# CVEs published 2022-02-19

16 CVEs were published on February 19, 2022: 0 critical, 4 high. Days are UTC.

- [CVE-2021-46700](https://cve.now/CVE-2021-46700.md): In libsixel 1.8.6, sixel\_encoder\_output\_without\_macro (called from sixel\_encoder\_encode\_frame in encoder.c) has a double free. (no CVSS)
- [CVE-2016-1239](https://cve.now/CVE-2016-1239.md): duck before 0.10 did not properly handle loading of untrusted code from the current directory. (no CVSS, Debian duck)
- [CVE-2022-0690](https://cve.now/CVE-2022-0690.md): Cross-site Scripting (XSS) - Reflected in microweber/microweber (CVSS 8.8, microweber/microweber)
- [CVE-2022-0689](https://cve.now/CVE-2022-0689.md): Use multiple time the one-time coupon in microweber/microweber (CVSS 5.3, microweber/microweber)
- [CVE-2022-23375](https://cve.now/CVE-2022-23375.md): WikiDocs version 0.1.18 has an authenticated remote code execution vulnerability. (no CVSS)
- [CVE-2022-23376](https://cve.now/CVE-2022-23376.md): WikiDocs version 0.1.18 has multiple reflected XSS vulnerabilities on different pages. (no CVSS)
- [CVE-2022-0632](https://cve.now/CVE-2022-0632.md): NULL Pointer Dereference in mruby/mruby (CVSS 5.5, mruby/mruby)
- [CVE-2022-0630](https://cve.now/CVE-2022-0630.md): Out-of-bounds Read in mruby/mruby (CVSS 7.1, mruby/mruby)
- [CVE-2022-0678](https://cve.now/CVE-2022-0678.md): Cross-site Scripting (XSS) - Reflected in microweber/microweber (CVSS 6.5, microweber/microweber)
- [CVE-2022-0409](https://cve.now/CVE-2022-0409.md): Unrestricted Upload of File with Dangerous Type in star7th/showdoc (CVSS 7.2, star7th/showdoc · showdoc/showdoc)
- [CVE-2016-20013](https://cve.now/CVE-2016-20013.md): sha256crypt and sha512crypt through 0.6 allow attackers to cause a denial of service (CPU consumption) because the algorithm's runtime is pr (no CVSS)
- [CVE-2022-24980](https://cve.now/CVE-2022-24980.md): An issue was discovered in the Kitodo.Presentation (aka dif) extension before 2.3.2, 3.x before 3.2.3, and 3.3.x before 3.3.4 for TYPO3. (no CVSS, kitodo/presentation)
- [CVE-2022-24979](https://cve.now/CVE-2022-24979.md): An issue was discovered in the Varnishcache extension before 2.0.1 for TYPO3. (no CVSS)
- [CVE-2022-25366](https://cve.now/CVE-2022-25366.md): Cryptomator through 1.6.5 allows DYLIB injection because, although it has the flag 0x1000 for Hardened Runtime, it has the com.apple.securit (no CVSS)
- [CVE-2022-25365](https://cve.now/CVE-2022-25365.md): Docker Desktop before 4.5.1 on Windows allows attackers to move arbitrary files. (CVSS 7.8)
- [CVE-2022-25256](https://cve.now/CVE-2022-25256.md): SAS Web Report Studio 4.4 allows XSS. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-02-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.