# CVEs published 2022-02-22

52 CVEs were published on February 22, 2022: 0 critical, 15 high. Days are UTC.

- [CVE-2022-0654](https://cve.now/CVE-2022-0654.md): Exposure of Sensitive Information to an Unauthorized Actor in fgribreau/node-request-retry (CVSS 8.1, fgribreau/node-request-retry · requestretry)
- [CVE-2022-23612](https://cve.now/CVE-2022-23612.md): Directory Traversal in OpenMRS Startup Filter (CVSS 7.5, openmrs-core)
- [CVE-2021-43826](https://cve.now/CVE-2021-43826.md): Crash when tunneling TCP over HTTP in Envoy (CVSS 7.5, envoyproxy envoy)
- [CVE-2021-43825](https://cve.now/CVE-2021-43825.md): Use-after-free in Envoy (CVSS 6.1, envoyproxy envoy)
- [CVE-2022-25418](https://cve.now/CVE-2022-25418.md): Tenda AC9 V15.03.2.21\_cn was discovered to contain a stack overflow via the function openSchedWifi. (no CVSS)
- [CVE-2022-25417](https://cve.now/CVE-2022-25417.md): Tenda AC9 V15.03.2.21\_cn was discovered to contain a stack overflow via the function saveparentcontrolinfo. (no CVSS)
- [CVE-2022-25414](https://cve.now/CVE-2022-25414.md): Tenda AC9 V15.03.2.21\_cn was discovered to contain a stack overflow via the parameter NPTR. (no CVSS)
- [CVE-2022-25083](https://cve.now/CVE-2022-25083.md): TOTOLink A860R V4.1.2cu.5182\_B20201027 was discovered to contain a command injection vulnerability in the "Main" function. (no CVSS)
- [CVE-2022-25084](https://cve.now/CVE-2022-25084.md): TOTOLink T6 V5.9c.4085\_B20190428 was discovered to contain a command injection vulnerability in the "Main" function. (no CVSS)
- [CVE-2022-25082](https://cve.now/CVE-2022-25082.md): TOTOLink A950RG V5.9c.4050\_B20190424 and V4.1.2cu.5204\_B20210112 were discovered to contain a command injection vulnerability in the "Main" (no CVSS)
- [CVE-2022-25080](https://cve.now/CVE-2022-25080.md): TOTOLink A830R V5.9c.4729\_B20191112 was discovered to contain a command injection vulnerability in the "Main" function. (no CVSS)
- [CVE-2022-25081](https://cve.now/CVE-2022-25081.md): TOTOLink T10 V5.9c.5061\_B20200511 was discovered to contain a command injection vulnerability in the "Main" function. (no CVSS)
- [CVE-2022-25079](https://cve.now/CVE-2022-25079.md): TOTOLink A810R V4.1.2cu.5182\_B20201026 was discovered to contain a command injection vulnerability in the "Main" function. (no CVSS)
- [CVE-2022-25077](https://cve.now/CVE-2022-25077.md): TOTOLink A3100R V4.1.2cu.5050\_B20200504 was discovered to contain a command injection vulnerability in the "Main" function. (no CVSS)
- [CVE-2022-25078](https://cve.now/CVE-2022-25078.md): TOTOLink A3600R V4.1.2cu.5182\_B20201102 was discovered to contain a command injection vulnerability in the "Main" function. (no CVSS)
- [CVE-2022-25075](https://cve.now/CVE-2022-25075.md): TOTOLink A3000RU V5.9c.2280\_B20180512 was discovered to contain a command injection vulnerability in the "Main" function. (no CVSS)
- [CVE-2022-25076](https://cve.now/CVE-2022-25076.md): TOTOLink A800R V4.1.2cu.5137\_B20200730 was discovered to contain a command injection vulnerability in the "Main" function. (no CVSS)
- [CVE-2022-25074](https://cve.now/CVE-2022-25074.md): TP-Link TL-WR902AC(US)\_V3\_191209 routers were discovered to contain a stack overflow in the function DM\_ Fillobjbystr(). (no CVSS)
- [CVE-2022-25072](https://cve.now/CVE-2022-25072.md): TP-Link Archer A54 Archer A54(US)\_V1\_210111 routers were discovered to contain a stack overflow in the function DM\_ Fillobjbystr(). (no CVSS)
- [CVE-2022-25073](https://cve.now/CVE-2022-25073.md): TL-WR841Nv14\_US\_0.9.1\_4.18 routers were discovered to contain a stack overflow in the function dm\_fillObjByStr(). (no CVSS)
- [CVE-2022-21655](https://cve.now/CVE-2022-21655.md): Incorrect handling of internal redirects results in crash in Envoy (CVSS 7.5, envoyproxy envoy)
- [CVE-2022-21654](https://cve.now/CVE-2022-21654.md): Incorrect configuration handling allows TLS session re-use without re-validation in Envoy (CVSS 7.4, envoyproxy envoy)
- [CVE-2022-21657](https://cve.now/CVE-2022-21657.md): X.509 Extended Key Usage and Trust Purposes bypass in Envoy (CVSS 6.8, envoyproxy envoy)
- [CVE-2022-21656](https://cve.now/CVE-2022-21656.md): X.509 subjectAltName matching bypass in Envoy (CVSS 7.4, envoyproxy envoy)
- [CVE-2022-23606](https://cve.now/CVE-2022-23606.md): Crash when a cluster is deleted in Envoy (CVSS 4.4, envoyproxy envoy)
- [CVE-2021-43824](https://cve.now/CVE-2021-43824.md): Null pointer dereference in envoy (CVSS 7.5, envoyproxy envoy)
- [CVE-2022-23635](https://cve.now/CVE-2022-23635.md): Unauthenticated control plane denial of service attack in Istio (CVSS 7.5, istio · istio.io/istio)
- [CVE-2021-44967](https://cve.now/CVE-2021-44967.md): A Remote Code Execution (RCE) vulnerabilty exists in LimeSurvey 5.2.4 via the upload and install plugins function, which could let a remote (no CVSS)
- [CVE-2020-27467](https://cve.now/CVE-2020-27467.md): A Directory Traversal vulnerability exits in Processwire CMS before 2.7.1 via the download parameter to index.php. (no CVSS)
- [CVE-2021-44567](https://cve.now/CVE-2021-44567.md): An unauthenticated SQL Injection vulnerability exists in RosarioSIS before 7.6.1 via the votes parameter in ProgramFunctions/PortalPollsNote (no CVSS, francoisjacquet/rosariosis)
- [CVE-2022-23654](https://cve.now/CVE-2022-23654.md): Improper write access check in Requarks/wiki (CVSS 8.1, Requarks wiki)
- [CVE-2021-44566](https://cve.now/CVE-2021-44566.md): A Cross Site Scripting (XSS) vulnerability exists in RosarioSIS before 4.3 via the SanitizeMarkDown function in ProgramFunctions/MarkDownHTM (no CVSS, francoisjacquet/rosariosis)
- [CVE-2021-44565](https://cve.now/CVE-2021-44565.md): A Cross Site Scripting (XSS) vulnerability exists in RosarioSIS before 7.6.1 via the xss\_clean function in classes/Security.php, which allow (no CVSS, francoisjacquet/rosariosis)
- [CVE-2022-23652](https://cve.now/CVE-2022-23652.md): Privilege escalation using hop-by-hop Connection header (CVSS 8.8, clastix capsule-proxy · github.com/clastix/capsule-proxy)
- [CVE-2022-0713](https://cve.now/CVE-2022-0713.md): Heap-based Buffer Overflow in radareorg/radare2 (CVSS 5.3, radareorg/radare2)
- [CVE-2022-23043](https://cve.now/CVE-2022-23043.md): Zenario CMS 9.2 allows an authenticated admin user to bypass the file upload restriction by creating a new 'File/MIME Types' using the '.pha (no CVSS, Zenario CMS · tribalsystems/zenario)
- [CVE-2022-0712](https://cve.now/CVE-2022-0712.md): NULL Pointer Dereference in radareorg/radare2 (CVSS 5.9, radareorg/radare2)
- [CVE-2021-46699](https://cve.now/CVE-2021-46699.md): A vulnerability has been identified in Simcenter Femap (All versions \< V2022.1.1). (no CVSS, Siemens Simcenter Femap)
- [CVE-2021-46162](https://cve.now/CVE-2021-46162.md): A vulnerability has been identified in Simcenter Femap (All versions \< V2022.1.1). (no CVSS, Siemens Simcenter Femap)
- [CVE-2022-0665](https://cve.now/CVE-2022-0665.md): Path Traversal in pimcore/pimcore (CVSS 4.9, pimcore/pimcore)
- [CVE-2021-4029](https://cve.now/CVE-2021-4029.md): A command injection vulnerability in the CGI program of the Zyxel ARMOR Z1/Z2 firmware could allow an attacker to execute arbitrary OS comma (CVSS 8.8, Zyxel ARMOR Z2 (NBG6817) firmware · Zyxel ARMOR Z1 (NBG6816…)
- [CVE-2021-4030](https://cve.now/CVE-2021-4030.md): A cross-site request forgery vulnerability in the HTTP daemon of the Zyxel ARMOR Z1/Z2 firmware could allow an attacker to execute arbitrary (CVSS 8.0, Zyxel ARMOR Z2 (NBG6817) firmware · Zyxel ARMOR Z1 (NBG6816…)
- [CVE-2022-24633](https://cve.now/CVE-2022-24633.md): All versions of FileCloud prior to 21.3 are vulnerable to user enumeration. (no CVSS)
- [CVE-2022-24582](https://cve.now/CVE-2022-24582.md): Accounting Journal Management 1.0 is vulnerable to XSS-PHPSESSID-Hijacking. (no CVSS)
- [CVE-2022-24565](https://cve.now/CVE-2022-24565.md): Checkmk \<=2.0.0p19 Fixed in 2.0.0p20 and Checkmk \<=1.6.0p27 Fixed in 1.6.0p28 are affected by a Cross Site Scripting (XSS) vulnerability. (no CVSS)
- [CVE-2022-25636](https://cve.now/CVE-2022-25636.md): net/netfilter/nf\_dup\_netdev.c in the Linux kernel 5.4 through 5.6.10 allows local users to gain privileges because of a heap out-of-bounds w (no CVSS)
- [CVE-2022-0676](https://cve.now/CVE-2022-0676.md): Heap-based Buffer Overflow in radareorg/radare2 (CVSS 7.8, radareorg/radare2)
- [CVE-2021-25636](https://cve.now/CVE-2021-25636.md): Incorrect trust validation of signature with ambiguous KeyInfo children (no CVSS, The Document Foundation LibreOffice)
- [CVE-2022-0714](https://cve.now/CVE-2022-0714.md): Heap-based Buffer Overflow in vim/vim (CVSS 8.4, vim/vim)
- [CVE-2022-23608](https://cve.now/CVE-2022-23608.md): Use after free in PJSIP (CVSS 8.1, pjsip pjproject)
- [CVE-2022-24599](https://cve.now/CVE-2022-24599.md): In autofile Audio File Library 0.3.6, there exists one memory leak vulnerability in printfileinfo, in printinfo.c, which allows an attacker (no CVSS)
- [CVE-2022-25643](https://cve.now/CVE-2022-25643.md): seatd-launch in seatd 0.6.x before 0.6.4 allows removing files with escalated privileges when installed setuid root. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-02-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.