# CVEs published 2022-02-08

41 CVEs were published on February 8, 2022: 0 critical, 5 high. Days are UTC.

- [CVE-2022-24676](https://cve.now/CVE-2022-24676.md): update\_code in Admin.php in HYBBS2 through 2.3.2 allows arbitrary file upload via a crafted ZIP archive. (no CVSS)
- [CVE-2022-24677](https://cve.now/CVE-2022-24677.md): Admin.php in HYBBS2 through 2.3.2 allows remote code execution because it writes plugin-related configuration information to conf.php. (no CVSS)
- [CVE-2022-23627](https://cve.now/CVE-2022-23627.md): Inadequate access verification when using proxy commands in ArchiSteamFarm (CVSS 5.0, JustArchiNET ArchiSteamFarm)
- [CVE-2021-45919](https://cve.now/CVE-2021-45919.md): Studio 42 elFinder through 2.1.31 allows XSS via an SVG document. (no CVSS, studio-42/elfinder)
- [CVE-2021-45329](https://cve.now/CVE-2021-45329.md): Cross Site Scripting (XSS) vulnerability exists in Gitea before 1.5.1 via the repository settings inside the external wiki/issue tracker URL (no CVSS, github.com/go-gitea/gitea)
- [CVE-2022-0524](https://cve.now/CVE-2022-0524.md): Business Logic Errors in publify/publify (CVSS 6.5, publify/publify · publify\_core)
- [CVE-2022-23626](https://cve.now/CVE-2022-23626.md): Insufficient file checks in m1k1o/blog (CVSS 8.5, m1k1o blog)
- [CVE-2022-0522](https://cve.now/CVE-2022-0522.md): Access of Memory Location Before Start of Buffer in radareorg/radare2 (CVSS 6.3, radareorg/radare2)
- [CVE-2022-21713](https://cve.now/CVE-2022-21713.md): Exposure of Sensitive Information in Grafana (CVSS 4.3, grafana · github.com/grafana/grafana)
- [CVE-2022-0521](https://cve.now/CVE-2022-0521.md): Access of Memory Location After End of Buffer in radareorg/radare2 (CVSS 6.3, radareorg/radare2)
- [CVE-2022-0520](https://cve.now/CVE-2022-0520.md): Use After Free in radareorg/radare2 (CVSS 8.8, radareorg/radare2)
- [CVE-2022-21703](https://cve.now/CVE-2022-21703.md): Cross Site Request Forgery in Grafana (CVSS 6.3, grafana · github.com/grafana/grafana/pkg/web)
- [CVE-2022-0519](https://cve.now/CVE-2022-0519.md): Buffer Access with Incorrect Length Value in radareorg/radare2 (CVSS 6.3, radareorg/radare2)
- [CVE-2022-0518](https://cve.now/CVE-2022-0518.md): Heap-based Buffer Overflow in radareorg/radare2 (CVSS 6.3, radareorg/radare2)
- [CVE-2022-21702](https://cve.now/CVE-2022-21702.md): Cross site scripting in Grafana proxy (CVSS 6.5, grafana · github.com/grafana/grafana)
- [CVE-2022-0139](https://cve.now/CVE-2022-0139.md): Use After Free in radareorg/radare2 (CVSS 7.1, radareorg/radare2)
- [CVE-2021-45328](https://cve.now/CVE-2021-45328.md): Gitea before 1.4.3 is affected by URL Redirection to Untrusted Site ('Open Redirect') via internal URLs. (no CVSS, github.com/go-gitea/gitea)
- [CVE-2021-45327](https://cve.now/CVE-2021-45327.md): Gitea before 1.11.2 is affected by Trusting HTTP Permission Methods on the Server Side when referencing the vulnerable admin or user API. (no CVSS, github.com/go-gitea/gitea · code.gitea.io/gitea)
- [CVE-2021-45326](https://cve.now/CVE-2021-45326.md): Cross Site Request Forgery (CSRF) vulnerability exists in Gitea before 1.5.2 via API routes.This can be dangerous especially with state alte (no CVSS, github.com/go-gitea/gitea)
- [CVE-2021-45325](https://cve.now/CVE-2021-45325.md): Server Side Request Forgery (SSRF) vulneraility exists in Gitea before 1.7.0 using the OpenID URL. (no CVSS, github.com/go-gitea/gitea)
- [CVE-2021-44864](https://cve.now/CVE-2021-44864.md): TP-Link WR886N 3.0 1.0.1 Build 150127 Rel.34123n is vulnerable to Buffer Overflow. (no CVSS)
- [CVE-2022-0510](https://cve.now/CVE-2022-0510.md): Cross-site Scripting (XSS) - Reflected in pimcore/pimcore (CVSS 4.3, pimcore/pimcore)
- [CVE-2021-44956](https://cve.now/CVE-2021-44956.md): Two Heap based buffer overflow vulnerabilities exist in ffjpeg through 01.01.2021. (no CVSS)
- [CVE-2021-44957](https://cve.now/CVE-2021-44957.md): Global buffer overflow vulnerability exist in ffjpeg through 01.01.2021. (no CVSS)
- [CVE-2022-23340](https://cve.now/CVE-2022-23340.md): Joplin 2.6.10 allows remote attackers to execute system commands through malicious code in user search results. (no CVSS, joplin)
- [CVE-2022-23331](https://cve.now/CVE-2022-23331.md): In DataEase v1.6.1, an authenticated user can gain unauthorized access to all user information and can change the administrator password. (no CVSS)
- [CVE-2022-0509](https://cve.now/CVE-2022-0509.md): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (CVSS 6.6, pimcore/pimcore)
- [CVE-2022-0508](https://cve.now/CVE-2022-0508.md): Server-Side Request Forgery (SSRF) in chocobozzz/peertube (CVSS 6.5, chocobozzz/peertube · @peertube/embed-api)
- [CVE-2022-22146](https://cve.now/CVE-2022-22146.md): Cross-site scripting vulnerability in TransmitMail 2.5.0 to 2.6.1 allows a remote unauthenticated attacker to inject an arbitrary script via (no CVSS, TAGAWA Takao TransmitMail)
- [CVE-2022-22142](https://cve.now/CVE-2022-22142.md): Reflected cross-site scripting vulnerability in the checkbox of php\_mailform versions prior to Version 1.40 allows a remote unauthenticated (no CVSS, econosys system php\_mailform)
- [CVE-2022-21805](https://cve.now/CVE-2022-21805.md): Reflected cross-site scripting vulnerability in the attached file name of php\_mailform versions prior to Version 1.40 allows a remote unauth (no CVSS, econosys system php\_mailform)
- [CVE-2022-21799](https://cve.now/CVE-2022-21799.md): Cross-site scripting vulnerability in ELECOM LAN router WRC-300FEBK-R firmware v1.13 and earlier allows an attacker on the adjacent network (no CVSS, ELECOM CO. ELECOM LAN router)
- [CVE-2022-21241](https://cve.now/CVE-2022-21241.md): Cross-site scripting vulnerability in CSV+ prior to 0.8.1 allows a remote unauthenticated attacker to inject an arbitrary script or an arbit (no CVSS, Plus one CSV+)
- [CVE-2022-21193](https://cve.now/CVE-2022-21193.md): Directory traversal vulnerability in TransmitMail 2.5.0 to 2.6.1 allows a remote unauthenticated attacker to obtain an arbitrary file on the (no CVSS, TAGAWA Takao TransmitMail)
- [CVE-2022-21173](https://cve.now/CVE-2022-21173.md): Hidden functionality vulnerability in ELECOM LAN routers (WRH-300BK3 firmware v1.05 and earlier, WRH-300WH3 firmware v1.05 and earlier, WRH- (no CVSS, ELECOM CO. ELECOM LAN routers)
- [CVE-2021-20877](https://cve.now/CVE-2021-20877.md): Cross-site scripting vulnerability in Canon laser printers and small office multifunctional printers (LBP162L/LBP162, MF4890dw, MF269dw/MF26 (no CVSS, Canon laser printers and small office multifunctional print…)
- [CVE-2022-0504](https://cve.now/CVE-2022-0504.md): Generation of Error Message Containing Sensitive Information in microweber/microweber (CVSS 6.5, microweber/microweber)
- [CVE-2022-0505](https://cve.now/CVE-2022-0505.md): Cross-Site Request Forgery (CSRF) in microweber/microweber (CVSS 5.7, microweber/microweber)
- [CVE-2022-0506](https://cve.now/CVE-2022-0506.md): Cross-site Scripting (XSS) - Stored in microweber/microweber (CVSS 7.7, microweber/microweber)
- [CVE-2022-24450](https://cve.now/CVE-2022-24450.md): NATS nats-server before 2.7.2 has Incorrect Access Control. (no CVSS, github.com/nats-io/nats-server · github.com/nats-io/nats… +1)
- [CVE-2022-0523](https://cve.now/CVE-2022-0523.md): Use After Free in radareorg/radare2 (CVSS 8.8, radareorg/radare2)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-02-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.