CVEs published in February 2022
2,617 vulnerabilities, 311 critical, 18 exploited.
KernelLinuxnet: do not keep the dst cache when uncloning an skb dst and its metadataNo scoreKernelLinuxipmr,ip6mr: acquire RTNL before calling ip[6]mr_free_table() on failure pathNo scoreKernelLinuxscsi: target: iscsi: Make sure the np under each tpg is uniqueNo scoreKernelLinuxusb: f_fs: Fix use-after-free for epfileNo scoreKernelLinuxlibsubcmd: Fix use-after-free for realloc(..., 0)No scoreKernelLinuxdrop_monitor: fix data-race in dropmon_net_event / trace_napi_poll_hitNo scoreKernelLinuxax25: improve the incomplete fix to avoid UAF and NPD bugsNo scoreKernelLinuxvsock: remove vsock from connected table when connect is interrupted by a signalNo scoreKernelLinuxnet: ieee802154: at86rf230: Stop leaking skb'sNo scoreKernelLinuxparisc: Fix data TLB miss in sba_unmap_sgNo scoreKernelLinuxiwlwifi: fix use-after-freeNo scoreKernelLinuxperf: Fix list corruption in perf_cgroup_switch()No scoreKernelLinuxvt_ioctl: fix array_index_nospec in vt_setactivateNo scoreKernelLinuxnet: usb: ax88179_178a: Fix out-of-bounds accesses in RX fixupNo scoreKernelLinuxnet: fix a memleak when uncloning an skb dst and its metadataNo scoreKernelLinuxnet: do not keep the dst cache when uncloning an skb dst and its metadataNo scoreKernelLinuxipmr,ip6mr: acquire RTNL before calling ip[6]mr_free_table() on failure pathNo scoreKernelLinuxscsi: target: iscsi: Make sure the np under each tpg is uniqueNo scoreKernelLinuxusb: f_fs: Fix use-after-free for epfileNo scoreKernelLinuxnet: ieee802154: at86rf230: Stop leaking skb'sNo scoreKernelLinuxax25: improve the incomplete fix to avoid UAF and NPD bugsNo scoreKernelLinuxlibsubcmd: Fix use-after-free for realloc(..., 0)No scoreKernelLinuxparisc: Fix data TLB miss in sba_unmap_sgNo scoreKernelLinuxdrop_monitor: fix data-race in dropmon_net_event / trace_napi_poll_hitNo scoreKernelLinuxvsock: remove vsock from connected table when connect is interrupted by a signalNo scoreKernelLinuxvt_ioctl: fix array_index_nospec in vt_setactivateNo scoreKernelLinuxnet: usb: ax88179_178a: Fix out-of-bounds accesses in RX fixupNo scoreKernelLinuxnet: fix a memleak when uncloning an skb dst and its metadataNo scoreKernelLinuxipmr,ip6mr: acquire RTNL before calling ip[6]mr_free_table() on failure pathNo scoreKernelLinuxnet: do not keep the dst cache when uncloning an skb dst and its metadataNo scoreKernelLinuxscsi: target: iscsi: Make sure the np under each tpg is uniqueNo scoreghostscriptOSS-FuzzHeap-buffer-overflow in spgetccNo scorendpiOSS-FuzzHeap-buffer-overflow in ndpi_workflow_process_packetNo score- zulip, zulip zulip/zulip +1 moreImproper Access Control in zulip/zulip4.1 Medium
- sangfor vdi clientSangforCSClient.exe in Sangfor VDI Client 5.4.2.1006 allows attackers, when they are able to read...5.5 Medium
- tricentis qtestTricentis qTest before 10.4 allows stored XSS by an authenticated attacker.5.4 Medium
- osu ohio supercomputer center open ondemandThe Job Composer app in Ohio Supercomputer Center Open OnDemand before 1.7.19 and 1.8.x before 1...4.3 Medium
- strapi, strapi strapi/strapi +1 moreArbitrary Command Injection in strapi/strapi6.1 Medium
- python pillow, fedoraproject fedora +1 morePath traversal in Pillow9.1 Critical
- microweber, microweber microweber/microweber +1 moreCross-site Scripting (XSS) - Reflected in microweber/microweber8.0 High
- microweber, microweber microweber/microweber +1 moreCross-site Scripting (XSS) - Stored in microweber/microweber4.3 Medium
- microweber, microweber microweber/microweber +1 moreIncorrect Authorization in microweber/microweber5.5 Medium
- iclinks scadaflex ii firmware, weblib +1 moreOn ICL ScadaFlex II SCADA Controller SC-1 and SC-2 1.03.07 devices, unauthenticated remote...9.1 Critical
- kde kcronKDE KCron through 21.12.2 uses a temporary file in /tmp when saving, but reuses the filename...7.8 High
- linux kernel, netapp bootstrap os, cloud volumes ontap mediator +14 more +16 moreAn issue was discovered in the Linux kernel through 5.16.11. The mixed IPID assignment method...5.9 Medium
- torproject torTor Browser 9.0.7 on Windows 10 build 10586 is vulnerable to information disclosure. This could...5.5 Medium
- modx revolutionUnrestricted Upload of File with Dangerous Type in MODX Revolution7.2 High
- xmlsoft libxml2, apple ipados, iphone os +36 more +38 morevalid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.7.5 High
- zulip, zulip server +1 moreMulti-use invitations can grant access to other organizations in Zulip7.2 High
- home owners collection management system project owners collection management systemHome Owners Collection Management System v1.0 was discovered to contain a SQL injection...9.8 Critical
- Show moreLoading…