CVEs published March 16, 2022
149 CVEs were published on March 16, 2022: 6 critical, 32 high. 1 is now in CISA KEV.
- Published
- 149
- Critical
- 6
- High
- 32
- Medium
- 28
- Low
- 4
- Unrated
- 79
- Now in CISA KEV
- 1
- Fix available
- 20
Most affected products
- Android
- 50
- Adobe Audition
- 9
- Adobe Bridge
- 9
- Adobe Character Animator
- 8
- Adobe Premiere Elements
- 7
- PTC Axeda agent · PTC Axeda Desktop Server for Windows
- 7
- Adobe Media Encoder
- 6
- Adobe Premiere
- 6
- Atlassian Fisheye · Atlassian Crucible
- 4
- pimcore/pimcore
- 3
Critical 6
- CVE-2022-23610Improper Verification of Cryptographic Signature in wire-serverwireapp wire-server
- CVE-2022-23812Malicious Packagenode-ipc
- CVE-2022-25251PTC Axeda agent and Axeda Desktop Server Missing Authentication For Critical FunctionPTC Axeda agent · PTC Axeda Desktop Server for Windows
- CVE-2022-25246PTC Axeda agent and Axeda Desktop Server Use of Hard-Coded CredentialsPTC Axeda agent · PTC Axeda Desktop Server for Windows
- CVE-2022-25247PTC Axeda agent and Axeda Desktop Server Missing Authentication For Critical FunctionPTC Axeda agent · PTC Axeda Desktop Server for Windows
- CVE-2021-43958Various rest resources in Fisheye and Crucible before version 4.8.9 allowed remote attackers to brute force user login credentials as rest rAtlassian Fisheye · Atlassian Crucible
High 32
- CVE-2021-39793In kbase_jd_user_buf_pin_pages of mali_kbase_mem.c, there is a possible out of bounds write due to a logic error in the code.Android
- CVE-2022-25252PTC Axeda agent and Axeda Desktop Server Improper Check or Handling Of Exceptional ConditionsPTC Axeda agent · PTC Axeda Desktop Server for Windows
- CVE-2022-25250PTC Axeda agent and Axeda Desktop Server Missing Authentication For Critical FunctionPTC Axeda agent · PTC Axeda Desktop Server for Windows
- CVE-2022-25249PTC Axeda agent and Axeda Desktop Server Path TraversalPTC Axeda agent · PTC Axeda Desktop Server for Windows
- CVE-2021-40735Adobe Audition Memory Corruption could lead to Arbitrary code executionAdobe Audition
- CVE-2021-40738Adobe Audition WAV file Memory corruption could lead to Arbitrary code executionAdobe Audition
- CVE-2021-40734Adobe Audition Memory Corruption could lead to Arbitrary code executionAdobe Audition
- CVE-2021-40740Adobe Audition Memory Corruption could lead to Arbitrary code executionAdobe Audition
- CVE-2021-40739Adobe Audition Memory Corruption could lead to Arbitrary code executionAdobe Audition
- CVE-2021-40736Adobe Audition Memory Corruption could lead to Arbitrary code executionAdobe Audition
- CVE-2021-42728Adobe Bridge Buffer Overflow Arbitrary code executionAdobe Bridge
- CVE-2021-40793Adobe Premiere Pro WAV file memory corruption vulnerability could lead to arbitrary code executionAdobe Premiere
- CVE-2021-40765Adobe Character Animator Memory Corruption could lead to Arbitrary code executionAdobe Character Animator
- CVE-2021-40794Adobe Premiere Pro MOV file memory corruption vulnerability could lead to arbitrary code executionAdobe Premiere
- CVE-2021-40792Adobe Premiere Pro WAV file memory corruption vulnerability could lead to arbitrary code executionAdobe Premiere
- CVE-2021-42526Adobe Premiere Elements WAV file memory corruption vulnerability could lead to arbitrary code executionAdobe Premiere Elements
- CVE-2021-42527Adobe Premiere Elements PSD file memory corruption vulnerability could lead to arbitrary code executionAdobe Premiere Elements
- CVE-2021-40786Adobe Premiere Elements M4A file memory corruption vulnerability could lead to arbitrary code executionAdobe Premiere Elements
- CVE-2021-40787Adobe Premiere Elements M4A file memory corruption vulnerability could lead to arbitrary code executionAdobe Premiere Elements
- CVE-2021-42724Adobe Bridge Memory Corruption could lead to Arbitrary code executionAdobe Bridge
- CVE-2021-42722Adobe Bridge Out-of-bounds read could lead to Arbitrary Code ExecutionAdobe Bridge
- CVE-2021-42729Adobe Bridge Memory Corruption could lead to Arbitrary code executionAdobe Bridge
- CVE-2021-42720Adobe Bridge Out-of-bounds read could lead to Arbitrary Code ExecutionAdobe Bridge
- CVE-2021-40763Adobe Character Animator Memory Corruption could lead to Arbitrary code executionAdobe Character Animator
- CVE-2021-40764Adobe Character Animator Memory Corruption could lead to Arbitrary code executionAdobe Character Animator
- CVE-2021-42730Adobe Bridge Memory Corruption could lead to Arbitrary code executionAdobe Bridge
- CVE-2021-42719Adobe Bridge Out-of-bounds read could lead to Arbitrary Code ExecutionAdobe Bridge
- CVE-2021-42533Adobe Bridge DCM File Parsing Double Free Remote Code Execution VulnerabilityAdobe Bridge
- CVE-2021-40780Adobe Media Encoder MXF file memory corruption vulnerability could lead to arbitrary code executionAdobe Media Encoder
- CVE-2021-40779Adobe Media Encoder WAV file memory corruption vulnerability could lead to arbitrary code executionAdobe Media Encoder
- CVE-2021-40777Adobe Media Encoder WAV file memory corruption vulnerability could lead to arbitrary code executionAdobe Media Encoder
- CVE-2021-43957Affected versions of Atlassian Fisheye & Crucible allowed remote attackers to browse local files via an Insecure Direct Object References (IAtlassian Fisheye · Atlassian Crucible
Medium, low and unrated 111
- CVE-2022-26534FISCO-BCOS release-3.0.0-rc2 was discovered to contain an issue where a malicious node, via a malicious viewchange packet, will cause normal
- CVE-2022-26300EOS v2.1.0 was discovered to contain a heap-buffer-overflow via the function txn_test_gen_plugin.
- CVE-2021-42219Go-Ethereum v1.10.9 was discovered to contain an issue which allows attackers to cause a denial of service (DoS) via sending an excessive amgithub.com/ethereum/go-ethereum
- CVE-2022-26295A stored cross-site scripting (XSS) vulnerability in /ptms/?page=user of Online Project Time Management System v1.0 allows attackers to exec
- CVE-2022-26293Online Project Time Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter in the function save
- CVE-2021-23648Cross-site Scripting (XSS)@braintree/sanitize-url
- CVE-2021-45822A cross-site scripting vulnerability is present in Xbtit 3.1.
- CVE-2022-21164Denial of Service (DoS)node-lmdb
- CVE-2021-45821A blind SQL injection vulnerability exists in Xbtit 3.1 via the sid parameter in ajaxchat/getHistoryChatData.php file that is accessible by
- CVE-2021-41987In the SCEP Server of RouterOS in certain Mikrotik products, an attacker can trigger a heap-based buffer overflow that leads to remote code
- CVE-2022-26660RunAsSpc 4.0 uses a universal and recoverable encryption key.
- CVE-2022-23234SnapCenter versions prior to 4.5 are susceptible to a vulnerability which could allow a local authenticated attacker to discover plaintext HSnapCenter
- CVE-2021-20180A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature wAnsible
- CVE-2021-23165A flaw was found in htmldoc before v1.9.12.htmldoc
- CVE-2021-23158A flaw was found in htmldoc in v1.9.12.htmldoc
- CVE-2021-20257An infinite loop flaw was found in the e1000 NIC emulator of the QEMU.QEMU
- CVE-2022-0918A vulnerability was discovered in the 389 Directory Server that allows an unauthenticated attacker with network access to the LDAP port to c389-ds-base
- CVE-2022-0982Buffer Overflow via crafted client request in Accel-PPP v1.12https://accel-ppp.org/ Accel-PPP
- CVE-2021-39709In sendSipAccountsRemovedNotification of SipAccountRegistry.java, there is a possible permission bypass due to an unsafe PendingIntent.Android
- CVE-2021-39707In onReceive of AppRestrictionsFragment.java, there is a possible way to start a phone call without permissions due to a confused deputy.Android
- CVE-2021-39708In gatt_process_notification of gatt_cl.cc, there is a possible out of bounds write due to an incorrect bounds check.Android
- CVE-2021-39706In onResume of CredentialStorage.java, there is a possible way to cleanup content of credentials storage due to a missing permission check.Android
- CVE-2021-39704In deleteNotificationChannelGroup of NotificationManagerService.java, there is a possible way to run foreground service without user notificAndroid
- CVE-2021-39703In updateState of UsbDeviceManager.java, there is a possible unauthorized access of files due to a confused deputy.Android
- CVE-2021-39701In serviceConnection of ControlsProviderLifecycleManager.kt, there is a possible way to keep service running in foreground without notificatAndroid
- CVE-2021-39702In onCreate of RequestManageCredentials.java, there is a possible way for a third party app to install certificates without user approval duAndroid
- CVE-2021-39698In aio_poll_complete_work of aio.c, there is a possible memory corruption due to a use after free.Android
- CVE-2021-39697In checkFileUriDestination of DownloadProvider.java, there is a possible way to bypass external storage private directories protection due tAndroid
- CVE-2021-39694In parse of RoleParser.java, there is a possible way for default apps to get permissions explicitly denied by the user due to a permissions Android
- CVE-2021-39695In createOrUpdate of BasePermission.java, there is a possible permission bypass due to a logic error in the code.Android
- CVE-2021-39693In onUidStateChanged of AppOpsService.java, there is a possible way to access location without a visible indicator due to a logic error in tAndroid
- CVE-2021-39692In onCreate of SetupLayoutActivity.java, there is a possible way to setup a work profile bypassing user consent due to a tapjacking/overlay Android
- CVE-2021-39689In multiple functions of odsign_main.cpp, there is a possible way to persist system attack due to a logic error in the code.Android
- CVE-2021-39690In setDisplayPadding of WallpaperManagerService.java, there is a possible way to cause a persistent DoS due to improper input validation.Android
- CVE-2021-39686In several functions of binder.c, there is a possible way to represent the wrong domain to SELinux due to a race condition.Android
- CVE-2021-39685In various setup methods of the USB gadget subsystem, there is a possible out of bounds write due to an incorrect flag check.Android
- CVE-2021-39667In ih264d_parse_decode_slice of ih264d_parse_slice.c, there is a possible out of bounds write due to a heap buffer overflow.Android
- CVE-2021-0957In NotificationStackScrollLayout of NotificationStackScrollLayout.java, there is a possible way to bypass Factory Reset Protections.Android
- CVE-2021-39624In PackageManager, there is a possible permanent denial of service due to resource exhaustion.Android
- CVE-2021-39792In usb_gadget_giveback_request of core.c, there is a possible use after free out of bounds read due to a race condition.Android
- CVE-2021-39737Product: AndroidVersions: Android kernelAndroid ID: A-208229524References: N/AAndroid
- CVE-2021-39736In prepare_io_entry and prepare_response of lwis_ioctl.c and lwis_periodic_io.c, there is a possible out of bounds write due to an integer oAndroid
- CVE-2021-39735In gasket_alloc_coherent_memory of gasket_page_table.c, there is a possible memory corruption due to a race condition.Android
- CVE-2021-39734In sendMessage of OneToOneChatImpl.java (? TBD), there is a possible way to send an RCS message without permissions due to a missing permissAndroid
- CVE-2021-39733In amcs_cdev_unlocked_ioctl of audiometrics.c, there is a possible out of bounds write due to improper input validation.Android
- CVE-2021-39731In ProtocolStkProactiveCommandAdapter::Init of protocolstkadapter.cpp, there is a possible out of bounds write due to an incorrect bounds chAndroid
- CVE-2021-39732In copy_io_entries of lwis_ioctl.c, there is a possible out of bounds write due to an integer overflow.Android
- CVE-2021-39730In TBD of TBD, there is a possible out of bounds read due to a missing bounds check.Android
- CVE-2021-39729In the TitanM chip, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2021-39726In cd_ParseMsg of cd_codec.c, there is a possible out of bounds read due to an incorrect bounds check.Android
- CVE-2021-39727In eicPresentationRetrieveEntryValue of acropora/app/identity/libeic/EicPresentation.c, there is a possible information disclosure due to a Android
- CVE-2021-39725In gasket_free_coherent_memory_all of gasket_page_table.c, there is a possible memory corruption due to a double free.Android
- CVE-2021-39724In TuningProviderBase::GetTuningTreeSet of tuning_provider_base.cc, there is a possible out of bounds read due to a missing bounds check.Android
- CVE-2021-39723Product: AndroidVersions: Android kernelAndroid ID: A-209014813References: N/AAndroid
- CVE-2021-39721In TBD of TBD, there is a possible out of bounds write due to memory corruption.Android
- CVE-2021-39722In ProtocolStkProactiveCommandAdapter::Init of protocolstkadapter.cpp, there is a possible out of bounds read due to an incorrect bounds cheAndroid
- CVE-2021-39720Product: AndroidVersions: Android kernelAndroid ID: A-207433926References: N/AAndroid
- CVE-2021-39719In lwis_top_register_io of lwis_device_top.c, there is a possible out of bounds write due to an integer overflow.Android
- CVE-2021-39717In iaxxx_btp_write_words of iaxxx-btp.c, there is a possible out of bounds read due to an incorrect bounds check.Android
- CVE-2021-39718In ProtocolStkProactiveCommandAdapter::Init of protocolstkadapter.cpp, there is a possible out of bounds write due to an incorrect bounds chAndroid
- CVE-2021-39716Product: AndroidVersions: Android kernelAndroid ID: A-206977562References: N/AAndroid
- CVE-2021-39715In __show_regs of process.c, there is a possible leak of kernel memory and addresses due to log information disclosure.Android
- CVE-2021-39714In ion_buffer_kmap_get of ion.c, there is a possible use-after-free due to an integer overflow.Android
- CVE-2021-39713Product: AndroidVersions: Android kernelAndroid ID: A-173788806References: Upstream kernelAndroid
- CVE-2021-39711In bpf_prog_test_run_skb of test_run.c, there is a possible out of bounds read due to Incorrect Size Value.Android
- CVE-2021-39712In TBD of TBD, there is a possible user after free vulnerability due to a race condition.Android
- CVE-2021-39710Product: AndroidVersions: Android kernelAndroid ID: A-202160245References: N/AAndroid
- CVE-2022-0811A flaw was found in CRI-O in the way it set kernel options for a pod.CRI-O · github.com/cri-o/cri-o
- CVE-2022-0959A malicious, but authorised and authenticated user can construct an HTTP request using their existing CSRF token and session cookie to manuapgadmin · pgadmin4
- CVE-2021-33853A Cross-Site Scripting (XSS) attack can cause arbitrary code (javascript) to run in a user’s browser while the browser is connected to a truX2CRM
- CVE-2022-25248PTC Axeda agent and Axeda Desktop Server Information ExposurePTC Axeda agent · PTC Axeda Desktop Server for Windows
- CVE-2021-40742Adobe Audition NULL Pointer Dereference Application denial-of-serviceAdobe Audition
- CVE-2021-40737Adobe Audition NULL Pointer Dereference Application denial-of-serviceAdobe Audition
- CVE-2021-40741Adobe Audition Memory Corruption could lead to Application denial-of-serviceAdobe Audition
- CVE-2021-42264Adobe Premiere Pro Null Pointer Dereference Application denial-of-serviceAdobe Premiere
- CVE-2021-42263Adobe Premiere Pro Null Pointer Dereference Application denial-of-serviceAdobe Premiere
- CVE-2021-40796Adobe Premiere Pro Null Pointer Dereference Application denial-of-serviceAdobe Premiere
- CVE-2021-40789Adobe Premiere Elements Null Pointer Dereference Application denial-of-serviceAdobe Premiere Elements
- CVE-2021-40788Adobe Premiere Elements Null Pointer Dereference Application denial-of-serviceAdobe Premiere Elements
- CVE-2021-40785Adobe Premiere Elements Null Pointer Dereference Application denial-of-serviceAdobe Premiere Elements
- CVE-2021-40769Adobe Character Animator SVG File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Character Animator
- CVE-2021-40762Adobe Character Animator NULL Pointer Dereference Application denial-of-serviceAdobe Character Animator
- CVE-2021-40766Adobe Character Animator SVG File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Character Animator
- CVE-2021-40767Adobe Character Animator Memory Corruption could lead to Application denial-of-serviceAdobe Character Animator
- CVE-2021-40768Adobe Character Animator NULL Pointer Dereference Application denial-of-serviceAdobe Character Animator
- CVE-2021-40781Adobe Media Encoder Null Pointer Dereference Application denial-of-serviceAdobe Media Encoder
- CVE-2021-40750Adobe Bridge NULL Pointer Dereference could lead to Application denial-of-serviceAdobe Bridge
- CVE-2021-40782Adobe Media Encoder Null Pointer Dereference Application denial-of-serviceAdobe Media Encoder
- CVE-2021-40778Adobe Media Encoder Null Pointer Dereference Application denial-of-serviceAdobe Media Encoder
- CVE-2022-26354A flaw was found in the vhost-vsock device of QEMU.qemu-kvm
- CVE-2022-26353A flaw was found in the virtio-net device of QEMU.qemu-kvm
- CVE-2022-24751Race condition in Zulipzulip
- CVE-2021-42552Reflected XSS in ArchivistaArchivistaBox webclient
- CVE-2022-0986Reflected Cross-site Scripting (XSS) Vulnerability in hestiacp/hestiacphestiacp/hestiacp
- CVE-2021-45787There is a stored Cross Site Scripting (XSS) vulnerability in maccms v10 through adding videos.
- CVE-2021-45786In maccms v10, an attacker can log in through /index.php/user/login in the "col" and "openid" parameters to gain privileges.
- CVE-2022-0705Cross-site Scripting (XSS) - Stored in pimcore/pimcorepimcore/pimcore
- CVE-2022-21946suddoers configuration for cscreen not restrictive enoughopenSUSE Factory
- CVE-2022-21945cscreen: usage of fixed path /tmp/cscreen.debugopenSUSE Factory
- CVE-2021-45851A Server-Side Request Forgery (SSRF) attack in FUXA 1.1.3 can be carried out leading to the obtaining of sensitive information from the serv@frangoteam/fuxa
- CVE-2021-46705grub2-once uses fixed file name in /var/tmpSUSE Linux Enterprise Server 15 SP4 · openSUSE Factory
- CVE-2021-45852An issue was discovered in Projectworlds Hospital Management System v1.0.
- CVE-2022-0704Cross-site Scripting (XSS) - Stored in pimcore/pimcorepimcore/pimcore
- CVE-2022-0911Cross-site Scripting (XSS) - Stored in pimcore/pimcorepimcore/pimcore
- CVE-2021-43956The jQuery deserialize library in Fisheye and Crucible before version 4.8.9 allowed remote attackers to to inject arbitrary HTML and/or JavaAtlassian Fisheye · Atlassian Crucible
- CVE-2021-43955The /rest-service-fecru/server-v1 resource in Fisheye and Crucible before version 4.8.9 allowed authenticated remote attackers to obtain infAtlassian Fisheye · Atlassian Crucible
- CVE-2022-27225Gradle Enterprise before 2021.4.3 relies on cleartext data transmission in some situations.
- CVE-2020-25721Kerberos acceptors need easy access to stable AD identifiers (eg objectSid).samba
- CVE-2021-20299A flaw was found in OpenEXR's Multipart input file functionality.OpenEXR
- CVE-2022-24728Cross-site Scripting in CKEditor4ckeditor4 · drupal/core
- CVE-2022-24729Regular expression Denial of Service in dialog pluginckeditor4 · drupal/core