CVEs published March 1, 2022
53 CVEs were published on March 1, 2022: 5 critical, 7 high.
- Published
- 53
- Critical
- 5
- High
- 7
- Medium
- 9
- Low
- 2
- Unrated
- 30
- Now in CISA KEV
- 0
- Fix available
- 8
Most affected products
- Finastra ssr-pages · @finastra/ssr-pages
- 2
- Fortinet FortiMail
- 2
- Fortinet FortiWLM
- 2
- IBM MQ Appliance
- 2
- andreapollastri/cipi
- 1
- ASUS Armoury Crate & Aura Creator Installer
- 1
- F-Secure endpoint protection products on Mac, F-Secure Linu…
- 1
- fluture-js fluture-node · fluture-node
- 1
- Fortinet FortiManager, FortiAnalyzer
- 1
- Fortinet FortiOS
- 1
Critical 5
- CVE-2021-41193Use of Externally-Controlled Format String in wire-avswireapp wire-avs · com.wire:avs
- CVE-2021-36166An improper authentication vulnerability in FortiMail before 7.0.1 may allow a remote attacker to efficiently guess one administrative accouFortinet FortiMail
- CVE-2021-4039A command injection vulnerability in the web interface of the Zyxel NWA-1100-NH firmware could allow an attacker to execute arbitrary OS comZyxel NWA1100-NH firmware
- CVE-2020-12775Hicos citizen certificate client-side component - Command InjectionHicos citizen certificate client-side component
- CVE-2022-24720Improper Input Validation in image_processingjanko image_processing · image_processing
High 7
- CVE-2022-24718Path Traversal in ssr-pagesFinastra ssr-pages · @finastra/ssr-pages
- CVE-2021-43077A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiWLM version 8.6.2 and below, versionFortinet FortiWLM
- CVE-2021-43075A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.2 and below, vFortinet FortiWLM
- CVE-2021-32586An improper input validation vulnerability in the web server CGI facilities of FortiMail before 7.0.1 may allow an unauthenticated attacker Fortinet FortiMail
- CVE-2021-36171The use of a cryptographically weak pseudo-random number generator in the password reset feature of FortiPortal before 6.0.6 may allow a remFortinet FortiPortal
- CVE-2022-0777Weak Password Recovery Mechanism for Forgotten Password in microweber/microwebermicroweber/microweber
- CVE-2022-22262ASUS Armoury Crate & Aura Creator Installer之ROG Live Service - Improper Link Resolution Before File AccessASUS Armoury Crate & Aura Creator Installer
Medium, low and unrated 41
- CVE-2021-45863tsMuxer git-2678966 was discovered to contain a heap-based buffer overflow via the function HevcUnit::updateBits in hevc.cpp.
- CVE-2021-45860An integer overflow in DTSStreamReader::findFrame() of tsMuxer git-2678966 allows attackers to cause a Denial of Service (DoS) via a crafted
- CVE-2022-25051An Off-by-one Error occurs in cmr113_decode of rtl_433 21.12 when decoding a crafted file.
- CVE-2021-45864tsMuxer git-c6a0277 was discovered to contain a segmentation fault via DTSStreamReader::findFrame in dtsStreamReader.cpp.
- CVE-2021-45861There is an Assertion `num <= INT_BIT' failed at BitStreamReader::skipBits in /bitStream.h:132 of tsMuxer git-c6a0277.
- CVE-2022-25050rtl_433 21.12 was discovered to contain a stack overflow in the function somfy_iohc_decode().
- CVE-2022-24255Extensis Portfolio v4.0 was discovered to contain hardcoded credentials which allows attackers to gain administrator privileges.
- CVE-2022-24254An unrestricted file upload vulnerability in the Backup/Restore Archive component of Extensis Portfolio v4.0 allows remote attackers to exec
- CVE-2022-24253Extensis Portfolio v4.0 was discovered to contain an authenticated unrestricted file upload vulnerability via the component AdminFileTransfe
- CVE-2022-24252An unrestricted file upload vulnerability in the FileTransferServlet component of Extensis Portfolio v4.0 allows remote attackers to execute
- CVE-2022-24251Extensis Portfolio v4.0 was discovered to contain an authenticated unrestricted file upload vulnerability via the Catalog Asset Upload funct
- CVE-2021-41282diag_routes.php in pfSense 2.5.2 allows sed data injection.
- CVE-2021-41652Insecure permissions in the file database.sdb of BatFlat CMS v1.3.6 allows attackers to dump the entire database.
- CVE-2022-25012Argus Surveillance DVR v4.0 employs weak password encryption.
- CVE-2022-25010The component /rootfs in RageFile of Stepmania v5.1b2 and below allows attackers access to the entire file system.
- CVE-2022-24719Unauthorized forwarding of confidential headers in fluture-nodefluture-js fluture-node · fluture-node
- CVE-2022-24717Cross Site Scripting (XSS) in ssr-pagesFinastra ssr-pages · @finastra/ssr-pages
- CVE-2020-15936A improper input validation in Fortinet FortiGate version 6.4.3 and below, version 6.2.5 and below, version 6.0.11 and below, version 5.6.13Fortinet FortiOS
- CVE-2022-22300A improper handling of insufficient permissions or privileges in Fortinet FortiAnalyzer version 5.6.0 through 5.6.11, FortiAnalyzer version Fortinet FortiManager, FortiAnalyzer
- CVE-2022-22321IBM MQ Appliance 9.2 CD and 9.2 LTS local messaging users stored with a password hash that provides insufficient protection.IBM MQ Appliance
- CVE-2021-38986IBM MQ Appliance 9.2 CD and 9.2 LTS does not invalidate session after logout which could allow an authenticated user to impersonate another IBM MQ Appliance
- CVE-2021-38955IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a local user with elevated privileges to cause a denial of service due to a file creation vuIBM VIOS · IBM AIX
- CVE-2020-4925A security vulnerability in the Spectrum Scale 5.0 and 5.1 allows a non-root user to overflow the mmfsd daemon with requests and preventing IBM Spectrum Scale
- CVE-2022-23387An issue was discovered in taocms 3.0.2.
- CVE-2021-44238AyaCMS 3.1.2 is vulnerable to Remote Code Execution (RCE) via /aya/module/admin/ust_tab_e.inc.php,
- CVE-2021-46387ZyXEL ZyWALL 2 Plus Internet Security Appliance is affected by Cross Site Scripting (XSS).
- CVE-2022-23380There is a SQL injection vulnerability in the background of taocms 3.0.2 in parameter id:action=admin&id=2&ctrl=edit.
- CVE-2022-23377Archeevo below 5.0 is affected by local file inclusion through file=~/web.config to allow an attacker to retrieve local files.
- CVE-2021-44747Denial-of-Service (DoS) VulnerabilityF-Secure endpoint protection products on Mac, F-Secure Linu…
- CVE-2022-0776Cross-site Scripting (XSS) - DOM in hakimel/reveal.jshakimel/reveal.js · reveal.js
- CVE-2021-35036A cleartext storage of information vulnerability in the Zyxel VMG3625-T50B firmware version V5.50(ABTL.0)b2k could allow an authenticated atZyxel VMG3625-T50B firmware
- CVE-2021-43619Trusted Firmware M 1.4.x through 1.4.1 has a buffer overflow issue in the Firmware Update partition.
- CVE-2022-24446An issue was discovered in Zoho ManageEngine Key Manager Plus 6.1.6.
- CVE-2021-44962An out-of-bounds read vulnerability exists in the GCode::extrude() functionality of Slic3r libslic3r 1.3.0 and Master Commit b1a5500.
- CVE-2021-44961A memory leakage flaw exists in the class PerimeterGenerator of Slic3r libslic3r 1.3.0 and Master Commit b1a5500.
- CVE-2021-42951A Remote Code Execution (RCE) vulnerability exists in Algorithmia MSOL all versions before October 10 2021 of SaaS.
- CVE-2021-42767A directory traversal vulnerability in the apoc plugins in Neo4J Graph database before 4.4.0.1 allows attackers to read local files, and somorg.neo4j.procedure:apoc
- CVE-2022-25022A cross-site scripting (XSS) vulnerability in Htmly v2.8.1 allows attackers to excute arbitrary web scripts HTML via a crafted payload in th
- CVE-2022-25020A cross-site scripting (XSS) vulnerability in Pluxml v5.8.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload
- CVE-2022-25018Pluxml v5.8.7 was discovered to allow attackers to execute arbitrary code via crafted PHP code inserted into static pages.
- CVE-2022-26332Cipi 3.1.15 allows Add Server stored XSS via the /api/servers name field.andreapollastri/cipi