# CVEs published 2022-02-25

87 CVEs were published on February 25, 2022: 0 critical, 8 high. Days are UTC.

- [CVE-2022-21706](https://cve.now/CVE-2022-21706.md): Multi-use invitations can grant access to other organizations in Zulip (CVSS 7.2, zulip)
- [CVE-2022-25096](https://cve.now/CVE-2022-25096.md): Home Owners Collection Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter in /members/view\_ (no CVSS)
- [CVE-2022-25095](https://cve.now/CVE-2022-25095.md): Home Owners Collection Management System v1.0 allows unauthenticated attackers to compromise user accounts via a crafted POST request. (no CVSS)
- [CVE-2022-25094](https://cve.now/CVE-2022-25094.md): Home Owners Collection Management System v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the parameter "cover (no CVSS)
- [CVE-2022-24710](https://cve.now/CVE-2022-24710.md): Cross-site Scripting in Weblate (CVSS 5.4, WeblateOrg weblate · weblate)
- [CVE-2022-24442](https://cve.now/CVE-2022-24442.md): JetBrains YouTrack before 2021.4.40426 was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates. (no CVSS)
- [CVE-2022-25259](https://cve.now/CVE-2022-25259.md): JetBrains Hub before 2021.1.14276 was vulnerable to reflected XSS. (no CVSS)
- [CVE-2022-25260](https://cve.now/CVE-2022-25260.md): JetBrains Hub before 2021.1.14276 was vulnerable to blind Server-Side Request Forgery (SSRF). (no CVSS)
- [CVE-2021-23495](https://cve.now/CVE-2021-23495.md): Open Redirect (CVSS 5.4, karma)
- [CVE-2022-25261](https://cve.now/CVE-2022-25261.md): JetBrains TeamCity before 2021.2.2 was vulnerable to reflected XSS. (no CVSS)
- [CVE-2022-25262](https://cve.now/CVE-2022-25262.md): In JetBrains Hub before 2022.1.14434, SAML request takeover was possible. (no CVSS)
- [CVE-2022-25263](https://cve.now/CVE-2022-25263.md): JetBrains TeamCity before 2021.2.3 was vulnerable to OS command injection in the Agent Push feature configuration. (no CVSS)
- [CVE-2022-25264](https://cve.now/CVE-2022-25264.md): In JetBrains TeamCity before 2021.2.3, environment variables of the "password" type could be logged in some cases. (no CVSS)
- [CVE-2021-42952](https://cve.now/CVE-2021-42952.md): Zepl Notebooks before 2021-10-25 are affected by a sandbox escape vulnerability. (no CVSS)
- [CVE-2022-25061](https://cve.now/CVE-2022-25061.md): TP-LINK TL-WR840N(ES)\_V6.20\_180709 was discovered to contain a command injection vulnerability via the component oal\_setIp6DefaultRoute. (no CVSS)
- [CVE-2022-25064](https://cve.now/CVE-2022-25064.md): TP-LINK TL-WR840N(ES)\_V6.20\_180709 was discovered to contain a remote code execution (RCE) vulnerability via the function oal\_wan6\_setIpAddr (no CVSS)
- [CVE-2022-25062](https://cve.now/CVE-2022-25062.md): TP-LINK TL-WR840N(ES)\_V6.20\_180709 was discovered to contain an integer overflow via the function dm\_checkString. (no CVSS)
- [CVE-2022-25060](https://cve.now/CVE-2022-25060.md): TP-LINK TL-WR840N(ES)\_V6.20\_180709 was discovered to contain a command injection vulnerability via the component oal\_startPing. (no CVSS)
- [CVE-2021-44132](https://cve.now/CVE-2021-44132.md): A command injection vulnerability in the function formImportOMCIShell of C-DATA ONU4FERW V2.1.13\_X139 allows attackers to execute arbitrary (no CVSS)
- [CVE-2021-37504](https://cve.now/CVE-2021-37504.md): A cross-site scripting (XSS) vulnerability in the fileNameStr parameter of jQuery-Upload-File v4.0.11 allows attackers to execute arbitrary (no CVSS, jquery-file-upload)
- [CVE-2021-42244](https://cve.now/CVE-2021-42244.md): A cross-site scripting (XSS) vulnerability in PaquitoSoftware Notimoo v1.2 allows attackers to execute arbitrary web scripts or HTML via a c (no CVSS)
- [CVE-2021-40046](https://cve.now/CVE-2021-40046.md): PCManager versions 11.1.1.95 has a privilege escalation vulnerability. (no CVSS, PCManager)
- [CVE-2021-40043](https://cve.now/CVE-2021-40043.md): The laser command injection vulnerability exists on AIS-BW80H-00 versions earlier than AIS-BW80H-00 9.0.3.4(H100SP13C00). (no CVSS, AIS-BW80H-00)
- [CVE-2021-37103](https://cve.now/CVE-2021-37103.md): There is an improper permission management vulnerability in the Wallet apps. (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-22429](https://cve.now/CVE-2021-22429.md): There is a memory address out of bounds in smartphones. (no CVSS, Huawei EMUI · Huawei Magic UI +1)
- [CVE-2021-22432](https://cve.now/CVE-2021-22432.md): There is a vulnerability when configuring permission isolation in smartphones. (no CVSS, Huawei EMUI · Huawei Magic UI +1)
- [CVE-2021-22426](https://cve.now/CVE-2021-22426.md): There is a memory address out of bounds in smartphones. (no CVSS, Huawei EMUI · Huawei Magic UI +1)
- [CVE-2021-22430](https://cve.now/CVE-2021-22430.md): There is a logic bypass vulnerability in smartphones. (no CVSS, Huawei EMUI · Huawei Magic UI +1)
- [CVE-2021-22431](https://cve.now/CVE-2021-22431.md): There is a vulnerability when configuring permission isolation in smartphones. (no CVSS, Huawei EMUI · Huawei Magic UI +1)
- [CVE-2021-22433](https://cve.now/CVE-2021-22433.md): There is a memory address out of bounds in smartphones. (no CVSS, Huawei EMUI · Huawei Magic UI +1)
- [CVE-2021-22434](https://cve.now/CVE-2021-22434.md): There is a memory address out of bounds vulnerability in smartphones. (no CVSS, Huawei EMUI · Huawei Magic UI +1)
- [CVE-2021-22394](https://cve.now/CVE-2021-22394.md): There is a buffer overflow vulnerability in smartphones. (no CVSS, Huawei EMUI · Huawei Magic UI +1)
- [CVE-2021-22395](https://cve.now/CVE-2021-22395.md): There is a code injection vulnerability in smartphones. (no CVSS, Huawei EMUI · Huawei Magic UI +1)
- [CVE-2021-22319](https://cve.now/CVE-2021-22319.md): There is an improper verification vulnerability in smartphones. (no CVSS, Huawei EMUI · Huawei Magic UI +1)
- [CVE-2021-37027](https://cve.now/CVE-2021-37027.md): There is a DoS vulnerability in smartphones. (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-22489](https://cve.now/CVE-2021-22489.md): There is a DoS vulnerability in smartphones. (no CVSS, Huawei EMUI · Huawei Magic UI +1)
- [CVE-2021-22448](https://cve.now/CVE-2021-22448.md): There is an improper verification vulnerability in smartphones. (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-22437](https://cve.now/CVE-2021-22437.md): There is a software integer overflow leading to a TOCTOU condition in smartphones. (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-22480](https://cve.now/CVE-2021-22480.md): The interface of a certain HarmonyOS module has an integer overflow vulnerability. (no CVSS, Huawei HarmonyOS)
- [CVE-2021-22479](https://cve.now/CVE-2021-22479.md): The interface of a certain HarmonyOS module has an invalid address access vulnerability. (no CVSS, Huawei HarmonyOS)
- [CVE-2021-22441](https://cve.now/CVE-2021-22441.md): Some Huawei products have an integer overflow vulnerability. (no CVSS, Huawei HarmonyOS)
- [CVE-2021-22478](https://cve.now/CVE-2021-22478.md): The interface of a certain HarmonyOS module has a UAF vulnerability. (no CVSS, Huawei HarmonyOS)
- [CVE-2021-26617](https://cve.now/CVE-2021-26617.md): Gabia Firstmall remote code execution vulnerability (CVSS 8.1, Gabia Co. Firstmall)
- [CVE-2022-21798](https://cve.now/CVE-2022-21798.md): ICSA-22-053-02 GE Proficy CIMPLICITY-Cleartext (CVSS 7.5, General Electric Proficy CIMPLICITY)
- [CVE-2022-23921](https://cve.now/CVE-2022-23921.md): ICSA-22-053-01 GE Proficy CIMPLICITY-IPM (CVSS 7.5, General Electric Proficy CIMPLICITY)
- [CVE-2022-25170](https://cve.now/CVE-2022-25170.md): ICSA-22-055-01 FATEK Automation FvDesigner (CVSS 7.8, FATEK Automation FvDesigner)
- [CVE-2022-21209](https://cve.now/CVE-2022-21209.md): ICSA-22-055-01 FATEK Automation FvDesigner (CVSS 7.8, FATEK Automation FvDesigner)
- [CVE-2022-23985](https://cve.now/CVE-2022-23985.md): ICSA-22-055-01 FATEK Automation FvDesigner (CVSS 7.8, FATEK Automation FvDesigner)
- [CVE-2022-0615](https://cve.now/CVE-2022-0615.md): Use-after-free vulnerability in ESET products for Linux (CVSS 5.9, ESET, spol. s r.o. Endpoint Antivirus for Linux · ESET, spo…)
- [CVE-2021-38993](https://cve.now/CVE-2021-38993.md): IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the smbcd daemon to cause a denial (CVSS 6.2, IBM VIOS · IBM AIX)
- [CVE-2021-45977](https://cve.now/CVE-2021-45977.md): JetBrains IntelliJ IDEA 2021.3.1 Preview, IntelliJ IDEA 2021.3.1 RC, PyCharm Professional 2021.3.1 RC, GoLand 2021.3.1, PhpStorm 2021.3.1 Pr (no CVSS)
- [CVE-2022-24347](https://cve.now/CVE-2022-24347.md): JetBrains YouTrack before 2021.4.36872 was vulnerable to stored XSS via a project icon. (no CVSS)
- [CVE-2022-24346](https://cve.now/CVE-2022-24346.md): In JetBrains IntelliJ IDEA before 2021.3.1, local code execution via RLO (Right-to-Left Override) characters was possible. (no CVSS)
- [CVE-2022-24345](https://cve.now/CVE-2022-24345.md): In JetBrains IntelliJ IDEA before 2021.2.4, local code execution (without permission from a user) upon opening a project was possible. (no CVSS)
- [CVE-2022-24344](https://cve.now/CVE-2022-24344.md): JetBrains YouTrack before 2021.4.31698 was vulnerable to stored XSS on the Notification templates page. (no CVSS)
- [CVE-2022-24343](https://cve.now/CVE-2022-24343.md): In JetBrains YouTrack before 2021.4.31698, a custom logo could be set by a user who has read-only permissions. (no CVSS)
- [CVE-2022-24342](https://cve.now/CVE-2022-24342.md): In JetBrains TeamCity before 2021.2.1, URL injection leading to CSRF was possible. (no CVSS)
- [CVE-2022-24341](https://cve.now/CVE-2022-24341.md): In JetBrains TeamCity before 2021.2.1, editing a user account to change its password didn't terminate sessions of the edited user. (no CVSS)
- [CVE-2022-24340](https://cve.now/CVE-2022-24340.md): In JetBrains TeamCity before 2021.2.1, XXE during the parsing of the configuration file was possible. (no CVSS)
- [CVE-2022-24339](https://cve.now/CVE-2022-24339.md): JetBrains TeamCity before 2021.2.1 was vulnerable to stored XSS. (no CVSS)
- [CVE-2022-24338](https://cve.now/CVE-2022-24338.md): JetBrains TeamCity before 2021.2.1 was vulnerable to reflected XSS. (no CVSS)
- [CVE-2022-24337](https://cve.now/CVE-2022-24337.md): In JetBrains TeamCity before 2021.2, health items of pull requests were shown to users who lacked appropriate permissions. (no CVSS)
- [CVE-2022-24336](https://cve.now/CVE-2022-24336.md): In JetBrains TeamCity before 2021.2.1, an unauthenticated attacker can cancel running builds via an XML-RPC request to the TeamCity server. (no CVSS)
- [CVE-2022-24335](https://cve.now/CVE-2022-24335.md): JetBrains TeamCity before 2021.2 was vulnerable to a Time-of-check/Time-of-use (TOCTOU) race-condition attack in agent registration via XML- (no CVSS)
- [CVE-2022-24334](https://cve.now/CVE-2022-24334.md): In JetBrains TeamCity before 2021.2.1, the Agent Push feature allowed selection of any private key on the server. (no CVSS)
- [CVE-2022-24333](https://cve.now/CVE-2022-24333.md): In JetBrains TeamCity before 2021.2, blind SSRF via an XML-RPC call was possible. (no CVSS)
- [CVE-2022-24332](https://cve.now/CVE-2022-24332.md): In JetBrains TeamCity before 2021.2, a logout action didn't remove a Remember Me cookie. (no CVSS)
- [CVE-2022-24331](https://cve.now/CVE-2022-24331.md): In JetBrains TeamCity before 2021.1.4, GitLab authentication impersonation was possible. (no CVSS)
- [CVE-2022-24330](https://cve.now/CVE-2022-24330.md): In JetBrains TeamCity before 2021.2.1, a redirection to an external site was possible. (no CVSS)
- [CVE-2022-24329](https://cve.now/CVE-2022-24329.md): In JetBrains Kotlin before 1.6.0, it was not possible to lock dependencies for Multiplatform Gradle Projects. (no CVSS, org.jetbrains.kotlin:kotlin-stdlib)
- [CVE-2022-24328](https://cve.now/CVE-2022-24328.md): In JetBrains Hub before 2021.1.13956, an unprivileged user could perform DoS. (no CVSS)
- [CVE-2022-24327](https://cve.now/CVE-2022-24327.md): In JetBrains Hub before 2021.1.13890, integration with JetBrains Account exposed an API key with excessive permissions. (no CVSS)
- [CVE-2022-25374](https://cve.now/CVE-2022-25374.md): HashiCorp Terraform Enterprise v202112-1, v202112-2, v202201-1, and v202201-2 were configured to log inbound HTTP requests in a manner that (no CVSS)
- [CVE-2022-24594](https://cve.now/CVE-2022-24594.md): In waline 1.6.1, an attacker can submit messages using X-Forwarded-For to forge any IP address. (no CVSS)
- [CVE-2022-24612](https://cve.now/CVE-2022-24612.md): An authenticated user can upload an XML file containing an XSS via the ITSM module of EyesOfNetwork 5.3.11, resulting in a stored XSS. (no CVSS)
- [CVE-2022-0247](https://cve.now/CVE-2022-0247.md): Write access to VMO data through copy-on-write in Fuchsia (CVSS 7.5, Google Fuchsia)
- [CVE-2022-25328](https://cve.now/CVE-2022-25328.md): Privilege escalation through command injection in fscrypt (CVSS 5.0, Google fscrypt · github.com/google/fscrypt)
- [CVE-2022-25327](https://cve.now/CVE-2022-25327.md): Local Denial of Service in fscrypt PAM module (CVSS 5.5, Google fscrypt · github.com/google/fscrypt)
- [CVE-2022-25326](https://cve.now/CVE-2022-25326.md): Denial of Service in fscrypt (CVSS 5.5, Google fscrypt · github.com/google/fscrypt)
- [CVE-2022-0746](https://cve.now/CVE-2022-0746.md): Business Logic Errors in dolibarr/dolibarr (CVSS 4.3, dolibarr/dolibarr)
- [CVE-2022-24948](https://cve.now/CVE-2022-24948.md): Apache JSPWiki Cross-site scripting vulnerability on User Preferences screen (no CVSS, Apache Software Foundation Apache JSPWiki · org.apache.jspw…)
- [CVE-2022-24947](https://cve.now/CVE-2022-24947.md): Apache JSPWiki CSRF Account Takeover (no CVSS, Apache Software Foundation Apache JSPWiki · org.apache.jspw…)
- [CVE-2022-24288](https://cve.now/CVE-2022-24288.md): Apache Airflow: RCE in example DAGs (no CVSS, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2021-45229](https://cve.now/CVE-2021-45229.md): Apache Airflow: Reflected XSS via Origin Query Argument in URL (no CVSS, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2021-34361](https://cve.now/CVE-2021-34361.md): Reflected XSS Vulnerability in Proxy Server (CVSS 5.3, QNAP Systems Proxy Server)
- [CVE-2021-34359](https://cve.now/CVE-2021-34359.md): Stored XSS Vulnerability in Proxy Server (CVSS 6.9, QNAP Systems Proxy Server)
- [CVE-2022-23835](https://cve.now/CVE-2022-23835.md): The Visual Voice Mail (VVM) application through 2022-02-24 for Android allows persistent access if an attacker temporarily controls an appli (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-02-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.