CVEs published March 29, 2022
105 CVEs were published on March 29, 2022: 17 critical, 13 high. 2 are now in CISA KEV.
- Published
- 105
- Critical
- 17
- High
- 13
- Medium
- 15
- Low
- 6
- Unrated
- 54
- Now in CISA KEV
- 2
- Fix available
- 43
Most affected products
- Delta Electronics DIAEnergie
- 17
- Jenkins project Jenkins Continuous Integration with Toad Ed…
- 4
- Jenkins project Jenkins Job and Node ownership Plugin · com…
- 4
- Jenkins project Jenkins Pipeline: Phoenix AutoTest Plugin ·…
- 4
- Jenkins project Jenkins Proxmox Plugin · org.jenkins-ci.plu…
- 4
- SaltStack Salt · salt
- 4
- SourceCodester One Church Management System
- 3
- Jenkins project Jenkins Bitbucket Server Integration Plugin…
- 2
- Jenkins project Jenkins JiraTestResultReporter Plugin · org…
- 2
- Jenkins project Jenkins RocketChat Notifier Plugin · org.je…
- 2
Critical 17
- CVE-2022-26871An arbitrary file upload vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to upload an arbitrary filTrend Micro Apex Central
- CVE-2022-27175Delta Electronics DIAEnergie SQL Injection in GetCalcTagListDelta Electronics DIAEnergie
- CVE-2022-26667Delta Electronics DIAEnergie SQL Injection in GetDemandAnalysisDataDelta Electronics DIAEnergie
- CVE-2022-26338Delta Electronics DIAEnergie SQL Injection in DIAE_hierarchyHandler.ashxDelta Electronics DIAEnergie
- CVE-2022-26514Delta Electronics DIAEnergie SQL Injection in DIAE_tagHandler.ashxDelta Electronics DIAEnergie
- CVE-2022-26666Delta Electronics DIAEnergie SQL Injection in HandlerDialogECC.ashxDelta Electronics DIAEnergie
- CVE-2022-26887Delta Electronics DIAEnergie SQL Injection in DIAE_HandlerTag_KID.ashxDelta Electronics DIAEnergie
- CVE-2022-26836Delta Electronics DIAEnergie SQL Injection in HandlerExport.ashx/Calendar.ashxDelta Electronics DIAEnergie
- CVE-2022-26349Delta Electronics DIAEnergie SQL Injection in DIAE_eccoefficientHandler.ashxDelta Electronics DIAEnergie
- CVE-2022-26065Delta Electronics DIAEnergie SQL Injection in GetLatestDemandNode and GetDemandAnalysisDataDelta Electronics DIAEnergie
- CVE-2022-26013Delta Electronics DIAEnergie SQL Injection in DIAE_dmdsetHandler.ashxDelta Electronics DIAEnergie
- CVE-2022-25880Delta Electronics DIAEnergie SQL Injection in DIAE_hierarchyHandler.ashxDelta Electronics DIAEnergie
- CVE-2022-0923Delta Electronics DIAEnergie SQL Injection in HandlerDialog_KID.ashxDelta Electronics DIAEnergie
- CVE-2022-26069Delta Electronics DIAEnergie SQL Injection in HandlerPage_KID.ashxDelta Electronics DIAEnergie
- CVE-2022-25347Delta Electronics DIAEnergie Path TraversalDelta Electronics DIAEnergie
- CVE-2022-25980Delta Electronics DIAEnergie SQL Injection in HandlerCommon.ashxDelta Electronics DIAEnergie
- CVE-2022-26059Delta Electronics DIAEnergie SQL Injection in GetQueryDataDelta Electronics DIAEnergie
High 13
- CVE-2022-21821NVIDIA CUDA Toolkit SDK contains an integer overflow vulnerability in cuobjdump.To exploit this vulnerability, a remote attacker would…NVIDIA CUDA Toolkit
- CVE-2022-26839Delta Electronics DIAEnergie Incorrect Default PermissionsDelta Electronics DIAEnergie
- CVE-2022-1055Use after Free in tc_new_tfilter allowing for privilege escalation in Linux KernelLinux Kernel
- CVE-2022-28136A cross-site request forgery (CSRF) vulnerability in Jenkins JiraTestResultReporter Plugin 165.v817928553942 and earlier allows attackers…Jenkins project Jenkins JiraTestResultReporter Plugin · org…
- CVE-2022-1032Insecure deserialization of not validated module file in crater-invoice/cratercrater-invoice/crater
- CVE-2022-1084SourceCodester One Church Management System Session userregister.php improper authenticationSourceCodester One Church Management System
- CVE-2022-1083Microfinance Management System sql injectionMicrofinance Management System
- CVE-2022-1082SourceCodester Microfinance Management System Login Page login.php sql injectionSourceCodester Microfinance Management System
- CVE-2022-1080SourceCodester One Church Management System attendancy.php sql injectionSourceCodester One Church Management System
- CVE-2022-1078SourceCodester College Website Management System sql injectionSourceCodester College Website Management System
- CVE-2022-1073Automatic Question Paper Generator password recoveryAutomatic Question Paper Generator
- CVE-2022-22936An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1.SaltStack Salt · salt
- CVE-2022-22941An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1.SaltStack Salt · salt
Medium, low and unrated 75
- CVE-2021-41594In RSA Archer 6.9.SP1 P3, if some application functions are precluded by the Administrator, this can be bypassed by intercepting the API…
- CVE-2022-26951Archer 6.x through 6.10 (6.10.0.0) contains a reflected XSS vulnerability.
- CVE-2022-26950Archer 6.x through 6.9 P2 (6.9.0.2) is affected by an open redirect vulnerability.
- CVE-2022-26949Archer 6.x through 6.9 SP2 P1 (6.9.2.1) contains an improper access control vulnerability on attachments.
- CVE-2022-26948The Archer RSS feed integration for Archer 6.x through 6.9 SP1 (6.9.1.0) is affected by an insecure credential storage vulnerability.
- CVE-2022-26947Archer 6.x through 6.9 SP3 (6.9.3.0) contains a reflected XSS vulnerability.
- CVE-2022-27432A Cross-Site Request Forgery (CSRF) in Pluck CMS v4.7.15 allows attackers to change the password of any given user by exploiting this…
- CVE-2022-27815SWHKD 1.1.5 unsafely uses the /tmp/swhkd.pid pathname.Simple-Wayland-HotKey-Daemon
- CVE-2015-3298Yubico ykneo-openpgp before 1.0.10 has a typo in which an invalid PIN can be used.
- CVE-2022-26244A stored cross-site scripting (XSS) vulnerability in Hospital Patient Record Management System v1.0 allows attackers to execute arbitrary…
- CVE-2021-44082textpattern 4.8.7 is vulnerable to Cross Site Scripting (XSS) via /textpattern/index.php,Body.
- CVE-2021-43118A Remote Command Injection vulnerability exists in DrayTek Vigor 2960 1.5.1.3, DrayTek Vigor 3900 1.5.1.3, and DrayTek Vigor 300B 1.5.1.3…
- CVE-2021-42911A Format String vulnerability exists in DrayTek Vigor 2960 <= 1.5.1.3, DrayTek Vigor 3900 <= 1.5.1.3, and DrayTek Vigor 300B <= 1.5.1.3 in…
- CVE-2021-43110An Access Conrol vulnerability exists in PuneethReddyHC online-shopping-system as of 11/01/2021 in add_products.
- CVE-2021-43109An SQL Injection vulnerability exits in PuneethReddyHC online-shopping-system as of 11/01/2021 via the p parameter in product.php.
- CVE-2022-1122A flaw was found in the opj2_decompress program in openjpeg2 2.4.0 in the way it handles an input directory with a large number of files.openjpeg2
- CVE-2022-22948The vCenter Server contains an information disclosure vulnerability due to improper permission of files.VMware vCenter Server and VMware Cloud Foundation
- CVE-2021-42970Cross Site Scripting (XSS) vulnerability exists in cxuucms v3 via the imgurl of /feedback/post/ content parameter.
- CVE-2021-44081A buffer overflow vulnerability exists in the AMF of open5gs 2.1.4.
- CVE-2021-43701CSZ CMS 1.2.9 has a Time and Boolean-based Blind SQL Injection vulnerability in the endpoint /admin/export/getcsv/article_db, via the…
- CVE-2022-0343Local Priviledge escalation in Perfetto Dev scriptsGoogle Perfetto Dev Scripts
- CVE-2021-22572Data-transfer-project information disclosure via tmp directoryGoogle Data-Transfer-Project
- CVE-2022-28160Jenkins Tests Selector Plugin 1.3.3 and earlier allows users with Item/Configure permission to read arbitrary files on the Jenkins…Jenkins project Jenkins Tests Selector Plugin · org.jenkins…
- CVE-2022-28159Jenkins Tests Selector Plugin 1.3.3 and earlier does not escape the Properties File Path option for Choosing Tests parameters, resulting…Jenkins project Jenkins Tests Selector Plugin · org.jenkins…
- CVE-2022-28158A missing permission check in Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier allows attackers with Overall/Read permission to…Jenkins project Jenkins Pipeline: Phoenix AutoTest Plugin ·…
Show all 75 entriesShow fewer entries
- CVE-2022-28157Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier allows attackers with Item/Configure permission to upload arbitrary files from…Jenkins project Jenkins Pipeline: Phoenix AutoTest Plugin ·…
- CVE-2022-28156Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier allows attackers with Item/Configure permission to copy arbitrary files and…Jenkins project Jenkins Pipeline: Phoenix AutoTest Plugin ·…
- CVE-2022-28155Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Jenkins project Jenkins Pipeline: Phoenix AutoTest Plugin ·…
- CVE-2022-28154Jenkins Coverage/Complexity Scatter Plot Plugin 1.1.1 and earlier does not configure its XML parser to prevent XML external entity (XXE)…Jenkins project Jenkins Coverage/Complexity Scatter Plot Pl…
- CVE-2022-28153Jenkins SiteMonitor Plugin 0.6 and earlier does not escape URLs of sites to monitor in tooltips, resulting in a stored cross-site…Jenkins project Jenkins SiteMonitor Plugin · org.jvnet.huds…
- CVE-2022-28152A cross-site request forgery (CSRF) vulnerability in Jenkins Job and Node ownership Plugin 0.13.0 and earlier allows attackers to restore…Jenkins project Jenkins Job and Node ownership Plugin · com…
- CVE-2022-28151A missing permission check in Jenkins Job and Node ownership Plugin 0.13.0 and earlier allows attackers with Item/Read permission to…Jenkins project Jenkins Job and Node ownership Plugin · com…
- CVE-2022-28150A cross-site request forgery (CSRF) vulnerability in Jenkins Job and Node ownership Plugin 0.13.0 and earlier allows attackers to change…Jenkins project Jenkins Job and Node ownership Plugin · com…
- CVE-2022-28149Jenkins Job and Node ownership Plugin 0.13.0 and earlier does not escape the names of the secondary owners, resulting in a stored…Jenkins project Jenkins Job and Node ownership Plugin · com…
- CVE-2022-28148The file browser in Jenkins Continuous Integration with Toad Edge Plugin 2.3 and earlier may interpret some paths to files as absolute on…Jenkins project Jenkins Continuous Integration with Toad Ed…
- CVE-2022-28147A missing permission check in Jenkins Continuous Integration with Toad Edge Plugin 2.3 and earlier allows attackers with Overall/Read…Jenkins project Jenkins Continuous Integration with Toad Ed…
- CVE-2022-28146Jenkins Continuous Integration with Toad Edge Plugin 2.3 and earlier allows attackers with Item/Configure permission to read arbitrary…Jenkins project Jenkins Continuous Integration with Toad Ed…
- CVE-2022-28145Jenkins Continuous Integration with Toad Edge Plugin 2.3 and earlier does not apply Content-Security-Policy headers to report files it…Jenkins project Jenkins Continuous Integration with Toad Ed…
- CVE-2022-28144Jenkins Proxmox Plugin 0.7.0 and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with…Jenkins project Jenkins Proxmox Plugin · org.jenkins-ci.plu…
- CVE-2022-28143A cross-site request forgery (CSRF) vulnerability in Jenkins Proxmox Plugin 0.7.0 and earlier allows attackers to connect to an…Jenkins project Jenkins Proxmox Plugin · org.jenkins-ci.plu…
- CVE-2022-28142Jenkins Proxmox Plugin 0.6.0 and earlier disables SSL/TLS certificate validation globally for the Jenkins controller JVM when configured…Jenkins project Jenkins Proxmox Plugin · org.jenkins-ci.plu…
- CVE-2022-28141Jenkins Proxmox Plugin 0.5.0 and earlier stores the Proxmox Datacenter password unencrypted in the global config.xml file on the Jenkins…Jenkins project Jenkins Proxmox Plugin · org.jenkins-ci.plu…
- CVE-2022-28140Jenkins Flaky Test Handler Plugin 1.2.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Jenkins project Jenkins Flaky Test Handler Plugin · org.jen…
- CVE-2022-28139A missing permission check in Jenkins RocketChat Notifier Plugin 1.4.10 and earlier allows attackers with Overall/Read permission to…Jenkins project Jenkins RocketChat Notifier Plugin · org.je…
- CVE-2022-28138A cross-site request forgery (CSRF) vulnerability in Jenkins RocketChat Notifier Plugin 1.4.10 and earlier allows attackers to connect to…Jenkins project Jenkins RocketChat Notifier Plugin · org.je…
- CVE-2022-28137A missing permission check in Jenkins JiraTestResultReporter Plugin 165.v817928553942 and earlier allows attackers with Overall/Read…Jenkins project Jenkins JiraTestResultReporter Plugin · org…
- CVE-2022-28135Jenkins instant-messaging Plugin 1.41 and earlier stores passwords for group chats unencrypted in the global configuration file of plugins…Jenkins project Jenkins instant-messaging Plugin · org.jvne…
- CVE-2022-28134Jenkins Bitbucket Server Integration Plugin 3.1.0 and earlier does not perform permission checks in several HTTP endpoints, allowing…Jenkins project Jenkins Bitbucket Server Integration Plugin…
- CVE-2022-28133Jenkins Bitbucket Server Integration Plugin 3.1.0 and earlier does not limit URL schemes for callback URLs on OAuth consumers, resulting…Jenkins project Jenkins Bitbucket Server Integration Plugin…
- CVE-2022-23903A Cross Site Scripting (XSS) vulnerability exists in pearadmin pear-admin-think <=5.0.6, which allows a login account to access arbitrary…
- CVE-2022-23901A stack overflow re2c 2.2 exists due to infinite recursion issues in src/dfa/dead_rules.cc.
- CVE-2022-23059Shopizer - Stored XSS in Manage Imagesshopizer-ecommerce Shopizer · com.shopizer:shopizer
- CVE-2021-46743In Firebase PHP-JWT before 6.0.0, an algorithm-confusion issue (e.g., RS256 / HS256) exists via the kid (aka Key ID) header, when multiple…firebase/php-jwt
- CVE-2022-1087htmly Edit Profile Module cross site scriptinghtmly
- CVE-2022-1086DolphinPHP User Management Page cross site scriptingDolphinPHP
- CVE-2022-1085CLTPHP POST Parameter cross site scriptingCLTPHP
- CVE-2022-1081SourceCodester Microfinance Management System addcustomerHandler.php cross site scriptingSourceCodester Microfinance Management System
- CVE-2022-1079SourceCodester One Church Management System churchprofile.php cross site scriptingSourceCodester One Church Management System
- CVE-2022-1077TEM FLEX-1080/FLEX-1085 Log information disclosureTEM FLEX-1080 · TEM FLEX-1085
- CVE-2022-1076Automatic Question Paper Generator System My Account Page login.php cross site scriptingAutomatic Question Paper Generator System
- CVE-2022-1075College Website Management System Contact cross site scriptingCollege Website Management System
- CVE-2022-1074TEM FLEX-1085 injectionTEM FLEX-1085
- CVE-2022-23937In Wind River VxWorks 6.9 and 7, a specific crafted packet may lead to an out-of-bounds read during an IKE initial exchange scenario.
- CVE-2022-24957DHC Vision eQMS through 5.4.8.322 has Persistent XSS due to insufficient encoding of untrusted input/output.
- CVE-2022-24956An issue was discovered in Shopware B2B-Suite through 4.4.1.
- CVE-2022-25420NTT Resonant Incorporated goo blog App Web Application 1.0 is vulnerable to CLRF injection.
- CVE-2021-44581An SQL Injection vulnerabilty exists in Kreado Kreasfero 1.5 via the id parameter.
- CVE-2021-45865A File Upload vulnerability exists in Sourcecodester Student Attendance Manageent System 1.0 via the file upload functionality.
- CVE-2021-45866A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Student Attendance Management System 1.0 via the couse filed in…
- CVE-2022-26269Suzuki Connect v1.0.15 allows attackers to tamper with displayed messages via spoofed CAN messages.
- CVE-2022-0331An information disclosure vulnerability in Webadmin allows an unauthenticated remote attacker to read the device serial number in Sophos…Sophos Firewall
- CVE-2022-1050A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device.QEMU
- CVE-2022-22934An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1.SaltStack Salt · salt
- CVE-2022-22935An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1.SaltStack Salt · salt
- CVE-2022-25521NUUO v03.11.00 was discovered to contain access control issue.