CVEs published March 4, 2022
56 CVEs were published on March 4, 2022: 3 critical, 4 high. 1 is now in CISA KEV.
- Published
- 56
- Critical
- 3
- High
- 4
- Medium
- 7
- Low
- 1
- Unrated
- 41
- Now in CISA KEV
- 1
- Fix available
- 14
Most affected products
- intelliants/subrion
- 3
- OpenEXR
- 3
- github.com/ethereum/go-ethereum
- 2
- hestiacp/hestiacp
- 2
- kernel
- 2
- pimcore/pimcore
- 2
- StorageGRID
- 2
- "BigFix Compliance Server"
- 1
- "BigFix Insights"
- 1
- Apache Software Foundation Apache Any23 · org.apache.any23:…
- 1
Critical 3
High 4
- CVE-2022-23915Remote Code Execution (RCE)Weblate
- CVE-2022-0855Improper Resolution of Path Equivalence in microweber-dev/whmcs_pluginmicroweber-dev/whmcs_plugin
- CVE-2022-0839Improper Restriction of XML External Entity Reference in liquibase/liquibaseliquibase/liquibase · org.liquibase:liquibase-core
- CVE-2021-3737A flaw was found in python.python · libpython +1
Medium, low and unrated 49
- CVE-2022-25312An XML external entity (XXE) injection vulnerability exists in the Apache Any23 RDFa XSLTStylesheet extractorApache Software Foundation Apache Any23 · org.apache.any23:…
- CVE-2021-46384https://gitee.com/mingSoft/MCMS MCMS <=5.2.5 is affected by: RCE.net.mingsoft:ms-mcms
- CVE-2021-40846An issue was discovered in Rhinode Trading Paints through 2.0.36.
- CVE-2021-44827There is remote authenticated OS command injection on TP-Link Archer C20i 0.9.1 3.2 v003a.0 Build 170221 Rel.55462n devices vie the X_TP_Ext
- CVE-2021-27756"TLS-RSA cipher suites are not disabled in BigFix Compliance up to v2.0.5."BigFix Compliance Server"
- CVE-2021-46353An information disclosure in web interface in D-Link DIR-X1860 before 1.03 RevA1 allows a remote unauthenticated attacker to send a speciall
- CVE-2021-43590Dell EMC Enterprise Storage Analytics for vRealize Operations, versions 4.0.1 to 6.2.1, contain a Plain-text password storage vulnerability.Dell EMC Enterprise Storage Analytics for vRealize Operatio…
- CVE-2022-25106D-Link DIR-859 v1.05 was discovered to contain a stack-based buffer overflow via the function genacgi_main.
- CVE-2021-27757" Insecure password storage issue.The application stores sensitive information in cleartext within a resource that might be accessible to an"BigFix Insights"
- CVE-2021-3656A flaw was found in the KVM's AMD code for supporting SVM nested virtualization.KVM
- CVE-2022-26484An issue was discovered in Veritas InfoScale Operations Manager (VIOM) before 7.4.2 Patch 600 and 8.x before 8.0.0 Patch 100.
- CVE-2022-26483An issue was discovered in Veritas InfoScale Operations Manager (VIOM) before 7.4.2 Patch 600 and 8.x before 8.0.0 Patch 100.
- CVE-2022-23233StorageGRID (formerly StorageGRID Webscale) versions prior to 11.6.0 are susceptible to a vulnerability which when successfully exploited coStorageGRID
- CVE-2022-23232StorageGRID (formerly StorageGRID Webscale) versions prior to 11.6.0 are susceptible to a vulnerability which when successfully exploited coStorageGRID
- CVE-2021-3575A heap-based buffer overflow was found in openjpeg in color.c:379:42 in sycc420_to_rgb when decompressing a crafted .j2k file.OpenJPEG
- CVE-2021-3428A flaw was found in the Linux kernel.kernel
- CVE-2021-20319An improper signature verification vulnerability was found in coreos-installer.coreos-installer
- CVE-2022-21828A user with high privilege access to the Incapptic Connect web console can remotely execute code on the Incapptic Connect server using a unsIvanti Incapptic Connect
- CVE-2022-25623The Symantec Management Agent is susceptible to a privilege escalation vulnerability.Symantec Management Agent
- CVE-2021-3744A memory leak flaw was found in the Linux kernel in the ccp_run_aes_gcm_cmd() function in drivers/crypto/ccp/ccp-ops.c, which allows attackekernel
- CVE-2021-3743An out-of-bounds (OOB) memory read flaw was found in the Qualcomm IPC router protocol in the Linux kernel.Kernel
- CVE-2022-23729When the device is in factory state, it can be access the shell without adb authentication process.LG mobile devices
- CVE-2022-22946In spring cloud gateway versions prior to 3.1.1+ , applications that are configured to enable HTTP2 and no key store or trusted certificatesSpring Cloud Gateway
- CVE-2021-46382Unauthenticated cross-site scripting (XSS) in Netgear WAC120 AC Access Point may lead to mulitple attacks like session hijacking even clipbo
- CVE-2021-46381Local File Inclusion due to path traversal in D-Link DAP-1620 leads to unauthorized internal files reading [/etc/passwd] and [/etc/shadow].
- CVE-2021-46379DLink DIR850 ET850-1.08TRb03 is affected by an incorrect access control vulnerability through URL redirection to untrusted site.
- CVE-2021-46378DLink DIR850 ET850-1.08TRb03 is affected by an incorrect access control vulnerability through an unauthenticated remote configuration downlo
- CVE-2020-18325Multilple Cross Site Scripting (XSS) vulnerability exists in Intelliants Subrion CMS v4.2.1 in the Configuration panel.intelliants/subrion
- CVE-2020-18324Cross Site Scripting (XSS) vulnerability exists in Subrion CMS 4.2.1 via the q parameter in the Kickstart template.intelliants/subrion
- CVE-2020-18326Cross Site Request Forgery (CSRF) vulnerability exists in Intelliants Subrion CMS v4.2.1 via the Members administrator function, which couldintelliants/subrion
- CVE-2020-18327Cross Site Scripting (XSS) vulnerability exists in Alfresco Alfresco Community Edition v5.2.0 via the action parameter in the alfresco/s/adm
- CVE-2022-0832Cross-site Scripting (XSS) - Stored in pimcore/pimcorepimcore/pimcore
- CVE-2022-0831Cross-site Scripting (XSS) - Stored in pimcore/pimcorepimcore/pimcore
- CVE-2022-26201Victor CMS v1.0 was discovered to contain a SQL injection vulnerability.
- CVE-2021-46394There is a stack buffer overflow vulnerability in the formSetPPTPServer function of Tenda-AX3 router V16.03.12.10_CN.
- CVE-2021-46393There is a stack buffer overflow vulnerability in the formSetPPTPServer function of Tenda-AX3 router V16.03.12.10_CN.
- CVE-2021-43392STMicroelectronics STSAFE-J 1.1.4, J-SAFE3 1.2.5, and J-SIGN sometimes allow attackers to obtain information on cryptographic secrets.
- CVE-2021-43393STMicroelectronics STSAFE-J 1.1.4, J-SAFE3 1.2.5, and J-SIGN sometimes allow attackers to abuse signature verification.
- CVE-2021-44321Mini-Inventory-and-Sales-Management-System is affected by Cross Site Request Forgery (CSRF), where an attacker can update/delete items in th
- CVE-2022-0752Cross-site Scripting (XSS) - Generic in hestiacp/hestiacphestiacp/hestiacp
- CVE-2022-23328A design flaw in all versions of Go-Ethereum allows an attacker node to send 5120 pending transactions of a high gas price from one account github.com/ethereum/go-ethereum
- CVE-2022-23327A design flaw in Go-Ethereum 1.10.12 and older versions allows an attacker node to send 5120 future transactions with a high gas price in ongithub.com/ethereum/go-ethereum
- CVE-2022-0838Cross-site Scripting (XSS) - Reflected in hestiacp/hestiacphestiacp/hestiacp
- CVE-2021-20300A flaw was found in OpenEXR's hufUncompress functionality in OpenEXR/IlmImf/ImfHuf.cpp.OpenEXR
- CVE-2021-20302A flaw was found in OpenEXR's TiledInputFile functionality.OpenEXR
- CVE-2021-20303A flaw found in function dataWindowForTile() of IlmImf/ImfTiledMisc.cpp.OpenEXR
- CVE-2021-23214When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle apostgresql
- CVE-2022-23397The Cedar Gate EZ-NET portal 6.5.5 6.8.0 Internet portal has a call to display messages to users which does not properly sanitize data sent
- CVE-2022-26336A carefully crafted TNEF file can cause an out of memory exceptionApache Software Foundation poi-scratchpad · org.apache.poi:…