CVEs published February 16, 2022
93 CVEs were published on February 16, 2022: 7 critical, 20 high. 2 are now in CISA KEV.
- Published
- 93
- Critical
- 7
- High
- 20
- Medium
- 19
- Low
- 2
- Unrated
- 45
- Now in CISA KEV
- 2
- Fix available
- 12
Most affected products
- Adobe Illustrator
- 13
- HP Support Assistant
- 6
- teluu pjsip
- 5
- BUSINESS NOTEBOOK PCS BIOS; BUSINESS DESKTOP PCS BIOS; RETA…
- 4
- kernel
- 4
- Alexander Fuchs PHP Everywhere
- 3
- IBM Maximo Anywhere
- 3
- VMware ESXi and VMware Cloud Foundation
- 3
- Drupal Core · drupal/core
- 2
- KiCad
- 2
Critical 7
- CVE-2022-24086Adobe Commerce checkout improper input validation leads to remote code executionAdobe Magento Commerce · magento/community-edition
- CVE-2022-24663Remote Code Execution by Subscriber+ users via WordPress shortcodeAlexander Fuchs PHP Everywhere
- CVE-2022-24665Remote Code Execution by by Contributor+ users via WordPress gutenberg blockAlexander Fuchs PHP Everywhere
- CVE-2022-24664Remote Code Execution by by Contributor+ users via WordPress metaboxAlexander Fuchs PHP Everywhere
- CVE-2022-0513WP Statistics <= 13.1.4 Unauthenticated Blind SQL Injection via exclusion_reasonVeronaLabs WP Statistics
- CVE-2022-25235xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is val
- CVE-2022-25236xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs.
High 20
- CVE-2022-23644Server-side request forgery in BookWyrmbookwyrm-social bookwyrm
- CVE-2021-23682Prototype Pollutionlitespeed.js · appwrite/server-ce
- CVE-2022-23804A stack-based buffer overflow vulnerability exists in the Gerber Viewer gerber and excellon ReadIJCoord coordinate parsing functionality of KiCad
- CVE-2022-23803A stack-based buffer overflow vulnerability exists in the Gerber Viewer gerber and excellon ReadXYCoord coordinate parsing functionality of KiCad
- CVE-2021-21958A heap-based buffer overflow vulnerability exists in the Hword HwordApp.dll functionality of Hancom Office 2020 11.0.0.2353.Hancom
- CVE-2022-23202Adobe Creative Cloud Desktop Uncontrolled Search Path Element Arbitrary code executionAdobe Creative Cloud
- CVE-2022-23200Adobe After Effects 3GP File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe After Effects
- CVE-2022-23203Adobe Photoshop Buffer Overflow could lead to Arbitrary code executionAdobe Photoshop
- CVE-2022-23186Adobe Illustrator Out-of-bounds Write could lead to Arbitrary code executionAdobe Illustrator
- CVE-2022-23188Adobe Illustrator Buffer Overflow could lead to Arbitrary code executionAdobe Illustrator
- CVE-2021-39299Potential vulnerabilities have been identified in UEFI firmware (BIOS) for some PC products which may allow escalation of privilege and arbiBUSINESS NOTEBOOK PCS BIOS; BUSINESS DESKTOP PCS BIOS; RETA…
- CVE-2021-39300Potential vulnerabilities have been identified in UEFI firmware (BIOS) for some PC products which may allow escalation of privilege and arbiBUSINESS NOTEBOOK PCS BIOS; BUSINESS DESKTOP PCS BIOS; RETA…
- CVE-2021-39301Potential vulnerabilities have been identified in UEFI firmware (BIOS) for some PC products which may allow escalation of privilege and arbiBUSINESS NOTEBOOK PCS BIOS; BUSINESS DESKTOP PCS BIOS; RETA…
- CVE-2021-39297Potential vulnerabilities have been identified in UEFI firmware (BIOS) for some PC products which may allow escalation of privilege and arbiBUSINESS NOTEBOOK PCS BIOS; BUSINESS DESKTOP PCS BIOS; RETA…
- CVE-2021-4134Fancy Product Designer <= 4.7.4 Admin+ SQL InjectionFancy Product Designer
- CVE-2021-4106Vulnerability in Snow Inventory Java ScannerSnow Inventory Java Scanner
- CVE-2021-26726Remote code execution in Valmet DNA before Collection 2021Valmet DNA
- CVE-2022-0559Use After Free in radareorg/radare2radareorg/radare2
- CVE-2022-0614Use of Out-of-range Pointer Offset in mruby/mrubymruby/mruby
- CVE-2021-3560It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestorpolkit
Medium, low and unrated 66
- CVE-2022-25270The Quick Edit module does not properly check entity access in some circumstances.Drupal Core · drupal/core
- CVE-2022-23636Invalid drop of partially-initialized instances in wasmtimebytecodealliance wasmtime · wasmtime +1
- CVE-2022-22885Hutool v5.7.18's HttpRequest was discovered to ignore all TLS/SSL certificate validation.cn.hutool:hutool-http
- CVE-2022-22880Jeecg-boot v3.0 was discovered to contain a SQL injection vulnerability via the code parameter in /jeecg-boot/sys/user/queryUserByDepId.org.jeecgframework.boot:jeecg-boot-base · org.jeecgframewor…
- CVE-2022-22881Jeecg-boot v3.0 was discovered to contain a SQL injection vulnerability via the code parameter in /sys/user/queryUserComponentData.org.jeecgframework.boot:jeecg-boot-base · org.jeecgframewor…
- CVE-2022-24985Forms generated by JQueryForm.com before 2022-02-05 allows a remote authenticated attacker to bypass authentication and access the administr
- CVE-2022-24984Forms generated by JQueryForm.com before 2022-02-05 (if file-upload capability is enabled) allow remote unauthenticated attackers to upload
- CVE-2022-24983Forms generated by JQueryForm.com before 2022-02-05 allow remote attackers to obtain the URI to any uploaded file by capturing the POST resp
- CVE-2022-24982Forms generated by JQueryForm.com before 2022-02-05 allows a remote authenticated attacker to access the cleartext credentials of all other
- CVE-2022-24981A reflected cross-site scripting (XSS) vulnerability in forms generated by JQueryForm.com before 2022-02-05 allows remote attackers to injec
- CVE-2022-25265In the Linux kernel through 5.16.10, certain binary files may have the exec-all attribute if they were built in approximately 2003 (e.g., wi
- CVE-2021-3242DuxCMS v3.1.3 was discovered to contain a SQL injection vulnerability via the component s/tools/SendTpl/index?keyword=.
- CVE-2022-25255In Qt 5.9.x through 5.15.x before 5.15.9 and 6.x before 6.2.4 on Linux and UNIX, QProcess could execute a binary from the current working di
- CVE-2021-3752A use-after-free flaw was found in the Linux kernel’s Bluetooth subsystem in the way user calls connect to the socket and disconnect simultakernel
- CVE-2021-3578A flaw was found in mbsync before v1.3.6 and v1.4.2, where an unchecked pointer cast allows a malicious or compromised server to write an arisync
- CVE-2021-3773A flaw in netfilter could allow a network-connected attacker to infer openvpn connection endpoint information for further use in traditionalkernel
- CVE-2021-3760A flaw was found in the Linux kernel.kernel
- CVE-2022-22853A stored cross-site scripting (XSS) vulnerability in Hospital Patient Record Management System v1.0 allows attackers to execute arbitrary we
- CVE-2019-4352IBM Maximo Anywhere 7.6.4.0 applications could allow obfuscation of the application source code.IBM Maximo Anywhere
- CVE-2019-4351IBM Maximo Anywhere 7.6.4.0 applications could disclose sensitive information to a user with physical access to the device.IBM Maximo Anywhere
- CVE-2019-4291IBM Maximo Anywhere 7.6.4.0 could allow an attacker to reverse engineer the application due to the lack of binary protection precautions.IBM Maximo Anywhere
- CVE-2022-22945VMware NSX Edge contains a CLI shell injection vulnerability.VMware NSX Edge
- CVE-2021-21966An information disclosure vulnerability exists in the HTTP Server /ping.html functionality of Texas Instruments CC3200 SimpleLink Solution NTexas Instruments
- CVE-2022-23204Adobe Premiere Rush JPEG File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Premiere Rush
- CVE-2022-23197Adobe Illustrator Out-of-bounds Read could lead to Memory leakAdobe Illustrator
- CVE-2022-23199Adobe Illustrator NULL Pointer Dereference Application denial-of-serviceAdobe Illustrator
- CVE-2022-23198Adobe Illustrator NULL Pointer Dereference Application denial-of-serviceAdobe Illustrator
- CVE-2022-23196Adobe Illustrator Out-of-bounds Read could lead to Memory leakAdobe Illustrator
- CVE-2022-23195Adobe Illustrator Out-of-bounds Read could lead to Memory leakAdobe Illustrator
- CVE-2022-23194Adobe Illustrator Out-of-bounds Read could lead to Memory leakAdobe Illustrator
- CVE-2022-23190Adobe Illustrator Out-of-bounds Read could lead to Memory leakAdobe Illustrator
- CVE-2022-23191Adobe Illustrator Out-of-bounds Read could lead to Memory leakAdobe Illustrator
- CVE-2022-23189Adobe Illustrator NULL Pointer Dereference Application denial-of-serviceAdobe Illustrator
- CVE-2022-23192Adobe Illustrator Out-of-bounds Read could lead to Memory leakAdobe Illustrator
- CVE-2022-23193Adobe Illustrator Out-of-bounds Read could lead to Memory leakAdobe Illustrator
- CVE-2021-39298A potential vulnerability in AMD System Management Mode (SMM) interrupt handler may allow an attacker with high privileges to access the SMMAMD 2nd Gen EPYC · AMD 3rd Gen EPYC +3
- CVE-2020-6920Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified iHP Support Assistant
- CVE-2020-6921Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified iHP Support Assistant
- CVE-2022-22792MobiSoft - MobiPlus User Take Over and Improper Handling of url ParametersMobiSoft eharmony
- CVE-2022-0617A flaw null pointer dereference in the Linux kernel UDF file system functionality was found in the way user triggers udf_file_write_iter funKernel
- CVE-2020-6922Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified iHP Support Assistant
- CVE-2020-6917Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified iHP Support Assistant
- CVE-2020-6919Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified iHP Support Assistant
- CVE-2020-6918Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified iHP Support Assistant
- CVE-2021-3551A flaw was found in the PKI-server, where the spkispawn command, when run in debug mode, stores admin credentials in the installation log fipki-server
- CVE-2021-3557A flaw was found in argocd.argocd
- CVE-2021-22050ESXi contains a slow HTTP POST denial-of-service vulnerability in rhttpproxy.VMware ESXi and VMware Cloud Foundation
- CVE-2021-22043VMware ESXi contains a TOCTOU (Time-of-check Time-of-use) vulnerability that exists in the way temporary files are handled.VMware ESXi and VMware Cloud Foundation
- CVE-2021-22041VMware ESXi, Workstation, and Fusion contain a double-fetch vulnerability in the UHCI USB controller.VMware ESXi , Workstation, Fusion and VMware Cloud Foundati…
- CVE-2021-22042VMware ESXi contains an unauthorized access vulnerability due to VMX having access to settingsd authorization tickets.VMware ESXi and VMware Cloud Foundation
- CVE-2021-22040VMware ESXi, Workstation, and Fusion contain a use-after-free vulnerability in the XHCI USB controller.VMware ESXi , Workstation, Fusion and VMware Cloud Foundati…
- CVE-2021-45391A Buffer Overflow vulnerability exists in Tenda Router AX12 V22.03.01.21_CN in the sub_422CE4 function in the goform/setIPv6Status binary fi
- CVE-2022-23358EasyCMS v1.6 allows for SQL injection via ArticlemAction.class.php.
- CVE-2022-0613Authorization Bypass Through User-Controlled Key in medialize/uri.jsmedialize/uri.js · urijs
- CVE-2022-0612Cross-site Scripting (XSS) - Stored in livehelperchat/livehelperchatlivehelperchat/livehelperchat · remdex/livehelperchat
- CVE-2022-25241In FileCloud before 21.3, the CSV user import functionality is vulnerable to Cross-Site Request Forgery (CSRF).
- CVE-2022-25242In FileCloud before 21.3, file upload is not protected against Cross-Site Request Forgery (CSRF).
- CVE-2021-3753A race problem was seen in the vt_k_ioctl in drivers/tty/vt/vt_ioctl.c in the Linux kernel, which may cause an out of bounds read in vt as tkernel
- CVE-2021-3781A trivial sandbox (enabled with the `-dSAFER` option) escape flaw was found in the ghostscript interpreter by injecting a specially crafted ghostscript
- CVE-2021-43299Stack overflow in PJSUA API when calling pjsua_player_create.teluu pjsip
- CVE-2021-43300Stack overflow in PJSUA API when calling pjsua_recorder_create.teluu pjsip
- CVE-2021-43301Stack overflow in PJSUA API when calling pjsua_playlist_create.teluu pjsip
- CVE-2021-43302Read out-of-bounds in PJSUA API when calling pjsua_recorder_create.teluu pjsip
- CVE-2021-43303Buffer overflow in PJSUA API when calling pjsua_call_dump.teluu pjsip
- CVE-2022-25258An issue was discovered in drivers/usb/gadget/composite.c in the Linux kernel before 5.16.10.
- CVE-2022-25271Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validationDrupal Core · drupal/core