# CVEs published 2022-02-10

47 CVEs were published on February 10, 2022: 17 critical, 4 high. 5 are now in CISA KEV. Days are UTC.

- [CVE-2022-24647](https://cve.now/CVE-2022-24647.md): Cuppa CMS v1.0 was discovered to contain an arbitrary file deletion vulnerability via the unlink() function. (no CVSS)
- [CVE-2022-24646](https://cve.now/CVE-2022-24646.md): Hospital Management System v4.0 was discovered to contain a SQL injection vulnerability in /Hospital-Management-System-master/contact.php vi (no CVSS)
- [CVE-2021-44970](https://cve.now/CVE-2021-44970.md): MiniCMS v1.11 was discovered to contain a cross-site scripting (XSS) vulnerability via /mc-admin/page-edit.php. (no CVSS)
- [CVE-2021-44969](https://cve.now/CVE-2021-44969.md): Taocms v3.0.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the Management Column component. (no CVSS)
- [CVE-2021-42000](https://cve.now/CVE-2021-42000.md): Ping Identity PingFederate Password Reset and Password Change Mishandling with an authentication policy in parallel reset flows (CVSS 5.3, Ping Identity PingFederate)
- [CVE-2022-23630](https://cve.now/CVE-2022-23630.md): Dependency verification bypass in Gradle (CVSS 7.5, gradle)
- [CVE-2022-24916](https://cve.now/CVE-2022-24916.md): Optimism before @eth-optimism/l2geth@0.5.11 allows economic griefing because a balance is duplicated upon contract self-destruction. (no CVSS)
- [CVE-2022-24568](https://cve.now/CVE-2022-24568.md): Novel-plus v3.6.0 was discovered to be vulnerable to Server-Side Request Forgery (SSRF) via user-supplied crafted input. (no CVSS)
- [CVE-2021-45364](https://cve.now/CVE-2021-45364.md): A Code Execution vulnerability exists in Statamic Version through 3.2.26 via SettingsController.php. (no CVSS)
- [CVE-2021-44850](https://cve.now/CVE-2021-44850.md): On Xilinx Zynq-7000 SoC devices, physical modification of an SD boot image allows for a buffer overflow attack in the ROM. (no CVSS)
- [CVE-2022-23321](https://cve.now/CVE-2022-23321.md): A persistent cross-site scripting (XSS) vulnerability exists on two input fields within the administrative panel when editing users in the X (no CVSS)
- [CVE-2022-0021](https://cve.now/CVE-2022-0021.md): GlobalProtect App: Information Exposure Vulnerability When Using Connect Before Logon (CVSS 3.3, Palo Alto Networks GlobalProtect App)
- [CVE-2022-0020](https://cve.now/CVE-2022-0020.md): Cortex XSOAR: Stored Cross-Site Scripting (XSS) Vulnerability in Web Interface (CVSS 6.8, Palo Alto Networks Cortex XSOAR)
- [CVE-2022-0019](https://cve.now/CVE-2022-0019.md): GlobalProtect App: Insufficiently Protected Credentials Vulnerability on Linux (CVSS 4.7, Palo Alto Networks GlobalProtect App)
- [CVE-2022-0018](https://cve.now/CVE-2022-0018.md): GlobalProtect App: Information Exposure Vulnerability When Connecting to GlobalProtect Portal With Single Sign-On Enabled (CVSS 6.1, Palo Alto Networks GlobalProtect App)
- [CVE-2022-0017](https://cve.now/CVE-2022-0017.md): GlobalProtect App: Improper Link Resolution Vulnerability Leads to Local Privilege Escalation (CVSS 7.0, Palo Alto Networks GlobalProtect App)
- [CVE-2022-0016](https://cve.now/CVE-2022-0016.md): GlobalProtect App: Privilege Escalation Vulnerability When Using Connect Before Logon (CVSS 7.4, Palo Alto Networks GlobalProtect App)
- [CVE-2022-0011](https://cve.now/CVE-2022-0011.md): PAN-OS: URL Category Exceptions Match More URLs Than Intended in URL Filtering (CVSS 6.5, Palo Alto Networks PAN-OS · Palo Alto Networks Prisma Access)
- [CVE-2021-45357](https://cve.now/CVE-2021-45357.md): Cross Site Scripting (XSS) vulnerability exists in Piwigo 12.x via the pwg\_activity function in include/functions.inc.php. (no CVSS)
- [CVE-2022-20680](https://cve.now/CVE-2022-20680.md): Cisco Prime Service Catalog Information Disclosure Vulnerability (CVSS 4.3, Cisco Prime Service Catalog)
- [CVE-2022-20630](https://cve.now/CVE-2022-20630.md): Cisco DNA Center Information Disclosure Vulnerability (CVSS 4.4, Cisco Digital Network Architecture Center)
- [CVE-2022-20699](https://cve.now/CVE-2022-20699.md): Cisco Small Business RV Series Routers Vulnerabilities (CVSS 10.0, KEV, Cisco Small Business RV Series Router Firmware)
- [CVE-2022-20700](https://cve.now/CVE-2022-20700.md): Cisco Small Business RV Series Routers Vulnerabilities (CVSS 10.0, KEV, Cisco Small Business RV Series Router Firmware)
- [CVE-2022-20701](https://cve.now/CVE-2022-20701.md): Cisco Small Business RV Series Routers Vulnerabilities (CVSS 10.0, KEV, Cisco Small Business RV Series Router Firmware)
- [CVE-2022-20702](https://cve.now/CVE-2022-20702.md): Cisco Small Business RV Series Routers Vulnerabilities (CVSS 10.0, Cisco Small Business RV Series Router Firmware)
- [CVE-2022-20703](https://cve.now/CVE-2022-20703.md): Cisco Small Business RV Series Routers Vulnerabilities (CVSS 10.0, KEV, Cisco Small Business RV Series Router Firmware)
- [CVE-2022-20704](https://cve.now/CVE-2022-20704.md): Cisco Small Business RV Series Routers Vulnerabilities (CVSS 10.0, Cisco Small Business RV Series Router Firmware)
- [CVE-2022-20705](https://cve.now/CVE-2022-20705.md): Cisco Small Business RV Series Routers Vulnerabilities (CVSS 10.0, Cisco Small Business RV Series Router Firmware)
- [CVE-2022-20706](https://cve.now/CVE-2022-20706.md): Cisco Small Business RV Series Routers Vulnerabilities (CVSS 10.0, Cisco Small Business RV Series Router Firmware)
- [CVE-2022-20707](https://cve.now/CVE-2022-20707.md): Cisco Small Business RV Series Routers Vulnerabilities (CVSS 10.0, Cisco Small Business RV Series Router Firmware)
- [CVE-2022-20708](https://cve.now/CVE-2022-20708.md): Cisco Small Business RV Series Routers Vulnerabilities (CVSS 10.0, KEV, Cisco Small Business RV Series Router Firmware)
- [CVE-2022-20709](https://cve.now/CVE-2022-20709.md): Cisco Small Business RV Series Routers Vulnerabilities (CVSS 10.0, Cisco Small Business RV Series Router Firmware)
- [CVE-2022-20710](https://cve.now/CVE-2022-20710.md): Cisco Small Business RV Series Routers Vulnerabilities (CVSS 10.0, Cisco Small Business RV Series Router Firmware)
- [CVE-2022-20711](https://cve.now/CVE-2022-20711.md): Cisco Small Business RV Series Routers Vulnerabilities (CVSS 10.0, Cisco Small Business RV Series Router Firmware)
- [CVE-2022-20712](https://cve.now/CVE-2022-20712.md): Cisco Small Business RV Series Routers Vulnerabilities (CVSS 10.0, Cisco Small Business RV Series Router Firmware)
- [CVE-2022-20738](https://cve.now/CVE-2022-20738.md): Cisco Umbrella Secure Web Gateway File Inspection Bypass Vulnerability (CVSS 5.8, Cisco Umbrella Insights Virtual Appliance)
- [CVE-2022-20749](https://cve.now/CVE-2022-20749.md): Cisco Small Business RV Series Routers Vulnerabilities (CVSS 10.0, Cisco Small Business RV Series Router Firmware)
- [CVE-2021-41445](https://cve.now/CVE-2021-41445.md): A reflected cross-site-scripting attack in web application of D-Link DIR-X1860 before v1.10WWB09\_Beta allows a remote unauthenticated attack (no CVSS)
- [CVE-2021-31814](https://cve.now/CVE-2021-31814.md): In Stormshield 1.1.0, and 2.1.0 through 2.9.0, an attacker can block a client from accessing the VPN and can obtain sensitive information th (no CVSS)
- [CVE-2021-37613](https://cve.now/CVE-2021-37613.md): Stormshield Network Security (SNS) 1.0.0 through 4.2.3 allows a Denial of Service. (no CVSS)
- [CVE-2021-3398](https://cve.now/CVE-2021-3398.md): Stormshield Network Security (SNS) 3.x has an Integer Overflow in the high-availability component. (no CVSS)
- [CVE-2021-44892](https://cve.now/CVE-2021-44892.md): A Remote Code Execution (RCE) vulnerability exists in ThinkPHP 3.x.x via value\[\_filename\] in index.php, which could let a malicious user obt (no CVSS, topthink/framework)
- [CVE-2022-24111](https://cve.now/CVE-2022-24111.md): In Mahara 21.04 before 21.04.3 and 21.10 before 21.10.1, portfolios created in groups that have not been shared with non-group members and p (no CVSS)
- [CVE-2021-45901](https://cve.now/CVE-2021-45901.md): The password-reset form in ServiceNow Orlando provides different responses to invalid authentication attempts depending on whether the usern (no CVSS)
- [CVE-2021-25992](https://cve.now/CVE-2021-25992.md): ifme - Insufficient Session Expiration (CVSS 9.8, ifmeorg ifme)
- [CVE-2022-0558](https://cve.now/CVE-2022-0558.md): Cross-site Scripting (XSS) - Stored in microweber/microweber (CVSS 9.8, microweber/microweber)
- [CVE-2022-0554](https://cve.now/CVE-2022-0554.md): Use of Out-of-range Pointer Offset in vim/vim (CVSS 8.4, vim/vim)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-02-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.