CVEs published February 15, 2022
91 CVEs were published on February 15, 2022: 3 critical, 7 high.
- Published
- 91
- Critical
- 3
- High
- 7
- Medium
- 10
- Low
- 0
- Unrated
- 71
- Now in CISA KEV
- 0
- Fix available
- 42
Most affected products
- Jenkins project Jenkins Pipeline: Shared Groovy Libraries P…
- 6
- Atlassian Jira Server · Atlassian Jira Data Center
- 3
- Jenkins project Jenkins Chef Sinatra Plugin · org.jenkins-c…
- 3
- Jenkins project Jenkins Pipeline: Groovy Plugin · org.jenki…
- 3
- librenms/librenms
- 3
- Atlassian Jira Service Management Server · Atlassian Jira S…
- 2
- Jenkins project Jenkins autonomiq Plugin · io.jenkins.plugi…
- 2
- Jenkins project Jenkins Checkmarx Plugin · com.checkmarx.je…
- 2
- Jenkins project Jenkins dbCharts Plugin · org.jenkins-ci.pl…
- 2
- Jenkins project Jenkins HashiCorp Vault Plugin · com.datapi…
- 2
Critical 3
- CVE-2021-46250An issue in SOA2Login::commented of ScratchOAuth2 before commit a91879bd58fa83b09283c0708a1864cdf067c64a allows attackers to authenticate as
- CVE-2022-22770TIBCO AuditSafe API Authentication vulnerabilityTIBCO Software TIBCO AuditSafe
- CVE-2021-43049TIBCO BusinessConnect Container Edition username and password leakageTIBCO Software TIBCO BusinessConnect Container Edition
High 7
- CVE-2022-23639Improper Restriction of Operations within the Bounds of a Memory Buffer and Race Condition in crossbeam-utilscrossbeam-rs crossbeam · crossbeam-utils
- CVE-2021-43050TIBCO BusinessConnect Container Edition administrative username and passwords leakageTIBCO Software TIBCO BusinessConnect Container Edition
- CVE-2022-23604Privilege escalation in DefenderTwentysix26 x26-Cogs
- CVE-2022-0588Missing Authorization in librenms/librenmslibrenms/librenms
- CVE-2022-0587Improper Authorization in librenms/librenmslibrenms/librenms
- CVE-2021-43940Affected versions of Atlassian Confluence Server and Data Center allow authenticated local attackers to achieve elevated privileges on the lAtlassian Confluence Server · Atlassian Confluence Data Cen…
- CVE-2022-21698Uncontrolled Resource Consumption in promhttpprometheus client_golang · github.com/prometheus/client_gol…
Medium, low and unrated 81
- CVE-2022-0611Missing Authorization in snipe/snipe-itsnipe/snipe-it
- CVE-2021-46252A Cross-Site Request Forgery (CSRF) in RequirementsBypassPage.php of Scratch Wiki scratch-confirmaccount-v3 allows attackers to modify accou
- CVE-2021-46251A reflected cross-site scripting (XSS) in ScratchOAuth2 before commit 1603f04e44ef67dde6ccffe866d2dca16defb293 allows attackers to execute a
- CVE-2021-46249An authorization bypass exploited by a user-controlled key in SpecificApps REST API in ScratchOAuth2 before commit d856dc704b2504cd3b92cf089
- CVE-2022-23643Side-channel attack in Sourcegraph Code Monitorssourcegraph
- CVE-2021-35380A Directory Traversal vulnerability exists in Solari di Udine TermTalk Server (TTServer) 3.24.0.2, which lets an unauthenticated malicious u
- CVE-2022-23641Denial of Service in Discoursediscourse
- CVE-2021-46321Tenda AC Series Router AC11_V02.03.01.104_CN was discovered to contain a stack buffer overflow in the wifiBasicCfg module.
- CVE-2021-46265Tenda AC Series Router AC11_V02.03.01.104_CN was discovered to contain a stack buffer overflow in the wanBasicCfg module.
- CVE-2021-46263Tenda AC Series Router AC11_V02.03.01.104_CN was discovered to contain a stack buffer overflow in the wifiTime module.
- CVE-2021-46264Tenda AC Series Router AC11_V02.03.01.104_CN was discovered to contain a stack buffer overflow in the onlineList module.
- CVE-2021-46262Tenda AC Series Router AC11_V02.03.01.104_CN was discovered to contain a stack buffer overflow in the PPPoE module.
- CVE-2021-37354Xerox Phaser 4622 v35.013.01.000 was discovered to contain a buffer overflow in the function sub_3226AC via the TIMEZONE variable.
- CVE-2021-33945RICOH Printer series SP products 320DN, SP 325DNw, SP 320SN, SP 320SFN, SP 325SNw, SP 325SFNw, SP 330SN, Aficio SP 3500SF, SP 221S, SP 220SN
- CVE-2021-42713Splashtop Remote Client (Personal Edition) through 3.4.6.1 creates a Temporary File in a Directory with Insecure Permissions.
- CVE-2022-24589Burden v3.0 was discovered to contain a stored cross-site scripting (XSS) in the Add Category function.
- CVE-2021-42714Splashtop Remote Client (Business Edition) through 3.4.8.3 creates a Temporary File in a Directory with Insecure Permissions.
- CVE-2022-25212A cross-site request forgery (CSRF) vulnerability in Jenkins SWAMP Plugin 1.2.6 and earlier allows attackers to connect to an attacker-speciJenkins project Jenkins SWAMP Plugin · org.continuousassura…
- CVE-2022-25211A missing permission check in Jenkins SWAMP Plugin 1.2.6 and earlier allows attackers with Overall/Read permission to connect to an attackerJenkins project Jenkins SWAMP Plugin · org.continuousassura…
- CVE-2022-25210Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier uses static fields to store job configuration information, allowing attackers withJenkins project Jenkins Convertigo Mobile Platform Plugin ·…
- CVE-2022-25209Jenkins Chef Sinatra Plugin 1.20 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Jenkins project Jenkins Chef Sinatra Plugin · org.jenkins-c…
- CVE-2022-25208A missing permission check in Jenkins Chef Sinatra Plugin 1.20 and earlier allows attackers with Overall/Read permission to have Jenkins senJenkins project Jenkins Chef Sinatra Plugin · org.jenkins-c…
- CVE-2022-25207A cross-site request forgery (CSRF) vulnerability in Jenkins Chef Sinatra Plugin 1.20 and earlier allows attackers to have Jenkins send an HJenkins project Jenkins Chef Sinatra Plugin · org.jenkins-c…
- CVE-2022-25206A missing check in Jenkins dbCharts Plugin 0.5.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specifiJenkins project Jenkins dbCharts Plugin · org.jenkins-ci.pl…
- CVE-2022-25205A cross-site request forgery (CSRF) vulnerability in Jenkins dbCharts Plugin 0.5.2 and earlier allows attackers to connect to an attacker-spJenkins project Jenkins dbCharts Plugin · org.jenkins-ci.pl…
- CVE-2022-25204Jenkins Doktor Plugin 0.4.1 and earlier implements functionality that allows agent processes to render files on the controller as Markdown oJenkins project Jenkins Doktor Plugin · by.dev.madhead.dokt…
- CVE-2022-25203Jenkins Team Views Plugin 0.9.0 and earlier does not escape team names, resulting in a stored cross-site scripting (XSS) vulnerability exploJenkins project Jenkins Team Views Plugin · com.sonymobile.…
- CVE-2022-25202Jenkins Promoted Builds (Simple) Plugin 1.9 and earlier does not escape the name of custom promotion levels, resulting in a stored cross-sitJenkins project Jenkins Promoted Builds (Simple) Plugin · o…
- CVE-2022-25201Missing permission checks in Jenkins Checkmarx Plugin 2022.1.2 and earlier allow attackers with Overall/Read permission to connect to an attJenkins project Jenkins Checkmarx Plugin · com.checkmarx.je…
- CVE-2022-25200A cross-site request forgery (CSRF) vulnerability in Jenkins Checkmarx Plugin 2022.1.2 and earlier allows attackers to connect to an attackeJenkins project Jenkins Checkmarx Plugin · com.checkmarx.je…
- CVE-2022-25199A missing permission check in Jenkins SCP publisher Plugin 1.8 and earlier allows attackers with Overall/Read permission to connect to an atJenkins project Jenkins SCP publisher Plugin · org.jenkins-…
- CVE-2022-25198A cross-site request forgery (CSRF) vulnerability in Jenkins SCP publisher Plugin 1.8 and earlier allows attackers to connect to an attackerJenkins project Jenkins SCP publisher Plugin · org.jenkins-…
- CVE-2022-25197Jenkins HashiCorp Vault Plugin 336.v182c0fbaaeb7 and earlier implements functionality that allows agent processes to read arbitrary files onJenkins project Jenkins HashiCorp Vault Plugin · com.datapi…
- CVE-2022-25196Jenkins GitLab Authentication Plugin 1.13 and earlier records the HTTP Referer header as part of the URL query parameters when the authenticJenkins project Jenkins GitLab Authentication Plugin · org.…
- CVE-2022-25195A missing permission check in Jenkins autonomiq Plugin 1.15 and earlier allows attackers with Overall/Read permission to connect to an attacJenkins project Jenkins autonomiq Plugin · io.jenkins.plugi…
- CVE-2022-25194A cross-site request forgery (CSRF) vulnerability in Jenkins autonomiq Plugin 1.15 and earlier allows attackers to connect to an attacker-spJenkins project Jenkins autonomiq Plugin · io.jenkins.plugi…
- CVE-2022-25193Missing permission checks in Jenkins Snow Commander Plugin 1.10 and earlier allow attackers with Overall/Read permission to connect to an atJenkins project Jenkins Snow Commander Plugin · io.jenkins.…
- CVE-2022-25192A cross-site request forgery (CSRF) vulnerability in Jenkins Snow Commander Plugin 1.10 and earlier allows attackers to connect to an attackJenkins project Jenkins Snow Commander Plugin · io.jenkins.…
- CVE-2022-25191Jenkins Agent Server Parameter Plugin 1.0 and earlier does not escape parameter names of agent server parameters, resulting in a stored crosJenkins project Jenkins Agent Server Parameter Plugin · io.…
- CVE-2022-25190A missing permission check in Jenkins Conjur Secrets Plugin 1.0.11 and earlier allows attackers with Overall/Read permission to enumerate crJenkins project Jenkins Conjur Secrets Plugin · org.conjur.…
- CVE-2022-25189Jenkins Custom Checkbox Parameter Plugin 1.1 and earlier does not escape parameter names of custom checkbox parameters, resulting in a storeJenkins project Jenkins Custom Checkbox Parameter Plugin ·…
- CVE-2022-25188Jenkins Fortify Plugin 20.2.34 and earlier does not sanitize the appName and appVersion parameters of its Pipeline steps, allowing attackersJenkins project Jenkins Fortify Plugin · org.jenkins-ci.plu…
- CVE-2022-25187Jenkins Support Core Plugin 2.79 and earlier does not redact some sensitive information in the support bundle.Jenkins project Jenkins Support Core Plugin · org.jenkins-c…
- CVE-2022-25186Jenkins HashiCorp Vault Plugin 3.8.0 and earlier implements functionality that allows agent processes to retrieve any Vault secrets for use Jenkins project Jenkins HashiCorp Vault Plugin · com.datapi…
- CVE-2022-25185Jenkins Generic Webhook Trigger Plugin 1.81 and earlier does not escape the build cause when using the webhook, resulting in a stored cross-Jenkins project Jenkins Generic Webhook Trigger Plugin · or…
- CVE-2022-25184Jenkins Pipeline: Build Step Plugin 2.15 and earlier reveals password parameter default values when generating a pipeline script using the PJenkins project Jenkins Pipeline: Build Step Plugin · org.j…
- CVE-2022-25183Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier uses the names of Pipeline libraries to create cache directorJenkins project Jenkins Pipeline: Shared Groovy Libraries P…
- CVE-2022-25182A sandbox bypass vulnerability in Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier allows attackers with Item/Jenkins project Jenkins Pipeline: Shared Groovy Libraries P…
- CVE-2022-25181A sandbox bypass vulnerability in Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier allows attackers with Item/Jenkins project Jenkins Pipeline: Shared Groovy Libraries P…
- CVE-2022-25180Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier includes password parameters from the original build in replayed builds, alloJenkins project Jenkins Pipeline: Groovy Plugin · org.jenki…
- CVE-2022-25178Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier does not restrict the names of resources passed to the librarJenkins project Jenkins Pipeline: Shared Groovy Libraries P…
- CVE-2022-25177Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier follows symbolic links to locations outside of the expected PJenkins project Jenkins Pipeline: Shared Groovy Libraries P…
- CVE-2022-25176Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier follows symbolic links to locations outside of the checkout directory for theJenkins project Jenkins Pipeline: Groovy Plugin · org.jenki…
- CVE-2022-25174Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier uses the same checkout directories for distinct SCMs for PipeJenkins project Jenkins Pipeline: Shared Groovy Libraries P…
- CVE-2022-25173Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier uses the same checkout directories for distinct SCMs when reading the script Jenkins project Jenkins Pipeline: Groovy Plugin · org.jenki…
- CVE-2022-24590A stored cross-site scripting (XSS) vulnerability in the Add Link function of BackdropCMS v1.21.1 allows attackers to execute arbitrary web
- CVE-2022-24587A stored cross-site scripting (XSS) vulnerability in the component core/admin/medias.php of PluXml v5.8.7 allows attackers to execute arbitr
- CVE-2022-24588Flatpress v1.2.1 was discovered to contain a cross-site scripting (XSS) vulnerability in the Upload SVG File function.
- CVE-2022-24226Hospital Management System v4.0 was discovered to contain a blind SQL injection vulnerability via the register function in func2.php.
- CVE-2022-24585A stored cross-site scripting (XSS) vulnerability in the component /core/admin/comment.php of PluXml v5.8.7 allows attackers to execute arbi
- CVE-2022-24684HashiCorp Nomad and Nomad Enterprise 0.9.0 through 1.0.16, 1.1.11, and 1.2.5 allow operators with job-submit capabilities to use the spread github.com/hashicorp/nomad
- CVE-2022-24586A stored cross-site scripting (XSS) vulnerability in the component /core/admin/categories.php of PluXml v5.8.7 allows attackers to execute a
- CVE-2022-0597Open Redirect in microweber/microwebermicroweber/microweber
- CVE-2021-42712Splashtop Streamer through 3.4.8.3 creates a Temporary File in a Directory with Insecure Permissions.
- CVE-2021-41552CommScope SURFboard SBG6950AC2 9.1.103AA23 devices allow Command Injection.
- CVE-2021-43734kkFileview v4.0.0 has arbitrary file read through a directory traversal vulnerability which may lead to sensitive file leak on related host.
- CVE-2022-23317CobaltStrike <=4.5 HTTP(S) listener does not determine whether the request URL begins with "/", and attackers can obtain relevant informatio
- CVE-2022-23384YzmCMS v6.3 is affected by Cross Site Request Forgery (CSRF) in /admin.add
- CVE-2021-46558Multiple cross-site scripting (XSS) vulnerabilities in the Add User module of Issabel PBX 20200102 allows attackers to execute arbitrary web
- CVE-2021-46557Vicidial 2.14-783a was discovered to contain a cross-site scripting (XSS) vulnerability via the input tabs.
- CVE-2022-0589Cross-site Scripting (XSS) - Stored in librenms/librenmslibrenms/librenms
- CVE-2021-43948Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view the names of privAtlassian Jira Service Management Server · Atlassian Jira S…
- CVE-2021-43941Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify several resources (including CsvFieldMappingsPagAtlassian Jira Server · Atlassian Jira Data Center
- CVE-2021-43950Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view import source conAtlassian Jira Service Management Server · Atlassian Jira S…
- CVE-2021-43953Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to toggle the Thread Contention and CPU moAtlassian Jira Server · Atlassian Jira Data Center
- CVE-2021-43952Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to restore the default configuration of fiAtlassian Jira Server · Atlassian Jira Data Center
- CVE-2021-44960In SVGPP SVG++ library 1.3.0, the XMLDocument::getRoot function in the renderDocument function handled the XMLDocument object improperly, re
- CVE-2022-0596Improper Validation of Specified Quantity in Input in microweber/microwebermicroweber/microweber
- CVE-2022-24227A cross-site scripting (XSS) vulnerability in BoltWire v7.10 and v 8.00 allows attackers to execute arbitrary web scripts or HTML via a craf
- CVE-2022-25175Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier uses the same checkout directories for distinct SCMs for the readTrusted Jenkins project Jenkins Pipeline: Multibranch Plugin · org.…
- CVE-2022-25179Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier follows symbolic links to locations outside of the checkout directory forJenkins project Jenkins Pipeline: Multibranch Plugin · org.…