# CVEs published 2022-01-29

7 CVEs were published on January 29, 2022: 0 critical, 0 high. Days are UTC.

- [CVE-2021-46660](https://cve.now/CVE-2021-46660.md): Signiant Manager+Agents before 15.1 allows XML External Entity (XXE) attacks. (no CVSS)
- [CVE-2022-24123](https://cve.now/CVE-2022-24123.md): MarkText through 0.16.3 does not sanitize the input of a mermaid block before rendering. (no CVSS)
- [CVE-2022-24124](https://cve.now/CVE-2022-24124.md): The query API in Casdoor before 1.13.1 has a SQL injection vulnerability related to the field and value parameters, as demonstrated by api/g (no CVSS, casdoor · github.com/casdoor/casdoor)
- [CVE-2021-46657](https://cve.now/CVE-2021-46657.md): get\_sort\_by\_table in MariaDB before 10.6.2 allows an application crash via certain subquery uses of ORDER BY. (no CVSS)
- [CVE-2021-46658](https://cve.now/CVE-2021-46658.md): save\_window\_function\_values in MariaDB before 10.6.3 allows an application crash because of incorrect handling of with\_window\_func=true for (no CVSS)
- [CVE-2021-46659](https://cve.now/CVE-2021-46659.md): MariaDB before 10.7.2 allows an application crash because it does not recognize that SELECT\_LEX::nest\_level is local to each VIEW. (no CVSS)
- [CVE-2022-24122](https://cve.now/CVE-2022-24122.md): kernel/ucount.c in the Linux kernel 5.14 through 5.16.4, when unprivileged user namespaces are enabled, allows a use-after-free and privileg (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-01-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.