# CVEs published 2022-03-11

88 CVEs were published on March 11, 2022: 2 critical, 18 high. Days are UTC.

- [CVE-2022-24760](https://cve.now/CVE-2022-24760.md): Command Injection in Parse server (CVSS 10.0, parse-community parse-server · parse-server)
- [CVE-2021-41848](https://cve.now/CVE-2021-41848.md): An issue was discovered in Luna Simo PPR1.180610.011/202001031830. (no CVSS)
- [CVE-2021-41849](https://cve.now/CVE-2021-41849.md): An issue was discovered in Luna Simo PPR1.180610.011/202001031830. (no CVSS)
- [CVE-2021-41850](https://cve.now/CVE-2021-41850.md): An issue was discovered in Luna Simo PPR1.180610.011/202001031830. (no CVSS)
- [CVE-2021-42577](https://cve.now/CVE-2021-42577.md): An issue was discovered in Softing OPC UA C++ SDK before 5.70. (no CVSS)
- [CVE-2021-42262](https://cve.now/CVE-2021-42262.md): An issue was discovered in Softing OPC UA C++ SDK before 5.70. (no CVSS)
- [CVE-2022-24421](https://cve.now/CVE-2022-24421.md): Dell BIOS contains an improper input validation vulnerability. (CVSS 8.2, Dell CPG BIOS)
- [CVE-2022-24420](https://cve.now/CVE-2022-24420.md): Dell BIOS contains an improper input validation vulnerability. (CVSS 8.2, Dell CPG BIOS)
- [CVE-2022-24419](https://cve.now/CVE-2022-24419.md): Dell BIOS contains an improper input validation vulnerability. (CVSS 8.2, Dell CPG BIOS)
- [CVE-2022-24416](https://cve.now/CVE-2022-24416.md): Dell BIOS contains an improper input validation vulnerability. (CVSS 8.2, Dell CPG BIOS)
- [CVE-2022-24415](https://cve.now/CVE-2022-24415.md): Dell BIOS contains an improper input validation vulnerability. (CVSS 8.2, Dell CPG BIOS)
- [CVE-2022-25839](https://cve.now/CVE-2022-25839.md): Improper Input Validation (CVSS 4.3, url-js)
- [CVE-2021-44667](https://cve.now/CVE-2021-44667.md): A Cross Site Scripting (XSS) vulnerability exists in Nacos 2.0.3 in auth/users via the (1) pageSize and (2) pageNo parameters. (no CVSS, com.alibaba.nacos:nacos-common)
- [CVE-2022-23625](https://cve.now/CVE-2022-23625.md): DoS vulnerability: Malformed Resource Identifiers (CVSS 6.5, wireapp wire-ios)
- [CVE-2021-23246](https://cve.now/CVE-2021-23246.md): In ACE2 ColorOS11, the attacker can obtain the foreground package name through permission promotion, resulting in user information disclosur (no CVSS, ACE2)
- [CVE-2022-25216](https://cve.now/CVE-2022-25216.md): An absolute path traversal vulnerability allows a remote attacker to download any file on the Windows file system for which the user account (no CVSS, DVDFab 12 Player / PlayerFab)
- [CVE-2021-33150](https://cve.now/CVE-2021-33150.md): Hardware allows activation of test or debug logic at runtime for some Intel(R) Trace Hub instances which may allow an unauthenticated user t (CVSS 6.8, Intel(R) Trace Hub instances which)
- [CVE-2022-0002](https://cve.now/CVE-2022-0002.md): Non-transparent sharing of branch predictor within a context in some Intel(R) Processors may allow an authorized user to potentially enable (CVSS 6.5, Intel(R) Processors)
- [CVE-2021-26341](https://cve.now/CVE-2021-26341.md): Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage. (no CVSS, AMD Processors)
- [CVE-2021-26401](https://cve.now/CVE-2021-26401.md): LFENCE/JMP (mitigation V2-2) may not sufficiently mitigate CVE-2017-5715 on some AMD CPUs. (no CVSS, AMD Processors)
- [CVE-2022-24090](https://cve.now/CVE-2022-24090.md): Adobe Photoshop 2022 Out-of-bounds Read could lead to Memory leak (CVSS 5.5, Adobe Photoshop)
- [CVE-2022-24096](https://cve.now/CVE-2022-24096.md): Adobe After Effects Heap-based Buffer Overflow Arbitrary code execution (CVSS 7.8, Adobe After Effects)
- [CVE-2022-23187](https://cve.now/CVE-2022-23187.md): Adobe Illustrator 2022 Buffer Overflow could lead to Arbitrary code execution (CVSS 7.8, Adobe Illustrator)
- [CVE-2022-24094](https://cve.now/CVE-2022-24094.md): Adobe After Effects Stack-based Buffer Overflow Arbitrary code execution (CVSS 7.8, Adobe After Effects)
- [CVE-2022-24097](https://cve.now/CVE-2022-24097.md): Adobe After Effects Out-of-bounds Write could lead to Arbitrary code execution (CVSS 7.8, Adobe After Effects)
- [CVE-2022-24095](https://cve.now/CVE-2022-24095.md): Adobe After Effects Stack-based Buffer Overflow Arbitrary code execution (CVSS 7.8, Adobe After Effects)
- [CVE-2022-25621](https://cve.now/CVE-2022-25621.md): UUNIVERGE WA 1020 Ver8.2.11 and prior, UNIVERGE WA 1510 Ver8.2.11 and prior, UNIVERGE WA 1511 Ver8.2.11 and prior, UNIVERGE WA 1512 Ver8.2.1 (no CVSS, NEC Platforms UNIVERGE DT)
- [CVE-2022-0853](https://cve.now/CVE-2022-0853.md): A flaw was found in JBoss-client. (no CVSS, jboss-client)
- [CVE-2021-32473](https://cve.now/CVE-2021-32473.md): It was possible for a student to view their quiz grade before it had been released, using a quiz web service. (no CVSS, moodle · moodle/moodle)
- [CVE-2021-32474](https://cve.now/CVE-2021-32474.md): An SQL injection risk existed on sites with MNet enabled and configured, via an XML-RPC call from the connected peer host. (no CVSS, moodle · moodle/moodle)
- [CVE-2021-32475](https://cve.now/CVE-2021-32475.md): ID numbers displayed in the quiz grading report required additional sanitizing to prevent a stored XSS risk. (no CVSS, moodle · moodle/moodle)
- [CVE-2021-32477](https://cve.now/CVE-2021-32477.md): The last time a user accessed the mobile app is displayed on their profile page, but should be restricted to users with the relevant capabil (no CVSS, moodle · moodle/moodle)
- [CVE-2021-33658](https://cve.now/CVE-2021-33658.md): atune before 0.3-0.8 log in as a local user and run the curl command to access the local atune url interface to escalate the local privilege (no CVSS, openEuler atune)
- [CVE-2022-23933](https://cve.now/CVE-2022-23933.md): Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitra (no CVSS, HP PC BIOS)
- [CVE-2022-23932](https://cve.now/CVE-2022-23932.md): Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitra (no CVSS, HP PC BIOS)
- [CVE-2022-23928](https://cve.now/CVE-2022-23928.md): Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitra (no CVSS, HP PC BIOS)
- [CVE-2022-23929](https://cve.now/CVE-2022-23929.md): Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitra (no CVSS, HP PC BIOS)
- [CVE-2022-23926](https://cve.now/CVE-2022-23926.md): Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitra (no CVSS, HP PC BIOS)
- [CVE-2022-23927](https://cve.now/CVE-2022-23927.md): Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitra (no CVSS, HP PC BIOS)
- [CVE-2022-23934](https://cve.now/CVE-2022-23934.md): Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitra (no CVSS, HP PC BIOS)
- [CVE-2022-23931](https://cve.now/CVE-2022-23931.md): Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitra (no CVSS, HP PC BIOS)
- [CVE-2022-23930](https://cve.now/CVE-2022-23930.md): Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitra (no CVSS, HP PC BIOS)
- [CVE-2022-23924](https://cve.now/CVE-2022-23924.md): Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitra (no CVSS, HP PC BIOS)
- [CVE-2022-23925](https://cve.now/CVE-2022-23925.md): Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitra (no CVSS, HP PC BIOS)
- [CVE-2022-23731](https://cve.now/CVE-2022-23731.md): V8 javascript engine (heap vulnerability) can cause privilege escalation ,which can impact on some webOS TV models. (no CVSS, LG webOS TV)
- [CVE-2022-23730](https://cve.now/CVE-2022-23730.md): The public API error causes for the attacker to be able to bypass API access control. (no CVSS, LG webOS TV)
- [CVE-2022-25600](https://cve.now/CVE-2022-25600.md): WordPress WP Google Map plugin \<= 4.2.3 - Cross-Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Flippercode WP Google Map Plugin)
- [CVE-2022-25601](https://cve.now/CVE-2022-25601.md): WordPress Contact Form X plugin \<= 2.4 - Reflected Cross-Site Scripting (XSS) vulnerability (CVSS 4.7, Jeff Starr Contact Form X)
- [CVE-2021-27414](https://cve.now/CVE-2021-27414.md): User interface misrepresentation of critical information in Hitachi ABB Power Grids Ellipse EAM (CVSS 5.5, Hitachi ABB Power Grids Ellipse Enterprise Asset Management)
- [CVE-2021-27416](https://cve.now/CVE-2021-27416.md): Cross-site scripting in Hitachi ABB Power Grids Ellipse EAM (CVSS 5.5, Hitachi ABB Power Grids Ellipse Enterprise Asset Management)
- [CVE-2021-32009](https://cve.now/CVE-2021-32009.md): Missing XSS guards on firmware page (CVSS 5.0, Secomea GateManager)
- [CVE-2022-0921](https://cve.now/CVE-2022-0921.md): Abusing Backup/Restore feature to achieve Remote Code Execution in microweber/microweber (CVSS 7.2, microweber/microweber)
- [CVE-2022-24433](https://cve.now/CVE-2022-24433.md): Command Injection (CVSS 8.1, simple-git)
- [CVE-2021-44620](https://cve.now/CVE-2021-44620.md): A Command Injection vulnerability exits in TOTOLINK A3100R \<=V4.1.2cu.5050\_B20200504 in adm/ntm.asp via the hosTime parameters. (no CVSS)
- [CVE-2021-44618](https://cve.now/CVE-2021-44618.md): A Server-side Template Injection (SSTI) vulnerability exists in Nystudio107 Seomatic 3.4.12 in src/helpers/UrlHelper.php via the host header (no CVSS, nystudio107/craft-seomatic)
- [CVE-2022-0860](https://cve.now/CVE-2022-0860.md): Improper Authorization in cobbler/cobbler (CVSS 8.2, cobbler/cobbler · cobbler)
- [CVE-2022-0870](https://cve.now/CVE-2022-0870.md): Server-Side Request Forgery (SSRF) in gogs/gogs (CVSS 5.0, gogs/gogs · gogs.io/gogs)
- [CVE-2022-0928](https://cve.now/CVE-2022-0928.md): Cross-site Scripting (XSS) - Stored in microweber/microweber (CVSS 6.8, microweber/microweber)
- [CVE-2022-0912](https://cve.now/CVE-2022-0912.md): Unrestricted Upload of File with Dangerous Type in microweber/microweber (CVSS 4.8, microweber/microweber)
- [CVE-2022-0913](https://cve.now/CVE-2022-0913.md): Integer Overflow or Wraparound in microweber/microweber (CVSS 9.1, microweber/microweber)
- [CVE-2022-23402](https://cve.now/CVE-2022-23402.md): The following Yokogawa Electric products hard-code the password for CAMS server applications: CENTUM VP versions from R5.01.00 to R5.04.20 a (no CVSS, Yokogawa Electric CENTUM VP · Yokogawa Electric Exaopc)
- [CVE-2022-23401](https://cve.now/CVE-2022-23401.md): The following Yokogawa Electric products contain insecure DLL loading issues. (no CVSS, Yokogawa Electric CENTUM CS · Yokogawa Electric CENTUM VP +1)
- [CVE-2022-22729](https://cve.now/CVE-2022-22729.md): CAMS for HIS Server contained in the following Yokogawa Electric products improperly authenticate the receiving packets. (no CVSS, Yokogawa Electric CENTUM CS · Yokogawa Electric CENTUM VP +1)
- [CVE-2022-22151](https://cve.now/CVE-2022-22151.md): CAMS for HIS Log Server contained in the following Yokogawa Electric products fails to properly neutralize log outputs: CENTUM CS 3000 versi (no CVSS, Yokogawa Electric CENTUM CS · Yokogawa Electric CENTUM VP +1)
- [CVE-2022-22148](https://cve.now/CVE-2022-22148.md): 'Root Service' service implemented in the following Yokogawa Electric products creates some named pipe with improper ACL configuration. (no CVSS, Yokogawa Electric CENTUM CS · Yokogawa Electric CENTUM VP +1)
- [CVE-2022-22145](https://cve.now/CVE-2022-22145.md): CAMS for HIS Log Server contained in the following Yokogawa Electric products is vulnerable to uncontrolled resource consumption. (no CVSS, Yokogawa Electric CENTUM CS · Yokogawa Electric CENTUM VP +1)
- [CVE-2022-22141](https://cve.now/CVE-2022-22141.md): 'Long-term Data Archive Package' service implemented in the following Yokogawa Electric products creates some named pipe with imporper ACL c (no CVSS, Yokogawa Electric CENTUM CS · Yokogawa Electric CENTUM VP +1)
- [CVE-2022-21808](https://cve.now/CVE-2022-21808.md): Path traversal vulnerability exists in CAMS for HIS Server contained in the following Yokogawa Electric products: CENTUM CS 3000 versions fr (no CVSS, Yokogawa Electric CENTUM CS · Yokogawa Electric CENTUM VP +1)
- [CVE-2022-21194](https://cve.now/CVE-2022-21194.md): The following Yokogawa Electric products do not change the passwords of the internal Windows accounts from the initial configuration: CENTUM (no CVSS, Yokogawa Electric CENTUM VP · Yokogawa Electric Exaopc)
- [CVE-2022-21177](https://cve.now/CVE-2022-21177.md): There is a path traversal vulnerability in CAMS for HIS Log Server contained in the following Yokogawa Electric products: CENTUM CS 3000 ver (no CVSS, Yokogawa Electric CENTUM CS · Yokogawa Electric CENTUM VP +1)
- [CVE-2021-46708](https://cve.now/CVE-2021-46708.md): The swagger-ui-dist package before 4.1.3 for Node.js could allow a remote attacker to hijack the clicking action of the victim. (no CVSS, swagger-ui-dist)
- [CVE-2018-25031](https://cve.now/CVE-2018-25031.md): Swagger UI 4.1.2 and earlier could allow a remote attacker to conduct spoofing attacks. (CVSS 4.3, swagger-ui · org.webjars:swagger-ui)
- [CVE-2022-26878](https://cve.now/CVE-2022-26878.md): drivers/bluetooth/virtio\_bt.c in the Linux kernel before 5.16.3 has a memory leak (socket buffers have memory allocated but not freed). (no CVSS)
- [CVE-2022-26874](https://cve.now/CVE-2022-26874.md): lib/Horde/Mime/Viewer/Ooo.php in Horde Mime\_Viewer before 2.2.4 allows XSS via an OpenOffice document, leading to account takeover in Horde (no CVSS)
- [CVE-2022-0822](https://cve.now/CVE-2022-0822.md): Cross-site Scripting (XSS) - Reflected in orchardcms/orchardcore (CVSS 5.4, orchardcms/orchardcore)
- [CVE-2020-36518](https://cve.now/CVE-2020-36518.md): jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects. (CVSS 7.5, com.fasterxml.jackson.core:jackson-databind)
- [CVE-2021-32472](https://cve.now/CVE-2021-32472.md): Teachers exporting a forum in CSV format could receive a CSV of forums from all courses in some circumstances. (no CVSS, moodle · moodle/moodle)
- [CVE-2021-32476](https://cve.now/CVE-2021-32476.md): A denial-of-service risk was identified in the draft files area, due to it not respecting user file upload limits. (no CVSS, moodle · moodle/moodle)
- [CVE-2021-32478](https://cve.now/CVE-2021-32478.md): The redirect URI in the LTI authorization endpoint required extra sanitizing to prevent reflected XSS and open redirect risks. (no CVSS, moodle · moodle/moodle)
- [CVE-2022-0001](https://cve.now/CVE-2022-0001.md): Non-transparent sharing of branch predictor selectors between contexts in some Intel(R) Processors may allow an authorized user to potential (CVSS 6.5, Intel(R) Processors)
- [CVE-2022-0871](https://cve.now/CVE-2022-0871.md): Missing Authorization in gogs/gogs (CVSS 8.2, gogs/gogs · gogs.io/gogs)
- [CVE-2022-0907](https://cve.now/CVE-2022-0907.md): Unchecked Return Value to NULL Pointer Dereference in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted (CVSS 5.5, libtiff)
- [CVE-2022-0908](https://cve.now/CVE-2022-0908.md): Null source pointer passed as an argument to memcpy() function within TIFFFetchNormalTag () in tif\_dirread.c in libtiff versions up to 4.3.0 (CVSS 7.7, TIFF Software Distribution libtiff)
- [CVE-2022-0909](https://cve.now/CVE-2022-0909.md): Divide By Zero error in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. (CVSS 5.5, libtiff)
- [CVE-2022-0924](https://cve.now/CVE-2022-0924.md): Out-of-bounds Read error in tiffcp in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. (CVSS 5.5, libtiff)
- [CVE-2022-0932](https://cve.now/CVE-2022-0932.md): Missing Authorization in saleor/saleor (CVSS 6.5, saleor/saleor · saleor)
- [CVE-2022-21819](https://cve.now/CVE-2022-21819.md): NVIDIA distributions of Jetson Linux contain a vulnerability where an error in the IOMMU configuration may allow an unprivileged attacker wi (CVSS 7.6, NVIDIA Jetson Nano, Jetson Nano 2GB)
- [CVE-2022-24754](https://cve.now/CVE-2022-24754.md): Buffer overflow in pjsip (CVSS 8.5, pjsip pjproject)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-03-11
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.