery (CSRF) vulnerability in ecrire/public/aiguiller.php, ecrire/public/balises.php, ecrir
- CVE-2021-44120SPIP 4.0.0 is affected by a Cross Site Scripting (XSS) vulnerability in ecrire/public/interfaces.php, adding the function safehtml to the vu
- CVE-2022-22932Path traversal flawsApache Software Foundation Apache Karaf · org.apache.karaf:…
- CVE-2021-41766Insecure Java Deserialization in Apache KarafApache Software Foundation Apache Karaf · org.apache.karaf.…
- CVE-2021-44118SPIP 4.0.0 is affected by a Cross Site Scripting (XSS) vulnerability.
- CVE-2022-0375Cross-site Scripting (XSS) - Stored in livehelperchat/livehelperchatlivehelperchat/livehelperchat · remdex/livehelperchat
- CVE-2022-0374Cross-site Scripting (XSS) - Stored in livehelperchat/livehelperchatlivehelperchat/livehelperchat · remdex/livehelperchat
- CVE-2022-23968Xerox VersaLink devices on specific versions of firmware before 2022-01-26 allow remote attackers to brick the device via a crafted TIFF fil
- CVE-2019-25056In Bromite through 78.0.3904.130, there are adblock rules in the release APK; therefore, probing which resources are blocked and which aren'
- CVE-2021-46559The firmware on Moxa TN-5900 devices through 3.1 has a weak algorithm that allows an attacker to defeat an inspection mechanism for integrit
- CVE-2021-46560The firmware on Moxa TN-5900 devices through 3.1 allows command injection that could lead to device damage.
- CVE-2022-23959In Varnish Cache before 6.6.2 and 7.x before 7.0.2, Varnish Cache 6.0 LTS before 6.0.10, and and Varnish Enterprise (Cache Plus) 4.1.x befor
- CVE-2021-22570Nullptr Dereference in ProtobufGoogle Protobuf · protobuf
- CVE-2021-22600Double Free in net/packet/af_packet.c leading to priviledge escalationLinux Kernel Kernel
- CVE-2021-46386File upload vulnerability in mingSoft MCMS through 5.2.5, allows remote attackers to execute arbitrary code via a crafted jspx webshell to nnet.mingsoft:ms-mcms
- CVE-2022-0359Heap-based Buffer Overflow in vim/vimvim/vim
- CVE-2022-0368Out-of-bounds Read in vim/vimvim/vim