CVEs published January 28, 2022
166 CVEs were published on January 28, 2022: 11 critical, 83 high. 2 are now in CISA KEV.
- Published
- 166
- Critical
- 11
- High
- 83
- Medium
- 16
- Low
- 4
- Unrated
- 52
- Now in CISA KEV
- 2
- Fix available
- 14
Most affected products
- livehelperchat/livehelperchat · remdex/livehelperchat
- 2
- vim/vim
- 2
- Western Digital My Cloud
- 2
- bmoor
- 1
- janeczku/calibre-web · calibreweb
- 1
- keyget
- 1
- laminas-form · laminas/laminas-form
- 1
- NAVER Whale browser
- 1
- next
- 1
- OpenSSL
- 1
Critical 11
- CVE-2021-23484Arbitrary File Write via Archive Extraction (Zip Slip)zip-local
- CVE-2021-40412An OScommand injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102.
- CVE-2021-40410An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102.
- CVE-2021-40411An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102.
- CVE-2021-40409An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102.
- CVE-2021-40407An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102.
- CVE-2021-40408An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102.
- CVE-2022-21217An out-of-bounds write vulnerability exists in the device TestEmail functionality of reolink RLC-410W v3.0.0.136_20121102.
- CVE-2021-40419A firmware update vulnerability exists in the 'factory' binary of reolink RLC-410W v3.0.0.136_20121102.
- CVE-2022-21796A memory corruption vulnerability exists in the netserver parse_command_list functionality of reolink RLC-410W v3.0.0.136_20121102.
- CVE-2022-23096An issue was discovered in the DNS proxy in Connman through 1.40.
High 83
- CVE-2021-44419A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102.
- CVE-2021-44417A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102.
- CVE-2021-44418A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102.
- CVE-2021-44416A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102.
- CVE-2021-44415A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102.
- CVE-2021-44413A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102.
- CVE-2021-44414A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102.
- CVE-2021-44412A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102.
- CVE-2021-44407A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102.
- CVE-2021-44405A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102.
- CVE-2021-44406A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102.
- CVE-2021-44404A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102.
- CVE-2021-44410A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102.
- CVE-2021-44411A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102.
- CVE-2021-44409A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102.
- CVE-2021-44408A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102.
- CVE-2021-44403A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102.
- CVE-2021-44401A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102.
- CVE-2021-44402A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102.
- CVE-2021-44400A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102.
- CVE-2021-44399A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102.
- CVE-2021-44397A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102.
- CVE-2021-44398A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102.
- CVE-2021-44396A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102.
- CVE-2021-44395A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102.
- CVE-2021-44392A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102.
- CVE-2021-44393A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102.
- CVE-2021-44391A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102.
- CVE-2021-44390A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102.
- CVE-2021-44388A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102.
- CVE-2021-44389A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102.
- CVE-2021-44387A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102.
- CVE-2021-44385A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102.
- CVE-2021-44386A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102.
- CVE-2021-44384A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102.
- CVE-2021-44383A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102.
- CVE-2021-44381A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102.
- CVE-2021-44382A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102.
- CVE-2021-44380A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102.
- CVE-2021-44378A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102.
- CVE-2021-44379A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102.
- CVE-2021-44377A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102.
- CVE-2021-44376A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102.
- CVE-2021-44373A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102.
- CVE-2021-44374A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102.
- CVE-2021-44372A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102.
- CVE-2021-44371A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102.
- CVE-2021-44369A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102.
- CVE-2021-44370A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102.
- CVE-2021-44368A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102.
- CVE-2021-44367A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102.
- CVE-2021-44364A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102.
- CVE-2021-44365A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102.
- CVE-2021-44363A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102.
- CVE-2021-44362A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102.
- CVE-2021-44360A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102.
- CVE-2021-44361A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102.
- CVE-2021-44359A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102.
- CVE-2021-44358A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102.
- CVE-2021-23558Prototype Pollutionbmoor
- CVE-2022-0393Out-of-bounds Read in vim/vimvim/vim
- CVE-2022-0352Cross-site Scripting (XSS) - Reflected in janeczku/calibre-webjaneczku/calibre-web · calibreweb
- CVE-2022-22994Insufficient Verification of Data Authenticity Remote Code Execution Vulnerability on Western Digital My Cloud devices.Western Digital My Cloud
- CVE-2022-22992Command Injection Remote Code Execution vulnerability on Western Digital My Cloud devices.
- CVE-2021-40416An incorrect default permission vulnerability exists in the cgiserver.cgi cgi_check_ability functionality of reolink RLC-410W v3.0.0.136_201
- CVE-2021-40415An incorrect default permission vulnerability exists in the cgiserver.cgi cgi_check_ability functionality of reolink RLC-410W v3.0.0.136_201
- CVE-2021-40413An incorrect default permission vulnerability exists in the cgiserver.cgi cgi_check_ability functionality of reolink RLC-410W v3.0.0.136_201
- CVE-2021-40414An incorrect default permission vulnerability exists in the cgiserver.cgi cgi_check_ability functionality of reolink RLC-410W v3.0.0.136_201
- CVE-2021-40406A denial of service vulnerability exists in the cgiserver.cgi session creation functionality of reolink RLC-410W v3.0.0.136_20121102.
- CVE-2022-21134A firmware update vulnerability exists in the "update" firmware checks functionality of reolink RLC-410W v3.0.0.136_20121102.
- CVE-2022-21199An information disclosure vulnerability exists due to the hardcoded TLS key of reolink RLC-410W v3.0.0.136_20121102.
- CVE-2022-21801A denial of service vulnerability exists in the netserver recv_command functionality of reolink RLC-410W v3.0.0.136_20121102.
- CVE-2021-40423A denial of service vulnerability exists in the cgiserver.cgi API command parser functionality of Reolink RLC-410W v3.0.0.136_20121102.
- CVE-2022-21236An information disclosure vulnerability exists due to a web server misconfiguration in the Reolink RLC-410W v3.0.0.136_20121102.
- CVE-2021-44463Emerson DeltaV Uncontrolled Search Path Element
- CVE-2021-22825A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could allow an attacker to access the system
- CVE-2021-27654Forgotten password reset functionality for local accounts can be used to bypass local authentication checks.Pegasystems Pega Infinity
- CVE-2022-22993Limited Server-Side Request Forgery vulnerability on Western Digital My Cloud devices.Western Digital My Cloud
- CVE-2021-40396A privilege escalation vulnerability exists in the installation of Advantech DeviceOn/iService 1.1.7.
- CVE-2021-40397A privilege escalation vulnerability exists in the installation of Advantech WISE-PaaS/OTA Server 3.0.9.
- CVE-2021-40389A privilege escalation vulnerability exists in the installation of Advantech DeviceOn/iEdge Server 1.0.2.
- CVE-2021-40388A privilege escalation vulnerability exists in Advantech SQ Manager Server 1.0.6.
- CVE-2021-4034A local privilege escalation vulnerability was found on polkit's pkexec utility.polkit
Medium, low and unrated 72
- CVE-2022-21721DOS Vulnerability in next.jsnext
- CVE-2022-23598Reflected XSS vulnerability when rendering error messages in laminas-formlaminas-form · laminas/laminas-form
- CVE-2022-23599Cross-site Scripting and Open Redirect in Products.ATContentTypesproducts-atcontenttypes
- CVE-2022-0395Cross-site Scripting (XSS) - Stored in livehelperchat/livehelperchatlivehelperchat/livehelperchat · remdex/livehelperchat
- CVE-2021-23760Prototype Pollutionkeyget
- CVE-2021-46448H.H.G Multistore v5.1.0 and below was discovered to contain a SQL injection vulnerability via /admin/customers.php?page=1&cID.
- CVE-2021-46447A cross-site scripting (XSS) vulnerability in H.H.G Multistore v5.1.0 and below allows attackers to execute arbitrary web scripts or HTML vi
- CVE-2021-46446H.H.G Multistore v5.1.0 and below was discovered to contain a SQL injection vulnerability via /admin/admin.php?module=admin_access_group_edi
- CVE-2021-46444H.H.G Multistore v5.1.0 and below was discovered to contain a SQL injection vulnerability via /admin/admin.php?module=admin_group_edit&agID.
- CVE-2021-46445H.H.G Multistore v5.1.0 and below was discovered to contain a SQL injection vulnerability via /admin/categories.php?box_group_id.
- CVE-2021-4160BN_mod_exp may produce incorrect results on MIPSOpenSSL
- CVE-2022-23889The comment function in YzmCMS v6.3 was discovered as being able to be operated concurrently, allowing attackers to create an unusually larg
- CVE-2022-23888YzmCMS v6.3 was discovered to contain a Cross-Site Request Forgey (CSRF) via the component /yzmcms/comment/index/init.html.
- CVE-2022-23887YzmCMS v6.3 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily delete user accounts via /ad
- CVE-2021-40404An authentication bypass vulnerability exists in the cgiserver.cgi Login functionality of reolink RLC-410W v3.0.0.136_20121102.
- CVE-2022-23456Potential arbitrary file deletion vulnerability has been identified in HP Support Assistant software.
- CVE-2021-40340OWASP Related Vulnerabilities in Hitachi Energy’s LinkOne Product
- CVE-2021-40339OWASP Related Vulnerabilities in Hitachi Energy’s LinkOne Product
- CVE-2021-40338OWASP Related Vulnerabilities in Hitachi Energy’s LinkOne Product
- CVE-2022-23979WordPress Ultimate Reviews plugin <= 3.0.15 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
- CVE-2021-31567WordPress Download Monitor plugin <= 4.4.6 - Authenticated Arbitrary File Download vulnerability
- CVE-2021-23863HTML code injection vulnerability in Android Application, Bosch Video Security, version 3.2.3.
- CVE-2021-23174WordPress Download Monitor plugin <= 4.4.6 - Auth. Stored Cross-Site Scripting (XSS) vulnerabilityWPChill Download Monitor
- CVE-2022-22791SYNEL - eharmony Authenticated Blind & Stored XSS
- CVE-2022-22790SYNEL - eharmony Directory Traversal
- CVE-2021-26264Emerson DeltaV Missing Authentication for Critical Function
- CVE-2021-22815A CWE-200: Information Exposure vulnerability exists which could cause the troubleshooting archive to be accessed.
- CVE-2021-22814A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists which could cause arbrit
- CVE-2021-22813A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause arbritr
- CVE-2021-22812A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause arbritr
- CVE-2021-22811A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause script
- CVE-2021-22809A CWE-125:Out-of-Bounds Read vulnerability exists that could cause unintended data disclosure when a malicious *.gd1 configuration file is l
- CVE-2021-22810A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause arbritr
- CVE-2021-22808A CWE-416: Use After Free vulnerability exists that could cause arbitrary code execution when a malicious *.gd1 configuration file is loaded
- CVE-2021-22799A CWE-331: Insufficient Entropy vulnerability exists that could cause unintended connection from an internal network to an external network
- CVE-2021-22807A CWE-787: Out-of-bounds Write vulnerability exists that could cause arbitrary code execution when a malicious *.gd1 configuration file is l
- CVE-2021-22816A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause a Denial of Service of the RTU when re
- CVE-2021-22827A CWE-20: Improper Input Validation vulnerability exists that could cause arbitrary code execution when the user visits a page containing th
- CVE-2021-22822A CWE-79 Improper Neutralization of Input During Web Page Generation (�Cross-site Scripting�) vulnerability exists that could allow an attac
- CVE-2021-22826A CWE-20: Improper Input Validation vulnerability exists that could cause arbitrary code execution when the user visits a page containing th
- CVE-2021-22821A CWE-918 Server-Side Request Forgery (SSRF) vulnerability exists that could cause the station web server to forward requests to unintended
- CVE-2021-22820A CWE-614 Insufficient Session Expiration vulnerability exists that could allow an attacker to maintain an unauthorized access over a hijack
- CVE-2021-22818A CWE-307 Improper Restriction of Excessive Authentication Attempts vulnerability exists that could allow an attacker to gain unauthorized a
- CVE-2021-22819A CWE-1021 Improper Restriction of Rendered UI Layers or Frames vulnerability exists that could cause unintended modifications of the produc
- CVE-2021-22725A CVE-352 Cross-Site Request Forgery (CSRF) vulnerability exists that could allow an attacker to impersonate the user or carry out actions o
- CVE-2021-22724A CVE-352 Cross-Site Request Forgery (CSRF) vulnerability exists that could allow an attacker to impersonate the user or carry out actions o
- CVE-2022-23727There is a privilege escalation vulnerability in some webOS TVs.
- CVE-2022-22938VMware Workstation (16.x prior to 16.2.2) and Horizon Client for Windows (5.x prior to 5.5.3) contains a denial-of-service vulnerability in
- CVE-2021-44971Multiple Tenda devices are affected by authentication bypass, such as AC15V1.0 Firmware V15.03.05.20_multi?AC5V1.0 Firmware V15.03.06.48_mul
- CVE-2022-22868Gibbon CMS v22.0.01 was discovered to contain a cross-site scripting (XSS) vulnerability, that allows attackers to inject arbitrary script v
- CVE-2021-41608A file disclosure vulnerability in the UploadedImageDisplay.aspx endpoint of SelectSurvey.NET before 5.052.000 allows a remote, unauthentica
- CVE-2021-41609SQL injection in the ID parameter of the UploadedImageDisplay.aspx endpoint of SelectSurvey.NET before 5.052.000 allows a remote, unauthenti
- CVE-2022-22294A SQL injection vulnerability exists in ZFAKA<=1.43 which an attacker can use to complete SQL injection in the foreground and add a backgrou
- CVE-2021-45899SuiteCRM before 7.12.3 and 8.x before 8.0.2 allows PHAR deserialization that can lead to remote code execution.
- CVE-2021-34073A Cross Site Scripting (XSS) vulnerabilty exists in Sourcecodester Gadget Works Online Ordering System in PHP/MySQLi 1.0 via the Category pa
- CVE-2021-45898SuiteCRM before 7.12.3 and 8.x before 8.0.2 allows local file inclusion.
- CVE-2021-45897SuiteCRM before 7.12.3 and 8.x before 8.0.2 allows remote code execution.
- CVE-2022-23863Zoho ManageEngine Desktop Central before 10.1.2137.10 allows an authenticated user to change any user's login password.
- CVE-2021-44249Online Motorcycle (Bike) Rental System 1.0 is vulnerable to a Blind Time-Based SQL Injection attack within the login portal.
- CVE-2021-45435An SQL Injection vulnerability exists in Sourcecodester Simple Cold Storage Management System using PHP/OOP 1.0 via the username field in lo
- CVE-2021-42791An issue was discovered in VeridiumID VeridiumAD 2.5.3.0.
- CVE-2020-28885Liferay Portal Server tested on 7.3.5 GA6, 7.2.0 GA1 is affected by OS Command Injection.
- CVE-2022-0394Cross-site Scripting (XSS) - Stored in livehelperchat/livehelperchatlivehelperchat/livehelperchat · remdex/livehelperchat
- CVE-2022-21720SQL injection using custom CSS administration form in GLPI
- CVE-2022-21719Reflected XSS using reload button in GLPI
- CVE-2022-24071A Built-in extension in Whale browser before 3.12.129.46 allows attackers to compromise the rendering process which could lead to controllinNAVER Whale browser
- CVE-2016-3735Piwigo is image gallery software written in PHP.Piwigo
- CVE-2020-25905An SQL Injection vulnerabilty exists in Sourcecodester Mobile Shop System in PHP MySQL 1.0 via the email parameter in (1) login.php or (2) L
- CVE-2020-28884Liferay Portal Server tested on 7.3.5 GA6, 7.2.0 GA1 is affected by OS Command Injection.
- CVE-2022-0392Heap-based Buffer Overflow in vim/vimvim/vim
- CVE-2022-23097An issue was discovered in the DNS proxy in Connman through 1.40.
- CVE-2022-23098An issue was discovered in the DNS proxy in Connman through 1.40.