CVEs published February 8, 2022
41 CVEs were published on February 8, 2022: 0 critical, 5 high.
- Published
- 41
- Critical
- 0
- High
- 5
- Medium
- 14
- Low
- 0
- Unrated
- 22
- Now in CISA KEV
- 0
- Fix available
- 26
Most affected products
- radareorg/radare2
- 7
- github.com/go-gitea/gitea
- 4
- microweber/microweber
- 3
- econosys system php_mailform
- 2
- grafana · github.com/grafana/grafana
- 2
- pimcore/pimcore
- 2
- TAGAWA Takao TransmitMail
- 2
- Canon laser printers and small office multifunctional print…
- 1
- chocobozzz/peertube · @peertube/embed-api
- 1
- ELECOM CO. ELECOM LAN router
- 1
High 5
- CVE-2022-23626Insufficient file checks in m1k1o/blogm1k1o blog
- CVE-2022-0520Use After Free in radareorg/radare2radareorg/radare2
- CVE-2022-0139Use After Free in radareorg/radare2radareorg/radare2
- CVE-2022-0506Cross-site Scripting (XSS) - Stored in microweber/microwebermicroweber/microweber
- CVE-2022-0523Use After Free in radareorg/radare2radareorg/radare2
Medium, low and unrated 36
- CVE-2022-24676update_code in Admin.php in HYBBS2 through 2.3.2 allows arbitrary file upload via a crafted ZIP archive.
- CVE-2022-24677Admin.php in HYBBS2 through 2.3.2 allows remote code execution because it writes plugin-related configuration information to conf.php.
- CVE-2022-23627Inadequate access verification when using proxy commands in ArchiSteamFarm JustArchiNET ArchiSteamFarm
- CVE-2021-45919Studio 42 elFinder through 2.1.31 allows XSS via an SVG document.studio-42/elfinder
- CVE-2021-45329Cross Site Scripting (XSS) vulnerability exists in Gitea before 1.5.1 via the repository settings inside the external wiki/issue tracker URLgithub.com/go-gitea/gitea
- CVE-2022-0524Business Logic Errors in publify/publifypublify/publify · publify_core
- CVE-2022-0522Access of Memory Location Before Start of Buffer in radareorg/radare2radareorg/radare2
- CVE-2022-21713Exposure of Sensitive Information in Grafanagrafana · github.com/grafana/grafana
- CVE-2022-0521Access of Memory Location After End of Buffer in radareorg/radare2radareorg/radare2
- CVE-2022-21703Cross Site Request Forgery in Grafanagrafana · github.com/grafana/grafana/pkg/web
- CVE-2022-0519Buffer Access with Incorrect Length Value in radareorg/radare2radareorg/radare2
- CVE-2022-0518Heap-based Buffer Overflow in radareorg/radare2radareorg/radare2
- CVE-2022-21702Cross site scripting in Grafana proxygrafana · github.com/grafana/grafana
- CVE-2021-45328Gitea before 1.4.3 is affected by URL Redirection to Untrusted Site ('Open Redirect') via internal URLs.github.com/go-gitea/gitea
- CVE-2021-45327Gitea before 1.11.2 is affected by Trusting HTTP Permission Methods on the Server Side when referencing the vulnerable admin or user API.github.com/go-gitea/gitea · code.gitea.io/gitea
- CVE-2021-45326Cross Site Request Forgery (CSRF) vulnerability exists in Gitea before 1.5.2 via API routes.This can be dangerous especially with state altegithub.com/go-gitea/gitea
- CVE-2021-45325Server Side Request Forgery (SSRF) vulneraility exists in Gitea before 1.7.0 using the OpenID URL.github.com/go-gitea/gitea
- CVE-2021-44864TP-Link WR886N 3.0 1.0.1 Build 150127 Rel.34123n is vulnerable to Buffer Overflow.
- CVE-2022-0510Cross-site Scripting (XSS) - Reflected in pimcore/pimcorepimcore/pimcore
- CVE-2021-44956Two Heap based buffer overflow vulnerabilities exist in ffjpeg through 01.01.2021.
- CVE-2021-44957Global buffer overflow vulnerability exist in ffjpeg through 01.01.2021.
- CVE-2022-23340Joplin 2.6.10 allows remote attackers to execute system commands through malicious code in user search results.joplin
- CVE-2022-23331In DataEase v1.6.1, an authenticated user can gain unauthorized access to all user information and can change the administrator password.
- CVE-2022-0509Cross-site Scripting (XSS) - Stored in pimcore/pimcorepimcore/pimcore
- CVE-2022-0508Server-Side Request Forgery (SSRF) in chocobozzz/peertubechocobozzz/peertube · @peertube/embed-api
- CVE-2022-22146Cross-site scripting vulnerability in TransmitMail 2.5.0 to 2.6.1 allows a remote unauthenticated attacker to inject an arbitrary script viaTAGAWA Takao TransmitMail
- CVE-2022-22142Reflected cross-site scripting vulnerability in the checkbox of php_mailform versions prior to Version 1.40 allows a remote unauthenticated econosys system php_mailform
- CVE-2022-21805Reflected cross-site scripting vulnerability in the attached file name of php_mailform versions prior to Version 1.40 allows a remote unautheconosys system php_mailform
- CVE-2022-21799Cross-site scripting vulnerability in ELECOM LAN router WRC-300FEBK-R firmware v1.13 and earlier allows an attacker on the adjacent network ELECOM CO. ELECOM LAN router
- CVE-2022-21241Cross-site scripting vulnerability in CSV+ prior to 0.8.1 allows a remote unauthenticated attacker to inject an arbitrary script or an arbitPlus one CSV+
- CVE-2022-21193Directory traversal vulnerability in TransmitMail 2.5.0 to 2.6.1 allows a remote unauthenticated attacker to obtain an arbitrary file on theTAGAWA Takao TransmitMail
- CVE-2022-21173Hidden functionality vulnerability in ELECOM LAN routers (WRH-300BK3 firmware v1.05 and earlier, WRH-300WH3 firmware v1.05 and earlier, WRH-ELECOM CO. ELECOM LAN routers
- CVE-2021-20877Cross-site scripting vulnerability in Canon laser printers and small office multifunctional printers (LBP162L/LBP162, MF4890dw, MF269dw/MF26Canon laser printers and small office multifunctional print…
- CVE-2022-0504Generation of Error Message Containing Sensitive Information in microweber/microwebermicroweber/microweber
- CVE-2022-0505Cross-Site Request Forgery (CSRF) in microweber/microwebermicroweber/microweber
- CVE-2022-24450NATS nats-server before 2.7.2 has Incorrect Access Control.github.com/nats-io/nats-server · github.com/nats-io/nats… +1