CVEs published March 21, 2022
63 CVEs were published on March 21, 2022: 2 critical, 4 high.
- Published
- 63
- Critical
- 2
- High
- 4
- Medium
- 4
- Low
- 3
- Unrated
- 50
- Now in CISA KEV
- 0
- Fix available
- 29
Most affected products
- Amelia – Events & Appointments Booking Calendar
- 3
- crater-invoice/crater
- 2
- OTRS AG OTRS
- 2
- Sophos UTM
- 2
- 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery
- 1
- Advanced Booking Calendar
- 1
- Advanced Contact form 7 DB
- 1
- BookingPress – Appointments Booking Calendar Plugin and Onl…
- 1
- BulletProof Security
- 1
- FormCraft
- 1
Critical 2
High 4
- CVE-2022-0386A post-auth SQL injection vulnerability in the Mail Manager potentially allows an authenticated attacker to execute code in Sophos UTM beforSophos UTM
- CVE-2022-24775Improper Input Validation in guzzlehttp/psr7guzzle psr7 · drupal/core +1
- CVE-2022-25766Remote Code Execution (RCE)ungit
- CVE-2022-22394The IBM Spectrum Protect 8.1.14.000 server could allow a remote attacker to bypass security restrictions, caused by improper enforcement of IBM Spectrum Protect Server
Medium, low and unrated 57
- CVE-2022-0652Confd log files contain local users', including root’s, SHA512crypt password hashes with insecure access permissions.Sophos UTM
- CVE-2022-26285Simple Subscription Website v1.0 was discovered to contain a SQL injection vulnerability via the id parameter in the apply endpoint.
- CVE-2022-26284Simple Client Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter in the manage_client endpo
- CVE-2022-26283Simple Subscription Website v1.0 was discovered to contain a SQL injection vulnerability via the id parameter in the view_plan endpoint.
- CVE-2022-27607Bento4 1.6.0-639 has a heap-based buffer over-read in the AP4_HvccAtom class, a different issue than CVE-2018-14531.
- CVE-2022-26174A remote code execution (RCE) vulnerability in Beekeeper Studio v3.2.0 allows attackers to execute arbitrary code via a crafted payload inje
- CVE-2022-27333idcCMS v1.10 was discovered to contain an issue which allows attackers to arbitrarily delete the install.lock file, resulting in a reset of
- CVE-2022-27090Cscms Music Portal System v4.2 was discovered to contain a redirection vulnerability via the backurl parameter.
- CVE-2021-40662A Cross-Site Request Forgery (CSRF) in Chamilo LMS 1.11.14 allows attackers to execute arbitrary commands on victim hosts via user interacti
- CVE-2021-38745Chamilo LMS v1.11.14 was discovered to contain a zero click code injection vulnerability which allows attackers to execute arbitrary code vi
- CVE-2021-46390An access control issue in the authentication module of Lexar_F35 v1.0.34 allows attackers to access sensitive data and cause a Denial of Se
- CVE-2022-26148An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix.
- CVE-2022-23345BigAnt Software BigAnt Server v5.6.06 was discovered to contain incorrect access control.
- CVE-2022-23346BigAnt Software BigAnt Server v5.6.06 was discovered to contain incorrect access control issues.
- CVE-2022-23352An issue in BigAnt Software BigAnt Server v5.6.06 can lead to a Denial of Service (DoS).
- CVE-2022-23348BigAnt Software BigAnt Server v5.6.06 was discovered to utilize weak password hashes.
- CVE-2022-23350BigAnt Software BigAnt Server v5.6.06 was discovered to contain a cross-site scripting (XSS) vulnerability.
- CVE-2022-23349BigAnt Software BigAnt Server v5.6.06 was discovered to contain a Cross-Site Request Forgery (CSRF).
- CVE-2022-23347BigAnt Software BigAnt Server v5.6.06 was discovered to be vulnerable to directory traversal attacks.
- CVE-2022-0760Simple Link Directory < 7.7.2 - Unauthenticated SQL injectionSimple Link Directory
- CVE-2022-0747Infographic Maker - iList < 4.3.8 - Unauthenticated SQL InjectionInfographic Maker – iList
- CVE-2022-0739BookingPress < 1.0.11 - Unauthenticated SQL InjectionBookingPress – Appointments Booking Calendar Plugin and Onl…
- CVE-2022-0694Advanced Booking Calendar < 1.7.0 - Unauthenticated SQL InjectionAdvanced Booking Calendar
- CVE-2022-0687Amelia < 1.0.46 - Manager+ RCEAmelia – Events & Appointments Booking Calendar
- CVE-2022-0681Simple Membership < 4.1.0 - Arbitrary Transaction Deletion via CSRFSimple Membership
- CVE-2022-0640AP Pricing Tables Lite < 1.1.5 - Reflected Cross-Site ScriptingPricing Table Builder – AP Pricing Tables Lite
- CVE-2022-0628AP Mega Menu < 3.0.8 - Reflected Cross-Site ScriptingMega Menu Plugin for WordPress – AP Mega Menu
- CVE-2022-0627Amelia < 1.0.46 - Reflected Cross-Site ScriptingAmelia – Events & Appointments Booking Calendar
- CVE-2022-0616Amelia < 1.0.46 - Arbitrary Customer Deletion via CSRFAmelia – Events & Appointments Booking Calendar
- CVE-2022-0591Formcraft3 < 3.8.28 - Unauthenticated SSRFFormCraft
- CVE-2022-0590BulletProof Security < 5.8 - Admin+ Stored Cross-Site Scripting (XSS)BulletProof Security
- CVE-2022-04233D FlipBook < 1.12.1 - Subscriber+ Stored Cross-Site Scripting3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery
- CVE-2022-0364Modern Events Calendar Lite < 6.4.0 - Contributor+ Stored Cross Site ScriptingModern Events Calendar Lite
- CVE-2022-0229miniOrange's Google Authenticator < 5.5 - Unauthenticated Arbitrary Options DeletionminiOrange's Google Authenticator
- CVE-2021-25019SEO Plugin by Squirrly SEO < 11.1.12 - Reflected Cross-Site ScriptingSEO Plugin by Squirrly SEO
- CVE-2021-24905Advanced Contact form 7 DB < 1.8.7 - Subscriber+ Arbitrary File DeletionAdvanced Contact form 7 DB
- CVE-2022-0515Cross-Site Request Forgery (CSRF) in crater-invoice/cratercrater-invoice/crater
- CVE-2022-0514Business Logic Errors in crater-invoice/cratercrater-invoice/crater
- CVE-2022-24235A Cross-Site Request Forgery (CSRF) in the management portal of Snapt Aria v12.8 allows attackers to escalate privileges and execute arbitra
- CVE-2022-24236An insecure permissions vulnerability in Snapt Aria v12.8 allows unauthenticated attackers to send e-mails from spoofed users' accounts.
- CVE-2022-24237The snaptPowered2 component of Snapt Aria v12.8 was discovered to contain a command injection vulnerability.
- CVE-2022-26960connector.minimal.php in std42 elFinder through 2.1.60 is affected by path traversal.studio-42/elfinder
- CVE-2020-24772In Dreamacro Clash for Windows v0.11.4, an attacker could embed a malicious iframe in a website with a crafted URL that would launch the Cla
- CVE-2022-26494An XSS was identified in the Admin Web interface of PrimeKey SignServer before 5.8.1.
- CVE-2021-45117The OPC autogenerated ANSI C stack stubs (in the NodeSets) do not handle all error cases.
- CVE-2022-25570In Click Studios (SA) Pty Ltd Passwordstate 9435, users with access to a passwordlist can gain access to additional password lists without p
- CVE-2022-24656HexoEditor 1.1.8 is affected by Cross Site Scripting (XSS).
- CVE-2021-45878Multiple versions of GARO Wallbox GLB/GTB/GTC are affected by incorrect access control.
- CVE-2021-45877Multiple versions of GARO Wallbox GLB/GTB/GTC are affected by hard coded credentials.
- CVE-2021-45876Multiple versions of GARO Wallbox GLB/GTB/GTC are affected by unauthenticated command injection.
- CVE-2022-1004Information disclosure in the External InterfaceOTRS AG OTRS
- CVE-2022-0475Possible XSS attack via translationOTRS AG OTRS
- CVE-2021-36100Authenticated remote code executionOTRS AG OTRS · OTRS AG SystemMonitoring +2
- CVE-2022-25505Taocms v3.0.2 was discovered to contain a SQL injection vulnerability via the id parameter in \include\Model\Category.php.
- CVE-2022-1035Segmentation Fault caused by MP4Box -lsr in gpac/gpacgpac/gpac
- CVE-2022-26183PNPM v6.15.1 and below was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when usepnpm
- CVE-2022-26184Poetry v1.1.9 and below was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when uspoetry