# CVEs published 2022-03-01

53 CVEs were published on March 1, 2022: 5 critical, 7 high. Days are UTC.

- [CVE-2021-45863](https://cve.now/CVE-2021-45863.md): tsMuxer git-2678966 was discovered to contain a heap-based buffer overflow via the function HevcUnit::updateBits in hevc.cpp. (no CVSS)
- [CVE-2021-45860](https://cve.now/CVE-2021-45860.md): An integer overflow in DTSStreamReader::findFrame() of tsMuxer git-2678966 allows attackers to cause a Denial of Service (DoS) via a crafted (no CVSS)
- [CVE-2022-25051](https://cve.now/CVE-2022-25051.md): An Off-by-one Error occurs in cmr113\_decode of rtl\_433 21.12 when decoding a crafted file. (no CVSS)
- [CVE-2021-45864](https://cve.now/CVE-2021-45864.md): tsMuxer git-c6a0277 was discovered to contain a segmentation fault via DTSStreamReader::findFrame in dtsStreamReader.cpp. (no CVSS)
- [CVE-2021-45861](https://cve.now/CVE-2021-45861.md): There is an Assertion \`num \<= INT\_BIT' failed at BitStreamReader::skipBits in /bitStream.h:132 of tsMuxer git-c6a0277. (no CVSS)
- [CVE-2022-25050](https://cve.now/CVE-2022-25050.md): rtl\_433 21.12 was discovered to contain a stack overflow in the function somfy\_iohc\_decode(). (no CVSS)
- [CVE-2022-24255](https://cve.now/CVE-2022-24255.md): Extensis Portfolio v4.0 was discovered to contain hardcoded credentials which allows attackers to gain administrator privileges. (no CVSS)
- [CVE-2022-24254](https://cve.now/CVE-2022-24254.md): An unrestricted file upload vulnerability in the Backup/Restore Archive component of Extensis Portfolio v4.0 allows remote attackers to exec (no CVSS)
- [CVE-2022-24253](https://cve.now/CVE-2022-24253.md): Extensis Portfolio v4.0 was discovered to contain an authenticated unrestricted file upload vulnerability via the component AdminFileTransfe (no CVSS)
- [CVE-2022-24252](https://cve.now/CVE-2022-24252.md): An unrestricted file upload vulnerability in the FileTransferServlet component of Extensis Portfolio v4.0 allows remote attackers to execute (no CVSS)
- [CVE-2022-24251](https://cve.now/CVE-2022-24251.md): Extensis Portfolio v4.0 was discovered to contain an authenticated unrestricted file upload vulnerability via the Catalog Asset Upload funct (no CVSS)
- [CVE-2021-41282](https://cve.now/CVE-2021-41282.md): diag\_routes.php in pfSense 2.5.2 allows sed data injection. (no CVSS)
- [CVE-2021-41652](https://cve.now/CVE-2021-41652.md): Insecure permissions in the file database.sdb of BatFlat CMS v1.3.6 allows attackers to dump the entire database. (no CVSS)
- [CVE-2022-25012](https://cve.now/CVE-2022-25012.md): Argus Surveillance DVR v4.0 employs weak password encryption. (no CVSS)
- [CVE-2022-25010](https://cve.now/CVE-2022-25010.md): The component /rootfs in RageFile of Stepmania v5.1b2 and below allows attackers access to the entire file system. (no CVSS)
- [CVE-2022-24719](https://cve.now/CVE-2022-24719.md): Unauthorized forwarding of confidential headers in fluture-node (CVSS 2.6, fluture-js fluture-node · fluture-node)
- [CVE-2022-24718](https://cve.now/CVE-2022-24718.md): Path Traversal in ssr-pages (CVSS 7.6, Finastra ssr-pages · @finastra/ssr-pages)
- [CVE-2022-24717](https://cve.now/CVE-2022-24717.md): Cross Site Scripting (XSS) in ssr-pages (CVSS 6.1, Finastra ssr-pages · @finastra/ssr-pages)
- [CVE-2021-43077](https://cve.now/CVE-2021-43077.md): A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiWLM version 8.6.2 and below, version (CVSS 8.8, Fortinet FortiWLM)
- [CVE-2020-15936](https://cve.now/CVE-2020-15936.md): A improper input validation in Fortinet FortiGate version 6.4.3 and below, version 6.2.5 and below, version 6.0.11 and below, version 5.6.13 (CVSS 2.6, Fortinet FortiOS)
- [CVE-2021-41193](https://cve.now/CVE-2021-41193.md): Use of Externally-Controlled Format String in wire-avs (CVSS 9.8, wireapp wire-avs · com.wire:avs)
- [CVE-2022-22300](https://cve.now/CVE-2022-22300.md): A improper handling of insufficient permissions or privileges in Fortinet FortiAnalyzer version 5.6.0 through 5.6.11, FortiAnalyzer version (CVSS 4.3, Fortinet FortiManager, FortiAnalyzer)
- [CVE-2021-43075](https://cve.now/CVE-2021-43075.md): A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.2 and below, v (CVSS 8.8, Fortinet FortiWLM)
- [CVE-2021-32586](https://cve.now/CVE-2021-32586.md): An improper input validation vulnerability in the web server CGI facilities of FortiMail before 7.0.1 may allow an unauthenticated attacker (CVSS 7.7, Fortinet FortiMail)
- [CVE-2021-36166](https://cve.now/CVE-2021-36166.md): An improper authentication vulnerability in FortiMail before 7.0.1 may allow a remote attacker to efficiently guess one administrative accou (CVSS 9.8, Fortinet FortiMail)
- [CVE-2021-36171](https://cve.now/CVE-2021-36171.md): The use of a cryptographically weak pseudo-random number generator in the password reset feature of FortiPortal before 6.0.6 may allow a rem (CVSS 8.1, Fortinet FortiPortal)
- [CVE-2022-22321](https://cve.now/CVE-2022-22321.md): IBM MQ Appliance 9.2 CD and 9.2 LTS local messaging users stored with a password hash that provides insufficient protection. (CVSS 5.1, IBM MQ Appliance)
- [CVE-2021-38986](https://cve.now/CVE-2021-38986.md): IBM MQ Appliance 9.2 CD and 9.2 LTS does not invalidate session after logout which could allow an authenticated user to impersonate another (CVSS 5.6, IBM MQ Appliance)
- [CVE-2021-38955](https://cve.now/CVE-2021-38955.md): IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a local user with elevated privileges to cause a denial of service due to a file creation vu (CVSS 4.4, IBM VIOS · IBM AIX)
- [CVE-2020-4925](https://cve.now/CVE-2020-4925.md): A security vulnerability in the Spectrum Scale 5.0 and 5.1 allows a non-root user to overflow the mmfsd daemon with requests and preventing (CVSS 6.2, IBM Spectrum Scale)
- [CVE-2022-23387](https://cve.now/CVE-2022-23387.md): An issue was discovered in taocms 3.0.2. (no CVSS)
- [CVE-2021-44238](https://cve.now/CVE-2021-44238.md): AyaCMS 3.1.2 is vulnerable to Remote Code Execution (RCE) via /aya/module/admin/ust\_tab\_e.inc.php, (no CVSS)
- [CVE-2021-46387](https://cve.now/CVE-2021-46387.md): ZyXEL ZyWALL 2 Plus Internet Security Appliance is affected by Cross Site Scripting (XSS). (no CVSS)
- [CVE-2022-23380](https://cve.now/CVE-2022-23380.md): There is a SQL injection vulnerability in the background of taocms 3.0.2 in parameter id:action=admin&id=2&ctrl=edit. (no CVSS)
- [CVE-2022-23377](https://cve.now/CVE-2022-23377.md): Archeevo below 5.0 is affected by local file inclusion through file=~/web.config to allow an attacker to retrieve local files. (no CVSS)
- [CVE-2021-44747](https://cve.now/CVE-2021-44747.md): Denial-of-Service (DoS) Vulnerability (CVSS 4.6, F-Secure endpoint protection products on Mac, F-Secure Linu…)
- [CVE-2022-0777](https://cve.now/CVE-2022-0777.md): Weak Password Recovery Mechanism for Forgotten Password in microweber/microweber (CVSS 7.3, microweber/microweber)
- [CVE-2022-0776](https://cve.now/CVE-2022-0776.md): Cross-site Scripting (XSS) - DOM in hakimel/reveal.js (CVSS 5.3, hakimel/reveal.js · reveal.js)
- [CVE-2021-4039](https://cve.now/CVE-2021-4039.md): A command injection vulnerability in the web interface of the Zyxel NWA-1100-NH firmware could allow an attacker to execute arbitrary OS com (CVSS 9.8, Zyxel NWA1100-NH firmware)
- [CVE-2021-35036](https://cve.now/CVE-2021-35036.md): A cleartext storage of information vulnerability in the Zyxel VMG3625-T50B firmware version V5.50(ABTL.0)b2k could allow an authenticated at (CVSS 6.5, Zyxel VMG3625-T50B firmware)
- [CVE-2021-43619](https://cve.now/CVE-2021-43619.md): Trusted Firmware M 1.4.x through 1.4.1 has a buffer overflow issue in the Firmware Update partition. (no CVSS)
- [CVE-2022-24446](https://cve.now/CVE-2022-24446.md): An issue was discovered in Zoho ManageEngine Key Manager Plus 6.1.6. (no CVSS)
- [CVE-2022-22262](https://cve.now/CVE-2022-22262.md): ASUS Armoury Crate & Aura Creator Installer之ROG Live Service - Improper Link Resolution Before File Access (CVSS 7.7, ASUS Armoury Crate & Aura Creator Installer)
- [CVE-2020-12775](https://cve.now/CVE-2020-12775.md): Hicos citizen certificate client-side component - Command Injection (CVSS 9.8, Hicos citizen certificate client-side component)
- [CVE-2021-44962](https://cve.now/CVE-2021-44962.md): An out-of-bounds read vulnerability exists in the GCode::extrude() functionality of Slic3r libslic3r 1.3.0 and Master Commit b1a5500. (no CVSS)
- [CVE-2021-44961](https://cve.now/CVE-2021-44961.md): A memory leakage flaw exists in the class PerimeterGenerator of Slic3r libslic3r 1.3.0 and Master Commit b1a5500. (no CVSS)
- [CVE-2021-42951](https://cve.now/CVE-2021-42951.md): A Remote Code Execution (RCE) vulnerability exists in Algorithmia MSOL all versions before October 10 2021 of SaaS. (no CVSS)
- [CVE-2021-42767](https://cve.now/CVE-2021-42767.md): A directory traversal vulnerability in the apoc plugins in Neo4J Graph database before 4.4.0.1 allows attackers to read local files, and som (no CVSS, org.neo4j.procedure:apoc)
- [CVE-2022-25022](https://cve.now/CVE-2022-25022.md): A cross-site scripting (XSS) vulnerability in Htmly v2.8.1 allows attackers to excute arbitrary web scripts HTML via a crafted payload in th (no CVSS)
- [CVE-2022-25020](https://cve.now/CVE-2022-25020.md): A cross-site scripting (XSS) vulnerability in Pluxml v5.8.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload (no CVSS)
- [CVE-2022-25018](https://cve.now/CVE-2022-25018.md): Pluxml v5.8.7 was discovered to allow attackers to execute arbitrary code via crafted PHP code inserted into static pages. (no CVSS)
- [CVE-2022-26332](https://cve.now/CVE-2022-26332.md): Cipi 3.1.15 allows Add Server stored XSS via the /api/servers name field. (no CVSS, andreapollastri/cipi)
- [CVE-2022-24720](https://cve.now/CVE-2022-24720.md): Improper Input Validation in image\_processing (CVSS 9.8, janko image\_processing · image\_processing)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-03-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.