# CVEs published 2022-01-31

28 CVEs were published on January 31, 2022: 0 critical, 0 high. Days are UTC.

- [CVE-2022-24266](https://cve.now/CVE-2022-24266.md): Cuppa CMS v1.0 was discovered to contain a SQL injection vulnerability in /administrator/components/table\_manager/ via the order\_by paramete (no CVSS)
- [CVE-2022-24265](https://cve.now/CVE-2022-24265.md): Cuppa CMS v1.0 was discovered to contain a SQL injection vulnerability in /administrator/components/menu/ via the path=component/menu/&menu\_ (no CVSS)
- [CVE-2022-24263](https://cve.now/CVE-2022-24263.md): Hospital Management System v4.0 was discovered to contain a SQL injection vulnerability in /Hospital-Management-System-master/func.php via t (no CVSS)
- [CVE-2022-24264](https://cve.now/CVE-2022-24264.md): Cuppa CMS v1.0 was discovered to contain a SQL injection vulnerability in /administrator/components/table\_manager/ via the search\_word param (no CVSS)
- [CVE-2022-23872](https://cve.now/CVE-2022-23872.md): Emlog pro v1.1.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /admin/configure.php via the p (no CVSS)
- [CVE-2022-21659](https://cve.now/CVE-2022-21659.md): Observable Response Discrepancy in Flask-AppBuilder (CVSS 5.3, flask-appbuilder)
- [CVE-2021-46459](https://cve.now/CVE-2021-46459.md): Victor CMS v1.0 was discovered to contain multiple SQL injection vulnerabilities in the component admin/users.php?source=add\_user. (no CVSS)
- [CVE-2021-42635](https://cve.now/CVE-2021-42635.md): PrinterLogic Web Stack versions 19.1.1.13 SP9 and below use a hardcoded APP\_KEY value, leading to pre-auth remote code execution. (no CVSS)
- [CVE-2021-42631](https://cve.now/CVE-2021-42631.md): PrinterLogic Web Stack versions 19.1.1.13 SP9 and below deserializes attacker controlled leading to pre-auth remote code execution. (no CVSS)
- [CVE-2021-44114](https://cve.now/CVE-2021-44114.md): Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Stock Management System in PHP/OOP 1.0, which allows remote malicious user (no CVSS)
- [CVE-2021-40033](https://cve.now/CVE-2021-40033.md): There is an information exposure vulnerability on several Huawei Products. (no CVSS)
- [CVE-2021-40042](https://cve.now/CVE-2021-40042.md): There is a release of invalid pointer vulnerability in some Huawei products, successful exploit may cause the process and service abnormal. (no CVSS)
- [CVE-2022-0286](https://cve.now/CVE-2022-0286.md): A flaw was found in the Linux kernel. (no CVSS)
- [CVE-2021-46458](https://cve.now/CVE-2021-46458.md): Victor CMS v1.0 was discovered to contain a SQL injection vulnerability in the component admin/posts.php?source=add\_post. (no CVSS)
- [CVE-2021-31617](https://cve.now/CVE-2021-31617.md): In ASQ in Stormshield Network Security (SNS) 1.0.0 through 2.7.8, 2.8.0 through 2.16.0, 3.0.0 through 3.7.20, 3.8.0 through 3.11.8, and 4.0. (no CVSS)
- [CVE-2021-28962](https://cve.now/CVE-2021-28962.md): Stormshield Network Security (SNS) before 4.2.2 allows a read-only administrator to gain privileges via CLI commands. (no CVSS)
- [CVE-2020-36056](https://cve.now/CVE-2020-36056.md): Beetel 777VR1-DI Hardware Version REV.1.01 Firmware Version V01.00.09\_55 was discovered to contain a cross-site scripting (XSS) vulnerabilit (no CVSS)
- [CVE-2020-36064](https://cve.now/CVE-2020-36064.md): Online Course Registration v1.0 was discovered to contain hardcoded credentials in the source code which allows attackers access to the cont (no CVSS)
- [CVE-2021-46101](https://cve.now/CVE-2021-46101.md): In Git for windows through 2.34.1 when using git pull to update the local warehouse, git.cmd can be run directly. (no CVSS)
- [CVE-2021-44255](https://cve.now/CVE-2021-44255.md): Authenticated remote code execution in MotionEye \<= 0.42.1 and MotioneEyeOS \<= 20200606 allows a remote attacker to upload a configuration b (no CVSS, motioneye)
- [CVE-2021-23520](https://cve.now/CVE-2021-23520.md): Arbitrary File Write via Archive Extraction (Zip Slip) (CVSS 5.5)
- [CVE-2021-23521](https://cve.now/CVE-2021-23521.md): Link Following (CVSS 5.5)
- [CVE-2021-45079](https://cve.now/CVE-2021-45079.md): In strongSwan before 5.9.5, a malicious responder can send an EAP-Success message too early without actually authenticating the client and ( (no CVSS)
- [CVE-2021-34805](https://cve.now/CVE-2021-34805.md): An issue was discovered in FAUST iServer before 9.0.019.019.7. (no CVSS)
- [CVE-2021-27971](https://cve.now/CVE-2021-27971.md): Alps Alpine Touchpad Driver 10.3201.101.215 is vulnerable to DLL Injection. (no CVSS)
- [CVE-2022-23409](https://cve.now/CVE-2022-23409.md): The Logs plugin before 3.0.4 for Craft CMS allows remote attackers to read arbitrary files via input to actionStream in Controller.php. (no CVSS)
- [CVE-2022-24130](https://cve.now/CVE-2022-24130.md): xterm through Patch 370, when Sixel support is enabled, allows attackers to trigger a buffer overflow in set\_sixel in graphics\_sixel.c via c (no CVSS)
- [CVE-2022-0414](https://cve.now/CVE-2022-0414.md): Improper Validation of Specified Quantity in Input in dolibarr/dolibarr (CVSS 4.1, dolibarr/dolibarr)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-01-31
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.