CVEs published March 11, 2022
88 CVEs were published on March 11, 2022: 2 critical, 18 high.
- Published
- 88
- Critical
- 2
- High
- 18
- Medium
- 20
- Low
- 0
- Unrated
- 48
- Now in CISA KEV
- 0
- Fix available
- 30
Most affected products
- HP PC BIOS
- 11
- Yokogawa Electric CENTUM CS · Yokogawa Electric CENTUM VP +1
- 8
- moodle · moodle/moodle
- 7
- Dell CPG BIOS
- 5
- Adobe After Effects
- 4
- microweber/microweber
- 4
- libtiff
- 3
- AMD Processors
- 2
- gogs/gogs · gogs.io/gogs
- 2
- Hitachi ABB Power Grids Ellipse Enterprise Asset Management
- 2
Critical 2
High 18
- CVE-2022-24421Dell BIOS contains an improper input validation vulnerability.Dell CPG BIOS
- CVE-2022-24420Dell BIOS contains an improper input validation vulnerability.Dell CPG BIOS
- CVE-2022-24419Dell BIOS contains an improper input validation vulnerability.Dell CPG BIOS
- CVE-2022-24416Dell BIOS contains an improper input validation vulnerability.Dell CPG BIOS
- CVE-2022-24415Dell BIOS contains an improper input validation vulnerability.Dell CPG BIOS
- CVE-2022-24096Adobe After Effects Heap-based Buffer Overflow Arbitrary code executionAdobe After Effects
- CVE-2022-23187Adobe Illustrator 2022 Buffer Overflow could lead to Arbitrary code executionAdobe Illustrator
- CVE-2022-24094Adobe After Effects Stack-based Buffer Overflow Arbitrary code executionAdobe After Effects
- CVE-2022-24097Adobe After Effects Out-of-bounds Write could lead to Arbitrary code executionAdobe After Effects
- CVE-2022-24095Adobe After Effects Stack-based Buffer Overflow Arbitrary code executionAdobe After Effects
- CVE-2022-0921Abusing Backup/Restore feature to achieve Remote Code Execution in microweber/microwebermicroweber/microweber
- CVE-2022-24433Command Injectionsimple-git
- CVE-2022-0860Improper Authorization in cobbler/cobblercobbler/cobbler · cobbler
- CVE-2020-36518jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.com.fasterxml.jackson.core:jackson-databind
- CVE-2022-0871Missing Authorization in gogs/gogsgogs/gogs · gogs.io/gogs
- CVE-2022-0908Null source pointer passed as an argument to memcpy() function within TIFFFetchNormalTag () in tif_dirread.c in libtiff versions up to 4.3.0TIFF Software Distribution libtiff
- CVE-2022-21819NVIDIA distributions of Jetson Linux contain a vulnerability where an error in the IOMMU configuration may allow an unprivileged attacker wiNVIDIA Jetson Nano, Jetson Nano 2GB
- CVE-2022-24754Buffer overflow in pjsippjsip pjproject
Medium, low and unrated 68
- CVE-2021-41848An issue was discovered in Luna Simo PPR1.180610.011/202001031830.
- CVE-2021-41849An issue was discovered in Luna Simo PPR1.180610.011/202001031830.
- CVE-2021-41850An issue was discovered in Luna Simo PPR1.180610.011/202001031830.
- CVE-2021-42577An issue was discovered in Softing OPC UA C++ SDK before 5.70.
- CVE-2021-42262An issue was discovered in Softing OPC UA C++ SDK before 5.70.
- CVE-2022-25839Improper Input Validationurl-js
- CVE-2021-44667A Cross Site Scripting (XSS) vulnerability exists in Nacos 2.0.3 in auth/users via the (1) pageSize and (2) pageNo parameters.com.alibaba.nacos:nacos-common
- CVE-2022-23625DoS vulnerability: Malformed Resource Identifierswireapp wire-ios
- CVE-2021-23246In ACE2 ColorOS11, the attacker can obtain the foreground package name through permission promotion, resulting in user information disclosurACE2
- CVE-2022-25216An absolute path traversal vulnerability allows a remote attacker to download any file on the Windows file system for which the user accountDVDFab 12 Player / PlayerFab
- CVE-2021-33150Hardware allows activation of test or debug logic at runtime for some Intel(R) Trace Hub instances which may allow an unauthenticated user tIntel(R) Trace Hub instances which
- CVE-2022-0002Non-transparent sharing of branch predictor within a context in some Intel(R) Processors may allow an authorized user to potentially enable Intel(R) Processors
- CVE-2021-26341Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage.AMD Processors
- CVE-2021-26401LFENCE/JMP (mitigation V2-2) may not sufficiently mitigate CVE-2017-5715 on some AMD CPUs.AMD Processors
- CVE-2022-24090Adobe Photoshop 2022 Out-of-bounds Read could lead to Memory leakAdobe Photoshop
- CVE-2022-25621UUNIVERGE WA 1020 Ver8.2.11 and prior, UNIVERGE WA 1510 Ver8.2.11 and prior, UNIVERGE WA 1511 Ver8.2.11 and prior, UNIVERGE WA 1512 Ver8.2.1NEC Platforms UNIVERGE DT
- CVE-2022-0853A flaw was found in JBoss-client.jboss-client
- CVE-2021-32473It was possible for a student to view their quiz grade before it had been released, using a quiz web service.moodle · moodle/moodle
- CVE-2021-32474An SQL injection risk existed on sites with MNet enabled and configured, via an XML-RPC call from the connected peer host.moodle · moodle/moodle
- CVE-2021-32475ID numbers displayed in the quiz grading report required additional sanitizing to prevent a stored XSS risk.moodle · moodle/moodle
- CVE-2021-32477The last time a user accessed the mobile app is displayed on their profile page, but should be restricted to users with the relevant capabilmoodle · moodle/moodle
- CVE-2021-33658atune before 0.3-0.8 log in as a local user and run the curl command to access the local atune url interface to escalate the local privilegeopenEuler atune
- CVE-2022-23933Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, ArbitraHP PC BIOS
- CVE-2022-23932Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, ArbitraHP PC BIOS
- CVE-2022-23928Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, ArbitraHP PC BIOS
- CVE-2022-23929Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, ArbitraHP PC BIOS
- CVE-2022-23926Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, ArbitraHP PC BIOS
- CVE-2022-23927Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, ArbitraHP PC BIOS
- CVE-2022-23934Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, ArbitraHP PC BIOS
- CVE-2022-23931Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, ArbitraHP PC BIOS
- CVE-2022-23930Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, ArbitraHP PC BIOS
- CVE-2022-23924Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, ArbitraHP PC BIOS
- CVE-2022-23925Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, ArbitraHP PC BIOS
- CVE-2022-23731V8 javascript engine (heap vulnerability) can cause privilege escalation ,which can impact on some webOS TV models.LG webOS TV
- CVE-2022-23730The public API error causes for the attacker to be able to bypass API access control.LG webOS TV
- CVE-2022-25600WordPress WP Google Map plugin <= 4.2.3 - Cross-Site Request Forgery (CSRF) vulnerabilityFlippercode WP Google Map Plugin
- CVE-2022-25601WordPress Contact Form X plugin <= 2.4 - Reflected Cross-Site Scripting (XSS) vulnerabilityJeff Starr Contact Form X
- CVE-2021-27414User interface misrepresentation of critical information in Hitachi ABB Power Grids Ellipse EAMHitachi ABB Power Grids Ellipse Enterprise Asset Management
- CVE-2021-27416Cross-site scripting in Hitachi ABB Power Grids Ellipse EAMHitachi ABB Power Grids Ellipse Enterprise Asset Management
- CVE-2021-32009Missing XSS guards on firmware pageSecomea GateManager
- CVE-2021-44620A Command Injection vulnerability exits in TOTOLINK A3100R <=V4.1.2cu.5050_B20200504 in adm/ntm.asp via the hosTime parameters.
- CVE-2021-44618A Server-side Template Injection (SSTI) vulnerability exists in Nystudio107 Seomatic 3.4.12 in src/helpers/UrlHelper.php via the host headernystudio107/craft-seomatic
- CVE-2022-0870Server-Side Request Forgery (SSRF) in gogs/gogsgogs/gogs · gogs.io/gogs
- CVE-2022-0928Cross-site Scripting (XSS) - Stored in microweber/microwebermicroweber/microweber
- CVE-2022-0912Unrestricted Upload of File with Dangerous Type in microweber/microwebermicroweber/microweber
- CVE-2022-23402The following Yokogawa Electric products hard-code the password for CAMS server applications: CENTUM VP versions from R5.01.00 to R5.04.20 aYokogawa Electric CENTUM VP · Yokogawa Electric Exaopc
- CVE-2022-23401The following Yokogawa Electric products contain insecure DLL loading issues.Yokogawa Electric CENTUM CS · Yokogawa Electric CENTUM VP +1
- CVE-2022-22729CAMS for HIS Server contained in the following Yokogawa Electric products improperly authenticate the receiving packets.Yokogawa Electric CENTUM CS · Yokogawa Electric CENTUM VP +1
- CVE-2022-22151CAMS for HIS Log Server contained in the following Yokogawa Electric products fails to properly neutralize log outputs: CENTUM CS 3000 versiYokogawa Electric CENTUM CS · Yokogawa Electric CENTUM VP +1
- CVE-2022-22148'Root Service' service implemented in the following Yokogawa Electric products creates some named pipe with improper ACL configuration.Yokogawa Electric CENTUM CS · Yokogawa Electric CENTUM VP +1
- CVE-2022-22145CAMS for HIS Log Server contained in the following Yokogawa Electric products is vulnerable to uncontrolled resource consumption.Yokogawa Electric CENTUM CS · Yokogawa Electric CENTUM VP +1
- CVE-2022-22141'Long-term Data Archive Package' service implemented in the following Yokogawa Electric products creates some named pipe with imporper ACL cYokogawa Electric CENTUM CS · Yokogawa Electric CENTUM VP +1
- CVE-2022-21808Path traversal vulnerability exists in CAMS for HIS Server contained in the following Yokogawa Electric products: CENTUM CS 3000 versions frYokogawa Electric CENTUM CS · Yokogawa Electric CENTUM VP +1
- CVE-2022-21194The following Yokogawa Electric products do not change the passwords of the internal Windows accounts from the initial configuration: CENTUMYokogawa Electric CENTUM VP · Yokogawa Electric Exaopc
- CVE-2022-21177There is a path traversal vulnerability in CAMS for HIS Log Server contained in the following Yokogawa Electric products: CENTUM CS 3000 verYokogawa Electric CENTUM CS · Yokogawa Electric CENTUM VP +1
- CVE-2021-46708The swagger-ui-dist package before 4.1.3 for Node.js could allow a remote attacker to hijack the clicking action of the victim.swagger-ui-dist
- CVE-2018-25031Swagger UI 4.1.2 and earlier could allow a remote attacker to conduct spoofing attacks.swagger-ui · org.webjars:swagger-ui
- CVE-2022-26878drivers/bluetooth/virtio_bt.c in the Linux kernel before 5.16.3 has a memory leak (socket buffers have memory allocated but not freed).
- CVE-2022-26874lib/Horde/Mime/Viewer/Ooo.php in Horde Mime_Viewer before 2.2.4 allows XSS via an OpenOffice document, leading to account takeover in Horde
- CVE-2022-0822Cross-site Scripting (XSS) - Reflected in orchardcms/orchardcoreorchardcms/orchardcore
- CVE-2021-32472Teachers exporting a forum in CSV format could receive a CSV of forums from all courses in some circumstances.moodle · moodle/moodle
- CVE-2021-32476A denial-of-service risk was identified in the draft files area, due to it not respecting user file upload limits.moodle · moodle/moodle
- CVE-2021-32478The redirect URI in the LTI authorization endpoint required extra sanitizing to prevent reflected XSS and open redirect risks.moodle · moodle/moodle
- CVE-2022-0001Non-transparent sharing of branch predictor selectors between contexts in some Intel(R) Processors may allow an authorized user to potentialIntel(R) Processors
- CVE-2022-0907Unchecked Return Value to NULL Pointer Dereference in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted libtiff
- CVE-2022-0909Divide By Zero error in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file.libtiff
- CVE-2022-0924Out-of-bounds Read error in tiffcp in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file.libtiff
- CVE-2022-0932Missing Authorization in saleor/saleorsaleor/saleor · saleor