CVEs published March 15, 2022
96 CVEs were published on March 15, 2022: 6 critical, 15 high.
- Published
- 96
- Critical
- 6
- High
- 15
- Medium
- 8
- Low
- 1
- Unrated
- 66
- Now in CISA KEV
- 0
- Fix available
- 36
Most affected products
- star7th/showdoc · showdoc/showdoc
- 10
- Jenkins project Jenkins Extended Choice Parameter Plugin ·…
- 4
- Jenkins project Jenkins Kubernetes Continuous Deploy Plugin…
- 4
- microweber/microweber
- 4
- bareos
- 2
- Jenkins project Jenkins CloudBees AWS Credentials Plugin ·…
- 2
- Jenkins project Jenkins Release Helper Plugin · org.jenkins…
- 2
- pimcore/pimcore
- 2
- Apache Software Foundation Apache CloudStack
- 1
- code.gitea.io/gitea
- 1
Critical 6
- CVE-2022-22771TIBCO JasperReports Library Directory Traversal VulnerabilityTIBCO Software TIBCO JasperReports Library · TIBCO Software…
- CVE-2022-0965Stored XSS viva .ofd file upload in star7th/showdocstar7th/showdoc · showdoc/showdoc
- CVE-2022-24752SQL Injection through sorting parameters in SyliusGridBundleSyliusGridBundle · sylius/grid-bundle
- CVE-2022-0942Stored XSS due to Unrestricted File Upload in star7th/showdocstar7th/showdoc · showdoc/showdoc
- CVE-2022-0945Stored XSS viva axd and cshtml file upload in star7th/showdoc in star7th/showdocstar7th/showdoc · showdoc/showdoc
- CVE-2022-0944Template injection in connection test endpoint leads to RCE in sqlpad/sqlpadsqlpad/sqlpad
High 15
- CVE-2022-27004Totolink routers s X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 were discovered to contain a command injection vulnerabil
- CVE-2022-27005Totolink routers s X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 were discovered to contain a command injection vulnerabil
- CVE-2022-27003Totolink routers s X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 were discovered to contain a command injection vulnerabil
- CVE-2022-0778Infinite loop in BN_mod_sqrt() reachable when parsing certificatesOpenSSL · mariadb +5
- CVE-2022-0970Cross-site Scripting (XSS) - Stored in getgrav/gravgetgrav/grav
- CVE-2022-0968The microweber application allows large characters to insert in the input field "fist & last name" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request. in microweber/microweber in microweber/microwebermicroweber/microweber
- CVE-2022-0964Stored XSS viva .webmv file upload in star7th/showdocstar7th/showdoc · showdoc/showdoc
- CVE-2022-0961The microweber application allows large characters to insert in the input field "post title" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request. in microweber/microwebermicroweber/microweber
- CVE-2022-24756Missing Release of Memory after Effective Lifetime in Bareos Directorbareos
- CVE-2022-24755Incorrect Authorization in Bareos Directorbareos
- CVE-2022-24721Incorrect Authorization in org.cometd.oortcometd · org.cometd.java:cometd-java-oort
- CVE-2022-0957Stored XSS via File Upload in star7th/showdocstar7th/showdoc · showdoc/showdoc
- CVE-2022-0956Stored XSS via File Upload in star7th/showdocstar7th/showdoc · showdoc/showdoc
- CVE-2022-0894Cross-site Scripting (XSS) - Stored in pimcore/pimcorepimcore/pimcore
- CVE-2022-0951File Upload Restriction Bypass leading to Stored XSS Vulnerability in star7th/showdocstar7th/showdoc · showdoc/showdoc
Medium, low and unrated 75
- CVE-2022-27223In drivers/usb/gadget/udc/udc-xilinx.c in the Linux kernel before 5.16.12, the endpoint index is not validated and might be manipulated by t
- CVE-2020-36519Mimecast Email Security before 2020-01-10 allows any admin to spoof any domain, and pass DMARC alignment via SPF.
- CVE-2022-27002Arris TR3300 v1.0.13 were discovered to contain a command injection vulnerability in the ddns function via the ddns_name, ddns_pwd, h_ddns、d
- CVE-2022-27001Arris TR3300 v1.0.13 were discovered to contain a command injection vulnerability in the dhcp function via the hostname parameter.
- CVE-2022-26999Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the static ip settings function via the wan_ip_stat, wan
- CVE-2022-27000Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the time and time zone function via the h_primary_ntp_se
- CVE-2022-26998Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the wps setting function via the wps_enrolee_pin paramet
- CVE-2022-26996Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the pppoe function via the pppoe_username, pppoe_passwd,
- CVE-2022-26997Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the upnp function via the upnp_ttl parameter.
- CVE-2022-26995Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the pptp (wan_pptp.html) function via the pptp_fix_ip, p
- CVE-2022-26993Arris routers SBR-AC1900P 1.0.7-B05, SBR-AC3200P 1.0.7-B05 and SBR-AC1200P 1.0.5-B05 were discovered to contain a command injection vulnerab
- CVE-2022-26994Arris routers SBR-AC1900P 1.0.7-B05, SBR-AC3200P 1.0.7-B05 and SBR-AC1200P 1.0.5-B05 were discovered to contain a command injection vulnerab
- CVE-2022-26992Arris routers SBR-AC1900P 1.0.7-B05, SBR-AC3200P 1.0.7-B05 and SBR-AC1200P 1.0.5-B05 were discovered to contain a command injection vulnerab
- CVE-2022-26990Arris routers SBR-AC1900P 1.0.7-B05, SBR-AC3200P 1.0.7-B05 and SBR-AC1200P 1.0.5-B05 were discovered to contain a command injection vulnerab
- CVE-2022-26991Arris routers SBR-AC1900P 1.0.7-B05, SBR-AC3200P 1.0.7-B05 and SBR-AC1200P 1.0.5-B05 were discovered to contain a command injection vulnerab
- CVE-2022-26213Totolink X5000R_Firmware v9.1.0u.6118_B20201102 was discovered to contain a command injection vulnerability in the function setNtpCfg, via t
- CVE-2022-26214Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU
- CVE-2022-26211Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU
- CVE-2022-26212Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU
- CVE-2022-26209Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU
- CVE-2022-26210Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU
- CVE-2022-26207Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU
- CVE-2022-26208Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU
- CVE-2022-26206Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU
- CVE-2021-29134The avatar middleware in Gitea before 1.13.6 allows Directory Traversal via a crafted URL.code.gitea.io/gitea
- CVE-2022-23989In Stormshield Network Security (SNS) before 3.7.25, 3.8.x through 3.11.x before 3.11.13, 4.x before 4.2.10, and 4.3.x before 4.3.5, a flood
- CVE-2022-25485CuppaCMS v1.0 was discovered to contain a local file inclusion via the url parameter in /alerts/alertLightbox.php.
- CVE-2022-25486CuppaCMS v1.0 was discovered to contain a local file inclusion via the url parameter in /alerts/alertConfigField.php.
- CVE-2022-25487Atom CMS v2.0 was discovered to contain a remote code execution (RCE) vulnerability via /admin/uploads.php.
- CVE-2022-25488Atom CMS v2.0 was discovered to contain a SQL injection vulnerability via the id parameter in /admin/ajax/avatar.php.
- CVE-2022-25489Atom CMS v2.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the "A" parameter in /widgets/debug.php.
- CVE-2022-25490HMS v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter in department.php.
- CVE-2022-25491HMS v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter in appointment.php.
- CVE-2022-25492HMS v1.0 was discovered to contain a SQL injection vulnerability via the medicineid parameter in ajaxmedicine.php.
- CVE-2022-25493HMS v1.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via treatmentrecord.php.
- CVE-2022-25494Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via staff_login.php.
- CVE-2022-25495The component /jquery_file_upload/server/php/index.php of CuppaCMS v1.0 allows attackers to upload arbitrary files and execute arbitrary cod
- CVE-2022-25497CuppaCMS v1.0 was discovered to contain an arbitrary file read via the copy function.
- CVE-2022-25498CuppaCMS v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the saveConfigData function in /classes/ajax/Functio
- CVE-2020-4989IBM Engineering Workflow Management 7.0, 7.0.1, and 7.0.2 and IBM Rational Team Concert 6.0.6 and 6.0.0.1 could allow an authenticated user IBM Engineering Workflow Management · IBM Rational Team Con…
- CVE-2022-27218Jenkins incapptic connect uploader Plugin 1.15 and earlier stores tokens unencrypted in job config.xml files on the Jenkins controller whereJenkins project Jenkins incapptic connect uploader Plugin ·…
- CVE-2022-27217Jenkins Vmware vRealize CodeStream Plugin 1.2 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller wheJenkins project Jenkins Vmware vRealize CodeStream Plugin ·…
- CVE-2022-27216Jenkins dbCharts Plugin 0.5.2 and earlier stores JDBC connection passwords unencrypted in its global configuration file on the Jenkins contrJenkins project Jenkins dbCharts Plugin · org.jenkins-ci.pl…
- CVE-2022-27215A missing permission check in Jenkins Release Helper Plugin 1.3.3 and earlier allows attackers with Overall/Read permission to connect to anJenkins project Jenkins Release Helper Plugin · org.jenkins…
- CVE-2022-27214A cross-site request forgery (CSRF) vulnerability in Jenkins Release Helper Plugin 1.3.3 and earlier allows attackers to connect to an attacJenkins project Jenkins Release Helper Plugin · org.jenkins…
- CVE-2022-27213Jenkins Environment Dashboard Plugin 1.1.10 and earlier does not escape the Environment order and the Component order configuration values iJenkins project Jenkins Environment Dashboard Plugin · io.j…
- CVE-2022-27212Jenkins List Git Branches Parameter Plugin 0.0.9 and earlier does not escape the name of the 'List Git branches (and more)' parameter, resulJenkins project Jenkins List Git Branches Parameter Plugin…
- CVE-2022-27211A missing permission check in Jenkins Kubernetes Continuous Deploy Plugin 2.3.1 and earlier allows attackers with Overall/Read permission toJenkins project Jenkins Kubernetes Continuous Deploy Plugin…
- CVE-2022-27210A cross-site request forgery (CSRF) vulnerability in Jenkins Kubernetes Continuous Deploy Plugin 2.3.1 and earlier allows attackers to conneJenkins project Jenkins Kubernetes Continuous Deploy Plugin…
- CVE-2022-27209A missing permission check in Jenkins Kubernetes Continuous Deploy Plugin 2.3.1 and earlier allows attackers with Overall/Read permission toJenkins project Jenkins Kubernetes Continuous Deploy Plugin…
- CVE-2022-27208Jenkins Kubernetes Continuous Deploy Plugin 2.3.1 and earlier allows users with Credentials/Create permission to read arbitrary files on theJenkins project Jenkins Kubernetes Continuous Deploy Plugin…
- CVE-2022-27207Jenkins global-build-stats Plugin 1.5 and earlier does not escape multiple fields in the chart configuration on the 'Global Build Stats' pagJenkins project Jenkins global-build-stats Plugin · org.jen…
- CVE-2022-27206Jenkins GitLab Authentication Plugin 1.13 and earlier stores the GitLab client secret unencrypted in the global config.xml file on the JenkiJenkins project Jenkins GitLab Authentication Plugin · org.…
- CVE-2022-27205A missing permission check in Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier allows attackers with Overall/Read perJenkins project Jenkins Extended Choice Parameter Plugin ·…
- CVE-2022-27204A cross-site request forgery vulnerability in Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier allows attackers to coJenkins project Jenkins Extended Choice Parameter Plugin ·…
- CVE-2022-27203Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier allows attackers with Item/Configure permission to read values from Jenkins project Jenkins Extended Choice Parameter Plugin ·…
- CVE-2022-27202Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier does not escape the value and description of extended choice parametJenkins project Jenkins Extended Choice Parameter Plugin ·…
- CVE-2022-27201Jenkins Semantic Versioning Plugin 1.13 and earlier does not restrict execution of an controller/agent message to agents, and implements no Jenkins project Jenkins Semantic Versioning Plugin · org.je…
- CVE-2022-27200Jenkins Folder-based Authorization Strategy Plugin 1.3 and earlier does not escape the names of roles shown on the configuration form, resulJenkins project Jenkins Folder-based Authorization Strategy…
- CVE-2022-27199A missing permission check in Jenkins CloudBees AWS Credentials Plugin 189.v3551d5642995 and earlier allows attackers with Overall/Read permJenkins project Jenkins CloudBees AWS Credentials Plugin ·…
- CVE-2022-27198A cross-site request forgery (CSRF) vulnerability in Jenkins CloudBees AWS Credentials Plugin 189.v3551d5642995 and earlier allows attackersJenkins project Jenkins CloudBees AWS Credentials Plugin ·…
- CVE-2022-27197Jenkins Dashboard View Plugin 2.18 and earlier does not perform URL validation for the Iframe Portlet's Iframe source URL, resulting in a stJenkins project Jenkins Dashboard View Plugin · org.jenkins…
- CVE-2022-27196Jenkins Favorite Plugin 2.4.0 and earlier does not escape the names of jobs in the favorite column, resulting in a stored cross-site scriptiJenkins project Jenkins Favorite Plugin · org.jvnet.hudson.…
- CVE-2022-27195Jenkins Parameterized Trigger Plugin 2.43 and earlier captures environment variables passed to builds triggered using Jenkins Parameterized Jenkins project Jenkins Parameterized Trigger Plugin · org.…
- CVE-2022-26779Apache Cloudstack insecure random number generation affects project email invitationApache Software Foundation Apache CloudStack
- CVE-2022-0966Stored XSS via File Upload in star7th/showdoc in star7th/showdocstar7th/showdoc · showdoc/showdoc
- CVE-2022-0967Stored XSS via File Upload in star7th/showdoc in star7th/showdoc in star7th/showdocstar7th/showdoc · showdoc/showdoc
- CVE-2022-0963Unrestricted XML Files Leads to Stored XSS in microweber/microwebermicroweber/microweber
- CVE-2022-0430Exposure of Sensitive Information to an Unauthorized Actor in httpie/httpiehttpie/httpie · httpie
- CVE-2022-0954Multiple Stored Cross-site Scripting (XSS) Vulnerabilities in Shop's Other Settings, Shop's Autorespond E-mail Settings and Shops' Payments Methods in microweber/microwebermicroweber/microweber
- CVE-2021-45010A path traversal vulnerability in the file upload functionality in tinyfilemanager.php in Tiny File Manager before 2.4.7 allows remote attac
- CVE-2022-0893Cross-site Scripting (XSS) - Stored in pimcore/pimcorepimcore/pimcore
- CVE-2022-0950Unrestricted Upload of File with Dangerous Type in star7th/showdocstar7th/showdoc · showdoc/showdoc
- CVE-2022-27193CVRF-CSAF-Converter before 1.0.0-rc2 resolves XML External Entities (XXE).cvrf2csaf
- CVE-2021-45848Denial of service (DoS) vulnerability in Nicotine+ 3.0.3 and later allows a user with a modified Soulseek client to crash Nicotine+ by sendinicotine-plus