CVEs published February 14, 2022
69 CVEs were published on February 14, 2022: 1 critical, 2 high.
- Published
- 69
- Critical
- 1
- High
- 2
- Medium
- 10
- Low
- 0
- Unrated
- 56
- Now in CISA KEV
- 0
- Fix available
- 32
Most affected products
- Wireshark Foundation Wireshark
- 4
- Futurio Extra
- 2
- IBM Cognos Analytics Mobile
- 2
- Remove Footer Credit
- 2
- Ad Invalid Click Protector
- 1
- Axis Communications AB AXIS IP Utility
- 1
- CMP
- 1
- Complianz – GDPR/CCPA Cookie Consent
- 1
- darylldoyle svg-sanitizer · enshrined/svg-sanitize
- 1
- ForgeRock Access Management
- 1
Critical 1
High 2
Medium, low and unrated 66
- CVE-2022-21818NVIDIA License System contains a vulnerability in the installation scripts for the DLS virtual appliance, where a user on a network after siNVIDIA License System
- CVE-2021-46463njs through 0.7.1, used in NGINX, was discovered to contain a control flow hijack caused by a Type Confusion vulnerability in njs_promise_pe
- CVE-2022-25139njs through 0.7.0, used in NGINX, was discovered to contain a heap use-after-free in njs_await_fulfilled.
- CVE-2021-46462njs through 0.7.1, used in NGINX, was discovered to contain a segmentation violation via njs_object_set_prototype in /src/njs_object.c.
- CVE-2021-46461njs through 0.7.0, used in NGINX, was discovered to contain an out-of-bounds array access via njs_vmcode_typeof in /src/njs_vmcode.c.
- CVE-2021-45005Artifex MuJS v1.1.3 was discovered to contain a heap buffer overflow which is caused by conflicting JumpList of nested try/finally statement
- CVE-2022-23638Cross-site Scripting in svg-sanitizerdarylldoyle svg-sanitizer · enshrined/svg-sanitize
- CVE-2022-23992XCOM Data Transport for Windows, Linux, and UNIX 11.6 releases contain a vulnerability due to insufficient input validation that could potenXCOM Data Transport for Windows, Linux, and UNIX
- CVE-2022-24705Buffer Overflow via Crafted Ipv6 Prefix Attribute Type Client Request in accel-ppp v1.12https://accel-ppp.org/ accel-ppp
- CVE-2022-24704Buffer Overflow via Crafted IPv6 Addr Attribute Type Client Request in Accel-PPP v1.12https://accel-ppp.org/ Accel-PPP
- CVE-2022-23410AXIS IP Utility before 4.18.0 allows for remote code execution and local privilege escalation by the means of DLL hijacking.Axis Communications AB AXIS IP Utility
- CVE-2022-23391A cross-site scripting (XSS) vulnerability in Pybbs v6.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload ins
- CVE-2022-23390An issue in the getType function of BBS Forum v5.3 and below allows attackers to upload arbitrary files.
- CVE-2022-23389PublicCMS v4.0 was discovered to contain a remote code execution (RCE) vulnerability via the cmdarray parameter.
- CVE-2022-23637Stored Cross-Site-Scripting (XSS) in Markdown Editork-box
- CVE-2022-24206Tongda2000 v11.10 was discovered to contain a SQL injection vulnerability in /mobile_seal/get_seal.php via the DEVICE_LIST parameter.
- CVE-2022-23902Tongda2000 v11.10 was discovered to contain a SQL injection vulnerability in export_data.php via the d_name parameter.
- CVE-2022-23337DedeCMS v5.7.87 was discovered to contain a SQL injection vulnerability in article_coonepage_rule.php via the ids parameter.
- CVE-2022-23336S-CMS v5.0 was discovered to contain a SQL injection vulnerability in member_pay.php via the O_id parameter.
- CVE-2022-23335Metinfo v7.5.0 was discovered to contain a SQL injection vulnerability in language_general.class.php via doModifyParameter.
- CVE-2022-22295Metinfo v7.5.0 was discovered to contain a SQL injection vulnerability in parameter_admin.class.php via the table_para parameter.
- CVE-2021-45310Sangoma Technologies Corporation Switchvox Version 102409 is affected by an information disclosure vulnerability due to an improper access r
- CVE-2019-25057In Corda before 4.1, the meaning of serialized data can be modified via an attacker-controlled CustomSerializer.
- CVE-2019-16864CompleteFTPService.exe in the server in EnterpriseDT CompleteFTP before 12.1.4 allows Remote Code Execution by leveraging a Windows user acc
- CVE-2021-43106A Header Injection vulnerability exists in Compass Plus TranzWare Online FIMI Web Interface Tranzware Online (TWO) 5.3.33.3 F38 and FIMI 4.2
- CVE-2021-45348An Arbitrary File Deletion vulnerability exists in SourceCodester Attendance Management System v1.0 via the csv parameter in admin/pageUploa
- CVE-2022-24988In galois_2p8 before 0.1.2, PrimitivePolynomialField::new has an off-by-one buffer overflow for a vector.galois_2p8
- CVE-2022-0579Missing Authorization in snipe/snipe-itsnipe/snipe-it
- CVE-2022-25150In Malwarebytes Binisoft Windows Firewall Control before 6.8.1.0, programs executed from the Tools tab can be used to escalate privileges.
- CVE-2021-45347An Incorrect Access Control vulnerability exists in zzcms 8.2, which lets a malicious user bypass authentication by changing the user name i
- CVE-2022-23367Fulusso v1.1 was discovered to contain a DOM-based cross-site scripting (XSS) vulnerability in /BindAccount/SuccessTips.js.
- CVE-2021-39080Due to weak obfuscation, IBM Cognos Analytics Mobile for Android application prior to version 1.1.14 , an attacker could be able to reverse IBM Cognos Analytics Mobile
- CVE-2021-39079IBM Cognos Analytics Mobile for Android applications prior to version 1.1.14 is vulnerable to cross-site scripting.IBM Cognos Analytics Mobile
- CVE-2022-22854An access control issue in hprms/admin/?page=user/list of Hospital Patient Record Management System v1.0 allows attackers to escalate privil
- CVE-2021-45392A Buffer Overflow vulnerability exists in Tenda Router AX12 V22.03.01.21_CN in the sub_422CE4 function in page /goform/setIPv6Status via the
- CVE-2021-46371antd-admin 5.5.0 is affected by an incorrect access control vulnerability.
- CVE-2022-24686HashiCorp Nomad and Nomad Enterprise 0.3.0 through 1.0.17, 1.1.11, and 1.2.5 artifact download functionality has a race condition such that github.com/hashicorp/nomad
- CVE-2021-45420Emerson Dixell XWEB-500 products are affected by arbitrary file write vulnerability in /cgi-bin/logo_extra_upload.cgi, /cgi-bin/cal_save.cgi
- CVE-2021-45421Emerson Dixell XWEB-500 products are affected by information disclosure via directory listing.
- CVE-2022-0214Popup | Custom Popup Builder < 1.3.1 - Unauthenticated Denial of ServicePopup | Custom Popup Builder
- CVE-2022-0212SpiderCalendar <= 1.5.65 - Reflected Cross-Site ScriptingSpiderCalendar
- CVE-2022-0208MapPress Maps for WordPress < 2.73.4 - Reflected Cross-Site scriptingMapPress Maps for WordPress
- CVE-2022-0206NewStatPress < 1.3.6 - Reflected Cross-Site ScriptingNewStatPress
- CVE-2022-0201Permalink Manager < 2.2.15 - Reflected Cross-Site ScriptingMaciej Bis Permalink Manager Lite · Maciej Bis Permalink Ma…
- CVE-2022-0200Themify Portfolio Post < 1.1.7 - Reflected Cross-Site ScriptingThemify Portfolio Post
- CVE-2022-0193Complianz - GDPR/CCPA Cookie Consent < 6.0.0 - Reflected Cross-Site ScriptingComplianz – GDPR/CCPA Cookie Consent
- CVE-2022-0190Ad Invalid Click Protector (AICP) < 1.2.6 - Authenticated SQL InjectionAd Invalid Click Protector
- CVE-2022-0188Coming Soon & Maintenance Plugin by NiteoThemes < 4.0.19 - Unauthenticated Arbitrary CSS UpdateCMP
- CVE-2022-0176PowerPack Lite for Beaver Builder < 1.2.9.3 - Reflected Cross-Site ScriptingPowerPack Lite for Beaver Builder
- CVE-2021-25115WP Photo Album Plus < 8.0.10 - Stored Cross-Site Scripting (XSS)WP Photo Album Plus
- CVE-2021-25110Futurio Extra < 1.6.3 - Subscriber+ User Email Address DisclosureFuturio Extra
- CVE-2021-25109Futurio Extra < 1.6.3 - Authenticated SQL InjectionFuturio Extra
- CVE-2021-25107Form Store to DB < 1.1.1 - Unauthenticated Stored Cross-Site ScriptingForm Store to DB
- CVE-2021-25050Remove Footer Credit < 1.0.11 - Admin+ Stored Cross-Site ScriptingRemove Footer Credit
- CVE-2021-25033Noptin < 1.6.5 - Open RedirectWordPress Newsletter Plugin – Noptin
- CVE-2021-25018PPOM for WooCommerce < 24.0 - Subscriber+ Settings Update to Stored XSSPPOM for WooCommerce
- CVE-2021-25014Ibtana < 1.1.4.9 - Subscriber+ Settings Update to Stored XSSIbtana – WordPress Website Builder
- CVE-2021-24904Mortgage Calculators WP < 1.56 - Admin+ Stored Cross-Site ScriptingMortgage Calculators WP
- CVE-2021-24874Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue < 3.1.31 - Reflected Cross-Site ScriptingNewsletter, SMTP, Email marketing and Subscribe forms by Se…
- CVE-2021-24446Remove Footer Credit < 1.0.6 - CSRF to Stored Cross-Site ScriptingRemove Footer Credit
- CVE-2022-24110Kiteworks MFT 7.5 may allow an unauthorized user to reset other users' passwords.
- CVE-2021-45346A Memory Leak vulnerability exists in SQLite Project SQLite3 3.35.1 and 3.37.0 via maliciously crafted SQL Queries (made via editing the Dat
- CVE-2022-0581Crash in the CMS protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of service via packet injection or craftedWireshark Foundation Wireshark
- CVE-2022-0582Unaligned access in the CSN.1 protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of service via packet injectiWireshark Foundation Wireshark
- CVE-2022-0583Crash in the PVFS protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of service via packet injection or crafteWireshark Foundation Wireshark
- CVE-2022-0586Infinite loop in RTMPT protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of service via packet injection or cWireshark Foundation Wireshark