# CVEs published 2022-03-02

77 CVEs were published on March 2, 2022: 1 critical, 5 high. Days are UTC.

- [CVE-2022-22909](https://cve.now/CVE-2022-22909.md): HotelDruid v3.0.3 was discovered to contain a remote code execution (RCE) vulnerability which is exploited via an attacker inserting a craft (no CVSS)
- [CVE-2022-25146](https://cve.now/CVE-2022-25146.md): The Remote App module in Liferay Portal Liferay Portal v7.4.3.4 through v7.4.3.8 and Liferay DXP 7.4 before update 5 does not check if the o (no CVSS, com.liferay:com.liferay.remote.app.web · com.liferay.portal…)
- [CVE-2021-38269](https://cve.now/CVE-2021-38269.md): Cross-site scripting (XSS) vulnerability in the Gogo Shell module in Liferay Portal 7.1.0 through 7.3.6 and 7.4.0, and Liferay DXP 7.1 befor (no CVSS, com.liferay:com.liferay.gogo.shell.web · com.liferay.portal…)
- [CVE-2021-44343](https://cve.now/CVE-2021-44343.md): David Brackeen ok-file-formats 203defd is vulnerable to Buffer Overflow. (no CVSS)
- [CVE-2022-25089](https://cve.now/CVE-2022-25089.md): Printix Secure Cloud Print Management through 1.3.1106.0 incorrectly uses Privileged APIs to modify values in HKEY\_LOCAL\_MACHINE via UITasks (no CVSS)
- [CVE-2021-38267](https://cve.now/CVE-2021-38267.md): Cross-site scripting (XSS) vulnerability in the Blogs module's edit blog entry page in Liferay Portal 7.3.2 through 7.3.6, and Liferay DXP 7 (no CVSS, com.liferay.portal:release.portal.bom · com.liferay.port… +1)
- [CVE-2021-44335](https://cve.now/CVE-2021-44335.md): David Brackeen ok-file-formats 203defd is vulnerable to Buffer Overflow. (no CVSS)
- [CVE-2021-38263](https://cve.now/CVE-2021-38263.md): Cross-site scripting (XSS) vulnerability in the Server module's script console in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 befo (no CVSS, com.liferay:com.liferay.server.admin.web · com.liferay.port…)
- [CVE-2022-25471](https://cve.now/CVE-2022-25471.md): An Insecure Direct Object Reference (IDOR) vulnerability in OpenEMR 6.0.0 allows any authenticated attacker to access and modify unauthorize (no CVSS)
- [CVE-2021-38264](https://cve.now/CVE-2021-38264.md): Cross-site scripting (XSS) vulnerability in the Frontend Taglib module in Liferay Portal 7.4.0 and 7.4.1 allows remote attackers to inject a (no CVSS, com.liferay:com.liferay.frontend.taglib.clay)
- [CVE-2021-38265](https://cve.now/CVE-2021-38265.md): Cross-site scripting (XSS) vulnerability in the Asset module in Liferay Portal 7.3.4 through 7.3.6 allow remote attackers to inject arbitrar (no CVSS, com.liferay:com.liferay.layout.admin.web · com.liferay.port…)
- [CVE-2021-38266](https://cve.now/CVE-2021-38266.md): The Portal Security module in Liferay Portal 7.2.1 and earlier, and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17 and 7.2 befor (no CVSS, com.liferay:com.liferay.portal.security.ldap.impl · com.lif…)
- [CVE-2022-24722](https://cve.now/CVE-2022-24722.md): Cross-site Scripting in view\_component (CVSS 8.1, github view\_component · view\_component)
- [CVE-2022-26171](https://cve.now/CVE-2022-26171.md): Bank Management System v1.o was discovered to contain a SQL injection vulnerability via the email parameter. (no CVSS)
- [CVE-2022-26170](https://cve.now/CVE-2022-26170.md): Simple Mobile Comparison Website v1.0 was discovered to contain a SQL injection vulnerability via the search parameter. (no CVSS)
- [CVE-2022-26169](https://cve.now/CVE-2022-26169.md): Air Cargo Management System v1.0 was discovered to contain a SQL injection vulnerability via the ref\_code parameter. (no CVSS)
- [CVE-2022-25399](https://cve.now/CVE-2022-25399.md): Simple Real Estate Portal System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter. (no CVSS)
- [CVE-2022-25398](https://cve.now/CVE-2022-25398.md): Auto Spare Parts Management v1.0 was discovered to contain a SQL injection vulnerability via the user parameter. (no CVSS)
- [CVE-2022-25396](https://cve.now/CVE-2022-25396.md): Cosmetics and Beauty Product Online Store v1.0 was discovered to contain a SQL injection vulnerability via the search parameter. (no CVSS)
- [CVE-2022-25395](https://cve.now/CVE-2022-25395.md): Cosmetics and Beauty Product Online Store v1.0 was discovered to contain multiple reflected cross-site scripting (XSS) attacks via the searc (no CVSS)
- [CVE-2022-25393](https://cve.now/CVE-2022-25393.md): Simple Bakery Shop Management v1.0 was discovered to contain a SQL injection vulnerability via the username parameter. (no CVSS)
- [CVE-2022-25394](https://cve.now/CVE-2022-25394.md): Medical Store Management System v1.0 was discovered to contain a SQL injection vulnerability via the cid parameter under customer-add.php. (no CVSS)
- [CVE-2022-25115](https://cve.now/CVE-2022-25115.md): A remote code execution (RCE) vulnerability in the Avatar parameter under /admin/?page=user/manage\_user of Home Owners Collection Management (no CVSS)
- [CVE-2022-25114](https://cve.now/CVE-2022-25114.md): Event Management v1.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the full\_name parameter under regis (no CVSS)
- [CVE-2021-23180](https://cve.now/CVE-2021-23180.md): A flaw was found in htmldoc in v1.9.12 and before. (no CVSS, htmldoc)
- [CVE-2021-23191](https://cve.now/CVE-2021-23191.md): A security issue was found in htmldoc v1.9.12 and before. (no CVSS, htmldoc)
- [CVE-2021-23206](https://cve.now/CVE-2021-23206.md): A flaw was found in htmldoc in v1.9.12 and prior. (no CVSS, htmldoc)
- [CVE-2021-4076](https://cve.now/CVE-2021-4076.md): A flaw exists in tang, a network-based cryptographic binding server, which could result in leak of private keys. (no CVSS, tang)
- [CVE-2021-3716](https://cve.now/CVE-2021-3716.md): A flaw was found in nbdkit due to to improperly caching plaintext state across the STARTTLS encryption boundary. (no CVSS, nbdkit)
- [CVE-2021-3715](https://cve.now/CVE-2021-3715.md): A flaw was found in the "Routing decision" classifier in the Linux kernel's Traffic Control networking subsystem in the way it handled chang (no CVSS, kernel)
- [CVE-2021-3658](https://cve.now/CVE-2021-3658.md): bluetoothd from bluez incorrectly saves adapters' Discoverable status when a device is powered down, and restores it when powered up. (CVSS 6.5, bluez)
- [CVE-2021-3623](https://cve.now/CVE-2021-3623.md): A flaw was found in libtpms. (no CVSS, libtpms)
- [CVE-2022-0711](https://cve.now/CVE-2022-0711.md): A flaw was found in the way HAProxy processed HTTP responses containing the "Set-Cookie2" header. (no CVSS, haproxy)
- [CVE-2021-41003](https://cve.now/CVE-2021-41003.md): Multiple unauthenticated command injection vulnerabilities were discovered in the AOS-CX API interface in Aruba CX 6200F Switch Series, Arub (no CVSS, Aruba CX 6200F Switch Series, Aruba 6300 Switch Series, Aru…)
- [CVE-2021-41002](https://cve.now/CVE-2021-41002.md): Multiple authenticated remote path traversal vulnerabilities were discovered in the AOS-CX command line interface in Aruba CX 6200F Switch S (no CVSS, Aruba CX 6200F Switch Series, Aruba 6300 Switch Series, Aru…)
- [CVE-2021-41000](https://cve.now/CVE-2021-41000.md): Multiple authenticated remote code execution vulnerabilities were discovered in the AOS-CX command line interface in Aruba CX 6200F Switch S (no CVSS, Aruba CX 6200F Switch Series, Aruba 6300 Switch Series, Aru…)
- [CVE-2021-41001](https://cve.now/CVE-2021-41001.md): An authenticated remote code execution vulnerability was discovered in the AOS-CX Network Analytics Engine (NAE) in Aruba CX 6200F Switch Se (no CVSS, Aruba CX 6200F Switch Series, Aruba 6300 Switch Series, Aru…)
- [CVE-2022-23957](https://cve.now/CVE-2022-23957.md): Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service. (no CVSS, HP ProBook 440 G8 Notebook PC; HP ProDesk 405 G6 Small Form…)
- [CVE-2022-23958](https://cve.now/CVE-2022-23958.md): Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service. (no CVSS, HP ProBook 440 G8 Notebook PC; HP ProDesk 405 G6 Small Form…)
- [CVE-2022-23955](https://cve.now/CVE-2022-23955.md): Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service. (no CVSS, HP ProBook 440 G8 Notebook PC; HP ProDesk 405 G6 Small Form…)
- [CVE-2022-23954](https://cve.now/CVE-2022-23954.md): Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service. (no CVSS, HP ProBook 440 G8 Notebook PC; HP ProDesk 405 G6 Small Form…)
- [CVE-2021-46270](https://cve.now/CVE-2021-46270.md): JFrog Artifactory before 7.31.10, is vulnerable to Broken Access Control where a project admin user is able to list all available repository (CVSS 2.7, JFrog Artifactory)
- [CVE-2021-45074](https://cve.now/CVE-2021-45074.md): JFrog Artifactory before 7.29.3 and 6.23.38, is vulnerable to Broken Access Control, a low-privileged user is able to delete other known use (CVSS 4.3, JFrog Artifactory)
- [CVE-2022-0675](https://cve.now/CVE-2022-0675.md): Puppet Firewall Module May Leave Unmanaged Rules (CVSS 5.6, Puppet Firewall Module)
- [CVE-2022-23953](https://cve.now/CVE-2022-23953.md): Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service. (no CVSS, HP ProBook 440 G8 Notebook PC; HP ProDesk 405 G6 Small Form…)
- [CVE-2022-23956](https://cve.now/CVE-2022-23956.md): Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service. (no CVSS, HP ProBook 440 G8 Notebook PC; HP ProDesk 405 G6 Small Form…)
- [CVE-2022-25045](https://cve.now/CVE-2022-25045.md): Home Owners Collection Management System v1.0 was discovered to contain hardcoded credentials which allows attackers to escalate privileges (no CVSS)
- [CVE-2022-22944](https://cve.now/CVE-2022-22944.md): VMware Workspace ONE Boxer contains a stored cross-site scripting (XSS) vulnerability. (no CVSS, VMware Workspace ONE Boxer)
- [CVE-2022-23656](https://cve.now/CVE-2022-23656.md): Cross-site scripting vulnerability in Zulip Server (CVSS 4.6, zulip)
- [CVE-2022-23640](https://cve.now/CVE-2022-23640.md): Improper Restriction of XML External Entity Reference in Excel-Streaming-Reader (CVSS 9.8, monitorjbl excel-streaming-reader · com.monitorjbl:xlsx-str…)
- [CVE-2021-38268](https://cve.now/CVE-2021-38268.md): The Dynamic Data Mapping module in Liferay Portal 7.0.0 through 7.3.6, and Liferay DXP 7.0 before fix pack 101, 7.1 before fix pack 21, 7.2 (no CVSS, com.liferay:com.liferay.dynamic.data.mapping.service · com.…)
- [CVE-2022-23878](https://cve.now/CVE-2022-23878.md): seacms V11.5 is affected by an arbitrary code execution vulnerability in admin\_config.php. (no CVSS)
- [CVE-2022-25016](https://cve.now/CVE-2022-25016.md): Home Owners Collection Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /student\_at (no CVSS)
- [CVE-2021-43070](https://cve.now/CVE-2021-43070.md): Multiple relative path traversal vulnerabilities \[CWE-23\] in FortiWLM management interface 8.6.2 and below, 8.5.2 and below, 8.4.2 and below (CVSS 5.4, Fortinet FortiWLM)
- [CVE-2022-22350](https://cve.now/CVE-2022-22350.md): IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in CAA to cause a denial of service. (CVSS 6.2, IBM AIX · IBM VIOS)
- [CVE-2021-38996](https://cve.now/CVE-2021-38996.md): IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX kernel to cause a denial o (CVSS 6.2, IBM VIOS · IBM AIX)
- [CVE-2022-0819](https://cve.now/CVE-2022-0819.md): Code Injection in dolibarr/dolibarr (CVSS 7.2, dolibarr/dolibarr)
- [CVE-2022-24447](https://cve.now/CVE-2022-24447.md): An issue was discovered in Zoho ManageEngine Key Manager Plus before 6200. (no CVSS)
- [CVE-2022-24305](https://cve.now/CVE-2022-24305.md): Zoho ManageEngine SharePoint Manager Plus before 4329 is vulnerable to a sensitive data leak that leads to privilege escalation. (no CVSS)
- [CVE-2022-24306](https://cve.now/CVE-2022-24306.md): Zoho ManageEngine SharePoint Manager Plus before 4329 allows account takeover because authorization is mishandled. (no CVSS)
- [CVE-2022-23779](https://cve.now/CVE-2022-23779.md): Zoho ManageEngine Desktop Central before 10.1.2137.8 exposes the installed server name to anyone. (no CVSS)
- [CVE-2022-25634](https://cve.now/CVE-2022-25634.md): Qt through 5.15.8 and 6.x through 6.2.3 can load system library files from an unintended working directory. (no CVSS)
- [CVE-2022-0829](https://cve.now/CVE-2022-0829.md): Improper Authorization in webmin/webmin (CVSS 5.4, webmin/webmin)
- [CVE-2022-23395](https://cve.now/CVE-2022-23395.md): jQuery Cookie 1.4.1 is affected by prototype pollution, which can lead to DOM cross-site scripting (XSS). (no CVSS, jquery.cookie)
- [CVE-2021-44166](https://cve.now/CVE-2021-44166.md): An improper access control vulnerability \[CWE-284 \] in FortiToken Mobile (Android) external push notification 5.1.0 and below may allow a re (CVSS 4.1, Fortinet FortiTokenAndroid)
- [CVE-2022-22301](https://cve.now/CVE-2022-22301.md): An improper neutralization of special elements used in an OS Command vulnerability \[CWE-78\] in FortiAP-C console 5.4.0 through 5.4.3, 5.2.0 (CVSS 7.8, Fortinet FortiAP-C)
- [CVE-2022-22303](https://cve.now/CVE-2022-22303.md): An exposure of sensitive system information to an unauthorized control sphere vulnerability \[CWE-497\] in FortiManager versions prior to 7.0. (CVSS 2.8, Fortinet FortiManager)
- [CVE-2022-0577](https://cve.now/CVE-2022-0577.md): Exposure of Sensitive Information to an Unauthorized Actor in scrapy/scrapy (CVSS 8.8, scrapy/scrapy · scrapy)
- [CVE-2021-23192](https://cve.now/CVE-2021-23192.md): A flaw was found in the way samba implemented DCE/RPC. (no CVSS, samba)
- [CVE-2021-23222](https://cve.now/CVE-2021-23222.md): A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use of SSL certificate verification a (no CVSS, postgresql)
- [CVE-2021-3631](https://cve.now/CVE-2021-3631.md): A flaw was found in libvirt while it generates SELinux MCS category pairs for VMs' dynamic labels. (no CVSS, libvirt)
- [CVE-2021-3654](https://cve.now/CVE-2021-3654.md): A vulnerability was found in openstack-nova's console proxy, noVNC. (no CVSS, openstack-nova · nova)
- [CVE-2021-3667](https://cve.now/CVE-2021-3667.md): An improper locking issue was found in the virStoragePoolLookupByTargetPath API of libvirt. (no CVSS, libvirt)
- [CVE-2021-3677](https://cve.now/CVE-2021-3677.md): A flaw was found in postgresql. (no CVSS, postgresql)
- [CVE-2021-3738](https://cve.now/CVE-2021-3738.md): In DCE/RPC it is possible to share the handles (cookies for resource state) between multiple connections via a mechanism called 'association (no CVSS, samba)
- [CVE-2021-3772](https://cve.now/CVE-2021-3772.md): A flaw was found in the Linux SCTP stack. (no CVSS, kernel)
- [CVE-2022-0824](https://cve.now/CVE-2022-0824.md): Improper Access Control to Remote Code Execution in webmin/webmin (CVSS 8.3, webmin/webmin)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-03-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.