# CVEs published 2022-03-18

159 CVEs were published on March 18, 2022: 5 critical, 9 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2022-26267](https://cve.now/CVE-2022-26267.md): Piwigo v12.2.0 was discovered to contain an information leak via the action parameter in /admin/maintenance\_actions.php. (no CVSS)
- [CVE-2022-26265](https://cve.now/CVE-2022-26265.md): Contao Managed Edition v1.5.0 was discovered to contain a remote command execution (RCE) vulnerability via the component php\_cli parameter. (no CVSS, contao/managed-edition)
- [CVE-2022-26266](https://cve.now/CVE-2022-26266.md): Piwigo v12.2.0 was discovered to contain a SQL injection vulnerability via pwg.users.php. (no CVSS)
- [CVE-2022-25581](https://cve.now/CVE-2022-25581.md): Classcms v2.5 and below contains an arbitrary file upload via the component \\class\\classupload. (no CVSS)
- [CVE-2022-25578](https://cve.now/CVE-2022-25578.md): taocms v3.0.2 allows attackers to execute code injection via arbitrarily editing the .htaccess file. (no CVSS)
- [CVE-2022-25390](https://cve.now/CVE-2022-25390.md): DCN Firewall DCME-520 was discovered to contain a remote command execution (RCE) vulnerability via the host parameter in the file /system/to (no CVSS)
- [CVE-2022-25389](https://cve.now/CVE-2022-25389.md): DCN Firewall DCME-520 was discovered to contain an arbitrary file download vulnerability via the path parameter in the file /audit/log/log\_m (no CVSS)
- [CVE-2022-25460](https://cve.now/CVE-2022-25460.md): Tenda AC6 v15.03.05.09\_multi was discovered to contain a stack overflow via the endip parameter in the SetPptpServerCfg function. (no CVSS)
- [CVE-2022-25461](https://cve.now/CVE-2022-25461.md): Tenda AC6 v15.03.05.09\_multi was discovered to contain a stack overflow via the startip parameter in the SetPptpServerCfg function. (no CVSS)
- [CVE-2022-25459](https://cve.now/CVE-2022-25459.md): Tenda AC6 v15.03.05.09\_multi was discovered to contain a stack overflow via the S1 parameter in the SetSysTimeCfg function. (no CVSS)
- [CVE-2022-25458](https://cve.now/CVE-2022-25458.md): Tenda AC6 v15.03.05.09\_multi was discovered to contain a stack overflow via the cmdinput parameter in the exeCommand function. (no CVSS)
- [CVE-2022-25457](https://cve.now/CVE-2022-25457.md): Tenda AC6 v15.03.05.09\_multi was discovered to contain a stack overflow via the ntpserver parameter in the SetSysTimeCfg function. (no CVSS)
- [CVE-2022-25455](https://cve.now/CVE-2022-25455.md): Tenda AC6 v15.03.05.09\_multi was discovered to contain a stack overflow via the list parameter in the SetIpMacBind function. (no CVSS)
- [CVE-2022-25456](https://cve.now/CVE-2022-25456.md): Tenda AC6 v15.03.05.09\_multi was discovered to contain a stack overflow via the security\_5g parameter in the WifiBasicSet function. (no CVSS)
- [CVE-2022-25454](https://cve.now/CVE-2022-25454.md): Tenda AC6 v15.03.05.09\_multi was discovered to contain a stack overflow via the loginpwd parameter in the SetFirewallCfg function. (no CVSS)
- [CVE-2022-25452](https://cve.now/CVE-2022-25452.md): Tenda AC6 v15.03.05.09\_multi was discovered to contain a stack overflow via the URLs parameter in the saveParentControlInfo function. (no CVSS)
- [CVE-2022-25453](https://cve.now/CVE-2022-25453.md): Tenda AC6 v15.03.05.09\_multi was discovered to contain a stack overflow via the time parameter in the saveParentControlInfo function. (no CVSS)
- [CVE-2022-25451](https://cve.now/CVE-2022-25451.md): Tenda AC6 V15.03.05.09\_multi was discovered to contain a stack overflow via the list parameter in the setstaticroutecfg function. (no CVSS)
- [CVE-2022-25449](https://cve.now/CVE-2022-25449.md): Tenda AC6 v15.03.05.09\_multi was discovered to contain a stack overflow via the deviceId parameter in the saveParentControlInfo function. (no CVSS)
- [CVE-2022-25450](https://cve.now/CVE-2022-25450.md): Tenda AC6 V15.03.05.09\_multi was discovered to contain a stack overflow via the list parameter in the SetVirtualServerCfg function. (no CVSS)
- [CVE-2022-25448](https://cve.now/CVE-2022-25448.md): Tenda AC6 v15.03.05.09\_multi was discovered to contain a stack overflow via the day parameter in the openSchedWifi function. (no CVSS)
- [CVE-2022-25446](https://cve.now/CVE-2022-25446.md): Tenda AC6 v15.03.05.09\_multi was discovered to contain a stack overflow via the schedstarttime parameter in the openSchedWifi function. (no CVSS)
- [CVE-2022-25447](https://cve.now/CVE-2022-25447.md): Tenda AC6 v15.03.05.09\_multi was discovered to contain a stack overflow via the schedendtime parameter in the openSchedWifi function. (no CVSS)
- [CVE-2022-25445](https://cve.now/CVE-2022-25445.md): Tenda AC6 v15.03.05.09\_multi was discovered to contain a stack overflow via the time parameter in the PowerSaveSet function. (no CVSS)
- [CVE-2022-25441](https://cve.now/CVE-2022-25441.md): Tenda AC9 v15.03.2.21 was discovered to contain a remote command execution (RCE) vulnerability via the vlanid parameter in the SetIPTVCfg fu (no CVSS)
- [CVE-2022-25440](https://cve.now/CVE-2022-25440.md): Tenda AC9 v15.03.2.21 was discovered to contain a stack overflow via the ntpserver parameter in the SetSysTimeCfg function. (no CVSS)
- [CVE-2022-25438](https://cve.now/CVE-2022-25438.md): Tenda AC9 v15.03.2.21 was discovered to contain a remote command execution (RCE) vulnerability via the SetIPTVCfg function. (no CVSS)
- [CVE-2022-25439](https://cve.now/CVE-2022-25439.md): Tenda AC9 v15.03.2.21 was discovered to contain a stack overflow via the list parameter in the SetIpMacBind function. (no CVSS)
- [CVE-2022-25437](https://cve.now/CVE-2022-25437.md): Tenda AC9 v15.03.2.21 was discovered to contain a stack overflow via the list parameter in the SetVirtualServerCfg function. (no CVSS)
- [CVE-2022-25435](https://cve.now/CVE-2022-25435.md): Tenda AC9 v15.03.2.21 was discovered to contain a stack overflow via the list parameter in the SetStaticRoutecfg function. (no CVSS)
- [CVE-2022-25434](https://cve.now/CVE-2022-25434.md): Tenda AC9 v15.03.2.21 was discovered to contain a stack overflow via the firewallen parameter in the SetFirewallCfg function. (no CVSS)
- [CVE-2022-25433](https://cve.now/CVE-2022-25433.md): Tenda AC9 v15.03.2.21 was discovered to contain a stack overflow via the urls parameter in the saveparentcontrolinfo function. (no CVSS)
- [CVE-2022-25428](https://cve.now/CVE-2022-25428.md): Tenda AC9 v15.03.2.21 was discovered to contain a stack overflow via the deviceId parameter in the saveparentcontrolinfo function. (no CVSS)
- [CVE-2022-25431](https://cve.now/CVE-2022-25431.md): Tenda AC9 v15.03.2.21 was discovered to contain multiple stack overflows via the NPTR, V12, V10 and V11 parameter in the Formsetqosband func (no CVSS)
- [CVE-2022-25429](https://cve.now/CVE-2022-25429.md): Tenda AC9 v15.03.2.21 was discovered to contain a buffer overflow via the time parameter in the saveparentcontrolinfo function. (no CVSS)
- [CVE-2022-25427](https://cve.now/CVE-2022-25427.md): Tenda AC9 v15.03.2.21 was discovered to contain a stack overflow via the schedendtime parameter in the openSchedWifi function. (no CVSS)
- [CVE-2022-27250](https://cve.now/CVE-2022-27250.md): The UNISOC chipset through 2022-03-15 allows attackers to obtain remote control of a mobile phone, e.g., to obtain sensitive information fro (no CVSS)
- [CVE-2020-25193](https://cve.now/CVE-2020-25193.md): GE Reason RT43X Clocks Use of Hard-coded Cryptographic Key (CVSS 5.3, GE Reason RT43X Clocks)
- [CVE-2020-25197](https://cve.now/CVE-2020-25197.md): GE Reason RT43X Clocks Code Injection (CVSS 9.8, GE Reason RT43X Clocks)
- [CVE-2020-25180](https://cve.now/CVE-2020-25180.md): Rockwell Automation ISaGRAF5 Runtime Use of Hard-coded Cryptographic Key (CVSS 5.3, Rockwell Automation ISaGRAF Runtime)
- [CVE-2020-25184](https://cve.now/CVE-2020-25184.md): Rockwell Automation ISaGRAF5 Runtime Unprotected Storage of Credentials (CVSS 7.8, Rockwell Automation ISaGRAF Runtime)
- [CVE-2020-25176](https://cve.now/CVE-2020-25176.md): Rockwell Automation ISaGRAF5 Runtime Relative Path Traversal (CVSS 9.1, Rockwell Automation ISaGRAF Runtime)
- [CVE-2020-25178](https://cve.now/CVE-2020-25178.md): Rockwell Automation ISaGRAF5 Runtime Cleartext Transmission of Sensitive Information (CVSS 7.5, Rockwell Automation ISaGRAF Runtime)
- [CVE-2020-25182](https://cve.now/CVE-2020-25182.md): Rockwell Automation ISaGRAF5 Runtime Uncontrolled Search Path Element (CVSS 6.7, Rockwell Automation ISaGRAF Runtime)
- [CVE-2020-16232](https://cve.now/CVE-2020-16232.md): Yokogawa WideField3 Buffer Copy Without Checking Size of Input (CVSS 2.8, Yokogawa WideField3)
- [CVE-2022-25607](https://cve.now/CVE-2022-25607.md): WordPress FV Flowplayer Video Player plugin \<= 7.5.15.727 - SQL Injection (SQLi) vulnerability (CVSS 6.6, FolioVision FV Flowplayer Video Player)
- [CVE-2022-25605](https://cve.now/CVE-2022-25605.md): WordPress WP-DownloadManager plugin \<= 1.68.6 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities (CVSS 4.8, Lester 'GaMerZ' Chan WP-DownloadManager)
- [CVE-2022-25602](https://cve.now/CVE-2022-25602.md): WordPress Responsive Menu plugin \<= 4.1.7 - Nonce token leak leading to arbitrary file upload, theme deletion, plugin settings change vulnerability (CVSS 8.3, ExpressTech Responsive Menu)
- [CVE-2022-25604](https://cve.now/CVE-2022-25604.md): WordPress Price Table plugin \<= 0.2.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (CVSS 4.1, Greg Priday Price Table)
- [CVE-2021-23209](https://cve.now/CVE-2021-23209.md): WordPress AMP for WP – Accelerated Mobile Pages plugin \<= 1.0.77.32 - Multiple Auth. Stored Cross-Site Scripting (XSS) vulnerabilities (CVSS 4.8, Ahmed Kaludi, Mohammed Kaludi AMP for WP – Accelerated Mobi…)
- [CVE-2021-23150](https://cve.now/CVE-2021-23150.md): WordPress AMP for WP – Accelerated Mobile Pages plugin \<= 1.0.77.31 - Auth. Stored Cross-Site Scripting (XSS) vulnerability (CVSS 4.8, Ahmed Kaludi, Mohammed Kaludi AMP for WP – Accelerated Mobi…)
- [CVE-2021-44760](https://cve.now/CVE-2021-44760.md): WordPress WP-DownloadManager plugin \<= 1.68.6 - Auth. Reflected Cross-Site Scripting (XSS) vulnerability (CVSS 4.8, Lester 'GaMerZ' Chan WP-DownloadManager)
- [CVE-2022-25603](https://cve.now/CVE-2022-25603.md): WordPress MaxGalleria plugin \<= 6.2.5 - Stored Cross-Site Scripting (XSS) vulnerability (CVSS 4.8, Max Foundry MaxGalleria)
- [CVE-2022-1002](https://cve.now/CVE-2022-1002.md): HTML Injection while inviting Guests (CVSS 2.0, Mattermost)
- [CVE-2022-1003](https://cve.now/CVE-2022-1003.md): Sysadmin can override existing configs & bypass restrictions like EnableUploads (CVSS 3.3, Mattermost)
- [CVE-2022-0547](https://cve.now/CVE-2022-0547.md): OpenVPN 2.1 until v2.4.12 and v2.5.6 may enable authentication bypass in external authentication plug-ins when more than one of them makes u (CVSS 9.8, OpenVPN)
- [CVE-2022-22659](https://cve.now/CVE-2022-22659.md): A logic issue was addressed with improved state management. (no CVSS, Apple iOS and iPadOS)
- [CVE-2022-22670](https://cve.now/CVE-2022-22670.md): An access issue was addressed with improved access restrictions. (no CVSS, Apple iOS and iPadOS · Apple tvOS +1)
- [CVE-2022-22667](https://cve.now/CVE-2022-22667.md): A use after free issue was addressed with improved memory management. (no CVSS, Apple iOS and iPadOS)
- [CVE-2022-22661](https://cve.now/CVE-2022-22661.md): A type confusion issue was addressed with improved state handling. (no CVSS, Apple macOS)
- [CVE-2022-22671](https://cve.now/CVE-2022-22671.md): An authentication issue was addressed with improved state management. (no CVSS, Apple iOS and iPadOS)
- [CVE-2022-22669](https://cve.now/CVE-2022-22669.md): A use after free issue was addressed with improved memory management. (no CVSS, Apple macOS)
- [CVE-2022-22665](https://cve.now/CVE-2022-22665.md): A logic issue was addressed with improved validation. (no CVSS, Apple macOS)
- [CVE-2022-22651](https://cve.now/CVE-2022-22651.md): An out-of-bounds write issue was addressed with improved bounds checking. (no CVSS, Apple macOS)
- [CVE-2022-22666](https://cve.now/CVE-2022-22666.md): A memory corruption issue was addressed with improved validation. (no CVSS, Apple iOS and iPadOS · Apple tvOS +1)
- [CVE-2022-22656](https://cve.now/CVE-2022-22656.md): An authentication issue was addressed with improved state management. (no CVSS, Apple macOS)
- [CVE-2022-22653](https://cve.now/CVE-2022-22653.md): A logic issue was addressed with improved restrictions. (no CVSS, Apple iOS and iPadOS)
- [CVE-2022-22664](https://cve.now/CVE-2022-22664.md): An out-of-bounds read was addressed with improved bounds checking. (no CVSS, Apple macOS)
- [CVE-2022-22657](https://cve.now/CVE-2022-22657.md): A memory initialization issue was addressed with improved memory handling. (no CVSS, Apple macOS)
- [CVE-2022-22660](https://cve.now/CVE-2022-22660.md): This issue was addressed with a new entitlement. (no CVSS, Apple macOS)
- [CVE-2022-22648](https://cve.now/CVE-2022-22648.md): This issue was addressed with improved checks. (no CVSS, Apple macOS)
- [CVE-2022-22654](https://cve.now/CVE-2022-22654.md): A user interface issue was addressed. (no CVSS, Apple Safari · Apple watchOS)
- [CVE-2022-22642](https://cve.now/CVE-2022-22642.md): This issue was addressed with improved checks. (no CVSS, Apple iOS and iPadOS)
- [CVE-2022-22644](https://cve.now/CVE-2022-22644.md): A privacy issue existed in the handling of Contact cards. (no CVSS, Apple macOS)
- [CVE-2022-22652](https://cve.now/CVE-2022-22652.md): The GSMA authentication panel could be presented on the lock screen. (no CVSS, Apple iOS and iPadOS)
- [CVE-2022-22647](https://cve.now/CVE-2022-22647.md): This issue was addressed with improved checks. (no CVSS, Apple macOS)
- [CVE-2022-22650](https://cve.now/CVE-2022-22650.md): This issue was addressed with improved checks. (no CVSS, Apple macOS)
- [CVE-2022-22638](https://cve.now/CVE-2022-22638.md): A null pointer dereference was addressed with improved validation. (no CVSS, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2022-22640](https://cve.now/CVE-2022-22640.md): A memory corruption issue was addressed with improved validation. (no CVSS, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2022-22641](https://cve.now/CVE-2022-22641.md): A use after free issue was addressed with improved memory management. (no CVSS, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2022-22633](https://cve.now/CVE-2022-22633.md): A memory corruption issue was addressed with improved state management. (no CVSS, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2022-22635](https://cve.now/CVE-2022-22635.md): An out-of-bounds write issue was addressed with improved bounds checking. (no CVSS, Apple iOS and iPadOS · Apple tvOS)
- [CVE-2022-22639](https://cve.now/CVE-2022-22639.md): A logic issue was addressed with improved state management. (no CVSS, Apple iOS and iPadOS · Apple macOS)
- [CVE-2022-22636](https://cve.now/CVE-2022-22636.md): An out-of-bounds write issue was addressed with improved bounds checking. (no CVSS, Apple iOS and iPadOS · Apple tvOS)
- [CVE-2022-22631](https://cve.now/CVE-2022-22631.md): An out-of-bounds write issue was addressed with improved bounds checking. (no CVSS, Apple macOS)
- [CVE-2022-22632](https://cve.now/CVE-2022-22632.md): A logic issue was addressed with improved state management. (no CVSS, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2022-22621](https://cve.now/CVE-2022-22621.md): This issue was addressed with improved checks. (no CVSS, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2022-22634](https://cve.now/CVE-2022-22634.md): A buffer overflow was addressed with improved bounds checking. (no CVSS, Apple iOS and iPadOS · Apple tvOS)
- [CVE-2022-22626](https://cve.now/CVE-2022-22626.md): An out-of-bounds read was addressed with improved bounds checking. (no CVSS, Apple macOS)
- [CVE-2022-22627](https://cve.now/CVE-2022-22627.md): An out-of-bounds read was addressed with improved bounds checking. (no CVSS, Apple macOS)
- [CVE-2022-22622](https://cve.now/CVE-2022-22622.md): This issue was addressed with improved checks. (no CVSS, Apple iOS and iPadOS)
- [CVE-2022-22625](https://cve.now/CVE-2022-22625.md): An out-of-bounds read was addressed with improved input validation. (no CVSS, Apple macOS)
- [CVE-2022-22618](https://cve.now/CVE-2022-22618.md): This issue was addressed with improved checks. (no CVSS, Apple iOS and iPadOS · Apple watchOS)
- [CVE-2022-22620](https://cve.now/CVE-2022-22620.md): A use after free issue was addressed with improved memory management. (CVSS 8.8, KEV, Apple Safari · Apple macOS)
- [CVE-2022-22612](https://cve.now/CVE-2022-22612.md): A memory consumption issue was addressed with improved memory handling. (no CVSS, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2022-22614](https://cve.now/CVE-2022-22614.md): A use after free issue was addressed with improved memory management. (no CVSS, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2022-22609](https://cve.now/CVE-2022-22609.md): The issue was addressed with additional permissions checks. (no CVSS, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2022-22615](https://cve.now/CVE-2022-22615.md): A use after free issue was addressed with improved memory management. (no CVSS, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2022-22617](https://cve.now/CVE-2022-22617.md): A logic issue was addressed with improved state management. (no CVSS, Apple macOS)
- [CVE-2022-22613](https://cve.now/CVE-2022-22613.md): An out-of-bounds write issue was addressed with improved bounds checking. (no CVSS, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2022-22611](https://cve.now/CVE-2022-22611.md): An out-of-bounds read was addressed with improved input validation. (no CVSS, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2022-22607](https://cve.now/CVE-2022-22607.md): An out-of-bounds read was addressed with improved bounds checking. (no CVSS, Apple Xcode)
- [CVE-2022-22605](https://cve.now/CVE-2022-22605.md): An out-of-bounds read was addressed with improved bounds checking. (no CVSS, Apple Xcode)
- [CVE-2022-22608](https://cve.now/CVE-2022-22608.md): An out-of-bounds read was addressed with improved bounds checking. (no CVSS, Apple Xcode)
- [CVE-2022-22603](https://cve.now/CVE-2022-22603.md): An out-of-bounds read was addressed with improved bounds checking. (no CVSS, Apple Xcode)
- [CVE-2022-22601](https://cve.now/CVE-2022-22601.md): An out-of-bounds read was addressed with improved bounds checking. (no CVSS, Apple Xcode)
- [CVE-2022-22606](https://cve.now/CVE-2022-22606.md): An out-of-bounds read was addressed with improved bounds checking. (no CVSS, Apple Xcode)
- [CVE-2022-22602](https://cve.now/CVE-2022-22602.md): An out-of-bounds read was addressed with improved bounds checking. (no CVSS, Apple Xcode)
- [CVE-2022-22604](https://cve.now/CVE-2022-22604.md): An out-of-bounds read was addressed with improved bounds checking. (no CVSS, Apple Xcode)
- [CVE-2022-22599](https://cve.now/CVE-2022-22599.md): Description: A permissions issue was addressed with improved validation. (no CVSS, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2022-22600](https://cve.now/CVE-2022-22600.md): The issue was addressed with improved permissions logic. (no CVSS, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2022-22597](https://cve.now/CVE-2022-22597.md): A memory corruption issue was addressed with improved validation. (no CVSS, Apple macOS)
- [CVE-2022-22592](https://cve.now/CVE-2022-22592.md): A logic issue was addressed with improved state management. (no CVSS, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2022-22594](https://cve.now/CVE-2022-22594.md): A cross-origin issue in the IndexDB API was addressed with improved input validation. (no CVSS, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2022-22598](https://cve.now/CVE-2022-22598.md): An issue with app access to camera metadata was addressed with improved logic. (no CVSS, Apple iOS and iPadOS)
- [CVE-2022-22593](https://cve.now/CVE-2022-22593.md): A buffer overflow issue was addressed with improved memory handling. (no CVSS, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2022-22596](https://cve.now/CVE-2022-22596.md): A memory corruption issue was addressed with improved validation. (no CVSS, Apple iOS and iPadOS · Apple watchOS)
- [CVE-2022-22590](https://cve.now/CVE-2022-22590.md): A use after free issue was addressed with improved memory management. (no CVSS, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2022-22591](https://cve.now/CVE-2022-22591.md): A memory corruption issue was addressed with improved memory handling. (no CVSS, Apple macOS)
- [CVE-2022-22589](https://cve.now/CVE-2022-22589.md): A validation issue was addressed with improved input sanitization. (no CVSS, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2022-22588](https://cve.now/CVE-2022-22588.md): A resource exhaustion issue was addressed with improved input validation. (no CVSS, Apple iOS and iPadOS)
- [CVE-2022-22584](https://cve.now/CVE-2022-22584.md): A memory corruption issue was addressed with improved validation. (no CVSS, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2022-22586](https://cve.now/CVE-2022-22586.md): An out-of-bounds write issue was addressed with improved bounds checking. (no CVSS, Apple macOS)
- [CVE-2022-22587](https://cve.now/CVE-2022-22587.md): A memory corruption issue was addressed with improved input validation. (CVSS 9.8, KEV, Apple iOS and iPadOS · Apple macOS)
- [CVE-2022-22585](https://cve.now/CVE-2022-22585.md): An issue existed within the path validation logic for symlinks. (no CVSS, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2022-22583](https://cve.now/CVE-2022-22583.md): A permissions issue was addressed with improved validation. (no CVSS, Apple macOS)
- [CVE-2022-22578](https://cve.now/CVE-2022-22578.md): A logic issue was addressed with improved validation. (no CVSS, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2022-22579](https://cve.now/CVE-2022-22579.md): An information disclosure issue was addressed with improved state management. (no CVSS, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2021-30771](https://cve.now/CVE-2021-30771.md): An out-of-bounds write was addressed with improved input validation. (no CVSS, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2020-15388](https://cve.now/CVE-2020-15388.md): A vulnerability in the Brocade Fabric OS before Brocade Fabric OS v9.0.1a, v8.2.3, v8.2.0\_CBN4, and v7.4.2h could allow an authenticated CLI (no CVSS, Brocade Fabric OS)
- [CVE-2021-27789](https://cve.now/CVE-2021-27789.md): The Web application of Brocade Fabric OS before versions Brocade Fabric OS v9.0.1a and v8.2.3a contains debug statements that expose sensiti (no CVSS, Brocade Fabric OS)
- [CVE-2022-24091](https://cve.now/CVE-2022-24091.md): Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2022-24092](https://cve.now/CVE-2022-24092.md): Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2021-4031](https://cve.now/CVE-2021-4031.md): Syltek Insufficient Verification of Data Authenticity (CVSS 7.5, Syltek)
- [CVE-2022-27243](https://cve.now/CVE-2022-27243.md): An issue was discovered in MISP before 2.4.156. (no CVSS)
- [CVE-2022-27244](https://cve.now/CVE-2022-27244.md): An issue was discovered in MISP before 2.4.156. (no CVSS)
- [CVE-2022-27245](https://cve.now/CVE-2022-27245.md): An issue was discovered in MISP before 2.4.156. (no CVSS)
- [CVE-2022-27246](https://cve.now/CVE-2022-27246.md): An issue was discovered in MISP before 2.4.156. (no CVSS)
- [CVE-2021-39046](https://cve.now/CVE-2021-39046.md): IBM Business Automation Workflow 18.0, 19.0, 20.0, and 21.0 and IBM Business Process Manager 8.5 and 8.6 stores user credentials in plain cl (CVSS 4.9, IBM Business Automation Workflow · IBM Business Process Man…)
- [CVE-2021-29899](https://cve.now/CVE-2021-29899.md): IBM Engineering Requirements Quality Assistant prior to 3.1.3 could allow an authenticated user to cause a denial of service. (CVSS 6.5, IBM Engineering Requirements Quality Assistant)
- [CVE-2022-24772](https://cve.now/CVE-2022-24772.md): Improper Verification of Cryptographic Signature in \`node-forge\` (CVSS 7.5, digitalbazaar forge · node-forge)
- [CVE-2022-24773](https://cve.now/CVE-2022-24773.md): Improper Verification of Cryptographic Signature in \`node-forge\` (CVSS 5.3, digitalbazaar forge · node-forge)
- [CVE-2022-24771](https://cve.now/CVE-2022-24771.md): Improper Verification of Cryptographic Signature in node-forge (CVSS 7.5, digitalbazaar forge · node-forge)
- [CVE-2022-0742](https://cve.now/CVE-2022-0742.md): Memory leak in ICMP6 in Linux Kernel (CVSS 9.1, Linux Kernel)
- [CVE-2022-24595](https://cve.now/CVE-2022-24595.md): Automotive Grade Linux Kooky Koi 11.0.0, 11.0.1, 11.0.2, 11.0.3, 11.0.4, and 11.0.5 is affected by Incorrect Access Control in usr/bin/afb-d (no CVSS)
- [CVE-2021-22571](https://cve.now/CVE-2021-22571.md): Information Leak in SA360-webquery-bigquery through read on /tmp (CVSS 5.5, google/sa360-webquery-bigquery)
- [CVE-2021-45834](https://cve.now/CVE-2021-45834.md): An attacker can upload or transfer files of dangerous types to the OpenDocMan 1.4.4 portal via add.php using MIME-bypass, which may be autom (no CVSS)
- [CVE-2021-45835](https://cve.now/CVE-2021-45835.md): The Online Admission System 1.0 allows an unauthenticated attacker to upload or transfer files of dangerous types to the application through (no CVSS)
- [CVE-2022-24655](https://cve.now/CVE-2022-24655.md): A stack overflow vulnerability exists in the upnpd service in Netgear EX6100v1 201.0.2.28, CAX80 2.1.2.6, and DC112A 1.0.0.62, which may lea (no CVSS)
- [CVE-2022-26965](https://cve.now/CVE-2022-26965.md): In Pluck 4.7.16, an admin user can use the theme upload functionality at /admin.php?action=themeinstall to perform remote code execution. (no CVSS)
- [CVE-2021-45868](https://cve.now/CVE-2021-45868.md): In the Linux kernel before 5.15.3, fs/quota/quota\_tree.c does not validate the block number in the quota tree (on disk). (no CVSS)
- [CVE-2022-27191](https://cve.now/CVE-2022-27191.md): The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumst (no CVSS, golang.org/x/crypto)
- [CVE-2022-27240](https://cve.now/CVE-2022-27240.md): scheme/webauthn.c in Glewlwyd SSO server 2.x before 2.6.2 has a buffer overflow associated with a webauthn assertion. (no CVSS)
- [CVE-2021-45967](https://cve.now/CVE-2021-45967.md): An issue was discovered in Pascom Cloud Phone System before 7.20.x. (no CVSS)
- [CVE-2021-45966](https://cve.now/CVE-2021-45966.md): An issue was discovered in Pascom Cloud Phone System before 7.20.x. (no CVSS)
- [CVE-2021-45968](https://cve.now/CVE-2021-45968.md): An issue was discovered in xmppserver jar in the XMPP Server component of the JIve platform, as used in Pascom Cloud Phone System before 7.2 (no CVSS)
- [CVE-2022-1011](https://cve.now/CVE-2022-1011.md): A use-after-free flaw was found in the Linux kernel’s FUSE filesystem in the way a user triggers write(). (no CVSS, kernel)
- [CVE-2022-22643](https://cve.now/CVE-2022-22643.md): This issue was addressed with improved checks. (no CVSS, Apple iOS and iPadOS · Apple macOS)
- [CVE-2022-24637](https://cve.now/CVE-2022-24637.md): Open Web Analytics (OWA) before 1.7.4 allows an unauthenticated remote attacker to obtain sensitive user information, which can be used to g (no CVSS, open-web-analytics/open-web-analytics)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-03-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.