# CVEs published 2022-03-07

128 CVEs were published on March 7, 2022: 3 critical, 5 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2021-36809](https://cve.now/CVE-2021-36809.md): A local attacker can overwrite arbitrary files on the system with VPN client logs using administrator privileges, potentially resulting in a (CVSS 6.1, Sophos SSL VPN client)
- [CVE-2022-24737](https://cve.now/CVE-2022-24737.md): Exposure of Sensitive Information to an Unauthorized Actor in httpie (CVSS 6.5, httpie)
- [CVE-2022-26661](https://cve.now/CVE-2022-26661.md): An XXE issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2. (no CVSS, trytond · proteus +1)
- [CVE-2022-26662](https://cve.now/CVE-2022-26662.md): An XML Entity Expansion (XEE) issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x (no CVSS, proteus · tryton +1)
- [CVE-2021-34338](https://cve.now/CVE-2021-34338.md): Ming 0.4.8 has an out-of-bounds buffer overwrite issue in the function getName() in decompiler.c file that causes a direct segmentation faul (no CVSS, ming)
- [CVE-2021-34339](https://cve.now/CVE-2021-34339.md): Ming 0.4.8 has an out-of-bounds buffer access issue in the function getString() in decompiler.c file that causes a direct segmentation fault (no CVSS, ming)
- [CVE-2021-34340](https://cve.now/CVE-2021-34340.md): Ming 0.4.8 has an out-of-bounds buffer access issue in the function decompileINCR\_DECR() in decompiler.c file that causes a direct segmentat (no CVSS, ming)
- [CVE-2021-34341](https://cve.now/CVE-2021-34341.md): Ming 0.4.8 has an out-of-bounds read vulnerability in the function decompileIF() in the decompile.c file that causes a direct segmentation f (no CVSS, ming)
- [CVE-2021-34342](https://cve.now/CVE-2021-34342.md): Ming 0.4.8 has an out-of-bounds read vulnerability in the function newVar\_N() in decompile.c which causes a huge information leak. (no CVSS, ming)
- [CVE-2021-4045](https://cve.now/CVE-2021-4045.md): TP-LINK Tapo C200 remote code execution vulnerability (CVSS 9.8, TP-Link Tapo C200)
- [CVE-2022-25219](https://cve.now/CVE-2022-25219.md): A null byte interaction error has been discovered in the code that the telnetd\_startup daemon uses to construct a pair of ephemeral password (no CVSS, Phicomm Routers)
- [CVE-2022-24644](https://cve.now/CVE-2022-24644.md): ZZ Inc. (no CVSS)
- [CVE-2022-25213](https://cve.now/CVE-2022-25213.md): Improper physical access control and use of hard-coded credentials in /etc/passwd permits an attacker with physical access to obtain a root (no CVSS, Phicomm Routers)
- [CVE-2022-25215](https://cve.now/CVE-2022-25215.md): Improper access control on the LocalMACConfig.asp interface allows an unauthenticated remote attacker to add (or remove) client MAC addresse (no CVSS, Phicomm Routers)
- [CVE-2022-25218](https://cve.now/CVE-2022-25218.md): The use of the RSA algorithm without OAEP, or any other padding scheme, in telnetd\_startup, allows an unauthenticated attacker on the local (no CVSS, Phicomm Routers)
- [CVE-2022-25217](https://cve.now/CVE-2022-25217.md): Use of a hard-coded cryptographic key pair by the telnetd\_startup service allows an attacker on the local area network to obtain a root shel (no CVSS, Phicomm Routers)
- [CVE-2022-25214](https://cve.now/CVE-2022-25214.md): Improper access control on the LocalClientList.asp interface allows an unauthenticated remote attacker to obtain sensitive information conce (no CVSS, Phicomm Routers)
- [CVE-2022-25243](https://cve.now/CVE-2022-25243.md): "Vault and Vault Enterprise 1.8.0 through 1.8.8, and 1.9.3 allowed the PKI secrets engine under certain configurations to issue wildcard cer (no CVSS)
- [CVE-2022-25244](https://cve.now/CVE-2022-25244.md): Vault Enterprise clusters using the tokenization transform feature can expose the tokenization key through the tokenization key configuratio (no CVSS)
- [CVE-2022-24738](https://cve.now/CVE-2022-24738.md): Account compromise in Evmos (CVSS 8.1, tharsis evmos · github.com/tharsis/evmos +1)
- [CVE-2020-36517](https://cve.now/CVE-2020-36517.md): An information leak in Nabu Casa Home Assistant Operating System and Home Assistant Supervised 2022.03 allows a DNS operator to gain knowled (no CVSS)
- [CVE-2021-41657](https://cve.now/CVE-2021-41657.md): SmartBear CodeCollaborator v6.1.6102 was discovered to contain a vulnerability in the web UI which would allow an attacker to conduct a clic (no CVSS)
- [CVE-2021-43970](https://cve.now/CVE-2021-43970.md): An arbitrary file upload vulnerability exists in albumimages.jsp in Quicklert for Digium 10.0.0 (1043) via a .mp3;.jsp filename for a file t (no CVSS)
- [CVE-2021-43969](https://cve.now/CVE-2021-43969.md): The login.jsp page of Quicklert for Digium 10.0.0 (1043) is affected by both Blind SQL Injection with Out-of-Band Interaction (DNS) and Blin (no CVSS)
- [CVE-2022-22834](https://cve.now/CVE-2022-22834.md): An issue was discovered in OverIT Geocall before 8.0. (no CVSS)
- [CVE-2022-22835](https://cve.now/CVE-2022-22835.md): An issue was discovered in OverIT Geocall before version 8.0. (no CVSS)
- [CVE-2022-26311](https://cve.now/CVE-2022-26311.md): Couchbase Operator 2.2.x before 2.2.3 exposes Sensitive Information to an Unauthorized Actor. (no CVSS)
- [CVE-2022-24177](https://cve.now/CVE-2022-24177.md): A cross-site scripting (XSS) vulnerability in the component cgi-bin/ej.cgi of Ex libris ALEPH 500 v18.1 and v20 allows attackers to execute (no CVSS)
- [CVE-2022-23940](https://cve.now/CVE-2022-23940.md): SuiteCRM through 7.12.1 and 8.x through 8.0.1 allows Remote Code Execution. (no CVSS)
- [CVE-2022-25294](https://cve.now/CVE-2022-25294.md): Proofpoint Insider Threat Management Agent for Windows relies on an inherently dangerous function that could enable an unprivileged local Wi (no CVSS)
- [CVE-2022-26488](https://cve.now/CVE-2022-26488.md): In Python before 3.10.3 on Windows, local users can gain privileges because the search path is inadequately secured. (no CVSS, libpython · python +1)
- [CVE-2022-26520](https://cve.now/CVE-2022-26520.md): In pgjdbc before 42.3.3, an attacker (who controls the jdbc URL or properties) can call java.util.logging.FileHandler to write to arbitrary (no CVSS, org.postgresql:postgresql)
- [CVE-2022-22351](https://cve.now/CVE-2022-22351.md): IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged trusted host user to exploit a vulnerability in the nimsh daemon to cause a (CVSS 6.1, IBM AIX · IBM VIOS)
- [CVE-2021-38989](https://cve.now/CVE-2021-38989.md): IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX kernel to cause a denial o (CVSS 6.2, IBM VIOS · IBM AIX)
- [CVE-2021-38988](https://cve.now/CVE-2021-38988.md): IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX kernel to cause a denial o (CVSS 6.2, IBM VIOS · IBM AIX)
- [CVE-2020-14115](https://cve.now/CVE-2020-14115.md): A command injection vulnerability exists in the Xiaomi Router AX3600. (no CVSS, Xiaomi Router AX3600)
- [CVE-2022-26131](https://cve.now/CVE-2022-26131.md): ICSA-22-063-01 Improper Protection against Electromagnetic Fault Injection in Trailer Power Line Communications (PLC) J2497 (CVSS 9.3, Power Line Communications PLC4TRUCKS)
- [CVE-2022-25922](https://cve.now/CVE-2022-25922.md): ICSA-22-063-01 Missing Authentication for Critical Function in Trailer Power Line Communications (PLC) J2497 (CVSS 6.1, Power Line Communications PLC4TRUCKS)
- [CVE-2020-14111](https://cve.now/CVE-2020-14111.md): A command injection vulnerability exists in the Xiaomi Router AX3600. (no CVSS, Xiaomi Router Router AX3600)
- [CVE-2021-32005](https://cve.now/CVE-2021-32005.md): SiteManager Log View XSS Issue (CVSS 6.5, Secomea SiteManager)
- [CVE-2021-3739](https://cve.now/CVE-2021-3739.md): A NULL pointer dereference flaw was found in the btrfs\_rm\_device function in fs/btrfs/volumes.c in the Linux Kernel, where triggering the bu (no CVSS, kernel)
- [CVE-2022-23383](https://cve.now/CVE-2022-23383.md): YzmCMS v6.3 is affected by broken access control. (no CVSS)
- [CVE-2021-32006](https://cve.now/CVE-2021-32006.md): GateManager information leak for LinkManager Users (CVSS 5.0, Secomea GateManager)
- [CVE-2021-44215](https://cve.now/CVE-2021-44215.md): Northern.tech CFEngine Enterprise 3.15.4 before 3.15.5 has Insecure Permissions that may allow unauthorized local users to have an unspecifi (no CVSS)
- [CVE-2021-44216](https://cve.now/CVE-2021-44216.md): Northern.tech CFEngine Enterprise before 3.15.5 and 3.18.x before 3.18.1 has Insecure Permissions that may allow unauthorized local users to (no CVSS)
- [CVE-2020-14112](https://cve.now/CVE-2020-14112.md): Information Leak Vulnerability exists in the Xiaomi Router AX6000. (no CVSS, Router AX6000)
- [CVE-2022-0725](https://cve.now/CVE-2022-0725.md): A flaw was found in keepass. (no CVSS, keepass)
- [CVE-2021-3660](https://cve.now/CVE-2021-3660.md): Cockpit (and its plugins) do not seem to protect itself against clickjacking. (no CVSS, cockpit)
- [CVE-2021-3732](https://cve.now/CVE-2021-3732.md): A flaw was found in the Linux kernel's OverlayFS subsystem in the way the user mounts the TmpFS filesystem with OverlayFS. (no CVSS, kernel)
- [CVE-2021-40047](https://cve.now/CVE-2021-40047.md): There is a vulnerability of memory not being released after effective lifetime in the Bastet module. (no CVSS, Huawei EMUI · Huawei Magic UI +1)
- [CVE-2021-40048](https://cve.now/CVE-2021-40048.md): There is an incorrect buffer size calculation vulnerability in the video framework. (no CVSS, Huawei EMUI · Huawei Magic UI +1)
- [CVE-2021-40049](https://cve.now/CVE-2021-40049.md): There is a permission control vulnerability in the PMS module. (no CVSS, Huawei EMUI · Huawei Magic UI +1)
- [CVE-2021-40050](https://cve.now/CVE-2021-40050.md): There is an out-of-bounds read vulnerability in the IFAA module. (no CVSS, Huawei EMUI · Huawei Magic UI +1)
- [CVE-2021-40051](https://cve.now/CVE-2021-40051.md): There is an unauthorized access vulnerability in system components. (no CVSS, Huawei EMUI · Huawei Magic UI +1)
- [CVE-2021-40052](https://cve.now/CVE-2021-40052.md): There is an incorrect buffer size calculation vulnerability in the video framework.Successful exploitation of this vulnerability may affect (no CVSS, Huawei HarmonyOS · Huawei EMUI +1)
- [CVE-2021-40053](https://cve.now/CVE-2021-40053.md): There is a permission control vulnerability in the Nearby module.Successful exploitation of this vulnerability will affect availability and (no CVSS, HarmonyOS;EMUI;Magic UI)
- [CVE-2021-40054](https://cve.now/CVE-2021-40054.md): There is an integer underflow vulnerability in the atcmdserver module. (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-40055](https://cve.now/CVE-2021-40055.md): There is a man-in-the-middle attack vulnerability during system update download in recovery mode. (no CVSS, Huawei EMUI · Huawei Magic UI +1)
- [CVE-2021-40056](https://cve.now/CVE-2021-40056.md): There is a vulnerability of copying input buffer without checking its size in the video framework. (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-40057](https://cve.now/CVE-2021-40057.md): There is a heap-based and stack-based buffer overflow vulnerability in the video framework. (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-40058](https://cve.now/CVE-2021-40058.md): There is a heap-based buffer overflow vulnerability in the video framework. (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-40059](https://cve.now/CVE-2021-40059.md): There is a permission control vulnerability in the Wi-Fi module. (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-40060](https://cve.now/CVE-2021-40060.md): There is a heap-based buffer overflow vulnerability in the video framework. (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-40061](https://cve.now/CVE-2021-40061.md): There is a vulnerability of accessing resources using an incompatible type (type confusion) in the Bastet module. (no CVSS, Huawei EMUI · Huawei Magic UI +1)
- [CVE-2021-40062](https://cve.now/CVE-2021-40062.md): There is a vulnerability of copying input buffer without checking its size in the video framework. (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-40063](https://cve.now/CVE-2021-40063.md): There is an improper access control vulnerability in the video module. (no CVSS, Huawei EMUI · Huawei Magic UI +1)
- [CVE-2021-40064](https://cve.now/CVE-2021-40064.md): There is a heap-based buffer overflow vulnerability in system components. (no CVSS, Huawei EMUI · Huawei Magic UI +1)
- [CVE-2022-24193](https://cve.now/CVE-2022-24193.md): CasaOS before v0.2.7 was discovered to contain a command injection vulnerability. (no CVSS, github.com/IceWhaleTech/CasaOS)
- [CVE-2022-0754](https://cve.now/CVE-2022-0754.md): SQL Injection in salesagility/suitecrm (CVSS 7.1, salesagility/suitecrm)
- [CVE-2021-4199](https://cve.now/CVE-2021-4199.md): Incorrect Permission Assignment for Critical Resource vulnerability in BDReinit.exe (VA-10017) (CVSS 7.8, Bitdefender Total Security · Bitdefender Internet Securi… +2)
- [CVE-2021-4198](https://cve.now/CVE-2021-4198.md): messaging\_ipc.dll NULL Pointer Dereference in multiple Bitdefender products (VA-10016) (CVSS 6.1, Bitdefender Total Security · Bitdefender Internet Securi… +3)
- [CVE-2022-25325](https://cve.now/CVE-2022-25325.md): Use after free vulnerability in CX-Programmer v9.76.1 and earlier which is a part of CX-One (v4.60) suite allows an attacker to cause inform (no CVSS, OMRON CX-Programmer)
- [CVE-2022-25234](https://cve.now/CVE-2022-25234.md): Out-of-bounds write vulnerability in CX-Programmer v9.76.1 and earlier which is a part of CX-One (v4.60) suite allows an attacker to cause i (no CVSS, OMRON CX-Programmer)
- [CVE-2022-25230](https://cve.now/CVE-2022-25230.md): Use after free vulnerability in CX-Programmer v9.76.1 and earlier which is a part of CX-One (v4.60) suite allows an attacker to cause inform (no CVSS, OMRON CX-Programmer)
- [CVE-2022-21219](https://cve.now/CVE-2022-21219.md): Out-of-bounds read vulnerability in CX-Programmer v9.76.1 and earlier which is a part of CX-One (v4.60) suite allows an attacker to cause in (no CVSS, OMRON CX-Programmer)
- [CVE-2022-21170](https://cve.now/CVE-2022-21170.md): Improper check for certificate revocation in i-FILTER Ver.10.45R01 and earlier, i-FILTER Ver.9.50R10 and earlier, i-FILTER Browser & Cloud M (no CVSS, Digital Arts i-FILTER, i-FILTER Browser & Cloud MultiAgent…)
- [CVE-2022-21158](https://cve.now/CVE-2022-21158.md): A stored cross-site scripting vulnerability in marktext versions prior to v0.17.0 due to improper handling of the link (with javascript: sch (no CVSS, MarkText)
- [CVE-2022-21132](https://cve.now/CVE-2022-21132.md): Directory traversal vulnerability in pfSense-pkg-WireGuard pfSense-pkg-WireGuard 0.1.5 versions prior to 0.1.5\_4 and pfSense-pkg-WireGuard 0 (no CVSS, pfSense-pkg-WireGuard)
- [CVE-2022-21124](https://cve.now/CVE-2022-21124.md): Out-of-bounds write vulnerability in CX-Programmer v9.76.1 and earlier which is a part of CX-One (v4.60) suite allows an attacker to cause i (no CVSS, OMRON CX-Programmer)
- [CVE-2022-0535](https://cve.now/CVE-2022-0535.md): E2Pdf \< 1.16.45 - Admin+ Stored Cross-Site Scripting (XSS) (no CVSS, E2Pdf – Export To Pdf Tool for WordPress)
- [CVE-2022-0533](https://cve.now/CVE-2022-0533.md): Ditty (formerly Ditty News Ticker) \< 3.0.15 - Reflected Cross-Site Scripting (XSS) (no CVSS, Ditty)
- [CVE-2022-0448](https://cve.now/CVE-2022-0448.md): CP Blocks \< 1.0.15 - Admin+ Stored Cross-Site Scripting (no CVSS, CP Blocks)
- [CVE-2022-0445](https://cve.now/CVE-2022-0445.md): WordPress Real Cookie Banner \< 2.14.2 - Settings Reset via CSRF (no CVSS, WordPress Real Cookie Banner: GDPR (DSGVO) & ePrivacy Cooki…)
- [CVE-2022-0442](https://cve.now/CVE-2022-0442.md): UsersWP \< 1.2.3.1 - Subscriber+ User Avatar Override (no CVSS, UsersWP – User Registration & User Profile)
- [CVE-2022-0441](https://cve.now/CVE-2022-0441.md): MasterStudy LMS \< 2.7.6 - Unauthenticated Admin Account Creation (no CVSS, MasterStudy LMS – WordPress LMS Plugin)
- [CVE-2022-0440](https://cve.now/CVE-2022-0440.md): Catch Themes Demo Import \< 2.1.1 - Admin+ Remote Code Execution (no CVSS, Catch Themes Demo Import)
- [CVE-2022-0439](https://cve.now/CVE-2022-0439.md): Email Subscribers & Newsletters \< 5.3.2 - Subscriber+ Blind SQL injection (no CVSS, Email Subscribers & Newsletters)
- [CVE-2022-0434](https://cve.now/CVE-2022-0434.md): Page Views Count \< 2.4.15 - Unauthenticated SQL Injection (no CVSS, Page View Count)
- [CVE-2022-0429](https://cve.now/CVE-2022-0429.md): WP Cerber Security, Anti-spam & Malware Scan \< 8.9.6 - Unauthenticated Stored Cross-Site Scripting (no CVSS, WP Cerber Security, Anti-spam & Malware Scan)
- [CVE-2022-0426](https://cve.now/CVE-2022-0426.md): Product Feed PRO for WooCommerce \< 11.2.3 - Reflected Cross-Site Scripting (no CVSS, Product Feed PRO for WooCommerce)
- [CVE-2022-0422](https://cve.now/CVE-2022-0422.md): White Label MS \< 2.2.9 - Reflected Cross-Site Scripting (no CVSS, White Label CMS)
- [CVE-2022-0420](https://cve.now/CVE-2022-0420.md): RegistrationMagic \< 5.0.2.2 - Admin+ SQL Injection (no CVSS, RegistrationMagic – Custom Registration Forms, User Registr…)
- [CVE-2022-0410](https://cve.now/CVE-2022-0410.md): WP Visitor Statistics (Real Time Traffic) \< 5.6 - Subscriber+ SQL Injection (no CVSS, WP Visitor Statistics)
- [CVE-2022-0389](https://cve.now/CVE-2022-0389.md): WP Time Slots Booking Form \< 1.1.63 - Admin+ Stored Cross-Site Scripting (no CVSS, WP Time Slots Booking Form)
- [CVE-2022-0384](https://cve.now/CVE-2022-0384.md): Video Conferencing with Zoom \< 3.8.17 - E-mail Address Disclosure (no CVSS, Video Conferencing with Zoom)
- [CVE-2022-0349](https://cve.now/CVE-2022-0349.md): NotificationX \< 2.3.9 - Unauthenticated Blind SQL Injection (no CVSS, NotificationX – Best FOMO, Social Proof, WooCommerce Sales…)
- [CVE-2022-0347](https://cve.now/CVE-2022-0347.md): LoginPress \< 1.5.12 - Reflected Cross-Site Scripting (no CVSS, LoginPress | Custom Login Page Customizer)
- [CVE-2022-0267](https://cve.now/CVE-2022-0267.md): AdRotate \< 5.8.22 - Admin+ SQL Injection (no CVSS, AdRotate – Ad manager & AdSense Ads)
- [CVE-2022-0205](https://cve.now/CVE-2022-0205.md): YOP Poll \< 6.3.5 - Author+ Stored Cross-Site Scripting (no CVSS, YOP Poll)
- [CVE-2022-0163](https://cve.now/CVE-2022-0163.md): Smart Forms \< 2.6.71 - Subscriber+ Form Data Download (no CVSS, Smart Forms – when you need more than just a contact form)
- [CVE-2021-25098](https://cve.now/CVE-2021-25098.md): Easy Pricing Tables \< 3.1.3 - Arbitrary Post Removal via CSRF (no CVSS, Pricing Tables WordPress Plugin – Easy Pricing Tables)
- [CVE-2021-25087](https://cve.now/CVE-2021-25087.md): Wordpress Download Manager \< 3.2.25 - Sensitive Information Disclosure (no CVSS, Download Manager)
- [CVE-2021-25039](https://cve.now/CVE-2021-25039.md): Multisite Content Copier/Updater \< 2.1.0 - Reflected Cross-Site Scripting (no CVSS, WordPress Multisite Content Copier/Updater)
- [CVE-2021-25038](https://cve.now/CVE-2021-25038.md): Multisite User Sync/Unsync \< 2.1.2 - Reflected Cross-Site Scripting (no CVSS, WordPress Multisite User Sync/Unsync)
- [CVE-2021-25009](https://cve.now/CVE-2021-25009.md): CorreosExpress \<= 2.6.0 - Sensitive Information Disclosure (no CVSS, CorreosExpress – Shipping Management – Tags)
- [CVE-2021-24961](https://cve.now/CVE-2021-24961.md): WordPress File Upload \< 4.16.3 - Contributor+ Stored Cross-Site Scripting via Shortcode (no CVSS, WordPress File Upload · wordpress-file-upload-pro)
- [CVE-2021-24960](https://cve.now/CVE-2021-24960.md): WordPress File Upload \< 4.16.3 - Contributor+ Stored Cross-Site Scripting via Malicious SVG (no CVSS, WordPress File Upload · wordpress-file-upload-pro)
- [CVE-2021-24953](https://cve.now/CVE-2021-24953.md): Advanced iFrame \< 2022 - Reflected Cross-Site Scripting (no CVSS, Advanced iFrame)
- [CVE-2021-24952](https://cve.now/CVE-2021-24952.md): Conversios.io \< 4.6.2 - Subscriber+ SQL Injection (no CVSS, Conversios.io – Google Analytics and Google Shopping plugin…)
- [CVE-2021-24826](https://cve.now/CVE-2021-24826.md): Custom Content Shortcode \< 4.0.2 - Authenticated Stored Cross-Site Scripting (no CVSS, Custom Content Shortcode)
- [CVE-2021-24825](https://cve.now/CVE-2021-24825.md): Custom Content Shortcode \< 4.0.2 - Authenticated Arbitrary File Access / LFI (no CVSS, Custom Content Shortcode)
- [CVE-2021-24824](https://cve.now/CVE-2021-24824.md): Custom Content Shortcode \< 4.0.1 - Unauthorised Arbitrary Post Metadata Access (no CVSS, Custom Content Shortcode)
- [CVE-2021-24821](https://cve.now/CVE-2021-24821.md): Cost Calculator \< 1.6 - Contributor+ Stored Cross-Site Scripting (no CVSS, Cost Calculator)
- [CVE-2021-24810](https://cve.now/CVE-2021-24810.md): WP Event Manager \< 3.1.23 - Admin+ Stored Cross-Site Scripting (no CVSS, WP Event Manager – Easily Build your Calendar of Events!)
- [CVE-2021-24778](https://cve.now/CVE-2021-24778.md): Tradetracker-Store \< 4.6.60 - Admin+ SQL Injection (no CVSS, Tradetracker-Store)
- [CVE-2021-24777](https://cve.now/CVE-2021-24777.md): Hotscot Contact Form \< 1.3 - Admin+ SQL Injection (no CVSS, Hotscot Contact Form)
- [CVE-2021-24216](https://cve.now/CVE-2021-24216.md): All-in-One WP Migration \< 7.41 - Admin+ Arbitrary File Upload to RCE (no CVSS, All-in-One WP Migration)
- [CVE-2022-0766](https://cve.now/CVE-2022-0766.md): Server-Side Request Forgery (SSRF) in janeczku/calibre-web (CVSS 6.5, janeczku/calibre-web · calibreweb)
- [CVE-2022-0767](https://cve.now/CVE-2022-0767.md): Server-Side Request Forgery (SSRF) in janeczku/calibre-web (CVSS 9.1, janeczku/calibre-web · calibreweb)
- [CVE-2022-25108](https://cve.now/CVE-2022-25108.md): Foxit PDF Reader and Editor before 11.2.1 and PhantomPDF before 10.1.7 allow a NULL pointer dereference during PDF parsing because the point (no CVSS)
- [CVE-2021-44032](https://cve.now/CVE-2021-44032.md): TP-Link Omada SDN Software Controller before 5.0.15 does not check if the authentication method specified in a connection request is allowed (no CVSS)
- [CVE-2021-40376](https://cve.now/CVE-2021-40376.md): otris Update Manager 1.2.1.0 allows local users to achieve SYSTEM access via unauthenticated calls to exposed interfaces over a .NET named p (no CVSS)
- [CVE-2021-3733](https://cve.now/CVE-2021-3733.md): There's a flaw in urllib's AbstractBasicAuthHandler class. (no CVSS, python · libpython +1)
- [CVE-2022-0755](https://cve.now/CVE-2022-0755.md): Missing Authorization in salesagility/suitecrm (CVSS 7.1, salesagility/suitecrm)
- [CVE-2022-0756](https://cve.now/CVE-2022-0756.md): Missing Authorization in salesagility/suitecrm (CVSS 5.4, salesagility/suitecrm)
- [CVE-2022-0847](https://cve.now/CVE-2022-0847.md): A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy\_page\_to\_iter\_pipe (CVSS 7.8, KEV, kernel)
- [CVE-2022-0865](https://cve.now/CVE-2022-0865.md): Reachable Assertion in tiffcp in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. (CVSS 5.5, libtiff)
- [CVE-2022-26521](https://cve.now/CVE-2022-26521.md): Abantecart through 1.3.2 allows remote authenticated administrators to execute arbitrary code by uploading an executable file, because the C (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-03-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.