CVEs published February 28, 2022
81 CVEs were published on February 28, 2022: 1 critical, 2 high.
- Published
- 81
- Critical
- 1
- High
- 2
- Medium
- 3
- Low
- 0
- Unrated
- 75
- Now in CISA KEV
- 0
- Fix available
- 38
Most affected products
- CodeIgniter4 · codeigniter4/framework
- 2
- Logo Showcase with Slick Slider – Logo Carousel, Logo Slide…
- 2
- Maps Plugin using Google Maps for WordPress – WP Google Map
- 2
- Orange Form
- 2
- rundeck
- 2
- Testimonial WordPress Plugin – AP Custom Testimonial
- 2
- WS Form LITE – Drag & Drop Contact Form Builder for WordPre…
- 2
- 15Zine
- 1
- Album and Image Gallery with Lightbox – Flagallery Photo Po…
- 1
- Asgaros Forum
- 1
Critical 1
High 2
Medium, low and unrated 78
- CVE-2022-0743Cross-site Scripting (XSS) - Stored in getgrav/gravgetgrav/grav
- CVE-2022-25413Maxsite CMS v108 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the parameter f_tags at /admin/page_edit/3.
- CVE-2022-25412Maxsite CMS v180 was discovered to contain multiple arbitrary file deletion vulnerabilities in /admin_page/all-files-update-ajax.php via the
- CVE-2022-25411A Remote Code Execution (RCE) vulnerability at /admin/options in Maxsite CMS v180 allows attackers to execute arbitrary code via a crafted P
- CVE-2022-25409Hospital Management System v1.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the demail parameter at /adm
- CVE-2022-25410Maxsite CMS v180 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the parameter f_file_description at /admin/
- CVE-2022-25407Hospital Management System v1.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Doctor parameter at /adm
- CVE-2022-25408Hospital Management System v1.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the dpassword parameter at /
- CVE-2022-25028Home Owners Collection Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the collected_by para
- CVE-2022-23907CMS Made Simple v2.2.15 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the parameter m1_fmmessage.
- CVE-2022-23906CMS Made Simple v2.2.15 was discovered to contain a Remote Command Execution (RCE) vulnerability via the upload avatar function.
- CVE-2021-45414A Remote Code Execution (RCE) vulnerability exists in DataRobot through 2021-10-28 because it allows submission of a Docker environment or J
- CVE-2021-41111Authorization Bypass Through User-Controlled Key in Rundeckrundeck
- CVE-2022-25015A stored cross-site scripting (XSS) vulnerability in Ice Hrm 30.0.0.OS allows attackers to steal cookies via a crafted payload inserted into
- CVE-2022-25014Ice Hrm 30.0.0.OS was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the "m" parameter in the Dashboard of t
- CVE-2022-25013Ice Hrm 30.0.0.OS was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities via the "key" and "fm" parameters
- CVE-2020-22845A buffer overflow in Mikrotik RouterOS 6.47 allows unauthenticated attackers to cause a denial of service (DOS) via crafted FTP requests.
- CVE-2020-22844A buffer overflow in Mikrotik RouterOS 6.47 allows unauthenticated attackers to cause a denial of service (DOS) via crafted SMB requests.
- CVE-2022-26181Dropbox Lepton v1.2.1-185-g2a08b77 was discovered to contain a heap-buffer-overflow in the function aligned_dealloc():src/lepton/bitops.cc:1
- CVE-2022-25023Audio File commit 004065d was discovered to contain a heap-buffer overflow in the function fouBytesToInt():AudioFile.h.
- CVE-2022-26315qrcp through 0.8.4, in receive mode, allows ../ Directory Traversal via the file name specified by the uploader.
- CVE-2021-44331ARM astcenc 3.2.0 is vulnerable to Buffer Overflow in function encode_ise().
- CVE-2021-44342David Brackeen ok-file-formats 203defd is vulnerable to Buffer Overflow via function ok_png_transform_scanline() in "/ok_png.c:494".
- CVE-2022-24712Cross-Site Request Forgery (CSRF) Protection Bypass Vulnerability in CodeIgniter4CodeIgniter4 · codeigniter4/framework
- CVE-2021-44340David Brackeen ok-file-formats dev version is vulnerable to Buffer Overflow.
- CVE-2022-26158An issue was discovered in the web application in Cherwell Service Management (CSM) 10.2.3.
- CVE-2022-26157An issue was discovered in the web application in Cherwell Service Management (CSM) 10.2.3.
- CVE-2021-44339David Brackeen ok-file-formats 203defd is vulnerable to Buffer Overflow.
- CVE-2022-26156An issue was discovered in the web application in Cherwell Service Management (CSM) 10.2.3.
- CVE-2022-26155An issue was discovered in the web application in Cherwell Service Management (CSM) 10.2.3.
- CVE-2022-25642Obyte (formerly Byteball) Wallet before 3.4.1 allows XSS.
- CVE-2021-44334David Brackeen ok-file-formats 97f78ca is vulnerable to Buffer Overflow.
- CVE-2021-43086ARM astcenc 3.2.0 is vulnerable to Buffer Overflow.
- CVE-2022-24685HashiCorp Nomad and Nomad Enterprise 1.0.17, 1.1.11, and 1.2.5 allow invalid HCL for the jobs parse endpoint, which may cause excessive CPU github.com/hashicorp/nomad
- CVE-2022-24572Car Driving School Management System v1.0 is affected by Cross Site Scripting (XSS) in the User Enrollment Form (Username Field).
- CVE-2022-24571Car Driving School Management System v1.0 is affected by SQL injection in the login page.
- CVE-2022-23988WS Form < 1.8.176 - Unauthenticated Stored Cross-Site ScriptingWS Form LITE – Drag & Drop Contact Form Builder for WordPre…
- CVE-2022-23987WS Form < 1.8.176 - Admin+ Stored Cross-Site ScriptingWS Form LITE – Drag & Drop Contact Form Builder for WordPre…
- CVE-2022-23912AP Custom Testimonial < 1.4.8 - Reflected Cross-Site ScriptingTestimonial WordPress Plugin – AP Custom Testimonial
- CVE-2022-23911AP Custom Testimonial < 1.4.8 - Admin+ SQL InjectionTestimonial WordPress Plugin – AP Custom Testimonial
- CVE-2022-0412TI WooCommerce Wishlist < 1.40.1 - Unauthenticated Blind SQL InjectionTemplateInvaders TI WooCommerce Wishlist
- CVE-2022-0411Asgaros Forum < 2.0.0 - Subscriber+ Blind SQL InjectionAsgaros Forum
- CVE-2022-0385Crazy Bone <= 0.6.0 - Unauthenticated Stored XSSCrazy Bone
- CVE-2022-0383WP Review Slider < 11.0 - Admin+ SQL InjectionWP Review Slider
- CVE-2022-0377LearnPress < 4.1.5 - Arbitrary Image RenamingLearnPress
- CVE-2022-0360WP Ultimate CSV Importer < 6.4.3 - Admin+ Stored Cross-Site ScriptingEasy Drag And drop All Import : WP Ultimate CSV Importer
- CVE-2022-0345Better Notifications for WP < 1.8.7 - Email Address DisclosureCustomize WordPress Emails and Alerts
- CVE-2022-0328Simple Membership < 4.0.9 - Arbitrary Member Deletion via CSRFSimple Membership
- CVE-2022-0189WP RSS Aggregator < 4.20 - Reflected Cross-Site Scripting (XSS)WP RSS Aggregator – News Feeds, Autoblogging, Youtube Video…
- CVE-2022-0150WP Accessibility Helper (WAH) < 0.6.0.7 - Reflected Cross-Site Scripting (XSS)WP Accessibility Helper
- CVE-2021-4222WP Paginate < 2.1.4 - Admin+ Stored Cross-Site ScriptingWP-Paginate
- CVE-2021-25118Yoast SEO 16.7-17.2 - Unauthenticated Full Path DisclosureYoast SEO
- CVE-2021-25112WHMCS Bridge < 6.4b - Reflected Cross-Site Scripting (XSS)WHMCS Bridge
- CVE-2021-25081WP Google Map < 1.8.4 - Arbitrary Post Deletion and Plugin's Settings Update via CSRFMaps Plugin using Google Maps for WordPress – WP Google Map
- CVE-2021-25042WP Visitor Statistics (Real Time Traffic) < 5.5 - Arbitrary IP Address Exclusion to Stored XSSWP Visitor Statistics
- CVE-2021-25034WP User < 7.0 - Reflected Cross-Site ScriptingWP User – Custom Registration Forms, Login and User Profile
- CVE-2021-25011WP Google Map < 1.8.1 - Subscriber+ Arbitrary Post Deletion and Plugin's Settings UpdateMaps Plugin using Google Maps for WordPress – WP Google Map
- CVE-2021-25010Post Snippets < 3.1.4 - CSRF to Stored Cross-Site ScriptingPost Snippets
- CVE-2021-24994WPvivid Backup and Migration Plugin < 0.9.69 - Unauthenticated Stored Cross-Site ScriptingMigration, Backup, Staging – WPvivid Backup and Migration P…
- CVE-2021-24977Use Any Font < 6.2.1 - Unauthenticated Arbitrary CSS AppendingUse Any Font | Custom Font Uploader
- CVE-2021-24971WP Responsive Menu < 3.1.7.1 - Subscriber+ Settings Update to Stored XSSWP Responsive Menu
- CVE-2021-24933Dynamic Widgets <= 1.5.16 - Reflected Cross-Site ScriptingDynamic Widgets
- CVE-2021-24920StatCounter < 2.0.7 - Admin+ Stored Cross-Site ScriptingStatCounter – Free Real Time Visitor Stats
- CVE-2021-24913Logo Showcase with Slick Slider < 2.0.1 - Arbitrary Media Title/Description/Alt Text/URL Update via CSRFLogo Showcase with Slick Slider – Logo Carousel, Logo Slide…
- CVE-2021-24903GRAND FlaGallery <= 6.1.2 - Admin+ Stored Cross-Site ScriptingAlbum and Image Gallery with Lightbox – Flagallery Photo Po…
- CVE-2021-24901Security Audit <= 1.0.0 - Admin+ Stored Cross Site ScriptingSecurity Audit
- CVE-2021-24898EditableTable <= 0.1.4 - Admin+ Stored Cross-Site ScriptingEditable Table Simple Fast FrontEnd From Sql tables
- CVE-2021-24864WP Cloudy < 4.4.9 - Admin+ SQL InjectionWP Cloudy, weather plugin
- CVE-2021-24823Support Board < 3.3.6 - Arbitrary File Deletion via CSRFSupport Board
- CVE-2021-24820Cost Calculator <= 1.6 - Authenticated Local File InclusionCost Calculator
- CVE-2021-24803Core Tweaks WP Setup <= 4.1 - Arbitrary Admin Account Creation / Admin Email Update via CSRFCore Tweaks WP Setup
- CVE-2021-24730Logo Showcase with Slick Slider < 1.2.5 - Subscriber+ Arbitrary Media Title/Description/Alt Text/URL UpdateLogo Showcase with Slick Slider – Logo Carousel, Logo Slide…
- CVE-2021-24704Orange Form <= 1.0 - SQL Injection via CSRFOrange Form
- CVE-2021-24689Contact Forms - Drag & Drop Contact Form Builder <= 1.0.5 - Admin+ Arbitrary System File ReadContact Forms – Drag & Drop Contact Form Builder
- CVE-2021-24688Orange Form <= 1.0.1 - Unauthenticated Arbitrary Post DeletionOrange Form
- CVE-2020-3651015Zine < 3.3.0 - Reflected Cross-Site Scripting15Zine
- CVE-2022-26159The auto-completion plugin in Ametys CMS before 4.5.0 allows a remote unauthenticated attacker to read documents such as plugins/web/service
- CVE-2021-43945Affected versions of Atlassian Jira Server and Data Center allow remote attackers with Roadmaps Administrator permissions to inject arbitrarAtlassian Jira Server · Atlassian Jira Data Center