# CVEs published 2022-02-11

163 CVEs were published on February 11, 2022: 3 critical, 25 high. 3 are now in CISA KEV. Days are UTC.

- [CVE-2022-0120](https://cve.now/CVE-2022-0120.md): Inappropriate implementation in Passwords in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to potentially leak cross-origin (no CVSS, Google Chrome)
- [CVE-2022-0118](https://cve.now/CVE-2022-0118.md): Inappropriate implementation in WebShare in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to potentially hide the contents o (no CVSS, Google Chrome)
- [CVE-2022-0117](https://cve.now/CVE-2022-0117.md): Policy bypass in Blink in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (no CVSS, Google Chrome)
- [CVE-2022-0116](https://cve.now/CVE-2022-0116.md): Inappropriate implementation in Compositing in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to spoof the contents of the Om (no CVSS, Google Chrome)
- [CVE-2022-0115](https://cve.now/CVE-2022-0115.md): Uninitialized use in File API in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to potentially perform out of bounds memory a (no CVSS, Google Chrome)
- [CVE-2022-0114](https://cve.now/CVE-2022-0114.md): Out of bounds memory access in Blink Serial API in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to perform an out of bounds (no CVSS, Google Chrome)
- [CVE-2022-0113](https://cve.now/CVE-2022-0113.md): Inappropriate implementation in Blink in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to leak cross-origin data via a craft (no CVSS, Google Chrome)
- [CVE-2022-0112](https://cve.now/CVE-2022-0112.md): Incorrect security UI in Browser UI in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to display missing URL or incorrect URL (no CVSS, Google Chrome)
- [CVE-2022-0111](https://cve.now/CVE-2022-0111.md): Inappropriate implementation in Navigation in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to incorrectly set origin via a (no CVSS, Google Chrome)
- [CVE-2022-0110](https://cve.now/CVE-2022-0110.md): Incorrect security UI in Autofill in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to spoof the contents of the Omnibox (URL (no CVSS, Google Chrome)
- [CVE-2022-0109](https://cve.now/CVE-2022-0109.md): Inappropriate implementation in Autofill in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to obtain potentially sensitive in (no CVSS, Google Chrome)
- [CVE-2022-0107](https://cve.now/CVE-2022-0107.md): Use after free in File Manager API in Google Chrome on Chrome OS prior to 97.0.4692.71 allowed an attacker who convinced a user to install a (no CVSS, Google Chrome)
- [CVE-2022-0106](https://cve.now/CVE-2022-0106.md): Use after free in Autofill in Google Chrome prior to 97.0.4692.71 allowed a remote attacker who convinced a user to perform specific user ge (no CVSS, Google Chrome)
- [CVE-2022-0105](https://cve.now/CVE-2022-0105.md): Use after free in PDF Accessibility in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to potentially exploit heap corruption (no CVSS, Google Chrome)
- [CVE-2022-0104](https://cve.now/CVE-2022-0104.md): Heap buffer overflow in ANGLE in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to potentially exploit heap corruption via a (no CVSS, Google Chrome)
- [CVE-2022-0103](https://cve.now/CVE-2022-0103.md): Use after free in SwiftShader in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to potentially exploit heap corruption via a (no CVSS, Google Chrome)
- [CVE-2022-0102](https://cve.now/CVE-2022-0102.md): Type confusion in V8 in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to potentially exploit heap corruption via a crafted H (no CVSS, Google Chrome)
- [CVE-2022-0101](https://cve.now/CVE-2022-0101.md): Heap buffer overflow in Bookmarks in Google Chrome prior to 97.0.4692.71 allowed a remote attacker who convinced a user to perform specific (no CVSS, Google Chrome)
- [CVE-2022-0100](https://cve.now/CVE-2022-0100.md): Heap buffer overflow in Media streams API in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to potentially exploit heap corru (no CVSS, Google Chrome)
- [CVE-2022-0099](https://cve.now/CVE-2022-0099.md): Use after free in Sign-in in Google Chrome prior to 97.0.4692.71 allowed a remote attacker who convinced a user to perform specific user ges (no CVSS, Google Chrome)
- [CVE-2022-0098](https://cve.now/CVE-2022-0098.md): Use after free in Screen Capture in Google Chrome on Chrome OS prior to 97.0.4692.71 allowed an attacker who convinced a user to perform spe (no CVSS, Google Chrome)
- [CVE-2022-0097](https://cve.now/CVE-2022-0097.md): Inappropriate implementation in DevTools in Google Chrome prior to 97.0.4692.71 allowed an attacker who convinced a user to install a malici (no CVSS, Google Chrome)
- [CVE-2022-0096](https://cve.now/CVE-2022-0096.md): Use after free in Storage in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to potentially exploit heap corruption via a craf (no CVSS, Google Chrome)
- [CVE-2021-4102](https://cve.now/CVE-2021-4102.md): Use after free in V8 in Google Chrome prior to 96.0.4664.110 allowed a remote attacker to potentially exploit heap corruption via a crafted (CVSS 8.8, KEV, Google Chrome)
- [CVE-2021-4101](https://cve.now/CVE-2021-4101.md): Heap buffer overflow in Swiftshader in Google Chrome prior to 96.0.4664.110 allowed a remote attacker to potentially exploit heap corruption (no CVSS, Google Chrome)
- [CVE-2021-4100](https://cve.now/CVE-2021-4100.md): Object lifecycle issue in ANGLE in Google Chrome prior to 96.0.4664.110 allowed a remote attacker to potentially exploit heap corruption via (no CVSS, Google Chrome)
- [CVE-2021-4099](https://cve.now/CVE-2021-4099.md): Use after free in Swiftshader in Google Chrome prior to 96.0.4664.110 allowed a remote attacker to potentially exploit heap corruption via a (no CVSS, Google Chrome)
- [CVE-2021-4098](https://cve.now/CVE-2021-4098.md): Insufficient data validation in Mojo in Google Chrome prior to 96.0.4664.110 allowed a remote attacker who had compromised the renderer proc (no CVSS, Google Chrome)
- [CVE-2022-23634](https://cve.now/CVE-2022-23634.md): Information Exposure when using Puma with Rails (CVSS 8.0, puma)
- [CVE-2021-46366](https://cve.now/CVE-2021-46366.md): An issue in the Login page of Magnolia CMS v6.2.3 and below allows attackers to exploit both an Open Redirect vulnerability and Cross-Site R (no CVSS, info.magnolia:magnolia-core)
- [CVE-2021-46365](https://cve.now/CVE-2021-46365.md): An issue in the Export function of Magnolia v6.2.3 and below allows attackers to execute XML External Entity attacks via a crafted XLF file. (no CVSS, info.magnolia:magnolia-core)
- [CVE-2021-46364](https://cve.now/CVE-2021-46364.md): A vulnerability in the Snake YAML parser of Magnolia CMS v6.2.3 and below allows attackers to execute arbitrary code via a crafted YAML file (no CVSS, info.magnolia:magnolia-core)
- [CVE-2021-46362](https://cve.now/CVE-2021-46362.md): A Server-Side Template Injection (SSTI) vulnerability in the Registration and Forgotten Password forms of Magnolia v6.2.3 and below allows a (no CVSS)
- [CVE-2021-46363](https://cve.now/CVE-2021-46363.md): An issue in the Export function of Magnolia v6.2.3 and below allows attackers to perform Formula Injection attacks via crafted CSV/XLS files (no CVSS, info.magnolia:magnolia-core)
- [CVE-2021-46361](https://cve.now/CVE-2021-46361.md): An issue in the Freemark Filter of Magnolia CMS v6.2.11 and below allows attackers to bypass security restrictions and execute arbitrary cod (no CVSS, info.magnolia:magnolia-core)
- [CVE-2021-23555](https://cve.now/CVE-2021-23555.md): Sandbox Bypass (CVSS 9.8, vm2)
- [CVE-2021-20001](https://cve.now/CVE-2021-20001.md): It was discovered, that debian-edu-config, a set of configuration files used for the Debian Edu blend, before 2.12.16 configured insecure pe (no CVSS, debian-edu-config)
- [CVE-2022-24968](https://cve.now/CVE-2022-24968.md): In Mellium mellium.im/xmpp through 0.21.0, an attacker capable of spoofing DNS TXT records can redirect a WebSocket connection request to a (no CVSS, mellium.im/xmpp)
- [CVE-2022-22766](https://cve.now/CVE-2022-22766.md): BD Pyxis Products - Hardcoded Credentials (CVSS 7.0, Becton Dickinson (BD) BD Pyxis Anesthesia Station ES ·… +20)
- [CVE-2020-26728](https://cve.now/CVE-2020-26728.md): A vulnerability was discovered in Tenda AC9 v3.0 V15.03.06.42\_multi and Tenda AC9 V1.0 V15.03.05.19(6318)\_CN which allows for remote code ex (no CVSS)
- [CVE-2021-34235](https://cve.now/CVE-2021-34235.md): Tokheim Profleet DiaLOG 11.005.02 is affected by SQL Injection. (no CVSS)
- [CVE-2021-39688](https://cve.now/CVE-2021-39688.md): In TBD of TBD, there is a possible out of bounds read due to TBD. (no CVSS, Android)
- [CVE-2021-39677](https://cve.now/CVE-2021-39677.md): In startVideoStream() there is a possibility of an OOB Read in the heap, when the camera buffer is ‘zero’ in size.Product: AndroidVersions: (no CVSS, Android)
- [CVE-2021-39687](https://cve.now/CVE-2021-39687.md): In HandleTransactionIoEvent of actuator\_driver.cc, there is a possible out of bounds read due to a heap buffer overflow. (no CVSS, Android)
- [CVE-2021-0524](https://cve.now/CVE-2021-0524.md): In isServiceDistractionOptimized of CarPackageManagerService.java, there is a possible disclosure of installed packages due to side channel (no CVSS, Android)
- [CVE-2022-0185](https://cve.now/CVE-2022-0185.md): A heap-based buffer overflow flaw was found in the way the legacy\_parse\_param function in the Filesystem Context functionality of the Linux (CVSS 8.4, KEV, kernel)
- [CVE-2021-39672](https://cve.now/CVE-2021-39672.md): In fastboot, there is a possible secure boot bypass due to a configuration error. (no CVSS, Android)
- [CVE-2021-39676](https://cve.now/CVE-2021-39676.md): In writeThrowable of AndroidFuture.java, there is a possible parcel serialization/deserialization mismatch due to improper input validation. (no CVSS, Android)
- [CVE-2021-39675](https://cve.now/CVE-2021-39675.md): In GKI\_getbuf of gki\_buffer.cc, there is a possible out of bounds write due to a heap buffer overflow. (no CVSS, Android)
- [CVE-2021-39674](https://cve.now/CVE-2021-39674.md): In btm\_sec\_connected and btm\_sec\_disconnected of btm\_sec.cc file , there is a possible use after free. (no CVSS, Android)
- [CVE-2021-39669](https://cve.now/CVE-2021-39669.md): In onCreate of InstallCaCertificateWarning.java, there is a possible way to mislead an user about CA installation circumstances due to a tap (no CVSS, Android)
- [CVE-2021-39671](https://cve.now/CVE-2021-39671.md): In code generated by aidl\_const\_expressions.cpp, there is a possible out of bounds read due to uninitialized data. (no CVSS, Android)
- [CVE-2021-39668](https://cve.now/CVE-2021-39668.md): In onActivityViewReady of DetailDialog.kt, there is a possible Intent Redirect due to a confused deputy. (no CVSS, Android)
- [CVE-2021-39666](https://cve.now/CVE-2021-39666.md): In extract of MediaMetricsItem.h, there is a possible out of bounds read due to improper input validation. (no CVSS, Android)
- [CVE-2021-39665](https://cve.now/CVE-2021-39665.md): In checkSpsUpdated of AAVCAssembler.cpp, there is a possible out of bounds read due to a heap buffer overflow. (no CVSS, Android)
- [CVE-2021-39663](https://cve.now/CVE-2021-39663.md): In openFileAndEnforcePathPermissionsHelper of MediaProvider.java, there is a possible bypass of a permissions check due to a confused deputy (no CVSS, Android)
- [CVE-2021-39664](https://cve.now/CVE-2021-39664.md): In LoadedPackage::Load of LoadedArsc.cpp, there is a possible out of bounds read due to a missing bounds check. (no CVSS, Android)
- [CVE-2021-39662](https://cve.now/CVE-2021-39662.md): In checkUriPermission of MediaProvider.java , there is a possible way to gain access to the content of media provider collections due to a m (no CVSS, Android)
- [CVE-2021-39658](https://cve.now/CVE-2021-39658.md): ismsEx service is a vendor service in unisoc equipment。ismsEx service is an extension of sms system service，but it does not check the permis (no CVSS, Android)
- [CVE-2021-39635](https://cve.now/CVE-2021-39635.md): ims\_ex is a vendor system service used to manage VoLTE in unisoc devices，But it does not verify the caller's permissions，so that normal apps (no CVSS, Android)
- [CVE-2021-39631](https://cve.now/CVE-2021-39631.md): In clear\_data\_dlg\_text of strings.xml, there is a possible situation when "Clear storage" functionality sets up the wrong security/privacy e (no CVSS, Android)
- [CVE-2021-39616](https://cve.now/CVE-2021-39616.md): Summary:Product: AndroidVersions: Android SoCAndroid ID: A-204686438 (no CVSS, Android)
- [CVE-2021-39619](https://cve.now/CVE-2021-39619.md): In updatePackageMappingsData of UsageStatsService.java, there is a possible way to bypass security and privacy settings of app usage due to (no CVSS, Android)
- [CVE-2022-0483](https://cve.now/CVE-2022-0483.md): Local privilege escalation due to insecure folder permissions (no CVSS, Acronis VSS Doctor)
- [CVE-2021-22824](https://cve.now/CVE-2021-22824.md): A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could result in denial of service, due to missing length che (no CVSS, Interactive Graphical SCADA System Data Collector (dc.exe))
- [CVE-2021-22800](https://cve.now/CVE-2021-22800.md): A CWE-20: Improper Input Validation vulnerability exists that could cause a Denial of Service when a crafted packet is sent to the controlle (no CVSS, Modicon M218 Logic Controller)
- [CVE-2021-22823](https://cve.now/CVE-2021-22823.md): A CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause deletion of arbitrary files in the context of (no CVSS, Interactive Graphical SCADA System Data Collector (dc.exe))
- [CVE-2021-22805](https://cve.now/CVE-2021-22805.md): A CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause deletion of arbitrary files in the context of (no CVSS, Interactive Graphical SCADA System Data Collector (dc.exe))
- [CVE-2021-22804](https://cve.now/CVE-2021-22804.md): A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists that could cause disclosure of arbitrary files be (no CVSS, Interactive Graphical SCADA System Data Collector (dc.exe))
- [CVE-2021-22802](https://cve.now/CVE-2021-22802.md): A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could result in remote code execution due to missing length (no CVSS, Interactive Graphical SCADA System Data Collector (dc.exe))
- [CVE-2021-22803](https://cve.now/CVE-2021-22803.md): A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists that could lead to remote code execution through a number of (no CVSS, Interactive Graphical SCADA System Data Collector (dc.exe))
- [CVE-2021-22801](https://cve.now/CVE-2021-22801.md): A CWE-269: Improper Privilege Management vulnerability exists that could cause an arbitrary command execution when the software is configure (no CVSS, ConneXium Network Manager Software)
- [CVE-2021-22806](https://cve.now/CVE-2021-22806.md): A CWE-669: Incorrect Resource Transfer Between Spheres vulnerability exists that could cause data exfiltration and unauthorized access when (no CVSS, spaceLYnk (V2.6.1 and prior), Wiser for KNX (V2.6.1 and pri…)
- [CVE-2021-22788](https://cve.now/CVE-2021-22788.md): A CWE-787: Out-of-bounds Write vulnerability exists that could cause denial of service when an attacker sends a specially crafted HTTP reque (CVSS 7.5, Modicon M340 CPUs: BMXP34 (Versions prior to V3.40), Modico…)
- [CVE-2021-22798](https://cve.now/CVE-2021-22798.md): A CWE-522: Insufficiently Protected Credentials vulnerability exists that could cause Sensitive data such as login credentials being exposed (no CVSS, Conext� ComBox)
- [CVE-2021-22787](https://cve.now/CVE-2021-22787.md): A CWE-20: Improper Input Validation vulnerability exists that could cause denial of service of the device when an attacker sends a specially (CVSS 7.5, Modicon M340 CPUs: BMXP34 (Versions prior to V3.40), Modico…)
- [CVE-2021-22785](https://cve.now/CVE-2021-22785.md): A CWE-200: Information Exposure vulnerability exists that could cause sensitive information of files located in the web root directory to le (CVSS 7.5, Modicon M340 CPUs: BMXP34 (Versions prior to V3.40), Modico…)
- [CVE-2021-22796](https://cve.now/CVE-2021-22796.md): A CWE-287: Improper Authentication vulnerability exists that could allow remote code execution when a malicious file is uploaded. (no CVSS, C-Bus Toolkit (V1.15.9 and prior), C-Gate Server)
- [CVE-2020-14523](https://cve.now/CVE-2020-14523.md): Mitsubishi Electric Factory Automation Products Path Traversal (CVSS 8.3, Mitsubishi Electric CW Configurator · Mitsubishi Electr… +10)
- [CVE-2021-22748](https://cve.now/CVE-2021-22748.md): A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could allow a remote code (no CVSS, C-Bus Toolkit (V1.15.9 and prior), C-Gate Server)
- [CVE-2020-14521](https://cve.now/CVE-2020-14521.md): Mitsubishi Electric Factory Automation Engineering Products Unquoted Search Path or Element (CVSS 8.3, Mitsubishi Electric C Controller Interface Module Utili… +43)
- [CVE-2022-23707](https://cve.now/CVE-2022-23707.md): An XSS vulnerability was found in Kibana index patterns. (no CVSS, Elastic Kibana)
- [CVE-2022-24926](https://cve.now/CVE-2022-24926.md): Improper input validation vulnerability in SmartTagPlugin prior to version 1.2.15-6 allows privileged attackers to trigger a XSS on a victim (CVSS 5.7, Samsung Mobile SmartTagPlugin)
- [CVE-2022-24927](https://cve.now/CVE-2022-24927.md): Improper privilege management vulnerability in Samsung Video Player prior to version 7.3.15.30 allows attackers to execute video files witho (CVSS 4.2, Samsung Mobile Samsung Video Player)
- [CVE-2022-24925](https://cve.now/CVE-2022-24925.md): Improper input validation vulnerability in SettingsProvider prior to Android S(12) allows privileged attackers to trigger a permanent denial (CVSS 4.4, Samsung Mobile Devices)
- [CVE-2022-24924](https://cve.now/CVE-2022-24924.md): An improper access control in LiveWallpaperService prior to versions 3.0.9.0 allows to create a specific named system directory without a pr (CVSS 2.2, Samsung Mobile LiveWallpaper)
- [CVE-2022-24003](https://cve.now/CVE-2022-24003.md): Exposure of Sensitive Information vulnerability in Bixby Vision prior to version 3.7.50.6 allows attackers to access internal data of Bixby (CVSS 4.0, Samsung Mobile Bixby Vision)
- [CVE-2022-24923](https://cve.now/CVE-2022-24923.md): Improper access control vulnerability in Samsung SearchWidget prior to versions 2.3.00.6 in China models allows untrusted applications to lo (CVSS 4.0, Samsung Mobile SearchWidget)
- [CVE-2022-24002](https://cve.now/CVE-2022-24002.md): Improper Authorization vulnerability in Link Sharing prior to version 12.4.00.3 allows attackers to open protected activity via Precondition (CVSS 4.0, Samsung Mobile Link sharing)
- [CVE-2022-24001](https://cve.now/CVE-2022-24001.md): Information disclosure vulnerability in Edge Panel prior to Android S(12) allows physical attackers to access screenshot in clipboard via Ed (CVSS 3.8, Samsung Mobile Devices)
- [CVE-2022-23999](https://cve.now/CVE-2022-23999.md): PendingIntent hijacking vulnerability in CpaReceiver prior to SMR Feb-2022 Release 1 allows local attackers to access media files without pe (CVSS 3.9, Samsung Mobile Devices)
- [CVE-2022-24000](https://cve.now/CVE-2022-24000.md): PendingIntent hijacking vulnerability in DataUsageReminderReceiver prior to SMR Feb-2022 Release 1 allows local attackers to access media fi (CVSS 3.9, Samsung Mobile Devices)
- [CVE-2022-23998](https://cve.now/CVE-2022-23998.md): Improper access control vulnerability in Camera prior to versions 11.1.02.16 in Android R(11), 10.5.03.77 in Android Q(10) and 9.0.6.68 in A (CVSS 6.2, Samsung Mobile Samsung Camera)
- [CVE-2022-23997](https://cve.now/CVE-2022-23997.md): Unprotected component vulnerability in StTheaterModeDurationAlarmReceiver in Wear OS 3.0 prior to Firmware update Feb-2022 Release allows un (CVSS 4.0, Samsung Mobile Samsung Wearable Devices)
- [CVE-2022-23996](https://cve.now/CVE-2022-23996.md): Unprotected component vulnerability in StTheaterModeReceiver in Wear OS 3.0 prior to Firmware update Feb-2022 Release allows untrusted appli (CVSS 4.0, Samsung Mobile Samsung Wearable Devices)
- [CVE-2022-23994](https://cve.now/CVE-2022-23994.md): An Improper access control vulnerability in StBedtimeModeReceiver in Wear OS 3.0 prior to Firmware update Feb-2022 Release allows untrusted (CVSS 3.3, Samsung Mobile Samsung Wearable Devices)
- [CVE-2022-23995](https://cve.now/CVE-2022-23995.md): Unprotected component vulnerability in StBedtimeModeAlarmReceiver in Wear OS 3.0 prior to Firmware update Feb-2022 Release allows untrusted (CVSS 4.0, Samsung Mobile Samsung Wearable Devices)
- [CVE-2022-23434](https://cve.now/CVE-2022-23434.md): A vulnerability using PendingIntent in Bixby Vision prior to versions 3.7.60.8 in Android S(12), 3.7.50.6 in Andorid R(11) and below allows (CVSS 4.4, Samsung Mobile Bixby Vision)
- [CVE-2022-23433](https://cve.now/CVE-2022-23433.md): Improper access control vulnerability in Reminder prior to versions 12.3.01.3000 in Android S(12), 12.2.05.6000 in Android R(11) and 11.6.08 (CVSS 4.3, Samsung Mobile Reminder)
- [CVE-2022-23431](https://cve.now/CVE-2022-23431.md): An improper boundary check in RPMB ldfw prior to SMR Feb-2022 Release 1 allows arbitrary memory write and code execution. (CVSS 6.4, Samsung Mobile Devices with Exynos chipsets)
- [CVE-2022-23432](https://cve.now/CVE-2022-23432.md): An improper input validation in SMC\_SRPMB\_WSM handler of RPMB ldfw prior to SMR Feb-2022 Release 1 allows arbitrary memory write and code ex (CVSS 6.4, Samsung Mobile Devices with Exynos chipsets)
- [CVE-2022-23429](https://cve.now/CVE-2022-23429.md): An improper boundary check in audio hal service prior to SMR Feb-2022 Release 1 allows attackers to read invalid memory and it leads to appl (CVSS 5.3, Samsung Mobile Devices)
- [CVE-2022-23428](https://cve.now/CVE-2022-23428.md): An improper boundary check in eden\_runtime hal service prior to SMR Feb-2022 Release 1 allows arbitrary memory write and code execution. (CVSS 8.4, Samsung Mobile Devices with Exynos chipsets)
- [CVE-2022-23427](https://cve.now/CVE-2022-23427.md): PendingIntent hijacking vulnerability in KnoxPrivacyNoticeReceiver prior to SMR Feb-2022 Release 1 allows local attackers to access media fi (CVSS 3.9, Samsung Mobile Devices)
- [CVE-2022-23425](https://cve.now/CVE-2022-23425.md): Improper input validation in Exynos baseband prior to SMR Feb-2022 Release 1 allows attackers to send arbitrary NAS signaling messages with (CVSS 8.6, Samsung Mobile Devices)
- [CVE-2022-23426](https://cve.now/CVE-2022-23426.md): A vulnerability using PendingIntent in DeX Home and DeX for PC prior to SMR Feb-2022 Release 1 allows attackers to access files with system (CVSS 4.4, Samsung Mobile Devices)
- [CVE-2022-22292](https://cve.now/CVE-2022-22292.md): Unprotected dynamic receiver in Telecom prior to SMR Feb-2022 Release 1 allows untrusted applications to launch arbitrary activity. (CVSS 7.1, Samsung Mobile Devices)
- [CVE-2022-22291](https://cve.now/CVE-2022-22291.md): Logging of excessive data vulnerability in telephony prior to SMR Feb-2022 Release 1 allows privileged attackers to get Cell Location Inform (CVSS 5.5, Samsung Mobile Devices)
- [CVE-2021-4046](https://cve.now/CVE-2021-4046.md): TCMAN GIM Cross-Site Scripting (XSS) (CVSS 5.4, TCMAN GIM)
- [CVE-2021-4035](https://cve.now/CVE-2021-4035.md): Wocu Monitoring stored Cross-Site Scripting (XSS) (CVSS 3.5, A3Sec Wocu Monitoring)
- [CVE-2021-31932](https://cve.now/CVE-2021-31932.md): Nokia BTS TRS web console FTM\_W20\_FP2\_2019.08.16\_0010 allows Authentication Bypass. (no CVSS)
- [CVE-2021-44111](https://cve.now/CVE-2021-44111.md): A Directory Traversal vulnerability exists in S-Cart 6.7 via download in sc-admin/backup. (no CVSS, s-cart/s-cart)
- [CVE-2021-23597](https://cve.now/CVE-2021-23597.md): Denial of Service (DoS) (CVSS 7.5, fastify-multipart)
- [CVE-2020-13677](https://cve.now/CVE-2020-13677.md): Under some circumstances, the Drupal core JSON:API module does not properly restrict access to certain content, which may result in unintend (no CVSS, Drupal Core · drupal/core)
- [CVE-2021-42940](https://cve.now/CVE-2021-42940.md): A Cross Site Scripting (XSS) vulnerability exists in Projeqtor 9.3.1 via /projeqtor/tool/saveAttachment.php, which allows an attacker to upl (no CVSS)
- [CVE-2020-13676](https://cve.now/CVE-2020-13676.md): The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclosure of field data. (no CVSS, Drupal Core · drupal/core)
- [CVE-2020-13670](https://cve.now/CVE-2020-13670.md): Information Disclosure vulnerability in file module of Drupal Core allows an attacker to gain access to the file metadata of a permanent pri (no CVSS, Drupal Core · drupal/core +1)
- [CVE-2020-13674](https://cve.now/CVE-2020-13674.md): The QuickEdit module does not properly validate access to routes, which could allow cross-site request forgery under some circumstances and (no CVSS, Drupal Core · drupal/core)
- [CVE-2020-13675](https://cve.now/CVE-2020-13675.md): Drupal's JSON:API and REST/File modules allow file uploads through their HTTP APIs. (no CVSS, Drupal Core · drupal/graphql +1)
- [CVE-2020-13673](https://cve.now/CVE-2020-13673.md): The Entity Embed module provides a filter to allow embedding entities in content fields. (no CVSS, Drupal Entity Embed · drupal/core +1)
- [CVE-2020-13672](https://cve.now/CVE-2020-13672.md): Cross-site Scripting (XSS) vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain circu (no CVSS, Drupal Core · drupal/core +1)
- [CVE-2020-13669](https://cve.now/CVE-2020-13669.md): Cross-site Scripting (XSS) vulnerability in ckeditor of Drupal Core allows attacker to inject XSS. (no CVSS, Drupal Core · drupal/core +1)
- [CVE-2021-45385](https://cve.now/CVE-2021-45385.md): A Null Pointer Dereference vulnerability exits in ffjpeg d5cfd49 (2021-12-06) in bmp\_load(). (no CVSS)
- [CVE-2020-13668](https://cve.now/CVE-2020-13668.md): Access bypass in Drupal Core 8/9 (no CVSS, Drupal Core · drupal/core +1)
- [CVE-2020-36062](https://cve.now/CVE-2020-36062.md): Dairy Farm Shop Management System v1.0 was discovered to contain hardcoded credentials in the source code which allows attackers access to t (no CVSS)
- [CVE-2021-45402](https://cve.now/CVE-2021-45402.md): The check\_alu\_op() function in kernel/bpf/verifier.c in the Linux kernel through v5.16-rc5 did not properly update bounds while handling the (no CVSS)
- [CVE-2021-38679](https://cve.now/CVE-2021-38679.md): Improper Authentication in Kazoo Server (CVSS 6.5, QNAP Systems Kazoo Server)
- [CVE-2022-0560](https://cve.now/CVE-2022-0560.md): Open Redirect in microweber/microweber (CVSS 4.3, microweber/microweber)
- [CVE-2021-46355](https://cve.now/CVE-2021-46355.md): OCS Inventory 2.9.1 is affected by Cross Site Scripting (XSS). (no CVSS)
- [CVE-2022-24289](https://cve.now/CVE-2022-24289.md): Deserialization of untrusted data in the Hessian Component of Apache Cayenne 4.1 with older Java versions (no CVSS, Apache Software Foundation Apache Cayenne · org.apache.caye…)
- [CVE-2022-24112](https://cve.now/CVE-2022-24112.md): apisix/batch-requests plugin allows overwriting the X-REAL-IP header (CVSS 9.8, KEV, Apache Software Foundation Apache APISIX)
- [CVE-2021-44521](https://cve.now/CVE-2021-44521.md): Remote code execution for scripted UDFs (no CVSS, Apache Software Foundation Apache Cassandra · org.apache.ca…)
- [CVE-2021-35077](https://cve.now/CVE-2021-35077.md): Possible use after free scenario in compute offloads to DSP while multiple calls spawn a dynamic process in Snapdragon Auto, Snapdragon Comp (CVSS 8.4, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-35075](https://cve.now/CVE-2021-35075.md): Possible null pointer dereference due to lack of WDOG structure validation during registration in Snapdragon Auto, Snapdragon Connectivity, (CVSS 8.4, Qualcomm Snapdragon Auto, Snapdragon Connectivity, Snapdrag…)
- [CVE-2021-35074](https://cve.now/CVE-2021-35074.md): Possible integer overflow due to improper fragment datatype while calculating number of fragments in a request message in Snapdragon Auto, S (CVSS 8.4, Qualcomm Snapdragon Auto, Snapdragon Connectivity, Snapdrag…)
- [CVE-2021-35069](https://cve.now/CVE-2021-35069.md): Improper validation of data length received from DMA buffer can lead to memory corruption. (CVSS 7.8, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-35068](https://cve.now/CVE-2021-35068.md): Lack of null check while freeing the device information buffer in the Bluetooth HFP protocol can lead to a NULL pointer dereference in Snapd (CVSS 8.4, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-30326](https://cve.now/CVE-2021-30326.md): Possible assertion due to improper size validation while processing the DownlinkPreemption IE in an RRC Reconfiguration/RRC Setup message in (CVSS 7.5, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-30325](https://cve.now/CVE-2021-30325.md): Possible out of bound access of DCI resources due to lack of validation process and resource allocation in Snapdragon Auto, Snapdragon Compu (CVSS 6.7, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-30324](https://cve.now/CVE-2021-30324.md): Possible out of bound write due to lack of boundary check for the maximum size of buffer when sending a DCI packet to remote process in Snap (CVSS 6.7, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-30323](https://cve.now/CVE-2021-30323.md): Improper validation of maximum size of data write to EFS file can lead to memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdrag (CVSS 7.8, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-30322](https://cve.now/CVE-2021-30322.md): Possible out of bounds write due to improper validation of number of GPIOs configured in an internal parameters array in Snapdragon Auto, Sn (CVSS 7.8, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-30318](https://cve.now/CVE-2021-30318.md): Improper validation of input when provisioning the HDCP key can lead to memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon (CVSS 8.4, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-30317](https://cve.now/CVE-2021-30317.md): Improper validation of program headers containing ELF metadata can lead to image verification bypass in Snapdragon Auto, Snapdragon Compute, (CVSS 9.3, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-30309](https://cve.now/CVE-2021-30309.md): Improper size validation of QXDM commands can lead to memory corruption in Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industria (CVSS 7.8, Qualcomm Snapdragon Compute, Snapdragon Consumer IOT, Snapd…)
- [CVE-2022-0557](https://cve.now/CVE-2022-0557.md): OS Command Injection in microweber/microweber (CVSS 8.1, microweber/microweber)
- [CVE-2022-24961](https://cve.now/CVE-2022-24961.md): In Portainer Agent before 2.11.1, an API server can continue running even if not associated with a Portainer instance in the past few days. (no CVSS)
- [CVE-2022-24958](https://cve.now/CVE-2022-24958.md): drivers/usb/gadget/legacy/inode.c in the Linux kernel through 5.16.8 mishandles dev-\>buf release. (no CVSS)
- [CVE-2022-24959](https://cve.now/CVE-2022-24959.md): An issue was discovered in the Linux kernel before 5.16.5. (no CVSS)
- [CVE-2022-24954](https://cve.now/CVE-2022-24954.md): Foxit PDF Reader before 11.2.1 and Foxit PDF Editor before 11.2.1 have a Stack-Based Buffer Overflow related to XFA, for the 'subform colSpa (no CVSS)
- [CVE-2022-24955](https://cve.now/CVE-2022-24955.md): Foxit PDF Reader before 11.2.1 and Foxit PDF Editor before 11.2.1 have an Uncontrolled Search Path Element for DLL files. (no CVSS)
- [CVE-2022-23773](https://cve.now/CVE-2022-23773.md): cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. (no CVSS, toolchain)
- [CVE-2022-23772](https://cve.now/CVE-2022-23772.md): Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7 has an overflow that can lead to Uncontrolled Memory Consumption. (no CVSS, stdlib)
- [CVE-2021-45386](https://cve.now/CVE-2021-45386.md): tcpreplay 4.3.4 has a Reachable Assertion in add\_tree\_ipv6() at tree.c (no CVSS)
- [CVE-2021-45387](https://cve.now/CVE-2021-45387.md): tcpreplay 4.3.4 has a Reachable Assertion in add\_tree\_ipv4() at tree.c. (no CVSS)
- [CVE-2022-0108](https://cve.now/CVE-2022-0108.md): Inappropriate implementation in Navigation in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to leak cross-origin data via a (no CVSS, Google Chrome)
- [CVE-2022-0382](https://cve.now/CVE-2022-0382.md): An information leak flaw was found due to uninitialized memory in the Linux kernel's TIPC protocol subsystem, in the way a user sends a TIPC (no CVSS, kernel)
- [CVE-2022-0561](https://cve.now/CVE-2022-0561.md): Null source pointer passed as an argument to memcpy() function within TIFFFetchStripThing() in tif\_dirread.c in libtiff versions from 3.9.0 (CVSS 5.5, libtiff)
- [CVE-2022-0562](https://cve.now/CVE-2022-0562.md): Null source pointer passed as an argument to memcpy() function within TIFFReadDirectory() in tif\_dirread.c in libtiff versions from 4.0 to 4 (CVSS 5.5, libtiff)
- [CVE-2022-23633](https://cve.now/CVE-2022-23633.md): Exposure of sensitive information in Action Pack (CVSS 7.4, rails · actionpack)
- [CVE-2022-23806](https://cve.now/CVE-2022-23806.md): Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x before 1.17.7 can incorrectly return true in situations with a big.Int va (no CVSS, stdlib)
- [CVE-2022-23853](https://cve.now/CVE-2022-23853.md): The LSP (Language Server Protocol) plugin in KDE Kate before 21.12.2 and KTextEditor before 5.91.0 tries to execute the associated LSP serve (no CVSS)
- [CVE-2022-24975](https://cve.now/CVE-2022-24975.md): The --mirror documentation for Git through 2.35.1 does not mention the availability of deleted content, aka the "GitBleed" issue. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-02-11
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.