CVEs published March 3, 2022
50 CVEs were published on March 3, 2022: 1 critical, 9 high. 3 are now in CISA KEV.
- Published
- 50
- Critical
- 1
- High
- 9
- Medium
- 4
- Low
- 2
- Unrated
- 34
- Now in CISA KEV
- 3
- Fix available
- 14
Most affected products
- FRRouting
- 5
- kernel
- 4
- PeTeReport
- 3
- Elastic kibana
- 2
- htmldoc
- 2
- net.mingsoft:ms-mcms
- 2
- ansible
- 1
- buildah · github.com/containers/buildah
- 1
- Cati
- 1
- containerd · github.com/containerd/containerd
- 1
Critical 1
High 9
- CVE-2021-38578Existing CommBuffer checks in SmmEntryPoint will not catch underflow when computing BufferSize.TianoCore EDK II
- CVE-2022-0265Improper Restriction of XML External Entity Reference in hazelcast/hazelcasthazelcast/hazelcast · com.hazelcast:hazelcast
- CVE-2022-24724Integer overflow in table parsing extension leads to heap memory corruptiongithub cmark-gfm
- CVE-2022-26129Buffer overflow vulnerabilities exist in FRRouting through 8.1.0 due to wrong checks on the subtlv length in the functions, parse_hello_subtFRRouting
- CVE-2022-22706Arm Mali GPU Kernel Driver allows a non-privileged user to achieve write access to read-only memory pages.
- CVE-2022-0492A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function.kernel
- CVE-2022-21716Buffer Overflow in Twistedtwisted
- CVE-2022-23648Insecure handling of image volumes in containerd CRI plugincontainerd · github.com/containerd/containerd
- CVE-2022-26125Buffer overflow vulnerabilities exist in FRRouting through 8.1.0 due to wrong checks on the input packet length in isisd/isis_tlvs.c.FRRouting
Medium, low and unrated 40
- CVE-2021-3640A flaw use-after-free in function sco_sock_sendmsg() of the Linux kernel HCI subsystem was found in the way user calls ioct UFFDIO_REGISTER kernel
- CVE-2022-22943VMware Tools for Windows (11.x.y and 10.x.y prior to 12.0.0) contains an uncontrolled search path vulnerability.VMware Tools for Windows
- CVE-2022-25220PeteReport Version 0.5 allows an authenticated admin user to inject persistent JavaScript code inside the markdown descriptions while creatiPeTeReport
- CVE-2022-23052PeteReport Version 0.5 contains a Cross Site Request Forgery (CSRF) vulnerability allowing an attacker to trick users into deleting users, pPeTeReport
- CVE-2022-23051PeteReport Version 0.5 allows an authenticated admin user to inject persistent JavaScript code while adding an 'Attack Tree' by modifying thPeTeReport
- CVE-2022-23710A cross-site-scripting (XSS) vulnerability was discovered in the Data Preview Pane (previously known as Index Pattern Preview Pane) which coElastic kibana
- CVE-2022-23709A flaw was discovered in Kibana in which users with Read access to the Uptime feature could modify alerting rules.Elastic kibana
- CVE-2022-23708A flaw was discovered in Elasticsearch 7.17.0’s upgrade assistant, in which upgrading from version 6.x to 7.x would disable the in-built proelasticsearch · org.elasticsearch:elasticsearch
- CVE-2021-4002A memory leak flaw in the Linux kernel's hugetlbfs memory usage was found in the way the user maps some regions of memory twice using shmgetkernel
- CVE-2021-3762A directory traversal vulnerability was found in the ClairCore engine of Clair.quay/claircore · github.com/quay/claircore
- CVE-2022-24725Exposure of home directory through shescape on Unix with Bashericcornelissen shescape · shescape
- CVE-2022-24723Improper Input Validation in URI.jsmedialize URI.js · urijs
- CVE-2021-3602An information disclosure flaw was found in Buildah, when building containers using chroot isolation.buildah · github.com/containers/buildah
- CVE-2021-3609.A flaw was found in the CAN BCM networking protocol in the Linux kernel, where a local attacker can abuse a flaw in the CAN subsystem to cokernel
- CVE-2021-3620A flaw was found in Ansible Engine's ansible-connection module, where sensitive information such as the Ansible user credentials is discloseansible
- CVE-2022-22700CyberArk Identity versions up to and including 22.1 in the 'StartAuthentication' resource, exposes the response header 'X-CFY-TX-TM'.CyberArk Identity
- CVE-2022-25125MCMS v5.2.4 was discovered to contain a SQL injection vulnerability via search.do in the file /mdiy/dict/listExcludeApp.
- CVE-2022-23898MCMS v5.2.5 was discovered to contain a SQL injection vulnerability via the categoryId parameter in the file IContentDao.xml.net.mingsoft:ms-mcms
- CVE-2022-23899MCMS v5.2.5 was discovered to contain a SQL injection vulnerability via search.do in the file /web/MCmsAction.java.net.mingsoft:ms-mcms
- CVE-2022-26128A buffer overflow vulnerability exists in FRRouting through 8.1.0 due to a wrong check on the input packet length in the babel_packet_examinFRRouting
- CVE-2022-26127A buffer overflow vulnerability exists in FRRouting through 8.1.0 due to missing a check on the input packet length in the babel_packet_examFRRouting
- CVE-2022-25138Axelor Open Suite v5.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Name parameter.
- CVE-2022-0841OS Command Injection in ljharb/npm-lockfileljharb/npm-lockfile · npm-lockfile
- CVE-2022-0753Cross-site Scripting (XSS) - Reflected in hestiacp/hestiacphestiacp/hestiacp
- CVE-2021-43774A risky-algorithm issue was discovered on Fujifilm DocuCentre-VI C4471 1.8 devices.
- CVE-2022-25031Remote Desktop Commander Suite Agent before v4.8 contains an unquoted service path which allows attackers to escalate privileges to the syst
- CVE-2021-45819Wordline HIDCCEMonitorSVC before v5.2.4.3 contains an unquoted service path which allows attackers to escalate privileges to the system leve
- CVE-2021-40637OS4ED openSIS 8.0 is affected by cross-site scripting (XSS) in EmailCheckOthers.php.
- CVE-2021-40636OS4ED openSIS 8.0 is affected by SQL Injection in CheckDuplicateName.php, which can extract information from the database.
- CVE-2021-40635OS4ED openSIS 8.0 is affected by SQL injection in ChooseCpSearch.php, ChooseRequestSearch.php.
- CVE-2022-0528Server-Side Request Forgery (SSRF) in transloadit/uppytransloadit/uppy · @uppy/companion
- CVE-2021-42950Remote Code Execution (RCE) vulnerability exists in Zepl Notebooks all previous versions before October 25 2021.
- CVE-2022-23849The biometric lock in Devolutions Password Hub for iOS before 2021.3.4 allows attackers to access the application because of authentication
- CVE-2022-24573A stored cross-site scripting (XSS) vulnerability in the admin interface in Element-IT HTTP Commander 7.0.0 allows unauthenticated users to
- CVE-2022-24563In Genixcms v1.1.11, a stored Cross-Site Scripting (XSS) vulnerability exists in /gxadmin/index.php?page=themes&view=options" via the intro_genix/cms
- CVE-2021-26259A flaw was found in htmldoc in v1.9.12.htmldoc
- CVE-2021-26948Null pointer dereference in the htmldoc v1.9.11 and before may allow attackers to execute arbitrary code and cause a denial of service via ahtmldoc
- CVE-2021-3638An out-of-bounds memory access flaw was found in the ATI VGA device emulation of QEMU.QEMU
- CVE-2022-0730Under certain ldap conditions, Cacti authentication can be bypassed with certain credential types.Cati
- CVE-2022-26126Buffer overflow vulnerabilities exist in FRRouting through 8.1.0 due to the use of strdup with a non-zero-terminated binary string in isis_nFRRouting