CVEs published February 1, 2022
72 CVEs were published on February 1, 2022: 2 critical, 7 high.
- Published
- 72
- Critical
- 2
- High
- 7
- Medium
- 3
- Low
- 1
- Unrated
- 59
- Now in CISA KEV
- 0
- Fix available
- 31
Most affected products
- com.itextpdf:itext7-core
- 3
- Link Library
- 3
- Asset CleanUp: Page Speed Booster
- 2
- NextScripts: Social Networks Auto-Poster
- 2
- Apache Software Foundation Apache Pulsar · org.apache.pulsa…
- 1
- Apache Software Foundation Apache Superset · apache-superset
- 1
- com.github.junrar:junrar
- 1
- Custom Dashboard & Login Page – AGCA
- 1
- Error Log Viewer by BestWebSoft
- 1
- Essential Addons for Elementor
- 1
Critical 2
High 7
- CVE-2022-23601CSRF token missing in Symfonysymfony · symfony/framework-bundle
- CVE-2021-43848Unititialized memory access in h2oh2o
- CVE-2021-43859Denial of Service by injecting highly recursive collections or maps in XStreamx-stream xstream · com.thoughtworks.xstream:xstream
- CVE-2022-23596Infinite loop in junrarcom.github.junrar:junrar
- CVE-2022-23597Remote program execution with user interaction
- CVE-2022-23602Nim's rst parser sandboxed mode allows include which can embed any local file
- CVE-2022-0417Heap-based Buffer Overflow in vim/vimvim/vim
Medium, low and unrated 63
- CVE-2021-42638PrinterLogic Web Stack versions 19.1.1.13 SP9 and below do not sanitize user input resulting in pre-auth remote code execution.
- CVE-2022-24220eliteCMS v1.0 was discovered to contain a SQL injection vulnerability via /admin/edit_post.php.
- CVE-2022-24223AtomCMS v2.0 was discovered to contain a SQL injection vulnerability via /admin/login.php.
- CVE-2022-24222eliteCMS v1.0 was discovered to contain a SQL injection vulnerability via /admin/edit_user.php.
- CVE-2022-24221eliteCMS v1.0 was discovered to contain a SQL injection vulnerability via /admin/functions/functions.php.
- CVE-2022-24219eliteCMS v1.0 was discovered to contain a SQL injection vulnerability via /admin/edit_page.php.
- CVE-2022-24218An issue in /admin/delete_image.php of eliteCMS v1.0 allows attackers to delete arbitrary files.
- CVE-2021-46093eliteCMS v1.0 is vulnerable to Insecure Permissions via manage_uploads.php.
- CVE-2021-38560Ivanti Service Manager 2021.1 allows reflected XSS via the appName parameter associated with ConfigDB calls, such as in RelocateAttachments.
- CVE-2021-44746UNIVERGE DT 820 V3.2.7.0 and prior, UNIVERGE DT 830 V5.2.7.0 and prior, UNIVERGE DT 930 V2.4.0.0 and prior, IP Phone Manager V8.9.1 and prio
- CVE-2021-44451API sensitive information leakApache Software Foundation Apache Superset · apache-superset
- CVE-2021-43510SQL Injection vulnerability exists in Sourcecodester Simple Client Management System 1.0 via the username field in login.php.
- CVE-2021-43509SQL Injection vulnerability exists in Sourcecodester Simple Client Management System 1.0 via the id parameter in view-service.php.
- CVE-2021-46253A cross-site scripting (XSS) vulnerability in the Create Post function of Anchor CMS v0.12.7 allows attackers to execute arbitrary web scrip
- CVE-2021-45416Reflected Cross-site scripting (XSS) vulnerability in RosarioSIS 8.2.1 allows attackers to inject arbitrary HTML via the search_term parametfrancoisjacquet/rosariosis
- CVE-2021-41571Pulsar Admin API allows access to data from other tenants using getMessageById APIApache Software Foundation Apache Pulsar · org.apache.pulsa…
- CVE-2022-0320Essential Addons for Elementor < 5.0.5 - Unauthenticated LFIEssential Addons for Elementor
- CVE-2022-0220WordPress GDPR & CCPA < 1.9.27 - Unauthenticated Reflected Cross-Site ScriptingWordPress GDPR
- CVE-2021-25092Link Library < 7.2.8 - Library Settings Reset via CSRFLink Library
- CVE-2021-25093Link Library < 7.2.8 - Unauthenticated Arbitrary Links DeletionLink Library
- CVE-2021-25091Link Library < 7.2.9 - Reflected Cross-Site ScriptingLink Library
- CVE-2021-25089UpdraftPlus < 1.16.69 - Reflected Cross-Site ScriptingUpdraftPlus WordPress Backup Plugin
- CVE-2021-25085WOOF - Products Filter for WooCommerce < 1.2.6.3 - Reflected Cross-Site ScriptingWOOF – Products Filter for WooCommerce
- CVE-2021-25063Contact Form 7 Skins < 2.5.1 - Reflected Cross-Site Scripting (XSS)Skins for Contact Form
- CVE-2021-25072NextScripts: Social Networks Auto-Poster < 4.3.25 - Arbitrary Post Deletion via CSRFNextScripts: Social Networks Auto-Poster
- CVE-2021-24983Asset CleanUp < 1.3.8.5 - Reflected Cross-Site Scripting via AJAX ActionAsset CleanUp: Page Speed Booster
- CVE-2021-24944Custom Dashboard & Login Page < 7.0 - Admin+ Stored Cross-Site ScriptingCustom Dashboard & Login Page – AGCA
- CVE-2021-24975NextScripts: Social Networks Auto-Poster < 4.3.24 - Unauthenticated Stored XSSNextScripts: Social Networks Auto-Poster
- CVE-2021-24937Asset CleanUp < 1.3.8.5 - Reflected Cross-Site ScriptingAsset CleanUp: Page Speed Booster
- CVE-2021-24934Visual CSS Style Editor < 7.5.4 - Reflected Cross-Site ScriptingVisual CSS Style Editor
- CVE-2021-24919Wicked Folders < 2.18.10 - Subscriber+ SQL Injection
- CVE-2021-24926Domain Check < 1.0.17 - Reflected Cross-Site Scripting
- CVE-2021-24900Ninja Tables < 4.1.8 - Admin+ Stored Cross-Site Cross-Site ScriptingNinja Tables – Best WP DataTables Plugin for WordPress
- CVE-2021-24868Document Embedder < 1.7.9 - Subscriber+ Arbitrary Private/Draft Post Title Disclosure
- CVE-2021-24775Document Embedder < 1.7.5 - Unauthenticated Arbitrary Private/Draft Post Title Disclosure
- CVE-2021-24814WordPress GDPR & CCPA < 1.9.26 - Authenticated Reflected Cross-Site Scripting
- CVE-2021-24765Perfect Survey < 1.5.2 - Unauthenticated Stored Cross-Site Scripting
- CVE-2021-24764Perfect Survey < 1.5.2 - Reflected Cross-Site Scripting
- CVE-2021-24762Perfect Survey < 1.5.2 - Unauthenticated SQL InjectionPerfect Survey
- CVE-2021-24763Perfect Survey < 1.5.2 - Unauthorised AJAX Call to Stored XSS / Survey Settings Update
- CVE-2021-24761Error Log Viewer < 1.1.2 - Arbitrary Text File Deletion via CSRFError Log Viewer by BestWebSoft
- CVE-2021-24707Learning Courses < 5.0 - Admin+ Stored Cross-Site Scripting
- CVE-2021-24648Registration Magic < 5.0.1.9 - Reflected Cross-Site Scripting
- CVE-2021-24686SVG Support < 2.3.20 - Admin+ Stored Cross-Site Scripting
- CVE-2022-21687Command injection in gh-ostgithub.com/github/gh-ost
- CVE-2021-41040In Eclipse Wakaama, ever since its inception until 2021-01-14, the CoAP parsing code does not properly sanitize network-received data.
- CVE-2022-23607Unsafe handling of user-specified cookies in treqtwisted treq · treq
- CVE-2022-0419NULL Pointer Dereference in radareorg/radare2radareorg/radare2
- CVE-2020-8562Bypass of Kubernetes API Server proxy TOCTOUKubernetes · k8s.io/kubernetes
- CVE-2022-23774Docker Desktop before 4.4.4 on Windows allows attackers to move arbitrary files.
- CVE-2021-46661MariaDB through 10.5.9 allows an application crash in find_field_in_tables and find_order_in_list via an unused common table expression (CTE
- CVE-2021-46662MariaDB through 10.5.9 allows a set_var.cc application crash via certain uses of an UPDATE statement in conjunction with a nested subquery.
- CVE-2021-46663MariaDB through 10.5.13 allows a ha_maria::extra application crash via certain SELECT statements.
- CVE-2021-46664MariaDB through 10.5.9 allows an application crash in sub_select_postjoin_aggr for a NULL value of aggr.
- CVE-2021-46665MariaDB through 10.5.9 allows a sql_parse.cc application crash because of incorrect used_tables expectations.
- CVE-2021-46666MariaDB before 10.6.2 allows an application crash because of mishandling of a pushdown from a HAVING clause to a WHERE clause.
- CVE-2021-46667MariaDB before 10.6.5 has a sql_lex.cc integer overflow, leading to an application crash.
- CVE-2021-46668MariaDB through 10.5.9 allows an application crash via certain long SELECT DISTINCT statements that improperly interact with storage-engine
- CVE-2021-46669MariaDB through 10.5.9 allows attackers to trigger a convert_const_to_int use-after-free when the BIGINT data type is used.
- CVE-2021-25097LabTools <= 1.0 - Subscriber+ Arbitrary Publication DeletionLabTools
- CVE-2022-24196iText v7.1.17, up to (exluding)": 7.1.18 and 7.2.2 was discovered to contain an out-of-memory error via the component readStreamBytesRaw, whcom.itextpdf:itext7-core
- CVE-2022-24197iText v7.1.17 was discovered to contain a stack-based buffer overflow via the component ByteBuffer.append, which allows attackers to cause acom.itextpdf:itext7-core
- CVE-2022-24198iText v7.1.17 was discovered to contain an out-of-bounds exception via the component ARCFOUREncryption.encryptARCFOUR, which allows attackercom.itextpdf:itext7-core