# CVEs published 2022-02-02

29 CVEs were published on February 2, 2022: 2 critical, 10 high. Days are UTC.

- [CVE-2022-24069](https://cve.now/CVE-2022-24069.md): An issue was discovered in AhciBusDxe in Insyde InsydeH2O with kernel 5.0 before 05.08.41, 5.1 before 05.16.29, 5.2 before 05.26.29, 5.3 bef (no CVSS)
- [CVE-2021-43522](https://cve.now/CVE-2021-43522.md): An issue was discovered in Insyde InsydeH2O with kernel 5.1 through 2021-11-08, 5.2 through 2021-11-08, and 5.3 through 2021-11-08. (no CVSS)
- [CVE-2022-0432](https://cve.now/CVE-2022-0432.md): Prototype Pollution in mastodon/mastodon (CVSS 7.4, mastodon/mastodon)
- [CVE-2021-42642](https://cve.now/CVE-2021-42642.md): PrinterLogic Web Stack versions 19.1.1.13 SP9 and below are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability that allo (no CVSS)
- [CVE-2021-42641](https://cve.now/CVE-2021-42641.md): PrinterLogic Web Stack versions 19.1.1.13 SP9 and below are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability that allo (no CVSS)
- [CVE-2021-42640](https://cve.now/CVE-2021-42640.md): PrinterLogic Web Stack versions 19.1.1.13 SP9 and below are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability that allo (no CVSS)
- [CVE-2021-42639](https://cve.now/CVE-2021-42639.md): PrinterLogic Web Stack versions 19.1.1.13 SP9 and below are vulnerable to multiple reflected cross site scripting vulnerabilities. (no CVSS)
- [CVE-2021-42637](https://cve.now/CVE-2021-42637.md): PrinterLogic Web Stack versions 19.1.1.13 SP9 and below use user-controlled input to craft a URL, resulting in a Server Side Request Forgery (no CVSS)
- [CVE-2021-42633](https://cve.now/CVE-2021-42633.md): PrinterLogic Web Stack versions 19.1.1.13 SP9 and below are vulnerable to SQL Injection, which may allow an attacker to access additional au (no CVSS)
- [CVE-2022-22510](https://cve.now/CVE-2022-22510.md): CODESYS: Null Pointer Dereference in CODESYS PROFINET stack (CVSS 7.5)
- [CVE-2022-22509](https://cve.now/CVE-2022-22509.md): PHOENIX CONTACT: FL SWITCH 2xxx series incorrect privilege assignment (CVSS 8.8)
- [CVE-2022-21817](https://cve.now/CVE-2022-21817.md): NVIDIA Omniverse Launcher contains a Cross-Origin Resource Sharing (CORS) vulnerability which can allow an unprivileged remote attacker, if (CVSS 9.3)
- [CVE-2021-39070](https://cve.now/CVE-2021-39070.md): IBM Security Verify Access 10.0.0.0, 10.0.1.0 and 10.0.2.0 with the advanced access control authentication service enabled could allow an at (CVSS 9.8)
- [CVE-2021-39066](https://cve.now/CVE-2021-39066.md): IBM Financial Transaction Manager 3.2.4 does not invalidate session any existing session identifier gives an attacker the opportunity to ste (CVSS 6.3)
- [CVE-2021-39044](https://cve.now/CVE-2021-39044.md): IBM Financial Transaction Manager 3.2.4 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and u (CVSS 4.3)
- [CVE-2021-24043](https://cve.now/CVE-2021-24043.md): A missing bound check in RTCP flag parsing code prior to WhatsApp for Android v2.21.23.2, WhatsApp Business for Android v2.21.23.2, WhatsApp (no CVSS)
- [CVE-2020-26208](https://cve.now/CVE-2020-26208.md): Heap-buffer-overflow in jhead (CVSS 5.3)
- [CVE-2022-21724](https://cve.now/CVE-2022-21724.md): Unchecked Class Instantiation when providing Plugin Classes (CVSS 7.0, org.postgresql:postgresql)
- [CVE-2022-0366](https://cve.now/CVE-2022-0366.md): An authenticated and authorized agent user could potentially gain administrative access via an SQLi vulnerability to Capsule8 Console betwee (CVSS 8.8)
- [CVE-2021-41018](https://cve.now/CVE-2021-41018.md): A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWeb version 6.4.1 and below, 6 (CVSS 8.8)
- [CVE-2021-36193](https://cve.now/CVE-2021-36193.md): Multiple stack-based buffer overflows in the command line interpreter of FortiWeb before 6.4.2 may allow an authenticated attacker to achiev (CVSS 6.3, Fortinet FortiFone · Fortinet FortiADC +8)
- [CVE-2021-43062](https://cve.now/CVE-2021-43062.md): A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiMail version 7.0.1 and 7.0.0, versio (CVSS 6.1, Fortinet FortiMail)
- [CVE-2021-43073](https://cve.now/CVE-2021-43073.md): A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWeb version 6.4.1 and 6.4.0, v (CVSS 8.8)
- [CVE-2021-41016](https://cve.now/CVE-2021-41016.md): A improper neutralization of special elements used in a command ('command injection') in Fortinet FortiExtender version 7.0.1 and below, 4.2 (CVSS 7.8)
- [CVE-2021-36177](https://cve.now/CVE-2021-36177.md): An improper access control vulnerability \[CWE-284\] in FortiAuthenticator HA service 6.3.2 and below, 6.2.x, 6.1.x, 6.0.x may allow an attack (CVSS 4.2)
- [CVE-2021-42753](https://cve.now/CVE-2021-42753.md): An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability \[CWE-22\] in FortiWeb management interface 6. (CVSS 8.1)
- [CVE-2022-24300](https://cve.now/CVE-2022-24300.md): Minetest before 5.4.0 allows attackers to add or modify arbitrary meta fields of the same item stack as saved user input, aka ItemStack meta (no CVSS)
- [CVE-2022-24301](https://cve.now/CVE-2022-24301.md): In Minetest before 5.4.0, players can add or subtract items from a different player's inventory. (no CVSS)
- [CVE-2022-0443](https://cve.now/CVE-2022-0443.md): Use After Free in vim/vim (CVSS 8.4, vim/vim)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-02-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.