# CVEs published 2022-01-26

51 CVEs were published on January 26, 2022: 1 critical, 10 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2021-41166](https://cve.now/CVE-2021-41166.md): Permission bypass in Nextcloud Android App (CVSS 4.3, nextcloud security-advisories)
- [CVE-2021-32849](https://cve.now/CVE-2021-32849.md): Arbitrary command execution in Gerapy (CVSS 8.8, gerapy)
- [CVE-2021-32841](https://cve.now/CVE-2021-32841.md): Path Traversal in SharpZipLib (CVSS 4.0, icsharpcode sharpziplib · SharpZipLib)
- [CVE-2021-32842](https://cve.now/CVE-2021-32842.md): Path Traversal in SharpZipLib (CVSS 4.0, icsharpcode sharpziplib · SharpZipLib)
- [CVE-2021-32840](https://cve.now/CVE-2021-32840.md): Path Traversal in SharpZipLib (CVSS 7.3, icsharpcode sharpziplib · SharpZipLib)
- [CVE-2022-21686](https://cve.now/CVE-2022-21686.md): Server Side Twig Template Injection in PrestaShop (CVSS 9.0, PrestaShop · prestashop/prestashop)
- [CVE-2022-22852](https://cve.now/CVE-2022-22852.md): A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodtester Hospital's Patient Records Management System 1.0 via the descrip (no CVSS)
- [CVE-2021-46114](https://cve.now/CVE-2021-46114.md): jpress v 4.2.0 is vulnerable to RCE via io.jpress.module.product.ProductNotifyKit#doSendEmail. (no CVSS)
- [CVE-2021-46385](https://cve.now/CVE-2021-46385.md): https://gitee.com/mingSoft/MCMS MCMS \<=5.2.5 is affected by: SQL Injection. (no CVSS, net.mingsoft:ms-mcms)
- [CVE-2022-22850](https://cve.now/CVE-2022-22850.md): A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodtester Hospital's Patient Records Management System 1.0 via the descrip (no CVSS)
- [CVE-2022-23993](https://cve.now/CVE-2022-23993.md): /usr/local/www/pkg.php in pfSense CE before 2.6.0 and pfSense Plus before 22.01 uses $\_REQUEST\['pkg\_filter'\] in a PHP echo call, causing XSS (no CVSS)
- [CVE-2022-23990](https://cve.now/CVE-2022-23990.md): Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function. (CVSS 7.5, platform/external/expat)
- [CVE-2021-46561](https://cve.now/CVE-2021-46561.md): controller/org.controller/org.controller.js in the CVE Services API 1.1.1 before 5c50baf3bda28133a3bc90b854765a64fb538304 allows an organiza (no CVSS)
- [CVE-2021-29846](https://cve.now/CVE-2021-29846.md): IBM Security Guardium Insights 3.0 could allow an authenticated user to obtain sensitive information due to insufficient session expiration. (CVSS 2.2, IBM Security Guardium Insights)
- [CVE-2021-29845](https://cve.now/CVE-2021-29845.md): IBM Security Guardium Insights 3.0 could allow an authenticated user to perform unauthorized actions due to improper input validation. (CVSS 4.3, IBM Security Guardium Insights)
- [CVE-2021-29838](https://cve.now/CVE-2021-29838.md): IBM Security Guardium Insights 3.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable H (CVSS 5.9, IBM Security Guardium Insights)
- [CVE-2021-46115](https://cve.now/CVE-2021-46115.md): jpress 4.2.0 is vulnerable to RCE via io.jpress.web.admin.\_TemplateController#doUploadFile. (no CVSS)
- [CVE-2021-46116](https://cve.now/CVE-2021-46116.md): jpress 4.2.0 is vulnerable to remote code execution via io.jpress.web.admin.\_TemplateController#doInstall. (no CVSS)
- [CVE-2021-46383](https://cve.now/CVE-2021-46383.md): https://gitee.com/mingSoft/MCMS MCMS \<=5.2.5 is affected by: SQL Injection. (no CVSS, net.mingsoft:ms-mcms)
- [CVE-2021-46118](https://cve.now/CVE-2021-46118.md): jpress 4.2.0 is vulnerable to remote code execution via io.jpress.module.article.kit.ArticleNotifyKit#doSendEmail. (no CVSS)
- [CVE-2022-22851](https://cve.now/CVE-2022-22851.md): A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodtester Hospital's Patient Records Management System 1.0 via the special (no CVSS)
- [CVE-2021-43334](https://cve.now/CVE-2021-43334.md): BuddyBoss Platform through 1.8.0 allows XSS via the Group Name or Group Description field. (no CVSS)
- [CVE-2021-44692](https://cve.now/CVE-2021-44692.md): BuddyBoss Platform through 1.8.0 allows remote attackers to obtain the email address of each user. (no CVSS)
- [CVE-2022-0378](https://cve.now/CVE-2022-0378.md): Cross-site Scripting (XSS) - Reflected in microweber/microweber (CVSS 7.1, microweber/microweber)
- [CVE-2022-0379](https://cve.now/CVE-2022-0379.md): Cross-site Scripting (XSS) - Stored in microweber/microweber (CVSS 8.1, microweber/microweber)
- [CVE-2021-46117](https://cve.now/CVE-2021-46117.md): jpress 4.2.0 is vulnerable to remote code execution via io.jpress.module.page.PageNotifyKit#doSendEmail. (no CVSS)
- [CVE-2021-45975](https://cve.now/CVE-2021-45975.md): In ListCheck.exe in Acer Care Center 4.x before 4.00.3038, a vulnerability in the loading mechanism of Windows DLLs could allow a local atta (no CVSS)
- [CVE-2022-0362](https://cve.now/CVE-2022-0362.md): SQL Injection in star7th/showdoc (CVSS 6.7, star7th/showdoc · showdoc/showdoc)
- [CVE-2022-0203](https://cve.now/CVE-2022-0203.md): Improper Access Control in crater-invoice/crater (CVSS 7.5, crater-invoice/crater · bytefury/crater)
- [CVE-2021-44123](https://cve.now/CVE-2021-44123.md): SPIP 4.0.0 is affected by a remote command execution vulnerability. (no CVSS)
- [CVE-2021-44122](https://cve.now/CVE-2021-44122.md): SPIP 4.0.0 is affected by a Cross Site Request Forgery (CSRF) vulnerability in ecrire/public/aiguiller.php, ecrire/public/balises.php, ecrir (no CVSS)
- [CVE-2021-44120](https://cve.now/CVE-2021-44120.md): SPIP 4.0.0 is affected by a Cross Site Scripting (XSS) vulnerability in ecrire/public/interfaces.php, adding the function safehtml to the vu (no CVSS)
- [CVE-2022-22932](https://cve.now/CVE-2022-22932.md): Path traversal flaws (no CVSS, Apache Software Foundation Apache Karaf · org.apache.karaf:…)
- [CVE-2021-41766](https://cve.now/CVE-2021-41766.md): Insecure Java Deserialization in Apache Karaf (no CVSS, Apache Software Foundation Apache Karaf · org.apache.karaf.…)
- [CVE-2021-44118](https://cve.now/CVE-2021-44118.md): SPIP 4.0.0 is affected by a Cross Site Scripting (XSS) vulnerability. (no CVSS)
- [CVE-2022-0251](https://cve.now/CVE-2022-0251.md): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (CVSS 8.1, pimcore/pimcore)
- [CVE-2022-0375](https://cve.now/CVE-2022-0375.md): Cross-site Scripting (XSS) - Stored in livehelperchat/livehelperchat (CVSS 6.5, livehelperchat/livehelperchat · remdex/livehelperchat)
- [CVE-2022-0374](https://cve.now/CVE-2022-0374.md): Cross-site Scripting (XSS) - Stored in livehelperchat/livehelperchat (CVSS 6.5, livehelperchat/livehelperchat · remdex/livehelperchat)
- [CVE-2022-21944](https://cve.now/CVE-2022-21944.md): watchman: chown in watchman@.socket unit allows symlink attack (CVSS 7.8, openSUSE Backports SLE-15-SP3 · openSUSE Factory)
- [CVE-2022-23968](https://cve.now/CVE-2022-23968.md): Xerox VersaLink devices on specific versions of firmware before 2022-01-26 allow remote attackers to brick the device via a crafted TIFF fil (no CVSS)
- [CVE-2019-25056](https://cve.now/CVE-2019-25056.md): In Bromite through 78.0.3904.130, there are adblock rules in the release APK; therefore, probing which resources are blocked and which aren' (no CVSS)
- [CVE-2021-46559](https://cve.now/CVE-2021-46559.md): The firmware on Moxa TN-5900 devices through 3.1 has a weak algorithm that allows an attacker to defeat an inspection mechanism for integrit (no CVSS)
- [CVE-2021-46560](https://cve.now/CVE-2021-46560.md): The firmware on Moxa TN-5900 devices through 3.1 allows command injection that could lead to device damage. (no CVSS)
- [CVE-2022-23959](https://cve.now/CVE-2022-23959.md): In Varnish Cache before 6.6.2 and 7.x before 7.0.2, Varnish Cache 6.0 LTS before 6.0.10, and and Varnish Enterprise (Cache Plus) 4.1.x befor (no CVSS)
- [CVE-2021-22570](https://cve.now/CVE-2021-22570.md): Nullptr Dereference in Protobuf (CVSS 6.5, Google Protobuf · protobuf)
- [CVE-2021-22600](https://cve.now/CVE-2021-22600.md): Double Free in net/packet/af\_packet.c leading to priviledge escalation (CVSS 6.6, KEV, Linux Kernel Kernel)
- [CVE-2021-46386](https://cve.now/CVE-2021-46386.md): File upload vulnerability in mingSoft MCMS through 5.2.5, allows remote attackers to execute arbitrary code via a crafted jspx webshell to n (no CVSS, net.mingsoft:ms-mcms)
- [CVE-2022-0355](https://cve.now/CVE-2022-0355.md): Improper Removal of Sensitive Information Before Storage or Transfer in feross/simple-get (CVSS 8.8, feross/simple-get · simple-get)
- [CVE-2022-0359](https://cve.now/CVE-2022-0359.md): Heap-based Buffer Overflow in vim/vim (CVSS 6.1, vim/vim)
- [CVE-2022-0361](https://cve.now/CVE-2022-0361.md): Heap-based Buffer Overflow in vim/vim (CVSS 8.4, vim/vim)
- [CVE-2022-0368](https://cve.now/CVE-2022-0368.md): Out-of-bounds Read in vim/vim (CVSS 5.5, vim/vim)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-01-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.