CVEs published February 7, 2022
50 CVEs were published on February 7, 2022: 2 critical, 7 high.
- Published
- 50
- Critical
- 2
- High
- 7
- Medium
- 12
- Low
- 2
- Unrated
- 27
- Now in CISA KEV
- 0
- Fix available
- 37
Most affected products
- Synology DiskStation Manager
- 6
- SupportCandy – Helpdesk & Support Ticket System
- 5
- IP2Location Country Blocker
- 3
- Microsoft Edge
- 3
- NVIDIA GPU Display Driver
- 3
- zephyrproject-rtos zephyr
- 2
- Advanced Cron Manager
- 1
- All-in-one Floating Contact Form, Call, Chat, and 50+ Socia…
- 1
- Apache Software Foundation Apache James · org.apache.james:…
- 1
- CLUEVO LMS, E-Learning Platform
- 1
Critical 2
High 7
- CVE-2022-23623Validation bypass in frouriofrouriojs frourio · frourio
- CVE-2022-23624Validation bypass in frourio-expressfrouriojs frourio-express · frourio-express
- CVE-2021-3861The RNDIS USB device class includes a buffer overflow vulnerabilityzephyrproject-rtos zephyr
- CVE-2021-3835Buffer overflow in usb device classzephyrproject-rtos zephyr
- CVE-2022-23613Privilege escalation on xrdpneutrinolabs xrdp
- CVE-2022-23263Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityMicrosoft Edge
- CVE-2022-21712Cookie and header exposure in twistedtwisted
Medium, low and unrated 41
- CVE-2021-45281QuickBox Pro v2.4.8 contains a cross-site scripting (XSS) vulnerability at "adminuseredit.php?usertoedit=XSS", as the user supplied input fo
- CVE-2022-21816NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (nvidia.ko), where a user in the guest OS can cause a GPU interruptNVIDIA Virtual GPU Software and NVIDIA Cloud Gaming
- CVE-2022-21815NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for private IOCTLs where a NUNVIDIA GPU Display Driver
- CVE-2022-22931Path traversal in Apache James 3.6.1Apache Software Foundation Apache James · org.apache.james:…
- CVE-2022-23262Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityMicrosoft Edge
- CVE-2022-23261Microsoft Edge (Chromium-based) Tampering VulnerabilityMicrosoft Edge
- CVE-2022-0149WooCommerce – Store Exporter < 2.7.1 - Reflected Cross-Site Scripting (XSS)WooCommerce – Store Exporter
- CVE-2022-0148All-in-one Floating Contact Form < 2.0.4 - Authenticated Reflected Cross-Site Scripting (XSS)All-in-one Floating Contact Form, Call, Chat, and 50+ Socia…
- CVE-2021-25108IP2Location Country Blocker < 2.26.6 - Arbitrary Country Ban via CSRFIP2Location Country Blocker
- CVE-2021-25114Paid Memberships Pro < 2.6.7 - Unauthenticated Blind SQL InjectionPaid Memberships Pro
- CVE-2021-25106WPLegalPages < 2.7.1 - Subscriber+ Arbitrary Settings Update to Stored XSSPrivacy Policy Generator, Terms & Conditions Generator Word…
- CVE-2021-25105Ivory Search < 5.4.1 - Multiple Admin+ Stored Cross-Site ScriptingIvory Search – WordPress Search Plugin
- CVE-2021-25103GTranslate < 2.9.7 - Reflected Cross-Site ScriptingTranslate WordPress with GTranslate
- CVE-2021-25096IP2Location Country Blocker < 2.26.5 - Ban BypassIP2Location Country Blocker
- CVE-2021-25084Advanced Cron Manager - Subscriber+ Arbitrary Events/Schedules Creation/DeletionAdvanced Cron Manager
- CVE-2021-25077Store Toolkit for WooCommerce < 2.3.2 - Reflected Cross-Site ScriptingStore Toolkit for WooCommerce
- CVE-2021-25029Cluevo < 1.8.1 - Admin+ Stored Cross Site ScriptingCLUEVO LMS, E-Learning Platform
- CVE-2021-25004SEUR Oficial < 1.7.2 - Admin+ Arbitrary File DownloadSEUR Oficial
- CVE-2021-24947RVM - Responsive Vector Maps < 6.4.2 - Subscriber+ Arbitrary File ReadRVM – Responsive Vector Maps
- CVE-2021-24993Ultimate Product Catalog < 5.0.26 - Subscriber+ Arbitrary Product Creation & Settings UpdateUltimate Product Catalog – WordPress Catalog Plugin
- CVE-2021-24928Rearrange Woocommerce Products < 3.0.8 - Subscriber+ SQL InjectionRearrange Woocommerce Products
- CVE-2021-24880SupportCandy < 2.2.7 - Contributor+ Stored Cross-Site ScriptingSupportCandy – Helpdesk & Support Ticket System
- CVE-2021-24879SupportCandy < 2.2.7 - CSRF to Cross-Site ScriptingSupportCandy – Helpdesk & Support Ticket System
- CVE-2021-24843SupportCandy < 2.2.7 - Arbitrary Ticket Deletion via CSRFSupportCandy – Helpdesk & Support Ticket System
- CVE-2021-24878SupportCandy < 2.2.7 - Reflected Cross-Site ScriptingSupportCandy – Helpdesk & Support Ticket System
- CVE-2021-24839SupportCandy < 2.2.5 - Unauthenticated Arbitrary Ticket DeletionSupportCandy – Helpdesk & Support Ticket System
- CVE-2021-46389IIPImage High Resolution Streaming Image Server prior to commit 882925b295a80ec992063deffc2a3b0d803c3195 is affected by an integer overflow
- CVE-2021-46359FISCO-BCOS release-3.0.0-rc2 contains a denial of service vulnerability.
- CVE-2022-23320XMPie uStore 12.3.7244.0 allows for administrators to generate reports based on raw SQL queries.
- CVE-2022-0474Disclosure of mail addressesOTRS AG OTRSCustomContactFields
- CVE-2022-0473Dynamic field error message is vulnerable to XSSOTRS AG OTRS
- CVE-2022-23184In affected Octopus Server versions when the server HTTP and HTTPS bindings are configured to localhost, Octopus Server will allow open rediOctopus Deploy Octopus Server
- CVE-2022-22679Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in support service management in Synology DiskSSynology DiskStation Manager
- CVE-2021-43929Improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in work flow management in Synology DiskStation Manager
- CVE-2021-43927Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Security Management functionality in SSynology DiskStation Manager
- CVE-2021-43926Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Log Management functionality in SynoloSynology DiskStation Manager
- CVE-2021-43925Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Log Management functionality in SynoloSynology DiskStation Manager
- CVE-2022-22680Exposure of sensitive information to an unauthorized actor vulnerability in Web Server in Synology DiskStation Manager (DSM) before 7.0.1-42Synology DiskStation Manager
- CVE-2021-25095IP2Location Country Blocker < 2.26.5 - Subscriber+ Arbitrary Country BanIP2Location Country Blocker
- CVE-2022-21813NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel driver, where improper handling of insufficient permissions or prNVIDIA GPU Display Driver
- CVE-2022-21814NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel driver package, where improper handling of insufficient permissioNVIDIA GPU Display Driver