# CVEs published 2022-02-01

72 CVEs were published on February 1, 2022: 2 critical, 7 high. Days are UTC.

- [CVE-2021-42638](https://cve.now/CVE-2021-42638.md): PrinterLogic Web Stack versions 19.1.1.13 SP9 and below do not sanitize user input resulting in pre-auth remote code execution. (no CVSS)
- [CVE-2022-24220](https://cve.now/CVE-2022-24220.md): eliteCMS v1.0 was discovered to contain a SQL injection vulnerability via /admin/edit\_post.php. (no CVSS)
- [CVE-2022-24223](https://cve.now/CVE-2022-24223.md): AtomCMS v2.0 was discovered to contain a SQL injection vulnerability via /admin/login.php. (no CVSS)
- [CVE-2022-24222](https://cve.now/CVE-2022-24222.md): eliteCMS v1.0 was discovered to contain a SQL injection vulnerability via /admin/edit\_user.php. (no CVSS)
- [CVE-2022-24221](https://cve.now/CVE-2022-24221.md): eliteCMS v1.0 was discovered to contain a SQL injection vulnerability via /admin/functions/functions.php. (no CVSS)
- [CVE-2022-24219](https://cve.now/CVE-2022-24219.md): eliteCMS v1.0 was discovered to contain a SQL injection vulnerability via /admin/edit\_page.php. (no CVSS)
- [CVE-2022-24218](https://cve.now/CVE-2022-24218.md): An issue in /admin/delete\_image.php of eliteCMS v1.0 allows attackers to delete arbitrary files. (no CVSS)
- [CVE-2021-46093](https://cve.now/CVE-2021-46093.md): eliteCMS v1.0 is vulnerable to Insecure Permissions via manage\_uploads.php. (no CVSS)
- [CVE-2021-38560](https://cve.now/CVE-2021-38560.md): Ivanti Service Manager 2021.1 allows reflected XSS via the appName parameter associated with ConfigDB calls, such as in RelocateAttachments. (no CVSS)
- [CVE-2021-44746](https://cve.now/CVE-2021-44746.md): UNIVERGE DT 820 V3.2.7.0 and prior, UNIVERGE DT 830 V5.2.7.0 and prior, UNIVERGE DT 930 V2.4.0.0 and prior, IP Phone Manager V8.9.1 and prio (no CVSS)
- [CVE-2021-44451](https://cve.now/CVE-2021-44451.md): API sensitive information leak (no CVSS, Apache Software Foundation Apache Superset · apache-superset)
- [CVE-2021-43510](https://cve.now/CVE-2021-43510.md): SQL Injection vulnerability exists in Sourcecodester Simple Client Management System 1.0 via the username field in login.php. (no CVSS)
- [CVE-2021-43509](https://cve.now/CVE-2021-43509.md): SQL Injection vulnerability exists in Sourcecodester Simple Client Management System 1.0 via the id parameter in view-service.php. (no CVSS)
- [CVE-2021-46253](https://cve.now/CVE-2021-46253.md): A cross-site scripting (XSS) vulnerability in the Create Post function of Anchor CMS v0.12.7 allows attackers to execute arbitrary web scrip (no CVSS)
- [CVE-2021-45416](https://cve.now/CVE-2021-45416.md): Reflected Cross-site scripting (XSS) vulnerability in RosarioSIS 8.2.1 allows attackers to inject arbitrary HTML via the search\_term paramet (no CVSS, francoisjacquet/rosariosis)
- [CVE-2021-41571](https://cve.now/CVE-2021-41571.md): Pulsar Admin API allows access to data from other tenants using getMessageById API (no CVSS, Apache Software Foundation Apache Pulsar · org.apache.pulsa…)
- [CVE-2022-0401](https://cve.now/CVE-2022-0401.md): Path Traversal in yuda-lyu/w-zip (CVSS 9.4, yuda-lyu/w-zip · w-zip)
- [CVE-2022-0320](https://cve.now/CVE-2022-0320.md): Essential Addons for Elementor \< 5.0.5 - Unauthenticated LFI (no CVSS, Essential Addons for Elementor)
- [CVE-2022-0220](https://cve.now/CVE-2022-0220.md): WordPress GDPR & CCPA \< 1.9.27 - Unauthenticated Reflected Cross-Site Scripting (no CVSS, WordPress GDPR)
- [CVE-2021-25092](https://cve.now/CVE-2021-25092.md): Link Library \< 7.2.8 - Library Settings Reset via CSRF (no CVSS, Link Library)
- [CVE-2021-25093](https://cve.now/CVE-2021-25093.md): Link Library \< 7.2.8 - Unauthenticated Arbitrary Links Deletion (no CVSS, Link Library)
- [CVE-2021-25091](https://cve.now/CVE-2021-25091.md): Link Library \< 7.2.9 - Reflected Cross-Site Scripting (no CVSS, Link Library)
- [CVE-2021-25089](https://cve.now/CVE-2021-25089.md): UpdraftPlus \< 1.16.69 - Reflected Cross-Site Scripting (no CVSS, UpdraftPlus WordPress Backup Plugin)
- [CVE-2021-25085](https://cve.now/CVE-2021-25085.md): WOOF - Products Filter for WooCommerce \< 1.2.6.3 - Reflected Cross-Site Scripting (no CVSS, WOOF – Products Filter for WooCommerce)
- [CVE-2021-25063](https://cve.now/CVE-2021-25063.md): Contact Form 7 Skins \< 2.5.1 - Reflected Cross-Site Scripting (XSS) (no CVSS, Skins for Contact Form)
- [CVE-2021-25072](https://cve.now/CVE-2021-25072.md): NextScripts: Social Networks Auto-Poster \< 4.3.25 - Arbitrary Post Deletion via CSRF (no CVSS, NextScripts: Social Networks Auto-Poster)
- [CVE-2021-24983](https://cve.now/CVE-2021-24983.md): Asset CleanUp \< 1.3.8.5 - Reflected Cross-Site Scripting via AJAX Action (no CVSS, Asset CleanUp: Page Speed Booster)
- [CVE-2021-24944](https://cve.now/CVE-2021-24944.md): Custom Dashboard & Login Page \< 7.0 - Admin+ Stored Cross-Site Scripting (no CVSS, Custom Dashboard & Login Page – AGCA)
- [CVE-2021-24975](https://cve.now/CVE-2021-24975.md): NextScripts: Social Networks Auto-Poster \< 4.3.24 - Unauthenticated Stored XSS (no CVSS, NextScripts: Social Networks Auto-Poster)
- [CVE-2021-24937](https://cve.now/CVE-2021-24937.md): Asset CleanUp \< 1.3.8.5 - Reflected Cross-Site Scripting (no CVSS, Asset CleanUp: Page Speed Booster)
- [CVE-2021-24934](https://cve.now/CVE-2021-24934.md): Visual CSS Style Editor \< 7.5.4 - Reflected Cross-Site Scripting (no CVSS, Visual CSS Style Editor)
- [CVE-2021-24919](https://cve.now/CVE-2021-24919.md): Wicked Folders \< 2.18.10 - Subscriber+ SQL Injection (no CVSS)
- [CVE-2021-24926](https://cve.now/CVE-2021-24926.md): Domain Check \< 1.0.17 - Reflected Cross-Site Scripting (no CVSS)
- [CVE-2021-24900](https://cve.now/CVE-2021-24900.md): Ninja Tables \< 4.1.8 - Admin+ Stored Cross-Site Cross-Site Scripting (no CVSS, Ninja Tables – Best WP DataTables Plugin for WordPress)
- [CVE-2021-24868](https://cve.now/CVE-2021-24868.md): Document Embedder \< 1.7.9 - Subscriber+ Arbitrary Private/Draft Post Title Disclosure (no CVSS)
- [CVE-2021-24775](https://cve.now/CVE-2021-24775.md): Document Embedder \< 1.7.5 - Unauthenticated Arbitrary Private/Draft Post Title Disclosure (no CVSS)
- [CVE-2021-24814](https://cve.now/CVE-2021-24814.md): WordPress GDPR & CCPA \< 1.9.26 - Authenticated Reflected Cross-Site Scripting (no CVSS)
- [CVE-2021-24765](https://cve.now/CVE-2021-24765.md): Perfect Survey \< 1.5.2 - Unauthenticated Stored Cross-Site Scripting (no CVSS)
- [CVE-2021-24764](https://cve.now/CVE-2021-24764.md): Perfect Survey \< 1.5.2 - Reflected Cross-Site Scripting (no CVSS)
- [CVE-2021-24762](https://cve.now/CVE-2021-24762.md): Perfect Survey \< 1.5.2 - Unauthenticated SQL Injection (no CVSS, Perfect Survey)
- [CVE-2021-24763](https://cve.now/CVE-2021-24763.md): Perfect Survey \< 1.5.2 - Unauthorised AJAX Call to Stored XSS / Survey Settings Update (no CVSS)
- [CVE-2021-24761](https://cve.now/CVE-2021-24761.md): Error Log Viewer \< 1.1.2 - Arbitrary Text File Deletion via CSRF (no CVSS, Error Log Viewer by BestWebSoft)
- [CVE-2021-24707](https://cve.now/CVE-2021-24707.md): Learning Courses \< 5.0 - Admin+ Stored Cross-Site Scripting (no CVSS)
- [CVE-2021-24648](https://cve.now/CVE-2021-24648.md): Registration Magic \< 5.0.1.9 - Reflected Cross-Site Scripting (no CVSS)
- [CVE-2021-24686](https://cve.now/CVE-2021-24686.md): SVG Support \< 2.3.20 - Admin+ Stored Cross-Site Scripting (no CVSS)
- [CVE-2022-23601](https://cve.now/CVE-2022-23601.md): CSRF token missing in Symfony (CVSS 8.1, symfony · symfony/framework-bundle)
- [CVE-2021-43848](https://cve.now/CVE-2021-43848.md): Unititialized memory access in h2o (CVSS 7.4, h2o)
- [CVE-2021-43859](https://cve.now/CVE-2021-43859.md): Denial of Service by injecting highly recursive collections or maps in XStream (CVSS 7.5, x-stream xstream · com.thoughtworks.xstream:xstream)
- [CVE-2022-21687](https://cve.now/CVE-2022-21687.md): Command injection in gh-ost (CVSS 6.8, github.com/github/gh-ost)
- [CVE-2022-23596](https://cve.now/CVE-2022-23596.md): Infinite loop in junrar (CVSS 7.5, com.github.junrar:junrar)
- [CVE-2022-23597](https://cve.now/CVE-2022-23597.md): Remote program execution with user interaction (CVSS 8.3)
- [CVE-2021-41040](https://cve.now/CVE-2021-41040.md): In Eclipse Wakaama, ever since its inception until 2021-01-14, the CoAP parsing code does not properly sanitize network-received data. (no CVSS)
- [CVE-2022-23607](https://cve.now/CVE-2022-23607.md): Unsafe handling of user-specified cookies in treq (CVSS 6.5, twisted treq · treq)
- [CVE-2022-23602](https://cve.now/CVE-2022-23602.md): Nim's rst parser sandboxed mode allows include which can embed any local file (CVSS 7.7)
- [CVE-2022-23603](https://cve.now/CVE-2022-23603.md): Code injection in iTunesRPC-Remastered (CVSS 9.9)
- [CVE-2022-0419](https://cve.now/CVE-2022-0419.md): NULL Pointer Dereference in radareorg/radare2 (CVSS 5.9, radareorg/radare2)
- [CVE-2020-8562](https://cve.now/CVE-2020-8562.md): Bypass of Kubernetes API Server proxy TOCTOU (CVSS 2.2, Kubernetes · k8s.io/kubernetes)
- [CVE-2022-23774](https://cve.now/CVE-2022-23774.md): Docker Desktop before 4.4.4 on Windows allows attackers to move arbitrary files. (no CVSS)
- [CVE-2021-46661](https://cve.now/CVE-2021-46661.md): MariaDB through 10.5.9 allows an application crash in find\_field\_in\_tables and find\_order\_in\_list via an unused common table expression (CTE (no CVSS)
- [CVE-2021-46662](https://cve.now/CVE-2021-46662.md): MariaDB through 10.5.9 allows a set\_var.cc application crash via certain uses of an UPDATE statement in conjunction with a nested subquery. (no CVSS)
- [CVE-2021-46663](https://cve.now/CVE-2021-46663.md): MariaDB through 10.5.13 allows a ha\_maria::extra application crash via certain SELECT statements. (no CVSS)
- [CVE-2021-46664](https://cve.now/CVE-2021-46664.md): MariaDB through 10.5.9 allows an application crash in sub\_select\_postjoin\_aggr for a NULL value of aggr. (no CVSS)
- [CVE-2021-46665](https://cve.now/CVE-2021-46665.md): MariaDB through 10.5.9 allows a sql\_parse.cc application crash because of incorrect used\_tables expectations. (no CVSS)
- [CVE-2021-46666](https://cve.now/CVE-2021-46666.md): MariaDB before 10.6.2 allows an application crash because of mishandling of a pushdown from a HAVING clause to a WHERE clause. (no CVSS)
- [CVE-2021-46667](https://cve.now/CVE-2021-46667.md): MariaDB before 10.6.5 has a sql\_lex.cc integer overflow, leading to an application crash. (no CVSS)
- [CVE-2021-46668](https://cve.now/CVE-2021-46668.md): MariaDB through 10.5.9 allows an application crash via certain long SELECT DISTINCT statements that improperly interact with storage-engine (no CVSS)
- [CVE-2021-46669](https://cve.now/CVE-2021-46669.md): MariaDB through 10.5.9 allows attackers to trigger a convert\_const\_to\_int use-after-free when the BIGINT data type is used. (no CVSS)
- [CVE-2021-25097](https://cve.now/CVE-2021-25097.md): LabTools \<= 1.0 - Subscriber+ Arbitrary Publication Deletion (no CVSS, LabTools)
- [CVE-2022-0417](https://cve.now/CVE-2022-0417.md): Heap-based Buffer Overflow in vim/vim (CVSS 8.4, vim/vim)
- [CVE-2022-24196](https://cve.now/CVE-2022-24196.md): iText v7.1.17, up to (exluding)": 7.1.18 and 7.2.2 was discovered to contain an out-of-memory error via the component readStreamBytesRaw, wh (no CVSS, com.itextpdf:itext7-core)
- [CVE-2022-24197](https://cve.now/CVE-2022-24197.md): iText v7.1.17 was discovered to contain a stack-based buffer overflow via the component ByteBuffer.append, which allows attackers to cause a (no CVSS, com.itextpdf:itext7-core)
- [CVE-2022-24198](https://cve.now/CVE-2022-24198.md): iText v7.1.17 was discovered to contain an out-of-bounds exception via the component ARCFOUREncryption.encryptARCFOUR, which allows attacker (no CVSS, com.itextpdf:itext7-core)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-02-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.