Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: January 2022

67 records · 12 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2021-24786
    33Monitor

    Download Monitor < 4.4.5 - Admin+ SQL Injection

    HighCVSS 7.2Proof of conceptEPSS 17%

    wpchill · download monitorJan 3, 2022

  • CVE-2021-45428
    56Plan

    TLR-2005KSH is affected by an incorrect access control vulnerability.

    CriticalCVSS 9.8Proof of conceptEPSS 56%

    telesquare · tlr-2005ksh firmwareJan 3, 2022

  • CVE-2021-43942
    41Plan

    Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Reflected Cro

    MediumCVSS 6.1No exploitEPSS 55%

    atlassian · jira serverJan 3, 2022

  • CVE-2021-44168
    61This week

    A download of code without integrity check vulnerability in the "execute restore src-vis" command of FortiOS before 7.0.3 may allow a local

    HighCVSS 7.8KEVWeaponizedEPSS 0%

    fortinet · fortiosJan 4, 2022

  • CVE-2021-43711
    50Plan

    The downloadFlile.cgi binary file in TOTOLINK EX200 V4.0.3c.7646_B20201211 has a command injection vulnerability when receiving GET paramete

    CriticalCVSS 9.8No exploitEPSS 37%

    totolink · ex200 firmwareJan 4, 2022

  • CVE-2022-21647
    50Plan

    Deserialization of Untrusted Data in Codeigniter4

    CriticalCVSS 9.8No exploitEPSS 37%

    codeigniter · codeigniterJan 4, 2022

  • CVE-2021-31589
    32Monitor

    A cross-site scripting (XSS) vulnerability has been reported and confirmed for BeyondTrust Secure Remote Access Base Software version 6.0.1

    MediumCVSS 6.1Proof of conceptEPSS 25%

    beyondtrust · appliance base softwareJan 5, 2022

  • CVE-2021-45456
    66This week

    Apache kylin checks the legitimacy of the project before executing some commands with the project name passed in by the user.

    CriticalCVSS 9.8No exploitEPSS 88%

    apache · kylinJan 6, 2022

  • CVE-2022-21661
    59Plan

    SQL injection in WordPress

    HighCVSS 7.5Proof of conceptEPSS 97%

    wordpress · wordpressJan 6, 2022

  • CVE-2022-21662
    40Plan

    Stored XSS in WordPress

    MediumCVSS 5.4No exploitEPSS 64%

    wordpress · wordpressJan 6, 2022

  • CVE-2021-35247
    52Plan

    Improper Input Validation Vulnerability in Serv-U

    MediumCVSS 5.3KEVWeaponizedEPSS 3%

    solarwinds · serv-uJan 10, 2022

  • CVE-2021-42392
    64This week

    The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database.

    CriticalCVSS 9.8Proof of conceptEPSS 83%

    h2database · h2Jan 10, 2022

  • CVE-2022-22265
    61This week

    An improper check or handling of exceptional conditions in NPU driver prior to SMR Jan-2022 Release 1 allows arbitrary memory write and code

    HighCVSS 7.8KEVWeaponizedEPSS 0%

    google · androidJan 10, 2022

  • CVE-2021-24862
    50Plan

    RegistrationMagic < 5.0.1.6 - Admin+ SQL Injection

    HighCVSS 7.2WeaponizedEPSS 73%

    metagauss · registrationmagicJan 10, 2022

  • CVE-2021-43297
    44Plan

    Dubbo Hessian cause RCE when parse error

    CriticalCVSS 9.8Proof of conceptEPSS 16%

    apache · dubboJan 10, 2022

  • CVE-2022-21881
    35Monitor

    Windows Kernel Elevation of Privilege Vulnerability

    HighCVSS 7.0Proof of conceptEPSS 24%

    microsoft · windows 10Jan 11, 2022

  • CVE-2022-21882
    79This week

    Win32k Elevation of Privilege Vulnerability

    HighCVSS 7.8KEVWeaponizedEPSS 59%

    microsoft · windows 10 1809Jan 11, 2022

  • CVE-2022-21907
    67This week

    HTTP Protocol Stack Remote Code Execution Vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 92%

    microsoft · windows 10Jan 11, 2022

  • CVE-2022-21919
    59Plan

    Windows User Profile Service Elevation of Privilege Vulnerability

    HighCVSS 7.0KEVWeaponizedEPSS 2%

    microsoft · windows 10 1507Jan 11, 2022

  • CVE-2021-42561
    41Plan

    An issue was discovered in CALDERA 2.8.1.

    HighCVSS 8.8Proof of conceptEPSS 19%

    mitre · calderaJan 12, 2022

  • CVE-2022-20615
    46Plan

    Jenkins Matrix Project Plugin 1.19 and earlier does not escape HTML metacharacters in node and label names, and label descriptions, resultin

    MediumCVSS 5.4No exploitEPSS 81%

    jenkins · matrix projectJan 12, 2022

  • CVE-2022-23111
    25Monitor

    A cross-site request forgery (CSRF) vulnerability in Jenkins Publish Over SSH Plugin 1.22 and earlier allows attackers to connect to an atta

    MediumCVSS 4.3No exploitEPSS 26%

    jenkins · publish over sshJan 12, 2022

  • CVE-2022-23131
    98Now

    Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML

    CriticalCVSS 9.8KEVWeaponizedEPSS 95%

    zabbix · zabbixJan 13, 2022

  • CVE-2022-23134
    80Now

    Possible view of the setup pages by unauthenticated users if config file already exists

    MediumCVSS 5.3KEVWeaponizedEPSS 95%

    zabbix · zabbixJan 13, 2022

  • CVE-2021-34995
    56Plan

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22.

    HighCVSS 8.8No exploitEPSS 68%

    commvault · commcellJan 13, 2022

  • CVE-2021-34996
    60This week

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22.

    HighCVSS 8.8No exploitEPSS 82%

    commvault · commcellJan 13, 2022

  • CVE-2022-23227
    84Now

    NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users

    CriticalCVSS 9.8KEVWeaponizedEPSS 48%

    nuuo · nvrmini2 firmwareJan 14, 2022

  • CVE-2021-44701
    37Monitor

    Adobe Acrobat Reader DC AcroForm Use-After-Free Remote Code Execution Vulnerability

    HighCVSS 7.8No exploitEPSS 20%

    adobe · acrobat dcJan 14, 2022

  • CVE-2021-44703
    48Plan

    Adobe Acrobat Pro DC Stack Overflow Vulnerability Arbitrary code execution

    HighCVSS 7.8No exploitEPSS 57%

    adobe · acrobat dcJan 14, 2022

  • CVE-2021-44704
    34Monitor

    Adobe Acrobat Reader Use-After-Free could lead to Arbitrary code execution

    HighCVSS 7.8No exploitEPSS 10%

    adobe · acrobat dcJan 14, 2022

  • CVE-2021-44708
    42Plan

    Adobe Acrobat Pro DC Heap Overflow could lead to Arbitrary code execution

    HighCVSS 7.8No exploitEPSS 38%

    adobe · acrobat dcJan 14, 2022

  • CVE-2021-44709
    40Plan

    Adobe Acrobat Pro DC Heap Overflow Vulnerability could lead to Arbitrary code execution

    HighCVSS 7.8No exploitEPSS 29%

    adobe · acrobat dcJan 14, 2022

  • CVE-2021-44710
    34Monitor

    Adobe Acrobat Reader Use-after-free could lead to Arbitrary code execution

    HighCVSS 7.8No exploitEPSS 11%

    adobe · acrobat dcJan 14, 2022

  • CVE-2021-44715
    26Monitor

    Adobe Acrobat Reader DC Out-of-Bounds Read Information Disclosure Vulnerability

    MediumCVSS 5.5No exploitEPSS 14%

    adobe · acrobat dcJan 14, 2022

  • CVE-2021-45062
    36Monitor

    Adobe Acrobat Reader DC Font Parsing Use-After-Free Remote Code Execution Vulnerability

    HighCVSS 7.8No exploitEPSS 16%

    adobe · acrobat dcJan 14, 2022

  • CVE-2021-45064
    34Monitor

    Adobe Acrobat Reader DC AcroForm Use-After-Free Remote Code Execution Vulnerability

    HighCVSS 7.8No exploitEPSS 11%

    adobe · acrobat dcJan 14, 2022

  • CVE-2021-45068
    35Monitor

    Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

    HighCVSS 7.8No exploitEPSS 12%

    adobe · acrobat dcJan 14, 2022

  • CVE-2022-23178
    62This week

    An issue was discovered on Crestron HD-MD4X2-4K-E 1.0.0.2159 devices.

    CriticalCVSS 9.8Proof of conceptEPSS 75%

    crestron · hd-md4x2-4k-e firmwareJan 15, 2022

  • CVE-2021-44757
    43Plan

    Zoho ManageEngine Desktop Central before 10.1.2137.9 and Desktop Central MSP before 10.1.2137.9 allow attackers to bypass authentication, an

    CriticalCVSS 9.1No exploitEPSS 24%

    zohocorp · manageengine desktop centralJan 18, 2022

  • CVE-2022-23302
    54Plan

    Deserialization of untrusted data in JMSSink in Apache Log4j 1.x

    HighCVSS 8.8No exploitEPSS 63%

    apache · log4jJan 18, 2022

  • CVE-2022-23305
    59Plan

    SQL injection in JDBC Appender in Apache Log4j V1

    CriticalCVSS 9.8Proof of conceptEPSS 66%

    apache · log4jJan 18, 2022

  • CVE-2022-23307
    51Plan

    A deserialization flaw in the Chainsaw component of Log4j 1 can lead to malicious code execution.

    HighCVSS 8.8No exploitEPSS 54%

    apache · chainsawJan 18, 2022

  • CVE-2021-35587
    98Now

    Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: OpenSSO Agent).

    CriticalCVSS 9.8KEVWeaponizedEPSS 96%

    oracle · access managerJan 19, 2022

  • CVE-2022-21279
    49Plan

    Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General).

    MediumCVSS 6.3No exploitEPSS 78%

    oracle · mysqlJan 19, 2022

  • CVE-2022-21280
    48Plan

    Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General).

    MediumCVSS 6.3No exploitEPSS 76%

    oracle · mysqlJan 19, 2022

  • CVE-2022-21371
    58Plan

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container).

    HighCVSS 7.5Proof of conceptEPSS 92%

    oracle · weblogic serverJan 19, 2022

  • CVE-2022-23221
    58Plan

    H2 Console before 2.1.210 allows remote attackers to execute arbitrary code via a jdbc:h2:mem JDBC URL containing the IGNORE_UNKNOWN_SETTING

    CriticalCVSS 9.8Proof of conceptEPSS 64%

    h2database · h2Jan 19, 2022

  • CVE-2022-23046
    36Monitor

    PhpIPAM v1.4.4 allows an authenticated admin user to inject SQL sentences in the "subnet" parameter while searching a subnet via app/admin/r

    HighCVSS 7.2Proof of conceptEPSS 25%

    phpipam · phpipamJan 19, 2022

  • CVE-2022-0281
    33Monitor

    Exposure of Sensitive Information to an Unauthorized Actor in microweber/microweber

    HighCVSS 7.5Proof of conceptEPSS 10%

    microweber · microweberJan 20, 2022

  • CVE-2022-22733
    37Monitor

    Access-Token in ElasticJob UI causes password disclosure

    MediumCVSS 6.5Proof of conceptEPSS 37%

    apache · shardingsphere elasticjob-uiJan 20, 2022

  • CVE-2022-23119
    37Monitor

    A directory traversal vulnerability in Trend Micro Deep Security and Cloud One - Workload Security Agent for Linux version 20 and below coul

    HighCVSS 7.5No exploitEPSS 22%

    linux · linux kernelJan 20, 2022

  • CVE-2022-22930
    46Plan

    A remote code execution (RCE) vulnerability in the Template Management function of MCMS v5.2.4 allows attackers to execute arbitrary code vi

    CriticalCVSS 9.8No exploitEPSS 23%

    mingsoft · mcmsJan 20, 2022

  • CVE-2021-25076
    40Plan

    WP User Frontend < 3.5.26 - SQL Injection to Reflected Cross-Site Scripting

    HighCVSS 8.8Proof of conceptEPSS 17%

    wedevs · wp user frontendJan 24, 2022

  • CVE-2021-25080
    49Plan

    Contact Form Entries < 1.1.7 - Unauthenticated Stored Cross-Site Scripting

    MediumCVSS 6.1No exploitEPSS 84%

    crmperks · contact form entriesJan 24, 2022

  • CVE-2022-23437
    29Monitor

    Infinite loop within Apache XercesJ xml parser

    MediumCVSS 6.5No exploitEPSS 11%

    apache · xerces-jJan 24, 2022

  • CVE-2022-23944
    60This week

    Apache ShenYu 2.4.1 Improper access control

    CriticalCVSS 9.1Proof of conceptEPSS 79%

    apache · shenyuJan 25, 2022

  • CVE-2022-0332
    52Plan

    A flaw was found in Moodle in versions 3.11 to 3.11.4.

    CriticalCVSS 9.8Proof of conceptEPSS 44%

    moodle · moodleJan 25, 2022

  • CVE-2021-22600
    60This week

    Double Free in net/packet/af_packet.c leading to priviledge escalation

    HighCVSS 7.0KEVWeaponizedEPSS 6%

    netapp · 8300 firmwareJan 26, 2022

  • CVE-2021-46065
    47Plan

    A Cross-site scripting (XSS) vulnerability in Secondary Email Field in Zoho ManageEngine ServiceDesk Plus 11.3 Build 11306 allows an attacke

    MediumCVSS 4.8No exploitEPSS 92%

    zohocorp · manageengine servicedesk plusJan 27, 2022

  • CVE-2021-23174
    44Plan

    WordPress Download Monitor plugin <= 4.4.6 - Auth. Stored Cross-Site Scripting (XSS) vulnerability

    MediumCVSS 4.8No exploitEPSS 83%

    wpchill · download monitorJan 28, 2022

  • CVE-2021-40407
    72This week

    An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102.

    HighCVSS 7.2KEVWeaponizedEPSS 47%

    reolink · rlc-410w firmwareJan 28, 2022

  • CVE-2021-40410
    36Monitor

    An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102.

    HighCVSS 7.2No exploitEPSS 27%

    reolink · rlc-410w firmwareJan 28, 2022

  • CVE-2021-40412
    36Monitor

    An OScommand injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102.

    HighCVSS 7.2No exploitEPSS 27%

    reolink · rlc-410w firmwareJan 28, 2022

  • CVE-2021-4034
    89Now

    A local privilege escalation vulnerability was found on polkit's pkexec utility.

    HighCVSS 7.8KEVWeaponizedEPSS 94%

    polkit project · polkitJan 28, 2022

  • CVE-2022-24124
    47Plan

    The query API in Casdoor before 1.13.1 has a SQL injection vulnerability related to the field and value parameters, as demonstrated by api/g

    HighCVSS 7.5Proof of conceptEPSS 55%

    casbin · casdoorJan 29, 2022

  • CVE-2021-34805
    38Monitor

    An issue was discovered in FAUST iServer before 9.0.019.019.7.

    HighCVSS 7.5Proof of conceptEPSS 26%

    land-software · faust iserverJan 31, 2022

  • CVE-2022-23409
    23Monitor

    The Logs plugin before 3.0.4 for Craft CMS allows remote attackers to read arbitrary files via input to actionStream in Controller.php.

    MediumCVSS 4.9Proof of conceptEPSS 13%

    ethercreative · logsJan 31, 2022