CVEs published March 17, 2022
53 CVEs were published on March 17, 2022: 2 critical, 10 high. 2 are now in CISA KEV.
- Published
- 53
- Critical
- 2
- High
- 10
- Medium
- 7
- Low
- 1
- Unrated
- 33
- Now in CISA KEV
- 2
- Fix available
- 16
Most affected products
- NAVER Whale browser
- 4
- KINGSOFT JAPAN The installer of WPS Office
- 2
- Rapid7 Nexpose
- 2
- accesslog
- 1
- bodymen
- 1
- ChainSafe js-libp2p-noise · @chainsafe/libp2p-noise
- 1
- git
- 1
- github.com/valyala/fasthttp
- 1
- gradio-app gradio · gradio
- 1
- guake
- 1
Critical 2
High 10
- CVE-2022-26500Improper limitation of path names in Veeam Backup & Replication 9.5U3, 9.5U4,10.x, and 11.x allows remote authenticated users access to inte
- CVE-2022-24770Improper Neutralization of Formula Elements in a CSV File in Gradio Flagginggradio-app gradio · gradio
- CVE-2022-21822NVIDIA FLARE contains a vulnerability in the admin interface, where an un-authorized attacker can cause Allocation of Resources Without LimiNVIDIA FLARE · nvflare
- CVE-2022-24759Failure to validate signature during handshake in @chainsafe/libp2p-noiseChainSafe js-libp2p-noise · @chainsafe/libp2p-noise
- CVE-2022-24761HTTP Request Smuggling in waitressPylons waitress · waitress
- CVE-2022-25354Prototype Pollutionset-in
- CVE-2022-25352Prototype Pollutionlibnested
- CVE-2022-25760Arbitrary Code Injectionaccesslog
- CVE-2022-0749Deserialization of Untrusted DataSinGooCMS.Utility
- CVE-2022-1000Path Traversal in prasathmani/tinyfilemanagerprasathmani/tinyfilemanager
Medium, low and unrated 41
- CVE-2022-0758Rapid7 Nexpose Reflected XSSRapid7 Nexpose
- CVE-2022-0757Rapid7 Nexpose SQL InjectionRapid7 Nexpose
- CVE-2022-0237Rapid7 Insight Agent Privilege EscalationRapid7 Insight Agent
- CVE-2021-44087A Remote Code Execution (RCE) vulnerability exists in Sourcecodester Attendance and Payroll System v1.0 which allows an unauthenticated remo
- CVE-2021-43961Sonatype Nexus Repository Manager 3.36.0 allows HTML Injection.
- CVE-2021-44088An SQL Injection vulnerability exists in Sourcecodester Attendance and Payroll System v1.0 which allows a remote attacker to bypass authenti
- CVE-2022-24302In Paramiko before 2.10.1, a race condition (between creation and chmod) in the write_private_key_file function could allow unauthorized infparamiko
- CVE-2022-26504Improper authentication in Veeam Backup & Replication 9.5U3, 9.5U4,10.x and 11.x component used for Microsoft System Center Virtual Machine
- CVE-2021-46107Ligeo Archives Ligeo Basics as of 02_01-2022 is vulnerable to Server Side Request Forgery (SSRF) which allows an attacker to read any docume
- CVE-2021-45040The Spatie media-library-pro library through 1.17.10 and 2.x through 2.1.6 for Laravel allows remote attackers to upload executable files vi
- CVE-2022-26511WPS Presentation 11.8.0.5745 insecurely load d3dx9_41.dll when opening .pps files('current directory type' DLL loading).KINGSOFT JAPAN WPS Presentation
- CVE-2022-26081The installer of WPS Office Version 10.8.0.5745 insecurely load shcore.dll, allowing an attacker to execute arbitrary code with the privilegKINGSOFT JAPAN The installer of WPS Office
- CVE-2022-25969The installer of WPS Office Version 10.8.0.6186 insecurely load VERSION.DLL (or some other DLLs), allowing an attacker to execute arbitrary KINGSOFT JAPAN The installer of WPS Office
- CVE-2022-25949The kernel mode driver kwatch3 of KINGSOFT Internet Security 9 Plus Version 2010.06.23.247 fails to properly handle crafted inputs, leading KINGSOFT JAPAN KINGSOFT Internet Security 9 Plus
- CVE-2022-25364In Gradle Enterprise before 2021.4.2, the default built-in build cache configuration allowed anonymous write access.
- CVE-2022-26503Deserialization of untrusted data in Veeam Agent for Windows 2.0, 2.1, 2.2, 3.0.2, 4.x, and 5.x allows local users to run arbitrary code wit
- CVE-2020-15591fexsrv in F*EX (aka Frams' Fast File EXchange) before fex-20160919_2 allows eval injection (for unauthenticated remote code execution).
- CVE-2022-26526Anaconda Anaconda3 (Anaconda Distribution) through 2021.11.0.0 and Miniconda3 through 4.11.0.0 can create a world-writable directory under %
- CVE-2021-44906Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).minimist
- CVE-2021-44261A vulnerability is in the 'BRS_top.html' page of the Netgear W104, version WAC104-V1.0.4.13, which can allow a remote attacker to access thi
- CVE-2021-44262A vulnerability is in the 'MNU_top.htm' page of the Netgear W104, version WAC104-V1.0.4.13, which can allow a remote attacker to access this
- CVE-2021-44259A vulnerability is in the 'wx.html' page of the WAVLINK AC1200, version WAVLINK-A42W-1.27.6-20180418, which can allow a remote attacker to a
- CVE-2021-44260A vulnerability is in the 'live_mfg.html' page of the WAVLINK AC1200, version WAVLINK-A42W-1.27.6-20180418, which can allow a remote attacke
- CVE-2021-44908SailsJS Sails.js <=1.4.0 is vulnerable to Prototype Pollution via controller/load-action-modules.js, function loadActionModules().sails
- CVE-2022-21221Directory Traversalgithub.com/valyala/fasthttp
- CVE-2021-23556Exposed Dangerous Method or Functionguake
- CVE-2021-23771Sandbox Bypassnotevil · argencoders-notevil
- CVE-2021-23632Remote Code Execution (RCE)git
- CVE-2022-25296Prototype Pollutionbodymen
- CVE-2021-45794Slims9 Bulian 9.4.2 is affected by SQL injection in /admin/modules/system/backup.php.
- CVE-2021-45793Slims9 Bulian 9.4.2 is affected by SQL injection in lib/comment.inc.php.
- CVE-2021-45792Slims9 Bulian 9.4.2 is affected by Cross Site Scripting (XSS) in /admin/modules/system/custom_field.php.
- CVE-2021-45791Slims8 Akasia 8.3.1 is affected by SQL injection in /admin/modules/bibliography/index.php, /admin/modules/membership/member_type.php, /admin
- CVE-2022-24075Whale browser before 3.12.129.18 allowed extensions to replace JavaScript files of the HWP viewer website which could access to local HWP fiNAVER Whale browser
- CVE-2022-24074Whale Bridge, a default extension in Whale browser before 3.12.129.18, allowed to receive any SendMessage request from the content script itNAVER Whale browser
- CVE-2022-24073The Web Request API in Whale browser before 3.12.129.18 allowed to deny access to the extension store or redirect to any URL when users acceNAVER Whale browser
- CVE-2022-24072The devtools API in Whale browser before 3.12.129.18 allowed extension developers to inject arbitrary JavaScript into the extension store weNAVER Whale browser
- CVE-2022-22273Improper neutralization of Special Elements leading to OS Command Injection vulnerability impacting end-of-life Secure Remote Access (SRA) pSonicWall SRA/SMA100
- CVE-2022-25514stb_truetype.h v1.26 was discovered to contain a heap-buffer-overflow via the function ttUSHORT() at stb_truetype.h.
- CVE-2022-25515stb_truetype.h v1.26 was discovered to contain a heap-buffer-overflow via the function ttULONG() at stb_truetype.h.
- CVE-2022-25516stb_truetype.h v1.26 was discovered to contain a heap-buffer-overflow via the function stbtt__find_table at stb_truetype.h.