CVEs published February 24, 2022
92 CVEs were published on February 24, 2022: 5 critical, 8 high. 1 is now in CISA KEV.
- Published
- 92
- Critical
- 5
- High
- 8
- Medium
- 18
- Low
- 0
- Unrated
- 61
- Now in CISA KEV
- 1
- Fix available
- 13
Most affected products
- WP Statistics
- 6
- appleple a-blog cms
- 4
- Blender
- 3
- Emerson OpenEnterprise SCADA Software
- 3
- NodeJS Node
- 3
- Trend Micro Apex One · Trend Micro Worry-Free Business Secu…
- 3
- Trend Micro ServerProtect for Storage · Trend Micro Serv… +2
- 3
- com.drewnoakes:metadata-extractor
- 2
- Cybonet Pineapp Mail Relay
- 2
- Dojin Club MICMNIS phpUploader
- 2
Critical 5
- CVE-2020-10640ICSA-20-140-02 Emerson OpenEnterpriseEmerson OpenEnterprise SCADA Software
- CVE-2022-25149WP Statistics <= 13.1.5 Unauthenticated Blind SQL Injection via IPWP Statistics
- CVE-2022-0651WP Statistics <= 13.1.5 Unauthenticated Blind SQL Injection via current_page_typeWP Statistics
- CVE-2021-35689A potential vulnerability in the Oracle Talent Acquisition Cloud - Taleo Enterprise Edition.Oracle Talent Acquisition Cloud - Taleo Enterprise Edition
- CVE-2022-25148WP Statistics <= 13.1.5 Unauthenticated Blind SQL Injection via current_page_idWP Statistics
High 8
- CVE-2022-24709Cross site scripting in @awsui/components-reactawsui-documentation · @awsui/components-react
- CVE-2020-10632ICSA-20-140-02 Emerson OpenEnterpriseEmerson OpenEnterprise SCADA Software
- CVE-2020-14481The DeskLock tool provided with FactoryTalk View SE uses a weak encryption algorithm that may allow a local, authenticated attacker to decipRockwell Automation FactoryTalk View SE
- CVE-2020-14478IMPROPER RESTRICTION OF XML EXTERNAL ENTITY REFERENCE CWE-611Rockwell Automation FactoryTalk Services Platform
- CVE-2022-25307WP Statistics <= 13.1.5 Unauthenticated Stored Cross-Site Scripting via platformWP Statistics
- CVE-2022-25305WP Statistics <= 13.1.5 Unauthenticated Stored Cross-Site Scripting via IPWP Statistics
- CVE-2022-25306WP Statistics <= 13.1.5 Unauthenticated Stored Cross-Site Scripting via browserWP Statistics
- CVE-2022-23176WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged credentials to access the system with a privileged managemen
Medium, low and unrated 79
- CVE-2021-39363Honeywell HDZP252DI 1.00.HW02.4 and HBW2PER1 1.000.HW01.3 devices allow a video replay attack after ARP cache poisoning has been achieved.
- CVE-2021-39364Honeywell HDZP252DI 1.00.HW02.4 and HBW2PER1 1.000.HW01.3 devices allow command spoofing (for camera control) after ARP cache poisoning has
- CVE-2021-29220Multiple buffer overflow security vulnerabilities have been identified in HPE iLO Amplifier Pack version(s): Prior to 2.12.iLO Amplifier Pack
- CVE-2022-23701A potential remote host header injection security vulnerability has been identified in HPE Integrated Lights-Out 4 (iLO 4) firmware version(HPE Integrated Lights-Out
- CVE-2021-29217A remote URL redirection vulnerability was discovered in HPE OneView Global Dashboard version(s): Prior to 2.5.HPE OneView Global Dashboard
- CVE-2021-29216A remote cross-site scripting vulnerability was discovered in HPE OneView Global Dashboard version(s): Prior to 2.5.HPE OneView Global Dashboard
- CVE-2021-43745A Denial of Service vulnerabilty exists in Trilium Notes 0.48.6 in the setupPage function
- CVE-2021-44665A Directory Traversal vulnerability exists in the Xerte Project Xerte through 3.10.3 when downloading a project file via download.php.
- CVE-2021-44664An Authenticated Remote Code Exection (RCE) vulnerability exists in Xerte through 3.9 in website_code/php/import/fileupload.php by uploading
- CVE-2021-44663A Remote Code Execution (RCE) vulnerability exists in the Xerte Project Xerte through 3.8.4 via a crafted php file through elfinder in conne
- CVE-2021-44662A Site Scripting (XSS) vulnerability exists in the Xerte Project Xerte through 3.8.4 via the link parameter in print.php.
- CVE-2021-3608A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device in versions prior to 6.1.0.QEMU
- CVE-2021-3607An integer overflow was found in the QEMU implementation of VMWare's paravirtual RDMA device in versions prior to 6.1.0.QEMU
- CVE-2021-3700A use-after-free vulnerability was found in usbredir in versions prior to 0.11.0 in the usbredirparser_serialize() in usbredirparser/usbrediusbredir
- CVE-2020-10636ICSA-20-140-02 Emerson OpenEnterpriseEmerson OpenEnterprise SCADA Software
- CVE-2021-4021A vulnerability was found in Radare2 in versions prior to 5.6.2, 5.6.0, 5.5.4 and 5.5.2.radare2
- CVE-2020-10635ICSA-20-098-05 KUKA.Sim Pro Improper Enforcement of Message Integrity During Transmission in a Communication ChannelKUKA Sim Pro
- CVE-2022-0546A missing bounds check in the image loader used in Blender 3.x and 2.93.8 leads to out-of-bounds heap access, allowing an attacker to cause Blender
- CVE-2022-0545An integer overflow in the processing of loaded 2D images leads to a write-what-where vulnerability and an out-of-bounds read vulnerability,Blender
- CVE-2022-0544An integer underflow in the DDS loader of Blender leads to an out-of-bounds read, possibly allowing an attacker to read sensitive data usingBlender
- CVE-2020-14480Due to usernames/passwords being stored in plaintext in Random Access Memory (RAM), a local, authenticated attacker could gain access to cerRockwell Automation FactoryTalk View SE
- CVE-2022-0683Essential Addons for Elementor Lite <= 5.0.8 Reflected Cross-Site ScriptingEssential Addons for Elementor Lite
- CVE-2022-0710Header Footer Code Manager <= 1.1.16 Reflected XSS99robots Header Footer Code Manager
- CVE-2022-0653Profile Builder – User Profile & User Registration Forms <= 3.6.1 Reflected Cross-Site ScriptingCozmoslabs Profile Builder – User Profile & User Registrati…
- CVE-2021-44533Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly.NodeJS Node · node +1
- CVE-2021-44532Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a string format.NodeJS Node
- CVE-2021-44531Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bNodeJS Node
- CVE-2022-23104WIN-911 2021 Incorrect Default PermissionsWIN-911
- CVE-2022-23922WIN-911 2021 Incorrect Default PermissionsWIN-911
- CVE-2020-14502The web interface of the 1734-AENTR communication module is vulnerable to stored XSS.Rockwell Automation 1734-AENTR
- CVE-2020-14504The web interface of the 1734-AENTR communication module mishandles authentication for HTTP POST requests.Rockwell Automation 1734-AENTR
- CVE-2022-23135There is a directory traversal vulnerability in some home gateway products of ZTE.ZXHN F677, ZXHN F477
- CVE-2022-25004Hospital Patient Record Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter in /admin/doctor
- CVE-2022-24232A local file inclusion in Hospital Patient Record Management System v1.0 allows attackers to execute arbitrary code via a crafted PHP file.
- CVE-2022-25003Hospital Patient Record Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter in /admin/doctor
- CVE-2022-22349IBM Sterling External Authentication Server 3.4.3.2, 6.0.2.0, and 6.0.3.0 is vulnerable to path traversals, due to not properly validating RIBM Sterling External Authentication Server
- CVE-2021-39038IBM WebSphere Application Server 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 22.0.0.2 could allow a remote attacker toIBM WebSphere Application Server Liberty · IBM WebSphere Ap…
- CVE-2021-38995IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX kernel to cause a denial oIBM AIX · IBM VIOS
- CVE-2021-38994IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX kernel to cause a denial oIBM AIX · IBM VIOS
- CVE-2022-22793Cybonet - PineApp Mail Relay Local File InclusionCybonet Pineapp Mail Relay
- CVE-2022-22794Cybonet - PineApp Mail Relay Unauthenticated Sql InjectionCybonet Pineapp Mail Relay
- CVE-2022-0732The backend infrastructure shared by multiple mobile device monitoring services does not adequately authenticate or authorize API requests, 1Byte Copy9 · 1Byte FoneTracker +7
- CVE-2022-24687HashiCorp Consul and Consul Enterprise 1.9.0 through 1.9.14, 1.10.7, and 1.11.2 clusters with at least one Ingress Gateway allow a user withgithub.com/hashicorp/consul
- CVE-2022-24615zip4j up to v2.10.0 can throw various uncaught exceptions while parsing a specially crafted ZIP file, which could result in an application cnet.lingala.zip4j:zip4j
- CVE-2022-24614When reading a specially crafted JPEG file, metadata-extractor up to 2.16.0 can be made to allocate large amounts of memory that finally leacom.drewnoakes:metadata-extractor
- CVE-2022-24613metadata-extractor up to 2.16.0 can throw various uncaught exceptions while parsing a specially crafted JPEG file, which could result in an com.drewnoakes:metadata-extractor
- CVE-2022-0695Denial of Service in radareorg/radare2radareorg/radare2
- CVE-2022-24610Settings/network settings/wireless settings on the Alecto DVC-215IP camera version 63.1.1.173 and below shows the Wi-Fi passphrase hidden, b
- CVE-2022-25355EC-CUBE 3.0.0 to 3.0.18-p3 and EC-CUBE 4.0.0 to 4.1.1 improperly handle HTTP Host header values, which may lead a remote unauthenticated attEC-CUBE CO. EC-CUBE 3 series and EC-CUBE 4 series · ec-cube…
- CVE-2022-24435Cross-site scripting vulnerability in phpUploader v1.2 and earlier allows a remote unauthenticated attacker to inject an arbitrary script viDojin Club MICMNIS phpUploader
- CVE-2022-24374Cross-site scripting vulnerability in a-blog cms Ver.2.8.x series versions prior to Ver.2.8.75, Ver.2.9.x series versions prior to Ver.2.9.4appleple a-blog cms
- CVE-2022-23986SQL injection vulnerability in the phpUploader v1.2 and earlier allows a remote unauthenticated attacker to obtain the information in the daDojin Club MICMNIS phpUploader
- CVE-2022-23916Cross-site scripting vulnerability in a-blog cms Ver.2.8.x series versions prior to Ver.2.8.75, Ver.2.9.x series versions prior to Ver.2.9.4appleple a-blog cms
- CVE-2022-23810Template injection (Improper Neutralization of Special Elements Used in a Template Engine) vulnerability in a-blog cms Ver.2.8.x series versappleple a-blog cms
- CVE-2022-21179Cross-site request forgery (CSRF) vulnerability in EC-CUBE plugin 'Mail Magazine Management Plugin' ver4.0.0 to 4.1.1 (for EC-CUBE 4 series)EC-CUBE CO. EC-CUBE plugin 'Mail Magazine Management Plugin'
- CVE-2022-21142Authentication bypass vulnerability in a-blog cms Ver.2.8.x series versions prior to Ver.2.8.74, Ver.2.9.x series versions prior to Ver.2.9.appleple a-blog cms
- CVE-2022-25291An integer overflow in WatchGuard Firebox and XTM appliances allows an authenticated remote attacker to trigger a heap-based buffer overflow
- CVE-2022-25290WatchGuard Firebox and XTM appliances allow an authenticated remote attacker with unprivileged credentials to retrieve certificate private k
- CVE-2022-25363WatchGuard Firebox and XTM appliances allow an authenticated remote attacker with unprivileged credentials to modify privileged management u
- CVE-2022-25293A systemd stack-based buffer overflow in WatchGuard Firebox and XTM appliances allows an authenticated remote attacker to potentially execut
- CVE-2022-25292A wgagent stack-based buffer overflow in WatchGuard Firebox and XTM appliances allows an authenticated remote attacker to potentially execut
- CVE-2022-25360WatchGuard Firebox and XTM appliances allow an authenticated remote attacker with unprivileged credentials to upload files to arbitrary loca
- CVE-2021-43943Affected versions of Atlassian Jira Service Management Server and Data Center allow attackers with administrator privileges to inject arbitrAtlassian Jira Service Management Server · Atlassian Jira S…
- CVE-2021-26092Failure to sanitize input in the SSL VPN web portal of FortiOS 5.2.10 through 5.2.15, 5.4.0 through 5.4.13, 5.6.0 through 5.6.14, 6.0.0 throFortinet FortiOS, FortiProxy
- CVE-2022-24680A security link following local privilege escalation vulnerability in Trend Micro Apex One, Trend Micro Apex One as a Service, Trend Micro WTrend Micro Apex One · Trend Micro Worry-Free Business Secu…
- CVE-2022-24679A security link following local privilege escalation vulnerability in Trend Micro Apex One, Trend Micro Apex One as a Service, Trend Micro WTrend Micro Apex One · Trend Micro Worry-Free Business Secu…
- CVE-2022-24678An security agent resource exhaustion denial-of-service vulnerability in Trend Micro Apex One, Trend Micro Apex One as a Service, Trend MicrTrend Micro Apex One · Trend Micro Worry-Free Business Secu…
- CVE-2022-24671A link following privilege escalation vulnerability in Trend Micro Antivirus for Max 11.0.2150 and below could allow a local attacker to modTrend Micro Antivirus for Mac
- CVE-2022-25331Uncaught exceptions that can be generated in Trend Micro ServerProtection 6.0/5.8 Information Server could allow a remote attacker to crash Trend Micro ServerProtect for Storage · Trend Micro Serv… +2
- CVE-2022-25330Integer overflow conditions that exist in Trend Micro ServerProtect 6.0/5.8 Information Server could allow a remote attacker to crash the prTrend Micro ServerProtect for Storage · Trend Micro Serv… +2
- CVE-2022-25329Trend Micro ServerProtect 6.0/5.8 Information Server uses a static credential to perform authentication when a specific command is typed in Trend Micro ServerProtect for Storage · Trend Micro Serv… +2
- CVE-2022-25838Laravel Fortify before 1.11.1 allows reuse within a short time window, thus calling into question the "OT" part of the "TOTP" concept.laravel/fortify
- CVE-2019-25058An issue was discovered in USBGuard before 1.1.0.
- CVE-2022-25640In wolfSSL before 5.2.0, a TLS 1.3 server cannot properly enforce a requirement for mutual authentication.
- CVE-2022-25638In wolfSSL before 5.2.0, certificate validation may be bypassed during attempted authentication by a TLS 1.3 client to a TLS 1.3 server.
- CVE-2021-26252A flaw was found in htmldoc in v1.9.12.htmldoc
- CVE-2021-3596A NULL pointer dereference flaw was found in ImageMagick in versions prior to 7.0.10-31 in ReadSVGImage() in coders/svg.c.ImageMagick
- CVE-2021-3610A heap-based buffer overflow vulnerability was found in ImageMagick in versions prior to 7.0.11-14 in ReadTIFFImage() in coders/tiff.c.ImageMagick
- CVE-2022-21824Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "propertiesNodeJS Node