# CVEs published 2022-02-20

13 CVEs were published on February 20, 2022: 1 critical, 2 high. Days are UTC.

- [CVE-2021-46701](https://cve.now/CVE-2021-46701.md): PreMiD 2.2.0 allows unintended access via the websocket transport. (CVSS 7.2)
- [CVE-2022-25375](https://cve.now/CVE-2022-25375.md): An issue was discovered in drivers/usb/gadget/function/rndis.c in the Linux kernel before 5.16.10. (no CVSS)
- [CVE-2022-25372](https://cve.now/CVE-2022-25372.md): Pritunl Client through 1.2.3019.52 on Windows allows local privilege escalation, related to an ACL entry for CREATOR OWNER in platform\_windo (no CVSS)
- [CVE-2022-23054](https://cve.now/CVE-2022-23054.md): Openmct XSS via the “Summary Widget” (CVSS 6.1, nasa openmct)
- [CVE-2022-23053](https://cve.now/CVE-2022-23053.md): Openmct XSS via the “Condition Widget” (CVSS 6.1, nasa openmct)
- [CVE-2022-22126](https://cve.now/CVE-2022-22126.md): Openmct XSS via the “Web Page” element (CVSS 6.1, nasa openmct)
- [CVE-2022-23848](https://cve.now/CVE-2022-23848.md): In Alluxio before 2.7.3, the logserver does not validate the input stream. (no CVSS, org.alluxio:alluxio-core-common)
- [CVE-2021-45083](https://cve.now/CVE-2021-45083.md): An issue was discovered in Cobbler before 3.3.1. (no CVSS, cobbler)
- [CVE-2021-45081](https://cve.now/CVE-2021-45081.md): An issue was discovered in Cobbler through 3.3.1. (no CVSS)
- [CVE-2022-0688](https://cve.now/CVE-2022-0688.md): Business Logic Errors in microweber/microweber (CVSS 9.4, microweber/microweber)
- [CVE-2021-45007](https://cve.now/CVE-2021-45007.md): Plesk 18.0.37 is affected by a Cross Site Request Forgery (CSRF) vulnerability that allows an attacker to insert data on the user and admin (no CVSS)
- [CVE-2022-0685](https://cve.now/CVE-2022-0685.md): Use of Out-of-range Pointer Offset in vim/vim (CVSS 8.4, vim/vim)
- [CVE-2022-0686](https://cve.now/CVE-2022-0686.md): Authorization Bypass Through User-Controlled Key in unshiftio/url-parse (CVSS 6.5, unshiftio/url-parse · url-parse)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-02-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.