CVEs published March 14, 2022
91 CVEs were published on March 14, 2022: 4 critical, 8 high. Browse them by severity, product and exploitation status.
- Published
- 91
- Critical
- 4
- High
- 8
- Medium
- 17
- Low
- 0
- Unrated
- 62
- Now in CISA KEV
- 0
- Fix available
- 56
Most affected products
- star7th/showdoc · showdoc/showdoc
- 7
- yandex clickhouse
- 7
- SmarterTools SmarterTrack
- 4
- Sylius · sylius/sylius
- 4
- Apache Software Foundation Apache HTTP Server
- 3
- IBM Spectrum Copy Data Management
- 3
- IBM Spectrum Protect Operations Center
- 2
- MOLIE – Instructure Canvas Linking tool
- 2
- Simple Quotation
- 2
- tribalsystems/zenario
- 2
Critical 4
- CVE-2022-0962Stored XSS viva .webma file upload in star7th/showdocstar7th/showdoc · showdoc/showdoc
- CVE-2022-0960Stored XSS viva .properties file upload in star7th/showdocstar7th/showdoc · showdoc/showdoc
- CVE-2022-0946Stored XSS viva cshtm file upload in star7th/showdocstar7th/showdoc · showdoc/showdoc
- CVE-2022-24387File upload and overwrite to app_data/Config in SmarterTrack v100.0.8019.14010SmarterTools SmarterTrack
High 8
- CVE-2022-24743Insufficient Session Expiration in SyliusSylius · sylius/sylius
- CVE-2022-21187Command Injectionlibvcs · vcspull
- CVE-2022-0941Stored XSS due to Unrestricted File Upload in star7th/showdocstar7th/showdoc · showdoc/showdoc
- CVE-2022-0938Stored XSS via file upload in star7th/showdocstar7th/showdoc · showdoc/showdoc
- CVE-2022-0943Heap-based Buffer Overflow occurs in vim in vim/vimvim/vim
- CVE-2022-20001Injection in fishfish-shell
- CVE-2022-24384Reflective XSS on SmarterTrack v100.0.8019.14010SmarterTools SmarterTrack
- CVE-2022-24386Stored XSS in SmarterTrack v100.0.8019.14010SmarterTools SmarterTrack
Medium, low and unrated 79
- CVE-2022-24762Exposure of Sensitive Information to an Unauthorized Actor in sysend.jsjcubic sysend.js · sysend
- CVE-2021-42391Divide-by-zero in Clickhouse's Gorilla compression codec when parsing a malicious query.yandex clickhouse
- CVE-2021-42390Divide-by-zero in Clickhouse's DeltaDouble compression codec when parsing a malicious query.yandex clickhouse
- CVE-2021-42389Divide-by-zero in Clickhouse's Delta compression codec when parsing a malicious query.yandex clickhouse
- CVE-2022-24740Improper Authentication in Voltoplone volto · @plone/volto
- CVE-2022-24749Basic Cross-site Scripting and Unrestricted Upload of File with Dangerous Type in SyliusSylius · sylius/sylius
- CVE-2022-24742Exposure of Sensitive Information Due to Incompatible Policies in SyliusSylius · sylius/sylius
- CVE-2022-24733Improper Restriction of Rendered UI Layers or Frames in SyliusSylius · sylius/sylius
- CVE-2022-26320The Rambus SafeZone Basic Crypto Module before 10.4.0, as used in certain Fujifilm (formerly Fuji Xerox) devices before 2022-03-01, Canon…
- CVE-2022-22353IBM Big SQL on IBM Cloud Pak for Data 7.1.0, 7.1.1, 7.2.0, and 7.2.3 could allow an authenticated user with appropriate permissions to…IBM Big SQL on Cloud Pak for Data
- CVE-2022-22348IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.13.xxx is vulnerable to reverse tabnabbing where it could allow a page linked…IBM Spectrum Protect Operations Center
- CVE-2022-22346IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.13.xxx is vulnerable to cross-site request forgery which could allow an…IBM Spectrum Protect Operations Center
- CVE-2021-38971IBM Data Virtualization on Cloud Pak for Data 1.3.0, 1.4.1, 1.5.0, 1.7.1 and 1.7.3 could allow an authorized user to bypass data masking…IBM Data Virtualization on Cloud Pak for Data
- CVE-2022-22354IBM Spectrum Protect Plus 10.1.0.0 through 10.1.9.2 and IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 do not limit the length…IBM Spectrum Copy Data Management · IBM Spectrum Protect Pl…
- CVE-2022-22344IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 is vulnerable to HTTP header injection, caused by improper validation of input…IBM Spectrum Copy Data Management
- CVE-2021-39055IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 is vulnerable to cross-site scripting.IBM Spectrum Copy Data Management
- CVE-2021-39051IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 is vulnerable to server-side request forgery, caused by improper input of…IBM Spectrum Copy Data Management
- CVE-2021-41952Zenario CMS 9.0.54156 is vulnerable to Cross Site Scripting (XSS) via upload file to *.SVG.tribalsystems/zenario
- CVE-2021-42171Zenario CMS 9.0.54156 is vulnerable to File Upload.tribalsystems/zenario
- CVE-2022-22735Simple Quotation <= 1.3.2 - Subscriber+ SQL injectionSimple Quotation
- CVE-2022-22734Simple Quotation <= 1.3.2 - Quote Creation/Edition via CSRF to Stored Cross-Site ScriptingSimple Quotation
- CVE-2022-0703GD Mylist <= 1.1.1 - Admin+ Stored Cross-Site ScriptingGDMylist
- CVE-2022-0702Petfinder Listings <= 1.0.18 - Admin+ Stored Cross-Site ScriptingPetfinder Listings
- CVE-2022-0701SEO 301 Meta <= 1.9.1 - Admin+ Stored Cross-Site ScriptingSeo 301 Meta
- CVE-2022-0700Simple Theme Options < 1.7 - Admin+ Stored Cross-Site ScriptingSimple Tracking
Show all 79 entriesShow fewer entries
- CVE-2022-0684WP Home Page Menu < 3.1 - Admin+ Stored Cross-Site ScriptingWP Home Page Menu
- CVE-2022-0674Kunze Law < 2.1 - Admin+ Stored Cross-Site ScriptingKunze Law
- CVE-2022-0659Sync iCloud COS < 2.0.1 - Admin+ Stored Cross-Site ScriptingSync QCloud COS
- CVE-2022-0658CommonsBooking < 2.6.8 - Unauthenticated SQL InjectionCommonsBooking
- CVE-2022-0648Team Circle Image Slider With Lightbox < 1.0.16 - Reflected Cross-Site ScriptingTeam Circle Image Slider With Lightbox
- CVE-2022-0601Countdown & Clock < 2.2.9 - Reflected Cross-Site ScriptingCountdown, Coming Soon, Maintenance – Countdown & Clock
- CVE-2022-0593Login with phone number < 1.3.7 - Unauthenticated remote plugin deletionLogin with phone number
- CVE-2022-0503Multisite Content Copier/Updater < 2.1.2 - Reflected Cross-Site ScriptingWordPress Multisite Content Copier/Updater
- CVE-2022-0478Event Manager for WooCommerce < 3.5.8 - Contributor+ SQL InjectionEvent Manager and Tickets Selling Plugin for WooCommerce
- CVE-2022-0449Flexi - Guest Submit < 4.20 - Reflected Cross-Site ScriptingFlexi – Guest Submit
- CVE-2022-0399Advanced Product Labels for WooCommerce < 1.2.3.7 - Reflected Cross-Site ScriptingAdvanced Product Labels for WooCommerce
- CVE-2022-0327Master Addons for Elementor < 1.8.2 - Reflected Cross-Site ScriptingMaster Addons for Elementor
- CVE-2022-0321WP Voting Contest < 3.0 - Reflected Cross-Site ScriptingWP Voting Contest
- CVE-2022-0254Zero Spam < 5.2.11 - Admin+ SQL InjectionWordPress Zero Spam · bmarshall511/wordpress_zero_spam
- CVE-2022-0248Contact Form Submissions < 1.7.3 - Unauthenticated Stored XSSContact Form Submissions
- CVE-2022-0230Better WordPress Google XML Sitemaps <= 1.4.1 - Unauthenticated Stored Cross-Site ScriptingBetter WordPress Google XML Sitemaps
- CVE-2022-0169Photo Gallery by 10Web < 1.6.0 - Unauthenticated SQL InjectionPhoto Gallery by 10Web – Mobile-Friendly Image Gallery
- CVE-2022-0165Page Builder KingComposer <= 2.9.6 - Open RedirectPage Builder: KingComposer – Free Drag and Drop page builde…
- CVE-2022-0161ARI Fancy Lightbox < 1.3.9 - Reflected Cross-Site ScriptingARI Fancy Lightbox – WordPress Popup
- CVE-2022-0147Cookie Information < 2.0.8 - Reflected Cross-Site ScriptingCookie Information | Free GDPR Consent Solution
- CVE-2021-25026Patreon WordPress < 1.8.2 - Admin+ Stored Cross-Site ScriptingPatreon WordPress
- CVE-2021-25007MOLIE <= 0.5 - Authenticated SQL InjectionMOLIE – Instructure Canvas Linking tool
- CVE-2021-25006MOLIE <= 0.5 - Reflected Cross-Site ScriptingMOLIE – Instructure Canvas Linking tool
- CVE-2021-25003WPCargo < 6.9.0 - Unauthenticated RCEWPCargo Track & Trace
- CVE-2021-24996IDPay for Contact Form 7 <= 2.1.2 - Reflected Cross-Site ScriptingIDPay for Contact Form
- CVE-2021-24995HTML5 Responsive FAQ <= 2.8.5 - Admin+ Stored Cross-Site ScriptingHTML5 Responsive FAQ
- CVE-2021-24982Child Theme Generator <= 2.2.7 - Reflected Cross-Site ScriptingChild Theme Generator
- CVE-2021-24966Error Log Viewer Plugin <= 1.1.1 - Admin+ Arbitrary File ClearingError Log Viewer by BestWebSoft
- CVE-2021-24959WP Email Users <= 1.7.6 - Subscriber+ SQL InjectionWP Email Users
- CVE-2021-24958Meks Easy Photo Feed Widget < 1.2.4 - Subscriber+ Settings Update to Stored XSSMeks Easy Photo Feed Widget
- CVE-2021-24950Insight Core <= 1.0 - Subscriber+ PHP Object Injection & Stored XSSInsight Core
- CVE-2021-24940Persian Woocommerce <= 5.8.0 - Reflected Cross-Site Scriptingووکامرس فارسی
- CVE-2021-24897Add Subtitle <= 1.1.0 - Contributor+ Stored Cross-Site ScriptingAdd Subtitle
- CVE-2021-24895Cybersoldier < 1.7.0 - Admin+ Stored Cross-Site ScriptingCybersoldier
- CVE-2021-24692Simple Download Monitor < 3.9.5 - Contributor+ Arbitrary File Download via Path TraversalSimple Download Monitor
- CVE-2021-44964Use after free in garbage collector and finalizer of lgc.c in Lua interpreter 5.4.0~5.4.3 allows attackers to perform Sandbox Escape via a…
- CVE-2022-24576GPAC 1.0.1 is affected by Use After Free through MP4Box.
- CVE-2022-24575GPAC 1.0.1 is affected by a stack-based buffer overflow through MP4Box.
- CVE-2022-0940Stored XSS due to Unrestricted File Upload in star7th/showdocstar7th/showdoc · showdoc/showdoc
- CVE-2022-23943mod_sed: Read/write beyond boundsApache Software Foundation Apache HTTP Server · apache
- CVE-2022-22721core: Possible buffer overflow with very large or unlimited LimitXMLRequestBodyApache Software Foundation Apache HTTP Server
- CVE-2022-22720HTTP request smuggling vulnerability in Apache HTTP Server 2.4.52 and earlierApache Software Foundation Apache HTTP Server
- CVE-2022-22719mod_lua Use of uninitialized value of in r:parsebodyApache Software Foundation Apache HTTP Server
- CVE-2022-0341Cross-site Scripting (XSS) - Stored in vanessa219/vditorvanessa219/vditor · vditor
- CVE-2022-0937Stored xss in showdoc through file upload in star7th/showdocstar7th/showdoc · showdoc/showdoc
- CVE-2021-43954The DefaultRepositoryAdminService class in Fisheye and Crucible before version 4.8.9 allowed remote attackers, who have 'can add…Atlassian Fisheye · Atlassian Crucible
- CVE-2021-42387Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query.yandex clickhouse
- CVE-2021-42388Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query.yandex clickhouse
- CVE-2021-43304Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query.yandex clickhouse
- CVE-2021-43305Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query.yandex clickhouse
- CVE-2022-24385Information disclosure via direct object access on SmarterTrack v100.0.8019.14010SmarterTools SmarterTrack
- CVE-2022-24574GPAC 1.0.1 is affected by a NULL pointer dereference in gf_dump_vrml_field.isra ().
- CVE-2022-24577GPAC 1.0.1 is affected by a NULL pointer dereference in gf_utf8_wcslen.
- CVE-2022-24578GPAC 1.0.1 is affected by a heap-based buffer overflow in SFS_AddString () at bifs/script_dec.c.