# CVEs published 2022-02-07

50 CVEs were published on February 7, 2022: 2 critical, 7 high. Days are UTC.

- [CVE-2022-23623](https://cve.now/CVE-2022-23623.md): Validation bypass in frourio (CVSS 8.1, frouriojs frourio · frourio)
- [CVE-2022-23624](https://cve.now/CVE-2022-23624.md): Validation bypass in frourio-express (CVSS 8.1, frouriojs frourio-express · frourio-express)
- [CVE-2021-3861](https://cve.now/CVE-2021-3861.md): The RNDIS USB device class includes a buffer overflow vulnerability (CVSS 8.2, zephyrproject-rtos zephyr)
- [CVE-2021-3835](https://cve.now/CVE-2021-3835.md): Buffer overflow in usb device class (CVSS 8.2, zephyrproject-rtos zephyr)
- [CVE-2022-23613](https://cve.now/CVE-2022-23613.md): Privilege escalation on xrdp (CVSS 7.8, neutrinolabs xrdp)
- [CVE-2021-45281](https://cve.now/CVE-2021-45281.md): QuickBox Pro v2.4.8 contains a cross-site scripting (XSS) vulnerability at "adminuseredit.php?usertoedit=XSS", as the user supplied input fo (no CVSS)
- [CVE-2022-21816](https://cve.now/CVE-2022-21816.md): NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (nvidia.ko), where a user in the guest OS can cause a GPU interrupt (CVSS 5.5, NVIDIA Virtual GPU Software and NVIDIA Cloud Gaming)
- [CVE-2022-21815](https://cve.now/CVE-2022-21815.md): NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for private IOCTLs where a NU (CVSS 5.5, NVIDIA GPU Display Driver)
- [CVE-2021-42833](https://cve.now/CVE-2021-42833.md): Use of hardcoded credentials impacting AquaView versions 1.60, 7.x, 8.x (CVSS 9.3)
- [CVE-2022-22931](https://cve.now/CVE-2022-22931.md): Path traversal in Apache James 3.6.1 (no CVSS, Apache Software Foundation Apache James · org.apache.james:…)
- [CVE-2022-23263](https://cve.now/CVE-2022-23263.md): Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (CVSS 7.7, Microsoft Edge)
- [CVE-2022-23262](https://cve.now/CVE-2022-23262.md): Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (CVSS 6.3, Microsoft Edge)
- [CVE-2022-23261](https://cve.now/CVE-2022-23261.md): Microsoft Edge (Chromium-based) Tampering Vulnerability (CVSS 5.3, Microsoft Edge)
- [CVE-2022-0149](https://cve.now/CVE-2022-0149.md): WooCommerce – Store Exporter \< 2.7.1 - Reflected Cross-Site Scripting (XSS) (no CVSS, WooCommerce – Store Exporter)
- [CVE-2022-0148](https://cve.now/CVE-2022-0148.md): All-in-one Floating Contact Form \< 2.0.4 - Authenticated Reflected Cross-Site Scripting (XSS) (no CVSS, All-in-one Floating Contact Form, Call, Chat, and 50+ Socia…)
- [CVE-2021-25108](https://cve.now/CVE-2021-25108.md): IP2Location Country Blocker \< 2.26.6 - Arbitrary Country Ban via CSRF (no CVSS, IP2Location Country Blocker)
- [CVE-2021-25114](https://cve.now/CVE-2021-25114.md): Paid Memberships Pro \< 2.6.7 - Unauthenticated Blind SQL Injection (no CVSS, Paid Memberships Pro)
- [CVE-2021-25106](https://cve.now/CVE-2021-25106.md): WPLegalPages \< 2.7.1 - Subscriber+ Arbitrary Settings Update to Stored XSS (no CVSS, Privacy Policy Generator, Terms & Conditions Generator Word…)
- [CVE-2021-25105](https://cve.now/CVE-2021-25105.md): Ivory Search \< 5.4.1 - Multiple Admin+ Stored Cross-Site Scripting (no CVSS, Ivory Search – WordPress Search Plugin)
- [CVE-2021-25103](https://cve.now/CVE-2021-25103.md): GTranslate \< 2.9.7 - Reflected Cross-Site Scripting (no CVSS, Translate WordPress with GTranslate)
- [CVE-2021-25096](https://cve.now/CVE-2021-25096.md): IP2Location Country Blocker \< 2.26.5 - Ban Bypass (no CVSS, IP2Location Country Blocker)
- [CVE-2021-25084](https://cve.now/CVE-2021-25084.md): Advanced Cron Manager - Subscriber+ Arbitrary Events/Schedules Creation/Deletion (no CVSS, Advanced Cron Manager)
- [CVE-2021-25077](https://cve.now/CVE-2021-25077.md): Store Toolkit for WooCommerce \< 2.3.2 - Reflected Cross-Site Scripting (no CVSS, Store Toolkit for WooCommerce)
- [CVE-2021-25029](https://cve.now/CVE-2021-25029.md): Cluevo \< 1.8.1 - Admin+ Stored Cross Site Scripting (no CVSS, CLUEVO LMS, E-Learning Platform)
- [CVE-2021-25004](https://cve.now/CVE-2021-25004.md): SEUR Oficial \< 1.7.2 - Admin+ Arbitrary File Download (no CVSS, SEUR Oficial)
- [CVE-2021-24947](https://cve.now/CVE-2021-24947.md): RVM - Responsive Vector Maps \< 6.4.2 - Subscriber+ Arbitrary File Read (no CVSS, RVM – Responsive Vector Maps)
- [CVE-2021-24993](https://cve.now/CVE-2021-24993.md): Ultimate Product Catalog \< 5.0.26 - Subscriber+ Arbitrary Product Creation & Settings Update (no CVSS, Ultimate Product Catalog – WordPress Catalog Plugin)
- [CVE-2021-24928](https://cve.now/CVE-2021-24928.md): Rearrange Woocommerce Products \< 3.0.8 - Subscriber+ SQL Injection (no CVSS, Rearrange Woocommerce Products)
- [CVE-2021-24880](https://cve.now/CVE-2021-24880.md): SupportCandy \< 2.2.7 - Contributor+ Stored Cross-Site Scripting (no CVSS, SupportCandy – Helpdesk & Support Ticket System)
- [CVE-2021-24879](https://cve.now/CVE-2021-24879.md): SupportCandy \< 2.2.7 - CSRF to Cross-Site Scripting (no CVSS, SupportCandy – Helpdesk & Support Ticket System)
- [CVE-2021-24843](https://cve.now/CVE-2021-24843.md): SupportCandy \< 2.2.7 - Arbitrary Ticket Deletion via CSRF (no CVSS, SupportCandy – Helpdesk & Support Ticket System)
- [CVE-2021-24878](https://cve.now/CVE-2021-24878.md): SupportCandy \< 2.2.7 - Reflected Cross-Site Scripting (no CVSS, SupportCandy – Helpdesk & Support Ticket System)
- [CVE-2021-24839](https://cve.now/CVE-2021-24839.md): SupportCandy \< 2.2.5 - Unauthenticated Arbitrary Ticket Deletion (no CVSS, SupportCandy – Helpdesk & Support Ticket System)
- [CVE-2021-46389](https://cve.now/CVE-2021-46389.md): IIPImage High Resolution Streaming Image Server prior to commit 882925b295a80ec992063deffc2a3b0d803c3195 is affected by an integer overflow (no CVSS)
- [CVE-2021-46359](https://cve.now/CVE-2021-46359.md): FISCO-BCOS release-3.0.0-rc2 contains a denial of service vulnerability. (no CVSS)
- [CVE-2022-23320](https://cve.now/CVE-2022-23320.md): XMPie uStore 12.3.7244.0 allows for administrators to generate reports based on raw SQL queries. (no CVSS)
- [CVE-2022-0474](https://cve.now/CVE-2022-0474.md): Disclosure of mail addresses (CVSS 2.4, OTRS AG OTRSCustomContactFields)
- [CVE-2022-0473](https://cve.now/CVE-2022-0473.md): Dynamic field error message is vulnerable to XSS (CVSS 3.8, OTRS AG OTRS)
- [CVE-2022-23184](https://cve.now/CVE-2022-23184.md): In affected Octopus Server versions when the server HTTP and HTTPS bindings are configured to localhost, Octopus Server will allow open redi (no CVSS, Octopus Deploy Octopus Server)
- [CVE-2022-22679](https://cve.now/CVE-2022-22679.md): Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in support service management in Synology DiskS (CVSS 6.5, Synology DiskStation Manager)
- [CVE-2021-43929](https://cve.now/CVE-2021-43929.md): Improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in work flow management in (CVSS 6.5, Synology DiskStation Manager)
- [CVE-2021-43928](https://cve.now/CVE-2021-43928.md): Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in mail sending and receiving compo (CVSS 9.9, Synology Mail Station)
- [CVE-2021-43927](https://cve.now/CVE-2021-43927.md): Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Security Management functionality in S (CVSS 4.7, Synology DiskStation Manager)
- [CVE-2021-43926](https://cve.now/CVE-2021-43926.md): Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Log Management functionality in Synolo (CVSS 4.7, Synology DiskStation Manager)
- [CVE-2021-43925](https://cve.now/CVE-2021-43925.md): Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Log Management functionality in Synolo (CVSS 4.7, Synology DiskStation Manager)
- [CVE-2022-22680](https://cve.now/CVE-2022-22680.md): Exposure of sensitive information to an unauthorized actor vulnerability in Web Server in Synology DiskStation Manager (DSM) before 7.0.1-42 (CVSS 5.3, Synology DiskStation Manager)
- [CVE-2021-25095](https://cve.now/CVE-2021-25095.md): IP2Location Country Blocker \< 2.26.5 - Subscriber+ Arbitrary Country Ban (no CVSS, IP2Location Country Blocker)
- [CVE-2022-21712](https://cve.now/CVE-2022-21712.md): Cookie and header exposure in twisted (CVSS 7.5, twisted)
- [CVE-2022-21813](https://cve.now/CVE-2022-21813.md): NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel driver, where improper handling of insufficient permissions or pr (CVSS 6.1, NVIDIA GPU Display Driver)
- [CVE-2022-21814](https://cve.now/CVE-2022-21814.md): NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel driver package, where improper handling of insufficient permissio (CVSS 6.1, NVIDIA GPU Display Driver)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-02-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.