# CVEs published 2022-03-09

182 CVEs were published on March 9, 2022: 6 critical, 61 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2022-24323](https://cve.now/CVE-2022-24323.md): A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause a disruption of communication between (CVSS 5.3, Schneider Electric EcoStruxure Process Expert · Schneider E…)
- [CVE-2022-24322](https://cve.now/CVE-2022-24322.md): A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause a disruption of com (CVSS 5.3, Schneider Electric EcoStruxure Control Expert)
- [CVE-2021-22783](https://cve.now/CVE-2021-22783.md): A CWE-200: Information Exposure vulnerability exists which could allow a session hijack when the door panel is communicating with the door. (CVSS 8.8, Schneider Electric Ritto Wiser Door)
- [CVE-2022-24753](https://cve.now/CVE-2022-24753.md): Code injection in Stripe CLI on windows (CVSS 7.7, stripe-cli · github.com/stripe/stripe-cli)
- [CVE-2022-24744](https://cve.now/CVE-2022-24744.md): Insufficient Session Expiration in shopware (CVSS 2.6, shopware platform · shopware/platform +1)
- [CVE-2022-24745](https://cve.now/CVE-2022-24745.md): Guest session is shared between customers in shopware (CVSS 4.8, shopware platform · shopware/platform +1)
- [CVE-2022-24746](https://cve.now/CVE-2022-24746.md): HTML injection possibility in voucher code form (CVSS 6.1, shopware platform · shopware/platform +2)
- [CVE-2022-24747](https://cve.now/CVE-2022-24747.md): HTTP caching is marking private HTTP headers as public (CVSS 6.3, shopware platform · shopware/platform +2)
- [CVE-2022-24748](https://cve.now/CVE-2022-24748.md): Incorrect Authentication in shopware (CVSS 6.8, shopware platform · shopware/core)
- [CVE-2021-44632](https://cve.now/CVE-2021-44632.md): A Buffer Overflow vulnerability exists in TP-LINK WR-886N 20190826 2.3.8 in the /cloud\_config/router\_post/upgrade\_info feature, which allows (no CVSS)
- [CVE-2021-44631](https://cve.now/CVE-2021-44631.md): A Buffer Overflow vulnerability exists in TP-LINK WR-886N 20190826 2.3.8 in the /cloud\_config/router\_post/reset\_cloud\_pwd feature, which all (no CVSS)
- [CVE-2021-44630](https://cve.now/CVE-2021-44630.md): A Buffer Overflow vulnerability exists in TP-LINK WR-886N 20190826 2.3.8 in the /cloud\_config/router\_post/modify\_account\_pwd feature, which (no CVSS)
- [CVE-2021-44629](https://cve.now/CVE-2021-44629.md): A Buffer Overflow vulnerabilitiy exists in TP-LINK WR-886N 20190826 2.3.8 in the /cloud\_config/router\_post/register feature, which allows ma (no CVSS)
- [CVE-2021-44628](https://cve.now/CVE-2021-44628.md): A Buffer Overflow vulnerabiltiy exists in TP-LINK WR-886N 20190826 2.3.8 in thee /cloud\_config/router\_post/login feature, which allows malic (no CVSS)
- [CVE-2021-44627](https://cve.now/CVE-2021-44627.md): A Buffer Overflow vulnerability exists in TP-LINK WR-886N 20190826 2.3.8 in the /cloud\_config/router\_post/get\_reset\_pwd\_veirfy\_code feature, (no CVSS)
- [CVE-2021-44626](https://cve.now/CVE-2021-44626.md): A Buffer Overflow vulnerability exists in TP-LINK WR-886N 20190826 2.3.8 in the /cloud\_config/router\_post/get\_reg\_verify\_code feature, which (no CVSS)
- [CVE-2021-44625](https://cve.now/CVE-2021-44625.md): A Buffer Overflow vulnerability exists in TP-LINK WR-886N 20190826 2.3.8 in /cloud\_config/cloud\_device/info interface, which allows a malici (no CVSS)
- [CVE-2022-24741](https://cve.now/CVE-2022-24741.md): High memory usage in Nextcloud server (CVSS 3.5, nextcloud security-advisories)
- [CVE-2022-24734](https://cve.now/CVE-2022-24734.md): Remote code execution in mybb (CVSS 7.2, mybb)
- [CVE-2021-44623](https://cve.now/CVE-2021-44623.md): A Buffer Overflow vulnerability exists in TP-LINK WR-886N 20190826 2.3.8 via the /cloud\_config/router\_post/check\_reset\_pwd\_verify\_code inter (no CVSS)
- [CVE-2021-44622](https://cve.now/CVE-2021-44622.md): A Buffer Overflow vulnerability exists in TP-LINK WR-886N 20190826 2.3.8 in the /cloud\_config/router\_post/check\_reg\_verify\_code function whi (no CVSS)
- [CVE-2021-32025](https://cve.now/CVE-2021-32025.md): An elevation of privilege vulnerability in the QNX Neutrino Kernel of affected versions of QNX Software Development Platform version(s) 6.4. (CVSS 8.1, BlackBerry QNX Software Development Platform (SDP), QNX OS…)
- [CVE-2022-0618](https://cve.now/CVE-2022-0618.md): A program using swift-nio-http2 is vulnerable to a denial of service attack, caused by a network peer sending a specially crafted HTTP/2 fra (no CVSS, Swift Project SwiftNIO HTTP2)
- [CVE-2022-24732](https://cve.now/CVE-2022-24732.md): Maddy Mail Server does not implement account expiry (CVSS 6.3, foxcpp maddy · github.com/foxcpp/maddy)
- [CVE-2022-22511](https://cve.now/CVE-2022-22511.md): WAGO PLCs WBM vulnerable to reflected XSS (CVSS 5.4, WAGO Compact Controller CC100 · WAGO Edge Controller +5)
- [CVE-2022-24919](https://cve.now/CVE-2022-24919.md): Reflected XSS in graph configuration window of Zabbix Frontend (CVSS 3.7, Zabbix Frontend)
- [CVE-2022-24918](https://cve.now/CVE-2022-24918.md): Reflected XSS in item configuration window of Zabbix Frontend (CVSS 3.7, Zabbix Frontend)
- [CVE-2022-24917](https://cve.now/CVE-2022-24917.md): Reflected XSS in service configuration window of Zabbix Frontend (CVSS 3.7, Zabbix Frontend)
- [CVE-2022-24349](https://cve.now/CVE-2022-24349.md): Reflected XSS in action configuration window of Zabbix Frontend (CVSS 4.6, Zabbix Frontend)
- [CVE-2022-22806](https://cve.now/CVE-2022-22806.md): A CWE-294: Authentication Bypass by Capture-replay vulnerability exists that could cause an unauthenticated connection to the UPS when a mal (no CVSS, Schneider Electric SmartConnect)
- [CVE-2022-22805](https://cve.now/CVE-2022-22805.md): A CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability exists that could cause remote code executio (no CVSS, Schneider Electric SmartConnect)
- [CVE-2022-0715](https://cve.now/CVE-2022-0715.md): A CWE-287: Improper Authentication vulnerability exists that could cause an attacker to arbitrarily change the behavior of the UPS when a ke (CVSS 8.9, Schneider Electric APC Smart-UPS · Schneider Electric Smart…)
- [CVE-2022-24995](https://cve.now/CVE-2022-24995.md): Tenda AX3 v16.03.12.10\_CN was discovered to contain a stack overflow in the function fromSetSysTime. (no CVSS)
- [CVE-2021-46408](https://cve.now/CVE-2021-46408.md): Tenda AX12 v22.03.01.21 was discovered to contain a stack buffer overflow in the function sub\_422CE4. (no CVSS)
- [CVE-2022-25566](https://cve.now/CVE-2022-25566.md): Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow in the function saveParentControlInfo. (no CVSS)
- [CVE-2022-25560](https://cve.now/CVE-2022-25560.md): Tenda AX12 v22.03.01.21 was discovered to contain a stack overflow in the function sub\_4327CC. (no CVSS)
- [CVE-2022-25561](https://cve.now/CVE-2022-25561.md): Tenda AX12 v22.03.01.21 was discovered to contain a stack overflow in the function sub\_42DE00. (no CVSS)
- [CVE-2022-25557](https://cve.now/CVE-2022-25557.md): Tenda AX1806 v1.0.0.1 was discovered to contain a heap overflow in the function saveParentControlInfo. (no CVSS)
- [CVE-2022-25558](https://cve.now/CVE-2022-25558.md): Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow in the function formSetProvince. (no CVSS)
- [CVE-2022-25556](https://cve.now/CVE-2022-25556.md): Tenda AX12 v22.03.01.21 was discovered to contain a stack overflow in the function sub\_42E328. (no CVSS)
- [CVE-2022-25555](https://cve.now/CVE-2022-25555.md): Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow in the function fromSetSysTime. (no CVSS)
- [CVE-2022-25547](https://cve.now/CVE-2022-25547.md): Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow in the function fromSetSysTime. (no CVSS)
- [CVE-2022-25553](https://cve.now/CVE-2022-25553.md): Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow in the function formSetSysToolDDNS. (no CVSS)
- [CVE-2022-25554](https://cve.now/CVE-2022-25554.md): Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow in the function saveParentControlInfo. (no CVSS)
- [CVE-2022-25551](https://cve.now/CVE-2022-25551.md): Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow in the function formSetSysToolDDNS. (no CVSS)
- [CVE-2022-25552](https://cve.now/CVE-2022-25552.md): Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow in the function form\_fast\_setting\_wifi\_set. (no CVSS)
- [CVE-2022-25549](https://cve.now/CVE-2022-25549.md): Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow in the function formSetSysToolDDNS. (no CVSS)
- [CVE-2022-25550](https://cve.now/CVE-2022-25550.md): Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow in the function saveParentControlInfo. (no CVSS)
- [CVE-2022-25548](https://cve.now/CVE-2022-25548.md): Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow in the function fromSetSysTime. (no CVSS)
- [CVE-2022-25546](https://cve.now/CVE-2022-25546.md): Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow in the function formSetSysToolDDNS. (no CVSS)
- [CVE-2022-25368](https://cve.now/CVE-2022-25368.md): Spectre BHB is a variant of Spectre-v2 in which malicious code uses the shared branch history (stored in the CPU BHB) to influence mispredic (no CVSS)
- [CVE-2022-0022](https://cve.now/CVE-2022-0022.md): PAN-OS: Use of a Weak Cryptographic Algorithm for Stored Password Hashes (CVSS 4.1, Palo Alto Networks PAN-OS · Palo Alto Networks Prisma Access)
- [CVE-2022-24526](https://cve.now/CVE-2022-24526.md): Visual Studio Code Spoofing Vulnerability (CVSS 6.1, Microsoft Visual Studio Code)
- [CVE-2022-24525](https://cve.now/CVE-2022-24525.md): Windows Update Stack Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2022-24522](https://cve.now/CVE-2022-24522.md): Skype Extension for Chrome Information Disclosure Vulnerability (CVSS 6.5, Microsoft Skype Extension for Chrome)
- [CVE-2022-24520](https://cve.now/CVE-2022-24520.md): Azure Site Recovery Remote Code Execution Vulnerability (CVSS 7.2, Microsoft Azure Site Recovery VMWare to Azure)
- [CVE-2022-24519](https://cve.now/CVE-2022-24519.md): Azure Site Recovery Elevation of Privilege Vulnerability (CVSS 6.5, Microsoft Azure Site Recovery VMWare to Azure)
- [CVE-2022-24518](https://cve.now/CVE-2022-24518.md): Azure Site Recovery Elevation of Privilege Vulnerability (CVSS 6.5, Microsoft Azure Site Recovery VMWare to Azure)
- [CVE-2022-24517](https://cve.now/CVE-2022-24517.md): Azure Site Recovery Remote Code Execution Vulnerability (CVSS 7.2, Microsoft Azure Site Recovery VMWare to Azure)
- [CVE-2022-24515](https://cve.now/CVE-2022-24515.md): Azure Site Recovery Elevation of Privilege Vulnerability (CVSS 6.5, Microsoft Azure Site Recovery VMWare to Azure)
- [CVE-2022-24512](https://cve.now/CVE-2022-24512.md): .NET and Visual Studio Remote Code Execution Vulnerability (CVSS 6.3, Microsoft Visual Studio · Microsoft .NET +116)
- [CVE-2022-24511](https://cve.now/CVE-2022-24511.md): Microsoft Office Word Tampering Vulnerability (CVSS 5.5, Microsoft Office · Microsoft 365 Apps for Enterprise +1)
- [CVE-2022-24510](https://cve.now/CVE-2022-24510.md): Microsoft Office Visio Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office · Microsoft 365 Apps for Enterprise)
- [CVE-2022-24509](https://cve.now/CVE-2022-24509.md): Microsoft Office Visio Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office · Microsoft 365 Apps for Enterprise)
- [CVE-2022-24508](https://cve.now/CVE-2022-24508.md): Win32 File Enumeration Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2022-24507](https://cve.now/CVE-2022-24507.md): Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-24506](https://cve.now/CVE-2022-24506.md): Azure Site Recovery Elevation of Privilege Vulnerability (CVSS 6.5, Microsoft Azure Site Recovery VMWare to Azure)
- [CVE-2022-24505](https://cve.now/CVE-2022-24505.md): Windows ALPC Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2022-24503](https://cve.now/CVE-2022-24503.md): Remote Desktop Protocol Client Information Disclosure Vulnerability (CVSS 5.4, Microsoft Windows · Microsoft Remote Desktop client for Win…)
- [CVE-2022-24502](https://cve.now/CVE-2022-24502.md): Windows HTML Platforms Security Feature Bypass Vulnerability (CVSS 4.3, Microsoft Windows)
- [CVE-2022-24501](https://cve.now/CVE-2022-24501.md): VP9 Video Extensions Remote Code Execution Vulnerability (CVSS 7.8, Microsoft VP9 Video Extensions)
- [CVE-2022-24471](https://cve.now/CVE-2022-24471.md): Azure Site Recovery Remote Code Execution Vulnerability (CVSS 7.2, Microsoft Azure Site Recovery VMWare to Azure)
- [CVE-2022-24470](https://cve.now/CVE-2022-24470.md): Azure Site Recovery Remote Code Execution Vulnerability (CVSS 7.2, Microsoft Azure Site Recovery VMWare to Azure)
- [CVE-2022-24469](https://cve.now/CVE-2022-24469.md): Azure Site Recovery Elevation of Privilege Vulnerability (CVSS 8.1, Microsoft Azure Site Recovery VMWare to Azure)
- [CVE-2022-24468](https://cve.now/CVE-2022-24468.md): Azure Site Recovery Remote Code Execution Vulnerability (CVSS 7.2, Microsoft Azure Site Recovery VMWare to Azure)
- [CVE-2022-24467](https://cve.now/CVE-2022-24467.md): Azure Site Recovery Remote Code Execution Vulnerability (CVSS 7.2, Microsoft Azure Site Recovery VMWare to Azure)
- [CVE-2022-24465](https://cve.now/CVE-2022-24465.md): Microsoft Intune Portal for iOS Security Feature Bypass Vulnerability (CVSS 3.3, Microsoft Intune Company Portal for iOS)
- [CVE-2022-24464](https://cve.now/CVE-2022-24464.md): .NET and Visual Studio Denial of Service Vulnerability (CVSS 7.5, Microsoft .NET · Microsoft Visual Studio +12)
- [CVE-2022-24463](https://cve.now/CVE-2022-24463.md): Microsoft Exchange Server Spoofing Vulnerability (CVSS 6.5, Microsoft Exchange Server 2016 Cumulative Update · Microsof…)
- [CVE-2022-24462](https://cve.now/CVE-2022-24462.md): Microsoft Word Security Feature Bypass Vulnerability (CVSS 5.5, Microsoft Office · Microsoft 365 Apps for Enterprise)
- [CVE-2022-24461](https://cve.now/CVE-2022-24461.md): Microsoft Office Visio Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office · Microsoft 365 Apps for Enterprise)
- [CVE-2022-24460](https://cve.now/CVE-2022-24460.md): Tablet Windows User Interface Application Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2022-24459](https://cve.now/CVE-2022-24459.md): Windows Fax and Scan Service Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-24457](https://cve.now/CVE-2022-24457.md): HEIF Image Extensions Remote Code Execution Vulnerability (CVSS 7.8, Microsoft HEIF Image Extension)
- [CVE-2022-24456](https://cve.now/CVE-2022-24456.md): HEVC Video Extensions Remote Code Execution Vulnerability (CVSS 7.8, Microsoft HEVC Video Extension · Microsoft HEVC Video Exten…)
- [CVE-2022-24455](https://cve.now/CVE-2022-24455.md): Windows CD-ROM Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-24454](https://cve.now/CVE-2022-24454.md): Windows Security Support Provider Interface Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-24453](https://cve.now/CVE-2022-24453.md): HEVC Video Extensions Remote Code Execution Vulnerability (CVSS 7.8, Microsoft HEVC Video Extension · Microsoft HEVC Video Exten…)
- [CVE-2022-24452](https://cve.now/CVE-2022-24452.md): HEVC Video Extensions Remote Code Execution Vulnerability (CVSS 7.8, Microsoft HEVC Video Extension · Microsoft HEVC Video Exten…)
- [CVE-2022-24451](https://cve.now/CVE-2022-24451.md): VP9 Video Extensions Remote Code Execution Vulnerability (CVSS 7.8, Microsoft VP9 Video Extensions)
- [CVE-2022-23301](https://cve.now/CVE-2022-23301.md): HEVC Video Extensions Remote Code Execution Vulnerability (CVSS 7.8, Microsoft HEVC Video Extension · Microsoft HEVC Video Exten…)
- [CVE-2022-23300](https://cve.now/CVE-2022-23300.md): Raw Image Extension Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Raw Image Extension)
- [CVE-2022-23299](https://cve.now/CVE-2022-23299.md): Windows PDEV Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-23298](https://cve.now/CVE-2022-23298.md): Windows NT OS Kernel Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2022-23297](https://cve.now/CVE-2022-23297.md): Windows NT Lan Manager Datagram Receiver Driver Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2022-23296](https://cve.now/CVE-2022-23296.md): Windows Installer Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-23295](https://cve.now/CVE-2022-23295.md): Raw Image Extension Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Raw Image Extension)
- [CVE-2022-23294](https://cve.now/CVE-2022-23294.md): Windows Event Tracing Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2022-23293](https://cve.now/CVE-2022-23293.md): Windows Fast FAT File System Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-23291](https://cve.now/CVE-2022-23291.md): Windows DWM Core Library Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-23290](https://cve.now/CVE-2022-23290.md): Windows Inking COM Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-23288](https://cve.now/CVE-2022-23288.md): Windows DWM Core Library Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2022-23287](https://cve.now/CVE-2022-23287.md): Windows ALPC Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2022-23286](https://cve.now/CVE-2022-23286.md): Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2022-23285](https://cve.now/CVE-2022-23285.md): Remote Desktop Client Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2022-23284](https://cve.now/CVE-2022-23284.md): Windows Print Spooler Elevation of Privilege Vulnerability (CVSS 7.2, Microsoft Windows)
- [CVE-2022-23283](https://cve.now/CVE-2022-23283.md): Windows ALPC Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2022-23282](https://cve.now/CVE-2022-23282.md): Paint 3D Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Paint)
- [CVE-2022-23281](https://cve.now/CVE-2022-23281.md): Windows Common Log File System Driver Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2022-23278](https://cve.now/CVE-2022-23278.md): Microsoft Defender for Endpoint Spoofing Vulnerability (CVSS 5.9, Microsoft Defender for Endpoint for Linux · Microsoft De… +4)
- [CVE-2022-23277](https://cve.now/CVE-2022-23277.md): Microsoft Exchange Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Exchange Server 2013 Cumulative Update · Micro… +1)
- [CVE-2022-23266](https://cve.now/CVE-2022-23266.md): Microsoft Defender for IoT Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Defender for IoT)
- [CVE-2022-23265](https://cve.now/CVE-2022-23265.md): Microsoft Defender for IoT Remote Code Execution Vulnerability (CVSS 7.2, Microsoft Defender for IoT)
- [CVE-2022-23253](https://cve.now/CVE-2022-23253.md): Windows Point-to-Point Tunneling Protocol Denial of Service Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2022-22010](https://cve.now/CVE-2022-22010.md): Media Foundation Information Disclosure Vulnerability (CVSS 4.4, Microsoft Windows)
- [CVE-2022-22007](https://cve.now/CVE-2022-22007.md): HEVC Video Extensions Remote Code Execution Vulnerability (CVSS 7.8, Microsoft HEVC Video Extension · Microsoft HEVC Video Exten…)
- [CVE-2022-22006](https://cve.now/CVE-2022-22006.md): HEVC Video Extensions Remote Code Execution Vulnerability (CVSS 7.8, Microsoft HEVC Video Extension · Microsoft HEVC Video Exten…)
- [CVE-2022-21990](https://cve.now/CVE-2022-21990.md): Remote Desktop Client Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows · Microsoft Remote Desktop client for Win…)
- [CVE-2022-21977](https://cve.now/CVE-2022-21977.md): Media Foundation Information Disclosure Vulnerability (CVSS 3.3, Microsoft Windows)
- [CVE-2022-21975](https://cve.now/CVE-2022-21975.md): Windows Hyper-V Denial of Service Vulnerability (CVSS 4.7, Microsoft Windows)
- [CVE-2022-21973](https://cve.now/CVE-2022-21973.md): Windows Media Center Update Denial of Service Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2022-21967](https://cve.now/CVE-2022-21967.md): Xbox Live Auth Manager for Windows Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2022-20060](https://cve.now/CVE-2022-20060.md): In preloader (usb), there is a possible permission bypass due to a missing proper image authentication. (no CVSS, MediaTek MT6761, MT6762, MT6765, MT6768, MT6771, MT6779, MT…)
- [CVE-2022-20059](https://cve.now/CVE-2022-20059.md): In preloader (usb), there is a possible out of bounds write due to a missing bounds check. (no CVSS, MediaTek MT6761, MT6762, MT6765, MT6768, MT6771, MT6779, MT…)
- [CVE-2022-20058](https://cve.now/CVE-2022-20058.md): In preloader (usb), there is a possible out of bounds write due to a missing bounds check. (no CVSS, MediaTek MT6761, MT6762, MT6765, MT6768, MT6771, MT6779, MT…)
- [CVE-2022-20057](https://cve.now/CVE-2022-20057.md): In btif, there is a possible memory corruption due to incorrect error handling. (no CVSS, MediaTek MT6739, MT6758, MT6761, MT6765, MT6768, MT6769, MT…)
- [CVE-2022-20056](https://cve.now/CVE-2022-20056.md): In preloader (usb), there is a possible out of bounds write due to a missing bounds check. (no CVSS, MediaTek MT6761, MT6762, MT6765, MT6768, MT6771, MT6779, MT…)
- [CVE-2022-20055](https://cve.now/CVE-2022-20055.md): In preloader (usb), there is a possible out of bounds write due to a missing bounds check. (no CVSS, MediaTek MT6761, MT6762, MT6765, MT6768, MT6771, MT6779, MT…)
- [CVE-2022-20054](https://cve.now/CVE-2022-20054.md): In ims service, there is a possible AT command injection due to a missing permission check. (no CVSS, MediaTek MT6580, MT6739, MT6750, MT6761, MT6762, MT6763, MT…)
- [CVE-2022-20051](https://cve.now/CVE-2022-20051.md): In ims service, there is a possible unexpected application behavior due to incorrect privilege assignment. (no CVSS, MediaTek MT6731, MT6732, MT6735, MT6737, MT6739, MT6750, MT…)
- [CVE-2022-20050](https://cve.now/CVE-2022-20050.md): In connsyslogger, there is a possible symbolic link following due to improper link resolution. (no CVSS, MediaTek MT6762, MT6765, MT6768, MT6769, MT6779, MT6781, MT…)
- [CVE-2022-20049](https://cve.now/CVE-2022-20049.md): In vpu, there is a possible escalation of privilege due to a missing permission check. (no CVSS, MediaTek MT6779, MT6785, MT6853, MT6853T, MT6873, MT6875, M…)
- [CVE-2022-20053](https://cve.now/CVE-2022-20053.md): In ims service, there is a possible escalation of privilege due to a missing permission check. (no CVSS, MediaTek MT6731, MT6732, MT6735, MT6737, MT6739, MT6750, MT…)
- [CVE-2022-20048](https://cve.now/CVE-2022-20048.md): In video decoder, there is a possible out of bounds write due to a missing bounds check. (no CVSS, MediaTek MT5816, MT5835, MT6885, MT6893, MT9900, MT9901, MT…)
- [CVE-2022-20047](https://cve.now/CVE-2022-20047.md): In video decoder, there is a possible out of bounds write due to a missing bounds check. (no CVSS, MediaTek MT5816, MT5835, MT6885, MT6893, MT9900, MT9901, MT…)
- [CVE-2021-33852](https://cve.now/CVE-2021-33852.md): A cross-site scripting (XSS) attack can cause arbitrary code (JavaScript) to run in a user's browser and can use an application as the vehic (no CVSS, WordPress Post Duplicator Plugin)
- [CVE-2021-33851](https://cve.now/CVE-2021-33851.md): A cross-site scripting (XSS) attack can cause arbitrary code (JavaScript) to run in a user's browser and can use an application as the vehic (no CVSS, WordPress Customize Login Image Plugin)
- [CVE-2021-42854](https://cve.now/CVE-2021-42854.md): Directory Traversal Read/Write/Delete at PluginServlet (CVSS 9.8, Aternity SteelCentral AppInternals Dynamic Sampling Agent)
- [CVE-2021-42856](https://cve.now/CVE-2021-42856.md): Reflected Cross-site Scripting at DsaDataTest (CVSS 4.7, Aternity SteelCentral AppInternals Dynamic Sampling Agent)
- [CVE-2021-42787](https://cve.now/CVE-2021-42787.md): Directory Traversal Write/Delete/Partial Read at AgentConfigurationServlet (CVSS 9.4, Aternity SteelCentral AppInternals Dynamic Sampling Agent)
- [CVE-2021-42857](https://cve.now/CVE-2021-42857.md): Directory Traversal Partial Write at AgentDaServlet (CVSS 5.3, Aternity SteelCentral AppInternals Dynamic Sampling Agent)
- [CVE-2021-42855](https://cve.now/CVE-2021-42855.md): Local privilege escalation due to misconfigured write permission on .debug\_command.config file (CVSS 7.8, Aternity SteelCentral AppInternals Dynamic Sampling Agent)
- [CVE-2021-42786](https://cve.now/CVE-2021-42786.md): Remote Code Execution at AgentControllerServlet (CVSS 9.8, Aternity SteelCentral AppInternals Dynamic Sampling Agent)
- [CVE-2021-42853](https://cve.now/CVE-2021-42853.md): Directory Traversal Delete/Read at AgentDiagnosticServlet (CVSS 9.1, Aternity SteelCentral AppInternals Dynamic Sampling Agent)
- [CVE-2021-4023](https://cve.now/CVE-2021-4023.md): A flaw was found in the io-workqueue implementation in the Linux kernel versions prior to 5.15-rc1. (no CVSS, kernel)
- [CVE-2022-24397](https://cve.now/CVE-2022-24397.md): SAP NetWeaver Enterprise Portal - versions 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in reflect (no CVSS, SAP SE SAP NetWeaver Enterprise Portal)
- [CVE-2022-0433](https://cve.now/CVE-2022-0433.md): A NULL pointer dereference flaw was found in the Linux kernel's BPF subsystem in the way a user triggers the map\_get\_next\_key function of th (no CVSS, kernel)
- [CVE-2021-20269](https://cve.now/CVE-2021-20269.md): A flaw was found in the permissions of a log file created by kexec-tools. (no CVSS, kexec-tools)
- [CVE-2021-36777](https://cve.now/CVE-2021-36777.md): login-proxy sends password to attacker-provided domain (CVSS 8.1, openSUSE Build service)
- [CVE-2021-35251](https://cve.now/CVE-2021-35251.md): Sensitive Data Disclosure Vulnerability (CVSS 5.3, SolarWinds Web Help Desk)
- [CVE-2022-25090](https://cve.now/CVE-2022-25090.md): Printix Secure Cloud Print Management through 1.3.1106.0 creates a temporary temp.ini file in a directory with insecure permissions, leading (no CVSS)
- [CVE-2022-24432](https://cve.now/CVE-2022-24432.md): ICSA-22-062-01 IPCOMM ipDIO (CVSS 5.5, IPCOMM ipDIO)
- [CVE-2022-24915](https://cve.now/CVE-2022-24915.md): ICSA-22-062-01 IPCOMM ipDIO (CVSS 8.0, IPCOMM ipDIO)
- [CVE-2022-22985](https://cve.now/CVE-2022-22985.md): ICSA-22-062-01 IPCOMM ipDIO (CVSS 8.8, IPCOMM ipDIO)
- [CVE-2022-21146](https://cve.now/CVE-2022-21146.md): ICSA-22-062-01 IPCOMM ipDIO (CVSS 6.3, IPCOMM ipDIO)
- [CVE-2022-26143](https://cve.now/CVE-2022-26143.md): The TP-240 (aka tp240dvr) component in Mitel MiCollab before 9.4 SP1 FP1 and MiVoice Business Express through 8.1 allows remote attackers to (CVSS 9.8, KEV)
- [CVE-2022-0904](https://cve.now/CVE-2022-0904.md): Stack overflow in document extractor in Mattermost (CVSS 4.3, Mattermost)
- [CVE-2022-0903](https://cve.now/CVE-2022-0903.md): Stack overflow in SAML login in Mattermost (CVSS 5.3, Mattermost)
- [CVE-2022-0507](https://cve.now/CVE-2022-0507.md): Vulnerability: Authenticated SQL Injection in API (CVSS 5.8, Artica PFMS Pandora FMS)
- [CVE-2022-0813](https://cve.now/CVE-2022-0813.md): PhpMyAdmin exposure of sensitive information (CVSS 5.3, phpMyAdmin · phpmyadmin/phpmyadmin)
- [CVE-2022-26355](https://cve.now/CVE-2022-26355.md): Citrix Federated Authentication Service (FAS) (no CVSS, Citrix Federated Authentication Service)
- [CVE-2022-22795](https://cve.now/CVE-2022-22795.md): Signiant - Manager+Agents XML External Entity (XXE) (CVSS 6.8, Signiant)
- [CVE-2022-24609](https://cve.now/CVE-2022-24609.md): Luocms v2.0 is affected by an incorrect access control vulnerability. (no CVSS)
- [CVE-2022-24608](https://cve.now/CVE-2022-24608.md): Luocms v2.0 is affected by Cross Site Scripting (XSS) in /admin/news/sort\_add.php and /inc/function.php. (no CVSS)
- [CVE-2022-24607](https://cve.now/CVE-2022-24607.md): Luocms v2.0 is affected by SQL Injection in /admin/news/news\_ok.php. (no CVSS)
- [CVE-2022-24606](https://cve.now/CVE-2022-24606.md): Luocms v2.0 is affected by SQL Injection in /admin/news/sort\_ok.php. (no CVSS)
- [CVE-2022-24605](https://cve.now/CVE-2022-24605.md): Luocms v2.0 is affected by SQL Injection in /admin/link/link\_ok.php. (no CVSS)
- [CVE-2022-24604](https://cve.now/CVE-2022-24604.md): Luocms v2.0 is affected by SQL Injection in /admin/link/link\_mod.php. (no CVSS)
- [CVE-2022-24603](https://cve.now/CVE-2022-24603.md): Luocms v2.0 is affected by SQL Injection in /admin/news/sort\_mod.php. (no CVSS)
- [CVE-2022-24602](https://cve.now/CVE-2022-24602.md): Luocms v2.0 is affected by SQL Injection in /admin/news/news\_mod.php. (no CVSS)
- [CVE-2022-24601](https://cve.now/CVE-2022-24601.md): Luocms v2.0 is affected by SQL Injection in /admin/manager/admin\_mod.php. (no CVSS)
- [CVE-2022-24600](https://cve.now/CVE-2022-24600.md): Luocms v2.0 is affected by SQL Injection through /admin/login.php. (no CVSS)
- [CVE-2022-24618](https://cve.now/CVE-2022-24618.md): Heimdal.Wizard.exe installer in Heimdal Premium Security 2.5.395 and earlier has insecure permissions, which allows unprivileged local users (no CVSS)
- [CVE-2021-44750](https://cve.now/CVE-2021-44750.md): Arbitrary Code Execution (CVSS 6.4, F-Secure Elements Agent, F-Secure MDR, F-Secure Client Secu…)
- [CVE-2022-0896](https://cve.now/CVE-2022-0896.md): Improper Neutralization of Special Elements Used in a Template Engine in microweber/microweber (CVSS 7.1, microweber/microweber)
- [CVE-2022-0482](https://cve.now/CVE-2022-0482.md): Exposure of Private Personal Information to an Unauthorized Actor in alextselegidis/easyappointments (CVSS 9.1, alextselegidis/easyappointments)
- [CVE-2022-0881](https://cve.now/CVE-2022-0881.md): Insecure Storage of Sensitive Information in chocobozzz/peertube (CVSS 7.6, chocobozzz/peertube)
- [CVE-2022-26778](https://cve.now/CVE-2022-26778.md): Veritas System Recovery (VSR) 18 and 21 stores a network destination password in the Windows registry during configuration of the backup con (CVSS 5.3)
- [CVE-2022-24960](https://cve.now/CVE-2022-24960.md): Use after free vulnerability in PDFTron SDK (CVSS 6.5)
- [CVE-2022-25943](https://cve.now/CVE-2022-25943.md): The installer of WPS Office for Windows versions prior to v11.2.0.10258 fails to configure properly the ACL for the directory where the serv (no CVSS, WPS Office Software WPS Office for Windows)
- [CVE-2022-0204](https://cve.now/CVE-2022-0204.md): A heap overflow vulnerability was found in bluez in versions prior to 5.63. (CVSS 8.8, bluez)
- [CVE-2022-0891](https://cve.now/CVE-2022-0891.md): A heap buffer overflow in ExtractImageSection function in tiffcrop.c in libtiff library Version 4.3.0 allows attacker to trigger unsafe or o (CVSS 6.1, libtiff)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-03-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.