# CVEs published 2022-02-14

69 CVEs were published on February 14, 2022: 1 critical, 2 high. Days are UTC.

- [CVE-2022-21818](https://cve.now/CVE-2022-21818.md): NVIDIA License System contains a vulnerability in the installation scripts for the DLS virtual appliance, where a user on a network after si (CVSS 5.4, NVIDIA License System)
- [CVE-2022-0580](https://cve.now/CVE-2022-0580.md): Incorrect Authorization in librenms/librenms (CVSS 7.1, librenms/librenms)
- [CVE-2021-46463](https://cve.now/CVE-2021-46463.md): njs through 0.7.1, used in NGINX, was discovered to contain a control flow hijack caused by a Type Confusion vulnerability in njs\_promise\_pe (no CVSS)
- [CVE-2022-25139](https://cve.now/CVE-2022-25139.md): njs through 0.7.0, used in NGINX, was discovered to contain a heap use-after-free in njs\_await\_fulfilled. (no CVSS)
- [CVE-2021-46462](https://cve.now/CVE-2021-46462.md): njs through 0.7.1, used in NGINX, was discovered to contain a segmentation violation via njs\_object\_set\_prototype in /src/njs\_object.c. (no CVSS)
- [CVE-2021-46461](https://cve.now/CVE-2021-46461.md): njs through 0.7.0, used in NGINX, was discovered to contain an out-of-bounds array access via njs\_vmcode\_typeof in /src/njs\_vmcode.c. (no CVSS)
- [CVE-2021-45005](https://cve.now/CVE-2021-45005.md): Artifex MuJS v1.1.3 was discovered to contain a heap buffer overflow which is caused by conflicting JumpList of nested try/finally statement (no CVSS)
- [CVE-2022-23638](https://cve.now/CVE-2022-23638.md): Cross-site Scripting in svg-sanitizer (CVSS 6.2, darylldoyle svg-sanitizer · enshrined/svg-sanitize)
- [CVE-2022-23992](https://cve.now/CVE-2022-23992.md): XCOM Data Transport for Windows, Linux, and UNIX 11.6 releases contain a vulnerability due to insufficient input validation that could poten (no CVSS, XCOM Data Transport for Windows, Linux, and UNIX)
- [CVE-2022-24705](https://cve.now/CVE-2022-24705.md): Buffer Overflow via Crafted Ipv6 Prefix Attribute Type Client Request in accel-ppp v1.12 (no CVSS, https://accel-ppp.org/ accel-ppp)
- [CVE-2022-24704](https://cve.now/CVE-2022-24704.md): Buffer Overflow via Crafted IPv6 Addr Attribute Type Client Request in Accel-PPP v1.12 (no CVSS, https://accel-ppp.org/ Accel-PPP)
- [CVE-2021-4201](https://cve.now/CVE-2021-4201.md): Pre-authentication session hijacking (CVSS 9.6, ForgeRock Access Management)
- [CVE-2022-23410](https://cve.now/CVE-2022-23410.md): AXIS IP Utility before 4.18.0 allows for remote code execution and local privilege escalation by the means of DLL hijacking. (no CVSS, Axis Communications AB AXIS IP Utility)
- [CVE-2022-23391](https://cve.now/CVE-2022-23391.md): A cross-site scripting (XSS) vulnerability in Pybbs v6.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload ins (no CVSS)
- [CVE-2022-23390](https://cve.now/CVE-2022-23390.md): An issue in the getType function of BBS Forum v5.3 and below allows attackers to upload arbitrary files. (no CVSS)
- [CVE-2022-23389](https://cve.now/CVE-2022-23389.md): PublicCMS v4.0 was discovered to contain a remote code execution (RCE) vulnerability via the cmdarray parameter. (no CVSS)
- [CVE-2022-23637](https://cve.now/CVE-2022-23637.md): Stored Cross-Site-Scripting (XSS) in Markdown Editor (CVSS 6.1, k-box)
- [CVE-2022-24206](https://cve.now/CVE-2022-24206.md): Tongda2000 v11.10 was discovered to contain a SQL injection vulnerability in /mobile\_seal/get\_seal.php via the DEVICE\_LIST parameter. (no CVSS)
- [CVE-2022-23902](https://cve.now/CVE-2022-23902.md): Tongda2000 v11.10 was discovered to contain a SQL injection vulnerability in export\_data.php via the d\_name parameter. (no CVSS)
- [CVE-2022-23337](https://cve.now/CVE-2022-23337.md): DedeCMS v5.7.87 was discovered to contain a SQL injection vulnerability in article\_coonepage\_rule.php via the ids parameter. (no CVSS)
- [CVE-2022-23336](https://cve.now/CVE-2022-23336.md): S-CMS v5.0 was discovered to contain a SQL injection vulnerability in member\_pay.php via the O\_id parameter. (no CVSS)
- [CVE-2022-23335](https://cve.now/CVE-2022-23335.md): Metinfo v7.5.0 was discovered to contain a SQL injection vulnerability in language\_general.class.php via doModifyParameter. (no CVSS)
- [CVE-2022-22295](https://cve.now/CVE-2022-22295.md): Metinfo v7.5.0 was discovered to contain a SQL injection vulnerability in parameter\_admin.class.php via the table\_para parameter. (no CVSS)
- [CVE-2021-45310](https://cve.now/CVE-2021-45310.md): Sangoma Technologies Corporation Switchvox Version 102409 is affected by an information disclosure vulnerability due to an improper access r (no CVSS)
- [CVE-2019-25057](https://cve.now/CVE-2019-25057.md): In Corda before 4.1, the meaning of serialized data can be modified via an attacker-controlled CustomSerializer. (no CVSS)
- [CVE-2019-16864](https://cve.now/CVE-2019-16864.md): CompleteFTPService.exe in the server in EnterpriseDT CompleteFTP before 12.1.4 allows Remote Code Execution by leveraging a Windows user acc (no CVSS)
- [CVE-2021-43106](https://cve.now/CVE-2021-43106.md): A Header Injection vulnerability exists in Compass Plus TranzWare Online FIMI Web Interface Tranzware Online (TWO) 5.3.33.3 F38 and FIMI 4.2 (no CVSS)
- [CVE-2021-45348](https://cve.now/CVE-2021-45348.md): An Arbitrary File Deletion vulnerability exists in SourceCodester Attendance Management System v1.0 via the csv parameter in admin/pageUploa (no CVSS)
- [CVE-2022-24988](https://cve.now/CVE-2022-24988.md): In galois\_2p8 before 0.1.2, PrimitivePolynomialField::new has an off-by-one buffer overflow for a vector. (no CVSS, galois\_2p8)
- [CVE-2022-0579](https://cve.now/CVE-2022-0579.md): Missing Authorization in snipe/snipe-it (CVSS 6.5, snipe/snipe-it)
- [CVE-2022-25150](https://cve.now/CVE-2022-25150.md): In Malwarebytes Binisoft Windows Firewall Control before 6.8.1.0, programs executed from the Tools tab can be used to escalate privileges. (no CVSS)
- [CVE-2021-45347](https://cve.now/CVE-2021-45347.md): An Incorrect Access Control vulnerability exists in zzcms 8.2, which lets a malicious user bypass authentication by changing the user name i (no CVSS)
- [CVE-2022-23367](https://cve.now/CVE-2022-23367.md): Fulusso v1.1 was discovered to contain a DOM-based cross-site scripting (XSS) vulnerability in /BindAccount/SuccessTips.js. (no CVSS)
- [CVE-2021-39080](https://cve.now/CVE-2021-39080.md): Due to weak obfuscation, IBM Cognos Analytics Mobile for Android application prior to version 1.1.14 , an attacker could be able to reverse (CVSS 4.8, IBM Cognos Analytics Mobile)
- [CVE-2021-39079](https://cve.now/CVE-2021-39079.md): IBM Cognos Analytics Mobile for Android applications prior to version 1.1.14 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Cognos Analytics Mobile)
- [CVE-2022-22854](https://cve.now/CVE-2022-22854.md): An access control issue in hprms/admin/?page=user/list of Hospital Patient Record Management System v1.0 allows attackers to escalate privil (no CVSS)
- [CVE-2021-45392](https://cve.now/CVE-2021-45392.md): A Buffer Overflow vulnerability exists in Tenda Router AX12 V22.03.01.21\_CN in the sub\_422CE4 function in page /goform/setIPv6Status via the (no CVSS)
- [CVE-2021-46371](https://cve.now/CVE-2021-46371.md): antd-admin 5.5.0 is affected by an incorrect access control vulnerability. (no CVSS)
- [CVE-2022-24686](https://cve.now/CVE-2022-24686.md): HashiCorp Nomad and Nomad Enterprise 0.3.0 through 1.0.17, 1.1.11, and 1.2.5 artifact download functionality has a race condition such that (no CVSS, github.com/hashicorp/nomad)
- [CVE-2021-45420](https://cve.now/CVE-2021-45420.md): Emerson Dixell XWEB-500 products are affected by arbitrary file write vulnerability in /cgi-bin/logo\_extra\_upload.cgi, /cgi-bin/cal\_save.cgi (no CVSS)
- [CVE-2021-45421](https://cve.now/CVE-2021-45421.md): Emerson Dixell XWEB-500 products are affected by information disclosure via directory listing. (no CVSS)
- [CVE-2022-0214](https://cve.now/CVE-2022-0214.md): Popup | Custom Popup Builder \< 1.3.1 - Unauthenticated Denial of Service (no CVSS, Popup | Custom Popup Builder)
- [CVE-2022-0212](https://cve.now/CVE-2022-0212.md): SpiderCalendar \<= 1.5.65 - Reflected Cross-Site Scripting (no CVSS, SpiderCalendar)
- [CVE-2022-0208](https://cve.now/CVE-2022-0208.md): MapPress Maps for WordPress \< 2.73.4 - Reflected Cross-Site scripting (no CVSS, MapPress Maps for WordPress)
- [CVE-2022-0206](https://cve.now/CVE-2022-0206.md): NewStatPress \< 1.3.6 - Reflected Cross-Site Scripting (no CVSS, NewStatPress)
- [CVE-2022-0201](https://cve.now/CVE-2022-0201.md): Permalink Manager \< 2.2.15 - Reflected Cross-Site Scripting (no CVSS, Maciej Bis Permalink Manager Lite · Maciej Bis Permalink Ma…)
- [CVE-2022-0200](https://cve.now/CVE-2022-0200.md): Themify Portfolio Post \< 1.1.7 - Reflected Cross-Site Scripting (no CVSS, Themify Portfolio Post)
- [CVE-2022-0193](https://cve.now/CVE-2022-0193.md): Complianz - GDPR/CCPA Cookie Consent \< 6.0.0 - Reflected Cross-Site Scripting (no CVSS, Complianz – GDPR/CCPA Cookie Consent)
- [CVE-2022-0190](https://cve.now/CVE-2022-0190.md): Ad Invalid Click Protector (AICP) \< 1.2.6 - Authenticated SQL Injection (no CVSS, Ad Invalid Click Protector)
- [CVE-2022-0188](https://cve.now/CVE-2022-0188.md): Coming Soon & Maintenance Plugin by NiteoThemes \< 4.0.19 - Unauthenticated Arbitrary CSS Update (no CVSS, CMP)
- [CVE-2022-0176](https://cve.now/CVE-2022-0176.md): PowerPack Lite for Beaver Builder \< 1.2.9.3 - Reflected Cross-Site Scripting (no CVSS, PowerPack Lite for Beaver Builder)
- [CVE-2021-25115](https://cve.now/CVE-2021-25115.md): WP Photo Album Plus \< 8.0.10 - Stored Cross-Site Scripting (XSS) (no CVSS, WP Photo Album Plus)
- [CVE-2021-25110](https://cve.now/CVE-2021-25110.md): Futurio Extra \< 1.6.3 - Subscriber+ User Email Address Disclosure (no CVSS, Futurio Extra)
- [CVE-2021-25109](https://cve.now/CVE-2021-25109.md): Futurio Extra \< 1.6.3 - Authenticated SQL Injection (no CVSS, Futurio Extra)
- [CVE-2021-25107](https://cve.now/CVE-2021-25107.md): Form Store to DB \< 1.1.1 - Unauthenticated Stored Cross-Site Scripting (no CVSS, Form Store to DB)
- [CVE-2021-25050](https://cve.now/CVE-2021-25050.md): Remove Footer Credit \< 1.0.11 - Admin+ Stored Cross-Site Scripting (no CVSS, Remove Footer Credit)
- [CVE-2021-25033](https://cve.now/CVE-2021-25033.md): Noptin \< 1.6.5 - Open Redirect (no CVSS, WordPress Newsletter Plugin – Noptin)
- [CVE-2021-25018](https://cve.now/CVE-2021-25018.md): PPOM for WooCommerce \< 24.0 - Subscriber+ Settings Update to Stored XSS (no CVSS, PPOM for WooCommerce)
- [CVE-2021-25014](https://cve.now/CVE-2021-25014.md): Ibtana \< 1.1.4.9 - Subscriber+ Settings Update to Stored XSS (no CVSS, Ibtana – WordPress Website Builder)
- [CVE-2021-24904](https://cve.now/CVE-2021-24904.md): Mortgage Calculators WP \< 1.56 - Admin+ Stored Cross-Site Scripting (no CVSS, Mortgage Calculators WP)
- [CVE-2021-24874](https://cve.now/CVE-2021-24874.md): Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue \< 3.1.31 - Reflected Cross-Site Scripting (no CVSS, Newsletter, SMTP, Email marketing and Subscribe forms by Se…)
- [CVE-2021-24446](https://cve.now/CVE-2021-24446.md): Remove Footer Credit \< 1.0.6 - CSRF to Stored Cross-Site Scripting (no CVSS, Remove Footer Credit)
- [CVE-2022-24110](https://cve.now/CVE-2022-24110.md): Kiteworks MFT 7.5 may allow an unauthorized user to reset other users' passwords. (no CVSS)
- [CVE-2021-45346](https://cve.now/CVE-2021-45346.md): A Memory Leak vulnerability exists in SQLite Project SQLite3 3.35.1 and 3.37.0 via maliciously crafted SQL Queries (made via editing the Dat (no CVSS)
- [CVE-2022-0512](https://cve.now/CVE-2022-0512.md): Authorization Bypass Through User-Controlled Key in unshiftio/url-parse (CVSS 8.8, unshiftio/url-parse · url-parse)
- [CVE-2022-0581](https://cve.now/CVE-2022-0581.md): Crash in the CMS protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of service via packet injection or crafted (CVSS 6.3, Wireshark Foundation Wireshark)
- [CVE-2022-0582](https://cve.now/CVE-2022-0582.md): Unaligned access in the CSN.1 protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of service via packet injecti (CVSS 6.3, Wireshark Foundation Wireshark)
- [CVE-2022-0583](https://cve.now/CVE-2022-0583.md): Crash in the PVFS protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of service via packet injection or crafte (CVSS 6.3, Wireshark Foundation Wireshark)
- [CVE-2022-0586](https://cve.now/CVE-2022-0586.md): Infinite loop in RTMPT protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of service via packet injection or c (CVSS 6.3, Wireshark Foundation Wireshark)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-02-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.