# CVEs published 2022-02-15

91 CVEs were published on February 15, 2022: 3 critical, 7 high. Days are UTC.

- [CVE-2022-0611](https://cve.now/CVE-2022-0611.md): Missing Authorization in snipe/snipe-it (CVSS 6.3, snipe/snipe-it)
- [CVE-2021-46252](https://cve.now/CVE-2021-46252.md): A Cross-Site Request Forgery (CSRF) in RequirementsBypassPage.php of Scratch Wiki scratch-confirmaccount-v3 allows attackers to modify accou (CVSS 6.5)
- [CVE-2021-46251](https://cve.now/CVE-2021-46251.md): A reflected cross-site scripting (XSS) in ScratchOAuth2 before commit 1603f04e44ef67dde6ccffe866d2dca16defb293 allows attackers to execute a (CVSS 6.1)
- [CVE-2021-46250](https://cve.now/CVE-2021-46250.md): An issue in SOA2Login::commented of ScratchOAuth2 before commit a91879bd58fa83b09283c0708a1864cdf067c64a allows attackers to authenticate as (CVSS 10.0)
- [CVE-2021-46249](https://cve.now/CVE-2021-46249.md): An authorization bypass exploited by a user-controlled key in SpecificApps REST API in ScratchOAuth2 before commit d856dc704b2504cd3b92cf089 (CVSS 6.5)
- [CVE-2022-23643](https://cve.now/CVE-2022-23643.md): Side-channel attack in Sourcegraph Code Monitors (CVSS 6.5, sourcegraph)
- [CVE-2021-35380](https://cve.now/CVE-2021-35380.md): A Directory Traversal vulnerability exists in Solari di Udine TermTalk Server (TTServer) 3.24.0.2, which lets an unauthenticated malicious u (no CVSS)
- [CVE-2022-23641](https://cve.now/CVE-2022-23641.md): Denial of Service in Discourse (CVSS 6.5, discourse)
- [CVE-2021-46321](https://cve.now/CVE-2021-46321.md): Tenda AC Series Router AC11\_V02.03.01.104\_CN was discovered to contain a stack buffer overflow in the wifiBasicCfg module. (no CVSS)
- [CVE-2021-46265](https://cve.now/CVE-2021-46265.md): Tenda AC Series Router AC11\_V02.03.01.104\_CN was discovered to contain a stack buffer overflow in the wanBasicCfg module. (no CVSS)
- [CVE-2021-46263](https://cve.now/CVE-2021-46263.md): Tenda AC Series Router AC11\_V02.03.01.104\_CN was discovered to contain a stack buffer overflow in the wifiTime module. (no CVSS)
- [CVE-2021-46264](https://cve.now/CVE-2021-46264.md): Tenda AC Series Router AC11\_V02.03.01.104\_CN was discovered to contain a stack buffer overflow in the onlineList module. (no CVSS)
- [CVE-2021-46262](https://cve.now/CVE-2021-46262.md): Tenda AC Series Router AC11\_V02.03.01.104\_CN was discovered to contain a stack buffer overflow in the PPPoE module. (no CVSS)
- [CVE-2021-37354](https://cve.now/CVE-2021-37354.md): Xerox Phaser 4622 v35.013.01.000 was discovered to contain a buffer overflow in the function sub\_3226AC via the TIMEZONE variable. (no CVSS)
- [CVE-2021-33945](https://cve.now/CVE-2021-33945.md): RICOH Printer series SP products 320DN, SP 325DNw, SP 320SN, SP 320SFN, SP 325SNw, SP 325SFNw, SP 330SN, Aficio SP 3500SF, SP 221S, SP 220SN (no CVSS)
- [CVE-2021-42713](https://cve.now/CVE-2021-42713.md): Splashtop Remote Client (Personal Edition) through 3.4.6.1 creates a Temporary File in a Directory with Insecure Permissions. (no CVSS)
- [CVE-2022-24589](https://cve.now/CVE-2022-24589.md): Burden v3.0 was discovered to contain a stored cross-site scripting (XSS) in the Add Category function. (no CVSS)
- [CVE-2021-42714](https://cve.now/CVE-2021-42714.md): Splashtop Remote Client (Business Edition) through 3.4.8.3 creates a Temporary File in a Directory with Insecure Permissions. (no CVSS)
- [CVE-2022-23639](https://cve.now/CVE-2022-23639.md): Improper Restriction of Operations within the Bounds of a Memory Buffer and Race Condition in crossbeam-utils (CVSS 8.1, crossbeam-rs crossbeam · crossbeam-utils)
- [CVE-2022-22770](https://cve.now/CVE-2022-22770.md): TIBCO AuditSafe API Authentication vulnerability (CVSS 9.8, TIBCO Software TIBCO AuditSafe)
- [CVE-2021-43050](https://cve.now/CVE-2021-43050.md): TIBCO BusinessConnect Container Edition administrative username and passwords leakage (CVSS 8.4, TIBCO Software TIBCO BusinessConnect Container Edition)
- [CVE-2021-43049](https://cve.now/CVE-2021-43049.md): TIBCO BusinessConnect Container Edition username and password leakage (CVSS 9.8, TIBCO Software TIBCO BusinessConnect Container Edition)
- [CVE-2022-25212](https://cve.now/CVE-2022-25212.md): A cross-site request forgery (CSRF) vulnerability in Jenkins SWAMP Plugin 1.2.6 and earlier allows attackers to connect to an attacker-speci (no CVSS, Jenkins project Jenkins SWAMP Plugin · org.continuousassura…)
- [CVE-2022-25211](https://cve.now/CVE-2022-25211.md): A missing permission check in Jenkins SWAMP Plugin 1.2.6 and earlier allows attackers with Overall/Read permission to connect to an attacker (no CVSS, Jenkins project Jenkins SWAMP Plugin · org.continuousassura…)
- [CVE-2022-25210](https://cve.now/CVE-2022-25210.md): Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier uses static fields to store job configuration information, allowing attackers with (no CVSS, Jenkins project Jenkins Convertigo Mobile Platform Plugin ·…)
- [CVE-2022-25209](https://cve.now/CVE-2022-25209.md): Jenkins Chef Sinatra Plugin 1.20 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. (no CVSS, Jenkins project Jenkins Chef Sinatra Plugin · org.jenkins-c…)
- [CVE-2022-25208](https://cve.now/CVE-2022-25208.md): A missing permission check in Jenkins Chef Sinatra Plugin 1.20 and earlier allows attackers with Overall/Read permission to have Jenkins sen (no CVSS, Jenkins project Jenkins Chef Sinatra Plugin · org.jenkins-c…)
- [CVE-2022-25207](https://cve.now/CVE-2022-25207.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Chef Sinatra Plugin 1.20 and earlier allows attackers to have Jenkins send an H (no CVSS, Jenkins project Jenkins Chef Sinatra Plugin · org.jenkins-c…)
- [CVE-2022-25206](https://cve.now/CVE-2022-25206.md): A missing check in Jenkins dbCharts Plugin 0.5.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specifi (no CVSS, Jenkins project Jenkins dbCharts Plugin · org.jenkins-ci.pl…)
- [CVE-2022-25205](https://cve.now/CVE-2022-25205.md): A cross-site request forgery (CSRF) vulnerability in Jenkins dbCharts Plugin 0.5.2 and earlier allows attackers to connect to an attacker-sp (no CVSS, Jenkins project Jenkins dbCharts Plugin · org.jenkins-ci.pl…)
- [CVE-2022-25204](https://cve.now/CVE-2022-25204.md): Jenkins Doktor Plugin 0.4.1 and earlier implements functionality that allows agent processes to render files on the controller as Markdown o (no CVSS, Jenkins project Jenkins Doktor Plugin · by.dev.madhead.dokt…)
- [CVE-2022-25203](https://cve.now/CVE-2022-25203.md): Jenkins Team Views Plugin 0.9.0 and earlier does not escape team names, resulting in a stored cross-site scripting (XSS) vulnerability explo (no CVSS, Jenkins project Jenkins Team Views Plugin · com.sonymobile.…)
- [CVE-2022-25202](https://cve.now/CVE-2022-25202.md): Jenkins Promoted Builds (Simple) Plugin 1.9 and earlier does not escape the name of custom promotion levels, resulting in a stored cross-sit (no CVSS, Jenkins project Jenkins Promoted Builds (Simple) Plugin · o…)
- [CVE-2022-25201](https://cve.now/CVE-2022-25201.md): Missing permission checks in Jenkins Checkmarx Plugin 2022.1.2 and earlier allow attackers with Overall/Read permission to connect to an att (no CVSS, Jenkins project Jenkins Checkmarx Plugin · com.checkmarx.je…)
- [CVE-2022-25200](https://cve.now/CVE-2022-25200.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Checkmarx Plugin 2022.1.2 and earlier allows attackers to connect to an attacke (no CVSS, Jenkins project Jenkins Checkmarx Plugin · com.checkmarx.je…)
- [CVE-2022-25199](https://cve.now/CVE-2022-25199.md): A missing permission check in Jenkins SCP publisher Plugin 1.8 and earlier allows attackers with Overall/Read permission to connect to an at (no CVSS, Jenkins project Jenkins SCP publisher Plugin · org.jenkins-…)
- [CVE-2022-25198](https://cve.now/CVE-2022-25198.md): A cross-site request forgery (CSRF) vulnerability in Jenkins SCP publisher Plugin 1.8 and earlier allows attackers to connect to an attacker (no CVSS, Jenkins project Jenkins SCP publisher Plugin · org.jenkins-…)
- [CVE-2022-25197](https://cve.now/CVE-2022-25197.md): Jenkins HashiCorp Vault Plugin 336.v182c0fbaaeb7 and earlier implements functionality that allows agent processes to read arbitrary files on (no CVSS, Jenkins project Jenkins HashiCorp Vault Plugin · com.datapi…)
- [CVE-2022-25196](https://cve.now/CVE-2022-25196.md): Jenkins GitLab Authentication Plugin 1.13 and earlier records the HTTP Referer header as part of the URL query parameters when the authentic (no CVSS, Jenkins project Jenkins GitLab Authentication Plugin · org.…)
- [CVE-2022-25195](https://cve.now/CVE-2022-25195.md): A missing permission check in Jenkins autonomiq Plugin 1.15 and earlier allows attackers with Overall/Read permission to connect to an attac (no CVSS, Jenkins project Jenkins autonomiq Plugin · io.jenkins.plugi…)
- [CVE-2022-25194](https://cve.now/CVE-2022-25194.md): A cross-site request forgery (CSRF) vulnerability in Jenkins autonomiq Plugin 1.15 and earlier allows attackers to connect to an attacker-sp (no CVSS, Jenkins project Jenkins autonomiq Plugin · io.jenkins.plugi…)
- [CVE-2022-25193](https://cve.now/CVE-2022-25193.md): Missing permission checks in Jenkins Snow Commander Plugin 1.10 and earlier allow attackers with Overall/Read permission to connect to an at (no CVSS, Jenkins project Jenkins Snow Commander Plugin · io.jenkins.…)
- [CVE-2022-25192](https://cve.now/CVE-2022-25192.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Snow Commander Plugin 1.10 and earlier allows attackers to connect to an attack (no CVSS, Jenkins project Jenkins Snow Commander Plugin · io.jenkins.…)
- [CVE-2022-25191](https://cve.now/CVE-2022-25191.md): Jenkins Agent Server Parameter Plugin 1.0 and earlier does not escape parameter names of agent server parameters, resulting in a stored cros (no CVSS, Jenkins project Jenkins Agent Server Parameter Plugin · io.…)
- [CVE-2022-25190](https://cve.now/CVE-2022-25190.md): A missing permission check in Jenkins Conjur Secrets Plugin 1.0.11 and earlier allows attackers with Overall/Read permission to enumerate cr (no CVSS, Jenkins project Jenkins Conjur Secrets Plugin · org.conjur.…)
- [CVE-2022-25189](https://cve.now/CVE-2022-25189.md): Jenkins Custom Checkbox Parameter Plugin 1.1 and earlier does not escape parameter names of custom checkbox parameters, resulting in a store (no CVSS, Jenkins project Jenkins Custom Checkbox Parameter Plugin ·…)
- [CVE-2022-25188](https://cve.now/CVE-2022-25188.md): Jenkins Fortify Plugin 20.2.34 and earlier does not sanitize the appName and appVersion parameters of its Pipeline steps, allowing attackers (no CVSS, Jenkins project Jenkins Fortify Plugin · org.jenkins-ci.plu…)
- [CVE-2022-25187](https://cve.now/CVE-2022-25187.md): Jenkins Support Core Plugin 2.79 and earlier does not redact some sensitive information in the support bundle. (no CVSS, Jenkins project Jenkins Support Core Plugin · org.jenkins-c…)
- [CVE-2022-25186](https://cve.now/CVE-2022-25186.md): Jenkins HashiCorp Vault Plugin 3.8.0 and earlier implements functionality that allows agent processes to retrieve any Vault secrets for use (no CVSS, Jenkins project Jenkins HashiCorp Vault Plugin · com.datapi…)
- [CVE-2022-25185](https://cve.now/CVE-2022-25185.md): Jenkins Generic Webhook Trigger Plugin 1.81 and earlier does not escape the build cause when using the webhook, resulting in a stored cross- (no CVSS, Jenkins project Jenkins Generic Webhook Trigger Plugin · or…)
- [CVE-2022-25184](https://cve.now/CVE-2022-25184.md): Jenkins Pipeline: Build Step Plugin 2.15 and earlier reveals password parameter default values when generating a pipeline script using the P (no CVSS, Jenkins project Jenkins Pipeline: Build Step Plugin · org.j…)
- [CVE-2022-25183](https://cve.now/CVE-2022-25183.md): Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier uses the names of Pipeline libraries to create cache director (no CVSS, Jenkins project Jenkins Pipeline: Shared Groovy Libraries P…)
- [CVE-2022-25182](https://cve.now/CVE-2022-25182.md): A sandbox bypass vulnerability in Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier allows attackers with Item/ (no CVSS, Jenkins project Jenkins Pipeline: Shared Groovy Libraries P…)
- [CVE-2022-25181](https://cve.now/CVE-2022-25181.md): A sandbox bypass vulnerability in Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier allows attackers with Item/ (no CVSS, Jenkins project Jenkins Pipeline: Shared Groovy Libraries P…)
- [CVE-2022-25180](https://cve.now/CVE-2022-25180.md): Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier includes password parameters from the original build in replayed builds, allo (no CVSS, Jenkins project Jenkins Pipeline: Groovy Plugin · org.jenki…)
- [CVE-2022-25178](https://cve.now/CVE-2022-25178.md): Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier does not restrict the names of resources passed to the librar (no CVSS, Jenkins project Jenkins Pipeline: Shared Groovy Libraries P…)
- [CVE-2022-25177](https://cve.now/CVE-2022-25177.md): Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier follows symbolic links to locations outside of the expected P (no CVSS, Jenkins project Jenkins Pipeline: Shared Groovy Libraries P…)
- [CVE-2022-25176](https://cve.now/CVE-2022-25176.md): Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier follows symbolic links to locations outside of the checkout directory for the (no CVSS, Jenkins project Jenkins Pipeline: Groovy Plugin · org.jenki…)
- [CVE-2022-25174](https://cve.now/CVE-2022-25174.md): Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier uses the same checkout directories for distinct SCMs for Pipe (no CVSS, Jenkins project Jenkins Pipeline: Shared Groovy Libraries P…)
- [CVE-2022-25173](https://cve.now/CVE-2022-25173.md): Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier uses the same checkout directories for distinct SCMs when reading the script (no CVSS, Jenkins project Jenkins Pipeline: Groovy Plugin · org.jenki…)
- [CVE-2022-24590](https://cve.now/CVE-2022-24590.md): A stored cross-site scripting (XSS) vulnerability in the Add Link function of BackdropCMS v1.21.1 allows attackers to execute arbitrary web (no CVSS)
- [CVE-2022-23604](https://cve.now/CVE-2022-23604.md): Privilege escalation in Defender (CVSS 8.8, Twentysix26 x26-Cogs)
- [CVE-2022-24587](https://cve.now/CVE-2022-24587.md): A stored cross-site scripting (XSS) vulnerability in the component core/admin/medias.php of PluXml v5.8.7 allows attackers to execute arbitr (no CVSS)
- [CVE-2022-24588](https://cve.now/CVE-2022-24588.md): Flatpress v1.2.1 was discovered to contain a cross-site scripting (XSS) vulnerability in the Upload SVG File function. (no CVSS)
- [CVE-2022-24226](https://cve.now/CVE-2022-24226.md): Hospital Management System v4.0 was discovered to contain a blind SQL injection vulnerability via the register function in func2.php. (no CVSS)
- [CVE-2022-24585](https://cve.now/CVE-2022-24585.md): A stored cross-site scripting (XSS) vulnerability in the component /core/admin/comment.php of PluXml v5.8.7 allows attackers to execute arbi (no CVSS)
- [CVE-2022-24684](https://cve.now/CVE-2022-24684.md): HashiCorp Nomad and Nomad Enterprise 0.9.0 through 1.0.16, 1.1.11, and 1.2.5 allow operators with job-submit capabilities to use the spread (no CVSS, github.com/hashicorp/nomad)
- [CVE-2022-24586](https://cve.now/CVE-2022-24586.md): A stored cross-site scripting (XSS) vulnerability in the component /core/admin/categories.php of PluXml v5.8.7 allows attackers to execute a (no CVSS)
- [CVE-2022-0597](https://cve.now/CVE-2022-0597.md): Open Redirect in microweber/microweber (CVSS 4.3, microweber/microweber)
- [CVE-2021-42712](https://cve.now/CVE-2021-42712.md): Splashtop Streamer through 3.4.8.3 creates a Temporary File in a Directory with Insecure Permissions. (no CVSS)
- [CVE-2021-41552](https://cve.now/CVE-2021-41552.md): CommScope SURFboard SBG6950AC2 9.1.103AA23 devices allow Command Injection. (no CVSS)
- [CVE-2021-43734](https://cve.now/CVE-2021-43734.md): kkFileview v4.0.0 has arbitrary file read through a directory traversal vulnerability which may lead to sensitive file leak on related host. (no CVSS)
- [CVE-2022-23317](https://cve.now/CVE-2022-23317.md): CobaltStrike \<=4.5 HTTP(S) listener does not determine whether the request URL begins with "/", and attackers can obtain relevant informatio (no CVSS)
- [CVE-2022-23384](https://cve.now/CVE-2022-23384.md): YzmCMS v6.3 is affected by Cross Site Request Forgery (CSRF) in /admin.add (no CVSS)
- [CVE-2021-46558](https://cve.now/CVE-2021-46558.md): Multiple cross-site scripting (XSS) vulnerabilities in the Add User module of Issabel PBX 20200102 allows attackers to execute arbitrary web (no CVSS)
- [CVE-2021-46557](https://cve.now/CVE-2021-46557.md): Vicidial 2.14-783a was discovered to contain a cross-site scripting (XSS) vulnerability via the input tabs. (no CVSS)
- [CVE-2022-0589](https://cve.now/CVE-2022-0589.md): Cross-site Scripting (XSS) - Stored in librenms/librenms (CVSS 5.4, librenms/librenms)
- [CVE-2022-0588](https://cve.now/CVE-2022-0588.md): Missing Authorization in librenms/librenms (CVSS 7.1, librenms/librenms)
- [CVE-2022-0587](https://cve.now/CVE-2022-0587.md): Improper Authorization in librenms/librenms (CVSS 7.1, librenms/librenms)
- [CVE-2021-43948](https://cve.now/CVE-2021-43948.md): Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view the names of priv (no CVSS, Atlassian Jira Service Management Server · Atlassian Jira S…)
- [CVE-2021-43941](https://cve.now/CVE-2021-43941.md): Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify several resources (including CsvFieldMappingsPag (no CVSS, Atlassian Jira Server · Atlassian Jira Data Center)
- [CVE-2021-43940](https://cve.now/CVE-2021-43940.md): Affected versions of Atlassian Confluence Server and Data Center allow authenticated local attackers to achieve elevated privileges on the l (CVSS 7.8, Atlassian Confluence Server · Atlassian Confluence Data Cen…)
- [CVE-2021-43950](https://cve.now/CVE-2021-43950.md): Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view import source con (no CVSS, Atlassian Jira Service Management Server · Atlassian Jira S…)
- [CVE-2021-43953](https://cve.now/CVE-2021-43953.md): Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to toggle the Thread Contention and CPU mo (no CVSS, Atlassian Jira Server · Atlassian Jira Data Center)
- [CVE-2021-43952](https://cve.now/CVE-2021-43952.md): Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to restore the default configuration of fi (no CVSS, Atlassian Jira Server · Atlassian Jira Data Center)
- [CVE-2021-44960](https://cve.now/CVE-2021-44960.md): In SVGPP SVG++ library 1.3.0, the XMLDocument::getRoot function in the renderDocument function handled the XMLDocument object improperly, re (no CVSS)
- [CVE-2022-0596](https://cve.now/CVE-2022-0596.md): Improper Validation of Specified Quantity in Input in microweber/microweber (CVSS 5.4, microweber/microweber)
- [CVE-2022-21698](https://cve.now/CVE-2022-21698.md): Uncontrolled Resource Consumption in promhttp (CVSS 7.5, prometheus client\_golang · github.com/prometheus/client\_gol…)
- [CVE-2022-24227](https://cve.now/CVE-2022-24227.md): A cross-site scripting (XSS) vulnerability in BoltWire v7.10 and v 8.00 allows attackers to execute arbitrary web scripts or HTML via a craf (CVSS 6.1)
- [CVE-2022-25175](https://cve.now/CVE-2022-25175.md): Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier uses the same checkout directories for distinct SCMs for the readTrusted (no CVSS, Jenkins project Jenkins Pipeline: Multibranch Plugin · org.…)
- [CVE-2022-25179](https://cve.now/CVE-2022-25179.md): Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier follows symbolic links to locations outside of the checkout directory for (no CVSS, Jenkins project Jenkins Pipeline: Multibranch Plugin · org.…)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-02-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.