CVEs published March 8, 2022
74 CVEs were published on March 8, 2022: 1 critical, 12 high. Browse them by severity, product and exploitation status.
- Published
- 74
- Critical
- 1
- High
- 12
- Medium
- 23
- Low
- 8
- Unrated
- 30
- Now in CISA KEV
- 0
- Fix available
- 51
Most affected products
- Samsung Mobile Devices
- 10
- nextcloud security-advisories
- 4
- icingaweb2
- 3
- Siemens Climatix POL909
- 3
- Siemens RUGGEDCOM i800 · Siemens RUGGEDCOM i800NC +140
- 3
- Siemens SINEC NMS · Siemens SINEMA Server
- 3
- kernel
- 2
- SAP SE SAP Focused Run
- 2
- Siemens Mendix Forgot Password Appstore module
- 2
- Siemens RUGGEDCOM i800 · Siemens RUGGEDCOM i801 +80
- 2
Critical 1
High 12
- CVE-2022-24739Server-Side Request Forgery (SSRF) and URL Redirection to Untrusted Site ('Open Redirect') in alltubeRudloff alltube · rudloff/alltube
- CVE-2022-24713Regular expression denial of service in Rust's regex craterust-lang regex · regex
- CVE-2022-24931Improper access control vulnerability in dynamic receiver in ApkInstaller prior to SMR MAR-2022 Release allows unauthorized attackers to…Samsung Mobile Devices
- CVE-2022-0877Cross-site Scripting (XSS) - Stored in bookstackapp/bookstackbookstackapp/bookstack · ssddanbrown/bookstack
- CVE-2021-42020A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i802, RUGGEDCOM…Siemens RUGGEDCOM i800 · Siemens RUGGEDCOM i800NC +124
- CVE-2021-42016A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i801, RUGGEDCOM i802, RUGGEDCOM i803, RUGGEDCOM M2100, RUGGEDCOM M2100F…Siemens RUGGEDCOM i800 · Siemens RUGGEDCOM i801 +80
- CVE-2021-43944This issue exists to document that a security improvement in the way that Jira Server and Data Center use templates has been implemented.Atlassian Jira Server · Atlassian Jira Data Center
- CVE-2022-24281A vulnerability has been identified in SINEC NMS (All versions < V1.0.3), SINEMA Server V14 (All versions).Siemens SINEC NMS · Siemens SINEMA Server
- CVE-2022-24282A vulnerability has been identified in SINEC NMS (All versions >= V1.0.3 < V2.0), SINEC NMS (All versions < V1.0.3), SINEMA Server V14…Siemens SINEC NMS · Siemens SINEMA Server
- CVE-2022-24715Arbitrary code execution for authenticated users in Icinga Web 2icingaweb2
- CVE-2022-24716Path traversal in Icinga Web 2icingaweb2
- CVE-2022-25311A vulnerability has been identified in SINEC NMS (All versions >= V1.0.3 < V2.0), SINEC NMS (All versions < V1.0.3), SINEMA Server V14…Siemens SINEC NMS · Siemens SINEMA Server
Medium, low and unrated 61
- CVE-2021-28488Ericsson Network Manager (ENM) before 21.2 has incorrect access-control behavior (that only affects the level of access available to…
- CVE-2022-24285Acer Care Center 4.00.30xx before 4.00.3042 contains a local privilege escalation vulnerability.
- CVE-2022-24286Acer QuickAccess 2.01.300x before 2.01.3030 and 3.00.30xx before 3.00.3038 contains a local privilege escalation vulnerability.
- CVE-2022-26337Trend Micro Password Manager (Consumer) installer version 5.0.0.1262 and below is vulnerable to an Uncontrolled Search Path Element…Trend Micro Password Manager
- CVE-2022-26319An installer search patch element vulnerability in Trend Micro Portable Security 3.0 Pro, 3.0 and 2.0 could allow a local attacker to…Trend Micro Portable Security
- CVE-2022-24714Disclosure of hosts and related data, linked to decommissioned services in Icinga Web 2icingaweb2
- CVE-2021-41241Advanced permissions is not respected for subfolders in Nextcloud servernextcloud security-advisories
- CVE-2021-41239User enumeration setting not respected in Nextcloud servernextcloud security-advisories
- CVE-2021-41181Nextcloud Talk app exposes chat messages on lockscreennextcloud security-advisories
- CVE-2021-41180Geolocation preview links can be set to arbitrary links in nextcloud talknextcloud security-advisories
- CVE-2022-25225Network Olympus version 1.8.0 allows an authenticated admin user to inject SQL queries in '/api/eventinstance' via the 'sqlparameter' JSON…Network Olympus
- CVE-2021-3698A flaw was found in Cockpit in versions prior to 260 in the way it handles the certificate verification performed by the System Security…cockpit
- CVE-2022-0516A vulnerability was found in kvm_s390_guest_sida_op in the arch/s390/kvm/kvm-s390.c function in KVM for s390 in the Linux kernel.kernel
- CVE-2021-4095A NULL pointer dereference was found in the Linux kernel's KVM when dirty ring logging is enabled without an active vCPU context.kernel
- CVE-2021-3981A flaw in grub2 was found where its configuration file, known as grub.cfg, is being created with the wrong permission set allowing non…grub2
- CVE-2022-25830Information Exposure vulnerability in Galaxy Watch3 Plugin prior to version 2.2.09.22012751 allows attacker to access password information…Samsung Mobile Galaxy Watch3 Plugin
- CVE-2022-25829Information Exposure vulnerability in Watch Active2 Plugin prior to version 2.2.08.22012751 allows attacker to access password information…Samsung Mobile Watch Active2 PlugIn
- CVE-2022-25828Information Exposure vulnerability in Watch Active Plugin prior to version 2.2.07.22012751 allows attacker to access password information…Samsung Mobile Watch Active PlugIn
- CVE-2022-25827Information Exposure vulnerability in Galaxy Watch Plugin prior to version 2.2.05.22012751 allows attacker to access password information…Samsung Mobile Galaxy Watch PlugIn
- CVE-2022-25826Information Exposure vulnerability in Galaxy S3 Plugin prior to version 2.2.03.22012751 allows attacker to access password information of…Samsung Mobile Galaxy S3 PlugIn
- CVE-2022-25825Improper access control vulnerability in Samsung Account prior to version 13.1.0.1 allows attackers to access to the authcode for sign-in.Samsung Mobile Samsung Account
- CVE-2022-25824Improper access control vulnerability in BixbyTouch prior to version 2.2.00.6 in China models allows untrusted applications to load…Samsung Mobile BixbyTouch
- CVE-2022-25823Information Exposure vulnerability in Galaxy Watch Plugin prior to version 2.2.05.220126741 allows attackers to access user information in…Samsung Mobile Galaxy Watch Plugin
- CVE-2022-25822An use after free vulnerability in sdp driver prior to SMR Mar-2022 Release 1 allows kernel crash.Samsung Mobile devices
- CVE-2022-25821Improper use of SMS buffer pointer in Shannon baseband prior to SMR Mar-2022 Release 1 allows OOB read.Samsung Mobile Devices
Show all 61 entriesShow fewer entries
- CVE-2022-25820A vulnerable design in fingerprint matching algorithm prior to SMR Mar-2022 Release 1 allows physical attackers to perform brute force…Samsung Mobile Devices
- CVE-2022-25819OOB read vulnerability in hdcp2 device node prior to SMR Mar-2022 Release 1 allow an attacker to view Kernel stack memory.Samsung Mobile Devices with Exynos chipsets
- CVE-2022-25818Improper boundary check in UWB stack prior to SMR Mar-2022 Release 1 allows arbitrary code execution.Samsung Mobile Devices
- CVE-2022-25817Improper authentication in One UI Home prior to SMR Mar-2022 Release 1 allows attacker to generate pinned-shortcut without user consent.Samsung Mobile Devices
- CVE-2022-25816Improper authentication in Samsung Lock and mask apps setting prior to SMR Mar-2022 Release 1 allows attacker to change enable/disable…Samsung Mobile Devices
- CVE-2022-25815PendingIntent hijacking vulnerability in Weather application prior to SMR Mar-2022 Release 1 allows local attackers to perform…Samsung Mobile Devices
- CVE-2022-25814PendingIntent hijacking vulnerability in Wearable Manager Installer prior to SMR Mar-2022 Release 1 allows local attackers to perform…Samsung Mobile Devices
- CVE-2022-24932Improper Protection of Alternate Path vulnerability in Setup wizard process prior to SMR Mar-2022 Release 1 allows physical attacker…Samsung Mobile Devices · Samsung Mobile Samsung Clould
- CVE-2022-24930An Improper access control vulnerability in StRetailModeReceiver in Wear OS 3.0 prior to Firmware update MAR-2022 Release allows untrusted…Samsung Mobile Samsung Wearable Devices
- CVE-2022-24929Unprotected Activity in AppLock prior to SMR Mar-2022 Release 1 allows attacker to change the list of locked app without authentication.Samsung Mobile Devices
- CVE-2022-24928Security misconfiguration of RKP in kernel prior to SMR Mar-2022 Release 1 allows a system not to be protected by RKP.Samsung Mobile Devices
- CVE-2022-26104SAP Financial Consolidation - version 10.1, does not perform necessary authorization checks for updating homepage messages, resulting for…SAP SE SAP Financial Consolidation
- CVE-2022-26103Under certain conditions, SAP NetWeaver (Real Time Messaging Framework) - version 7.50, allows an attacker to access information which…SAP SE SAP NetWeaver
- CVE-2022-26101Fiori launchpad - versions 754, 755, 756, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS)…SAP SE Fiori Launchpad
- CVE-2022-22547Simple Diagnostics Agent - versions 1.0 (up to version 1.57.), allows an attacker to access information which would otherwise be…SAP SE Simple Diagnostics Agent
- CVE-2022-24399The SAP Focused Run (Real User Monitoring) - versions 200, 300, REST service does not sufficiently sanitize the input name of the file…SAP SE SAP Focused Run
- CVE-2022-24395SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs…SAP SE SAP NetWeaver Enterprise Portal
- CVE-2022-26100SAPCAR - version 7.22, does not contain sufficient input validation on the SAPCAR archive.SAP SE SAPCAR
- CVE-2022-26102Due to missing authorization check, SAP NetWeaver Application Server for ABAP - versions 700, 701, 702, 731, allows an authenticated…SAP SE SAP NetWeaver Application Server for ABAP
- CVE-2022-24396The Simple Diagnostics Agent - versions 1.0 up to version 1.57, does not perform any authentication checks for functionalities that can be…SAP SE SAP Focused Run
- CVE-2022-24398Under certain conditions SAP Business Objects Business Intelligence Platform - versions 420, 430, allows an authenticated attacker to…SAP SE SAP Business Objects Business Intelligence Platform
- CVE-2022-26317A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.29).Siemens Mendix Applications using Mendix
- CVE-2022-26314A vulnerability has been identified in Mendix Forgot Password Appstore module (All versions >= V3.3.0 < V3.5.1), Mendix Forgot Password…Siemens Mendix Forgot Password Appstore module
- CVE-2022-26313A vulnerability has been identified in Mendix Forgot Password Appstore module (All versions >= V3.3.0 < V3.5.1).Siemens Mendix Forgot Password Appstore module
- CVE-2022-24661A vulnerability has been identified in Simcenter STAR-CCM+ Viewer (All versions < V2022.1).Siemens Simcenter STAR-CCM+ Viewer
- CVE-2022-24408A vulnerability has been identified in SINUMERIK MC (All versions < V1.15 SP1), SINUMERIK ONE (All versions < V6.15 SP1).Siemens SINUMERIK MC · Siemens SINUMERIK ONE
- CVE-2022-24309A vulnerability has been identified in Mendix Runtime V7 (All versions < V7.23.29), Mendix Runtime V8 (All versions < V8.18.16), Mendix…Siemens Mendix Runtime
- CVE-2021-44478A vulnerability has been identified in Polarion ALM (All versions < V21 R2 P2), Polarion WebClient for SVN (All versions).Siemens Polarion ALM · Siemens Polarion WebClient for SVN
- CVE-2021-42019A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i802, RUGGEDCOM…Siemens RUGGEDCOM i800 · Siemens RUGGEDCOM i800NC +140
- CVE-2021-42018A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i802, RUGGEDCOM…Siemens RUGGEDCOM i800 · Siemens RUGGEDCOM i800NC +140
- CVE-2021-42017A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i801, RUGGEDCOM i802, RUGGEDCOM i803, RUGGEDCOM M2100, RUGGEDCOM M2100F…Siemens RUGGEDCOM i800 · Siemens RUGGEDCOM i801 +80
- CVE-2021-41543A vulnerability has been identified in Climatix POL909 (AWB module) (All versions < V11.44), Climatix POL909 (AWM module) (All versions <…Siemens Climatix POL909
- CVE-2021-41542A vulnerability has been identified in Climatix POL909 (AWB module) (All versions < V11.44), Climatix POL909 (AWM module) (All versions <…Siemens Climatix POL909
- CVE-2021-41541A vulnerability has been identified in Climatix POL909 (AWB module) (All versions < V11.44), Climatix POL909 (AWM module) (All versions <…Siemens Climatix POL909
- CVE-2021-37209A vulnerability has been identified in RUGGEDCOM i800 (All versions < V4.3.8), RUGGEDCOM i801 (All versions < V4.3.8), RUGGEDCOM i802 (All…Siemens RUGGEDCOM i800 · Siemens RUGGEDCOM i801 +64
- CVE-2022-0856libcaca is affected by a Divide By Zero issue via img2txt, which allows a remote malicious user to cause a Denial of Servicelibcaca