CVEs published February 22, 2022
52 CVEs were published on February 22, 2022: 0 critical, 15 high.
- Published
- 52
- Critical
- 0
- High
- 15
- Medium
- 6
- Low
- 0
- Unrated
- 31
- Now in CISA KEV
- 0
- Fix available
- 23
Most affected products
- envoyproxy envoy
- 8
- francoisjacquet/rosariosis
- 3
- radareorg/radare2
- 3
- Siemens Simcenter Femap
- 2
- Zyxel ARMOR Z2 (NBG6817) firmware · Zyxel ARMOR Z1 (NBG6816…
- 2
- clastix capsule-proxy · github.com/clastix/capsule-proxy
- 1
- fgribreau/node-request-retry · requestretry
- 1
- istio · istio.io/istio
- 1
- openmrs-core
- 1
- pimcore/pimcore
- 1
High 15
- CVE-2022-0654Exposure of Sensitive Information to an Unauthorized Actor in fgribreau/node-request-retryfgribreau/node-request-retry · requestretry
- CVE-2022-23612Directory Traversal in OpenMRS Startup Filteropenmrs-core
- CVE-2021-43826Crash when tunneling TCP over HTTP in Envoyenvoyproxy envoy
- CVE-2022-21655Incorrect handling of internal redirects results in crash in Envoyenvoyproxy envoy
- CVE-2022-21654Incorrect configuration handling allows TLS session re-use without re-validation in Envoyenvoyproxy envoy
- CVE-2022-21656X.509 subjectAltName matching bypass in Envoyenvoyproxy envoy
- CVE-2021-43824Null pointer dereference in envoyenvoyproxy envoy
- CVE-2022-23635Unauthenticated control plane denial of service attack in Istioistio · istio.io/istio
- CVE-2022-23654Improper write access check in Requarks/wikiRequarks wiki
- CVE-2022-23652Privilege escalation using hop-by-hop Connection headerclastix capsule-proxy · github.com/clastix/capsule-proxy
- CVE-2021-4029A command injection vulnerability in the CGI program of the Zyxel ARMOR Z1/Z2 firmware could allow an attacker to execute arbitrary OS commaZyxel ARMOR Z2 (NBG6817) firmware · Zyxel ARMOR Z1 (NBG6816…
- CVE-2021-4030A cross-site request forgery vulnerability in the HTTP daemon of the Zyxel ARMOR Z1/Z2 firmware could allow an attacker to execute arbitraryZyxel ARMOR Z2 (NBG6817) firmware · Zyxel ARMOR Z1 (NBG6816…
- CVE-2022-0676Heap-based Buffer Overflow in radareorg/radare2radareorg/radare2
- CVE-2022-0714Heap-based Buffer Overflow in vim/vimvim/vim
- CVE-2022-23608Use after free in PJSIPpjsip pjproject
Medium, low and unrated 37
- CVE-2021-43825Use-after-free in Envoyenvoyproxy envoy
- CVE-2022-25418Tenda AC9 V15.03.2.21_cn was discovered to contain a stack overflow via the function openSchedWifi.
- CVE-2022-25417Tenda AC9 V15.03.2.21_cn was discovered to contain a stack overflow via the function saveparentcontrolinfo.
- CVE-2022-25414Tenda AC9 V15.03.2.21_cn was discovered to contain a stack overflow via the parameter NPTR.
- CVE-2022-25083TOTOLink A860R V4.1.2cu.5182_B20201027 was discovered to contain a command injection vulnerability in the "Main" function.
- CVE-2022-25084TOTOLink T6 V5.9c.4085_B20190428 was discovered to contain a command injection vulnerability in the "Main" function.
- CVE-2022-25082TOTOLink A950RG V5.9c.4050_B20190424 and V4.1.2cu.5204_B20210112 were discovered to contain a command injection vulnerability in the "Main"
- CVE-2022-25080TOTOLink A830R V5.9c.4729_B20191112 was discovered to contain a command injection vulnerability in the "Main" function.
- CVE-2022-25081TOTOLink T10 V5.9c.5061_B20200511 was discovered to contain a command injection vulnerability in the "Main" function.
- CVE-2022-25079TOTOLink A810R V4.1.2cu.5182_B20201026 was discovered to contain a command injection vulnerability in the "Main" function.
- CVE-2022-25077TOTOLink A3100R V4.1.2cu.5050_B20200504 was discovered to contain a command injection vulnerability in the "Main" function.
- CVE-2022-25078TOTOLink A3600R V4.1.2cu.5182_B20201102 was discovered to contain a command injection vulnerability in the "Main" function.
- CVE-2022-25075TOTOLink A3000RU V5.9c.2280_B20180512 was discovered to contain a command injection vulnerability in the "Main" function.
- CVE-2022-25076TOTOLink A800R V4.1.2cu.5137_B20200730 was discovered to contain a command injection vulnerability in the "Main" function.
- CVE-2022-25074TP-Link TL-WR902AC(US)_V3_191209 routers were discovered to contain a stack overflow in the function DM_ Fillobjbystr().
- CVE-2022-25072TP-Link Archer A54 Archer A54(US)_V1_210111 routers were discovered to contain a stack overflow in the function DM_ Fillobjbystr().
- CVE-2022-25073TL-WR841Nv14_US_0.9.1_4.18 routers were discovered to contain a stack overflow in the function dm_fillObjByStr().
- CVE-2022-21657X.509 Extended Key Usage and Trust Purposes bypass in Envoyenvoyproxy envoy
- CVE-2022-23606Crash when a cluster is deleted in Envoyenvoyproxy envoy
- CVE-2021-44967A Remote Code Execution (RCE) vulnerabilty exists in LimeSurvey 5.2.4 via the upload and install plugins function, which could let a remote
- CVE-2020-27467A Directory Traversal vulnerability exits in Processwire CMS before 2.7.1 via the download parameter to index.php.
- CVE-2021-44567An unauthenticated SQL Injection vulnerability exists in RosarioSIS before 7.6.1 via the votes parameter in ProgramFunctions/PortalPollsNotefrancoisjacquet/rosariosis
- CVE-2021-44566A Cross Site Scripting (XSS) vulnerability exists in RosarioSIS before 4.3 via the SanitizeMarkDown function in ProgramFunctions/MarkDownHTMfrancoisjacquet/rosariosis
- CVE-2021-44565A Cross Site Scripting (XSS) vulnerability exists in RosarioSIS before 7.6.1 via the xss_clean function in classes/Security.php, which allowfrancoisjacquet/rosariosis
- CVE-2022-0713Heap-based Buffer Overflow in radareorg/radare2radareorg/radare2
- CVE-2022-23043Zenario CMS 9.2 allows an authenticated admin user to bypass the file upload restriction by creating a new 'File/MIME Types' using the '.phaZenario CMS · tribalsystems/zenario
- CVE-2022-0712NULL Pointer Dereference in radareorg/radare2radareorg/radare2
- CVE-2021-46699A vulnerability has been identified in Simcenter Femap (All versions < V2022.1.1).Siemens Simcenter Femap
- CVE-2021-46162A vulnerability has been identified in Simcenter Femap (All versions < V2022.1.1).Siemens Simcenter Femap
- CVE-2022-0665Path Traversal in pimcore/pimcorepimcore/pimcore
- CVE-2022-24633All versions of FileCloud prior to 21.3 are vulnerable to user enumeration.
- CVE-2022-24582Accounting Journal Management 1.0 is vulnerable to XSS-PHPSESSID-Hijacking.
- CVE-2022-24565Checkmk <=2.0.0p19 Fixed in 2.0.0p20 and Checkmk <=1.6.0p27 Fixed in 1.6.0p28 are affected by a Cross Site Scripting (XSS) vulnerability.
- CVE-2022-25636net/netfilter/nf_dup_netdev.c in the Linux kernel 5.4 through 5.6.10 allows local users to gain privileges because of a heap out-of-bounds w
- CVE-2021-25636Incorrect trust validation of signature with ambiguous KeyInfo childrenThe Document Foundation LibreOffice
- CVE-2022-24599In autofile Audio File Library 0.3.6, there exists one memory leak vulnerability in printfileinfo, in printinfo.c, which allows an attacker
- CVE-2022-25643seatd-launch in seatd 0.6.x before 0.6.4 allows removing files with escalated privileges when installed setuid root.