CVEs published March 18, 2022
159 CVEs were published on March 18, 2022: 5 critical, 9 high. 2 are now in CISA KEV.
- Published
- 159
- Critical
- 5
- High
- 9
- Medium
- 14
- Low
- 3
- Unrated
- 128
- Now in CISA KEV
- 2
- Fix available
- 82
Most affected products
- Apple macOS
- 21
- Apple iOS and iPadOS · Apple macOS +2
- 20
- Apple iOS and iPadOS
- 9
- Apple Xcode
- 8
- Rockwell Automation ISaGRAF Runtime
- 5
- Apple iOS and iPadOS · Apple macOS +1
- 4
- Apple iOS and iPadOS · Apple macOS
- 3
- Apple iOS and iPadOS · Apple tvOS
- 3
- digitalbazaar forge · node-forge
- 3
- Adobe Acrobat Reader
- 2
Critical 5
- CVE-2020-25197GE Reason RT43X Clocks Code InjectionGE Reason RT43X Clocks
- CVE-2020-25176Rockwell Automation ISaGRAF5 Runtime Relative Path TraversalRockwell Automation ISaGRAF Runtime
- CVE-2022-0547OpenVPN 2.1 until v2.4.12 and v2.5.6 may enable authentication bypass in external authentication plug-ins when more than one of them makes uOpenVPN
- CVE-2022-22587A memory corruption issue was addressed with improved input validation.Apple iOS and iPadOS · Apple macOS
- CVE-2022-0742Memory leak in ICMP6 in Linux KernelLinux Kernel
High 9
- CVE-2020-25184Rockwell Automation ISaGRAF5 Runtime Unprotected Storage of CredentialsRockwell Automation ISaGRAF Runtime
- CVE-2020-25178Rockwell Automation ISaGRAF5 Runtime Cleartext Transmission of Sensitive InformationRockwell Automation ISaGRAF Runtime
- CVE-2022-25602WordPress Responsive Menu plugin <= 4.1.7 - Nonce token leak leading to arbitrary file upload, theme deletion, plugin settings change vulnerabilityExpressTech Responsive Menu
- CVE-2022-22620A use after free issue was addressed with improved memory management.Apple Safari · Apple macOS
- CVE-2022-24091Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe Acrobat Reader
- CVE-2022-24092Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe Acrobat Reader
- CVE-2021-4031Syltek Insufficient Verification of Data AuthenticitySyltek
- CVE-2022-24772Improper Verification of Cryptographic Signature in `node-forge`digitalbazaar forge · node-forge
- CVE-2022-24771Improper Verification of Cryptographic Signature in node-forgedigitalbazaar forge · node-forge
Medium, low and unrated 145
- CVE-2022-26267Piwigo v12.2.0 was discovered to contain an information leak via the action parameter in /admin/maintenance_actions.php.
- CVE-2022-26265Contao Managed Edition v1.5.0 was discovered to contain a remote command execution (RCE) vulnerability via the component php_cli parameter.contao/managed-edition
- CVE-2022-26266Piwigo v12.2.0 was discovered to contain a SQL injection vulnerability via pwg.users.php.
- CVE-2022-25581Classcms v2.5 and below contains an arbitrary file upload via the component \class\classupload.
- CVE-2022-25578taocms v3.0.2 allows attackers to execute code injection via arbitrarily editing the .htaccess file.
- CVE-2022-25390DCN Firewall DCME-520 was discovered to contain a remote command execution (RCE) vulnerability via the host parameter in the file /system/to
- CVE-2022-25389DCN Firewall DCME-520 was discovered to contain an arbitrary file download vulnerability via the path parameter in the file /audit/log/log_m
- CVE-2022-25460Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the endip parameter in the SetPptpServerCfg function.
- CVE-2022-25461Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the startip parameter in the SetPptpServerCfg function.
- CVE-2022-25459Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the S1 parameter in the SetSysTimeCfg function.
- CVE-2022-25458Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the cmdinput parameter in the exeCommand function.
- CVE-2022-25457Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the ntpserver parameter in the SetSysTimeCfg function.
- CVE-2022-25455Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the list parameter in the SetIpMacBind function.
- CVE-2022-25456Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the security_5g parameter in the WifiBasicSet function.
- CVE-2022-25454Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the loginpwd parameter in the SetFirewallCfg function.
- CVE-2022-25452Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the URLs parameter in the saveParentControlInfo function.
- CVE-2022-25453Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the time parameter in the saveParentControlInfo function.
- CVE-2022-25451Tenda AC6 V15.03.05.09_multi was discovered to contain a stack overflow via the list parameter in the setstaticroutecfg function.
- CVE-2022-25449Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the deviceId parameter in the saveParentControlInfo function.
- CVE-2022-25450Tenda AC6 V15.03.05.09_multi was discovered to contain a stack overflow via the list parameter in the SetVirtualServerCfg function.
- CVE-2022-25448Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the day parameter in the openSchedWifi function.
- CVE-2022-25446Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the schedstarttime parameter in the openSchedWifi function.
- CVE-2022-25447Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the schedendtime parameter in the openSchedWifi function.
- CVE-2022-25445Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the time parameter in the PowerSaveSet function.
- CVE-2022-25441Tenda AC9 v15.03.2.21 was discovered to contain a remote command execution (RCE) vulnerability via the vlanid parameter in the SetIPTVCfg fu
- CVE-2022-25440Tenda AC9 v15.03.2.21 was discovered to contain a stack overflow via the ntpserver parameter in the SetSysTimeCfg function.
- CVE-2022-25438Tenda AC9 v15.03.2.21 was discovered to contain a remote command execution (RCE) vulnerability via the SetIPTVCfg function.
- CVE-2022-25439Tenda AC9 v15.03.2.21 was discovered to contain a stack overflow via the list parameter in the SetIpMacBind function.
- CVE-2022-25437Tenda AC9 v15.03.2.21 was discovered to contain a stack overflow via the list parameter in the SetVirtualServerCfg function.
- CVE-2022-25435Tenda AC9 v15.03.2.21 was discovered to contain a stack overflow via the list parameter in the SetStaticRoutecfg function.
- CVE-2022-25434Tenda AC9 v15.03.2.21 was discovered to contain a stack overflow via the firewallen parameter in the SetFirewallCfg function.
- CVE-2022-25433Tenda AC9 v15.03.2.21 was discovered to contain a stack overflow via the urls parameter in the saveparentcontrolinfo function.
- CVE-2022-25428Tenda AC9 v15.03.2.21 was discovered to contain a stack overflow via the deviceId parameter in the saveparentcontrolinfo function.
- CVE-2022-25431Tenda AC9 v15.03.2.21 was discovered to contain multiple stack overflows via the NPTR, V12, V10 and V11 parameter in the Formsetqosband func
- CVE-2022-25429Tenda AC9 v15.03.2.21 was discovered to contain a buffer overflow via the time parameter in the saveparentcontrolinfo function.
- CVE-2022-25427Tenda AC9 v15.03.2.21 was discovered to contain a stack overflow via the schedendtime parameter in the openSchedWifi function.
- CVE-2022-27250The UNISOC chipset through 2022-03-15 allows attackers to obtain remote control of a mobile phone, e.g., to obtain sensitive information fro
- CVE-2020-25193GE Reason RT43X Clocks Use of Hard-coded Cryptographic KeyGE Reason RT43X Clocks
- CVE-2020-25180Rockwell Automation ISaGRAF5 Runtime Use of Hard-coded Cryptographic KeyRockwell Automation ISaGRAF Runtime
- CVE-2020-25182Rockwell Automation ISaGRAF5 Runtime Uncontrolled Search Path ElementRockwell Automation ISaGRAF Runtime
- CVE-2020-16232Yokogawa WideField3 Buffer Copy Without Checking Size of InputYokogawa WideField3
- CVE-2022-25607WordPress FV Flowplayer Video Player plugin <= 7.5.15.727 - SQL Injection (SQLi) vulnerabilityFolioVision FV Flowplayer Video Player
- CVE-2022-25605WordPress WP-DownloadManager plugin <= 1.68.6 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilitiesLester 'GaMerZ' Chan WP-DownloadManager
- CVE-2022-25604WordPress Price Table plugin <= 0.2.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityGreg Priday Price Table
- CVE-2021-23209WordPress AMP for WP – Accelerated Mobile Pages plugin <= 1.0.77.32 - Multiple Auth. Stored Cross-Site Scripting (XSS) vulnerabilitiesAhmed Kaludi, Mohammed Kaludi AMP for WP – Accelerated Mobi…
- CVE-2021-23150WordPress AMP for WP – Accelerated Mobile Pages plugin <= 1.0.77.31 - Auth. Stored Cross-Site Scripting (XSS) vulnerabilityAhmed Kaludi, Mohammed Kaludi AMP for WP – Accelerated Mobi…
- CVE-2021-44760WordPress WP-DownloadManager plugin <= 1.68.6 - Auth. Reflected Cross-Site Scripting (XSS) vulnerabilityLester 'GaMerZ' Chan WP-DownloadManager
- CVE-2022-25603WordPress MaxGalleria plugin <= 6.2.5 - Stored Cross-Site Scripting (XSS) vulnerabilityMax Foundry MaxGalleria
- CVE-2022-1002HTML Injection while inviting GuestsMattermost
- CVE-2022-1003Sysadmin can override existing configs & bypass restrictions like EnableUploadsMattermost
- CVE-2022-22659A logic issue was addressed with improved state management.Apple iOS and iPadOS
- CVE-2022-22670An access issue was addressed with improved access restrictions.Apple iOS and iPadOS · Apple tvOS +1
- CVE-2022-22667A use after free issue was addressed with improved memory management.Apple iOS and iPadOS
- CVE-2022-22661A type confusion issue was addressed with improved state handling.Apple macOS
- CVE-2022-22671An authentication issue was addressed with improved state management.Apple iOS and iPadOS
- CVE-2022-22669A use after free issue was addressed with improved memory management.Apple macOS
- CVE-2022-22665A logic issue was addressed with improved validation.Apple macOS
- CVE-2022-22651An out-of-bounds write issue was addressed with improved bounds checking.Apple macOS
- CVE-2022-22666A memory corruption issue was addressed with improved validation.Apple iOS and iPadOS · Apple tvOS +1
- CVE-2022-22656An authentication issue was addressed with improved state management.Apple macOS
- CVE-2022-22653A logic issue was addressed with improved restrictions.Apple iOS and iPadOS
- CVE-2022-22664An out-of-bounds read was addressed with improved bounds checking.Apple macOS
- CVE-2022-22657A memory initialization issue was addressed with improved memory handling.Apple macOS
- CVE-2022-22660This issue was addressed with a new entitlement.Apple macOS
- CVE-2022-22648This issue was addressed with improved checks.Apple macOS
- CVE-2022-22654A user interface issue was addressed.Apple Safari · Apple watchOS
- CVE-2022-22642This issue was addressed with improved checks.Apple iOS and iPadOS
- CVE-2022-22644A privacy issue existed in the handling of Contact cards.Apple macOS
- CVE-2022-22652The GSMA authentication panel could be presented on the lock screen.Apple iOS and iPadOS
- CVE-2022-22647This issue was addressed with improved checks.Apple macOS
- CVE-2022-22650This issue was addressed with improved checks.Apple macOS
- CVE-2022-22638A null pointer dereference was addressed with improved validation.Apple iOS and iPadOS · Apple macOS +2
- CVE-2022-22640A memory corruption issue was addressed with improved validation.Apple iOS and iPadOS · Apple macOS +2
- CVE-2022-22641A use after free issue was addressed with improved memory management.Apple iOS and iPadOS · Apple macOS +1
- CVE-2022-22633A memory corruption issue was addressed with improved state management.Apple iOS and iPadOS · Apple macOS +1
- CVE-2022-22635An out-of-bounds write issue was addressed with improved bounds checking.Apple iOS and iPadOS · Apple tvOS
- CVE-2022-22639A logic issue was addressed with improved state management.Apple iOS and iPadOS · Apple macOS
- CVE-2022-22636An out-of-bounds write issue was addressed with improved bounds checking.Apple iOS and iPadOS · Apple tvOS
- CVE-2022-22631An out-of-bounds write issue was addressed with improved bounds checking.Apple macOS
- CVE-2022-22632A logic issue was addressed with improved state management.Apple iOS and iPadOS · Apple macOS +2
- CVE-2022-22621This issue was addressed with improved checks.Apple iOS and iPadOS · Apple macOS +2
- CVE-2022-22634A buffer overflow was addressed with improved bounds checking.Apple iOS and iPadOS · Apple tvOS
- CVE-2022-22626An out-of-bounds read was addressed with improved bounds checking.Apple macOS
- CVE-2022-22627An out-of-bounds read was addressed with improved bounds checking.Apple macOS
- CVE-2022-22622This issue was addressed with improved checks.Apple iOS and iPadOS
- CVE-2022-22625An out-of-bounds read was addressed with improved input validation.Apple macOS
- CVE-2022-22618This issue was addressed with improved checks.Apple iOS and iPadOS · Apple watchOS
- CVE-2022-22612A memory consumption issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple macOS +2
- CVE-2022-22614A use after free issue was addressed with improved memory management.Apple iOS and iPadOS · Apple macOS +2
- CVE-2022-22609The issue was addressed with additional permissions checks.Apple iOS and iPadOS · Apple macOS +2
- CVE-2022-22615A use after free issue was addressed with improved memory management.Apple iOS and iPadOS · Apple macOS +2
- CVE-2022-22617A logic issue was addressed with improved state management.Apple macOS
- CVE-2022-22613An out-of-bounds write issue was addressed with improved bounds checking.Apple iOS and iPadOS · Apple macOS +2
- CVE-2022-22611An out-of-bounds read was addressed with improved input validation.Apple iOS and iPadOS · Apple macOS +2
- CVE-2022-22607An out-of-bounds read was addressed with improved bounds checking.Apple Xcode
- CVE-2022-22605An out-of-bounds read was addressed with improved bounds checking.Apple Xcode
- CVE-2022-22608An out-of-bounds read was addressed with improved bounds checking.Apple Xcode
- CVE-2022-22603An out-of-bounds read was addressed with improved bounds checking.Apple Xcode
- CVE-2022-22601An out-of-bounds read was addressed with improved bounds checking.Apple Xcode
- CVE-2022-22606An out-of-bounds read was addressed with improved bounds checking.Apple Xcode
- CVE-2022-22602An out-of-bounds read was addressed with improved bounds checking.Apple Xcode
- CVE-2022-22604An out-of-bounds read was addressed with improved bounds checking.Apple Xcode
- CVE-2022-22599Description: A permissions issue was addressed with improved validation.Apple iOS and iPadOS · Apple macOS +1
- CVE-2022-22600The issue was addressed with improved permissions logic.Apple iOS and iPadOS · Apple macOS +2
- CVE-2022-22597A memory corruption issue was addressed with improved validation.Apple macOS
- CVE-2022-22592A logic issue was addressed with improved state management.Apple iOS and iPadOS · Apple macOS +2
- CVE-2022-22594A cross-origin issue in the IndexDB API was addressed with improved input validation.Apple iOS and iPadOS · Apple macOS +2
- CVE-2022-22598An issue with app access to camera metadata was addressed with improved logic.Apple iOS and iPadOS
- CVE-2022-22593A buffer overflow issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple macOS +2
- CVE-2022-22596A memory corruption issue was addressed with improved validation.Apple iOS and iPadOS · Apple watchOS
- CVE-2022-22590A use after free issue was addressed with improved memory management.Apple iOS and iPadOS · Apple macOS +2
- CVE-2022-22591A memory corruption issue was addressed with improved memory handling.Apple macOS
- CVE-2022-22589A validation issue was addressed with improved input sanitization.Apple iOS and iPadOS · Apple macOS +2
- CVE-2022-22588A resource exhaustion issue was addressed with improved input validation.Apple iOS and iPadOS
- CVE-2022-22584A memory corruption issue was addressed with improved validation.Apple iOS and iPadOS · Apple macOS +2
- CVE-2022-22586An out-of-bounds write issue was addressed with improved bounds checking.Apple macOS
- CVE-2022-22585An issue existed within the path validation logic for symlinks.Apple iOS and iPadOS · Apple macOS +2
- CVE-2022-22583A permissions issue was addressed with improved validation.Apple macOS
- CVE-2022-22578A logic issue was addressed with improved validation.Apple iOS and iPadOS · Apple macOS +2
- CVE-2022-22579An information disclosure issue was addressed with improved state management.Apple iOS and iPadOS · Apple macOS +1
- CVE-2021-30771An out-of-bounds write was addressed with improved input validation.Apple iOS and iPadOS · Apple macOS +2
- CVE-2020-15388A vulnerability in the Brocade Fabric OS before Brocade Fabric OS v9.0.1a, v8.2.3, v8.2.0_CBN4, and v7.4.2h could allow an authenticated CLIBrocade Fabric OS
- CVE-2021-27789The Web application of Brocade Fabric OS before versions Brocade Fabric OS v9.0.1a and v8.2.3a contains debug statements that expose sensitiBrocade Fabric OS
- CVE-2022-27243An issue was discovered in MISP before 2.4.156.
- CVE-2022-27244An issue was discovered in MISP before 2.4.156.
- CVE-2022-27245An issue was discovered in MISP before 2.4.156.
- CVE-2022-27246An issue was discovered in MISP before 2.4.156.
- CVE-2021-39046IBM Business Automation Workflow 18.0, 19.0, 20.0, and 21.0 and IBM Business Process Manager 8.5 and 8.6 stores user credentials in plain clIBM Business Automation Workflow · IBM Business Process Man…
- CVE-2021-29899IBM Engineering Requirements Quality Assistant prior to 3.1.3 could allow an authenticated user to cause a denial of service.IBM Engineering Requirements Quality Assistant
- CVE-2022-24773Improper Verification of Cryptographic Signature in `node-forge`digitalbazaar forge · node-forge
- CVE-2022-24595Automotive Grade Linux Kooky Koi 11.0.0, 11.0.1, 11.0.2, 11.0.3, 11.0.4, and 11.0.5 is affected by Incorrect Access Control in usr/bin/afb-d
- CVE-2021-22571Information Leak in SA360-webquery-bigquery through read on /tmpgoogle/sa360-webquery-bigquery
- CVE-2021-45834An attacker can upload or transfer files of dangerous types to the OpenDocMan 1.4.4 portal via add.php using MIME-bypass, which may be autom
- CVE-2021-45835The Online Admission System 1.0 allows an unauthenticated attacker to upload or transfer files of dangerous types to the application through
- CVE-2022-24655A stack overflow vulnerability exists in the upnpd service in Netgear EX6100v1 201.0.2.28, CAX80 2.1.2.6, and DC112A 1.0.0.62, which may lea
- CVE-2022-26965In Pluck 4.7.16, an admin user can use the theme upload functionality at /admin.php?action=themeinstall to perform remote code execution.
- CVE-2021-45868In the Linux kernel before 5.15.3, fs/quota/quota_tree.c does not validate the block number in the quota tree (on disk).
- CVE-2022-27191The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstgolang.org/x/crypto
- CVE-2022-27240scheme/webauthn.c in Glewlwyd SSO server 2.x before 2.6.2 has a buffer overflow associated with a webauthn assertion.
- CVE-2021-45967An issue was discovered in Pascom Cloud Phone System before 7.20.x.
- CVE-2021-45966An issue was discovered in Pascom Cloud Phone System before 7.20.x.
- CVE-2021-45968An issue was discovered in xmppserver jar in the XMPP Server component of the JIve platform, as used in Pascom Cloud Phone System before 7.2
- CVE-2022-1011A use-after-free flaw was found in the Linux kernel’s FUSE filesystem in the way a user triggers write().kernel
- CVE-2022-22643This issue was addressed with improved checks.Apple iOS and iPadOS · Apple macOS
- CVE-2022-24637Open Web Analytics (OWA) before 1.7.4 allows an unauthenticated remote attacker to obtain sensitive user information, which can be used to gopen-web-analytics/open-web-analytics