CVEs published March 2, 2022
77 CVEs were published on March 2, 2022: 1 critical, 5 high.
- Published
- 77
- Critical
- 1
- High
- 5
- Medium
- 9
- Low
- 2
- Unrated
- 60
- Now in CISA KEV
- 0
- Fix available
- 19
Most affected products
- HP ProBook 440 G8 Notebook PC; HP ProDesk 405 G6 Small Form…
- 6
- Aruba CX 6200F Switch Series, Aruba 6300 Switch Series, Aru…
- 4
- htmldoc
- 3
- JFrog Artifactory
- 2
- kernel
- 2
- libvirt
- 2
- postgresql
- 2
- samba
- 2
- webmin/webmin
- 2
- bluez
- 1
Critical 1
High 5
- CVE-2022-24722Cross-site Scripting in view_componentgithub view_component · view_component
- CVE-2022-0819Code Injection in dolibarr/dolibarrdolibarr/dolibarr
- CVE-2022-22301An improper neutralization of special elements used in an OS Command vulnerability [CWE-78] in FortiAP-C console 5.4.0 through 5.4.3, 5.2.0 Fortinet FortiAP-C
- CVE-2022-0577Exposure of Sensitive Information to an Unauthorized Actor in scrapy/scrapyscrapy/scrapy · scrapy
- CVE-2022-0824Improper Access Control to Remote Code Execution in webmin/webminwebmin/webmin
Medium, low and unrated 71
- CVE-2022-22909HotelDruid v3.0.3 was discovered to contain a remote code execution (RCE) vulnerability which is exploited via an attacker inserting a craft
- CVE-2022-25146The Remote App module in Liferay Portal Liferay Portal v7.4.3.4 through v7.4.3.8 and Liferay DXP 7.4 before update 5 does not check if the ocom.liferay:com.liferay.remote.app.web · com.liferay.portal…
- CVE-2021-38269Cross-site scripting (XSS) vulnerability in the Gogo Shell module in Liferay Portal 7.1.0 through 7.3.6 and 7.4.0, and Liferay DXP 7.1 beforcom.liferay:com.liferay.gogo.shell.web · com.liferay.portal…
- CVE-2021-44343David Brackeen ok-file-formats 203defd is vulnerable to Buffer Overflow.
- CVE-2022-25089Printix Secure Cloud Print Management through 1.3.1106.0 incorrectly uses Privileged APIs to modify values in HKEY_LOCAL_MACHINE via UITasks
- CVE-2021-38267Cross-site scripting (XSS) vulnerability in the Blogs module's edit blog entry page in Liferay Portal 7.3.2 through 7.3.6, and Liferay DXP 7com.liferay.portal:release.portal.bom · com.liferay.port… +1
- CVE-2021-44335David Brackeen ok-file-formats 203defd is vulnerable to Buffer Overflow.
- CVE-2021-38263Cross-site scripting (XSS) vulnerability in the Server module's script console in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 befocom.liferay:com.liferay.server.admin.web · com.liferay.port…
- CVE-2022-25471An Insecure Direct Object Reference (IDOR) vulnerability in OpenEMR 6.0.0 allows any authenticated attacker to access and modify unauthorize
- CVE-2021-38264Cross-site scripting (XSS) vulnerability in the Frontend Taglib module in Liferay Portal 7.4.0 and 7.4.1 allows remote attackers to inject acom.liferay:com.liferay.frontend.taglib.clay
- CVE-2021-38265Cross-site scripting (XSS) vulnerability in the Asset module in Liferay Portal 7.3.4 through 7.3.6 allow remote attackers to inject arbitrarcom.liferay:com.liferay.layout.admin.web · com.liferay.port…
- CVE-2021-38266The Portal Security module in Liferay Portal 7.2.1 and earlier, and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17 and 7.2 beforcom.liferay:com.liferay.portal.security.ldap.impl · com.lif…
- CVE-2022-26171Bank Management System v1.o was discovered to contain a SQL injection vulnerability via the email parameter.
- CVE-2022-26170Simple Mobile Comparison Website v1.0 was discovered to contain a SQL injection vulnerability via the search parameter.
- CVE-2022-26169Air Cargo Management System v1.0 was discovered to contain a SQL injection vulnerability via the ref_code parameter.
- CVE-2022-25399Simple Real Estate Portal System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter.
- CVE-2022-25398Auto Spare Parts Management v1.0 was discovered to contain a SQL injection vulnerability via the user parameter.
- CVE-2022-25396Cosmetics and Beauty Product Online Store v1.0 was discovered to contain a SQL injection vulnerability via the search parameter.
- CVE-2022-25395Cosmetics and Beauty Product Online Store v1.0 was discovered to contain multiple reflected cross-site scripting (XSS) attacks via the searc
- CVE-2022-25393Simple Bakery Shop Management v1.0 was discovered to contain a SQL injection vulnerability via the username parameter.
- CVE-2022-25394Medical Store Management System v1.0 was discovered to contain a SQL injection vulnerability via the cid parameter under customer-add.php.
- CVE-2022-25115A remote code execution (RCE) vulnerability in the Avatar parameter under /admin/?page=user/manage_user of Home Owners Collection Management
- CVE-2022-25114Event Management v1.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the full_name parameter under regis
- CVE-2021-23180A flaw was found in htmldoc in v1.9.12 and before.htmldoc
- CVE-2021-23191A security issue was found in htmldoc v1.9.12 and before.htmldoc
- CVE-2021-23206A flaw was found in htmldoc in v1.9.12 and prior.htmldoc
- CVE-2021-4076A flaw exists in tang, a network-based cryptographic binding server, which could result in leak of private keys.tang
- CVE-2021-3716A flaw was found in nbdkit due to to improperly caching plaintext state across the STARTTLS encryption boundary.nbdkit
- CVE-2021-3715A flaw was found in the "Routing decision" classifier in the Linux kernel's Traffic Control networking subsystem in the way it handled changkernel
- CVE-2021-3658bluetoothd from bluez incorrectly saves adapters' Discoverable status when a device is powered down, and restores it when powered up.bluez
- CVE-2021-3623A flaw was found in libtpms.libtpms
- CVE-2022-0711A flaw was found in the way HAProxy processed HTTP responses containing the "Set-Cookie2" header.haproxy
- CVE-2021-41003Multiple unauthenticated command injection vulnerabilities were discovered in the AOS-CX API interface in Aruba CX 6200F Switch Series, ArubAruba CX 6200F Switch Series, Aruba 6300 Switch Series, Aru…
- CVE-2021-41002Multiple authenticated remote path traversal vulnerabilities were discovered in the AOS-CX command line interface in Aruba CX 6200F Switch SAruba CX 6200F Switch Series, Aruba 6300 Switch Series, Aru…
- CVE-2021-41000Multiple authenticated remote code execution vulnerabilities were discovered in the AOS-CX command line interface in Aruba CX 6200F Switch SAruba CX 6200F Switch Series, Aruba 6300 Switch Series, Aru…
- CVE-2021-41001An authenticated remote code execution vulnerability was discovered in the AOS-CX Network Analytics Engine (NAE) in Aruba CX 6200F Switch SeAruba CX 6200F Switch Series, Aruba 6300 Switch Series, Aru…
- CVE-2022-23957Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service.HP ProBook 440 G8 Notebook PC; HP ProDesk 405 G6 Small Form…
- CVE-2022-23958Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service.HP ProBook 440 G8 Notebook PC; HP ProDesk 405 G6 Small Form…
- CVE-2022-23955Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service.HP ProBook 440 G8 Notebook PC; HP ProDesk 405 G6 Small Form…
- CVE-2022-23954Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service.HP ProBook 440 G8 Notebook PC; HP ProDesk 405 G6 Small Form…
- CVE-2021-46270JFrog Artifactory before 7.31.10, is vulnerable to Broken Access Control where a project admin user is able to list all available repositoryJFrog Artifactory
- CVE-2021-45074JFrog Artifactory before 7.29.3 and 6.23.38, is vulnerable to Broken Access Control, a low-privileged user is able to delete other known useJFrog Artifactory
- CVE-2022-0675Puppet Firewall Module May Leave Unmanaged RulesPuppet Firewall Module
- CVE-2022-23953Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service.HP ProBook 440 G8 Notebook PC; HP ProDesk 405 G6 Small Form…
- CVE-2022-23956Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service.HP ProBook 440 G8 Notebook PC; HP ProDesk 405 G6 Small Form…
- CVE-2022-25045Home Owners Collection Management System v1.0 was discovered to contain hardcoded credentials which allows attackers to escalate privileges
- CVE-2022-22944VMware Workspace ONE Boxer contains a stored cross-site scripting (XSS) vulnerability.VMware Workspace ONE Boxer
- CVE-2022-23656Cross-site scripting vulnerability in Zulip Serverzulip
- CVE-2021-38268The Dynamic Data Mapping module in Liferay Portal 7.0.0 through 7.3.6, and Liferay DXP 7.0 before fix pack 101, 7.1 before fix pack 21, 7.2 com.liferay:com.liferay.dynamic.data.mapping.service · com.…
- CVE-2022-23878seacms V11.5 is affected by an arbitrary code execution vulnerability in admin_config.php.
- CVE-2022-25016Home Owners Collection Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /student_at
- CVE-2021-43070Multiple relative path traversal vulnerabilities [CWE-23] in FortiWLM management interface 8.6.2 and below, 8.5.2 and below, 8.4.2 and belowFortinet FortiWLM
- CVE-2022-22350IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in CAA to cause a denial of service.IBM AIX · IBM VIOS
- CVE-2021-38996IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX kernel to cause a denial oIBM VIOS · IBM AIX
- CVE-2022-24447An issue was discovered in Zoho ManageEngine Key Manager Plus before 6200.
- CVE-2022-24305Zoho ManageEngine SharePoint Manager Plus before 4329 is vulnerable to a sensitive data leak that leads to privilege escalation.
- CVE-2022-24306Zoho ManageEngine SharePoint Manager Plus before 4329 allows account takeover because authorization is mishandled.
- CVE-2022-23779Zoho ManageEngine Desktop Central before 10.1.2137.8 exposes the installed server name to anyone.
- CVE-2022-25634Qt through 5.15.8 and 6.x through 6.2.3 can load system library files from an unintended working directory.
- CVE-2022-0829Improper Authorization in webmin/webminwebmin/webmin
- CVE-2022-23395jQuery Cookie 1.4.1 is affected by prototype pollution, which can lead to DOM cross-site scripting (XSS).jquery.cookie
- CVE-2021-44166An improper access control vulnerability [CWE-284 ] in FortiToken Mobile (Android) external push notification 5.1.0 and below may allow a reFortinet FortiTokenAndroid
- CVE-2022-22303An exposure of sensitive system information to an unauthorized control sphere vulnerability [CWE-497] in FortiManager versions prior to 7.0.Fortinet FortiManager
- CVE-2021-23192A flaw was found in the way samba implemented DCE/RPC.samba
- CVE-2021-23222A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use of SSL certificate verification apostgresql
- CVE-2021-3631A flaw was found in libvirt while it generates SELinux MCS category pairs for VMs' dynamic labels.libvirt
- CVE-2021-3654A vulnerability was found in openstack-nova's console proxy, noVNC.openstack-nova · nova
- CVE-2021-3667An improper locking issue was found in the virStoragePoolLookupByTargetPath API of libvirt.libvirt
- CVE-2021-3677A flaw was found in postgresql.postgresql
- CVE-2021-3738In DCE/RPC it is possible to share the handles (cookies for resource state) between multiple connections via a mechanism called 'associationsamba
- CVE-2021-3772A flaw was found in the Linux SCTP stack.kernel