# CVEs published 2022-03-04

56 CVEs were published on March 4, 2022: 3 critical, 4 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2022-25312](https://cve.now/CVE-2022-25312.md): An XML external entity (XXE) injection vulnerability exists in the Apache Any23 RDFa XSLTStylesheet extractor (no CVSS, Apache Software Foundation Apache Any23 · org.apache.any23:…)
- [CVE-2021-46384](https://cve.now/CVE-2021-46384.md): https://gitee.com/mingSoft/MCMS MCMS \<=5.2.5 is affected by: RCE. (no CVSS, net.mingsoft:ms-mcms)
- [CVE-2021-40846](https://cve.now/CVE-2021-40846.md): An issue was discovered in Rhinode Trading Paints through 2.0.36. (no CVSS)
- [CVE-2021-44827](https://cve.now/CVE-2021-44827.md): There is remote authenticated OS command injection on TP-Link Archer C20i 0.9.1 3.2 v003a.0 Build 170221 Rel.55462n devices vie the X\_TP\_Ext (no CVSS)
- [CVE-2021-32008](https://cve.now/CVE-2021-32008.md): Logged-in Administrator may get unrestricted file system access (CVSS 9.9, Secomea GateManager)
- [CVE-2021-27756](https://cve.now/CVE-2021-27756.md): "TLS-RSA cipher suites are not disabled in BigFix Compliance up to v2.0.5. (no CVSS, "BigFix Compliance Server")
- [CVE-2021-46353](https://cve.now/CVE-2021-46353.md): An information disclosure in web interface in D-Link DIR-X1860 before 1.03 RevA1 allows a remote unauthenticated attacker to send a speciall (no CVSS)
- [CVE-2021-43590](https://cve.now/CVE-2021-43590.md): Dell EMC Enterprise Storage Analytics for vRealize Operations, versions 4.0.1 to 6.2.1, contain a Plain-text password storage vulnerability. (CVSS 6.0, Dell EMC Enterprise Storage Analytics for vRealize Operatio…)
- [CVE-2022-23915](https://cve.now/CVE-2022-23915.md): Remote Code Execution (RCE) (CVSS 7.2, Weblate)
- [CVE-2022-25106](https://cve.now/CVE-2022-25106.md): D-Link DIR-859 v1.05 was discovered to contain a stack-based buffer overflow via the function genacgi\_main. (no CVSS)
- [CVE-2021-27757](https://cve.now/CVE-2021-27757.md): " Insecure password storage issue.The application stores sensitive information in cleartext within a resource that might be accessible to an (no CVSS, "BigFix Insights")
- [CVE-2021-3656](https://cve.now/CVE-2021-3656.md): A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. (no CVSS, KVM)
- [CVE-2022-0855](https://cve.now/CVE-2022-0855.md): Improper Resolution of Path Equivalence in microweber-dev/whmcs\_plugin (CVSS 7.4, microweber-dev/whmcs\_plugin)
- [CVE-2022-26484](https://cve.now/CVE-2022-26484.md): An issue was discovered in Veritas InfoScale Operations Manager (VIOM) before 7.4.2 Patch 600 and 8.x before 8.0.0 Patch 100. (CVSS 4.9)
- [CVE-2022-26483](https://cve.now/CVE-2022-26483.md): An issue was discovered in Veritas InfoScale Operations Manager (VIOM) before 7.4.2 Patch 600 and 8.x before 8.0.0 Patch 100. (CVSS 4.8)
- [CVE-2022-26318](https://cve.now/CVE-2022-26318.md): On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code, aka FBX-22786. (CVSS 9.8, KEV)
- [CVE-2022-23233](https://cve.now/CVE-2022-23233.md): StorageGRID (formerly StorageGRID Webscale) versions prior to 11.6.0 are susceptible to a vulnerability which when successfully exploited co (no CVSS, StorageGRID)
- [CVE-2022-23232](https://cve.now/CVE-2022-23232.md): StorageGRID (formerly StorageGRID Webscale) versions prior to 11.6.0 are susceptible to a vulnerability which when successfully exploited co (no CVSS, StorageGRID)
- [CVE-2021-3575](https://cve.now/CVE-2021-3575.md): A heap-based buffer overflow was found in openjpeg in color.c:379:42 in sycc420\_to\_rgb when decompressing a crafted .j2k file. (no CVSS, OpenJPEG)
- [CVE-2021-3428](https://cve.now/CVE-2021-3428.md): A flaw was found in the Linux kernel. (no CVSS, kernel)
- [CVE-2021-20319](https://cve.now/CVE-2021-20319.md): An improper signature verification vulnerability was found in coreos-installer. (no CVSS, coreos-installer)
- [CVE-2022-21828](https://cve.now/CVE-2022-21828.md): A user with high privilege access to the Incapptic Connect web console can remotely execute code on the Incapptic Connect server using a uns (no CVSS, Ivanti Incapptic Connect)
- [CVE-2022-25623](https://cve.now/CVE-2022-25623.md): The Symantec Management Agent is susceptible to a privilege escalation vulnerability. (no CVSS, Symantec Management Agent)
- [CVE-2021-3744](https://cve.now/CVE-2021-3744.md): A memory leak flaw was found in the Linux kernel in the ccp\_run\_aes\_gcm\_cmd() function in drivers/crypto/ccp/ccp-ops.c, which allows attacke (no CVSS, kernel)
- [CVE-2021-3743](https://cve.now/CVE-2021-3743.md): An out-of-bounds (OOB) memory read flaw was found in the Qualcomm IPC router protocol in the Linux kernel. (no CVSS, Kernel)
- [CVE-2022-23729](https://cve.now/CVE-2022-23729.md): When the device is in factory state, it can be access the shell without adb authentication process. (no CVSS, LG mobile devices)
- [CVE-2022-22946](https://cve.now/CVE-2022-22946.md): In spring cloud gateway versions prior to 3.1.1+ , applications that are configured to enable HTTP2 and no key store or trusted certificates (no CVSS, Spring Cloud Gateway)
- [CVE-2021-46382](https://cve.now/CVE-2021-46382.md): Unauthenticated cross-site scripting (XSS) in Netgear WAC120 AC Access Point may lead to mulitple attacks like session hijacking even clipbo (no CVSS)
- [CVE-2021-46381](https://cve.now/CVE-2021-46381.md): Local File Inclusion due to path traversal in D-Link DAP-1620 leads to unauthorized internal files reading \[/etc/passwd\] and \[/etc/shadow\]. (no CVSS)
- [CVE-2021-46379](https://cve.now/CVE-2021-46379.md): DLink DIR850 ET850-1.08TRb03 is affected by an incorrect access control vulnerability through URL redirection to untrusted site. (no CVSS)
- [CVE-2021-46378](https://cve.now/CVE-2021-46378.md): DLink DIR850 ET850-1.08TRb03 is affected by an incorrect access control vulnerability through an unauthenticated remote configuration downlo (no CVSS)
- [CVE-2022-0839](https://cve.now/CVE-2022-0839.md): Improper Restriction of XML External Entity Reference in liquibase/liquibase (CVSS 7.3, liquibase/liquibase · org.liquibase:liquibase-core)
- [CVE-2020-18325](https://cve.now/CVE-2020-18325.md): Multilple Cross Site Scripting (XSS) vulnerability exists in Intelliants Subrion CMS v4.2.1 in the Configuration panel. (no CVSS, intelliants/subrion)
- [CVE-2020-18324](https://cve.now/CVE-2020-18324.md): Cross Site Scripting (XSS) vulnerability exists in Subrion CMS 4.2.1 via the q parameter in the Kickstart template. (no CVSS, intelliants/subrion)
- [CVE-2020-18326](https://cve.now/CVE-2020-18326.md): Cross Site Request Forgery (CSRF) vulnerability exists in Intelliants Subrion CMS v4.2.1 via the Members administrator function, which could (no CVSS, intelliants/subrion)
- [CVE-2020-18327](https://cve.now/CVE-2020-18327.md): Cross Site Scripting (XSS) vulnerability exists in Alfresco Alfresco Community Edition v5.2.0 via the action parameter in the alfresco/s/adm (no CVSS)
- [CVE-2022-0832](https://cve.now/CVE-2022-0832.md): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (CVSS 4.6, pimcore/pimcore)
- [CVE-2022-0831](https://cve.now/CVE-2022-0831.md): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (CVSS 4.6, pimcore/pimcore)
- [CVE-2022-26201](https://cve.now/CVE-2022-26201.md): Victor CMS v1.0 was discovered to contain a SQL injection vulnerability. (no CVSS)
- [CVE-2021-46394](https://cve.now/CVE-2021-46394.md): There is a stack buffer overflow vulnerability in the formSetPPTPServer function of Tenda-AX3 router V16.03.12.10\_CN. (no CVSS)
- [CVE-2021-46393](https://cve.now/CVE-2021-46393.md): There is a stack buffer overflow vulnerability in the formSetPPTPServer function of Tenda-AX3 router V16.03.12.10\_CN. (no CVSS)
- [CVE-2021-43392](https://cve.now/CVE-2021-43392.md): STMicroelectronics STSAFE-J 1.1.4, J-SAFE3 1.2.5, and J-SIGN sometimes allow attackers to obtain information on cryptographic secrets. (no CVSS)
- [CVE-2021-43393](https://cve.now/CVE-2021-43393.md): STMicroelectronics STSAFE-J 1.1.4, J-SAFE3 1.2.5, and J-SIGN sometimes allow attackers to abuse signature verification. (no CVSS)
- [CVE-2021-44321](https://cve.now/CVE-2021-44321.md): Mini-Inventory-and-Sales-Management-System is affected by Cross Site Request Forgery (CSRF), where an attacker can update/delete items in th (no CVSS)
- [CVE-2022-0752](https://cve.now/CVE-2022-0752.md): Cross-site Scripting (XSS) - Generic in hestiacp/hestiacp (CVSS 3.5, hestiacp/hestiacp)
- [CVE-2022-23328](https://cve.now/CVE-2022-23328.md): A design flaw in all versions of Go-Ethereum allows an attacker node to send 5120 pending transactions of a high gas price from one account (no CVSS, github.com/ethereum/go-ethereum)
- [CVE-2022-23327](https://cve.now/CVE-2022-23327.md): A design flaw in Go-Ethereum 1.10.12 and older versions allows an attacker node to send 5120 future transactions with a high gas price in on (no CVSS, github.com/ethereum/go-ethereum)
- [CVE-2022-0848](https://cve.now/CVE-2022-0848.md): OS Command Injection in part-db/part-db (CVSS 10.0, part-db/part-db)
- [CVE-2022-0838](https://cve.now/CVE-2022-0838.md): Cross-site Scripting (XSS) - Reflected in hestiacp/hestiacp (CVSS 6.6, hestiacp/hestiacp)
- [CVE-2021-20300](https://cve.now/CVE-2021-20300.md): A flaw was found in OpenEXR's hufUncompress functionality in OpenEXR/IlmImf/ImfHuf.cpp. (no CVSS, OpenEXR)
- [CVE-2021-20302](https://cve.now/CVE-2021-20302.md): A flaw was found in OpenEXR's TiledInputFile functionality. (no CVSS, OpenEXR)
- [CVE-2021-20303](https://cve.now/CVE-2021-20303.md): A flaw found in function dataWindowForTile() of IlmImf/ImfTiledMisc.cpp. (no CVSS, OpenEXR)
- [CVE-2021-23214](https://cve.now/CVE-2021-23214.md): When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle a (no CVSS, postgresql)
- [CVE-2021-3737](https://cve.now/CVE-2021-3737.md): A flaw was found in python. (CVSS 7.5, python · libpython +1)
- [CVE-2022-23397](https://cve.now/CVE-2022-23397.md): The Cedar Gate EZ-NET portal 6.5.5 6.8.0 Internet portal has a call to display messages to users which does not properly sanitize data sent (CVSS 6.1)
- [CVE-2022-26336](https://cve.now/CVE-2022-26336.md): A carefully crafted TNEF file can cause an out of memory exception (no CVSS, Apache Software Foundation poi-scratchpad · org.apache.poi:…)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-03-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.