CVEs published March 7, 2022
128 CVEs were published on March 7, 2022: 3 critical, 5 high. 1 is now in CISA KEV.
- Published
- 128
- Critical
- 3
- High
- 5
- Medium
- 12
- Low
- 0
- Unrated
- 108
- Now in CISA KEV
- 1
- Fix available
- 52
Most affected products
- Huawei EMUI · Huawei Magic UI +1
- 9
- Huawei EMUI · Huawei Magic UI
- 7
- Phicomm Routers
- 6
- ming
- 5
- OMRON CX-Programmer
- 5
- Custom Content Shortcode
- 3
- kernel
- 3
- salesagility/suitecrm
- 3
- IBM VIOS · IBM AIX
- 2
- janeczku/calibre-web · calibreweb
- 2
Critical 3
- CVE-2021-4045TP-LINK Tapo C200 remote code execution vulnerabilityTP-Link Tapo C200
- CVE-2022-26131ICSA-22-063-01 Improper Protection against Electromagnetic Fault Injection in Trailer Power Line Communications (PLC) J2497Power Line Communications PLC4TRUCKS
- CVE-2022-0767Server-Side Request Forgery (SSRF) in janeczku/calibre-webjaneczku/calibre-web · calibreweb
High 5
- CVE-2022-24738Account compromise in Evmostharsis evmos · github.com/tharsis/evmos +1
- CVE-2022-0754SQL Injection in salesagility/suitecrmsalesagility/suitecrm
- CVE-2021-4199Incorrect Permission Assignment for Critical Resource vulnerability in BDReinit.exe (VA-10017)Bitdefender Total Security · Bitdefender Internet Securi… +2
- CVE-2022-0755Missing Authorization in salesagility/suitecrmsalesagility/suitecrm
- CVE-2022-0847A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe kernel
Medium, low and unrated 120
- CVE-2021-36809A local attacker can overwrite arbitrary files on the system with VPN client logs using administrator privileges, potentially resulting in aSophos SSL VPN client
- CVE-2022-24737Exposure of Sensitive Information to an Unauthorized Actor in httpiehttpie
- CVE-2022-26661An XXE issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.trytond · proteus +1
- CVE-2022-26662An XML Entity Expansion (XEE) issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.xproteus · tryton +1
- CVE-2021-34338Ming 0.4.8 has an out-of-bounds buffer overwrite issue in the function getName() in decompiler.c file that causes a direct segmentation faulming
- CVE-2021-34339Ming 0.4.8 has an out-of-bounds buffer access issue in the function getString() in decompiler.c file that causes a direct segmentation faultming
- CVE-2021-34340Ming 0.4.8 has an out-of-bounds buffer access issue in the function decompileINCR_DECR() in decompiler.c file that causes a direct segmentatming
- CVE-2021-34341Ming 0.4.8 has an out-of-bounds read vulnerability in the function decompileIF() in the decompile.c file that causes a direct segmentation fming
- CVE-2021-34342Ming 0.4.8 has an out-of-bounds read vulnerability in the function newVar_N() in decompile.c which causes a huge information leak.ming
- CVE-2022-25219A null byte interaction error has been discovered in the code that the telnetd_startup daemon uses to construct a pair of ephemeral passwordPhicomm Routers
- CVE-2022-24644ZZ Inc.
- CVE-2022-25213Improper physical access control and use of hard-coded credentials in /etc/passwd permits an attacker with physical access to obtain a root Phicomm Routers
- CVE-2022-25215Improper access control on the LocalMACConfig.asp interface allows an unauthenticated remote attacker to add (or remove) client MAC addressePhicomm Routers
- CVE-2022-25218The use of the RSA algorithm without OAEP, or any other padding scheme, in telnetd_startup, allows an unauthenticated attacker on the local Phicomm Routers
- CVE-2022-25217Use of a hard-coded cryptographic key pair by the telnetd_startup service allows an attacker on the local area network to obtain a root shelPhicomm Routers
- CVE-2022-25214Improper access control on the LocalClientList.asp interface allows an unauthenticated remote attacker to obtain sensitive information concePhicomm Routers
- CVE-2022-25243"Vault and Vault Enterprise 1.8.0 through 1.8.8, and 1.9.3 allowed the PKI secrets engine under certain configurations to issue wildcard cer
- CVE-2022-25244Vault Enterprise clusters using the tokenization transform feature can expose the tokenization key through the tokenization key configuratio
- CVE-2020-36517An information leak in Nabu Casa Home Assistant Operating System and Home Assistant Supervised 2022.03 allows a DNS operator to gain knowled
- CVE-2021-41657SmartBear CodeCollaborator v6.1.6102 was discovered to contain a vulnerability in the web UI which would allow an attacker to conduct a clic
- CVE-2021-43970An arbitrary file upload vulnerability exists in albumimages.jsp in Quicklert for Digium 10.0.0 (1043) via a .mp3;.jsp filename for a file t
- CVE-2021-43969The login.jsp page of Quicklert for Digium 10.0.0 (1043) is affected by both Blind SQL Injection with Out-of-Band Interaction (DNS) and Blin
- CVE-2022-22834An issue was discovered in OverIT Geocall before 8.0.
- CVE-2022-22835An issue was discovered in OverIT Geocall before version 8.0.
- CVE-2022-26311Couchbase Operator 2.2.x before 2.2.3 exposes Sensitive Information to an Unauthorized Actor.
- CVE-2022-24177A cross-site scripting (XSS) vulnerability in the component cgi-bin/ej.cgi of Ex libris ALEPH 500 v18.1 and v20 allows attackers to execute
- CVE-2022-23940SuiteCRM through 7.12.1 and 8.x through 8.0.1 allows Remote Code Execution.
- CVE-2022-25294Proofpoint Insider Threat Management Agent for Windows relies on an inherently dangerous function that could enable an unprivileged local Wi
- CVE-2022-26488In Python before 3.10.3 on Windows, local users can gain privileges because the search path is inadequately secured.libpython · python +1
- CVE-2022-26520In pgjdbc before 42.3.3, an attacker (who controls the jdbc URL or properties) can call java.util.logging.FileHandler to write to arbitrary org.postgresql:postgresql
- CVE-2022-22351IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged trusted host user to exploit a vulnerability in the nimsh daemon to cause aIBM AIX · IBM VIOS
- CVE-2021-38989IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX kernel to cause a denial oIBM VIOS · IBM AIX
- CVE-2021-38988IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX kernel to cause a denial oIBM VIOS · IBM AIX
- CVE-2020-14115A command injection vulnerability exists in the Xiaomi Router AX3600.Xiaomi Router AX3600
- CVE-2022-25922ICSA-22-063-01 Missing Authentication for Critical Function in Trailer Power Line Communications (PLC) J2497Power Line Communications PLC4TRUCKS
- CVE-2020-14111A command injection vulnerability exists in the Xiaomi Router AX3600.Xiaomi Router Router AX3600
- CVE-2021-32005SiteManager Log View XSS IssueSecomea SiteManager
- CVE-2021-3739A NULL pointer dereference flaw was found in the btrfs_rm_device function in fs/btrfs/volumes.c in the Linux Kernel, where triggering the bukernel
- CVE-2022-23383YzmCMS v6.3 is affected by broken access control.
- CVE-2021-32006GateManager information leak for LinkManager UsersSecomea GateManager
- CVE-2021-44215Northern.tech CFEngine Enterprise 3.15.4 before 3.15.5 has Insecure Permissions that may allow unauthorized local users to have an unspecifi
- CVE-2021-44216Northern.tech CFEngine Enterprise before 3.15.5 and 3.18.x before 3.18.1 has Insecure Permissions that may allow unauthorized local users to
- CVE-2020-14112Information Leak Vulnerability exists in the Xiaomi Router AX6000.Router AX6000
- CVE-2022-0725A flaw was found in keepass.keepass
- CVE-2021-3660Cockpit (and its plugins) do not seem to protect itself against clickjacking.cockpit
- CVE-2021-3732A flaw was found in the Linux kernel's OverlayFS subsystem in the way the user mounts the TmpFS filesystem with OverlayFS.kernel
- CVE-2021-40047There is a vulnerability of memory not being released after effective lifetime in the Bastet module.Huawei EMUI · Huawei Magic UI +1
- CVE-2021-40048There is an incorrect buffer size calculation vulnerability in the video framework.Huawei EMUI · Huawei Magic UI +1
- CVE-2021-40049There is a permission control vulnerability in the PMS module.Huawei EMUI · Huawei Magic UI +1
- CVE-2021-40050There is an out-of-bounds read vulnerability in the IFAA module.Huawei EMUI · Huawei Magic UI +1
- CVE-2021-40051There is an unauthorized access vulnerability in system components.Huawei EMUI · Huawei Magic UI +1
- CVE-2021-40052There is an incorrect buffer size calculation vulnerability in the video framework.Successful exploitation of this vulnerability may affect Huawei HarmonyOS · Huawei EMUI +1
- CVE-2021-40053There is a permission control vulnerability in the Nearby module.Successful exploitation of this vulnerability will affect availability and HarmonyOS;EMUI;Magic UI
- CVE-2021-40054There is an integer underflow vulnerability in the atcmdserver module.Huawei EMUI · Huawei Magic UI
- CVE-2021-40055There is a man-in-the-middle attack vulnerability during system update download in recovery mode.Huawei EMUI · Huawei Magic UI +1
- CVE-2021-40056There is a vulnerability of copying input buffer without checking its size in the video framework.Huawei EMUI · Huawei Magic UI
- CVE-2021-40057There is a heap-based and stack-based buffer overflow vulnerability in the video framework.Huawei EMUI · Huawei Magic UI
- CVE-2021-40058There is a heap-based buffer overflow vulnerability in the video framework.Huawei EMUI · Huawei Magic UI
- CVE-2021-40059There is a permission control vulnerability in the Wi-Fi module.Huawei EMUI · Huawei Magic UI
- CVE-2021-40060There is a heap-based buffer overflow vulnerability in the video framework.Huawei EMUI · Huawei Magic UI
- CVE-2021-40061There is a vulnerability of accessing resources using an incompatible type (type confusion) in the Bastet module.Huawei EMUI · Huawei Magic UI +1
- CVE-2021-40062There is a vulnerability of copying input buffer without checking its size in the video framework.Huawei EMUI · Huawei Magic UI
- CVE-2021-40063There is an improper access control vulnerability in the video module.Huawei EMUI · Huawei Magic UI +1
- CVE-2021-40064There is a heap-based buffer overflow vulnerability in system components.Huawei EMUI · Huawei Magic UI +1
- CVE-2022-24193CasaOS before v0.2.7 was discovered to contain a command injection vulnerability.github.com/IceWhaleTech/CasaOS
- CVE-2021-4198messaging_ipc.dll NULL Pointer Dereference in multiple Bitdefender products (VA-10016)Bitdefender Total Security · Bitdefender Internet Securi… +3
- CVE-2022-25325Use after free vulnerability in CX-Programmer v9.76.1 and earlier which is a part of CX-One (v4.60) suite allows an attacker to cause informOMRON CX-Programmer
- CVE-2022-25234Out-of-bounds write vulnerability in CX-Programmer v9.76.1 and earlier which is a part of CX-One (v4.60) suite allows an attacker to cause iOMRON CX-Programmer
- CVE-2022-25230Use after free vulnerability in CX-Programmer v9.76.1 and earlier which is a part of CX-One (v4.60) suite allows an attacker to cause informOMRON CX-Programmer
- CVE-2022-21219Out-of-bounds read vulnerability in CX-Programmer v9.76.1 and earlier which is a part of CX-One (v4.60) suite allows an attacker to cause inOMRON CX-Programmer
- CVE-2022-21170Improper check for certificate revocation in i-FILTER Ver.10.45R01 and earlier, i-FILTER Ver.9.50R10 and earlier, i-FILTER Browser & Cloud MDigital Arts i-FILTER, i-FILTER Browser & Cloud MultiAgent…
- CVE-2022-21158A stored cross-site scripting vulnerability in marktext versions prior to v0.17.0 due to improper handling of the link (with javascript: schMarkText
- CVE-2022-21132Directory traversal vulnerability in pfSense-pkg-WireGuard pfSense-pkg-WireGuard 0.1.5 versions prior to 0.1.5_4 and pfSense-pkg-WireGuard 0pfSense-pkg-WireGuard
- CVE-2022-21124Out-of-bounds write vulnerability in CX-Programmer v9.76.1 and earlier which is a part of CX-One (v4.60) suite allows an attacker to cause iOMRON CX-Programmer
- CVE-2022-0535E2Pdf < 1.16.45 - Admin+ Stored Cross-Site Scripting (XSS)E2Pdf – Export To Pdf Tool for WordPress
- CVE-2022-0533Ditty (formerly Ditty News Ticker) < 3.0.15 - Reflected Cross-Site Scripting (XSS)Ditty
- CVE-2022-0448CP Blocks < 1.0.15 - Admin+ Stored Cross-Site ScriptingCP Blocks
- CVE-2022-0445WordPress Real Cookie Banner < 2.14.2 - Settings Reset via CSRFWordPress Real Cookie Banner: GDPR (DSGVO) & ePrivacy Cooki…
- CVE-2022-0442UsersWP < 1.2.3.1 - Subscriber+ User Avatar OverrideUsersWP – User Registration & User Profile
- CVE-2022-0441MasterStudy LMS < 2.7.6 - Unauthenticated Admin Account CreationMasterStudy LMS – WordPress LMS Plugin
- CVE-2022-0440Catch Themes Demo Import < 2.1.1 - Admin+ Remote Code ExecutionCatch Themes Demo Import
- CVE-2022-0439Email Subscribers & Newsletters < 5.3.2 - Subscriber+ Blind SQL injectionEmail Subscribers & Newsletters
- CVE-2022-0434Page Views Count < 2.4.15 - Unauthenticated SQL InjectionPage View Count
- CVE-2022-0429WP Cerber Security, Anti-spam & Malware Scan < 8.9.6 - Unauthenticated Stored Cross-Site ScriptingWP Cerber Security, Anti-spam & Malware Scan
- CVE-2022-0426Product Feed PRO for WooCommerce < 11.2.3 - Reflected Cross-Site ScriptingProduct Feed PRO for WooCommerce
- CVE-2022-0422White Label MS < 2.2.9 - Reflected Cross-Site ScriptingWhite Label CMS
- CVE-2022-0420RegistrationMagic < 5.0.2.2 - Admin+ SQL InjectionRegistrationMagic – Custom Registration Forms, User Registr…
- CVE-2022-0410WP Visitor Statistics (Real Time Traffic) < 5.6 - Subscriber+ SQL InjectionWP Visitor Statistics
- CVE-2022-0389WP Time Slots Booking Form < 1.1.63 - Admin+ Stored Cross-Site ScriptingWP Time Slots Booking Form
- CVE-2022-0384Video Conferencing with Zoom < 3.8.17 - E-mail Address DisclosureVideo Conferencing with Zoom
- CVE-2022-0349NotificationX < 2.3.9 - Unauthenticated Blind SQL InjectionNotificationX – Best FOMO, Social Proof, WooCommerce Sales…
- CVE-2022-0347LoginPress < 1.5.12 - Reflected Cross-Site ScriptingLoginPress | Custom Login Page Customizer
- CVE-2022-0267AdRotate < 5.8.22 - Admin+ SQL InjectionAdRotate – Ad manager & AdSense Ads
- CVE-2022-0205YOP Poll < 6.3.5 - Author+ Stored Cross-Site ScriptingYOP Poll
- CVE-2022-0163Smart Forms < 2.6.71 - Subscriber+ Form Data DownloadSmart Forms – when you need more than just a contact form
- CVE-2021-25098Easy Pricing Tables < 3.1.3 - Arbitrary Post Removal via CSRFPricing Tables WordPress Plugin – Easy Pricing Tables
- CVE-2021-25087Wordpress Download Manager < 3.2.25 - Sensitive Information DisclosureDownload Manager
- CVE-2021-25039Multisite Content Copier/Updater < 2.1.0 - Reflected Cross-Site ScriptingWordPress Multisite Content Copier/Updater
- CVE-2021-25038Multisite User Sync/Unsync < 2.1.2 - Reflected Cross-Site ScriptingWordPress Multisite User Sync/Unsync
- CVE-2021-25009CorreosExpress <= 2.6.0 - Sensitive Information DisclosureCorreosExpress – Shipping Management – Tags
- CVE-2021-24961WordPress File Upload < 4.16.3 - Contributor+ Stored Cross-Site Scripting via ShortcodeWordPress File Upload · wordpress-file-upload-pro
- CVE-2021-24960WordPress File Upload < 4.16.3 - Contributor+ Stored Cross-Site Scripting via Malicious SVGWordPress File Upload · wordpress-file-upload-pro
- CVE-2021-24953Advanced iFrame < 2022 - Reflected Cross-Site ScriptingAdvanced iFrame
- CVE-2021-24952Conversios.io < 4.6.2 - Subscriber+ SQL InjectionConversios.io – Google Analytics and Google Shopping plugin…
- CVE-2021-24826Custom Content Shortcode < 4.0.2 - Authenticated Stored Cross-Site ScriptingCustom Content Shortcode
- CVE-2021-24825Custom Content Shortcode < 4.0.2 - Authenticated Arbitrary File Access / LFICustom Content Shortcode
- CVE-2021-24824Custom Content Shortcode < 4.0.1 - Unauthorised Arbitrary Post Metadata AccessCustom Content Shortcode
- CVE-2021-24821Cost Calculator < 1.6 - Contributor+ Stored Cross-Site ScriptingCost Calculator
- CVE-2021-24810WP Event Manager < 3.1.23 - Admin+ Stored Cross-Site ScriptingWP Event Manager – Easily Build your Calendar of Events!
- CVE-2021-24778Tradetracker-Store < 4.6.60 - Admin+ SQL InjectionTradetracker-Store
- CVE-2021-24777Hotscot Contact Form < 1.3 - Admin+ SQL InjectionHotscot Contact Form
- CVE-2021-24216All-in-One WP Migration < 7.41 - Admin+ Arbitrary File Upload to RCEAll-in-One WP Migration
- CVE-2022-0766Server-Side Request Forgery (SSRF) in janeczku/calibre-webjaneczku/calibre-web · calibreweb
- CVE-2022-25108Foxit PDF Reader and Editor before 11.2.1 and PhantomPDF before 10.1.7 allow a NULL pointer dereference during PDF parsing because the point
- CVE-2021-44032TP-Link Omada SDN Software Controller before 5.0.15 does not check if the authentication method specified in a connection request is allowed
- CVE-2021-40376otris Update Manager 1.2.1.0 allows local users to achieve SYSTEM access via unauthenticated calls to exposed interfaces over a .NET named p
- CVE-2021-3733There's a flaw in urllib's AbstractBasicAuthHandler class.python · libpython +1
- CVE-2022-0756Missing Authorization in salesagility/suitecrmsalesagility/suitecrm
- CVE-2022-0865Reachable Assertion in tiffcp in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file.libtiff
- CVE-2022-26521Abantecart through 1.3.2 allows remote authenticated administrators to execute arbitrary code by uploading an executable file, because the C