CVEs published February 21, 2022
49 CVEs were published on February 21, 2022: 0 critical, 4 high.
- Published
- 49
- Critical
- 0
- High
- 4
- Medium
- 9
- Low
- 1
- Unrated
- 35
- Now in CISA KEV
- 0
- Fix available
- 28
Most affected products
- GiveWP – Donation Plugin and Fundraising Platform
- 3
- "HCL Sametime"
- 2
- AnyComment
- 2
- Brocade Fabric OS
- 2
- Coming soon and Maintenance mode
- 2
- Popup Builder – Create highly converting, mobile friendly m…
- 2
- Samba
- 2
- AccessPress Themes Frontend Post WordPress Plugin – Acc… +91
- 1
- Ad Inserter – Ad Manager & AdSense Ads · Ad Inserter Pro
- 1
- Advanced Database Cleaner
- 1
High 4
- CVE-2022-22308IBM Planning Analytics 2.0 is vulnerable to a Remote File Include (RFI) attack.IBM Planning Analytics
- CVE-2021-44142The Samba vfs_fruit module uses extended file attributes (EA, xattr) to provide "...enhanced compatibility with Apple SMB clients and interoSamba
- CVE-2021-45008Plesk CMS 18.0.37 is affected by an insecure permissions vulnerability that allows privilege Escalation from user to admin rights.
- CVE-2022-25297Arbitrary File Writedrogonframework/drogon
Medium, low and unrated 45
- CVE-2022-24564Checkmk <=2.0.0p19 contains a Cross Site Scripting (XSS) vulnerability.
- CVE-2021-27797Brocade Fabric OS before Brocade Fabric OS v8.2.1c, v8.1.2h, and all versions of Brocade Fabric OS v8.0.x and v7.x contain documented hard-cBrocade Fabric OS
- CVE-2021-26256WordPress Survey Maker plugin <= 2.0.6 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerabilitySurvey Maker team Survey Maker
- CVE-2021-27796A vulnerability in Brocade Fabric OS versions before Brocade Fabric OS v8.0.1b, v7.4.1d could allow an authenticated attacker within the resBrocade Fabric OS
- CVE-2022-25599WordPress Spiffy Calendar plugin <= 4.9.0 - Event deletion via Cross-Site Request Forgery (CSRF) vulnerabilitySpiffy Plugins Spiffy Calendar
- CVE-2022-24295Okta Advanced Server Access Client for Windows prior to version 1.57.0 was found to be vulnerable to command injection via a specially craftOkta Advanced Server Access Client
- CVE-2022-23984WordPress wpDiscuz plugin <= 7.3.11 - Sensitive Information DisclosuregVectors Team Comments – wpDiscuz
- CVE-2022-23983WordPress WP Content Copy Protection & No Right Click plugin <= 3.4.4 - Cross-Site Request Forgery (CSRF) leads to Settings Update vulnerabilityWP-buy WP Content Copy Protection & No Right Click
- CVE-2022-0708Team Creator's Email Address is disclosed to Team Members via one of the APIsMattermost
- CVE-2021-27753"Sametime Android PathTraversal Vulnerability""HCL Sametime"
- CVE-2021-27755"Sametime Android potential path traversal vulnerability when using File class""HCL Sametime"
- CVE-2021-44568Two heap-overflow vulnerabilities exist in openSUSE/libsolv libsolv through 13 Dec 2020 in the decisionmap variable via the resolve_dependen
- CVE-2022-0692Open Redirect on Rudloff/alltube in rudloff/alltuberudloff/alltube
- CVE-2022-24553An issue was found in Zfaka <= 1.4.5.
- CVE-2022-0313Float Menu < 4.3.1 - Arbitrary Menu Deletion via CSRFFloat menu – awesome floating side menu
- CVE-2022-0288Ad Inserter < 2.7.10 - Reflected Cross-Site ScriptingAd Inserter – Ad Manager & AdSense Ads · Ad Inserter Pro
- CVE-2022-0279AnyComment < 0.2.18 - Comment Rating Increase/Decrease via Race ConditionAnyComment
- CVE-2022-0255Database Backup for WordPress < 2.5.1 - Admin+ SQL InjectionDatabase Backup for WordPress
- CVE-2022-0252Give < 2.17.3 - Reflected Cross-Site Scripting via Import ToolGiveWP – Donation Plugin and Fundraising Platform
- CVE-2022-0234WOOCS < 1.3.7.5 - Reflected Cross-Site ScriptingWOOCS – Currency Switcher for WooCommerce. Professional and…
- CVE-2022-0228Popup Builder < 4.0.7 - Admin+ SQL InjectionPopup Builder – Create highly converting, mobile friendly m…
- CVE-2022-0211Shield Security < 13.0.6 - Admin+ Stored Cross-Site ScriptingShield Security – Scanners, Security Hardening, Brute Force…
- CVE-2022-0199Coming soon and Maintenance mode < 3.6.8 - Arbitrary Email Sending to Subscribed Users via CSRFComing soon and Maintenance mode
- CVE-2022-0186Image Photo Gallery Final Tiles Grid < 3.5.3 - Contributor+ Stored Cross-Site ScriptingImage Photo Gallery Final Tiles Grid
- CVE-2022-0164Coming soon and Maintenance mode < 3.6.7 - Subscriber+ Arbitrary Email Sending to Subscribed UsersComing soon and Maintenance mode
- CVE-2022-0134AnyComment < 0.2.18 - Arbitrary HyperComments Import/Revert via CSRFAnyComment
- CVE-2021-4208ExportFeed <= 2.0.1.0 - Admin+ SQL InjectionExportFeed: List WooCommerce Products on eBay Store
- CVE-2021-25101Anti-Malware Security and Brute-Force Firewall < 4.20.94 - Admin+ Reflected Cross-Site ScriptingAnti-Malware Security and Brute-Force Firewall
- CVE-2021-25100Give < 2.17.3 - Reflected Cross-Site Scripting via Donation Forms DashboardGiveWP – Donation Plugin and Fundraising Platform
- CVE-2021-25099Give < 2.17.3 - Unauthenticated Reflected Cross-Site ScriptingGiveWP – Donation Plugin and Fundraising Platform
- CVE-2021-25082Popup Builder < 4.0.7 - LFI to RCEPopup Builder – Create highly converting, mobile friendly m…
- CVE-2021-25075Duplicate Page or Post < 1.5.1 - Arbitrary Settings Update to Stored XSSDuplicate Page or Post
- CVE-2021-25069WordPress Download Manager < 3.2.34 - Authenticated SQL Injection to Reflected XSSDownload Manager
- CVE-2021-25060Five Star Business Profile and Schema < 2.1.7 - Subscriber+ Page Creation & Settings Update to Stored XSSFive Star Business Profile and Schema
- CVE-2021-25058The Buffer Button <= 1.0 - Authenticated Stored Cross Site Scripting (XSS)The Buffer Button
- CVE-2021-25057Translation Exchange <= 1.0.14 - Authenticated Stored Cross-Site Scripting (XSS)Translation Exchange – Translate Your WordPress Site In Min…
- CVE-2021-25055FeedWordPress < 2022.0123 - Reflected Cross-Site Scripting (XSS)FeedWordPress
- CVE-2021-24921Advanced Database Cleaner < 3.0.4 - Reflected Cross-Site ScriptingAdvanced Database Cleaner
- CVE-2021-24867Backdoored Plugins & Themes from AccessPress ThemesAccessPress Themes Frontend Post WordPress Plugin – Acc… +91
- CVE-2021-4115There is a flaw in polkit which can allow an unprivileged user to cause polkit to crash, due to process file descriptor exhaustion.polkitd
- CVE-2021-44141All versions of Samba prior to 4.15.5 are vulnerable to a malicious client using a server symlink to determine if a file or directory existsSamba
- CVE-2022-0563A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support.util-linux
- CVE-2022-0564Qlik Sense Enterprise Domain User enumerationQlik Sense Enterprise on Windows
- CVE-2022-0691Authorization Bypass Through User-Controlled Key in unshiftio/url-parseunshiftio/url-parse · url-parse
- CVE-2022-0696NULL Pointer Dereference in vim/vimvim/vim