Archive

January 2022

Vulnerabilities first published in this month (UTC), newest first.

← December 2021 2022 / January February 2022 →

All Critical High Medium Low Exploited only Public exploit

2,026 results · Feed

Medium 4.3

CVE-2022-20614

Incorrect Permission Assignment for Critical Resource in Jenkins Mailer Plugin

A missing permission check in Jenkins Mailer Plugin 391.ve4a_38c1b_cf4b_ and earlier allows attackers with Overall/Read access to use the DNS used by the Jenkins instance to resolve an attacker-specified hostname.

Jenkins Project Jenkins Mailer Plugin org.jenkins-ci.plugins:mailer Web / CMS Maven

Jan 12, 2022
Unscored —

CVE-2021-36417

A heap-based buffer overflow vulnerability exists in GPAC v1.0.1 in the gf_isom_dovi_config_get function in MP4Box, whi…

gpac gpac Debian Ubuntu

Jan 12, 2022
Unscored —

CVE-2021-40562

A Segmentation fault caused by a floating point exception exists in Gpac through 1.0.1 using mp4box via the naludmx_enq…

gpac gpac Debian Ubuntu

Jan 12, 2022
Unscored —

CVE-2021-40563

A Segmentation fault exists casued by null pointer dereference exists in Gpac through 1.0.1 via the naludmx_create_avc_…

gpac gpac Debian Ubuntu

Jan 12, 2022
Unscored —

CVE-2021-40566

A Segmentation fault casued by heap use after free vulnerability exists in Gpac through 1.0.1 via the mpgviddmx_process…

gpac gpac Debian Ubuntu

Jan 12, 2022
Unscored —

CVE-2021-40564

A Segmentation fault caused by null pointer dereference vulnerability eists in Gpac through 1.0.2 via the avc_parse_sli…

gpac gpac Debian Ubuntu

Jan 12, 2022
Unscored —

CVE-2021-40559

A null pointer deference vulnerability exists in gpac through 1.0.1 via the naludmx_parse_nal_avc function in reframe_n…

gpac gpac Debian Ubuntu

Jan 12, 2022
Unscored —

CVE-2021-40565

A Segmentation fault caused by a null pointer dereference vulnerability exists in Gpac through 1.0.1 via the gf_avc_par…

gpac gpac Debian Ubuntu

Jan 12, 2022
High 8.2

CVE-2021-43860

Permissions granted to applications can be hidden from the user at install time

Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.12.3 and 1.10.6, Flatpak doesn't properly validate that the permissions displayed to the user for an app at install time match the actual permissions granted to the app …

Flatpak Flatpak flatpak flatpak Debian Ubuntu Alpine

Jan 12, 2022
High 7.1

CVE-2022-0087 Scanner template

Cross-site Scripting (XSS) - Reflected in keystonejs/keystone

keystone is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

keystonejs keystonejs/keystone @keystone-6/auth @keystone-next/auth npm

Jan 11, 2022
Unscored —

CVE-2021-43999

Improper validation of SAML responses

Apache Guacamole 1.2.0 and 1.3.0 do not properly validate responses received from a SAML identity provider. If SAML support is enabled, this may allow a malicious user to assume the identity of another Guacamole user.

Apache Software Foundation Apache Guacamole guacamole-server Ubuntu

Jan 11, 2022
Unscored —

CVE-2021-41767

Private tunnel identifier may be included in the non-private details of active connections

Apache Guacamole 1.3.0 and older may incorrectly include a private tunnel identifier in the non-private details of some REST responses. This may allow an authenticated user who already has permission to access a particular connection to read from or interact …

Apache Software Foundation Apache Guacamole guacamole-server Ubuntu

Jan 11, 2022
High 8.1

CVE-2022-21646

Lookup operations do not take into account wildcards in SpiceDB

SpiceDB is a database system for managing security-critical application permissions. Any user making use of a wildcard relationship under the right hand branch of an `exclusion` or within an `intersection` operation will see `Lookup`/`LookupResources` return …

authzed spicedb github.com/authzed/spicedb Go

Jan 11, 2022
Unscored —

CVE-2021-46283

nf_tables_newset in net/netfilter/nf_tables_api.c in the Linux kernel before 5.12.13 allows local users to cause a deni…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Jan 11, 2022
Critical 9.0

CVE-2022-21969

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft Microsoft Exchange Server 2013 Cumulative Update 23 Microsoft Exchange Server 2019 Cumulative Update 11 Microsoft Exchange Server 2016 Cumulative Update 22

Jan 11, 2022
Medium 6.1

CVE-2022-21970 Public exploit

Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability

Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability

Microsoft Microsoft Edge (Chromium-based) Browsers

Jan 11, 2022
Medium 5.5

CVE-2022-21964

Remote Desktop Licensing Diagnoser Information Disclosure Vulnerability

Remote Desktop Licensing Diagnoser Information Disclosure Vulnerability

Microsoft Windows 10 Version 1607 Windows

Jan 11, 2022
Medium 6.4

CVE-2022-21963

Windows Resilient File System (ReFS) Remote Code Execution Vulnerability

Windows Resilient File System (ReFS) Remote Code Execution Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Jan 11, 2022
Medium 6.8

CVE-2022-21962

Windows Resilient File System (ReFS) Remote Code Execution Vulnerability

Windows Resilient File System (ReFS) Remote Code Execution Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Jan 11, 2022
Medium 6.8

CVE-2022-21961

Windows Resilient File System (ReFS) Remote Code Execution Vulnerability

Windows Resilient File System (ReFS) Remote Code Execution Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Jan 11, 2022
Medium 6.8

CVE-2022-21960

Windows Resilient File System (ReFS) Remote Code Execution Vulnerability

Windows Resilient File System (ReFS) Remote Code Execution Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Jan 11, 2022
Medium 6.8

CVE-2022-21959

Windows Resilient File System (ReFS) Remote Code Execution Vulnerability

Windows Resilient File System (ReFS) Remote Code Execution Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Jan 11, 2022
Medium 6.8

CVE-2022-21958

Windows Resilient File System (ReFS) Remote Code Execution Vulnerability

Windows Resilient File System (ReFS) Remote Code Execution Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Jan 11, 2022
Medium 6.1

CVE-2022-21954

Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability

Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability

Microsoft Microsoft Edge (Chromium-based) Browsers

Jan 11, 2022
High 7.6

CVE-2022-21932

Microsoft Dynamics 365 Customer Engagement Cross-Site Scripting Vulnerability

Microsoft Dynamics 365 Customer Engagement Cross-Site Scripting Vulnerability

Microsoft Microsoft Dynamics 365 Customer Engagement V9.0

Jan 11, 2022
Medium 4.2

CVE-2022-21931

Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

Microsoft Microsoft Edge (Chromium-based) Browsers

Jan 11, 2022
Medium 4.2

CVE-2022-21930

Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

Microsoft Microsoft Edge (Chromium-based) Browsers

Jan 11, 2022
Low 2.5

CVE-2022-21929

Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

Microsoft Microsoft Edge (Chromium-based) Browsers

Jan 11, 2022
Medium 6.3

CVE-2022-21928

Windows Resilient File System (ReFS) Remote Code Execution Vulnerability

Windows Resilient File System (ReFS) Remote Code Execution Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Jan 11, 2022
Medium 5.3

CVE-2022-21924

Workstation Service Remote Protocol Security Feature Bypass Vulnerability

Workstation Service Remote Protocol Security Feature Bypass Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Jan 11, 2022
Medium 5.3

CVE-2022-21925

Windows BackupKey Remote Protocol Security Feature Bypass Vulnerability

Windows BackupKey Remote Protocol Security Feature Bypass Vulnerability

Microsoft Windows Server 2008 R2 Service Pack 1 Windows Server 2008 R2 Service Pack 1 (Server Core installation) Windows Server 2008 Service Pack 2 Windows

Jan 11, 2022
High 8.8

CVE-2022-21922

Remote Procedure Call Runtime Remote Code Execution Vulnerability

Remote Procedure Call Runtime Remote Code Execution Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Jan 11, 2022
Medium 4.4

CVE-2022-21921

Windows Defender Credential Guard Security Feature Bypass Vulnerability

Windows Defender Credential Guard Security Feature Bypass Vulnerability

Microsoft Windows Server 2022 Windows 10 Version 21H2 Windows 11 version 21H2 Windows

Jan 11, 2022
High 8.8

CVE-2022-21920

Windows Kerberos Elevation of Privilege Vulnerability

Windows Kerberos Elevation of Privilege Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Jan 11, 2022
Medium 6.5

CVE-2022-21918

DirectX Graphics Kernel File Denial of Service Vulnerability

DirectX Graphics Kernel File Denial of Service Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Jan 11, 2022
High 7.0

CVE-2022-21919 Exploited

Windows User Profile Service Elevation of Privilege Vulnerability

Windows User Profile Service Elevation of Privilege Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Jan 11, 2022
KEV Apr 25, 2022
High 7.8

CVE-2022-21917

HEVC Video Extensions Remote Code Execution Vulnerability

HEVC Video Extensions Remote Code Execution Vulnerability

Microsoft HEVC Video Extensions

Jan 11, 2022
High 7.8

CVE-2022-21916

Windows Common Log File System Driver Elevation of Privilege Vulnerability

Windows Common Log File System Driver Elevation of Privilege Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Jan 11, 2022
Medium 6.5

CVE-2022-21915

Windows GDI+ Information Disclosure Vulnerability

Windows GDI+ Information Disclosure Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Jan 11, 2022
Medium 5.3

CVE-2022-21913

Local Security Authority (Domain Policy) Remote Protocol Security Feature Bypass

Local Security Authority (Domain Policy) Remote Protocol Security Feature Bypass

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Jan 11, 2022