# CVEs published 2022-01-28

166 CVEs were published on January 28, 2022: 11 critical, 83 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2022-21721](https://cve.now/CVE-2022-21721.md): DOS Vulnerability in next.js (CVSS 5.9, next)
- [CVE-2022-23598](https://cve.now/CVE-2022-23598.md): Reflected XSS vulnerability when rendering error messages in laminas-form (CVSS 6.1, laminas-form · laminas/laminas-form)
- [CVE-2022-23599](https://cve.now/CVE-2022-23599.md): Cross-site Scripting and Open Redirect in Products.ATContentTypes (CVSS 4.3, products-atcontenttypes)
- [CVE-2021-44419](https://cve.now/CVE-2021-44419.md): A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136\_20121102. (CVSS 8.6)
- [CVE-2021-44417](https://cve.now/CVE-2021-44417.md): A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136\_20121102. (CVSS 8.6)
- [CVE-2021-44418](https://cve.now/CVE-2021-44418.md): A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136\_20121102. (CVSS 8.6)
- [CVE-2021-44416](https://cve.now/CVE-2021-44416.md): A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136\_20121102. (CVSS 8.6)
- [CVE-2021-44415](https://cve.now/CVE-2021-44415.md): A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136\_20121102. (CVSS 8.6)
- [CVE-2021-44413](https://cve.now/CVE-2021-44413.md): A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136\_20121102. (CVSS 8.6)
- [CVE-2021-44414](https://cve.now/CVE-2021-44414.md): A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136\_20121102. (CVSS 8.6)
- [CVE-2021-44412](https://cve.now/CVE-2021-44412.md): A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136\_20121102. (CVSS 8.6)
- [CVE-2021-44407](https://cve.now/CVE-2021-44407.md): A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136\_20121102. (CVSS 8.6)
- [CVE-2021-44405](https://cve.now/CVE-2021-44405.md): A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136\_20121102. (CVSS 8.6)
- [CVE-2021-44406](https://cve.now/CVE-2021-44406.md): A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136\_20121102. (CVSS 8.6)
- [CVE-2021-44404](https://cve.now/CVE-2021-44404.md): A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136\_20121102. (CVSS 8.6)
- [CVE-2021-44410](https://cve.now/CVE-2021-44410.md): A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136\_20121102. (CVSS 8.6)
- [CVE-2021-44411](https://cve.now/CVE-2021-44411.md): A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136\_20121102. (CVSS 8.6)
- [CVE-2021-44409](https://cve.now/CVE-2021-44409.md): A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136\_20121102. (CVSS 8.6)
- [CVE-2021-44408](https://cve.now/CVE-2021-44408.md): A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136\_20121102. (CVSS 8.6)
- [CVE-2021-44403](https://cve.now/CVE-2021-44403.md): A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136\_20121102. (CVSS 8.6)
- [CVE-2021-44401](https://cve.now/CVE-2021-44401.md): A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136\_20121102. (CVSS 8.6)
- [CVE-2021-44402](https://cve.now/CVE-2021-44402.md): A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136\_20121102. (CVSS 8.6)
- [CVE-2021-44400](https://cve.now/CVE-2021-44400.md): A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136\_20121102. (CVSS 8.6)
- [CVE-2021-44399](https://cve.now/CVE-2021-44399.md): A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136\_20121102. (CVSS 8.6)
- [CVE-2021-44397](https://cve.now/CVE-2021-44397.md): A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136\_20121102. (CVSS 8.6)
- [CVE-2021-44398](https://cve.now/CVE-2021-44398.md): A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136\_20121102. (CVSS 8.6)
- [CVE-2021-44396](https://cve.now/CVE-2021-44396.md): A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136\_20121102. (CVSS 8.6)
- [CVE-2021-44395](https://cve.now/CVE-2021-44395.md): A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136\_20121102. (CVSS 8.6)
- [CVE-2021-44392](https://cve.now/CVE-2021-44392.md): A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136\_20121102. (CVSS 8.6)
- [CVE-2021-44393](https://cve.now/CVE-2021-44393.md): A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136\_20121102. (CVSS 8.6)
- [CVE-2021-44391](https://cve.now/CVE-2021-44391.md): A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136\_20121102. (CVSS 8.6)
- [CVE-2021-44390](https://cve.now/CVE-2021-44390.md): A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136\_20121102. (CVSS 8.6)
- [CVE-2021-44388](https://cve.now/CVE-2021-44388.md): A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136\_20121102. (CVSS 8.6)
- [CVE-2021-44389](https://cve.now/CVE-2021-44389.md): A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136\_20121102. (CVSS 8.6)
- [CVE-2021-44387](https://cve.now/CVE-2021-44387.md): A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136\_20121102. (CVSS 8.6)
- [CVE-2021-44385](https://cve.now/CVE-2021-44385.md): A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136\_20121102. (CVSS 8.6)
- [CVE-2021-44386](https://cve.now/CVE-2021-44386.md): A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136\_20121102. (CVSS 8.6)
- [CVE-2021-44384](https://cve.now/CVE-2021-44384.md): A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136\_20121102. (CVSS 8.6)
- [CVE-2021-44383](https://cve.now/CVE-2021-44383.md): A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136\_20121102. (CVSS 8.6)
- [CVE-2021-44381](https://cve.now/CVE-2021-44381.md): A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136\_20121102. (CVSS 8.6)
- [CVE-2021-44382](https://cve.now/CVE-2021-44382.md): A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136\_20121102. (CVSS 8.6)
- [CVE-2021-44380](https://cve.now/CVE-2021-44380.md): A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136\_20121102. (CVSS 8.6)
- [CVE-2021-44378](https://cve.now/CVE-2021-44378.md): A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136\_20121102. (CVSS 8.6)
- [CVE-2021-44379](https://cve.now/CVE-2021-44379.md): A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136\_20121102. (CVSS 8.6)
- [CVE-2021-44377](https://cve.now/CVE-2021-44377.md): A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136\_20121102. (CVSS 8.6)
- [CVE-2021-44376](https://cve.now/CVE-2021-44376.md): A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136\_20121102. (CVSS 8.6)
- [CVE-2021-44373](https://cve.now/CVE-2021-44373.md): A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136\_20121102. (CVSS 8.6)
- [CVE-2021-44374](https://cve.now/CVE-2021-44374.md): A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136\_20121102. (CVSS 8.6)
- [CVE-2021-44372](https://cve.now/CVE-2021-44372.md): A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136\_20121102. (CVSS 8.6)
- [CVE-2021-44371](https://cve.now/CVE-2021-44371.md): A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136\_20121102. (CVSS 8.6)
- [CVE-2021-44369](https://cve.now/CVE-2021-44369.md): A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136\_20121102. (CVSS 8.6)
- [CVE-2021-44370](https://cve.now/CVE-2021-44370.md): A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136\_20121102. (CVSS 8.6)
- [CVE-2021-44368](https://cve.now/CVE-2021-44368.md): A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136\_20121102. (CVSS 8.6)
- [CVE-2021-44367](https://cve.now/CVE-2021-44367.md): A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136\_20121102. (CVSS 8.6)
- [CVE-2021-44364](https://cve.now/CVE-2021-44364.md): A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136\_20121102. (CVSS 8.6)
- [CVE-2021-44365](https://cve.now/CVE-2021-44365.md): A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136\_20121102. (CVSS 8.6)
- [CVE-2021-44363](https://cve.now/CVE-2021-44363.md): A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136\_20121102. (CVSS 8.6)
- [CVE-2021-44362](https://cve.now/CVE-2021-44362.md): A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136\_20121102. (CVSS 8.6)
- [CVE-2021-44360](https://cve.now/CVE-2021-44360.md): A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136\_20121102. (CVSS 8.6)
- [CVE-2021-44361](https://cve.now/CVE-2021-44361.md): A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136\_20121102. (CVSS 8.6)
- [CVE-2021-44359](https://cve.now/CVE-2021-44359.md): A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136\_20121102. (CVSS 8.6)
- [CVE-2021-44358](https://cve.now/CVE-2021-44358.md): A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136\_20121102. (CVSS 8.6)
- [CVE-2021-23558](https://cve.now/CVE-2021-23558.md): Prototype Pollution (CVSS 7.3, bmoor)
- [CVE-2022-0395](https://cve.now/CVE-2022-0395.md): Cross-site Scripting (XSS) - Stored in livehelperchat/livehelperchat (CVSS 6.5, livehelperchat/livehelperchat · remdex/livehelperchat)
- [CVE-2021-23760](https://cve.now/CVE-2021-23760.md): Prototype Pollution (CVSS 5.6, keyget)
- [CVE-2021-23484](https://cve.now/CVE-2021-23484.md): Arbitrary File Write via Archive Extraction (Zip Slip) (CVSS 9.8, zip-local)
- [CVE-2022-0393](https://cve.now/CVE-2022-0393.md): Out-of-bounds Read in vim/vim (CVSS 8.4, vim/vim)
- [CVE-2021-46448](https://cve.now/CVE-2021-46448.md): H.H.G Multistore v5.1.0 and below was discovered to contain a SQL injection vulnerability via /admin/customers.php?page=1&cID. (no CVSS)
- [CVE-2021-46447](https://cve.now/CVE-2021-46447.md): A cross-site scripting (XSS) vulnerability in H.H.G Multistore v5.1.0 and below allows attackers to execute arbitrary web scripts or HTML vi (no CVSS)
- [CVE-2021-46446](https://cve.now/CVE-2021-46446.md): H.H.G Multistore v5.1.0 and below was discovered to contain a SQL injection vulnerability via /admin/admin.php?module=admin\_access\_group\_edi (no CVSS)
- [CVE-2021-46444](https://cve.now/CVE-2021-46444.md): H.H.G Multistore v5.1.0 and below was discovered to contain a SQL injection vulnerability via /admin/admin.php?module=admin\_group\_edit&agID. (no CVSS)
- [CVE-2021-46445](https://cve.now/CVE-2021-46445.md): H.H.G Multistore v5.1.0 and below was discovered to contain a SQL injection vulnerability via /admin/categories.php?box\_group\_id. (no CVSS)
- [CVE-2022-0352](https://cve.now/CVE-2022-0352.md): Cross-site Scripting (XSS) - Reflected in janeczku/calibre-web (CVSS 8.5, janeczku/calibre-web · calibreweb)
- [CVE-2021-4160](https://cve.now/CVE-2021-4160.md): BN\_mod\_exp may produce incorrect results on MIPS (no CVSS, OpenSSL)
- [CVE-2022-23889](https://cve.now/CVE-2022-23889.md): The comment function in YzmCMS v6.3 was discovered as being able to be operated concurrently, allowing attackers to create an unusually larg (no CVSS)
- [CVE-2022-23888](https://cve.now/CVE-2022-23888.md): YzmCMS v6.3 was discovered to contain a Cross-Site Request Forgey (CSRF) via the component /yzmcms/comment/index/init.html. (no CVSS)
- [CVE-2022-23887](https://cve.now/CVE-2022-23887.md): YzmCMS v6.3 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily delete user accounts via /ad (no CVSS)
- [CVE-2022-22994](https://cve.now/CVE-2022-22994.md): Insufficient Verification of Data Authenticity Remote Code Execution Vulnerability on Western Digital My Cloud devices. (CVSS 8.8, Western Digital My Cloud)
- [CVE-2022-22992](https://cve.now/CVE-2022-22992.md): Command Injection Remote Code Execution vulnerability on Western Digital My Cloud devices. (CVSS 7.8)
- [CVE-2021-40412](https://cve.now/CVE-2021-40412.md): An OScommand injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136\_20121102. (CVSS 9.1)
- [CVE-2021-40410](https://cve.now/CVE-2021-40410.md): An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136\_20121102. (CVSS 9.1)
- [CVE-2021-40411](https://cve.now/CVE-2021-40411.md): An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136\_20121102. (CVSS 9.1)
- [CVE-2021-40409](https://cve.now/CVE-2021-40409.md): An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136\_20121102. (CVSS 9.1)
- [CVE-2021-40407](https://cve.now/CVE-2021-40407.md): An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136\_20121102. (CVSS 9.1, KEV)
- [CVE-2021-40408](https://cve.now/CVE-2021-40408.md): An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136\_20121102. (CVSS 9.1)
- [CVE-2021-40416](https://cve.now/CVE-2021-40416.md): An incorrect default permission vulnerability exists in the cgiserver.cgi cgi\_check\_ability functionality of reolink RLC-410W v3.0.0.136\_201 (CVSS 7.1)
- [CVE-2021-40415](https://cve.now/CVE-2021-40415.md): An incorrect default permission vulnerability exists in the cgiserver.cgi cgi\_check\_ability functionality of reolink RLC-410W v3.0.0.136\_201 (CVSS 7.1)
- [CVE-2021-40413](https://cve.now/CVE-2021-40413.md): An incorrect default permission vulnerability exists in the cgiserver.cgi cgi\_check\_ability functionality of reolink RLC-410W v3.0.0.136\_201 (CVSS 7.1)
- [CVE-2021-40414](https://cve.now/CVE-2021-40414.md): An incorrect default permission vulnerability exists in the cgiserver.cgi cgi\_check\_ability functionality of reolink RLC-410W v3.0.0.136\_201 (CVSS 7.1)
- [CVE-2022-21217](https://cve.now/CVE-2022-21217.md): An out-of-bounds write vulnerability exists in the device TestEmail functionality of reolink RLC-410W v3.0.0.136\_20121102. (CVSS 9.1)
- [CVE-2021-40406](https://cve.now/CVE-2021-40406.md): A denial of service vulnerability exists in the cgiserver.cgi session creation functionality of reolink RLC-410W v3.0.0.136\_20121102. (CVSS 7.5)
- [CVE-2021-40404](https://cve.now/CVE-2021-40404.md): An authentication bypass vulnerability exists in the cgiserver.cgi Login functionality of reolink RLC-410W v3.0.0.136\_20121102. (CVSS 5.3)
- [CVE-2021-40419](https://cve.now/CVE-2021-40419.md): A firmware update vulnerability exists in the 'factory' binary of reolink RLC-410W v3.0.0.136\_20121102. (CVSS 10.0)
- [CVE-2022-21134](https://cve.now/CVE-2022-21134.md): A firmware update vulnerability exists in the "update" firmware checks functionality of reolink RLC-410W v3.0.0.136\_20121102. (CVSS 8.3)
- [CVE-2022-21199](https://cve.now/CVE-2022-21199.md): An information disclosure vulnerability exists due to the hardcoded TLS key of reolink RLC-410W v3.0.0.136\_20121102. (CVSS 7.5)
- [CVE-2022-21801](https://cve.now/CVE-2022-21801.md): A denial of service vulnerability exists in the netserver recv\_command functionality of reolink RLC-410W v3.0.0.136\_20121102. (CVSS 8.6)
- [CVE-2022-21796](https://cve.now/CVE-2022-21796.md): A memory corruption vulnerability exists in the netserver parse\_command\_list functionality of reolink RLC-410W v3.0.0.136\_20121102. (CVSS 9.3)
- [CVE-2021-40423](https://cve.now/CVE-2021-40423.md): A denial of service vulnerability exists in the cgiserver.cgi API command parser functionality of Reolink RLC-410W v3.0.0.136\_20121102. (CVSS 7.5)
- [CVE-2022-21236](https://cve.now/CVE-2022-21236.md): An information disclosure vulnerability exists due to a web server misconfiguration in the Reolink RLC-410W v3.0.0.136\_20121102. (CVSS 8.1)
- [CVE-2022-23456](https://cve.now/CVE-2022-23456.md): Potential arbitrary file deletion vulnerability has been identified in HP Support Assistant software. (no CVSS)
- [CVE-2021-40340](https://cve.now/CVE-2021-40340.md): OWASP Related Vulnerabilities in Hitachi Energy’s LinkOne Product (CVSS 3.7)
- [CVE-2021-40339](https://cve.now/CVE-2021-40339.md): OWASP Related Vulnerabilities in Hitachi Energy’s LinkOne Product (CVSS 3.7)
- [CVE-2021-40338](https://cve.now/CVE-2021-40338.md): OWASP Related Vulnerabilities in Hitachi Energy’s LinkOne Product (CVSS 3.7)
- [CVE-2022-23979](https://cve.now/CVE-2022-23979.md): WordPress Ultimate Reviews plugin \<= 3.0.15 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (CVSS 4.8)
- [CVE-2021-31567](https://cve.now/CVE-2021-31567.md): WordPress Download Monitor plugin \<= 4.4.6 - Authenticated Arbitrary File Download vulnerability (CVSS 6.8)
- [CVE-2021-23863](https://cve.now/CVE-2021-23863.md): HTML code injection vulnerability in Android Application, Bosch Video Security, version 3.2.3. (CVSS 6.1)
- [CVE-2021-23174](https://cve.now/CVE-2021-23174.md): WordPress Download Monitor plugin \<= 4.4.6 - Auth. Stored Cross-Site Scripting (XSS) vulnerability (CVSS 3.4, WPChill Download Monitor)
- [CVE-2022-22791](https://cve.now/CVE-2022-22791.md): SYNEL - eharmony Authenticated Blind & Stored XSS (CVSS 6.6)
- [CVE-2022-22790](https://cve.now/CVE-2022-22790.md): SYNEL - eharmony Directory Traversal (CVSS 5.6)
- [CVE-2021-44463](https://cve.now/CVE-2021-44463.md): Emerson DeltaV Uncontrolled Search Path Element (CVSS 8.1)
- [CVE-2021-26264](https://cve.now/CVE-2021-26264.md): Emerson DeltaV Missing Authentication for Critical Function (CVSS 6.1)
- [CVE-2021-22815](https://cve.now/CVE-2021-22815.md): A CWE-200: Information Exposure vulnerability exists which could cause the troubleshooting archive to be accessed. (no CVSS)
- [CVE-2021-22814](https://cve.now/CVE-2021-22814.md): A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists which could cause arbrit (no CVSS)
- [CVE-2021-22813](https://cve.now/CVE-2021-22813.md): A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause arbritr (no CVSS)
- [CVE-2021-22812](https://cve.now/CVE-2021-22812.md): A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause arbritr (no CVSS)
- [CVE-2021-22811](https://cve.now/CVE-2021-22811.md): A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause script (no CVSS)
- [CVE-2021-22809](https://cve.now/CVE-2021-22809.md): A CWE-125:Out-of-Bounds Read vulnerability exists that could cause unintended data disclosure when a malicious \*.gd1 configuration file is l (no CVSS)
- [CVE-2021-22810](https://cve.now/CVE-2021-22810.md): A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause arbritr (no CVSS)
- [CVE-2021-22808](https://cve.now/CVE-2021-22808.md): A CWE-416: Use After Free vulnerability exists that could cause arbitrary code execution when a malicious \*.gd1 configuration file is loaded (no CVSS)
- [CVE-2021-22799](https://cve.now/CVE-2021-22799.md): A CWE-331: Insufficient Entropy vulnerability exists that could cause unintended connection from an internal network to an external network (no CVSS)
- [CVE-2021-22807](https://cve.now/CVE-2021-22807.md): A CWE-787: Out-of-bounds Write vulnerability exists that could cause arbitrary code execution when a malicious \*.gd1 configuration file is l (no CVSS)
- [CVE-2021-22816](https://cve.now/CVE-2021-22816.md): A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause a Denial of Service of the RTU when re (no CVSS)
- [CVE-2021-22825](https://cve.now/CVE-2021-22825.md): A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could allow an attacker to access the system (CVSS 8.0)
- [CVE-2021-22827](https://cve.now/CVE-2021-22827.md): A CWE-20: Improper Input Validation vulnerability exists that could cause arbitrary code execution when the user visits a page containing th (no CVSS)
- [CVE-2021-22822](https://cve.now/CVE-2021-22822.md): A CWE-79 Improper Neutralization of Input During Web Page Generation (�Cross-site Scripting�) vulnerability exists that could allow an attac (no CVSS)
- [CVE-2021-22826](https://cve.now/CVE-2021-22826.md): A CWE-20: Improper Input Validation vulnerability exists that could cause arbitrary code execution when the user visits a page containing th (no CVSS)
- [CVE-2021-22821](https://cve.now/CVE-2021-22821.md): A CWE-918 Server-Side Request Forgery (SSRF) vulnerability exists that could cause the station web server to forward requests to unintended (no CVSS)
- [CVE-2021-22820](https://cve.now/CVE-2021-22820.md): A CWE-614 Insufficient Session Expiration vulnerability exists that could allow an attacker to maintain an unauthorized access over a hijack (no CVSS)
- [CVE-2021-22818](https://cve.now/CVE-2021-22818.md): A CWE-307 Improper Restriction of Excessive Authentication Attempts vulnerability exists that could allow an attacker to gain unauthorized a (no CVSS)
- [CVE-2021-22819](https://cve.now/CVE-2021-22819.md): A CWE-1021 Improper Restriction of Rendered UI Layers or Frames vulnerability exists that could cause unintended modifications of the produc (no CVSS)
- [CVE-2021-22725](https://cve.now/CVE-2021-22725.md): A CVE-352 Cross-Site Request Forgery (CSRF) vulnerability exists that could allow an attacker to impersonate the user or carry out actions o (no CVSS)
- [CVE-2021-22724](https://cve.now/CVE-2021-22724.md): A CVE-352 Cross-Site Request Forgery (CSRF) vulnerability exists that could allow an attacker to impersonate the user or carry out actions o (no CVSS)
- [CVE-2021-27654](https://cve.now/CVE-2021-27654.md): Forgotten password reset functionality for local accounts can be used to bypass local authentication checks. (CVSS 8.8, Pegasystems Pega Infinity)
- [CVE-2022-23727](https://cve.now/CVE-2022-23727.md): There is a privilege escalation vulnerability in some webOS TVs. (no CVSS)
- [CVE-2022-22993](https://cve.now/CVE-2022-22993.md): Limited Server-Side Request Forgery vulnerability on Western Digital My Cloud devices. (CVSS 7.8, Western Digital My Cloud)
- [CVE-2021-40396](https://cve.now/CVE-2021-40396.md): A privilege escalation vulnerability exists in the installation of Advantech DeviceOn/iService 1.1.7. (CVSS 8.8)
- [CVE-2021-40397](https://cve.now/CVE-2021-40397.md): A privilege escalation vulnerability exists in the installation of Advantech WISE-PaaS/OTA Server 3.0.9. (CVSS 8.8)
- [CVE-2021-40389](https://cve.now/CVE-2021-40389.md): A privilege escalation vulnerability exists in the installation of Advantech DeviceOn/iEdge Server 1.0.2. (CVSS 8.8)
- [CVE-2021-40388](https://cve.now/CVE-2021-40388.md): A privilege escalation vulnerability exists in Advantech SQ Manager Server 1.0.6. (CVSS 8.8)
- [CVE-2022-22938](https://cve.now/CVE-2022-22938.md): VMware Workstation (16.x prior to 16.2.2) and Horizon Client for Windows (5.x prior to 5.5.3) contains a denial-of-service vulnerability in (no CVSS)
- [CVE-2021-44971](https://cve.now/CVE-2021-44971.md): Multiple Tenda devices are affected by authentication bypass, such as AC15V1.0 Firmware V15.03.05.20\_multi?AC5V1.0 Firmware V15.03.06.48\_mul (no CVSS)
- [CVE-2022-22868](https://cve.now/CVE-2022-22868.md): Gibbon CMS v22.0.01 was discovered to contain a cross-site scripting (XSS) vulnerability, that allows attackers to inject arbitrary script v (no CVSS)
- [CVE-2021-41608](https://cve.now/CVE-2021-41608.md): A file disclosure vulnerability in the UploadedImageDisplay.aspx endpoint of SelectSurvey.NET before 5.052.000 allows a remote, unauthentica (no CVSS)
- [CVE-2021-41609](https://cve.now/CVE-2021-41609.md): SQL injection in the ID parameter of the UploadedImageDisplay.aspx endpoint of SelectSurvey.NET before 5.052.000 allows a remote, unauthenti (no CVSS)
- [CVE-2022-22294](https://cve.now/CVE-2022-22294.md): A SQL injection vulnerability exists in ZFAKA\<=1.43 which an attacker can use to complete SQL injection in the foreground and add a backgrou (no CVSS)
- [CVE-2021-45899](https://cve.now/CVE-2021-45899.md): SuiteCRM before 7.12.3 and 8.x before 8.0.2 allows PHAR deserialization that can lead to remote code execution. (no CVSS)
- [CVE-2021-34073](https://cve.now/CVE-2021-34073.md): A Cross Site Scripting (XSS) vulnerabilty exists in Sourcecodester Gadget Works Online Ordering System in PHP/MySQLi 1.0 via the Category pa (no CVSS)
- [CVE-2021-45898](https://cve.now/CVE-2021-45898.md): SuiteCRM before 7.12.3 and 8.x before 8.0.2 allows local file inclusion. (no CVSS)
- [CVE-2021-45897](https://cve.now/CVE-2021-45897.md): SuiteCRM before 7.12.3 and 8.x before 8.0.2 allows remote code execution. (no CVSS)
- [CVE-2022-23863](https://cve.now/CVE-2022-23863.md): Zoho ManageEngine Desktop Central before 10.1.2137.10 allows an authenticated user to change any user's login password. (no CVSS)
- [CVE-2021-44249](https://cve.now/CVE-2021-44249.md): Online Motorcycle (Bike) Rental System 1.0 is vulnerable to a Blind Time-Based SQL Injection attack within the login portal. (no CVSS)
- [CVE-2021-45435](https://cve.now/CVE-2021-45435.md): An SQL Injection vulnerability exists in Sourcecodester Simple Cold Storage Management System using PHP/OOP 1.0 via the username field in lo (no CVSS)
- [CVE-2021-42791](https://cve.now/CVE-2021-42791.md): An issue was discovered in VeridiumID VeridiumAD 2.5.3.0. (no CVSS)
- [CVE-2020-28885](https://cve.now/CVE-2020-28885.md): Liferay Portal Server tested on 7.3.5 GA6, 7.2.0 GA1 is affected by OS Command Injection. (no CVSS)
- [CVE-2022-0394](https://cve.now/CVE-2022-0394.md): Cross-site Scripting (XSS) - Stored in livehelperchat/livehelperchat (CVSS 5.3, livehelperchat/livehelperchat · remdex/livehelperchat)
- [CVE-2022-21720](https://cve.now/CVE-2022-21720.md): SQL injection using custom CSS administration form in GLPI (CVSS 4.9)
- [CVE-2022-21719](https://cve.now/CVE-2022-21719.md): Reflected XSS using reload button in GLPI (CVSS 6.1)
- [CVE-2022-24071](https://cve.now/CVE-2022-24071.md): A Built-in extension in Whale browser before 3.12.129.46 allows attackers to compromise the rendering process which could lead to controllin (no CVSS, NAVER Whale browser)
- [CVE-2016-3735](https://cve.now/CVE-2016-3735.md): Piwigo is image gallery software written in PHP. (no CVSS, Piwigo)
- [CVE-2020-25905](https://cve.now/CVE-2020-25905.md): An SQL Injection vulnerabilty exists in Sourcecodester Mobile Shop System in PHP MySQL 1.0 via the email parameter in (1) login.php or (2) L (no CVSS)
- [CVE-2020-28884](https://cve.now/CVE-2020-28884.md): Liferay Portal Server tested on 7.3.5 GA6, 7.2.0 GA1 is affected by OS Command Injection. (no CVSS)
- [CVE-2021-4034](https://cve.now/CVE-2021-4034.md): A local privilege escalation vulnerability was found on polkit's pkexec utility. (CVSS 7.8, KEV, polkit)
- [CVE-2022-0392](https://cve.now/CVE-2022-0392.md): Heap-based Buffer Overflow in vim/vim (CVSS 6.1, vim/vim)
- [CVE-2022-23096](https://cve.now/CVE-2022-23096.md): An issue was discovered in the DNS proxy in Connman through 1.40. (CVSS 9.1)
- [CVE-2022-23097](https://cve.now/CVE-2022-23097.md): An issue was discovered in the DNS proxy in Connman through 1.40. (no CVSS)
- [CVE-2022-23098](https://cve.now/CVE-2022-23098.md): An issue was discovered in the DNS proxy in Connman through 1.40. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-01-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.