# CVEs published 2022-02-16

93 CVEs were published on February 16, 2022: 7 critical, 20 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2022-25270](https://cve.now/CVE-2022-25270.md): The Quick Edit module does not properly check entity access in some circumstances. (no CVSS, Drupal Core · drupal/core)
- [CVE-2022-23636](https://cve.now/CVE-2022-23636.md): Invalid drop of partially-initialized instances in wasmtime (CVSS 5.1, bytecodealliance wasmtime · wasmtime +1)
- [CVE-2022-22885](https://cve.now/CVE-2022-22885.md): Hutool v5.7.18's HttpRequest was discovered to ignore all TLS/SSL certificate validation. (no CVSS, cn.hutool:hutool-http)
- [CVE-2022-22880](https://cve.now/CVE-2022-22880.md): Jeecg-boot v3.0 was discovered to contain a SQL injection vulnerability via the code parameter in /jeecg-boot/sys/user/queryUserByDepId. (no CVSS, org.jeecgframework.boot:jeecg-boot-base · org.jeecgframewor…)
- [CVE-2022-22881](https://cve.now/CVE-2022-22881.md): Jeecg-boot v3.0 was discovered to contain a SQL injection vulnerability via the code parameter in /sys/user/queryUserComponentData. (no CVSS, org.jeecgframework.boot:jeecg-boot-base · org.jeecgframewor…)
- [CVE-2022-24985](https://cve.now/CVE-2022-24985.md): Forms generated by JQueryForm.com before 2022-02-05 allows a remote authenticated attacker to bypass authentication and access the administr (no CVSS)
- [CVE-2022-24984](https://cve.now/CVE-2022-24984.md): Forms generated by JQueryForm.com before 2022-02-05 (if file-upload capability is enabled) allow remote unauthenticated attackers to upload (no CVSS)
- [CVE-2022-24983](https://cve.now/CVE-2022-24983.md): Forms generated by JQueryForm.com before 2022-02-05 allow remote attackers to obtain the URI to any uploaded file by capturing the POST resp (no CVSS)
- [CVE-2022-24982](https://cve.now/CVE-2022-24982.md): Forms generated by JQueryForm.com before 2022-02-05 allows a remote authenticated attacker to access the cleartext credentials of all other (no CVSS)
- [CVE-2022-24981](https://cve.now/CVE-2022-24981.md): A reflected cross-site scripting (XSS) vulnerability in forms generated by JQueryForm.com before 2022-02-05 allows remote attackers to injec (no CVSS)
- [CVE-2022-25265](https://cve.now/CVE-2022-25265.md): In the Linux kernel through 5.16.10, certain binary files may have the exec-all attribute if they were built in approximately 2003 (e.g., wi (no CVSS)
- [CVE-2021-3242](https://cve.now/CVE-2021-3242.md): DuxCMS v3.1.3 was discovered to contain a SQL injection vulnerability via the component s/tools/SendTpl/index?keyword=. (no CVSS)
- [CVE-2022-25255](https://cve.now/CVE-2022-25255.md): In Qt 5.9.x through 5.15.x before 5.15.9 and 6.x before 6.2.4 on Linux and UNIX, QProcess could execute a binary from the current working di (no CVSS)
- [CVE-2021-3752](https://cve.now/CVE-2021-3752.md): A use-after-free flaw was found in the Linux kernel’s Bluetooth subsystem in the way user calls connect to the socket and disconnect simulta (no CVSS, kernel)
- [CVE-2021-3578](https://cve.now/CVE-2021-3578.md): A flaw was found in mbsync before v1.3.6 and v1.4.2, where an unchecked pointer cast allows a malicious or compromised server to write an ar (no CVSS, isync)
- [CVE-2021-3773](https://cve.now/CVE-2021-3773.md): A flaw in netfilter could allow a network-connected attacker to infer openvpn connection endpoint information for further use in traditional (no CVSS, kernel)
- [CVE-2021-3760](https://cve.now/CVE-2021-3760.md): A flaw was found in the Linux kernel. (no CVSS, kernel)
- [CVE-2022-23644](https://cve.now/CVE-2022-23644.md): Server-side request forgery in BookWyrm (CVSS 8.8, bookwyrm-social bookwyrm)
- [CVE-2022-22853](https://cve.now/CVE-2022-22853.md): A stored cross-site scripting (XSS) vulnerability in Hospital Patient Record Management System v1.0 allows attackers to execute arbitrary we (no CVSS)
- [CVE-2021-23682](https://cve.now/CVE-2021-23682.md): Prototype Pollution (CVSS 7.3, litespeed.js · appwrite/server-ce)
- [CVE-2019-4352](https://cve.now/CVE-2019-4352.md): IBM Maximo Anywhere 7.6.4.0 applications could allow obfuscation of the application source code. (CVSS 2.4, IBM Maximo Anywhere)
- [CVE-2019-4351](https://cve.now/CVE-2019-4351.md): IBM Maximo Anywhere 7.6.4.0 applications could disclose sensitive information to a user with physical access to the device. (CVSS 2.1, IBM Maximo Anywhere)
- [CVE-2019-4291](https://cve.now/CVE-2019-4291.md): IBM Maximo Anywhere 7.6.4.0 could allow an attacker to reverse engineer the application due to the lack of binary protection precautions. (CVSS 6.5, IBM Maximo Anywhere)
- [CVE-2022-22945](https://cve.now/CVE-2022-22945.md): VMware NSX Edge contains a CLI shell injection vulnerability. (no CVSS, VMware NSX Edge)
- [CVE-2022-23804](https://cve.now/CVE-2022-23804.md): A stack-based buffer overflow vulnerability exists in the Gerber Viewer gerber and excellon ReadIJCoord coordinate parsing functionality of (CVSS 7.8, KiCad)
- [CVE-2022-23803](https://cve.now/CVE-2022-23803.md): A stack-based buffer overflow vulnerability exists in the Gerber Viewer gerber and excellon ReadXYCoord coordinate parsing functionality of (CVSS 7.8, KiCad)
- [CVE-2021-21966](https://cve.now/CVE-2021-21966.md): An information disclosure vulnerability exists in the HTTP Server /ping.html functionality of Texas Instruments CC3200 SimpleLink Solution N (CVSS 5.3, Texas Instruments)
- [CVE-2021-21958](https://cve.now/CVE-2021-21958.md): A heap-based buffer overflow vulnerability exists in the Hword HwordApp.dll functionality of Hancom Office 2020 11.0.0.2353. (CVSS 7.8, Hancom)
- [CVE-2022-23202](https://cve.now/CVE-2022-23202.md): Adobe Creative Cloud Desktop Uncontrolled Search Path Element Arbitrary code execution (CVSS 7.0, Adobe Creative Cloud)
- [CVE-2022-24086](https://cve.now/CVE-2022-24086.md): Adobe Commerce checkout improper input validation leads to remote code execution (CVSS 9.8, KEV, Adobe Magento Commerce · magento/community-edition)
- [CVE-2022-23200](https://cve.now/CVE-2022-23200.md): Adobe After Effects 3GP File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe After Effects)
- [CVE-2022-23204](https://cve.now/CVE-2022-23204.md): Adobe Premiere Rush JPEG File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Premiere Rush)
- [CVE-2022-23203](https://cve.now/CVE-2022-23203.md): Adobe Photoshop Buffer Overflow could lead to Arbitrary code execution (CVSS 7.8, Adobe Photoshop)
- [CVE-2022-23197](https://cve.now/CVE-2022-23197.md): Adobe Illustrator Out-of-bounds Read could lead to Memory leak (CVSS 5.5, Adobe Illustrator)
- [CVE-2022-23199](https://cve.now/CVE-2022-23199.md): Adobe Illustrator NULL Pointer Dereference Application denial-of-service (CVSS 5.5, Adobe Illustrator)
- [CVE-2022-23198](https://cve.now/CVE-2022-23198.md): Adobe Illustrator NULL Pointer Dereference Application denial-of-service (CVSS 5.5, Adobe Illustrator)
- [CVE-2022-23196](https://cve.now/CVE-2022-23196.md): Adobe Illustrator Out-of-bounds Read could lead to Memory leak (CVSS 5.5, Adobe Illustrator)
- [CVE-2022-23195](https://cve.now/CVE-2022-23195.md): Adobe Illustrator Out-of-bounds Read could lead to Memory leak (CVSS 5.5, Adobe Illustrator)
- [CVE-2022-23194](https://cve.now/CVE-2022-23194.md): Adobe Illustrator Out-of-bounds Read could lead to Memory leak (CVSS 5.5, Adobe Illustrator)
- [CVE-2022-23190](https://cve.now/CVE-2022-23190.md): Adobe Illustrator Out-of-bounds Read could lead to Memory leak (CVSS 5.5, Adobe Illustrator)
- [CVE-2022-23191](https://cve.now/CVE-2022-23191.md): Adobe Illustrator Out-of-bounds Read could lead to Memory leak (CVSS 5.5, Adobe Illustrator)
- [CVE-2022-23186](https://cve.now/CVE-2022-23186.md): Adobe Illustrator Out-of-bounds Write could lead to Arbitrary code execution (CVSS 7.8, Adobe Illustrator)
- [CVE-2022-23189](https://cve.now/CVE-2022-23189.md): Adobe Illustrator NULL Pointer Dereference Application denial-of-service (CVSS 5.5, Adobe Illustrator)
- [CVE-2022-23188](https://cve.now/CVE-2022-23188.md): Adobe Illustrator Buffer Overflow could lead to Arbitrary code execution (CVSS 7.8, Adobe Illustrator)
- [CVE-2022-23192](https://cve.now/CVE-2022-23192.md): Adobe Illustrator Out-of-bounds Read could lead to Memory leak (CVSS 5.5, Adobe Illustrator)
- [CVE-2022-23193](https://cve.now/CVE-2022-23193.md): Adobe Illustrator Out-of-bounds Read could lead to Memory leak (CVSS 5.5, Adobe Illustrator)
- [CVE-2021-39299](https://cve.now/CVE-2021-39299.md): Potential vulnerabilities have been identified in UEFI firmware (BIOS) for some PC products which may allow escalation of privilege and arbi (CVSS 7.8, BUSINESS NOTEBOOK PCS BIOS; BUSINESS DESKTOP PCS BIOS; RETA…)
- [CVE-2021-39300](https://cve.now/CVE-2021-39300.md): Potential vulnerabilities have been identified in UEFI firmware (BIOS) for some PC products which may allow escalation of privilege and arbi (CVSS 7.3, BUSINESS NOTEBOOK PCS BIOS; BUSINESS DESKTOP PCS BIOS; RETA…)
- [CVE-2021-39301](https://cve.now/CVE-2021-39301.md): Potential vulnerabilities have been identified in UEFI firmware (BIOS) for some PC products which may allow escalation of privilege and arbi (CVSS 7.8, BUSINESS NOTEBOOK PCS BIOS; BUSINESS DESKTOP PCS BIOS; RETA…)
- [CVE-2021-39297](https://cve.now/CVE-2021-39297.md): Potential vulnerabilities have been identified in UEFI firmware (BIOS) for some PC products which may allow escalation of privilege and arbi (CVSS 7.8, BUSINESS NOTEBOOK PCS BIOS; BUSINESS DESKTOP PCS BIOS; RETA…)
- [CVE-2021-39298](https://cve.now/CVE-2021-39298.md): A potential vulnerability in AMD System Management Mode (SMM) interrupt handler may allow an attacker with high privileges to access the SMM (CVSS 6.5, AMD 2nd Gen EPYC · AMD 3rd Gen EPYC +3)
- [CVE-2020-6920](https://cve.now/CVE-2020-6920.md): Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified i (no CVSS, HP Support Assistant)
- [CVE-2020-6921](https://cve.now/CVE-2020-6921.md): Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified i (no CVSS, HP Support Assistant)
- [CVE-2022-22792](https://cve.now/CVE-2022-22792.md): MobiSoft - MobiPlus User Take Over and Improper Handling of url Parameters (CVSS 6.6, MobiSoft eharmony)
- [CVE-2022-24663](https://cve.now/CVE-2022-24663.md): Remote Code Execution by Subscriber+ users via WordPress shortcode (CVSS 9.9, Alexander Fuchs PHP Everywhere)
- [CVE-2022-24665](https://cve.now/CVE-2022-24665.md): Remote Code Execution by by Contributor+ users via WordPress gutenberg block (CVSS 9.9, Alexander Fuchs PHP Everywhere)
- [CVE-2021-4134](https://cve.now/CVE-2021-4134.md): Fancy Product Designer \<= 4.7.4 Admin+ SQL Injection (CVSS 7.2, Fancy Product Designer)
- [CVE-2022-24664](https://cve.now/CVE-2022-24664.md): Remote Code Execution by by Contributor+ users via WordPress metabox (CVSS 9.9, Alexander Fuchs PHP Everywhere)
- [CVE-2022-0513](https://cve.now/CVE-2022-0513.md): WP Statistics \<= 13.1.4 Unauthenticated Blind SQL Injection via exclusion\_reason (CVSS 9.8, VeronaLabs WP Statistics)
- [CVE-2022-0617](https://cve.now/CVE-2022-0617.md): A flaw null pointer dereference in the Linux kernel UDF file system functionality was found in the way user triggers udf\_file\_write\_iter fun (no CVSS, Kernel)
- [CVE-2021-4106](https://cve.now/CVE-2021-4106.md): Vulnerability in Snow Inventory Java Scanner (CVSS 7.8, Snow Inventory Java Scanner)
- [CVE-2020-6922](https://cve.now/CVE-2020-6922.md): Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified i (no CVSS, HP Support Assistant)
- [CVE-2020-6917](https://cve.now/CVE-2020-6917.md): Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified i (no CVSS, HP Support Assistant)
- [CVE-2020-6919](https://cve.now/CVE-2020-6919.md): Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified i (no CVSS, HP Support Assistant)
- [CVE-2020-6918](https://cve.now/CVE-2020-6918.md): Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified i (no CVSS, HP Support Assistant)
- [CVE-2021-3551](https://cve.now/CVE-2021-3551.md): A flaw was found in the PKI-server, where the spkispawn command, when run in debug mode, stores admin credentials in the installation log fi (no CVSS, pki-server)
- [CVE-2021-3557](https://cve.now/CVE-2021-3557.md): A flaw was found in argocd. (no CVSS, argocd)
- [CVE-2021-22050](https://cve.now/CVE-2021-22050.md): ESXi contains a slow HTTP POST denial-of-service vulnerability in rhttpproxy. (no CVSS, VMware ESXi and VMware Cloud Foundation)
- [CVE-2021-22043](https://cve.now/CVE-2021-22043.md): VMware ESXi contains a TOCTOU (Time-of-check Time-of-use) vulnerability that exists in the way temporary files are handled. (no CVSS, VMware ESXi and VMware Cloud Foundation)
- [CVE-2021-22041](https://cve.now/CVE-2021-22041.md): VMware ESXi, Workstation, and Fusion contain a double-fetch vulnerability in the UHCI USB controller. (no CVSS, VMware ESXi , Workstation, Fusion and VMware Cloud Foundati…)
- [CVE-2021-22042](https://cve.now/CVE-2021-22042.md): VMware ESXi contains an unauthorized access vulnerability due to VMX having access to settingsd authorization tickets. (no CVSS, VMware ESXi and VMware Cloud Foundation)
- [CVE-2021-22040](https://cve.now/CVE-2021-22040.md): VMware ESXi, Workstation, and Fusion contain a use-after-free vulnerability in the XHCI USB controller. (no CVSS, VMware ESXi , Workstation, Fusion and VMware Cloud Foundati…)
- [CVE-2021-26726](https://cve.now/CVE-2021-26726.md): Remote code execution in Valmet DNA before Collection 2021 (CVSS 8.8, Valmet DNA)
- [CVE-2021-45391](https://cve.now/CVE-2021-45391.md): A Buffer Overflow vulnerability exists in Tenda Router AX12 V22.03.01.21\_CN in the sub\_422CE4 function in the goform/setIPv6Status binary fi (no CVSS)
- [CVE-2022-23358](https://cve.now/CVE-2022-23358.md): EasyCMS v1.6 allows for SQL injection via ArticlemAction.class.php. (no CVSS)
- [CVE-2022-0559](https://cve.now/CVE-2022-0559.md): Use After Free in radareorg/radare2 (CVSS 8.4, radareorg/radare2)
- [CVE-2022-0614](https://cve.now/CVE-2022-0614.md): Use of Out-of-range Pointer Offset in mruby/mruby (CVSS 8.4, mruby/mruby)
- [CVE-2022-0613](https://cve.now/CVE-2022-0613.md): Authorization Bypass Through User-Controlled Key in medialize/uri.js (CVSS 5.3, medialize/uri.js · urijs)
- [CVE-2022-0612](https://cve.now/CVE-2022-0612.md): Cross-site Scripting (XSS) - Stored in livehelperchat/livehelperchat (CVSS 6.7, livehelperchat/livehelperchat · remdex/livehelperchat)
- [CVE-2022-25241](https://cve.now/CVE-2022-25241.md): In FileCloud before 21.3, the CSV user import functionality is vulnerable to Cross-Site Request Forgery (CSRF). (no CVSS)
- [CVE-2022-25242](https://cve.now/CVE-2022-25242.md): In FileCloud before 21.3, file upload is not protected against Cross-Site Request Forgery (CSRF). (no CVSS)
- [CVE-2022-25235](https://cve.now/CVE-2022-25235.md): xmltok\_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is val (CVSS 9.8)
- [CVE-2022-25236](https://cve.now/CVE-2022-25236.md): xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs. (CVSS 9.8)
- [CVE-2021-3560](https://cve.now/CVE-2021-3560.md): It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor (CVSS 7.8, KEV, polkit)
- [CVE-2021-3753](https://cve.now/CVE-2021-3753.md): A race problem was seen in the vt\_k\_ioctl in drivers/tty/vt/vt\_ioctl.c in the Linux kernel, which may cause an out of bounds read in vt as t (no CVSS, kernel)
- [CVE-2021-3781](https://cve.now/CVE-2021-3781.md): A trivial sandbox (enabled with the \`-dSAFER\` option) escape flaw was found in the ghostscript interpreter by injecting a specially crafted (no CVSS, ghostscript)
- [CVE-2021-43299](https://cve.now/CVE-2021-43299.md): Stack overflow in PJSUA API when calling pjsua\_player\_create. (no CVSS, teluu pjsip)
- [CVE-2021-43300](https://cve.now/CVE-2021-43300.md): Stack overflow in PJSUA API when calling pjsua\_recorder\_create. (no CVSS, teluu pjsip)
- [CVE-2021-43301](https://cve.now/CVE-2021-43301.md): Stack overflow in PJSUA API when calling pjsua\_playlist\_create. (no CVSS, teluu pjsip)
- [CVE-2021-43302](https://cve.now/CVE-2021-43302.md): Read out-of-bounds in PJSUA API when calling pjsua\_recorder\_create. (no CVSS, teluu pjsip)
- [CVE-2021-43303](https://cve.now/CVE-2021-43303.md): Buffer overflow in PJSUA API when calling pjsua\_call\_dump. (no CVSS, teluu pjsip)
- [CVE-2022-25258](https://cve.now/CVE-2022-25258.md): An issue was discovered in drivers/usb/gadget/composite.c in the Linux kernel before 5.16.10. (no CVSS)
- [CVE-2022-25271](https://cve.now/CVE-2022-25271.md): Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation (no CVSS, Drupal Core · drupal/core)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-02-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.