# CVEs published 2022-02-04

219 CVEs were published on February 4, 2022: 6 critical, 40 high. Days are UTC.

- [CVE-2021-32036](https://cve.now/CVE-2021-32036.md): Denial of Service and Data Integrity vulnerability in features command (CVSS 5.4, MongoDB Server)
- [CVE-2021-38960](https://cve.now/CVE-2021-38960.md): IBM OPENBMC OP920, OP930, and OP940 could allow an unauthenticated user to obtain sensitive information. (CVSS 5.3, IBM OPENBMC · IBM HMC)
- [CVE-2018-25029](https://cve.now/CVE-2018-25029.md): The Z-Wave specification requires that S2 security can be downgraded to S0 or other less secure protocols, allowing an attacker within radio (no CVSS, Silicon Labs Z-Wave)
- [CVE-2013-20003](https://cve.now/CVE-2013-20003.md): Z-Wave devices from Sierra Designs (circa 2013) and Silicon Labs (using S0 security) may use a known, shared network key of all zeros, allow (no CVSS, Silicon Labs Z-Wave · Sierra Designs Z-Wave)
- [CVE-2022-0317](https://cve.now/CVE-2022-0317.md): Improper Input Validation in AKPublic.Verify in go-attestation (CVSS 4.0, Google go-attestation · github.com/google/go-attestation)
- [CVE-2022-23913](https://cve.now/CVE-2022-23913.md): Apache ActiveMQ Artemis DoS (no CVSS, Apache Software Foundation Apache ActiveMQ Artemis · org.ap…)
- [CVE-2022-0481](https://cve.now/CVE-2022-0481.md): NULL Pointer Dereference in mruby/mruby (CVSS 5.5, mruby/mruby)
- [CVE-2022-23805](https://cve.now/CVE-2022-23805.md): A security out-of-bounds read information disclosure vulnerability in Trend Micro Worry-Free Business Security Server could allow a local at (no CVSS, Trend Micro Worry-Free Business Security)
- [CVE-2021-36152](https://cve.now/CVE-2021-36152.md): Insecure TrustManager used in LDAP connections (no CVSS, Apache Software Foundation Apache Gobblin · org.apache.gobb…)
- [CVE-2021-36151](https://cve.now/CVE-2021-36151.md): Local Credentials Disclosure Vulnerability (no CVSS, Apache Software Foundation Apache Gobblin · org.apache.gobb…)
- [CVE-2022-23609](https://cve.now/CVE-2022-23609.md): Path traveresal in iTunesRPC-Remastered (CVSS 8.3, bildsben iTunesRPC-Remastered)
- [CVE-2022-23611](https://cve.now/CVE-2022-23611.md): OS command injection in iTunesRPC-Remastered (CVSS 8.1, bildsben iTunesRPC-Remastered)
- [CVE-2022-23561](https://cve.now/CVE-2022-23561.md): Out of bounds write in TFLite (CVSS 8.8, tensorflow · tensorflow-cpu +1)
- [CVE-2022-23557](https://cve.now/CVE-2022-23557.md): Division by zero in TFLite (CVSS 6.5, tensorflow · tensorflow-cpu +1)
- [CVE-2022-23558](https://cve.now/CVE-2022-23558.md): Integer overflow in TFLite array creation (CVSS 7.6, tensorflow · tensorflow-gpu +1)
- [CVE-2022-23570](https://cve.now/CVE-2022-23570.md): Null-dereference in Tensorflow (CVSS 6.5, tensorflow · tensorflow-cpu +1)
- [CVE-2022-23564](https://cve.now/CVE-2022-23564.md): Reachable Assertion in Tensorflow (CVSS 6.5, tensorflow · tensorflow-cpu +1)
- [CVE-2022-23565](https://cve.now/CVE-2022-23565.md): \`CHECK\`-failures in Tensorflow (CVSS 6.5, tensorflow · tensorflow-gpu +1)
- [CVE-2022-23562](https://cve.now/CVE-2022-23562.md): Integer overflow in Tensorflow (CVSS 7.6, tensorflow · tensorflow-cpu +1)
- [CVE-2022-23563](https://cve.now/CVE-2022-23563.md): Insecure temporary file in Tensorflow (CVSS 7.1, tensorflow · tensorflow-cpu +1)
- [CVE-2022-23559](https://cve.now/CVE-2022-23559.md): Integer overflow in TFLite (CVSS 8.8, tensorflow · tensorflow-cpu +1)
- [CVE-2022-23560](https://cve.now/CVE-2022-23560.md): Read and Write outside of bounds in TFLite (CVSS 8.8, tensorflow · tensorflow-cpu +1)
- [CVE-2022-23574](https://cve.now/CVE-2022-23574.md): Out of bounds read and write in Tensorflow (CVSS 8.8, tensorflow · tensorflow-gpu +1)
- [CVE-2022-23571](https://cve.now/CVE-2022-23571.md): Reachable Assertion in Tensorflow (CVSS 6.5, tensorflow · tensorflow-cpu +1)
- [CVE-2022-23566](https://cve.now/CVE-2022-23566.md): Out of bounds write in Tensorflow (CVSS 8.8, tensorflow · tensorflow-cpu +1)
- [CVE-2022-23577](https://cve.now/CVE-2022-23577.md): Null-dereference in Tensorflow (CVSS 6.5, tensorflow · tensorflow-cpu +1)
- [CVE-2022-23578](https://cve.now/CVE-2022-23578.md): Memory leak in Tensorflow (CVSS 4.3, tensorflow · tensorflow-cpu +1)
- [CVE-2022-23572](https://cve.now/CVE-2022-23572.md): Crash when type cannot be specialized in Tensorflow (CVSS 6.5, tensorflow · tensorflow-cpu +1)
- [CVE-2022-23573](https://cve.now/CVE-2022-23573.md): Uninitialized variable access in Tensorflow (CVSS 7.6, tensorflow · tensorflow-gpu +1)
- [CVE-2022-23585](https://cve.now/CVE-2022-23585.md): Memory leak in decoding PNG images in Tensorflow (CVSS 4.3, tensorflow · tensorflow-cpu +1)
- [CVE-2022-23579](https://cve.now/CVE-2022-23579.md): \`CHECK\`-failures during Grappler's \`SafeToRemoveIdentity\` in Tensorflow (CVSS 6.5, tensorflow · tensorflow-cpu +1)
- [CVE-2022-23580](https://cve.now/CVE-2022-23580.md): Abort caused by allocating a vector that is too large in Tensorflow (CVSS 6.5, tensorflow · tensorflow-gpu +1)
- [CVE-2022-23581](https://cve.now/CVE-2022-23581.md): \`CHECK\`-failures during Grappler's \`IsSimplifiableReshape\` in Tensorflow (CVSS 6.5, tensorflow · tensorflow-cpu +1)
- [CVE-2022-23575](https://cve.now/CVE-2022-23575.md): Integer overflow in Tensorflow (CVSS 6.5, tensorflow · tensorflow-cpu +1)
- [CVE-2022-23576](https://cve.now/CVE-2022-23576.md): Integer overflow in Tensorflow (CVSS 6.5, tensorflow · tensorflow-cpu +1)
- [CVE-2022-23588](https://cve.now/CVE-2022-23588.md): \`CHECK\`-fails due to attempting to build a reference tensor in Tensorflow (CVSS 6.5, tensorflow · tensorflow-cpu +1)
- [CVE-2022-23589](https://cve.now/CVE-2022-23589.md): Null pointer dereference in Grappler's \`IsConstant\` in Tensorflow (CVSS 6.5, tensorflow · tensorflow-cpu +1)
- [CVE-2022-23586](https://cve.now/CVE-2022-23586.md): Multiple \`CHECK\`-fails in \`function.cc\` in Tensorflow (CVSS 6.5, tensorflow · tensorflow-cpu +1)
- [CVE-2022-23583](https://cve.now/CVE-2022-23583.md): \`CHECK\`-failures in binary ops in Tensorflow (CVSS 6.5, tensorflow · tensorflow-gpu +1)
- [CVE-2022-23582](https://cve.now/CVE-2022-23582.md): \`CHECK\`-failures in \`TensorByteSize\` in Tensorflow (CVSS 6.5, tensorflow · tensorflow-cpu +1)
- [CVE-2022-23584](https://cve.now/CVE-2022-23584.md): Use after free in \`DecodePng\` in Tensorflow (CVSS 7.6, tensorflow · tensorflow-cpu +1)
- [CVE-2022-23587](https://cve.now/CVE-2022-23587.md): Integer overflow in Tensorflow (CVSS 8.8, tensorflow · tensorflow-gpu +1)
- [CVE-2022-23592](https://cve.now/CVE-2022-23592.md): Out of bounds read in Tensorflow (CVSS 8.1, tensorflow · tensorflow-cpu +1)
- [CVE-2022-23595](https://cve.now/CVE-2022-23595.md): Null pointer dereference in TensorFlow (CVSS 5.3, tensorflow · tensorflow-gpu +1)
- [CVE-2022-23594](https://cve.now/CVE-2022-23594.md): Out of bounds read in Tensorflow (CVSS 8.8, tensorflow · tensorflow-cpu +1)
- [CVE-2022-23590](https://cve.now/CVE-2022-23590.md): Crash due to erroneous \`StatusOr\` in Tensorflow (CVSS 5.9, tensorflow · tensorflow-gpu +1)
- [CVE-2022-23591](https://cve.now/CVE-2022-23591.md): Stack overflow in Tensorflow (CVSS 7.5, tensorflow · tensorflow-cpu +1)
- [CVE-2022-23593](https://cve.now/CVE-2022-23593.md): Segfault in \`simplifyBroadcast\` in Tensorflow (CVSS 5.9, tensorflow · tensorflow-gpu +1)
- [CVE-2022-23600](https://cve.now/CVE-2022-23600.md): Limited ability to spoof SAML authentication with missing audience verification (CVSS 5.3, fleetdm fleet · github.com/fleetdm/fleet/v4)
- [CVE-2022-0472](https://cve.now/CVE-2022-0472.md): Unrestricted Upload of File with Dangerous Type in jsdecena/laracom (CVSS 8.1, jsdecena/laracom)
- [CVE-2022-23605](https://cve.now/CVE-2022-23605.md): Expired Ephemeral Messages not reliably removed in wire-webapp (CVSS 4.4, wireapp wire-webapp)
- [CVE-2021-39021](https://cve.now/CVE-2021-39021.md): IBM Guardium Data Encryption (GDE) 5.0.0.2 behaves differently or sends different responses under different circumstances in a way that is o (CVSS 3.7, IBM Security Guardium Data Encryption)
- [CVE-2021-43841](https://cve.now/CVE-2021-43841.md): XSS by SVG upload in xwiki-platform (CVSS 5.4, xwiki-platform · org.xwiki.platform:xwiki-platform-oldco… +1)
- [CVE-2022-22804](https://cve.now/CVE-2022-22804.md): A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could allow an auth (no CVSS, EcoStruxure Power Monitoring Expert)
- [CVE-2022-22726](https://cve.now/CVE-2022-22726.md): A CWE-20: Improper Input Validation vulnerability exists that could allow arbitrary files on the server to be read by authenticated users th (no CVSS, EcoStruxure Power Monitoring Expert)
- [CVE-2022-22727](https://cve.now/CVE-2022-22727.md): A CWE-20: Improper Input Validation vulnerability exists that could allow an unauthenticated attacker to view data, change settings, impact (no CVSS, EcoStruxure Power Monitoring Expert)
- [CVE-2022-22725](https://cve.now/CVE-2022-22725.md): A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could lead to a buffer overflow causing program crashes and (no CVSS, Easergy P3)
- [CVE-2020-7534](https://cve.now/CVE-2020-7534.md): A CWE-352: Cross-Site Request Forgery (CSRF) vulnerability exists on the web server used, that could cause a leak of sensitive data or unaut (CVSS 7.1, Modicon M340 CPUs: BMXP34 (All Versions), Modicon Quantum C…)
- [CVE-2022-22724](https://cve.now/CVE-2022-22724.md): A CWE-400: Uncontrolled Resource Consumption vulnerability exists that could cause a denial of service on ports 80 (HTTP) and 502 (Modbus), (no CVSS, Modicon M340 CPUs: BMXP34)
- [CVE-2022-22723](https://cve.now/CVE-2022-22723.md): A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could lead to a buffer overflow causing program crashes and (no CVSS, Easergy P5)
- [CVE-2022-22722](https://cve.now/CVE-2022-22722.md): A CWE-798: Use of Hard-coded Credentials vulnerability exists that could result in information disclosure. (no CVSS, Schneider Electric Easergy P5)
- [CVE-2021-44206](https://cve.now/CVE-2021-44206.md): Local privilege escalation due to DLL hijacking vulnerability in Acronis Media Builder service (no CVSS, Acronis Cyber Protect Home Office · Acronis True Image)
- [CVE-2021-44204](https://cve.now/CVE-2021-44204.md): Local privilege escalation via named pipe due to improper access control checks (no CVSS, Acronis Cyber Protect · Acronis Agent +1)
- [CVE-2022-24114](https://cve.now/CVE-2022-24114.md): Local privilege escalation due to race condition on application startup (no CVSS, Acronis Cyber Protect Home Office · Acronis True Image)
- [CVE-2021-44205](https://cve.now/CVE-2021-44205.md): Local privilege escalation due to DLL hijacking vulnerability (no CVSS, Acronis Cyber Protect Home Office · Acronis True Image)
- [CVE-2022-24115](https://cve.now/CVE-2022-24115.md): Local privilege escalation due to unrestricted loading of unsigned libraries (no CVSS, Acronis Cyber Protect Home Office · Acronis True Image)
- [CVE-2022-24113](https://cve.now/CVE-2022-24113.md): Local privilege escalation due to excessive permissions assigned to child processes (no CVSS, Acronis Cyber Protect · Acronis Agent +1)
- [CVE-2022-22987](https://cve.now/CVE-2022-22987.md): Advantech ADAM-3600 (CVSS 9.8, Advantech ADAM-3600)
- [CVE-2022-0365](https://cve.now/CVE-2022-0365.md): Ricon Mobile, Inc. (CVSS 9.1, Ricon Industrial Cellular Router)
- [CVE-2021-28503](https://cve.now/CVE-2021-28503.md): In Arista's EOS software affected releases, eAPI might skip re-evaluating user credentials when certificate based authentication is used, which allows remote attackers to access the device via eAPI. (CVSS 7.4, Arista Networks Arista EOS)
- [CVE-2022-22689](https://cve.now/CVE-2022-22689.md): CA Harvest Software Change Manager versions 13.0.3, 13.0.4, 14.0.0, and 14.0.1, contain a vulnerability in the CSV export functionality, due (no CVSS, CA Harvest Software Change Manager)
- [CVE-2022-23980](https://cve.now/CVE-2022-23980.md): WordPress Yasr – Yet Another Stars Rating plugin \<= 2.9.9 - Cross-Site Scripting (XSS) vulnerability (CVSS 4.7, Dario Curvino Yasr – Yet Another Stars Rating)
- [CVE-2022-0381](https://cve.now/CVE-2022-0381.md): Embed Swagger \<= 1.0.0 Reflected Cross-Site Scripting (CVSS 6.1, Embed Swagger)
- [CVE-2022-0218](https://cve.now/CVE-2022-0218.md): WP HTML Mail \<= 3.0.9 Missing Authorization on REST-API Route (CVSS 8.3, codemiq WP HTML Mail)
- [CVE-2022-0380](https://cve.now/CVE-2022-0380.md): Fotobook \<= 3.2.3 Reflected Cross-Site Scripting (CVSS 6.1, Fotobook)
- [CVE-2021-38130](https://cve.now/CVE-2021-38130.md): A potential Information leakage vulnerability has been identified in versions of Micro Focus Voltage SecureMail Mail Relay prior to 7.3.0.1. (no CVSS, Voltage SecureMail Mail Relay.)
- [CVE-2021-22284](https://cve.now/CVE-2021-22284.md): SECURITY - OPC Server for AC 800M - Remote Code Execution Vulnerability (CVSS 8.4, ABB 800xA, Control Software for AC 800M OPC Server for A… +1)
- [CVE-2022-0487](https://cve.now/CVE-2022-0487.md): A use-after-free vulnerability was found in rtsx\_usb\_ms\_drv\_remove in drivers/memstick/host/rtsx\_usb\_ms.c in memstick in the Linux kernel. (no CVSS, kernel)
- [CVE-2022-0484](https://cve.now/CVE-2022-0484.md): Improper URL Validation causes Mirantis Container Cloud Lens Extension to open external programs (CVSS 8.8, Mirantis Container Cloud Lens Extension)
- [CVE-2021-22285](https://cve.now/CVE-2021-22285.md): SECURITY – Denial of Service Vulnerabilities in SPIET800 INFI-Net to Ethernet Transfer module and PNI800 S+ Ethernet communication interface module (CVSS 7.5, ABB SPIET800 · ABB PNI800)
- [CVE-2021-22288](https://cve.now/CVE-2021-22288.md): SECURITY – Denial of Service Vulnerabilities in SPIET800 INFI-Net to Ethernet Transfer module and PNI800 S+ Ethernet communication interface module (CVSS 7.5, ABB SPIET800 · ABB PNI800)
- [CVE-2021-22286](https://cve.now/CVE-2021-22286.md): SECURITY – Denial of Service Vulnerabilities in SPIET800 INFI-Net to Ethernet Transfer module and PNI800 S+ Ethernet communication interface module (CVSS 7.5, ABB SPIET800 · ABB PNI800)
- [CVE-2021-4154](https://cve.now/CVE-2021-4154.md): A use-after-free flaw was found in cgroup1\_parse\_param in kernel/cgroup/cgroup-v1.c in the Linux kernel's cgroup v1 parser. (no CVSS, kernel)
- [CVE-2021-44779](https://cve.now/CVE-2021-44779.md): WordPress \[GWA\] AutoResponder plugin \<= 2.3 - Unauthenticated SQL Injection (SQLi) vulnerability (CVSS 7.3, G.J.P. \[GWA\] AutoResponder)
- [CVE-2021-29218](https://cve.now/CVE-2021-29218.md): A local unquoted search path security vulnerability has been identified in HPE Agentless Management Service for Windows version(s): Prior to (no CVSS, HPE Agentless Management)
- [CVE-2021-29219](https://cve.now/CVE-2021-29219.md): A potential local buffer overflow vulnerability has been identified in HPE FlexNetwork 5130 EL Switch Series version: Prior to 5130\_EI\_7.10. (no CVSS, HPE FlexNetwork 5130 EI Switch Series)
- [CVE-2022-22939](https://cve.now/CVE-2022-22939.md): VMware Cloud Foundation contains an information disclosure vulnerability due to logging of credentials in plain-text within multiple log fil (no CVSS, VMware Cloud Foundation)
- [CVE-2020-12965](https://cve.now/CVE-2020-12965.md): When combined with specific software sequences, AMD CPUs may transiently execute non-canonical loads and store using only the lower 48 addre (no CVSS, AMD All supported processors)
- [CVE-2020-12966](https://cve.now/CVE-2020-12966.md): AMD EPYC™ Processors contain an information disclosure vulnerability in the Secure Encrypted Virtualization with Encrypted State (SEV-ES) an (no CVSS, 1st/2nd/3rd Gen AMD EPYC™ Processors)
- [CVE-2020-12891](https://cve.now/CVE-2020-12891.md): AMD Radeon Software may be vulnerable to DLL Hijacking through path variable. (no CVSS, AMD Radeon Software · AMD Radeon Pro Software for Enterprise)
- [CVE-2021-21962](https://cve.now/CVE-2021-21962.md): A heap-based buffer overflow vulnerability exists in the OTA Update u-download functionality of Sealevel Systems, Inc. (CVSS 9.0, Sealevel)
- [CVE-2021-21968](https://cve.now/CVE-2021-21968.md): A file write vulnerability exists in the OTA update task functionality of Sealevel Systems, Inc. (CVSS 8.1, Sealevel)
- [CVE-2021-21959](https://cve.now/CVE-2021-21959.md): A misconfiguration exists in the MQTTS functionality of Sealevel Systems, Inc. (CVSS 7.7, Sealevel)
- [CVE-2021-40420](https://cve.now/CVE-2021-40420.md): A use-after-free vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version 11.1.0.52543. (CVSS 8.8, Foxit)
- [CVE-2022-22150](https://cve.now/CVE-2022-22150.md): A memory corruption vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version 11.1.0.52543. (CVSS 8.8, Foxit)
- [CVE-2021-21964](https://cve.now/CVE-2021-21964.md): A denial of service vulnerability exists in the Modbus configuration functionality of Sealevel Systems, Inc. (CVSS 8.6, Sealevel)
- [CVE-2021-21965](https://cve.now/CVE-2021-21965.md): A denial of service vulnerability exists in the SeaMax remote configuration functionality of Sealevel Systems, Inc. (CVSS 8.6, Sealevel)
- [CVE-2021-21961](https://cve.now/CVE-2021-21961.md): A stack-based buffer overflow vulnerability exists in the NBNS functionality of Sealevel Systems, Inc. (CVSS 10.0, Sealevel)
- [CVE-2021-21960](https://cve.now/CVE-2021-21960.md): A stack-based buffer overflow vulnerability exists in both the LLMNR functionality of Sealevel Systems, Inc. (CVSS 10.0, Sealevel)
- [CVE-2021-21963](https://cve.now/CVE-2021-21963.md): An information disclosure vulnerability exists in the Web Server functionality of Sealevel Systems, Inc. (CVSS 7.4, Sealevel)
- [CVE-2021-21971](https://cve.now/CVE-2021-21971.md): An out-of-bounds write vulnerability exists in the URL\_decode functionality of Sealevel Systems, Inc. (CVSS 3.7, Sealevel)
- [CVE-2021-21970](https://cve.now/CVE-2021-21970.md): An out-of-bounds write vulnerability exists in the HandleSeaCloudMessage functionality of Sealevel Systems, Inc. (CVSS 3.7, Sealevel)
- [CVE-2021-21969](https://cve.now/CVE-2021-21969.md): An out-of-bounds write vulnerability exists in the HandleSeaCloudMessage functionality of Sealevel Systems, Inc. (CVSS 3.7, Sealevel")
- [CVE-2022-23947](https://cve.now/CVE-2022-23947.md): A stack-based buffer overflow vulnerability exists in the Gerber Viewer gerber and excellon DCodeNumber parsing functionality of KiCad EDA 6 (CVSS 7.8, KiCad)
- [CVE-2022-23946](https://cve.now/CVE-2022-23946.md): A stack-based buffer overflow vulnerability exists in the Gerber Viewer gerber and excellon GCodeNumber parsing functionality of KiCad EDA 6 (CVSS 7.8, KiCad)
- [CVE-2022-23614](https://cve.now/CVE-2022-23614.md): Code injection in Twig (CVSS 8.8, twigphp Twig · twig/twig)
- [CVE-2022-23379](https://cve.now/CVE-2022-23379.md): Emlog v6.0 was discovered to contain a SQL injection vulnerability via the $TagID parameter of getblogidsfromtagid(). (no CVSS)
- [CVE-2021-32732](https://cve.now/CVE-2021-32732.md): Cross-Site Request Forgery in xwiki-platform (CVSS 7.5, xwiki-platform · org.xwiki.platform:xwiki-platform-administ…)
- [CVE-2022-23330](https://cve.now/CVE-2022-23330.md): A remote code execution (RCE) vulnerability in HelloWorldAddonController.java of jpress v4.2.0 allows attackers to execute arbitrary code vi (no CVSS)
- [CVE-2022-23329](https://cve.now/CVE-2022-23329.md): A vulnerability in ${"freemarker.template.utility.Execute"?new() of UJCMS Jspxcms v10.2.0 allows attackers to execute arbitrary commands via (no CVSS)
- [CVE-2022-24348](https://cve.now/CVE-2022-24348.md): Argo CD before 2.1.9 and 2.2.x before 2.2.4 allows directory traversal related to Helm charts because of an error in helmTemplate in reposit (no CVSS, github.com/argoproj/argo-cd/v2 · github.com/argoproj/argo-cd)
- [CVE-2021-46671](https://cve.now/CVE-2021-46671.md): options.c in atftp before 0.7.5 reads past the end of an array, and consequently discloses server-side /etc/group data to a remote client. (no CVSS)
- [CVE-2021-23507](https://cve.now/CVE-2021-23507.md): Prototype Pollution (CVSS 7.5, object-path-set)
- [CVE-2021-23470](https://cve.now/CVE-2021-23470.md): Prototype Pollution (CVSS 8.2, putil-merge)
- [CVE-2021-23497](https://cve.now/CVE-2021-23497.md): Prototype Pollution (CVSS 7.5, @strikeentco/set)
- [CVE-2022-24448](https://cve.now/CVE-2022-24448.md): An issue was discovered in fs/nfs/dir.c in the Linux kernel before 5.16.5. (no CVSS)
- [CVE-2021-45408](https://cve.now/CVE-2021-45408.md): Open Redirect vulnerability exists in SeedDMS 6.0.15 in out.Login.php, which llows remote malicious users to redirect users to malicious sit (no CVSS)
- [CVE-2022-24129](https://cve.now/CVE-2022-24129.md): The OIDC OP plugin before 3.0.4 for Shibboleth Identity Provider allows server-side request forgery (SSRF) due to insufficient restriction o (no CVSS)
- [CVE-2021-29398](https://cve.now/CVE-2021-29398.md): Directory traversal in /northstar/Common/NorthFileManager/fileManagerObjects.jsp Northstar Technologies Inc NorthStar Club Management 6.3 al (no CVSS)
- [CVE-2021-29397](https://cve.now/CVE-2021-29397.md): Cleartext Transmission of Sensitive Information in /northstar/Admin/login.jsp in Northstar Technologies Inc NorthStar Club Management 6.3 al (no CVSS)
- [CVE-2021-29396](https://cve.now/CVE-2021-29396.md): Systemic Insecure Permissions in Northstar Technologies Inc NorthStar Club Management 6.3 allows remote unauthenticated users to use various (no CVSS)
- [CVE-2021-29395](https://cve.now/CVE-2021-29395.md): Directory travesal in /northstar/filemanager/download.jsp in Northstar Technologies Inc NorthStar Club Management 6.3 allows remote unauthen (no CVSS)
- [CVE-2021-29394](https://cve.now/CVE-2021-29394.md): Account Hijacking in /northstar/Admin/changePassword.jsp in Northstar Technologies Inc NorthStar Club Management 6.3 allows remote authentic (no CVSS)
- [CVE-2021-29393](https://cve.now/CVE-2021-29393.md): Remote Code Execution in cominput.jsp and comoutput.jsp in Northstar Technologies Inc NorthStar Club Management 6.3 allows remote unauthenti (no CVSS)
- [CVE-2022-24249](https://cve.now/CVE-2022-24249.md): A Null Pointer Dereference vulnerability exists in GPAC 1.1.0 via the xtra\_box\_write function in /box\_code\_base.c, which causes a Denial of (no CVSS)
- [CVE-2021-45429](https://cve.now/CVE-2021-45429.md): A Buffer Overflow vulnerablity exists in VirusTotal YARA git commit: 605b2edf07ed8eb9a2c61ba22eb2e7c362f47ba7 via yr\_set\_configuration in ya (no CVSS)
- [CVE-2021-43635](https://cve.now/CVE-2021-43635.md): A Cross Site Scripting (XSS) vulnerability exists in Codex before 1.4.0 via Notebook/Page name field, which allows malicious users to execut (no CVSS)
- [CVE-2022-24262](https://cve.now/CVE-2022-24262.md): The config restore function of Voipmonitor GUI before v24.96 does not properly check files sent as restore archives, allowing remote attacke (no CVSS)
- [CVE-2022-24259](https://cve.now/CVE-2022-24259.md): An incorrect check in the component cdr.php of Voipmonitor GUI before v24.96 allows unauthenticated attackers to escalate privileges via a c (no CVSS)
- [CVE-2022-24260](https://cve.now/CVE-2022-24260.md): A SQL injection vulnerability in Voipmonitor GUI before v24.96 allows attackers to escalate privileges to the Administrator level. (no CVSS)
- [CVE-2021-44977](https://cve.now/CVE-2021-44977.md): In iCMS \<=8.0.0, a directory traversal vulnerability allows an attacker to read arbitrary files. (no CVSS)
- [CVE-2021-44978](https://cve.now/CVE-2021-44978.md): iCMS \<= 8.0.0 allows users to add and render a comtom template, which has a SSTI vulnerability which causes remote code execution. (no CVSS)
- [CVE-2021-46398](https://cve.now/CVE-2021-46398.md): A Cross-Site Request Forgery vulnerability exists in Filebrowser \< 2.18.0 that allows attackers to create a backdoor user with admin privile (no CVSS, github.com/filebrowser/filebrowser/v2)
- [CVE-2021-43145](https://cve.now/CVE-2021-43145.md): With certain LDAP configurations, Zammad 5.0.1 was found to be vulnerable to unauthorized access with existing user accounts. (no CVSS)
- [CVE-2021-44886](https://cve.now/CVE-2021-44886.md): In Zammad 5.0.2, agents can configure "out of office" periods and substitute persons. (no CVSS)
- [CVE-2021-44983](https://cve.now/CVE-2021-44983.md): In taocms 3.0.1 after logging in to the background, there is an Arbitrary file download vulnerability at the File Management column. (no CVSS)
- [CVE-2021-46320](https://cve.now/CVE-2021-46320.md): In OpenZeppelin \<=v4.4.0, initializer functions that are invoked separate from contract creation (the most prominent example being minimal p (no CVSS, @openzeppelin/contracts · @openzeppelin/contracts-upgradeab…)
- [CVE-2022-23316](https://cve.now/CVE-2022-23316.md): An issue was discovered in taoCMS v3.0.2. (no CVSS)
- [CVE-2021-44903](https://cve.now/CVE-2021-44903.md): Micro-Star International (MSI) Center Pro \<= 2.0.16.0 is vulnerable to multiple Privilege Escalation (LPE/EoP) vulnerabilities in the atidgl (no CVSS)
- [CVE-2021-44901](https://cve.now/CVE-2021-44901.md): Micro-Star International (MSI) Dragon Center \<= 2.0.116.0 is vulnerable to multiple Privilege Escalation (LPE/EoP) vulnerabilities in the at (no CVSS)
- [CVE-2021-44900](https://cve.now/CVE-2021-44900.md): Micro-Star International (MSI) App Player \<= 4.280.1.6309 is vulnerable to multiple Privilege Escalation (LPE/EoP) vulnerabilities in the NT (no CVSS)
- [CVE-2021-44899](https://cve.now/CVE-2021-44899.md): Micro-Star International (MSI) Center \<= 1.0.31.0 is vulnerable to multiple Privilege Escalation vulnerabilities in the atidgllk.sys, atillk (no CVSS)
- [CVE-2021-44246](https://cve.now/CVE-2021-44246.md): Totolink devices A3100R v4.1.2cu.5050\_B20200504, A830R v5.9c.4729\_B20191112, and A720R v4.1.5cu.470\_B20200911 were discovered to contain a s (no CVSS)
- [CVE-2021-44247](https://cve.now/CVE-2021-44247.md): Totolink devices A3100R v4.1.2cu.5050\_B20200504, A830R v5.9c.4729\_B20191112, and A720R v4.1.5cu.470\_B20200911 were discovered to contain com (no CVSS)
- [CVE-2021-44880](https://cve.now/CVE-2021-44880.md): D-Link devices DIR\_878 DIR\_878\_FW1.30B08\_Hotfix\_02 and DIR\_882 DIR\_882\_FW1.30B06\_Hotfix\_02 were discovered to contain a command injection vu (no CVSS)
- [CVE-2021-44881](https://cve.now/CVE-2021-44881.md): D-Link device DIR\_882 DIR\_882\_FW1.30B06\_Hotfix\_02 was discovered to contain a command injection vulnerability in the twsystem function. (no CVSS)
- [CVE-2021-44882](https://cve.now/CVE-2021-44882.md): D-Link device DIR\_878\_FW1.30B08\_Hotfix\_02 was discovered to contain a command injection vulnerability in the twsystem function. (no CVSS)
- [CVE-2021-45733](https://cve.now/CVE-2021-45733.md): TOTOLINK X5000R v9.1.0u.6118\_B20201102 was discovered to contain a command injection vulnerability in the function NTPSyncWithHost. (no CVSS)
- [CVE-2021-45734](https://cve.now/CVE-2021-45734.md): TOTOLINK X5000R v9.1.0u.6118\_B20201102 was discovered to contain a stack overflow in the function setUrlFilterRules. (no CVSS)
- [CVE-2021-45735](https://cve.now/CVE-2021-45735.md): TOTOLINK X5000R v9.1.0u.6118\_B20201102 was discovered to use the HTTP protocol for authentication into the admin interface, allowing attacke (no CVSS)
- [CVE-2021-45736](https://cve.now/CVE-2021-45736.md): TOTOLINK X5000R v9.1.0u.6118\_B20201102 was discovered to contain a stack overflow in the function setL2tpServerCfg. (no CVSS)
- [CVE-2021-45737](https://cve.now/CVE-2021-45737.md): TOTOLINK A720R v4.1.5cu.470\_B20200911 was discovered to contain a stack overflow in the Form\_Login function. (no CVSS)
- [CVE-2021-45738](https://cve.now/CVE-2021-45738.md): TOTOLINK X5000R v9.1.0u.6118\_B20201102 was discovered to contain a command injection vulnerability in the function UploadFirmwareFile. (no CVSS)
- [CVE-2021-45739](https://cve.now/CVE-2021-45739.md): TOTOLINK A720R v4.1.5cu.470\_B20200911 was discovered to contain a stack overflow in the Form\_Login function. (no CVSS)
- [CVE-2021-45740](https://cve.now/CVE-2021-45740.md): TOTOLINK A720R v4.1.5cu.470\_B20200911 was discovered to contain a stack overflow in the setWiFiWpsStart function. (no CVSS)
- [CVE-2021-45741](https://cve.now/CVE-2021-45741.md): TOTOLINK X5000R v9.1.0u.6118\_B20201102 was discovered to contain a stack overflow in the function setIpv6Cfg. (no CVSS)
- [CVE-2021-45742](https://cve.now/CVE-2021-45742.md): TOTOLINK A720R v4.1.5cu.470\_B20200911 was discovered to contain a command injection vulnerability in the "Main" function. (no CVSS)
- [CVE-2021-45986](https://cve.now/CVE-2021-45986.md): Tenda routers G1 and G3 v15.11.0.17(9502)\_CN were discovered to contain a command injection vulnerability in the function formSetUSBShareInf (no CVSS)
- [CVE-2021-45987](https://cve.now/CVE-2021-45987.md): Tenda routers G1 and G3 v15.11.0.17(9502)\_CN were discovered to contain a command injection vulnerability in the function formSetNetCheckToo (no CVSS)
- [CVE-2021-45988](https://cve.now/CVE-2021-45988.md): Tenda routers G1 and G3 v15.11.0.17(9502)\_CN were discovered to contain a stack overflow in the function formAddDnsForward. (no CVSS)
- [CVE-2021-45989](https://cve.now/CVE-2021-45989.md): Tenda routers G1 and G3 v15.11.0.17(9502)\_CN were discovered to contain a stack overflow in the function guestWifiRuleRefresh. (no CVSS)
- [CVE-2021-45990](https://cve.now/CVE-2021-45990.md): Tenda routers G1 and G3 v15.11.0.17(9502)\_CN were discovered to contain a command injection vulnerability in the function uploadPicture. (no CVSS)
- [CVE-2021-45991](https://cve.now/CVE-2021-45991.md): Tenda routers G1 and G3 v15.11.0.17(9502)\_CN were discovered to contain a stack overflow in the function formAddVpnUsers. (no CVSS)
- [CVE-2021-45992](https://cve.now/CVE-2021-45992.md): Tenda routers G1 and G3 v15.11.0.17(9502)\_CN were discovered to contain a stack overflow in the function formSetQvlanList. (no CVSS)
- [CVE-2021-45993](https://cve.now/CVE-2021-45993.md): Tenda routers G1 and G3 v15.11.0.17(9502)\_CN were discovered to contain a stack overflow in the function formIPMacBindModify. (no CVSS)
- [CVE-2021-45994](https://cve.now/CVE-2021-45994.md): Tenda routers G1 and G3 v15.11.0.17(9502)\_CN were discovered to contain a stack overflow in the function formDelDhcpRule. (no CVSS)
- [CVE-2021-45995](https://cve.now/CVE-2021-45995.md): Tenda routers G1 and G3 v15.11.0.17(9502)\_CN were discovered to contain a stack overflow in the function formSetStaticRoute. (no CVSS)
- [CVE-2021-45996](https://cve.now/CVE-2021-45996.md): Tenda routers G1 and G3 v15.11.0.17(9502)\_CN were discovered to contain a stack overflow in the function formSetPortMapping. (no CVSS)
- [CVE-2021-45997](https://cve.now/CVE-2021-45997.md): Tenda routers G1 and G3 v15.11.0.17(9502)\_CN were discovered to contain a stack overflow in the function formSetPortMapping. (no CVSS)
- [CVE-2021-45998](https://cve.now/CVE-2021-45998.md): D-Link device DIR\_882 DIR\_882\_FW1.30B06\_Hotfix\_02 was discovered to contain a command injection vulnerability in the LocalIPAddress paramete (no CVSS)
- [CVE-2021-46226](https://cve.now/CVE-2021-46226.md): D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function wget\_test.asp. (no CVSS)
- [CVE-2021-46227](https://cve.now/CVE-2021-46227.md): D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function proxy\_client.asp. (no CVSS)
- [CVE-2021-46228](https://cve.now/CVE-2021-46228.md): D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function httpd\_debug.asp. (no CVSS)
- [CVE-2021-46229](https://cve.now/CVE-2021-46229.md): D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function usb\_paswd.asp. (no CVSS)
- [CVE-2021-46230](https://cve.now/CVE-2021-46230.md): D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function upgrade\_filter. (no CVSS)
- [CVE-2021-46231](https://cve.now/CVE-2021-46231.md): D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function urlrd\_opt.asp. (no CVSS)
- [CVE-2021-46232](https://cve.now/CVE-2021-46232.md): D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function version\_upgrade.asp. (no CVSS)
- [CVE-2021-46233](https://cve.now/CVE-2021-46233.md): D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function msp\_info.htm. (no CVSS)
- [CVE-2021-46452](https://cve.now/CVE-2021-46452.md): D-Link device D-Link DIR-823-Pro v1.0.2 was discovered to contain a command injection vulnerability in the function SetNetworkTomographySett (no CVSS)
- [CVE-2021-46453](https://cve.now/CVE-2021-46453.md): D-Link device D-Link DIR-823-Pro v1.0.2 was discovered to contain a command injection vulnerability in the function SetStaticRouteSettings. (no CVSS)
- [CVE-2021-46454](https://cve.now/CVE-2021-46454.md): D-Link device D-Link DIR-823-Pro v1.0.2 was discovered to contain a command injection vulnerability in the function SetWLanApcliSettings. (no CVSS)
- [CVE-2021-46455](https://cve.now/CVE-2021-46455.md): D-Link device D-Link DIR-823-Pro v1.0.2 was discovered to contain a command injection vulnerability in the function SetStationSettings. (no CVSS)
- [CVE-2021-46456](https://cve.now/CVE-2021-46456.md): D-Link device D-Link DIR-823-Pro v1.0.2 was discovered to contain a command injection vulnerability in the function SetWLanACLSettings. (no CVSS)
- [CVE-2021-46457](https://cve.now/CVE-2021-46457.md): D-Link device D-Link DIR-823-Pro v1.0.2 was discovered to contain a command injection vulnerability in the function ChgSambaUserSettings. (no CVSS)
- [CVE-2022-24142](https://cve.now/CVE-2022-24142.md): Tenda AX3 v16.03.12.10\_CN was discovered to contain a stack overflow in the function formSetFirewallCfg. (no CVSS)
- [CVE-2022-24143](https://cve.now/CVE-2022-24143.md): Tenda AX3 v16.03.12.10\_CN and AX12 22.03.01.2\_CN was discovered to contain a stack overflow in the function form\_fast\_setting\_wifi\_set. (no CVSS)
- [CVE-2022-24144](https://cve.now/CVE-2022-24144.md): Tenda AX3 v16.03.12.10\_CN was discovered to contain a command injection vulnerability in the function WanParameterSetting. (no CVSS)
- [CVE-2022-24145](https://cve.now/CVE-2022-24145.md): Tenda AX3 v16.03.12.10\_CN was discovered to contain a stack overflow in the function formWifiBasicSet. (no CVSS)
- [CVE-2022-24146](https://cve.now/CVE-2022-24146.md): Tenda AX3 v16.03.12.10\_CN was discovered to contain a stack overflow in the function formSetQosBand. (no CVSS)
- [CVE-2022-24147](https://cve.now/CVE-2022-24147.md): Tenda AX3 v16.03.12.10\_CN was discovered to contain a stack overflow in the function fromAdvSetMacMtuWan. (no CVSS)
- [CVE-2022-24148](https://cve.now/CVE-2022-24148.md): Tenda AX3 v16.03.12.10\_CN was discovered to contain a command injection vulnerability in the function mDMZSetCfg. (no CVSS)
- [CVE-2022-24149](https://cve.now/CVE-2022-24149.md): Tenda AX3 v16.03.12.10\_CN was discovered to contain a stack overflow in the function fromSetWirelessRepeat. (no CVSS)
- [CVE-2022-24150](https://cve.now/CVE-2022-24150.md): Tenda AX3 v16.03.12.10\_CN was discovered to contain a command injection vulnerability in the function formSetSafeWanWebMan. (no CVSS)
- [CVE-2022-24151](https://cve.now/CVE-2022-24151.md): Tenda AX3 v16.03.12.10\_CN was discovered to contain a stack overflow in the function fromSetWifiGusetBasic. (no CVSS)
- [CVE-2022-24152](https://cve.now/CVE-2022-24152.md): Tenda AX3 v16.03.12.10\_CN was discovered to contain a stack overflow in the function fromSetRouteStatic. (no CVSS)
- [CVE-2022-24153](https://cve.now/CVE-2022-24153.md): Tenda AX3 v16.03.12.10\_CN was discovered to contain a stack overflow in the function formAddMacfilterRule. (no CVSS)
- [CVE-2022-24154](https://cve.now/CVE-2022-24154.md): Tenda AX3 v16.03.12.10\_CN was discovered to contain a stack overflow in the function formSetRebootTimer. (no CVSS)
- [CVE-2022-24155](https://cve.now/CVE-2022-24155.md): Tenda AX3 v16.03.12.10\_CN was discovered to contain a heap overflow in the function setSchedWifi. (no CVSS)
- [CVE-2022-24156](https://cve.now/CVE-2022-24156.md): Tenda AX3 v16.03.12.10\_CN was discovered to contain a stack overflow in the function formSetVirtualSer. (no CVSS)
- [CVE-2022-24157](https://cve.now/CVE-2022-24157.md): Tenda AX3 v16.03.12.10\_CN was discovered to contain a stack overflow in the function formSetMacFilterCfg. (no CVSS)
- [CVE-2022-24158](https://cve.now/CVE-2022-24158.md): Tenda AX3 v16.03.12.10\_CN was discovered to contain a stack overflow in the function fromSetIpMacBind. (no CVSS)
- [CVE-2022-24159](https://cve.now/CVE-2022-24159.md): Tenda AX3 v16.03.12.10\_CN was discovered to contain a stack overflow in the function formSetPPTPServer. (no CVSS)
- [CVE-2022-24162](https://cve.now/CVE-2022-24162.md): Tenda AX3 v16.03.12.10\_CN was discovered to contain a stack overflow in the function saveParentControlInfo. (no CVSS)
- [CVE-2022-24160](https://cve.now/CVE-2022-24160.md): Tenda AX3 v16.03.12.10\_CN was discovered to contain a stack overflow in the function formSetDeviceName. (no CVSS)
- [CVE-2022-24161](https://cve.now/CVE-2022-24161.md): Tenda AX3 v16.03.12.10\_CN was discovered to contain a heap overflow in the function GetParentControlInfo. (no CVSS)
- [CVE-2022-24164](https://cve.now/CVE-2022-24164.md): Tenda routers G1 and G3 v15.11.0.17(9502)\_CN were discovered to contain a stack overflow in the function formSetVirtualSer. (no CVSS)
- [CVE-2022-24163](https://cve.now/CVE-2022-24163.md): Tenda AX3 v16.03.12.10\_CN was discovered to contain a stack overflow in the function fromSetSysTime. (no CVSS)
- [CVE-2022-24165](https://cve.now/CVE-2022-24165.md): Tenda routers G1 and G3 v15.11.0.17(9502)\_CN were discovered to contain a command injection vulnerability in the function formSetQvlanList. (no CVSS)
- [CVE-2022-24166](https://cve.now/CVE-2022-24166.md): Tenda routers G1 and G3 v15.11.0.17(9502)\_CN were discovered to contain a stack overflow in the function formSetSysTime. (no CVSS)
- [CVE-2022-24167](https://cve.now/CVE-2022-24167.md): Tenda routers G1 and G3 v15.11.0.17(9502)\_CN were discovered to contain a command injection vulnerability in the function formSetDMZ. (no CVSS)
- [CVE-2022-24168](https://cve.now/CVE-2022-24168.md): Tenda routers G1 and G3 v15.11.0.17(9502)\_CN were discovered to contain a command injection vulnerability in the function formSetIpGroup. (no CVSS)
- [CVE-2022-24169](https://cve.now/CVE-2022-24169.md): Tenda routers G1 and G3 v15.11.0.17(9502)\_CN were discovered to contain a stack overflow in the function formIPMacBindAdd. (no CVSS)
- [CVE-2022-24170](https://cve.now/CVE-2022-24170.md): Tenda routers G1 and G3 v15.11.0.17(9502)\_CN were discovered to contain a command injection vulnerability in the function formSetIpSecTunnel (no CVSS)
- [CVE-2022-24171](https://cve.now/CVE-2022-24171.md): Tenda routers G1 and G3 v15.11.0.17(9502)\_CN were discovered to contain a command injection vulnerability in the function formSetPppoeServer (no CVSS)
- [CVE-2022-24172](https://cve.now/CVE-2022-24172.md): Tenda routers G1 and G3 v15.11.0.17(9502)\_CN were discovered to contain a stack overflow in the function formAddDhcpBindRule. (no CVSS)
- [CVE-2021-40401](https://cve.now/CVE-2021-40401.md): A use-after-free vulnerability exists in the RS-274X aperture definition tokenization functionality of Gerbv 2.7.0 and dev (commit b5f1eacd) (CVSS 10.0, Gerbv)
- [CVE-2021-40403](https://cve.now/CVE-2021-40403.md): An information disclosure vulnerability exists in the pick-and-place rotation parsing functionality of Gerbv 2.7.0 and dev (commit b5f1eacd) (CVSS 5.8, Gerbv)
- [CVE-2021-4043](https://cve.now/CVE-2021-4043.md): NULL Pointer Dereference in gpac/gpac (CVSS 5.8, gpac/gpac)
- [CVE-2022-0264](https://cve.now/CVE-2022-0264.md): A vulnerability was found in the Linux kernel's eBPF verifier when handling internal data structures. (no CVSS, kernel)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-02-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.