# CVEs published 2022-03-14

91 CVEs were published on March 14, 2022: 4 critical, 8 high. Days are UTC.

- [CVE-2022-24762](https://cve.now/CVE-2022-24762.md): Exposure of Sensitive Information to an Unauthorized Actor in sysend.js (CVSS 6.5, jcubic sysend.js · sysend)
- [CVE-2021-42391](https://cve.now/CVE-2021-42391.md): Divide-by-zero in Clickhouse's Gorilla compression codec when parsing a malicious query. (no CVSS, yandex clickhouse)
- [CVE-2021-42390](https://cve.now/CVE-2021-42390.md): Divide-by-zero in Clickhouse's DeltaDouble compression codec when parsing a malicious query. (no CVSS, yandex clickhouse)
- [CVE-2021-42389](https://cve.now/CVE-2021-42389.md): Divide-by-zero in Clickhouse's Delta compression codec when parsing a malicious query. (no CVSS, yandex clickhouse)
- [CVE-2022-24740](https://cve.now/CVE-2022-24740.md): Improper Authentication in Volto (CVSS 5.0, plone volto · @plone/volto)
- [CVE-2022-24749](https://cve.now/CVE-2022-24749.md): Basic Cross-site Scripting and Unrestricted Upload of File with Dangerous Type in Sylius (CVSS 6.1, Sylius · sylius/sylius)
- [CVE-2022-24743](https://cve.now/CVE-2022-24743.md): Insufficient Session Expiration in Sylius (CVSS 7.1, Sylius · sylius/sylius)
- [CVE-2022-24742](https://cve.now/CVE-2022-24742.md): Exposure of Sensitive Information Due to Incompatible Policies in Sylius (CVSS 5.0, Sylius · sylius/sylius)
- [CVE-2022-24733](https://cve.now/CVE-2022-24733.md): Improper Restriction of Rendered UI Layers or Frames in Sylius (CVSS 6.1, Sylius · sylius/sylius)
- [CVE-2022-26320](https://cve.now/CVE-2022-26320.md): The Rambus SafeZone Basic Crypto Module before 10.4.0, as used in certain Fujifilm (formerly Fuji Xerox) devices before 2022-03-01, Canon im (no CVSS)
- [CVE-2022-21187](https://cve.now/CVE-2022-21187.md): Command Injection (CVSS 8.1, libvcs · vcspull)
- [CVE-2022-22353](https://cve.now/CVE-2022-22353.md): IBM Big SQL on IBM Cloud Pak for Data 7.1.0, 7.1.1, 7.2.0, and 7.2.3 could allow an authenticated user with appropriate permissions to obtai (CVSS 5.3, IBM Big SQL on Cloud Pak for Data)
- [CVE-2022-22348](https://cve.now/CVE-2022-22348.md): IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.13.xxx is vulnerable to reverse tabnabbing where it could allow a page linked t (CVSS 4.0, IBM Spectrum Protect Operations Center)
- [CVE-2022-22346](https://cve.now/CVE-2022-22346.md): IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.13.xxx is vulnerable to cross-site request forgery which could allow an attacke (CVSS 4.3, IBM Spectrum Protect Operations Center)
- [CVE-2021-38971](https://cve.now/CVE-2021-38971.md): IBM Data Virtualization on Cloud Pak for Data 1.3.0, 1.4.1, 1.5.0, 1.7.1 and 1.7.3 could allow an authorized user to bypass data masking rul (CVSS 4.9, IBM Data Virtualization on Cloud Pak for Data)
- [CVE-2022-22354](https://cve.now/CVE-2022-22354.md): IBM Spectrum Protect Plus 10.1.0.0 through 10.1.9.2 and IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 do not limit the length o (CVSS 6.2, IBM Spectrum Copy Data Management · IBM Spectrum Protect Pl…)
- [CVE-2022-22344](https://cve.now/CVE-2022-22344.md): IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 is vulnerable to HTTP header injection, caused by improper validation of input by (CVSS 4.8, IBM Spectrum Copy Data Management)
- [CVE-2021-39055](https://cve.now/CVE-2021-39055.md): IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Spectrum Copy Data Management)
- [CVE-2021-39051](https://cve.now/CVE-2021-39051.md): IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 is vulnerable to server-side request forgery, caused by improper input of applica (CVSS 4.8, IBM Spectrum Copy Data Management)
- [CVE-2022-0962](https://cve.now/CVE-2022-0962.md): Stored XSS viva .webma file upload in star7th/showdoc (CVSS 9.0, star7th/showdoc · showdoc/showdoc)
- [CVE-2021-41952](https://cve.now/CVE-2021-41952.md): Zenario CMS 9.0.54156 is vulnerable to Cross Site Scripting (XSS) via upload file to \*.SVG. (no CVSS, tribalsystems/zenario)
- [CVE-2021-42171](https://cve.now/CVE-2021-42171.md): Zenario CMS 9.0.54156 is vulnerable to File Upload. (no CVSS, tribalsystems/zenario)
- [CVE-2022-0960](https://cve.now/CVE-2022-0960.md): Stored XSS viva .properties file upload in star7th/showdoc (CVSS 9.0, star7th/showdoc · showdoc/showdoc)
- [CVE-2022-22735](https://cve.now/CVE-2022-22735.md): Simple Quotation \<= 1.3.2 - Subscriber+ SQL injection (no CVSS, Simple Quotation)
- [CVE-2022-22734](https://cve.now/CVE-2022-22734.md): Simple Quotation \<= 1.3.2 - Quote Creation/Edition via CSRF to Stored Cross-Site Scripting (no CVSS, Simple Quotation)
- [CVE-2022-0703](https://cve.now/CVE-2022-0703.md): GD Mylist \<= 1.1.1 - Admin+ Stored Cross-Site Scripting (no CVSS, GDMylist)
- [CVE-2022-0702](https://cve.now/CVE-2022-0702.md): Petfinder Listings \<= 1.0.18 - Admin+ Stored Cross-Site Scripting (no CVSS, Petfinder Listings)
- [CVE-2022-0701](https://cve.now/CVE-2022-0701.md): SEO 301 Meta \<= 1.9.1 - Admin+ Stored Cross-Site Scripting (no CVSS, Seo 301 Meta)
- [CVE-2022-0700](https://cve.now/CVE-2022-0700.md): Simple Theme Options \< 1.7 - Admin+ Stored Cross-Site Scripting (no CVSS, Simple Tracking)
- [CVE-2022-0684](https://cve.now/CVE-2022-0684.md): WP Home Page Menu \< 3.1 - Admin+ Stored Cross-Site Scripting (no CVSS, WP Home Page Menu)
- [CVE-2022-0674](https://cve.now/CVE-2022-0674.md): Kunze Law \< 2.1 - Admin+ Stored Cross-Site Scripting (no CVSS, Kunze Law)
- [CVE-2022-0659](https://cve.now/CVE-2022-0659.md): Sync iCloud COS \< 2.0.1 - Admin+ Stored Cross-Site Scripting (no CVSS, Sync QCloud COS)
- [CVE-2022-0658](https://cve.now/CVE-2022-0658.md): CommonsBooking \< 2.6.8 - Unauthenticated SQL Injection (no CVSS, CommonsBooking)
- [CVE-2022-0648](https://cve.now/CVE-2022-0648.md): Team Circle Image Slider With Lightbox \< 1.0.16 - Reflected Cross-Site Scripting (no CVSS, Team Circle Image Slider With Lightbox)
- [CVE-2022-0601](https://cve.now/CVE-2022-0601.md): Countdown & Clock \< 2.2.9 - Reflected Cross-Site Scripting (no CVSS, Countdown, Coming Soon, Maintenance – Countdown & Clock)
- [CVE-2022-0593](https://cve.now/CVE-2022-0593.md): Login with phone number \< 1.3.7 - Unauthenticated remote plugin deletion (no CVSS, Login with phone number)
- [CVE-2022-0503](https://cve.now/CVE-2022-0503.md): Multisite Content Copier/Updater \< 2.1.2 - Reflected Cross-Site Scripting (no CVSS, WordPress Multisite Content Copier/Updater)
- [CVE-2022-0478](https://cve.now/CVE-2022-0478.md): Event Manager for WooCommerce \< 3.5.8 - Contributor+ SQL Injection (no CVSS, Event Manager and Tickets Selling Plugin for WooCommerce)
- [CVE-2022-0449](https://cve.now/CVE-2022-0449.md): Flexi - Guest Submit \< 4.20 - Reflected Cross-Site Scripting (no CVSS, Flexi – Guest Submit)
- [CVE-2022-0399](https://cve.now/CVE-2022-0399.md): Advanced Product Labels for WooCommerce \< 1.2.3.7 - Reflected Cross-Site Scripting (no CVSS, Advanced Product Labels for WooCommerce)
- [CVE-2022-0327](https://cve.now/CVE-2022-0327.md): Master Addons for Elementor \< 1.8.2 - Reflected Cross-Site Scripting (no CVSS, Master Addons for Elementor)
- [CVE-2022-0321](https://cve.now/CVE-2022-0321.md): WP Voting Contest \< 3.0 - Reflected Cross-Site Scripting (no CVSS, WP Voting Contest)
- [CVE-2022-0254](https://cve.now/CVE-2022-0254.md): Zero Spam \< 5.2.11 - Admin+ SQL Injection (no CVSS, WordPress Zero Spam · bmarshall511/wordpress\_zero\_spam)
- [CVE-2022-0248](https://cve.now/CVE-2022-0248.md): Contact Form Submissions \< 1.7.3 - Unauthenticated Stored XSS (no CVSS, Contact Form Submissions)
- [CVE-2022-0230](https://cve.now/CVE-2022-0230.md): Better WordPress Google XML Sitemaps \<= 1.4.1 - Unauthenticated Stored Cross-Site Scripting (no CVSS, Better WordPress Google XML Sitemaps)
- [CVE-2022-0169](https://cve.now/CVE-2022-0169.md): Photo Gallery by 10Web \< 1.6.0 - Unauthenticated SQL Injection (no CVSS, Photo Gallery by 10Web – Mobile-Friendly Image Gallery)
- [CVE-2022-0165](https://cve.now/CVE-2022-0165.md): Page Builder KingComposer \<= 2.9.6 - Open Redirect (no CVSS, Page Builder: KingComposer – Free Drag and Drop page builde…)
- [CVE-2022-0161](https://cve.now/CVE-2022-0161.md): ARI Fancy Lightbox \< 1.3.9 - Reflected Cross-Site Scripting (no CVSS, ARI Fancy Lightbox – WordPress Popup)
- [CVE-2022-0147](https://cve.now/CVE-2022-0147.md): Cookie Information \< 2.0.8 - Reflected Cross-Site Scripting (no CVSS, Cookie Information | Free GDPR Consent Solution)
- [CVE-2021-25026](https://cve.now/CVE-2021-25026.md): Patreon WordPress \< 1.8.2 - Admin+ Stored Cross-Site Scripting (no CVSS, Patreon WordPress)
- [CVE-2021-25007](https://cve.now/CVE-2021-25007.md): MOLIE \<= 0.5 - Authenticated SQL Injection (no CVSS, MOLIE – Instructure Canvas Linking tool)
- [CVE-2021-25006](https://cve.now/CVE-2021-25006.md): MOLIE \<= 0.5 - Reflected Cross-Site Scripting (no CVSS, MOLIE – Instructure Canvas Linking tool)
- [CVE-2021-25003](https://cve.now/CVE-2021-25003.md): WPCargo \< 6.9.0 - Unauthenticated RCE (no CVSS, WPCargo Track & Trace)
- [CVE-2021-24996](https://cve.now/CVE-2021-24996.md): IDPay for Contact Form 7 \<= 2.1.2 - Reflected Cross-Site Scripting (no CVSS, IDPay for Contact Form)
- [CVE-2021-24995](https://cve.now/CVE-2021-24995.md): HTML5 Responsive FAQ \<= 2.8.5 - Admin+ Stored Cross-Site Scripting (no CVSS, HTML5 Responsive FAQ)
- [CVE-2021-24982](https://cve.now/CVE-2021-24982.md): Child Theme Generator \<= 2.2.7 - Reflected Cross-Site Scripting (no CVSS, Child Theme Generator)
- [CVE-2021-24966](https://cve.now/CVE-2021-24966.md): Error Log Viewer Plugin \<= 1.1.1 - Admin+ Arbitrary File Clearing (no CVSS, Error Log Viewer by BestWebSoft)
- [CVE-2021-24959](https://cve.now/CVE-2021-24959.md): WP Email Users \<= 1.7.6 - Subscriber+ SQL Injection (no CVSS, WP Email Users)
- [CVE-2021-24958](https://cve.now/CVE-2021-24958.md): Meks Easy Photo Feed Widget \< 1.2.4 - Subscriber+ Settings Update to Stored XSS (no CVSS, Meks Easy Photo Feed Widget)
- [CVE-2021-24950](https://cve.now/CVE-2021-24950.md): Insight Core \<= 1.0 - Subscriber+ PHP Object Injection & Stored XSS (no CVSS, Insight Core)
- [CVE-2021-24940](https://cve.now/CVE-2021-24940.md): Persian Woocommerce \<= 5.8.0 - Reflected Cross-Site Scripting (no CVSS, ووکامرس فارسی)
- [CVE-2021-24897](https://cve.now/CVE-2021-24897.md): Add Subtitle \<= 1.1.0 - Contributor+ Stored Cross-Site Scripting (no CVSS, Add Subtitle)
- [CVE-2021-24895](https://cve.now/CVE-2021-24895.md): Cybersoldier \< 1.7.0 - Admin+ Stored Cross-Site Scripting (no CVSS, Cybersoldier)
- [CVE-2021-24692](https://cve.now/CVE-2021-24692.md): Simple Download Monitor \< 3.9.5 - Contributor+ Arbitrary File Download via Path Traversal (no CVSS, Simple Download Monitor)
- [CVE-2021-44964](https://cve.now/CVE-2021-44964.md): Use after free in garbage collector and finalizer of lgc.c in Lua interpreter 5.4.0~5.4.3 allows attackers to perform Sandbox Escape via a c (no CVSS)
- [CVE-2022-24576](https://cve.now/CVE-2022-24576.md): GPAC 1.0.1 is affected by Use After Free through MP4Box. (no CVSS)
- [CVE-2022-24575](https://cve.now/CVE-2022-24575.md): GPAC 1.0.1 is affected by a stack-based buffer overflow through MP4Box. (no CVSS)
- [CVE-2022-0946](https://cve.now/CVE-2022-0946.md): Stored XSS viva cshtm file upload in star7th/showdoc (CVSS 9.0, star7th/showdoc · showdoc/showdoc)
- [CVE-2022-0941](https://cve.now/CVE-2022-0941.md): Stored XSS due to Unrestricted File Upload in star7th/showdoc (CVSS 7.3, star7th/showdoc · showdoc/showdoc)
- [CVE-2022-24387](https://cve.now/CVE-2022-24387.md): File upload and overwrite to app\_data/Config in SmarterTrack v100.0.8019.14010 (CVSS 9.1, SmarterTools SmarterTrack)
- [CVE-2022-0940](https://cve.now/CVE-2022-0940.md): Stored XSS due to Unrestricted File Upload in star7th/showdoc (CVSS 6.3, star7th/showdoc · showdoc/showdoc)
- [CVE-2022-23943](https://cve.now/CVE-2022-23943.md): mod\_sed: Read/write beyond bounds (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2022-22721](https://cve.now/CVE-2022-22721.md): core: Possible buffer overflow with very large or unlimited LimitXMLRequestBody (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2022-22720](https://cve.now/CVE-2022-22720.md): HTTP request smuggling vulnerability in Apache HTTP Server 2.4.52 and earlier (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2022-22719](https://cve.now/CVE-2022-22719.md): mod\_lua Use of uninitialized value of in r:parsebody (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2022-0938](https://cve.now/CVE-2022-0938.md): Stored XSS via file upload in star7th/showdoc (CVSS 7.1, star7th/showdoc · showdoc/showdoc)
- [CVE-2022-0341](https://cve.now/CVE-2022-0341.md): Cross-site Scripting (XSS) - Stored in vanessa219/vditor (CVSS 6.6, vanessa219/vditor · vditor)
- [CVE-2022-0937](https://cve.now/CVE-2022-0937.md): Stored xss in showdoc through file upload in star7th/showdoc (CVSS 6.3, star7th/showdoc · showdoc/showdoc)
- [CVE-2021-43954](https://cve.now/CVE-2021-43954.md): The DefaultRepositoryAdminService class in Fisheye and Crucible before version 4.8.9 allowed remote attackers, who have 'can add repository (no CVSS, Atlassian Fisheye · Atlassian Crucible)
- [CVE-2021-42387](https://cve.now/CVE-2021-42387.md): Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query. (no CVSS, yandex clickhouse)
- [CVE-2021-42388](https://cve.now/CVE-2021-42388.md): Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query. (no CVSS, yandex clickhouse)
- [CVE-2021-43304](https://cve.now/CVE-2021-43304.md): Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query. (no CVSS, yandex clickhouse)
- [CVE-2021-43305](https://cve.now/CVE-2021-43305.md): Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query. (no CVSS, yandex clickhouse)
- [CVE-2022-0943](https://cve.now/CVE-2022-0943.md): Heap-based Buffer Overflow occurs in vim in vim/vim (CVSS 8.4, vim/vim)
- [CVE-2022-20001](https://cve.now/CVE-2022-20001.md): Injection in fish (CVSS 7.8, fish-shell)
- [CVE-2022-24384](https://cve.now/CVE-2022-24384.md): Reflective XSS on SmarterTrack v100.0.8019.14010 (CVSS 8.8, SmarterTools SmarterTrack)
- [CVE-2022-24385](https://cve.now/CVE-2022-24385.md): Information disclosure via direct object access on SmarterTrack v100.0.8019.14010 (CVSS 6.5, SmarterTools SmarterTrack)
- [CVE-2022-24386](https://cve.now/CVE-2022-24386.md): Stored XSS in SmarterTrack v100.0.8019.14010 (CVSS 8.8, SmarterTools SmarterTrack)
- [CVE-2022-24574](https://cve.now/CVE-2022-24574.md): GPAC 1.0.1 is affected by a NULL pointer dereference in gf\_dump\_vrml\_field.isra (). (no CVSS)
- [CVE-2022-24577](https://cve.now/CVE-2022-24577.md): GPAC 1.0.1 is affected by a NULL pointer dereference in gf\_utf8\_wcslen. (no CVSS)
- [CVE-2022-24578](https://cve.now/CVE-2022-24578.md): GPAC 1.0.1 is affected by a heap-based buffer overflow in SFS\_AddString () at bifs/script\_dec.c. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-03-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.