# CVEs published 2022-03-17

53 CVEs were published on March 17, 2022: 2 critical, 10 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2022-0758](https://cve.now/CVE-2022-0758.md): Rapid7 Nexpose Reflected XSS (CVSS 3.3, Rapid7 Nexpose)
- [CVE-2022-0757](https://cve.now/CVE-2022-0757.md): Rapid7 Nexpose SQL Injection (CVSS 5.5, Rapid7 Nexpose)
- [CVE-2022-0237](https://cve.now/CVE-2022-0237.md): Rapid7 Insight Agent Privilege Escalation (CVSS 4.0, Rapid7 Insight Agent)
- [CVE-2021-44087](https://cve.now/CVE-2021-44087.md): A Remote Code Execution (RCE) vulnerability exists in Sourcecodester Attendance and Payroll System v1.0 which allows an unauthenticated remo (no CVSS)
- [CVE-2021-43961](https://cve.now/CVE-2021-43961.md): Sonatype Nexus Repository Manager 3.36.0 allows HTML Injection. (no CVSS)
- [CVE-2021-44088](https://cve.now/CVE-2021-44088.md): An SQL Injection vulnerability exists in Sourcecodester Attendance and Payroll System v1.0 which allows a remote attacker to bypass authenti (no CVSS)
- [CVE-2022-24302](https://cve.now/CVE-2022-24302.md): In Paramiko before 2.10.1, a race condition (between creation and chmod) in the write\_private\_key\_file function could allow unauthorized inf (no CVSS, paramiko)
- [CVE-2022-26500](https://cve.now/CVE-2022-26500.md): Improper limitation of path names in Veeam Backup & Replication 9.5U3, 9.5U4,10.x, and 11.x allows remote authenticated users access to inte (CVSS 8.8, KEV)
- [CVE-2022-26504](https://cve.now/CVE-2022-26504.md): Improper authentication in Veeam Backup & Replication 9.5U3, 9.5U4,10.x and 11.x component used for Microsoft System Center Virtual Machine (no CVSS)
- [CVE-2021-46107](https://cve.now/CVE-2021-46107.md): Ligeo Archives Ligeo Basics as of 02\_01-2022 is vulnerable to Server Side Request Forgery (SSRF) which allows an attacker to read any docume (no CVSS)
- [CVE-2022-24770](https://cve.now/CVE-2022-24770.md): Improper Neutralization of Formula Elements in a CSV File in Gradio Flagging (CVSS 8.8, gradio-app gradio · gradio)
- [CVE-2022-21822](https://cve.now/CVE-2022-21822.md): NVIDIA FLARE contains a vulnerability in the admin interface, where an un-authorized attacker can cause Allocation of Resources Without Limi (CVSS 7.5, NVIDIA FLARE · nvflare)
- [CVE-2022-26501](https://cve.now/CVE-2022-26501.md): Veeam Backup & Replication 10.x and 11.x has Incorrect Access Control (issue 1 of 2). (CVSS 9.8, KEV)
- [CVE-2021-45040](https://cve.now/CVE-2021-45040.md): The Spatie media-library-pro library through 1.17.10 and 2.x through 2.1.6 for Laravel allows remote attackers to upload executable files vi (no CVSS)
- [CVE-2022-26511](https://cve.now/CVE-2022-26511.md): WPS Presentation 11.8.0.5745 insecurely load d3dx9\_41.dll when opening .pps files('current directory type' DLL loading). (no CVSS, KINGSOFT JAPAN WPS Presentation)
- [CVE-2022-26081](https://cve.now/CVE-2022-26081.md): The installer of WPS Office Version 10.8.0.5745 insecurely load shcore.dll, allowing an attacker to execute arbitrary code with the privileg (no CVSS, KINGSOFT JAPAN The installer of WPS Office)
- [CVE-2022-25969](https://cve.now/CVE-2022-25969.md): The installer of WPS Office Version 10.8.0.6186 insecurely load VERSION.DLL (or some other DLLs), allowing an attacker to execute arbitrary (no CVSS, KINGSOFT JAPAN The installer of WPS Office)
- [CVE-2022-25949](https://cve.now/CVE-2022-25949.md): The kernel mode driver kwatch3 of KINGSOFT Internet Security 9 Plus Version 2010.06.23.247 fails to properly handle crafted inputs, leading (no CVSS, KINGSOFT JAPAN KINGSOFT Internet Security 9 Plus)
- [CVE-2022-24759](https://cve.now/CVE-2022-24759.md): Failure to validate signature during handshake in @chainsafe/libp2p-noise (CVSS 8.1, ChainSafe js-libp2p-noise · @chainsafe/libp2p-noise)
- [CVE-2022-25364](https://cve.now/CVE-2022-25364.md): In Gradle Enterprise before 2021.4.2, the default built-in build cache configuration allowed anonymous write access. (no CVSS)
- [CVE-2022-26503](https://cve.now/CVE-2022-26503.md): Deserialization of untrusted data in Veeam Agent for Windows 2.0, 2.1, 2.2, 3.0.2, 4.x, and 5.x allows local users to run arbitrary code wit (no CVSS)
- [CVE-2020-15591](https://cve.now/CVE-2020-15591.md): fexsrv in F\*EX (aka Frams' Fast File EXchange) before fex-20160919\_2 allows eval injection (for unauthenticated remote code execution). (no CVSS)
- [CVE-2022-26526](https://cve.now/CVE-2022-26526.md): Anaconda Anaconda3 (Anaconda Distribution) through 2021.11.0.0 and Miniconda3 through 4.11.0.0 can create a world-writable directory under % (no CVSS)
- [CVE-2021-44906](https://cve.now/CVE-2021-44906.md): Minimist \<=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95). (no CVSS, minimist)
- [CVE-2022-24761](https://cve.now/CVE-2022-24761.md): HTTP Request Smuggling in waitress (CVSS 7.5, Pylons waitress · waitress)
- [CVE-2021-44261](https://cve.now/CVE-2021-44261.md): A vulnerability is in the 'BRS\_top.html' page of the Netgear W104, version WAC104-V1.0.4.13, which can allow a remote attacker to access thi (no CVSS)
- [CVE-2021-44262](https://cve.now/CVE-2021-44262.md): A vulnerability is in the 'MNU\_top.htm' page of the Netgear W104, version WAC104-V1.0.4.13, which can allow a remote attacker to access this (no CVSS)
- [CVE-2021-44259](https://cve.now/CVE-2021-44259.md): A vulnerability is in the 'wx.html' page of the WAVLINK AC1200, version WAVLINK-A42W-1.27.6-20180418, which can allow a remote attacker to a (no CVSS)
- [CVE-2021-44260](https://cve.now/CVE-2021-44260.md): A vulnerability is in the 'live\_mfg.html' page of the WAVLINK AC1200, version WAVLINK-A42W-1.27.6-20180418, which can allow a remote attacke (no CVSS)
- [CVE-2021-44908](https://cve.now/CVE-2021-44908.md): SailsJS Sails.js \<=1.4.0 is vulnerable to Prototype Pollution via controller/load-action-modules.js, function loadActionModules(). (no CVSS, sails)
- [CVE-2022-21221](https://cve.now/CVE-2022-21221.md): Directory Traversal (CVSS 5.9, github.com/valyala/fasthttp)
- [CVE-2022-0748](https://cve.now/CVE-2022-0748.md): Arbitrary Code Execution (CVSS 9.8, post-loader)
- [CVE-2022-25354](https://cve.now/CVE-2022-25354.md): Prototype Pollution (CVSS 8.6, set-in)
- [CVE-2022-25352](https://cve.now/CVE-2022-25352.md): Prototype Pollution (CVSS 7.5, libnested)
- [CVE-2021-23556](https://cve.now/CVE-2021-23556.md): Exposed Dangerous Method or Function (CVSS 6.4, guake)
- [CVE-2021-23771](https://cve.now/CVE-2021-23771.md): Sandbox Bypass (CVSS 6.5, notevil · argencoders-notevil)
- [CVE-2022-25760](https://cve.now/CVE-2022-25760.md): Arbitrary Code Injection (CVSS 7.1, accesslog)
- [CVE-2021-23632](https://cve.now/CVE-2021-23632.md): Remote Code Execution (RCE) (CVSS 6.6, git)
- [CVE-2022-25296](https://cve.now/CVE-2022-25296.md): Prototype Pollution (CVSS 6.3, bodymen)
- [CVE-2022-0749](https://cve.now/CVE-2022-0749.md): Deserialization of Untrusted Data (CVSS 7.4, SinGooCMS.Utility)
- [CVE-2021-45794](https://cve.now/CVE-2021-45794.md): Slims9 Bulian 9.4.2 is affected by SQL injection in /admin/modules/system/backup.php. (no CVSS)
- [CVE-2021-45793](https://cve.now/CVE-2021-45793.md): Slims9 Bulian 9.4.2 is affected by SQL injection in lib/comment.inc.php. (no CVSS)
- [CVE-2021-45792](https://cve.now/CVE-2021-45792.md): Slims9 Bulian 9.4.2 is affected by Cross Site Scripting (XSS) in /admin/modules/system/custom\_field.php. (no CVSS)
- [CVE-2021-45791](https://cve.now/CVE-2021-45791.md): Slims8 Akasia 8.3.1 is affected by SQL injection in /admin/modules/bibliography/index.php, /admin/modules/membership/member\_type.php, /admin (no CVSS)
- [CVE-2022-1000](https://cve.now/CVE-2022-1000.md): Path Traversal in prasathmani/tinyfilemanager (CVSS 8.8, prasathmani/tinyfilemanager)
- [CVE-2022-24075](https://cve.now/CVE-2022-24075.md): Whale browser before 3.12.129.18 allowed extensions to replace JavaScript files of the HWP viewer website which could access to local HWP fi (no CVSS, NAVER Whale browser)
- [CVE-2022-24074](https://cve.now/CVE-2022-24074.md): Whale Bridge, a default extension in Whale browser before 3.12.129.18, allowed to receive any SendMessage request from the content script it (no CVSS, NAVER Whale browser)
- [CVE-2022-24073](https://cve.now/CVE-2022-24073.md): The Web Request API in Whale browser before 3.12.129.18 allowed to deny access to the extension store or redirect to any URL when users acce (no CVSS, NAVER Whale browser)
- [CVE-2022-24072](https://cve.now/CVE-2022-24072.md): The devtools API in Whale browser before 3.12.129.18 allowed extension developers to inject arbitrary JavaScript into the extension store we (no CVSS, NAVER Whale browser)
- [CVE-2022-22273](https://cve.now/CVE-2022-22273.md): Improper neutralization of Special Elements leading to OS Command Injection vulnerability impacting end-of-life Secure Remote Access (SRA) p (no CVSS, SonicWall SRA/SMA100)
- [CVE-2022-25514](https://cve.now/CVE-2022-25514.md): stb\_truetype.h v1.26 was discovered to contain a heap-buffer-overflow via the function ttUSHORT() at stb\_truetype.h. (no CVSS)
- [CVE-2022-25515](https://cve.now/CVE-2022-25515.md): stb\_truetype.h v1.26 was discovered to contain a heap-buffer-overflow via the function ttULONG() at stb\_truetype.h. (no CVSS)
- [CVE-2022-25516](https://cve.now/CVE-2022-25516.md): stb\_truetype.h v1.26 was discovered to contain a heap-buffer-overflow via the function stbtt\_\_find\_table at stb\_truetype.h. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-03-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.