CVEs published February 23, 2022
44 CVEs were published on February 23, 2022: 1 critical, 11 high.
- Published
- 44
- Critical
- 1
- High
- 11
- Medium
- 12
- Low
- 0
- Unrated
- 20
- Now in CISA KEV
- 0
- Fix available
- 19
Most affected products
- Cisco NX-OS Software
- 4
- microweber/microweber
- 3
- anuko timetracker
- 2
- chocobozzz/peertube
- 2
- IBM Sterling Secure Proxy
- 2
- octobercms october · october/system
- 2
- Backblaze B2_Command_Line_Tool · b2
- 1
- Backblaze b2-sdk-python · b2sdk
- 1
- Dell BSAFE SSL-J
- 1
- dolibarr/dolibarr
- 1
Critical 1
High 11
- CVE-2022-24707SQL injection in anuko timetrackeranuko timetracker
- CVE-2022-22336IBM Sterling External Authentication Server and IBM Sterling Secure Proxy 6.0.3.0, 6.0.2.0, and 3.4.3.2 could allow a remote user to consumeIBM Sterling Secure Proxy
- CVE-2022-21705Authenticated remote code execution in octobercmsoctobercms october · october/system
- CVE-2022-20623Cisco Nexus 9000 Series Switches Bidirectional Forwarding Detection Denial of Service VulnerabilityCisco NX-OS Software
- CVE-2022-20624Cisco NX-OS Software Cisco Fabric Services Over IP Denial of Service VulnerabilityCisco NX-OS Software
- CVE-2022-20650Cisco NX-OS Software NX-API Command Injection VulnerabilityCisco NX-OS Software
- CVE-2022-0476Denial of Service in radareorg/radare2radareorg/radare2
- CVE-2022-0721Insertion of Sensitive Information Into Debugging Code in microweber/microwebermicroweber/microweber
- CVE-2022-0719Cross-site Scripting (XSS) - Reflected in microweber/microwebermicroweber/microweber
- CVE-2022-0736Insecure Temporary File in mlflow/mlflowmlflow/mlflow · mlflow
- CVE-2022-0729Use of Out-of-range Pointer Offset in vim/vimvim/vim
Medium, low and unrated 32
- CVE-2022-24708Stored XSS vulnerability in anuko/timetrackeranuko timetracker
- CVE-2022-23655Missing server signature validation in OctoberCMSoctobercms october · october/system
- CVE-2022-23653B2 Command Line Tool TOCTOU application key disclosure Backblaze B2_Command_Line_Tool · b2
- CVE-2022-23651b2-sdk-python TOCTOU application key disclosureBackblaze b2-sdk-python · b2sdk
- CVE-2022-24409Dell BSAFE SSL-J contains remediation for a covert timing channel vulnerability that may be exploited by malicious users to compromise the aDell BSAFE SSL-J
- CVE-2022-25405Tongda2000 v11.10 was discovered to contain a SQL injection vulnerability in change_box.php via the DELETE_STR parameter.
- CVE-2022-25098ECTouch v2 suffers from arbitrary file deletion due to insufficient filtering of the filename parameter.ectouch/ectouch
- CVE-2022-25099A vulnerability in the component /languages/index.php of WBCE CMS v1.5.2 allows attackers to execute arbitrary code via a crafted PHP file.
- CVE-2022-25101A vulnerability in the component /templates/install.php of WBCE CMS v1.5.2 allows attackers to execute arbitrary code via a crafted PHP file
- CVE-2022-25104HorizontCMS v1.0.0-beta.2 was discovered to contain an arbitrary file download vulnerability via the component /admin/file-manager/.
- CVE-2022-25401The copy function of the file manager in Cuppa CMS v1.0 allows any file to be copied to the current directory, granting attackers read acces
- CVE-2022-25402An incorrect access control issue in HMS v1.0 allows unauthenticated attackers to read and modify all PHP files.
- CVE-2022-25403HMS v1.0 was discovered to contain a SQL injection vulnerability via the component admin.php.
- CVE-2022-25404Tongda2000 v11.10 was discovered to contain a SQL injection vulnerability in delete.php via the DELETE_STR parameter.
- CVE-2022-25406Tongda2000 v11.10 was discovered to contain a SQL injection vulnerability in delete_query.php via the DELETE_STR parameter.
- CVE-2021-45746A Directory Traversal vulnerability exists in WeBankPartners wecube-platform 3.2.1 via the file variable in PluginPackageController.java.
- CVE-2021-44550An Incorrect Access Control vulnerability exists in CoreNLP 4.3.2 via the classifier in NERServlet.java (lines 158 and 159).edu.stanford.nlp:stanford-corenlp
- CVE-2021-4070Off-by-one Error in v2fly/v2ray-corev2fly/v2ray-core · github.com/v2fly/v2ray-core +1
- CVE-2022-22333IBM Sterling Secure Proxy 6.0.3.0, 6.0.2.0, and 3.4.3.2 and IBM Sterling External Authentication Server are vulnerable a buffer overflow, duIBM Sterling Secure Proxy
- CVE-2021-44610Multiple SQL Injection vulnerabilities exist in bloofoxCMS 0.5.2.1 - 0.5.1 via the (1) URLs, (2) lang_id, (3) tmpl_id, (4) mod_rewrite (5) e
- CVE-2021-44608Multiple Cross Site Scripting (XSS) vulnerabilities exists in bloofoxCMS 0.5.2.1 - 0.5.1 via the (1) file parameter and (2) type parameter i
- CVE-2021-44607A Cross Site Scripting (XSS) vulnerability exists in FUEL-CMS 1.5.1 in the Assets page via an SVG file.
- CVE-2022-0731Improper Access Control (IDOR) in dolibarr/dolibarrdolibarr/dolibarr
- CVE-2021-43724A Cross Site Scripting (XSS) vulnerability exits in Subrion CMS through 4.2.1 in the Create Page functionality of the admin Account via a SG
- CVE-2022-20625Cisco FXOS and NX-OS Software Cisco Discovery Protocol Service Denial of Service VulnerabilityCisco NX-OS Software
- CVE-2022-24620Piwigo version 12.2.0 is vulnerable to stored cross-site scripting (XSS), which can lead to privilege escalation.
- CVE-2022-0727Improper Access Control in chocobozzz/peertubechocobozzz/peertube
- CVE-2022-24566In Checkmk <=2.0.0p19 fixed in 2.0.0p20 and Checkmk <=1.6.0p27 fixed in 1.6.0p28, the title of a Predefined condition is not properly escape
- CVE-2022-25809Improper Neutralization of audio output from 3rd and 4th Generation Amazon Echo Dot devices allows arbitrary voice command execution on thes
- CVE-2022-0717Out-of-bounds Read in mruby/mrubymruby/mruby
- CVE-2022-0726Missing Authorization in chocobozzz/peertubechocobozzz/peertube
- CVE-2022-24407In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT or UPDATE statement.