CVEs published March 14, 2022
91 CVEs were published on March 14, 2022: 4 critical, 8 high.
- Published
- 91
- Critical
- 4
- High
- 8
- Medium
- 17
- Low
- 0
- Unrated
- 62
- Now in CISA KEV
- 0
- Fix available
- 55
Most affected products
- star7th/showdoc · showdoc/showdoc
- 7
- yandex clickhouse
- 7
- Apache Software Foundation Apache HTTP Server
- 4
- SmarterTools SmarterTrack
- 4
- Sylius · sylius/sylius
- 4
- IBM Spectrum Copy Data Management
- 3
- IBM Spectrum Protect Operations Center
- 2
- MOLIE – Instructure Canvas Linking tool
- 2
- Simple Quotation
- 2
- tribalsystems/zenario
- 2
Critical 4
- CVE-2022-0962Stored XSS viva .webma file upload in star7th/showdocstar7th/showdoc · showdoc/showdoc
- CVE-2022-0960Stored XSS viva .properties file upload in star7th/showdocstar7th/showdoc · showdoc/showdoc
- CVE-2022-0946Stored XSS viva cshtm file upload in star7th/showdocstar7th/showdoc · showdoc/showdoc
- CVE-2022-24387File upload and overwrite to app_data/Config in SmarterTrack v100.0.8019.14010SmarterTools SmarterTrack
High 8
- CVE-2022-24743Insufficient Session Expiration in SyliusSylius · sylius/sylius
- CVE-2022-21187Command Injectionlibvcs · vcspull
- CVE-2022-0941Stored XSS due to Unrestricted File Upload in star7th/showdocstar7th/showdoc · showdoc/showdoc
- CVE-2022-0938Stored XSS via file upload in star7th/showdocstar7th/showdoc · showdoc/showdoc
- CVE-2022-0943Heap-based Buffer Overflow occurs in vim in vim/vimvim/vim
- CVE-2022-20001Injection in fishfish-shell
- CVE-2022-24384Reflective XSS on SmarterTrack v100.0.8019.14010SmarterTools SmarterTrack
- CVE-2022-24386Stored XSS in SmarterTrack v100.0.8019.14010SmarterTools SmarterTrack
Medium, low and unrated 79
- CVE-2022-24762Exposure of Sensitive Information to an Unauthorized Actor in sysend.jsjcubic sysend.js · sysend
- CVE-2021-42391Divide-by-zero in Clickhouse's Gorilla compression codec when parsing a malicious query.yandex clickhouse
- CVE-2021-42390Divide-by-zero in Clickhouse's DeltaDouble compression codec when parsing a malicious query.yandex clickhouse
- CVE-2021-42389Divide-by-zero in Clickhouse's Delta compression codec when parsing a malicious query.yandex clickhouse
- CVE-2022-24740Improper Authentication in Voltoplone volto · @plone/volto
- CVE-2022-24749Basic Cross-site Scripting and Unrestricted Upload of File with Dangerous Type in SyliusSylius · sylius/sylius
- CVE-2022-24742Exposure of Sensitive Information Due to Incompatible Policies in SyliusSylius · sylius/sylius
- CVE-2022-24733Improper Restriction of Rendered UI Layers or Frames in SyliusSylius · sylius/sylius
- CVE-2022-26320The Rambus SafeZone Basic Crypto Module before 10.4.0, as used in certain Fujifilm (formerly Fuji Xerox) devices before 2022-03-01, Canon im
- CVE-2022-22353IBM Big SQL on IBM Cloud Pak for Data 7.1.0, 7.1.1, 7.2.0, and 7.2.3 could allow an authenticated user with appropriate permissions to obtaiIBM Big SQL on Cloud Pak for Data
- CVE-2022-22348IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.13.xxx is vulnerable to reverse tabnabbing where it could allow a page linked tIBM Spectrum Protect Operations Center
- CVE-2022-22346IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.13.xxx is vulnerable to cross-site request forgery which could allow an attackeIBM Spectrum Protect Operations Center
- CVE-2021-38971IBM Data Virtualization on Cloud Pak for Data 1.3.0, 1.4.1, 1.5.0, 1.7.1 and 1.7.3 could allow an authorized user to bypass data masking rulIBM Data Virtualization on Cloud Pak for Data
- CVE-2022-22354IBM Spectrum Protect Plus 10.1.0.0 through 10.1.9.2 and IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 do not limit the length oIBM Spectrum Copy Data Management · IBM Spectrum Protect Pl…
- CVE-2022-22344IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 is vulnerable to HTTP header injection, caused by improper validation of input byIBM Spectrum Copy Data Management
- CVE-2021-39055IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 is vulnerable to cross-site scripting.IBM Spectrum Copy Data Management
- CVE-2021-39051IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 is vulnerable to server-side request forgery, caused by improper input of applicaIBM Spectrum Copy Data Management
- CVE-2021-41952Zenario CMS 9.0.54156 is vulnerable to Cross Site Scripting (XSS) via upload file to *.SVG.tribalsystems/zenario
- CVE-2021-42171Zenario CMS 9.0.54156 is vulnerable to File Upload.tribalsystems/zenario
- CVE-2022-22735Simple Quotation <= 1.3.2 - Subscriber+ SQL injectionSimple Quotation
- CVE-2022-22734Simple Quotation <= 1.3.2 - Quote Creation/Edition via CSRF to Stored Cross-Site ScriptingSimple Quotation
- CVE-2022-0703GD Mylist <= 1.1.1 - Admin+ Stored Cross-Site ScriptingGDMylist
- CVE-2022-0702Petfinder Listings <= 1.0.18 - Admin+ Stored Cross-Site ScriptingPetfinder Listings
- CVE-2022-0701SEO 301 Meta <= 1.9.1 - Admin+ Stored Cross-Site ScriptingSeo 301 Meta
- CVE-2022-0700Simple Theme Options < 1.7 - Admin+ Stored Cross-Site ScriptingSimple Tracking
- CVE-2022-0684WP Home Page Menu < 3.1 - Admin+ Stored Cross-Site ScriptingWP Home Page Menu
- CVE-2022-0674Kunze Law < 2.1 - Admin+ Stored Cross-Site ScriptingKunze Law
- CVE-2022-0659Sync iCloud COS < 2.0.1 - Admin+ Stored Cross-Site ScriptingSync QCloud COS
- CVE-2022-0658CommonsBooking < 2.6.8 - Unauthenticated SQL InjectionCommonsBooking
- CVE-2022-0648Team Circle Image Slider With Lightbox < 1.0.16 - Reflected Cross-Site ScriptingTeam Circle Image Slider With Lightbox
- CVE-2022-0601Countdown & Clock < 2.2.9 - Reflected Cross-Site ScriptingCountdown, Coming Soon, Maintenance – Countdown & Clock
- CVE-2022-0593Login with phone number < 1.3.7 - Unauthenticated remote plugin deletionLogin with phone number
- CVE-2022-0503Multisite Content Copier/Updater < 2.1.2 - Reflected Cross-Site ScriptingWordPress Multisite Content Copier/Updater
- CVE-2022-0478Event Manager for WooCommerce < 3.5.8 - Contributor+ SQL InjectionEvent Manager and Tickets Selling Plugin for WooCommerce
- CVE-2022-0449Flexi - Guest Submit < 4.20 - Reflected Cross-Site ScriptingFlexi – Guest Submit
- CVE-2022-0399Advanced Product Labels for WooCommerce < 1.2.3.7 - Reflected Cross-Site ScriptingAdvanced Product Labels for WooCommerce
- CVE-2022-0327Master Addons for Elementor < 1.8.2 - Reflected Cross-Site ScriptingMaster Addons for Elementor
- CVE-2022-0321WP Voting Contest < 3.0 - Reflected Cross-Site ScriptingWP Voting Contest
- CVE-2022-0254Zero Spam < 5.2.11 - Admin+ SQL InjectionWordPress Zero Spam · bmarshall511/wordpress_zero_spam
- CVE-2022-0248Contact Form Submissions < 1.7.3 - Unauthenticated Stored XSSContact Form Submissions
- CVE-2022-0230Better WordPress Google XML Sitemaps <= 1.4.1 - Unauthenticated Stored Cross-Site ScriptingBetter WordPress Google XML Sitemaps
- CVE-2022-0169Photo Gallery by 10Web < 1.6.0 - Unauthenticated SQL InjectionPhoto Gallery by 10Web – Mobile-Friendly Image Gallery
- CVE-2022-0165Page Builder KingComposer <= 2.9.6 - Open RedirectPage Builder: KingComposer – Free Drag and Drop page builde…
- CVE-2022-0161ARI Fancy Lightbox < 1.3.9 - Reflected Cross-Site ScriptingARI Fancy Lightbox – WordPress Popup
- CVE-2022-0147Cookie Information < 2.0.8 - Reflected Cross-Site ScriptingCookie Information | Free GDPR Consent Solution
- CVE-2021-25026Patreon WordPress < 1.8.2 - Admin+ Stored Cross-Site ScriptingPatreon WordPress
- CVE-2021-25007MOLIE <= 0.5 - Authenticated SQL InjectionMOLIE – Instructure Canvas Linking tool
- CVE-2021-25006MOLIE <= 0.5 - Reflected Cross-Site ScriptingMOLIE – Instructure Canvas Linking tool
- CVE-2021-25003WPCargo < 6.9.0 - Unauthenticated RCEWPCargo Track & Trace
- CVE-2021-24996IDPay for Contact Form 7 <= 2.1.2 - Reflected Cross-Site ScriptingIDPay for Contact Form
- CVE-2021-24995HTML5 Responsive FAQ <= 2.8.5 - Admin+ Stored Cross-Site ScriptingHTML5 Responsive FAQ
- CVE-2021-24982Child Theme Generator <= 2.2.7 - Reflected Cross-Site ScriptingChild Theme Generator
- CVE-2021-24966Error Log Viewer Plugin <= 1.1.1 - Admin+ Arbitrary File ClearingError Log Viewer by BestWebSoft
- CVE-2021-24959WP Email Users <= 1.7.6 - Subscriber+ SQL InjectionWP Email Users
- CVE-2021-24958Meks Easy Photo Feed Widget < 1.2.4 - Subscriber+ Settings Update to Stored XSSMeks Easy Photo Feed Widget
- CVE-2021-24950Insight Core <= 1.0 - Subscriber+ PHP Object Injection & Stored XSSInsight Core
- CVE-2021-24940Persian Woocommerce <= 5.8.0 - Reflected Cross-Site Scriptingووکامرس فارسی
- CVE-2021-24897Add Subtitle <= 1.1.0 - Contributor+ Stored Cross-Site ScriptingAdd Subtitle
- CVE-2021-24895Cybersoldier < 1.7.0 - Admin+ Stored Cross-Site ScriptingCybersoldier
- CVE-2021-24692Simple Download Monitor < 3.9.5 - Contributor+ Arbitrary File Download via Path TraversalSimple Download Monitor
- CVE-2021-44964Use after free in garbage collector and finalizer of lgc.c in Lua interpreter 5.4.0~5.4.3 allows attackers to perform Sandbox Escape via a c
- CVE-2022-24576GPAC 1.0.1 is affected by Use After Free through MP4Box.
- CVE-2022-24575GPAC 1.0.1 is affected by a stack-based buffer overflow through MP4Box.
- CVE-2022-0940Stored XSS due to Unrestricted File Upload in star7th/showdocstar7th/showdoc · showdoc/showdoc
- CVE-2022-23943mod_sed: Read/write beyond boundsApache Software Foundation Apache HTTP Server
- CVE-2022-22721core: Possible buffer overflow with very large or unlimited LimitXMLRequestBodyApache Software Foundation Apache HTTP Server
- CVE-2022-22720HTTP request smuggling vulnerability in Apache HTTP Server 2.4.52 and earlierApache Software Foundation Apache HTTP Server
- CVE-2022-22719mod_lua Use of uninitialized value of in r:parsebodyApache Software Foundation Apache HTTP Server
- CVE-2022-0341Cross-site Scripting (XSS) - Stored in vanessa219/vditorvanessa219/vditor · vditor
- CVE-2022-0937Stored xss in showdoc through file upload in star7th/showdocstar7th/showdoc · showdoc/showdoc
- CVE-2021-43954The DefaultRepositoryAdminService class in Fisheye and Crucible before version 4.8.9 allowed remote attackers, who have 'can add repository Atlassian Fisheye · Atlassian Crucible
- CVE-2021-42387Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query.yandex clickhouse
- CVE-2021-42388Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query.yandex clickhouse
- CVE-2021-43304Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query.yandex clickhouse
- CVE-2021-43305Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query.yandex clickhouse
- CVE-2022-24385Information disclosure via direct object access on SmarterTrack v100.0.8019.14010SmarterTools SmarterTrack
- CVE-2022-24574GPAC 1.0.1 is affected by a NULL pointer dereference in gf_dump_vrml_field.isra ().
- CVE-2022-24577GPAC 1.0.1 is affected by a NULL pointer dereference in gf_utf8_wcslen.
- CVE-2022-24578GPAC 1.0.1 is affected by a heap-based buffer overflow in SFS_AddString () at bifs/script_dec.c.