# CVEs published 2022-02-24

92 CVEs were published on February 24, 2022: 5 critical, 8 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2021-39363](https://cve.now/CVE-2021-39363.md): Honeywell HDZP252DI 1.00.HW02.4 and HBW2PER1 1.000.HW01.3 devices allow a video replay attack after ARP cache poisoning has been achieved. (no CVSS)
- [CVE-2021-39364](https://cve.now/CVE-2021-39364.md): Honeywell HDZP252DI 1.00.HW02.4 and HBW2PER1 1.000.HW01.3 devices allow command spoofing (for camera control) after ARP cache poisoning has (no CVSS)
- [CVE-2021-29220](https://cve.now/CVE-2021-29220.md): Multiple buffer overflow security vulnerabilities have been identified in HPE iLO Amplifier Pack version(s): Prior to 2.12. (no CVSS, iLO Amplifier Pack)
- [CVE-2022-23701](https://cve.now/CVE-2022-23701.md): A potential remote host header injection security vulnerability has been identified in HPE Integrated Lights-Out 4 (iLO 4) firmware version( (no CVSS, HPE Integrated Lights-Out)
- [CVE-2021-29217](https://cve.now/CVE-2021-29217.md): A remote URL redirection vulnerability was discovered in HPE OneView Global Dashboard version(s): Prior to 2.5. (no CVSS, HPE OneView Global Dashboard)
- [CVE-2021-29216](https://cve.now/CVE-2021-29216.md): A remote cross-site scripting vulnerability was discovered in HPE OneView Global Dashboard version(s): Prior to 2.5. (no CVSS, HPE OneView Global Dashboard)
- [CVE-2021-43745](https://cve.now/CVE-2021-43745.md): A Denial of Service vulnerabilty exists in Trilium Notes 0.48.6 in the setupPage function (no CVSS)
- [CVE-2021-44665](https://cve.now/CVE-2021-44665.md): A Directory Traversal vulnerability exists in the Xerte Project Xerte through 3.10.3 when downloading a project file via download.php. (no CVSS)
- [CVE-2021-44664](https://cve.now/CVE-2021-44664.md): An Authenticated Remote Code Exection (RCE) vulnerability exists in Xerte through 3.9 in website\_code/php/import/fileupload.php by uploading (no CVSS)
- [CVE-2022-24709](https://cve.now/CVE-2022-24709.md): Cross site scripting in @awsui/components-react (CVSS 8.8, awsui-documentation · @awsui/components-react)
- [CVE-2021-44663](https://cve.now/CVE-2021-44663.md): A Remote Code Execution (RCE) vulnerability exists in the Xerte Project Xerte through 3.8.4 via a crafted php file through elfinder in conne (no CVSS)
- [CVE-2021-44662](https://cve.now/CVE-2021-44662.md): A Site Scripting (XSS) vulnerability exists in the Xerte Project Xerte through 3.8.4 via the link parameter in print.php. (no CVSS)
- [CVE-2021-3608](https://cve.now/CVE-2021-3608.md): A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device in versions prior to 6.1.0. (no CVSS, QEMU)
- [CVE-2021-3607](https://cve.now/CVE-2021-3607.md): An integer overflow was found in the QEMU implementation of VMWare's paravirtual RDMA device in versions prior to 6.1.0. (no CVSS, QEMU)
- [CVE-2021-3700](https://cve.now/CVE-2021-3700.md): A use-after-free vulnerability was found in usbredir in versions prior to 0.11.0 in the usbredirparser\_serialize() in usbredirparser/usbredi (no CVSS, usbredir)
- [CVE-2020-10636](https://cve.now/CVE-2020-10636.md): ICSA-20-140-02 Emerson OpenEnterprise (CVSS 6.5, Emerson OpenEnterprise SCADA Software)
- [CVE-2020-10640](https://cve.now/CVE-2020-10640.md): ICSA-20-140-02 Emerson OpenEnterprise (CVSS 10.0, Emerson OpenEnterprise SCADA Software)
- [CVE-2020-10632](https://cve.now/CVE-2020-10632.md): ICSA-20-140-02 Emerson OpenEnterprise (CVSS 8.8, Emerson OpenEnterprise SCADA Software)
- [CVE-2021-4021](https://cve.now/CVE-2021-4021.md): A vulnerability was found in Radare2 in versions prior to 5.6.2, 5.6.0, 5.5.4 and 5.5.2. (no CVSS, radare2)
- [CVE-2020-10635](https://cve.now/CVE-2020-10635.md): ICSA-20-098-05 KUKA.Sim Pro Improper Enforcement of Message Integrity During Transmission in a Communication Channel (CVSS 4.3, KUKA Sim Pro)
- [CVE-2022-0546](https://cve.now/CVE-2022-0546.md): A missing bounds check in the image loader used in Blender 3.x and 2.93.8 leads to out-of-bounds heap access, allowing an attacker to cause (no CVSS, Blender)
- [CVE-2022-0545](https://cve.now/CVE-2022-0545.md): An integer overflow in the processing of loaded 2D images leads to a write-what-where vulnerability and an out-of-bounds read vulnerability, (no CVSS, Blender)
- [CVE-2022-0544](https://cve.now/CVE-2022-0544.md): An integer underflow in the DDS loader of Blender leads to an out-of-bounds read, possibly allowing an attacker to read sensitive data using (no CVSS, Blender)
- [CVE-2020-14480](https://cve.now/CVE-2020-14480.md): Due to usernames/passwords being stored in plaintext in Random Access Memory (RAM), a local, authenticated attacker could gain access to cer (CVSS 5.5, Rockwell Automation FactoryTalk View SE)
- [CVE-2020-14481](https://cve.now/CVE-2020-14481.md): The DeskLock tool provided with FactoryTalk View SE uses a weak encryption algorithm that may allow a local, authenticated attacker to decip (CVSS 7.8, Rockwell Automation FactoryTalk View SE)
- [CVE-2020-14478](https://cve.now/CVE-2020-14478.md): IMPROPER RESTRICTION OF XML EXTERNAL ENTITY REFERENCE CWE-611 (CVSS 7.1, Rockwell Automation FactoryTalk Services Platform)
- [CVE-2022-25307](https://cve.now/CVE-2022-25307.md): WP Statistics \<= 13.1.5 Unauthenticated Stored Cross-Site Scripting via platform (CVSS 7.2, WP Statistics)
- [CVE-2022-25305](https://cve.now/CVE-2022-25305.md): WP Statistics \<= 13.1.5 Unauthenticated Stored Cross-Site Scripting via IP (CVSS 7.2, WP Statistics)
- [CVE-2022-25306](https://cve.now/CVE-2022-25306.md): WP Statistics \<= 13.1.5 Unauthenticated Stored Cross-Site Scripting via browser (CVSS 7.2, WP Statistics)
- [CVE-2022-0683](https://cve.now/CVE-2022-0683.md): Essential Addons for Elementor Lite \<= 5.0.8 Reflected Cross-Site Scripting (CVSS 6.1, Essential Addons for Elementor Lite)
- [CVE-2022-25149](https://cve.now/CVE-2022-25149.md): WP Statistics \<= 13.1.5 Unauthenticated Blind SQL Injection via IP (CVSS 9.8, WP Statistics)
- [CVE-2022-0651](https://cve.now/CVE-2022-0651.md): WP Statistics \<= 13.1.5 Unauthenticated Blind SQL Injection via current\_page\_type (CVSS 9.8, WP Statistics)
- [CVE-2022-0710](https://cve.now/CVE-2022-0710.md): Header Footer Code Manager \<= 1.1.16 Reflected XSS (CVSS 6.1, 99robots Header Footer Code Manager)
- [CVE-2022-0653](https://cve.now/CVE-2022-0653.md): Profile Builder – User Profile & User Registration Forms \<= 3.6.1 Reflected Cross-Site Scripting (CVSS 6.1, Cozmoslabs Profile Builder – User Profile & User Registrati…)
- [CVE-2021-44533](https://cve.now/CVE-2021-44533.md): Node.js \< 12.22.9, \< 14.18.3, \< 16.13.2, and \< 17.3.1 did not handle multi-value Relative Distinguished Names correctly. (no CVSS, NodeJS Node · node +1)
- [CVE-2021-44532](https://cve.now/CVE-2021-44532.md): Node.js \< 12.22.9, \< 14.18.3, \< 16.13.2, and \< 17.3.1 converts SANs (Subject Alternative Names) to a string format. (no CVSS, NodeJS Node)
- [CVE-2021-44531](https://cve.now/CVE-2021-44531.md): Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in b (no CVSS, NodeJS Node)
- [CVE-2022-23104](https://cve.now/CVE-2022-23104.md): WIN-911 2021 Incorrect Default Permissions (CVSS 5.6, WIN-911)
- [CVE-2022-23922](https://cve.now/CVE-2022-23922.md): WIN-911 2021 Incorrect Default Permissions (CVSS 5.6, WIN-911)
- [CVE-2020-14502](https://cve.now/CVE-2020-14502.md): The web interface of the 1734-AENTR communication module is vulnerable to stored XSS. (CVSS 6.1, Rockwell Automation 1734-AENTR)
- [CVE-2020-14504](https://cve.now/CVE-2020-14504.md): The web interface of the 1734-AENTR communication module mishandles authentication for HTTP POST requests. (CVSS 5.3, Rockwell Automation 1734-AENTR)
- [CVE-2022-23135](https://cve.now/CVE-2022-23135.md): There is a directory traversal vulnerability in some home gateway products of ZTE. (no CVSS, ZXHN F677, ZXHN F477)
- [CVE-2022-25004](https://cve.now/CVE-2022-25004.md): Hospital Patient Record Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter in /admin/doctor (no CVSS)
- [CVE-2022-24232](https://cve.now/CVE-2022-24232.md): A local file inclusion in Hospital Patient Record Management System v1.0 allows attackers to execute arbitrary code via a crafted PHP file. (no CVSS)
- [CVE-2022-25003](https://cve.now/CVE-2022-25003.md): Hospital Patient Record Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter in /admin/doctor (no CVSS)
- [CVE-2022-22349](https://cve.now/CVE-2022-22349.md): IBM Sterling External Authentication Server 3.4.3.2, 6.0.2.0, and 6.0.3.0 is vulnerable to path traversals, due to not properly validating R (CVSS 4.3, IBM Sterling External Authentication Server)
- [CVE-2021-39038](https://cve.now/CVE-2021-39038.md): IBM WebSphere Application Server 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 22.0.0.2 could allow a remote attacker to (CVSS 4.4, IBM WebSphere Application Server Liberty · IBM WebSphere Ap…)
- [CVE-2021-38995](https://cve.now/CVE-2021-38995.md): IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX kernel to cause a denial o (CVSS 6.2, IBM AIX · IBM VIOS)
- [CVE-2021-38994](https://cve.now/CVE-2021-38994.md): IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX kernel to cause a denial o (CVSS 6.2, IBM AIX · IBM VIOS)
- [CVE-2022-22793](https://cve.now/CVE-2022-22793.md): Cybonet - PineApp Mail Relay Local File Inclusion (CVSS 6.1, Cybonet Pineapp Mail Relay)
- [CVE-2022-22794](https://cve.now/CVE-2022-22794.md): Cybonet - PineApp Mail Relay Unauthenticated Sql Injection (CVSS 6.8, Cybonet Pineapp Mail Relay)
- [CVE-2022-0732](https://cve.now/CVE-2022-0732.md): The backend infrastructure shared by multiple mobile device monitoring services does not adequately authenticate or authorize API requests, (no CVSS, 1Byte Copy9 · 1Byte FoneTracker +7)
- [CVE-2022-24687](https://cve.now/CVE-2022-24687.md): HashiCorp Consul and Consul Enterprise 1.9.0 through 1.9.14, 1.10.7, and 1.11.2 clusters with at least one Ingress Gateway allow a user with (no CVSS, github.com/hashicorp/consul)
- [CVE-2022-24615](https://cve.now/CVE-2022-24615.md): zip4j up to v2.10.0 can throw various uncaught exceptions while parsing a specially crafted ZIP file, which could result in an application c (no CVSS, net.lingala.zip4j:zip4j)
- [CVE-2022-24614](https://cve.now/CVE-2022-24614.md): When reading a specially crafted JPEG file, metadata-extractor up to 2.16.0 can be made to allocate large amounts of memory that finally lea (no CVSS, com.drewnoakes:metadata-extractor)
- [CVE-2022-24613](https://cve.now/CVE-2022-24613.md): metadata-extractor up to 2.16.0 can throw various uncaught exceptions while parsing a specially crafted JPEG file, which could result in an (no CVSS, com.drewnoakes:metadata-extractor)
- [CVE-2022-0695](https://cve.now/CVE-2022-0695.md): Denial of Service in radareorg/radare2 (CVSS 6.8, radareorg/radare2)
- [CVE-2022-24610](https://cve.now/CVE-2022-24610.md): Settings/network settings/wireless settings on the Alecto DVC-215IP camera version 63.1.1.173 and below shows the Wi-Fi passphrase hidden, b (no CVSS)
- [CVE-2022-25355](https://cve.now/CVE-2022-25355.md): EC-CUBE 3.0.0 to 3.0.18-p3 and EC-CUBE 4.0.0 to 4.1.1 improperly handle HTTP Host header values, which may lead a remote unauthenticated att (no CVSS, EC-CUBE CO. EC-CUBE 3 series and EC-CUBE 4 series · ec-cube…)
- [CVE-2022-24435](https://cve.now/CVE-2022-24435.md): Cross-site scripting vulnerability in phpUploader v1.2 and earlier allows a remote unauthenticated attacker to inject an arbitrary script vi (no CVSS, Dojin Club MICMNIS phpUploader)
- [CVE-2022-24374](https://cve.now/CVE-2022-24374.md): Cross-site scripting vulnerability in a-blog cms Ver.2.8.x series versions prior to Ver.2.8.75, Ver.2.9.x series versions prior to Ver.2.9.4 (no CVSS, appleple a-blog cms)
- [CVE-2022-23986](https://cve.now/CVE-2022-23986.md): SQL injection vulnerability in the phpUploader v1.2 and earlier allows a remote unauthenticated attacker to obtain the information in the da (no CVSS, Dojin Club MICMNIS phpUploader)
- [CVE-2022-23916](https://cve.now/CVE-2022-23916.md): Cross-site scripting vulnerability in a-blog cms Ver.2.8.x series versions prior to Ver.2.8.75, Ver.2.9.x series versions prior to Ver.2.9.4 (no CVSS, appleple a-blog cms)
- [CVE-2022-23810](https://cve.now/CVE-2022-23810.md): Template injection (Improper Neutralization of Special Elements Used in a Template Engine) vulnerability in a-blog cms Ver.2.8.x series vers (no CVSS, appleple a-blog cms)
- [CVE-2022-21179](https://cve.now/CVE-2022-21179.md): Cross-site request forgery (CSRF) vulnerability in EC-CUBE plugin 'Mail Magazine Management Plugin' ver4.0.0 to 4.1.1 (for EC-CUBE 4 series) (no CVSS, EC-CUBE CO. EC-CUBE plugin 'Mail Magazine Management Plugin')
- [CVE-2022-21142](https://cve.now/CVE-2022-21142.md): Authentication bypass vulnerability in a-blog cms Ver.2.8.x series versions prior to Ver.2.8.74, Ver.2.9.x series versions prior to Ver.2.9. (no CVSS, appleple a-blog cms)
- [CVE-2022-25291](https://cve.now/CVE-2022-25291.md): An integer overflow in WatchGuard Firebox and XTM appliances allows an authenticated remote attacker to trigger a heap-based buffer overflow (no CVSS)
- [CVE-2022-25290](https://cve.now/CVE-2022-25290.md): WatchGuard Firebox and XTM appliances allow an authenticated remote attacker with unprivileged credentials to retrieve certificate private k (no CVSS)
- [CVE-2022-25363](https://cve.now/CVE-2022-25363.md): WatchGuard Firebox and XTM appliances allow an authenticated remote attacker with unprivileged credentials to modify privileged management u (no CVSS)
- [CVE-2022-25293](https://cve.now/CVE-2022-25293.md): A systemd stack-based buffer overflow in WatchGuard Firebox and XTM appliances allows an authenticated remote attacker to potentially execut (no CVSS)
- [CVE-2022-25292](https://cve.now/CVE-2022-25292.md): A wgagent stack-based buffer overflow in WatchGuard Firebox and XTM appliances allows an authenticated remote attacker to potentially execut (no CVSS)
- [CVE-2022-25360](https://cve.now/CVE-2022-25360.md): WatchGuard Firebox and XTM appliances allow an authenticated remote attacker with unprivileged credentials to upload files to arbitrary loca (no CVSS)
- [CVE-2021-43943](https://cve.now/CVE-2021-43943.md): Affected versions of Atlassian Jira Service Management Server and Data Center allow attackers with administrator privileges to inject arbitr (no CVSS, Atlassian Jira Service Management Server · Atlassian Jira S…)
- [CVE-2021-26092](https://cve.now/CVE-2021-26092.md): Failure to sanitize input in the SSL VPN web portal of FortiOS 5.2.10 through 5.2.15, 5.4.0 through 5.4.13, 5.6.0 through 5.6.14, 6.0.0 thro (CVSS 4.7, Fortinet FortiOS, FortiProxy)
- [CVE-2022-24680](https://cve.now/CVE-2022-24680.md): A security link following local privilege escalation vulnerability in Trend Micro Apex One, Trend Micro Apex One as a Service, Trend Micro W (no CVSS, Trend Micro Apex One · Trend Micro Worry-Free Business Secu…)
- [CVE-2022-24679](https://cve.now/CVE-2022-24679.md): A security link following local privilege escalation vulnerability in Trend Micro Apex One, Trend Micro Apex One as a Service, Trend Micro W (no CVSS, Trend Micro Apex One · Trend Micro Worry-Free Business Secu…)
- [CVE-2022-24678](https://cve.now/CVE-2022-24678.md): An security agent resource exhaustion denial-of-service vulnerability in Trend Micro Apex One, Trend Micro Apex One as a Service, Trend Micr (no CVSS, Trend Micro Apex One · Trend Micro Worry-Free Business Secu…)
- [CVE-2022-24671](https://cve.now/CVE-2022-24671.md): A link following privilege escalation vulnerability in Trend Micro Antivirus for Max 11.0.2150 and below could allow a local attacker to mod (no CVSS, Trend Micro Antivirus for Mac)
- [CVE-2022-25331](https://cve.now/CVE-2022-25331.md): Uncaught exceptions that can be generated in Trend Micro ServerProtection 6.0/5.8 Information Server could allow a remote attacker to crash (no CVSS, Trend Micro ServerProtect for Storage · Trend Micro Serv… +2)
- [CVE-2022-25330](https://cve.now/CVE-2022-25330.md): Integer overflow conditions that exist in Trend Micro ServerProtect 6.0/5.8 Information Server could allow a remote attacker to crash the pr (no CVSS, Trend Micro ServerProtect for Storage · Trend Micro Serv… +2)
- [CVE-2022-25329](https://cve.now/CVE-2022-25329.md): Trend Micro ServerProtect 6.0/5.8 Information Server uses a static credential to perform authentication when a specific command is typed in (no CVSS, Trend Micro ServerProtect for Storage · Trend Micro Serv… +2)
- [CVE-2022-25838](https://cve.now/CVE-2022-25838.md): Laravel Fortify before 1.11.1 allows reuse within a short time window, thus calling into question the "OT" part of the "TOTP" concept. (no CVSS, laravel/fortify)
- [CVE-2019-25058](https://cve.now/CVE-2019-25058.md): An issue was discovered in USBGuard before 1.1.0. (no CVSS)
- [CVE-2022-25640](https://cve.now/CVE-2022-25640.md): In wolfSSL before 5.2.0, a TLS 1.3 server cannot properly enforce a requirement for mutual authentication. (no CVSS)
- [CVE-2022-25638](https://cve.now/CVE-2022-25638.md): In wolfSSL before 5.2.0, certificate validation may be bypassed during attempted authentication by a TLS 1.3 client to a TLS 1.3 server. (no CVSS)
- [CVE-2022-23176](https://cve.now/CVE-2022-23176.md): WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged credentials to access the system with a privileged managemen (CVSS 8.8, KEV)
- [CVE-2021-35689](https://cve.now/CVE-2021-35689.md): A potential vulnerability in the Oracle Talent Acquisition Cloud - Taleo Enterprise Edition. (CVSS 9.8, Oracle Talent Acquisition Cloud - Taleo Enterprise Edition)
- [CVE-2021-26252](https://cve.now/CVE-2021-26252.md): A flaw was found in htmldoc in v1.9.12. (no CVSS, htmldoc)
- [CVE-2021-3596](https://cve.now/CVE-2021-3596.md): A NULL pointer dereference flaw was found in ImageMagick in versions prior to 7.0.10-31 in ReadSVGImage() in coders/svg.c. (no CVSS, ImageMagick)
- [CVE-2021-3610](https://cve.now/CVE-2021-3610.md): A heap-based buffer overflow vulnerability was found in ImageMagick in versions prior to 7.0.11-14 in ReadTIFFImage() in coders/tiff.c. (no CVSS, ImageMagick)
- [CVE-2022-21824](https://cve.now/CVE-2022-21824.md): Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties (no CVSS, NodeJS Node)
- [CVE-2022-25148](https://cve.now/CVE-2022-25148.md): WP Statistics \<= 13.1.5 Unauthenticated Blind SQL Injection via current\_page\_id (CVSS 9.8, WP Statistics)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-02-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.