CVEs published January 31, 2022
28 CVEs were published on January 31, 2022: 0 critical, 0 high.
- Published
- 28
- Critical
- 0
- High
- 0
- Medium
- 4
- Low
- 0
- Unrated
- 24
- Now in CISA KEV
- 0
- Fix available
- 2
Most affected products
- dolibarr/dolibarr
- 1
- flask-appbuilder
- 1
- motioneye
- 1
Medium, low and unrated 28
- CVE-2022-24266Cuppa CMS v1.0 was discovered to contain a SQL injection vulnerability in /administrator/components/table_manager/ via the order_by paramete
- CVE-2022-24265Cuppa CMS v1.0 was discovered to contain a SQL injection vulnerability in /administrator/components/menu/ via the path=component/menu/&menu_
- CVE-2022-24263Hospital Management System v4.0 was discovered to contain a SQL injection vulnerability in /Hospital-Management-System-master/func.php via t
- CVE-2022-24264Cuppa CMS v1.0 was discovered to contain a SQL injection vulnerability in /administrator/components/table_manager/ via the search_word param
- CVE-2022-23872Emlog pro v1.1.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /admin/configure.php via the p
- CVE-2022-21659Observable Response Discrepancy in Flask-AppBuilderflask-appbuilder
- CVE-2021-46459Victor CMS v1.0 was discovered to contain multiple SQL injection vulnerabilities in the component admin/users.php?source=add_user.
- CVE-2021-42635PrinterLogic Web Stack versions 19.1.1.13 SP9 and below use a hardcoded APP_KEY value, leading to pre-auth remote code execution.
- CVE-2021-42631PrinterLogic Web Stack versions 19.1.1.13 SP9 and below deserializes attacker controlled leading to pre-auth remote code execution.
- CVE-2021-44114Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Stock Management System in PHP/OOP 1.0, which allows remote malicious user
- CVE-2021-40033There is an information exposure vulnerability on several Huawei Products.
- CVE-2021-40042There is a release of invalid pointer vulnerability in some Huawei products, successful exploit may cause the process and service abnormal.
- CVE-2022-0286A flaw was found in the Linux kernel.
- CVE-2021-46458Victor CMS v1.0 was discovered to contain a SQL injection vulnerability in the component admin/posts.php?source=add_post.
- CVE-2021-31617In ASQ in Stormshield Network Security (SNS) 1.0.0 through 2.7.8, 2.8.0 through 2.16.0, 3.0.0 through 3.7.20, 3.8.0 through 3.11.8, and 4.0.
- CVE-2021-28962Stormshield Network Security (SNS) before 4.2.2 allows a read-only administrator to gain privileges via CLI commands.
- CVE-2020-36056Beetel 777VR1-DI Hardware Version REV.1.01 Firmware Version V01.00.09_55 was discovered to contain a cross-site scripting (XSS) vulnerabilit
- CVE-2020-36064Online Course Registration v1.0 was discovered to contain hardcoded credentials in the source code which allows attackers access to the cont
- CVE-2021-46101In Git for windows through 2.34.1 when using git pull to update the local warehouse, git.cmd can be run directly.
- CVE-2021-44255Authenticated remote code execution in MotionEye <= 0.42.1 and MotioneEyeOS <= 20200606 allows a remote attacker to upload a configuration bmotioneye
- CVE-2021-23520Arbitrary File Write via Archive Extraction (Zip Slip)
- CVE-2021-23521Link Following
- CVE-2021-45079In strongSwan before 5.9.5, a malicious responder can send an EAP-Success message too early without actually authenticating the client and (
- CVE-2021-34805An issue was discovered in FAUST iServer before 9.0.019.019.7.
- CVE-2021-27971Alps Alpine Touchpad Driver 10.3201.101.215 is vulnerable to DLL Injection.
- CVE-2022-23409The Logs plugin before 3.0.4 for Craft CMS allows remote attackers to read arbitrary files via input to actionStream in Controller.php.
- CVE-2022-24130xterm through Patch 370, when Sixel support is enabled, allows attackers to trigger a buffer overflow in set_sixel in graphics_sixel.c via c
- CVE-2022-0414Improper Validation of Specified Quantity in Input in dolibarr/dolibarrdolibarr/dolibarr