# CVEs published 2022-02-23

44 CVEs were published on February 23, 2022: 1 critical, 11 high. Days are UTC.

- [CVE-2022-24707](https://cve.now/CVE-2022-24707.md): SQL injection in anuko timetracker (CVSS 7.4, anuko timetracker)
- [CVE-2022-24708](https://cve.now/CVE-2022-24708.md): Stored XSS vulnerability in anuko/timetracker (CVSS 6.5, anuko timetracker)
- [CVE-2022-23655](https://cve.now/CVE-2022-23655.md): Missing server signature validation in OctoberCMS (CVSS 4.8, octobercms october · october/system)
- [CVE-2022-23653](https://cve.now/CVE-2022-23653.md): B2 Command Line Tool TOCTOU application key disclosure (CVSS 4.7, Backblaze B2\_Command\_Line\_Tool · b2)
- [CVE-2022-23651](https://cve.now/CVE-2022-23651.md): b2-sdk-python TOCTOU application key disclosure (CVSS 4.7, Backblaze b2-sdk-python · b2sdk)
- [CVE-2022-24409](https://cve.now/CVE-2022-24409.md): Dell BSAFE SSL-J contains remediation for a covert timing channel vulnerability that may be exploited by malicious users to compromise the a (CVSS 5.9, Dell BSAFE SSL-J)
- [CVE-2022-25405](https://cve.now/CVE-2022-25405.md): Tongda2000 v11.10 was discovered to contain a SQL injection vulnerability in change\_box.php via the DELETE\_STR parameter. (no CVSS)
- [CVE-2022-25098](https://cve.now/CVE-2022-25098.md): ECTouch v2 suffers from arbitrary file deletion due to insufficient filtering of the filename parameter. (no CVSS, ectouch/ectouch)
- [CVE-2022-25099](https://cve.now/CVE-2022-25099.md): A vulnerability in the component /languages/index.php of WBCE CMS v1.5.2 allows attackers to execute arbitrary code via a crafted PHP file. (no CVSS)
- [CVE-2022-25101](https://cve.now/CVE-2022-25101.md): A vulnerability in the component /templates/install.php of WBCE CMS v1.5.2 allows attackers to execute arbitrary code via a crafted PHP file (no CVSS)
- [CVE-2022-25104](https://cve.now/CVE-2022-25104.md): HorizontCMS v1.0.0-beta.2 was discovered to contain an arbitrary file download vulnerability via the component /admin/file-manager/. (no CVSS)
- [CVE-2022-25401](https://cve.now/CVE-2022-25401.md): The copy function of the file manager in Cuppa CMS v1.0 allows any file to be copied to the current directory, granting attackers read acces (no CVSS)
- [CVE-2022-25402](https://cve.now/CVE-2022-25402.md): An incorrect access control issue in HMS v1.0 allows unauthenticated attackers to read and modify all PHP files. (no CVSS)
- [CVE-2022-25403](https://cve.now/CVE-2022-25403.md): HMS v1.0 was discovered to contain a SQL injection vulnerability via the component admin.php. (no CVSS)
- [CVE-2022-25404](https://cve.now/CVE-2022-25404.md): Tongda2000 v11.10 was discovered to contain a SQL injection vulnerability in delete.php via the DELETE\_STR parameter. (no CVSS)
- [CVE-2022-25406](https://cve.now/CVE-2022-25406.md): Tongda2000 v11.10 was discovered to contain a SQL injection vulnerability in delete\_query.php via the DELETE\_STR parameter. (no CVSS)
- [CVE-2021-45746](https://cve.now/CVE-2021-45746.md): A Directory Traversal vulnerability exists in WeBankPartners wecube-platform 3.2.1 via the file variable in PluginPackageController.java. (no CVSS)
- [CVE-2021-44550](https://cve.now/CVE-2021-44550.md): An Incorrect Access Control vulnerability exists in CoreNLP 4.3.2 via the classifier in NERServlet.java (lines 158 and 159). (no CVSS, edu.stanford.nlp:stanford-corenlp)
- [CVE-2021-4070](https://cve.now/CVE-2021-4070.md): Off-by-one Error in v2fly/v2ray-core (CVSS 5.9, v2fly/v2ray-core · github.com/v2fly/v2ray-core +1)
- [CVE-2022-22336](https://cve.now/CVE-2022-22336.md): IBM Sterling External Authentication Server and IBM Sterling Secure Proxy 6.0.3.0, 6.0.2.0, and 3.4.3.2 could allow a remote user to consume (CVSS 7.5, IBM Sterling Secure Proxy)
- [CVE-2022-22333](https://cve.now/CVE-2022-22333.md): IBM Sterling Secure Proxy 6.0.3.0, 6.0.2.0, and 3.4.3.2 and IBM Sterling External Authentication Server are vulnerable a buffer overflow, du (CVSS 6.5, IBM Sterling Secure Proxy)
- [CVE-2021-44610](https://cve.now/CVE-2021-44610.md): Multiple SQL Injection vulnerabilities exist in bloofoxCMS 0.5.2.1 - 0.5.1 via the (1) URLs, (2) lang\_id, (3) tmpl\_id, (4) mod\_rewrite (5) e (no CVSS)
- [CVE-2022-21705](https://cve.now/CVE-2022-21705.md): Authenticated remote code execution in octobercms (CVSS 7.2, octobercms october · october/system)
- [CVE-2021-44608](https://cve.now/CVE-2021-44608.md): Multiple Cross Site Scripting (XSS) vulnerabilities exists in bloofoxCMS 0.5.2.1 - 0.5.1 via the (1) file parameter and (2) type parameter i (no CVSS)
- [CVE-2021-44607](https://cve.now/CVE-2021-44607.md): A Cross Site Scripting (XSS) vulnerability exists in FUEL-CMS 1.5.1 in the Assets page via an SVG file. (no CVSS)
- [CVE-2022-0731](https://cve.now/CVE-2022-0731.md): Improper Access Control (IDOR) in dolibarr/dolibarr (CVSS 5.4, dolibarr/dolibarr)
- [CVE-2021-43724](https://cve.now/CVE-2021-43724.md): A Cross Site Scripting (XSS) vulnerability exits in Subrion CMS through 4.2.1 in the Create Page functionality of the admin Account via a SG (no CVSS)
- [CVE-2022-20623](https://cve.now/CVE-2022-20623.md): Cisco Nexus 9000 Series Switches Bidirectional Forwarding Detection Denial of Service Vulnerability (CVSS 8.6, Cisco NX-OS Software)
- [CVE-2022-20624](https://cve.now/CVE-2022-20624.md): Cisco NX-OS Software Cisco Fabric Services Over IP Denial of Service Vulnerability (CVSS 8.6, Cisco NX-OS Software)
- [CVE-2022-20625](https://cve.now/CVE-2022-20625.md): Cisco FXOS and NX-OS Software Cisco Discovery Protocol Service Denial of Service Vulnerability (CVSS 4.3, Cisco NX-OS Software)
- [CVE-2022-20650](https://cve.now/CVE-2022-20650.md): Cisco NX-OS Software NX-API Command Injection Vulnerability (CVSS 8.8, Cisco NX-OS Software)
- [CVE-2022-0476](https://cve.now/CVE-2022-0476.md): Denial of Service in radareorg/radare2 (CVSS 7.3, radareorg/radare2)
- [CVE-2022-24620](https://cve.now/CVE-2022-24620.md): Piwigo version 12.2.0 is vulnerable to stored cross-site scripting (XSS), which can lead to privilege escalation. (no CVSS)
- [CVE-2022-0727](https://cve.now/CVE-2022-0727.md): Improper Access Control in chocobozzz/peertube (CVSS 5.4, chocobozzz/peertube)
- [CVE-2022-24566](https://cve.now/CVE-2022-24566.md): In Checkmk \<=2.0.0p19 fixed in 2.0.0p20 and Checkmk \<=1.6.0p27 fixed in 1.6.0p28, the title of a Predefined condition is not properly escape (no CVSS)
- [CVE-2022-0724](https://cve.now/CVE-2022-0724.md): Insecure Storage of Sensitive Information in microweber/microweber (CVSS 9.1, microweber/microweber)
- [CVE-2022-0721](https://cve.now/CVE-2022-0721.md): Insertion of Sensitive Information Into Debugging Code in microweber/microweber (CVSS 8.8, microweber/microweber)
- [CVE-2022-0719](https://cve.now/CVE-2022-0719.md): Cross-site Scripting (XSS) - Reflected in microweber/microweber (CVSS 7.6, microweber/microweber)
- [CVE-2022-0736](https://cve.now/CVE-2022-0736.md): Insecure Temporary File in mlflow/mlflow (CVSS 8.2, mlflow/mlflow · mlflow)
- [CVE-2022-25809](https://cve.now/CVE-2022-25809.md): Improper Neutralization of audio output from 3rd and 4th Generation Amazon Echo Dot devices allows arbitrary voice command execution on thes (no CVSS)
- [CVE-2022-0717](https://cve.now/CVE-2022-0717.md): Out-of-bounds Read in mruby/mruby (CVSS 6.8, mruby/mruby)
- [CVE-2022-0726](https://cve.now/CVE-2022-0726.md): Missing Authorization in chocobozzz/peertube (CVSS 5.4, chocobozzz/peertube)
- [CVE-2022-0729](https://cve.now/CVE-2022-0729.md): Use of Out-of-range Pointer Offset in vim/vim (CVSS 7.8, vim/vim)
- [CVE-2022-24407](https://cve.now/CVE-2022-24407.md): In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT or UPDATE statement. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-02-23
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.