CVEs published March 8, 2022
74 CVEs were published on March 8, 2022: 1 critical, 12 high.
- Published
- 74
- Critical
- 1
- High
- 12
- Medium
- 23
- Low
- 8
- Unrated
- 30
- Now in CISA KEV
- 0
- Fix available
- 51
Most affected products
- Samsung Mobile Devices
- 10
- nextcloud security-advisories
- 4
- icingaweb2
- 3
- Siemens Climatix POL909
- 3
- Siemens RUGGEDCOM i800 · Siemens RUGGEDCOM i800NC +140
- 3
- Siemens SINEC NMS · Siemens SINEMA Server
- 3
- kernel
- 2
- SAP SE SAP Focused Run
- 2
- Siemens Mendix Forgot Password Appstore module
- 2
- Siemens RUGGEDCOM i800 · Siemens RUGGEDCOM i801 +80
- 2
Critical 1
High 12
- CVE-2022-24739Server-Side Request Forgery (SSRF) and URL Redirection to Untrusted Site ('Open Redirect') in alltubeRudloff alltube · rudloff/alltube
- CVE-2022-24713Regular expression denial of service in Rust's regex craterust-lang regex · regex
- CVE-2022-24931Improper access control vulnerability in dynamic receiver in ApkInstaller prior to SMR MAR-2022 Release allows unauthorized attackers to exeSamsung Mobile Devices
- CVE-2022-0877Cross-site Scripting (XSS) - Stored in bookstackapp/bookstackbookstackapp/bookstack · ssddanbrown/bookstack
- CVE-2021-42020A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i802, RUGGEDCOM i802NC,Siemens RUGGEDCOM i800 · Siemens RUGGEDCOM i800NC +124
- CVE-2021-42016A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i801, RUGGEDCOM i802, RUGGEDCOM i803, RUGGEDCOM M2100, RUGGEDCOM M2100F, RUSiemens RUGGEDCOM i800 · Siemens RUGGEDCOM i801 +80
- CVE-2021-43944This issue exists to document that a security improvement in the way that Jira Server and Data Center use templates has been implemented.Atlassian Jira Server · Atlassian Jira Data Center
- CVE-2022-24281A vulnerability has been identified in SINEC NMS (All versions < V1.0.3), SINEMA Server V14 (All versions).Siemens SINEC NMS · Siemens SINEMA Server
- CVE-2022-24282A vulnerability has been identified in SINEC NMS (All versions >= V1.0.3 < V2.0), SINEC NMS (All versions < V1.0.3), SINEMA Server V14 (All Siemens SINEC NMS · Siemens SINEMA Server
- CVE-2022-24715Arbitrary code execution for authenticated users in Icinga Web 2icingaweb2
- CVE-2022-24716Path traversal in Icinga Web 2icingaweb2
- CVE-2022-25311A vulnerability has been identified in SINEC NMS (All versions >= V1.0.3 < V2.0), SINEC NMS (All versions < V1.0.3), SINEMA Server V14 (All Siemens SINEC NMS · Siemens SINEMA Server
Medium, low and unrated 61
- CVE-2021-28488Ericsson Network Manager (ENM) before 21.2 has incorrect access-control behavior (that only affects the level of access available to persons
- CVE-2022-24285Acer Care Center 4.00.30xx before 4.00.3042 contains a local privilege escalation vulnerability.
- CVE-2022-24286Acer QuickAccess 2.01.300x before 2.01.3030 and 3.00.30xx before 3.00.3038 contains a local privilege escalation vulnerability.
- CVE-2022-26337Trend Micro Password Manager (Consumer) installer version 5.0.0.1262 and below is vulnerable to an Uncontrolled Search Path Element vulnerabTrend Micro Password Manager
- CVE-2022-26319An installer search patch element vulnerability in Trend Micro Portable Security 3.0 Pro, 3.0 and 2.0 could allow a local attacker to place Trend Micro Portable Security
- CVE-2022-24714Disclosure of hosts and related data, linked to decommissioned services in Icinga Web 2icingaweb2
- CVE-2021-41241Advanced permissions is not respected for subfolders in Nextcloud servernextcloud security-advisories
- CVE-2021-41239User enumeration setting not respected in Nextcloud servernextcloud security-advisories
- CVE-2021-41181Nextcloud Talk app exposes chat messages on lockscreennextcloud security-advisories
- CVE-2021-41180Geolocation preview links can be set to arbitrary links in nextcloud talknextcloud security-advisories
- CVE-2022-25225Network Olympus version 1.8.0 allows an authenticated admin user to inject SQL queries in '/api/eventinstance' via the 'sqlparameter' JSON pNetwork Olympus
- CVE-2021-3698A flaw was found in Cockpit in versions prior to 260 in the way it handles the certificate verification performed by the System Security Sercockpit
- CVE-2022-0516A vulnerability was found in kvm_s390_guest_sida_op in the arch/s390/kvm/kvm-s390.c function in KVM for s390 in the Linux kernel.kernel
- CVE-2021-4095A NULL pointer dereference was found in the Linux kernel's KVM when dirty ring logging is enabled without an active vCPU context.kernel
- CVE-2021-3981A flaw in grub2 was found where its configuration file, known as grub.cfg, is being created with the wrong permission set allowing non privigrub2
- CVE-2022-25830Information Exposure vulnerability in Galaxy Watch3 Plugin prior to version 2.2.09.22012751 allows attacker to access password information oSamsung Mobile Galaxy Watch3 Plugin
- CVE-2022-25829Information Exposure vulnerability in Watch Active2 Plugin prior to version 2.2.08.22012751 allows attacker to access password information oSamsung Mobile Watch Active2 PlugIn
- CVE-2022-25828Information Exposure vulnerability in Watch Active Plugin prior to version 2.2.07.22012751 allows attacker to access password information ofSamsung Mobile Watch Active PlugIn
- CVE-2022-25827Information Exposure vulnerability in Galaxy Watch Plugin prior to version 2.2.05.22012751 allows attacker to access password information ofSamsung Mobile Galaxy Watch PlugIn
- CVE-2022-25826Information Exposure vulnerability in Galaxy S3 Plugin prior to version 2.2.03.22012751 allows attacker to access password information of coSamsung Mobile Galaxy S3 PlugIn
- CVE-2022-25825Improper access control vulnerability in Samsung Account prior to version 13.1.0.1 allows attackers to access to the authcode for sign-in.Samsung Mobile Samsung Account
- CVE-2022-25824Improper access control vulnerability in BixbyTouch prior to version 2.2.00.6 in China models allows untrusted applications to load arbitrarSamsung Mobile BixbyTouch
- CVE-2022-25823Information Exposure vulnerability in Galaxy Watch Plugin prior to version 2.2.05.220126741 allows attackers to access user information in lSamsung Mobile Galaxy Watch Plugin
- CVE-2022-25822An use after free vulnerability in sdp driver prior to SMR Mar-2022 Release 1 allows kernel crash.Samsung Mobile devices
- CVE-2022-25821Improper use of SMS buffer pointer in Shannon baseband prior to SMR Mar-2022 Release 1 allows OOB read.Samsung Mobile Devices
- CVE-2022-25820A vulnerable design in fingerprint matching algorithm prior to SMR Mar-2022 Release 1 allows physical attackers to perform brute force attacSamsung Mobile Devices
- CVE-2022-25819OOB read vulnerability in hdcp2 device node prior to SMR Mar-2022 Release 1 allow an attacker to view Kernel stack memory.Samsung Mobile Devices with Exynos chipsets
- CVE-2022-25818Improper boundary check in UWB stack prior to SMR Mar-2022 Release 1 allows arbitrary code execution.Samsung Mobile Devices
- CVE-2022-25817Improper authentication in One UI Home prior to SMR Mar-2022 Release 1 allows attacker to generate pinned-shortcut without user consent.Samsung Mobile Devices
- CVE-2022-25816Improper authentication in Samsung Lock and mask apps setting prior to SMR Mar-2022 Release 1 allows attacker to change enable/disable withoSamsung Mobile Devices
- CVE-2022-25815PendingIntent hijacking vulnerability in Weather application prior to SMR Mar-2022 Release 1 allows local attackers to perform unauthorized Samsung Mobile Devices
- CVE-2022-25814PendingIntent hijacking vulnerability in Wearable Manager Installer prior to SMR Mar-2022 Release 1 allows local attackers to perform unauthSamsung Mobile Devices
- CVE-2022-24932Improper Protection of Alternate Path vulnerability in Setup wizard process prior to SMR Mar-2022 Release 1 allows physical attacker packageSamsung Mobile Devices · Samsung Mobile Samsung Clould
- CVE-2022-24930An Improper access control vulnerability in StRetailModeReceiver in Wear OS 3.0 prior to Firmware update MAR-2022 Release allows untrusted aSamsung Mobile Samsung Wearable Devices
- CVE-2022-24929Unprotected Activity in AppLock prior to SMR Mar-2022 Release 1 allows attacker to change the list of locked app without authentication.Samsung Mobile Devices
- CVE-2022-24928Security misconfiguration of RKP in kernel prior to SMR Mar-2022 Release 1 allows a system not to be protected by RKP.Samsung Mobile Devices
- CVE-2022-26104SAP Financial Consolidation - version 10.1, does not perform necessary authorization checks for updating homepage messages, resulting for anSAP SE SAP Financial Consolidation
- CVE-2022-26103Under certain conditions, SAP NetWeaver (Real Time Messaging Framework) - version 7.50, allows an attacker to access information which couldSAP SE SAP NetWeaver
- CVE-2022-26101Fiori launchpad - versions 754, 755, 756, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulneSAP SE Fiori Launchpad
- CVE-2022-22547Simple Diagnostics Agent - versions 1.0 (up to version 1.57.), allows an attacker to access information which would otherwise be restricted SAP SE Simple Diagnostics Agent
- CVE-2022-24399The SAP Focused Run (Real User Monitoring) - versions 200, 300, REST service does not sufficiently sanitize the input name of the file usingSAP SE SAP Focused Run
- CVE-2022-24395SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, reSAP SE SAP NetWeaver Enterprise Portal
- CVE-2022-26100SAPCAR - version 7.22, does not contain sufficient input validation on the SAPCAR archive.SAP SE SAPCAR
- CVE-2022-26102Due to missing authorization check, SAP NetWeaver Application Server for ABAP - versions 700, 701, 702, 731, allows an authenticated attackeSAP SE SAP NetWeaver Application Server for ABAP
- CVE-2022-24396The Simple Diagnostics Agent - versions 1.0 up to version 1.57, does not perform any authentication checks for functionalities that can be aSAP SE SAP Focused Run
- CVE-2022-24398Under certain conditions SAP Business Objects Business Intelligence Platform - versions 420, 430, allows an authenticated attacker to accessSAP SE SAP Business Objects Business Intelligence Platform
- CVE-2022-26317A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.29).Siemens Mendix Applications using Mendix
- CVE-2022-26314A vulnerability has been identified in Mendix Forgot Password Appstore module (All versions >= V3.3.0 < V3.5.1), Mendix Forgot Password AppsSiemens Mendix Forgot Password Appstore module
- CVE-2022-26313A vulnerability has been identified in Mendix Forgot Password Appstore module (All versions >= V3.3.0 < V3.5.1).Siemens Mendix Forgot Password Appstore module
- CVE-2022-24661A vulnerability has been identified in Simcenter STAR-CCM+ Viewer (All versions < V2022.1).Siemens Simcenter STAR-CCM+ Viewer
- CVE-2022-24408A vulnerability has been identified in SINUMERIK MC (All versions < V1.15 SP1), SINUMERIK ONE (All versions < V6.15 SP1).Siemens SINUMERIK MC · Siemens SINUMERIK ONE
- CVE-2022-24309A vulnerability has been identified in Mendix Runtime V7 (All versions < V7.23.29), Mendix Runtime V8 (All versions < V8.18.16), Mendix RuntSiemens Mendix Runtime
- CVE-2021-44478A vulnerability has been identified in Polarion ALM (All versions < V21 R2 P2), Polarion WebClient for SVN (All versions).Siemens Polarion ALM · Siemens Polarion WebClient for SVN
- CVE-2021-42019A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i802, RUGGEDCOM i802NC,Siemens RUGGEDCOM i800 · Siemens RUGGEDCOM i800NC +140
- CVE-2021-42018A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i802, RUGGEDCOM i802NC,Siemens RUGGEDCOM i800 · Siemens RUGGEDCOM i800NC +140
- CVE-2021-42017A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i801, RUGGEDCOM i802, RUGGEDCOM i803, RUGGEDCOM M2100, RUGGEDCOM M2100F, RUSiemens RUGGEDCOM i800 · Siemens RUGGEDCOM i801 +80
- CVE-2021-41543A vulnerability has been identified in Climatix POL909 (AWB module) (All versions < V11.44), Climatix POL909 (AWM module) (All versions < V1Siemens Climatix POL909
- CVE-2021-41542A vulnerability has been identified in Climatix POL909 (AWB module) (All versions < V11.44), Climatix POL909 (AWM module) (All versions < V1Siemens Climatix POL909
- CVE-2021-41541A vulnerability has been identified in Climatix POL909 (AWB module) (All versions < V11.44), Climatix POL909 (AWM module) (All versions < V1Siemens Climatix POL909
- CVE-2021-37209A vulnerability has been identified in RUGGEDCOM i800 (All versions < V4.3.8), RUGGEDCOM i801 (All versions < V4.3.8), RUGGEDCOM i802 (All vSiemens RUGGEDCOM i800 · Siemens RUGGEDCOM i801 +64
- CVE-2022-0856libcaca is affected by a Divide By Zero issue via img2txt, which allows a remote malicious user to cause a Denial of Servicelibcaca