CVEs published February 17, 2022
34 CVEs were published on February 17, 2022: 1 critical, 6 high. 1 is now in CISA KEV.
- Published
- 34
- Critical
- 1
- High
- 6
- Medium
- 8
- Low
- 1
- Unrated
- 18
- Now in CISA KEV
- 1
- Fix available
- 12
Most affected products
- Canonical snapd
- 4
- Cisco Email Security Appliance
- 1
- Cisco Prime Infrastructure
- 1
- Cisco Redundancy Configuration Manager
- 1
- GitHub Enterprise Server
- 1
- github.com/hashicorp/nomad
- 1
- IBM MQ
- 1
- microweber/microweber
- 1
- mruby/mruby
- 1
- net.mingsoft:ms-mcms
- 1
Critical 1
High 6
- CVE-2021-4120snapd could be made to bypass intended access restrictions through snap content interfaces and layout pathsCanonical snapd
- CVE-2021-44730snapd could be made to escalate privileges and run programs as administratorCanonical snapd
- CVE-2022-20653Cisco Email Security Appliance DNS Verification Denial of Service VulnerabilityCisco Email Security Appliance
- CVE-2022-23632Traefik skips the router TLS configuration when the host header is an FQDNtraefik · github.com/traefik/traefik/v2 +1
- CVE-2021-44731snapd could be made to escalate privileges and run programs as administratorCanonical snapd
- CVE-2022-0629Stack-based Buffer Overflow in vim/vimvim/vim
Medium, low and unrated 27
- CVE-2021-41599Improper control flow in GitHub Enterprise Server hosted Pages leads to remote code executionGitHub Enterprise Server
- CVE-2021-3155snapd created ~/snap with too-wide permissionsCanonical snapd
- CVE-2021-46319Remote Code Execution (RCE) vulnerability exists in D-Link Router DIR-846 DIR846A1_FW100A43.bin and DIR846enFW100A53DLA-Retail.bin.
- CVE-2021-46315Remote Command Execution (RCE) vulnerability exists in HNAP1/control/SetWizardConfig.php in D-Link Router DIR-846 DIR846A1_FW100A43.bin and
- CVE-2022-22916O2OA v6.4.7 was discovered to contain a remote code execution (RCE) vulnerability via /x_program_center/jaxrs/invoke.
- CVE-2021-46314A Remote Command Execution (RCE) vulnerability exists in HNAP1/control/SetNetworkTomographySettings.php of D-Link Router DIR-846 DIR846A1_FW
- CVE-2022-22914An incorrect access control issue in the component FileManager of Ovidentia CMS 6.0 allows authenticated attackers to to view and download c
- CVE-2022-23646Improper CSP in Image Optimization API for Next.jsvercel next.js · next
- CVE-2014-8597A reflected cross-site scripting (XSS) vulnerability in PHP-Fusion 7.02.07 allows remote attackers to inject arbitrary web script or HTML vi
- CVE-2022-22912Prototype pollution vulnerability via .parse() in Plist before v3.0.4 allows attackers to cause a Denial of Service (DoS) and may lead to replist
- CVE-2022-0633UpdraftPlus Free < 1.22.3 & Premium < 2.22.3 - Subscriber+ Backup DownloadUpdraftPlus WordPress Backup Plugin
- CVE-2021-46247The use of a hard-coded cryptographic key significantly increases the possibility encrypted data may be recovered from ASUS CMAX6000 v1.02.0
- CVE-2022-24683HashiCorp Nomad and Nomad Enterprise 0.9.2 through 1.0.17, 1.1.11, and 1.2.5 allow operators with read-fs and alloc-exec (or job-submit) capgithub.com/hashicorp/nomad
- CVE-2022-0638Cross-Site Request Forgery (CSRF) in microweber/microwebermicroweber/microweber
- CVE-2021-39034IBM MQ 9.1 LTS is vulnerable to a denial of service attack caused by an issue within the channel process.IBM MQ
- CVE-2021-44868A problem was found in ming-soft MCMS v5.1.net.mingsoft:ms-mcms
- CVE-2022-20750Cisco Redundancy Configuration Manager for Cisco StarOS Software TCP Denial of Service VulnerabilityCisco Redundancy Configuration Manager
- CVE-2022-20659Cisco Prime Infrastructure and Evolved Programmable Network Manager Cross-Site Scripting VulnerabilityCisco Prime Infrastructure
- CVE-2022-23319A segmentation fault during PCF file parsing in pcf2bdf versions >=1.05 allows an attacker to trigger a program crash via a specially crafte
- CVE-2022-22899Core FTP / SFTP Server v2 Build 725 was discovered to allow unauthenticated attackers to cause a Denial of Service (DoS) via a crafted packe
- CVE-2022-23318A heap-buffer-overflow in pcf2bdf, versions >= 1.05 allows an attacker to trigger unsafe memory access via a specially crafted PCF font file
- CVE-2021-46368TRIGONE Remote System Monitor 3.61 is vulnerable to an unquoted path service allowing local users to launch processes with elevated privileg
- CVE-2022-0623Out-of-bounds Read in mruby/mrubymruby/mruby
- CVE-2022-24953The Crypt_GPG extension before 1.6.7 for PHP does not prevent additional options in GPG calls, which presents a risk for certain environmentpear/crypt_gpg
- CVE-2022-22901There is an Assertion in 'context_p->next_scanner_info_p->type == SCANNER_TYPE_FUNCTION' failed at parser_parse_function_arguments in /js/js
- CVE-2022-0622Generation of Error Message Containing Sensitive Information in snipe/snipe-itsnipe/snipe-it
- CVE-2022-0639Authorization Bypass Through User-Controlled Key in unshiftio/url-parseunshiftio/url-parse · url-parse