# CVEs published 2022-02-21

49 CVEs were published on February 21, 2022: 0 critical, 4 high. Days are UTC.

- [CVE-2022-24564](https://cve.now/CVE-2022-24564.md): Checkmk \<=2.0.0p19 contains a Cross Site Scripting (XSS) vulnerability. (no CVSS)
- [CVE-2022-22308](https://cve.now/CVE-2022-22308.md): IBM Planning Analytics 2.0 is vulnerable to a Remote File Include (RFI) attack. (CVSS 7.1, IBM Planning Analytics)
- [CVE-2021-27797](https://cve.now/CVE-2021-27797.md): Brocade Fabric OS before Brocade Fabric OS v8.2.1c, v8.1.2h, and all versions of Brocade Fabric OS v8.0.x and v7.x contain documented hard-c (no CVSS, Brocade Fabric OS)
- [CVE-2021-26256](https://cve.now/CVE-2021-26256.md): WordPress Survey Maker plugin \<= 2.0.6 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability (CVSS 4.7, Survey Maker team Survey Maker)
- [CVE-2021-27796](https://cve.now/CVE-2021-27796.md): A vulnerability in Brocade Fabric OS versions before Brocade Fabric OS v8.0.1b, v7.4.1d could allow an authenticated attacker within the res (no CVSS, Brocade Fabric OS)
- [CVE-2022-25599](https://cve.now/CVE-2022-25599.md): WordPress Spiffy Calendar plugin \<= 4.9.0 - Event deletion via Cross-Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Spiffy Plugins Spiffy Calendar)
- [CVE-2022-24295](https://cve.now/CVE-2022-24295.md): Okta Advanced Server Access Client for Windows prior to version 1.57.0 was found to be vulnerable to command injection via a specially craft (no CVSS, Okta Advanced Server Access Client)
- [CVE-2022-23984](https://cve.now/CVE-2022-23984.md): WordPress wpDiscuz plugin \<= 7.3.11 - Sensitive Information Disclosure (CVSS 3.7, gVectors Team Comments – wpDiscuz)
- [CVE-2022-23983](https://cve.now/CVE-2022-23983.md): WordPress WP Content Copy Protection & No Right Click plugin \<= 3.4.4 - Cross-Site Request Forgery (CSRF) leads to Settings Update vulnerability (CVSS 4.3, WP-buy WP Content Copy Protection & No Right Click)
- [CVE-2022-0708](https://cve.now/CVE-2022-0708.md): Team Creator's Email Address is disclosed to Team Members via one of the APIs (CVSS 4.3, Mattermost)
- [CVE-2021-27753](https://cve.now/CVE-2021-27753.md): "Sametime Android PathTraversal Vulnerability" (no CVSS, "HCL Sametime")
- [CVE-2021-27755](https://cve.now/CVE-2021-27755.md): "Sametime Android potential path traversal vulnerability when using File class" (no CVSS, "HCL Sametime")
- [CVE-2021-44568](https://cve.now/CVE-2021-44568.md): Two heap-overflow vulnerabilities exist in openSUSE/libsolv libsolv through 13 Dec 2020 in the decisionmap variable via the resolve\_dependen (no CVSS)
- [CVE-2021-44142](https://cve.now/CVE-2021-44142.md): The Samba vfs\_fruit module uses extended file attributes (EA, xattr) to provide "...enhanced compatibility with Apple SMB clients and intero (CVSS 8.8, Samba)
- [CVE-2022-0692](https://cve.now/CVE-2022-0692.md): Open Redirect on Rudloff/alltube in rudloff/alltube (CVSS 4.7, rudloff/alltube)
- [CVE-2022-24553](https://cve.now/CVE-2022-24553.md): An issue was found in Zfaka \<= 1.4.5. (no CVSS)
- [CVE-2021-45008](https://cve.now/CVE-2021-45008.md): Plesk CMS 18.0.37 is affected by an insecure permissions vulnerability that allows privilege Escalation from user to admin rights. (CVSS 8.8)
- [CVE-2022-0313](https://cve.now/CVE-2022-0313.md): Float Menu \< 4.3.1 - Arbitrary Menu Deletion via CSRF (no CVSS, Float menu – awesome floating side menu)
- [CVE-2022-0288](https://cve.now/CVE-2022-0288.md): Ad Inserter \< 2.7.10 - Reflected Cross-Site Scripting (no CVSS, Ad Inserter – Ad Manager & AdSense Ads · Ad Inserter Pro)
- [CVE-2022-0279](https://cve.now/CVE-2022-0279.md): AnyComment \< 0.2.18 - Comment Rating Increase/Decrease via Race Condition (no CVSS, AnyComment)
- [CVE-2022-0255](https://cve.now/CVE-2022-0255.md): Database Backup for WordPress \< 2.5.1 - Admin+ SQL Injection (no CVSS, Database Backup for WordPress)
- [CVE-2022-0252](https://cve.now/CVE-2022-0252.md): Give \< 2.17.3 - Reflected Cross-Site Scripting via Import Tool (no CVSS, GiveWP – Donation Plugin and Fundraising Platform)
- [CVE-2022-0234](https://cve.now/CVE-2022-0234.md): WOOCS \< 1.3.7.5 - Reflected Cross-Site Scripting (no CVSS, WOOCS – Currency Switcher for WooCommerce. Professional and…)
- [CVE-2022-0228](https://cve.now/CVE-2022-0228.md): Popup Builder \< 4.0.7 - Admin+ SQL Injection (no CVSS, Popup Builder – Create highly converting, mobile friendly m…)
- [CVE-2022-0211](https://cve.now/CVE-2022-0211.md): Shield Security \< 13.0.6 - Admin+ Stored Cross-Site Scripting (no CVSS, Shield Security – Scanners, Security Hardening, Brute Force…)
- [CVE-2022-0199](https://cve.now/CVE-2022-0199.md): Coming soon and Maintenance mode \< 3.6.8 - Arbitrary Email Sending to Subscribed Users via CSRF (no CVSS, Coming soon and Maintenance mode)
- [CVE-2022-0186](https://cve.now/CVE-2022-0186.md): Image Photo Gallery Final Tiles Grid \< 3.5.3 - Contributor+ Stored Cross-Site Scripting (no CVSS, Image Photo Gallery Final Tiles Grid)
- [CVE-2022-0164](https://cve.now/CVE-2022-0164.md): Coming soon and Maintenance mode \< 3.6.7 - Subscriber+ Arbitrary Email Sending to Subscribed Users (no CVSS, Coming soon and Maintenance mode)
- [CVE-2022-0134](https://cve.now/CVE-2022-0134.md): AnyComment \< 0.2.18 - Arbitrary HyperComments Import/Revert via CSRF (no CVSS, AnyComment)
- [CVE-2021-4208](https://cve.now/CVE-2021-4208.md): ExportFeed \<= 2.0.1.0 - Admin+ SQL Injection (no CVSS, ExportFeed: List WooCommerce Products on eBay Store)
- [CVE-2021-25101](https://cve.now/CVE-2021-25101.md): Anti-Malware Security and Brute-Force Firewall \< 4.20.94 - Admin+ Reflected Cross-Site Scripting (no CVSS, Anti-Malware Security and Brute-Force Firewall)
- [CVE-2021-25100](https://cve.now/CVE-2021-25100.md): Give \< 2.17.3 - Reflected Cross-Site Scripting via Donation Forms Dashboard (no CVSS, GiveWP – Donation Plugin and Fundraising Platform)
- [CVE-2021-25099](https://cve.now/CVE-2021-25099.md): Give \< 2.17.3 - Unauthenticated Reflected Cross-Site Scripting (no CVSS, GiveWP – Donation Plugin and Fundraising Platform)
- [CVE-2021-25082](https://cve.now/CVE-2021-25082.md): Popup Builder \< 4.0.7 - LFI to RCE (no CVSS, Popup Builder – Create highly converting, mobile friendly m…)
- [CVE-2021-25075](https://cve.now/CVE-2021-25075.md): Duplicate Page or Post \< 1.5.1 - Arbitrary Settings Update to Stored XSS (no CVSS, Duplicate Page or Post)
- [CVE-2021-25069](https://cve.now/CVE-2021-25069.md): WordPress Download Manager \< 3.2.34 - Authenticated SQL Injection to Reflected XSS (no CVSS, Download Manager)
- [CVE-2021-25060](https://cve.now/CVE-2021-25060.md): Five Star Business Profile and Schema \< 2.1.7 - Subscriber+ Page Creation & Settings Update to Stored XSS (no CVSS, Five Star Business Profile and Schema)
- [CVE-2021-25058](https://cve.now/CVE-2021-25058.md): The Buffer Button \<= 1.0 - Authenticated Stored Cross Site Scripting (XSS) (no CVSS, The Buffer Button)
- [CVE-2021-25057](https://cve.now/CVE-2021-25057.md): Translation Exchange \<= 1.0.14 - Authenticated Stored Cross-Site Scripting (XSS) (no CVSS, Translation Exchange – Translate Your WordPress Site In Min…)
- [CVE-2021-25055](https://cve.now/CVE-2021-25055.md): FeedWordPress \< 2022.0123 - Reflected Cross-Site Scripting (XSS) (no CVSS, FeedWordPress)
- [CVE-2021-24921](https://cve.now/CVE-2021-24921.md): Advanced Database Cleaner \< 3.0.4 - Reflected Cross-Site Scripting (no CVSS, Advanced Database Cleaner)
- [CVE-2021-24867](https://cve.now/CVE-2021-24867.md): Backdoored Plugins & Themes from AccessPress Themes (no CVSS, AccessPress Themes Frontend Post WordPress Plugin – Acc… +91)
- [CVE-2022-25297](https://cve.now/CVE-2022-25297.md): Arbitrary File Write (CVSS 7.5, drogonframework/drogon)
- [CVE-2021-4115](https://cve.now/CVE-2021-4115.md): There is a flaw in polkit which can allow an unprivileged user to cause polkit to crash, due to process file descriptor exhaustion. (no CVSS, polkitd)
- [CVE-2021-44141](https://cve.now/CVE-2021-44141.md): All versions of Samba prior to 4.15.5 are vulnerable to a malicious client using a server symlink to determine if a file or directory exists (no CVSS, Samba)
- [CVE-2022-0563](https://cve.now/CVE-2022-0563.md): A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. (CVSS 5.5, util-linux)
- [CVE-2022-0564](https://cve.now/CVE-2022-0564.md): Qlik Sense Enterprise Domain User enumeration (CVSS 5.3, Qlik Sense Enterprise on Windows)
- [CVE-2022-0691](https://cve.now/CVE-2022-0691.md): Authorization Bypass Through User-Controlled Key in unshiftio/url-parse (CVSS 6.5, unshiftio/url-parse · url-parse)
- [CVE-2022-0696](https://cve.now/CVE-2022-0696.md): NULL Pointer Dereference in vim/vim (CVSS 6.2, vim/vim)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-02-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.