# CVEs published 2022-02-17

34 CVEs were published on February 17, 2022: 1 critical, 6 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2021-41599](https://cve.now/CVE-2021-41599.md): Improper control flow in GitHub Enterprise Server hosted Pages leads to remote code execution (no CVSS, GitHub Enterprise Server)
- [CVE-2021-4120](https://cve.now/CVE-2021-4120.md): snapd could be made to bypass intended access restrictions through snap content interfaces and layout paths (CVSS 8.2, Canonical snapd)
- [CVE-2021-44730](https://cve.now/CVE-2021-44730.md): snapd could be made to escalate privileges and run programs as administrator (CVSS 7.8, Canonical snapd)
- [CVE-2021-3155](https://cve.now/CVE-2021-3155.md): snapd created ~/snap with too-wide permissions (CVSS 3.8, Canonical snapd)
- [CVE-2021-46319](https://cve.now/CVE-2021-46319.md): Remote Code Execution (RCE) vulnerability exists in D-Link Router DIR-846 DIR846A1\_FW100A43.bin and DIR846enFW100A53DLA-Retail.bin. (no CVSS)
- [CVE-2021-46315](https://cve.now/CVE-2021-46315.md): Remote Command Execution (RCE) vulnerability exists in HNAP1/control/SetWizardConfig.php in D-Link Router DIR-846 DIR846A1\_FW100A43.bin and (no CVSS)
- [CVE-2022-22916](https://cve.now/CVE-2022-22916.md): O2OA v6.4.7 was discovered to contain a remote code execution (RCE) vulnerability via /x\_program\_center/jaxrs/invoke. (no CVSS)
- [CVE-2021-46314](https://cve.now/CVE-2021-46314.md): A Remote Command Execution (RCE) vulnerability exists in HNAP1/control/SetNetworkTomographySettings.php of D-Link Router DIR-846 DIR846A1\_FW (no CVSS)
- [CVE-2022-22914](https://cve.now/CVE-2022-22914.md): An incorrect access control issue in the component FileManager of Ovidentia CMS 6.0 allows authenticated attackers to to view and download c (no CVSS)
- [CVE-2022-23646](https://cve.now/CVE-2022-23646.md): Improper CSP in Image Optimization API for Next.js (CVSS 5.9, vercel next.js · next)
- [CVE-2021-45382](https://cve.now/CVE-2021-45382.md): A Remote Command Execution (RCE) vulnerability exists in all series H/W revisions D-link DIR-810L, DIR-820L/LW, DIR-826L, DIR-830L, and DIR- (CVSS 9.8, KEV)
- [CVE-2014-8597](https://cve.now/CVE-2014-8597.md): A reflected cross-site scripting (XSS) vulnerability in PHP-Fusion 7.02.07 allows remote attackers to inject arbitrary web script or HTML vi (no CVSS)
- [CVE-2022-22912](https://cve.now/CVE-2022-22912.md): Prototype pollution vulnerability via .parse() in Plist before v3.0.4 allows attackers to cause a Denial of Service (DoS) and may lead to re (no CVSS, plist)
- [CVE-2022-0633](https://cve.now/CVE-2022-0633.md): UpdraftPlus Free \< 1.22.3 & Premium \< 2.22.3 - Subscriber+ Backup Download (no CVSS, UpdraftPlus WordPress Backup Plugin)
- [CVE-2021-46247](https://cve.now/CVE-2021-46247.md): The use of a hard-coded cryptographic key significantly increases the possibility encrypted data may be recovered from ASUS CMAX6000 v1.02.0 (no CVSS)
- [CVE-2022-24683](https://cve.now/CVE-2022-24683.md): HashiCorp Nomad and Nomad Enterprise 0.9.2 through 1.0.17, 1.1.11, and 1.2.5 allow operators with read-fs and alloc-exec (or job-submit) cap (no CVSS, github.com/hashicorp/nomad)
- [CVE-2022-0638](https://cve.now/CVE-2022-0638.md): Cross-Site Request Forgery (CSRF) in microweber/microweber (CVSS 4.3, microweber/microweber)
- [CVE-2021-39034](https://cve.now/CVE-2021-39034.md): IBM MQ 9.1 LTS is vulnerable to a denial of service attack caused by an issue within the channel process. (CVSS 5.3, IBM MQ)
- [CVE-2021-44868](https://cve.now/CVE-2021-44868.md): A problem was found in ming-soft MCMS v5.1. (no CVSS, net.mingsoft:ms-mcms)
- [CVE-2022-20653](https://cve.now/CVE-2022-20653.md): Cisco Email Security Appliance DNS Verification Denial of Service Vulnerability (CVSS 7.5, Cisco Email Security Appliance)
- [CVE-2022-20750](https://cve.now/CVE-2022-20750.md): Cisco Redundancy Configuration Manager for Cisco StarOS Software TCP Denial of Service Vulnerability (CVSS 5.3, Cisco Redundancy Configuration Manager)
- [CVE-2022-20659](https://cve.now/CVE-2022-20659.md): Cisco Prime Infrastructure and Evolved Programmable Network Manager Cross-Site Scripting Vulnerability (CVSS 6.1, Cisco Prime Infrastructure)
- [CVE-2022-23632](https://cve.now/CVE-2022-23632.md): Traefik skips the router TLS configuration when the host header is an FQDN (CVSS 7.4, traefik · github.com/traefik/traefik/v2 +1)
- [CVE-2022-23319](https://cve.now/CVE-2022-23319.md): A segmentation fault during PCF file parsing in pcf2bdf versions \>=1.05 allows an attacker to trigger a program crash via a specially crafte (no CVSS)
- [CVE-2022-22899](https://cve.now/CVE-2022-22899.md): Core FTP / SFTP Server v2 Build 725 was discovered to allow unauthenticated attackers to cause a Denial of Service (DoS) via a crafted packe (no CVSS)
- [CVE-2022-23318](https://cve.now/CVE-2022-23318.md): A heap-buffer-overflow in pcf2bdf, versions \>= 1.05 allows an attacker to trigger unsafe memory access via a specially crafted PCF font file (no CVSS)
- [CVE-2021-46368](https://cve.now/CVE-2021-46368.md): TRIGONE Remote System Monitor 3.61 is vulnerable to an unquoted path service allowing local users to launch processes with elevated privileg (no CVSS)
- [CVE-2022-0623](https://cve.now/CVE-2022-0623.md): Out-of-bounds Read in mruby/mruby (CVSS 6.5, mruby/mruby)
- [CVE-2022-24953](https://cve.now/CVE-2022-24953.md): The Crypt\_GPG extension before 1.6.7 for PHP does not prevent additional options in GPG calls, which presents a risk for certain environment (no CVSS, pear/crypt\_gpg)
- [CVE-2022-22901](https://cve.now/CVE-2022-22901.md): There is an Assertion in 'context\_p-\>next\_scanner\_info\_p-\>type == SCANNER\_TYPE\_FUNCTION' failed at parser\_parse\_function\_arguments in /js/js (no CVSS)
- [CVE-2022-0622](https://cve.now/CVE-2022-0622.md): Generation of Error Message Containing Sensitive Information in snipe/snipe-it (CVSS 5.3, snipe/snipe-it)
- [CVE-2021-44731](https://cve.now/CVE-2021-44731.md): snapd could be made to escalate privileges and run programs as administrator (CVSS 7.8, Canonical snapd)
- [CVE-2022-0629](https://cve.now/CVE-2022-0629.md): Stack-based Buffer Overflow in vim/vim (CVSS 8.4, vim/vim)
- [CVE-2022-0639](https://cve.now/CVE-2022-0639.md): Authorization Bypass Through User-Controlled Key in unshiftio/url-parse (CVSS 6.5, unshiftio/url-parse · url-parse)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-02-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.