CVEs published February 25, 2022
87 CVEs were published on February 25, 2022: 0 critical, 8 high.
- Published
- 87
- Critical
- 0
- High
- 8
- Medium
- 10
- Low
- 0
- Unrated
- 69
- Now in CISA KEV
- 0
- Fix available
- 15
Most affected products
- Huawei EMUI · Huawei Magic UI +1
- 11
- Huawei EMUI · Huawei Magic UI
- 4
- Huawei HarmonyOS
- 4
- FATEK Automation FvDesigner
- 3
- Google fscrypt · github.com/google/fscrypt
- 3
- Apache Software Foundation Apache Airflow · apache-airflow
- 2
- Apache Software Foundation Apache JSPWiki · org.apache.jspw…
- 2
- General Electric Proficy CIMPLICITY
- 2
- QNAP Systems Proxy Server
- 2
- AIS-BW80H-00
- 1
High 8
- CVE-2022-21706Multi-use invitations can grant access to other organizations in Zulipzulip
- CVE-2021-26617Gabia Firstmall remote code execution vulnerabilityGabia Co. Firstmall
- CVE-2022-21798ICSA-22-053-02 GE Proficy CIMPLICITY-CleartextGeneral Electric Proficy CIMPLICITY
- CVE-2022-23921ICSA-22-053-01 GE Proficy CIMPLICITY-IPMGeneral Electric Proficy CIMPLICITY
- CVE-2022-25170ICSA-22-055-01 FATEK Automation FvDesignerFATEK Automation FvDesigner
- CVE-2022-21209ICSA-22-055-01 FATEK Automation FvDesignerFATEK Automation FvDesigner
- CVE-2022-23985ICSA-22-055-01 FATEK Automation FvDesignerFATEK Automation FvDesigner
- CVE-2022-0247Write access to VMO data through copy-on-write in FuchsiaGoogle Fuchsia
Medium, low and unrated 79
- CVE-2022-25096Home Owners Collection Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter in /members/view_
- CVE-2022-25095Home Owners Collection Management System v1.0 allows unauthenticated attackers to compromise user accounts via a crafted POST request.
- CVE-2022-25094Home Owners Collection Management System v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the parameter "cover
- CVE-2022-24710Cross-site Scripting in WeblateWeblateOrg weblate · weblate
- CVE-2022-24442JetBrains YouTrack before 2021.4.40426 was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates.
- CVE-2022-25259JetBrains Hub before 2021.1.14276 was vulnerable to reflected XSS.
- CVE-2022-25260JetBrains Hub before 2021.1.14276 was vulnerable to blind Server-Side Request Forgery (SSRF).
- CVE-2021-23495Open Redirectkarma
- CVE-2022-25261JetBrains TeamCity before 2021.2.2 was vulnerable to reflected XSS.
- CVE-2022-25262In JetBrains Hub before 2022.1.14434, SAML request takeover was possible.
- CVE-2022-25263JetBrains TeamCity before 2021.2.3 was vulnerable to OS command injection in the Agent Push feature configuration.
- CVE-2022-25264In JetBrains TeamCity before 2021.2.3, environment variables of the "password" type could be logged in some cases.
- CVE-2021-42952Zepl Notebooks before 2021-10-25 are affected by a sandbox escape vulnerability.
- CVE-2022-25061TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain a command injection vulnerability via the component oal_setIp6DefaultRoute.
- CVE-2022-25064TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain a remote code execution (RCE) vulnerability via the function oal_wan6_setIpAddr
- CVE-2022-25062TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain an integer overflow via the function dm_checkString.
- CVE-2022-25060TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain a command injection vulnerability via the component oal_startPing.
- CVE-2021-44132A command injection vulnerability in the function formImportOMCIShell of C-DATA ONU4FERW V2.1.13_X139 allows attackers to execute arbitrary
- CVE-2021-37504A cross-site scripting (XSS) vulnerability in the fileNameStr parameter of jQuery-Upload-File v4.0.11 allows attackers to execute arbitrary jquery-file-upload
- CVE-2021-42244A cross-site scripting (XSS) vulnerability in PaquitoSoftware Notimoo v1.2 allows attackers to execute arbitrary web scripts or HTML via a c
- CVE-2021-40046PCManager versions 11.1.1.95 has a privilege escalation vulnerability.PCManager
- CVE-2021-40043The laser command injection vulnerability exists on AIS-BW80H-00 versions earlier than AIS-BW80H-00 9.0.3.4(H100SP13C00).AIS-BW80H-00
- CVE-2021-37103There is an improper permission management vulnerability in the Wallet apps.Huawei EMUI · Huawei Magic UI
- CVE-2021-22429There is a memory address out of bounds in smartphones.Huawei EMUI · Huawei Magic UI +1
- CVE-2021-22432There is a vulnerability when configuring permission isolation in smartphones.Huawei EMUI · Huawei Magic UI +1
- CVE-2021-22426There is a memory address out of bounds in smartphones.Huawei EMUI · Huawei Magic UI +1
- CVE-2021-22430There is a logic bypass vulnerability in smartphones.Huawei EMUI · Huawei Magic UI +1
- CVE-2021-22431There is a vulnerability when configuring permission isolation in smartphones.Huawei EMUI · Huawei Magic UI +1
- CVE-2021-22433There is a memory address out of bounds in smartphones.Huawei EMUI · Huawei Magic UI +1
- CVE-2021-22434There is a memory address out of bounds vulnerability in smartphones.Huawei EMUI · Huawei Magic UI +1
- CVE-2021-22394There is a buffer overflow vulnerability in smartphones.Huawei EMUI · Huawei Magic UI +1
- CVE-2021-22395There is a code injection vulnerability in smartphones.Huawei EMUI · Huawei Magic UI +1
- CVE-2021-22319There is an improper verification vulnerability in smartphones.Huawei EMUI · Huawei Magic UI +1
- CVE-2021-37027There is a DoS vulnerability in smartphones.Huawei EMUI · Huawei Magic UI
- CVE-2021-22489There is a DoS vulnerability in smartphones.Huawei EMUI · Huawei Magic UI +1
- CVE-2021-22448There is an improper verification vulnerability in smartphones.Huawei EMUI · Huawei Magic UI
- CVE-2021-22437There is a software integer overflow leading to a TOCTOU condition in smartphones.Huawei EMUI · Huawei Magic UI
- CVE-2021-22480The interface of a certain HarmonyOS module has an integer overflow vulnerability.Huawei HarmonyOS
- CVE-2021-22479The interface of a certain HarmonyOS module has an invalid address access vulnerability.Huawei HarmonyOS
- CVE-2021-22441Some Huawei products have an integer overflow vulnerability.Huawei HarmonyOS
- CVE-2021-22478The interface of a certain HarmonyOS module has a UAF vulnerability.Huawei HarmonyOS
- CVE-2022-0615Use-after-free vulnerability in ESET products for LinuxESET, spol. s r.o. Endpoint Antivirus for Linux · ESET, spo…
- CVE-2021-38993IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the smbcd daemon to cause a denialIBM VIOS · IBM AIX
- CVE-2021-45977JetBrains IntelliJ IDEA 2021.3.1 Preview, IntelliJ IDEA 2021.3.1 RC, PyCharm Professional 2021.3.1 RC, GoLand 2021.3.1, PhpStorm 2021.3.1 Pr
- CVE-2022-24347JetBrains YouTrack before 2021.4.36872 was vulnerable to stored XSS via a project icon.
- CVE-2022-24346In JetBrains IntelliJ IDEA before 2021.3.1, local code execution via RLO (Right-to-Left Override) characters was possible.
- CVE-2022-24345In JetBrains IntelliJ IDEA before 2021.2.4, local code execution (without permission from a user) upon opening a project was possible.
- CVE-2022-24344JetBrains YouTrack before 2021.4.31698 was vulnerable to stored XSS on the Notification templates page.
- CVE-2022-24343In JetBrains YouTrack before 2021.4.31698, a custom logo could be set by a user who has read-only permissions.
- CVE-2022-24342In JetBrains TeamCity before 2021.2.1, URL injection leading to CSRF was possible.
- CVE-2022-24341In JetBrains TeamCity before 2021.2.1, editing a user account to change its password didn't terminate sessions of the edited user.
- CVE-2022-24340In JetBrains TeamCity before 2021.2.1, XXE during the parsing of the configuration file was possible.
- CVE-2022-24339JetBrains TeamCity before 2021.2.1 was vulnerable to stored XSS.
- CVE-2022-24338JetBrains TeamCity before 2021.2.1 was vulnerable to reflected XSS.
- CVE-2022-24337In JetBrains TeamCity before 2021.2, health items of pull requests were shown to users who lacked appropriate permissions.
- CVE-2022-24336In JetBrains TeamCity before 2021.2.1, an unauthenticated attacker can cancel running builds via an XML-RPC request to the TeamCity server.
- CVE-2022-24335JetBrains TeamCity before 2021.2 was vulnerable to a Time-of-check/Time-of-use (TOCTOU) race-condition attack in agent registration via XML-
- CVE-2022-24334In JetBrains TeamCity before 2021.2.1, the Agent Push feature allowed selection of any private key on the server.
- CVE-2022-24333In JetBrains TeamCity before 2021.2, blind SSRF via an XML-RPC call was possible.
- CVE-2022-24332In JetBrains TeamCity before 2021.2, a logout action didn't remove a Remember Me cookie.
- CVE-2022-24331In JetBrains TeamCity before 2021.1.4, GitLab authentication impersonation was possible.
- CVE-2022-24330In JetBrains TeamCity before 2021.2.1, a redirection to an external site was possible.
- CVE-2022-24329In JetBrains Kotlin before 1.6.0, it was not possible to lock dependencies for Multiplatform Gradle Projects.org.jetbrains.kotlin:kotlin-stdlib
- CVE-2022-24328In JetBrains Hub before 2021.1.13956, an unprivileged user could perform DoS.
- CVE-2022-24327In JetBrains Hub before 2021.1.13890, integration with JetBrains Account exposed an API key with excessive permissions.
- CVE-2022-25374HashiCorp Terraform Enterprise v202112-1, v202112-2, v202201-1, and v202201-2 were configured to log inbound HTTP requests in a manner that
- CVE-2022-24594In waline 1.6.1, an attacker can submit messages using X-Forwarded-For to forge any IP address.
- CVE-2022-24612An authenticated user can upload an XML file containing an XSS via the ITSM module of EyesOfNetwork 5.3.11, resulting in a stored XSS.
- CVE-2022-25328Privilege escalation through command injection in fscryptGoogle fscrypt · github.com/google/fscrypt
- CVE-2022-25327Local Denial of Service in fscrypt PAM moduleGoogle fscrypt · github.com/google/fscrypt
- CVE-2022-25326Denial of Service in fscryptGoogle fscrypt · github.com/google/fscrypt
- CVE-2022-0746Business Logic Errors in dolibarr/dolibarrdolibarr/dolibarr
- CVE-2022-24948Apache JSPWiki Cross-site scripting vulnerability on User Preferences screenApache Software Foundation Apache JSPWiki · org.apache.jspw…
- CVE-2022-24947Apache JSPWiki CSRF Account TakeoverApache Software Foundation Apache JSPWiki · org.apache.jspw…
- CVE-2022-24288Apache Airflow: RCE in example DAGsApache Software Foundation Apache Airflow · apache-airflow
- CVE-2021-45229Apache Airflow: Reflected XSS via Origin Query Argument in URLApache Software Foundation Apache Airflow · apache-airflow
- CVE-2021-34361Reflected XSS Vulnerability in Proxy ServerQNAP Systems Proxy Server
- CVE-2021-34359Stored XSS Vulnerability in Proxy ServerQNAP Systems Proxy Server
- CVE-2022-23835The Visual Voice Mail (VVM) application through 2022-02-24 for Android allows persistent access if an attacker temporarily controls an appli