# CVEs published 2022-03-08

74 CVEs were published on March 8, 2022: 1 critical, 12 high. Days are UTC.

- [CVE-2021-28488](https://cve.now/CVE-2021-28488.md): Ericsson Network Manager (ENM) before 21.2 has incorrect access-control behavior (that only affects the level of access available to persons (no CVSS)
- [CVE-2022-24285](https://cve.now/CVE-2022-24285.md): Acer Care Center 4.00.30xx before 4.00.3042 contains a local privilege escalation vulnerability. (no CVSS)
- [CVE-2022-24286](https://cve.now/CVE-2022-24286.md): Acer QuickAccess 2.01.300x before 2.01.3030 and 3.00.30xx before 3.00.3038 contains a local privilege escalation vulnerability. (no CVSS)
- [CVE-2022-26337](https://cve.now/CVE-2022-26337.md): Trend Micro Password Manager (Consumer) installer version 5.0.0.1262 and below is vulnerable to an Uncontrolled Search Path Element vulnerab (no CVSS, Trend Micro Password Manager)
- [CVE-2022-26319](https://cve.now/CVE-2022-26319.md): An installer search patch element vulnerability in Trend Micro Portable Security 3.0 Pro, 3.0 and 2.0 could allow a local attacker to place (no CVSS, Trend Micro Portable Security)
- [CVE-2022-24739](https://cve.now/CVE-2022-24739.md): Server-Side Request Forgery (SSRF) and URL Redirection to Untrusted Site ('Open Redirect') in alltube (CVSS 7.3, Rudloff alltube · rudloff/alltube)
- [CVE-2022-24714](https://cve.now/CVE-2022-24714.md): Disclosure of hosts and related data, linked to decommissioned services in Icinga Web 2 (CVSS 5.3, icingaweb2)
- [CVE-2022-24713](https://cve.now/CVE-2022-24713.md): Regular expression denial of service in Rust's regex crate (CVSS 7.5, rust-lang regex · regex)
- [CVE-2021-41241](https://cve.now/CVE-2021-41241.md): Advanced permissions is not respected for subfolders in Nextcloud server (CVSS 4.3, nextcloud security-advisories)
- [CVE-2021-41239](https://cve.now/CVE-2021-41239.md): User enumeration setting not respected in Nextcloud server (CVSS 5.3, nextcloud security-advisories)
- [CVE-2021-41181](https://cve.now/CVE-2021-41181.md): Nextcloud Talk app exposes chat messages on lockscreen (CVSS 2.4, nextcloud security-advisories)
- [CVE-2021-41180](https://cve.now/CVE-2021-41180.md): Geolocation preview links can be set to arbitrary links in nextcloud talk (CVSS 4.7, nextcloud security-advisories)
- [CVE-2022-25225](https://cve.now/CVE-2022-25225.md): Network Olympus version 1.8.0 allows an authenticated admin user to inject SQL queries in '/api/eventinstance' via the 'sqlparameter' JSON p (no CVSS, Network Olympus)
- [CVE-2021-3698](https://cve.now/CVE-2021-3698.md): A flaw was found in Cockpit in versions prior to 260 in the way it handles the certificate verification performed by the System Security Ser (no CVSS, cockpit)
- [CVE-2022-0516](https://cve.now/CVE-2022-0516.md): A vulnerability was found in kvm\_s390\_guest\_sida\_op in the arch/s390/kvm/kvm-s390.c function in KVM for s390 in the Linux kernel. (no CVSS, kernel)
- [CVE-2021-4095](https://cve.now/CVE-2021-4095.md): A NULL pointer dereference was found in the Linux kernel's KVM when dirty ring logging is enabled without an active vCPU context. (no CVSS, kernel)
- [CVE-2021-3981](https://cve.now/CVE-2021-3981.md): A flaw in grub2 was found where its configuration file, known as grub.cfg, is being created with the wrong permission set allowing non privi (no CVSS, grub2)
- [CVE-2022-25830](https://cve.now/CVE-2022-25830.md): Information Exposure vulnerability in Galaxy Watch3 Plugin prior to version 2.2.09.22012751 allows attacker to access password information o (CVSS 1.9, Samsung Mobile Galaxy Watch3 Plugin)
- [CVE-2022-25829](https://cve.now/CVE-2022-25829.md): Information Exposure vulnerability in Watch Active2 Plugin prior to version 2.2.08.22012751 allows attacker to access password information o (CVSS 1.9, Samsung Mobile Watch Active2 PlugIn)
- [CVE-2022-25828](https://cve.now/CVE-2022-25828.md): Information Exposure vulnerability in Watch Active Plugin prior to version 2.2.07.22012751 allows attacker to access password information of (CVSS 1.9, Samsung Mobile Watch Active PlugIn)
- [CVE-2022-25827](https://cve.now/CVE-2022-25827.md): Information Exposure vulnerability in Galaxy Watch Plugin prior to version 2.2.05.22012751 allows attacker to access password information of (CVSS 1.9, Samsung Mobile Galaxy Watch PlugIn)
- [CVE-2022-25826](https://cve.now/CVE-2022-25826.md): Information Exposure vulnerability in Galaxy S3 Plugin prior to version 2.2.03.22012751 allows attacker to access password information of co (CVSS 1.9, Samsung Mobile Galaxy S3 PlugIn)
- [CVE-2022-25825](https://cve.now/CVE-2022-25825.md): Improper access control vulnerability in Samsung Account prior to version 13.1.0.1 allows attackers to access to the authcode for sign-in. (CVSS 6.2, Samsung Mobile Samsung Account)
- [CVE-2022-25824](https://cve.now/CVE-2022-25824.md): Improper access control vulnerability in BixbyTouch prior to version 2.2.00.6 in China models allows untrusted applications to load arbitrar (CVSS 4.0, Samsung Mobile BixbyTouch)
- [CVE-2022-25823](https://cve.now/CVE-2022-25823.md): Information Exposure vulnerability in Galaxy Watch Plugin prior to version 2.2.05.220126741 allows attackers to access user information in l (CVSS 1.9, Samsung Mobile Galaxy Watch Plugin)
- [CVE-2022-25822](https://cve.now/CVE-2022-25822.md): An use after free vulnerability in sdp driver prior to SMR Mar-2022 Release 1 allows kernel crash. (CVSS 4.0, Samsung Mobile devices)
- [CVE-2022-25821](https://cve.now/CVE-2022-25821.md): Improper use of SMS buffer pointer in Shannon baseband prior to SMR Mar-2022 Release 1 allows OOB read. (CVSS 3.3, Samsung Mobile Devices)
- [CVE-2022-25820](https://cve.now/CVE-2022-25820.md): A vulnerable design in fingerprint matching algorithm prior to SMR Mar-2022 Release 1 allows physical attackers to perform brute force attac (CVSS 4.2, Samsung Mobile Devices)
- [CVE-2022-25819](https://cve.now/CVE-2022-25819.md): OOB read vulnerability in hdcp2 device node prior to SMR Mar-2022 Release 1 allow an attacker to view Kernel stack memory. (CVSS 5.3, Samsung Mobile Devices with Exynos chipsets)
- [CVE-2022-25818](https://cve.now/CVE-2022-25818.md): Improper boundary check in UWB stack prior to SMR Mar-2022 Release 1 allows arbitrary code execution. (CVSS 6.5, Samsung Mobile Devices)
- [CVE-2022-25817](https://cve.now/CVE-2022-25817.md): Improper authentication in One UI Home prior to SMR Mar-2022 Release 1 allows attacker to generate pinned-shortcut without user consent. (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2022-25816](https://cve.now/CVE-2022-25816.md): Improper authentication in Samsung Lock and mask apps setting prior to SMR Mar-2022 Release 1 allows attacker to change enable/disable witho (CVSS 4.1, Samsung Mobile Devices)
- [CVE-2022-25815](https://cve.now/CVE-2022-25815.md): PendingIntent hijacking vulnerability in Weather application prior to SMR Mar-2022 Release 1 allows local attackers to perform unauthorized (CVSS 5.5, Samsung Mobile Devices)
- [CVE-2022-25814](https://cve.now/CVE-2022-25814.md): PendingIntent hijacking vulnerability in Wearable Manager Installer prior to SMR Mar-2022 Release 1 allows local attackers to perform unauth (CVSS 5.5, Samsung Mobile Devices)
- [CVE-2022-24932](https://cve.now/CVE-2022-24932.md): Improper Protection of Alternate Path vulnerability in Setup wizard process prior to SMR Mar-2022 Release 1 allows physical attacker package (CVSS 4.2, Samsung Mobile Devices · Samsung Mobile Samsung Clould)
- [CVE-2022-24931](https://cve.now/CVE-2022-24931.md): Improper access control vulnerability in dynamic receiver in ApkInstaller prior to SMR MAR-2022 Release allows unauthorized attackers to exe (CVSS 7.9, Samsung Mobile Devices)
- [CVE-2022-24930](https://cve.now/CVE-2022-24930.md): An Improper access control vulnerability in StRetailModeReceiver in Wear OS 3.0 prior to Firmware update MAR-2022 Release allows untrusted a (CVSS 4.4, Samsung Mobile Samsung Wearable Devices)
- [CVE-2022-24929](https://cve.now/CVE-2022-24929.md): Unprotected Activity in AppLock prior to SMR Mar-2022 Release 1 allows attacker to change the list of locked app without authentication. (CVSS 4.1, Samsung Mobile Devices)
- [CVE-2022-24928](https://cve.now/CVE-2022-24928.md): Security misconfiguration of RKP in kernel prior to SMR Mar-2022 Release 1 allows a system not to be protected by RKP. (CVSS 5.9, Samsung Mobile Devices)
- [CVE-2022-26104](https://cve.now/CVE-2022-26104.md): SAP Financial Consolidation - version 10.1, does not perform necessary authorization checks for updating homepage messages, resulting for an (no CVSS, SAP SE SAP Financial Consolidation)
- [CVE-2022-26103](https://cve.now/CVE-2022-26103.md): Under certain conditions, SAP NetWeaver (Real Time Messaging Framework) - version 7.50, allows an attacker to access information which could (no CVSS, SAP SE SAP NetWeaver)
- [CVE-2022-26101](https://cve.now/CVE-2022-26101.md): Fiori launchpad - versions 754, 755, 756, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulne (no CVSS, SAP SE Fiori Launchpad)
- [CVE-2022-22547](https://cve.now/CVE-2022-22547.md): Simple Diagnostics Agent - versions 1.0 (up to version 1.57.), allows an attacker to access information which would otherwise be restricted (no CVSS, SAP SE Simple Diagnostics Agent)
- [CVE-2022-24399](https://cve.now/CVE-2022-24399.md): The SAP Focused Run (Real User Monitoring) - versions 200, 300, REST service does not sufficiently sanitize the input name of the file using (no CVSS, SAP SE SAP Focused Run)
- [CVE-2022-24395](https://cve.now/CVE-2022-24395.md): SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, re (no CVSS, SAP SE SAP NetWeaver Enterprise Portal)
- [CVE-2022-26100](https://cve.now/CVE-2022-26100.md): SAPCAR - version 7.22, does not contain sufficient input validation on the SAPCAR archive. (no CVSS, SAP SE SAPCAR)
- [CVE-2022-26102](https://cve.now/CVE-2022-26102.md): Due to missing authorization check, SAP NetWeaver Application Server for ABAP - versions 700, 701, 702, 731, allows an authenticated attacke (no CVSS, SAP SE SAP NetWeaver Application Server for ABAP)
- [CVE-2022-24396](https://cve.now/CVE-2022-24396.md): The Simple Diagnostics Agent - versions 1.0 up to version 1.57, does not perform any authentication checks for functionalities that can be a (no CVSS, SAP SE SAP Focused Run)
- [CVE-2022-24398](https://cve.now/CVE-2022-24398.md): Under certain conditions SAP Business Objects Business Intelligence Platform - versions 420, 430, allows an authenticated attacker to access (no CVSS, SAP SE SAP Business Objects Business Intelligence Platform)
- [CVE-2022-0877](https://cve.now/CVE-2022-0877.md): Cross-site Scripting (XSS) - Stored in bookstackapp/bookstack (CVSS 7.6, bookstackapp/bookstack · ssddanbrown/bookstack)
- [CVE-2022-26317](https://cve.now/CVE-2022-26317.md): A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions \< V7.23.29). (no CVSS, Siemens Mendix Applications using Mendix)
- [CVE-2022-26314](https://cve.now/CVE-2022-26314.md): A vulnerability has been identified in Mendix Forgot Password Appstore module (All versions \>= V3.3.0 \< V3.5.1), Mendix Forgot Password Apps (no CVSS, Siemens Mendix Forgot Password Appstore module)
- [CVE-2022-26313](https://cve.now/CVE-2022-26313.md): A vulnerability has been identified in Mendix Forgot Password Appstore module (All versions \>= V3.3.0 \< V3.5.1). (no CVSS, Siemens Mendix Forgot Password Appstore module)
- [CVE-2022-24661](https://cve.now/CVE-2022-24661.md): A vulnerability has been identified in Simcenter STAR-CCM+ Viewer (All versions \< V2022.1). (no CVSS, Siemens Simcenter STAR-CCM+ Viewer)
- [CVE-2022-24408](https://cve.now/CVE-2022-24408.md): A vulnerability has been identified in SINUMERIK MC (All versions \< V1.15 SP1), SINUMERIK ONE (All versions \< V6.15 SP1). (no CVSS, Siemens SINUMERIK MC · Siemens SINUMERIK ONE)
- [CVE-2022-24309](https://cve.now/CVE-2022-24309.md): A vulnerability has been identified in Mendix Runtime V7 (All versions \< V7.23.29), Mendix Runtime V8 (All versions \< V8.18.16), Mendix Runt (CVSS 6.8, Siemens Mendix Runtime)
- [CVE-2021-44478](https://cve.now/CVE-2021-44478.md): A vulnerability has been identified in Polarion ALM (All versions \< V21 R2 P2), Polarion WebClient for SVN (All versions). (no CVSS, Siemens Polarion ALM · Siemens Polarion WebClient for SVN)
- [CVE-2021-42020](https://cve.now/CVE-2021-42020.md): A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i802, RUGGEDCOM i802NC, (CVSS 7.5, Siemens RUGGEDCOM i800 · Siemens RUGGEDCOM i800NC +124)
- [CVE-2021-42019](https://cve.now/CVE-2021-42019.md): A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i802, RUGGEDCOM i802NC, (CVSS 5.9, Siemens RUGGEDCOM i800 · Siemens RUGGEDCOM i800NC +140)
- [CVE-2021-42018](https://cve.now/CVE-2021-42018.md): A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i802, RUGGEDCOM i802NC, (CVSS 5.9, Siemens RUGGEDCOM i800 · Siemens RUGGEDCOM i800NC +140)
- [CVE-2021-42017](https://cve.now/CVE-2021-42017.md): A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i801, RUGGEDCOM i802, RUGGEDCOM i803, RUGGEDCOM M2100, RUGGEDCOM M2100F, RU (CVSS 5.9, Siemens RUGGEDCOM i800 · Siemens RUGGEDCOM i801 +80)
- [CVE-2021-42016](https://cve.now/CVE-2021-42016.md): A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i801, RUGGEDCOM i802, RUGGEDCOM i803, RUGGEDCOM M2100, RUGGEDCOM M2100F, RU (CVSS 7.5, Siemens RUGGEDCOM i800 · Siemens RUGGEDCOM i801 +80)
- [CVE-2021-41543](https://cve.now/CVE-2021-41543.md): A vulnerability has been identified in Climatix POL909 (AWB module) (All versions \< V11.44), Climatix POL909 (AWM module) (All versions \< V1 (no CVSS, Siemens Climatix POL909)
- [CVE-2021-41542](https://cve.now/CVE-2021-41542.md): A vulnerability has been identified in Climatix POL909 (AWB module) (All versions \< V11.44), Climatix POL909 (AWM module) (All versions \< V1 (no CVSS, Siemens Climatix POL909)
- [CVE-2021-41541](https://cve.now/CVE-2021-41541.md): A vulnerability has been identified in Climatix POL909 (AWB module) (All versions \< V11.44), Climatix POL909 (AWM module) (All versions \< V1 (no CVSS, Siemens Climatix POL909)
- [CVE-2021-37208](https://cve.now/CVE-2021-37208.md): A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i802, RUGGEDCOM i802NC, (CVSS 9.6, Siemens RUGGEDCOM i800 · Siemens RUGGEDCOM i800NC +140)
- [CVE-2021-43944](https://cve.now/CVE-2021-43944.md): This issue exists to document that a security improvement in the way that Jira Server and Data Center use templates has been implemented. (CVSS 7.2, Atlassian Jira Server · Atlassian Jira Data Center)
- [CVE-2021-37209](https://cve.now/CVE-2021-37209.md): A vulnerability has been identified in RUGGEDCOM i800 (All versions \< V4.3.8), RUGGEDCOM i801 (All versions \< V4.3.8), RUGGEDCOM i802 (All v (CVSS 6.7, Siemens RUGGEDCOM i800 · Siemens RUGGEDCOM i801 +64)
- [CVE-2022-0856](https://cve.now/CVE-2022-0856.md): libcaca is affected by a Divide By Zero issue via img2txt, which allows a remote malicious user to cause a Denial of Service (no CVSS, libcaca)
- [CVE-2022-24281](https://cve.now/CVE-2022-24281.md): A vulnerability has been identified in SINEC NMS (All versions \< V1.0.3), SINEMA Server V14 (All versions). (CVSS 7.2, Siemens SINEC NMS · Siemens SINEMA Server)
- [CVE-2022-24282](https://cve.now/CVE-2022-24282.md): A vulnerability has been identified in SINEC NMS (All versions \>= V1.0.3 \< V2.0), SINEC NMS (All versions \< V1.0.3), SINEMA Server V14 (All (CVSS 7.2, Siemens SINEC NMS · Siemens SINEMA Server)
- [CVE-2022-24715](https://cve.now/CVE-2022-24715.md): Arbitrary code execution for authenticated users in Icinga Web 2 (CVSS 8.5, icingaweb2)
- [CVE-2022-24716](https://cve.now/CVE-2022-24716.md): Path traversal in Icinga Web 2 (CVSS 7.5, icingaweb2)
- [CVE-2022-25311](https://cve.now/CVE-2022-25311.md): A vulnerability has been identified in SINEC NMS (All versions \>= V1.0.3 \< V2.0), SINEC NMS (All versions \< V1.0.3), SINEMA Server V14 (All (CVSS 7.3, Siemens SINEC NMS · Siemens SINEMA Server)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-03-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.