# CVEs published 2022-03-21

63 CVEs were published on March 21, 2022: 2 critical, 4 high. Days are UTC.

- [CVE-2022-0652](https://cve.now/CVE-2022-0652.md): Confd log files contain local users', including root’s, SHA512crypt password hashes with insecure access permissions. (CVSS 3.3, Sophos UTM)
- [CVE-2022-0386](https://cve.now/CVE-2022-0386.md): A post-auth SQL injection vulnerability in the Mail Manager potentially allows an authenticated attacker to execute code in Sophos UTM befor (CVSS 8.8, Sophos UTM)
- [CVE-2022-26285](https://cve.now/CVE-2022-26285.md): Simple Subscription Website v1.0 was discovered to contain a SQL injection vulnerability via the id parameter in the apply endpoint. (no CVSS)
- [CVE-2022-26284](https://cve.now/CVE-2022-26284.md): Simple Client Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter in the manage\_client endpo (no CVSS)
- [CVE-2022-26283](https://cve.now/CVE-2022-26283.md): Simple Subscription Website v1.0 was discovered to contain a SQL injection vulnerability via the id parameter in the view\_plan endpoint. (no CVSS)
- [CVE-2022-27607](https://cve.now/CVE-2022-27607.md): Bento4 1.6.0-639 has a heap-based buffer over-read in the AP4\_HvccAtom class, a different issue than CVE-2018-14531. (no CVSS)
- [CVE-2022-26174](https://cve.now/CVE-2022-26174.md): A remote code execution (RCE) vulnerability in Beekeeper Studio v3.2.0 allows attackers to execute arbitrary code via a crafted payload inje (no CVSS)
- [CVE-2022-27333](https://cve.now/CVE-2022-27333.md): idcCMS v1.10 was discovered to contain an issue which allows attackers to arbitrarily delete the install.lock file, resulting in a reset of (no CVSS)
- [CVE-2022-27090](https://cve.now/CVE-2022-27090.md): Cscms Music Portal System v4.2 was discovered to contain a redirection vulnerability via the backurl parameter. (no CVSS)
- [CVE-2021-40662](https://cve.now/CVE-2021-40662.md): A Cross-Site Request Forgery (CSRF) in Chamilo LMS 1.11.14 allows attackers to execute arbitrary commands on victim hosts via user interacti (no CVSS)
- [CVE-2021-38745](https://cve.now/CVE-2021-38745.md): Chamilo LMS v1.11.14 was discovered to contain a zero click code injection vulnerability which allows attackers to execute arbitrary code vi (no CVSS)
- [CVE-2021-46390](https://cve.now/CVE-2021-46390.md): An access control issue in the authentication module of Lexar\_F35 v1.0.34 allows attackers to access sensitive data and cause a Denial of Se (no CVSS)
- [CVE-2022-26148](https://cve.now/CVE-2022-26148.md): An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix. (no CVSS)
- [CVE-2022-23345](https://cve.now/CVE-2022-23345.md): BigAnt Software BigAnt Server v5.6.06 was discovered to contain incorrect access control. (no CVSS)
- [CVE-2022-23346](https://cve.now/CVE-2022-23346.md): BigAnt Software BigAnt Server v5.6.06 was discovered to contain incorrect access control issues. (no CVSS)
- [CVE-2022-23352](https://cve.now/CVE-2022-23352.md): An issue in BigAnt Software BigAnt Server v5.6.06 can lead to a Denial of Service (DoS). (no CVSS)
- [CVE-2022-23348](https://cve.now/CVE-2022-23348.md): BigAnt Software BigAnt Server v5.6.06 was discovered to utilize weak password hashes. (no CVSS)
- [CVE-2022-23350](https://cve.now/CVE-2022-23350.md): BigAnt Software BigAnt Server v5.6.06 was discovered to contain a cross-site scripting (XSS) vulnerability. (no CVSS)
- [CVE-2022-23349](https://cve.now/CVE-2022-23349.md): BigAnt Software BigAnt Server v5.6.06 was discovered to contain a Cross-Site Request Forgery (CSRF). (no CVSS)
- [CVE-2022-23347](https://cve.now/CVE-2022-23347.md): BigAnt Software BigAnt Server v5.6.06 was discovered to be vulnerable to directory traversal attacks. (no CVSS)
- [CVE-2022-24775](https://cve.now/CVE-2022-24775.md): Improper Input Validation in guzzlehttp/psr7 (CVSS 7.5, guzzle psr7 · drupal/core +1)
- [CVE-2022-0760](https://cve.now/CVE-2022-0760.md): Simple Link Directory \< 7.7.2 - Unauthenticated SQL injection (no CVSS, Simple Link Directory)
- [CVE-2022-0747](https://cve.now/CVE-2022-0747.md): Infographic Maker - iList \< 4.3.8 - Unauthenticated SQL Injection (no CVSS, Infographic Maker – iList)
- [CVE-2022-0739](https://cve.now/CVE-2022-0739.md): BookingPress \< 1.0.11 - Unauthenticated SQL Injection (no CVSS, BookingPress – Appointments Booking Calendar Plugin and Onl…)
- [CVE-2022-0694](https://cve.now/CVE-2022-0694.md): Advanced Booking Calendar \< 1.7.0 - Unauthenticated SQL Injection (no CVSS, Advanced Booking Calendar)
- [CVE-2022-0687](https://cve.now/CVE-2022-0687.md): Amelia \< 1.0.46 - Manager+ RCE (no CVSS, Amelia – Events & Appointments Booking Calendar)
- [CVE-2022-0681](https://cve.now/CVE-2022-0681.md): Simple Membership \< 4.1.0 - Arbitrary Transaction Deletion via CSRF (no CVSS, Simple Membership)
- [CVE-2022-0640](https://cve.now/CVE-2022-0640.md): AP Pricing Tables Lite \< 1.1.5 - Reflected Cross-Site Scripting (no CVSS, Pricing Table Builder – AP Pricing Tables Lite)
- [CVE-2022-0628](https://cve.now/CVE-2022-0628.md): AP Mega Menu \< 3.0.8 - Reflected Cross-Site Scripting (no CVSS, Mega Menu Plugin for WordPress – AP Mega Menu)
- [CVE-2022-0627](https://cve.now/CVE-2022-0627.md): Amelia \< 1.0.46 - Reflected Cross-Site Scripting (no CVSS, Amelia – Events & Appointments Booking Calendar)
- [CVE-2022-0616](https://cve.now/CVE-2022-0616.md): Amelia \< 1.0.46 - Arbitrary Customer Deletion via CSRF (no CVSS, Amelia – Events & Appointments Booking Calendar)
- [CVE-2022-0591](https://cve.now/CVE-2022-0591.md): Formcraft3 \< 3.8.28 - Unauthenticated SSRF (no CVSS, FormCraft)
- [CVE-2022-0590](https://cve.now/CVE-2022-0590.md): BulletProof Security \< 5.8 - Admin+ Stored Cross-Site Scripting (XSS) (no CVSS, BulletProof Security)
- [CVE-2022-0423](https://cve.now/CVE-2022-0423.md): 3D FlipBook \< 1.12.1 - Subscriber+ Stored Cross-Site Scripting (no CVSS, 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery)
- [CVE-2022-0364](https://cve.now/CVE-2022-0364.md): Modern Events Calendar Lite \< 6.4.0 - Contributor+ Stored Cross Site Scripting (no CVSS, Modern Events Calendar Lite)
- [CVE-2022-0229](https://cve.now/CVE-2022-0229.md): miniOrange's Google Authenticator \< 5.5 - Unauthenticated Arbitrary Options Deletion (no CVSS, miniOrange's Google Authenticator)
- [CVE-2021-25019](https://cve.now/CVE-2021-25019.md): SEO Plugin by Squirrly SEO \< 11.1.12 - Reflected Cross-Site Scripting (no CVSS, SEO Plugin by Squirrly SEO)
- [CVE-2021-24905](https://cve.now/CVE-2021-24905.md): Advanced Contact form 7 DB \< 1.8.7 - Subscriber+ Arbitrary File Deletion (no CVSS, Advanced Contact form 7 DB)
- [CVE-2022-0515](https://cve.now/CVE-2022-0515.md): Cross-Site Request Forgery (CSRF) in crater-invoice/crater (CVSS 4.3, crater-invoice/crater)
- [CVE-2022-0514](https://cve.now/CVE-2022-0514.md): Business Logic Errors in crater-invoice/crater (CVSS 6.5, crater-invoice/crater)
- [CVE-2022-24766](https://cve.now/CVE-2022-24766.md): Insufficient Protection against HTTP Request Smuggling in mitmproxy (CVSS 9.8, mitmproxy)
- [CVE-2022-24235](https://cve.now/CVE-2022-24235.md): A Cross-Site Request Forgery (CSRF) in the management portal of Snapt Aria v12.8 allows attackers to escalate privileges and execute arbitra (no CVSS)
- [CVE-2022-24236](https://cve.now/CVE-2022-24236.md): An insecure permissions vulnerability in Snapt Aria v12.8 allows unauthenticated attackers to send e-mails from spoofed users' accounts. (no CVSS)
- [CVE-2022-24237](https://cve.now/CVE-2022-24237.md): The snaptPowered2 component of Snapt Aria v12.8 was discovered to contain a command injection vulnerability. (no CVSS)
- [CVE-2022-25766](https://cve.now/CVE-2022-25766.md): Remote Code Execution (RCE) (CVSS 8.8, ungit)
- [CVE-2022-26960](https://cve.now/CVE-2022-26960.md): connector.minimal.php in std42 elFinder through 2.1.60 is affected by path traversal. (no CVSS, studio-42/elfinder)
- [CVE-2022-22394](https://cve.now/CVE-2022-22394.md): The IBM Spectrum Protect 8.1.14.000 server could allow a remote attacker to bypass security restrictions, caused by improper enforcement of (CVSS 7.5, IBM Spectrum Protect Server)
- [CVE-2020-24772](https://cve.now/CVE-2020-24772.md): In Dreamacro Clash for Windows v0.11.4, an attacker could embed a malicious iframe in a website with a crafted URL that would launch the Cla (no CVSS)
- [CVE-2022-26494](https://cve.now/CVE-2022-26494.md): An XSS was identified in the Admin Web interface of PrimeKey SignServer before 5.8.1. (no CVSS)
- [CVE-2021-45117](https://cve.now/CVE-2021-45117.md): The OPC autogenerated ANSI C stack stubs (in the NodeSets) do not handle all error cases. (no CVSS)
- [CVE-2022-25570](https://cve.now/CVE-2022-25570.md): In Click Studios (SA) Pty Ltd Passwordstate 9435, users with access to a passwordlist can gain access to additional password lists without p (no CVSS)
- [CVE-2022-24656](https://cve.now/CVE-2022-24656.md): HexoEditor 1.1.8 is affected by Cross Site Scripting (XSS). (no CVSS)
- [CVE-2021-45878](https://cve.now/CVE-2021-45878.md): Multiple versions of GARO Wallbox GLB/GTB/GTC are affected by incorrect access control. (no CVSS)
- [CVE-2022-0415](https://cve.now/CVE-2022-0415.md): Remote Command Execution in uploading repository file in gogs/gogs (CVSS 9.9, gogs/gogs · gogs.io/gogs)
- [CVE-2021-45877](https://cve.now/CVE-2021-45877.md): Multiple versions of GARO Wallbox GLB/GTB/GTC are affected by hard coded credentials. (no CVSS)
- [CVE-2021-45876](https://cve.now/CVE-2021-45876.md): Multiple versions of GARO Wallbox GLB/GTB/GTC are affected by unauthenticated command injection. (no CVSS)
- [CVE-2022-1004](https://cve.now/CVE-2022-1004.md): Information disclosure in the External Interface (CVSS 4.3, OTRS AG OTRS)
- [CVE-2022-0475](https://cve.now/CVE-2022-0475.md): Possible XSS attack via translation (CVSS 3.5, OTRS AG OTRS)
- [CVE-2021-36100](https://cve.now/CVE-2021-36100.md): Authenticated remote code execution (CVSS 6.4, OTRS AG OTRS · OTRS AG SystemMonitoring +2)
- [CVE-2022-25505](https://cve.now/CVE-2022-25505.md): Taocms v3.0.2 was discovered to contain a SQL injection vulnerability via the id parameter in \\include\\Model\\Category.php. (no CVSS)
- [CVE-2022-1035](https://cve.now/CVE-2022-1035.md): Segmentation Fault caused by MP4Box -lsr in gpac/gpac (CVSS 2.9, gpac/gpac)
- [CVE-2022-26183](https://cve.now/CVE-2022-26183.md): PNPM v6.15.1 and below was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when use (no CVSS, pnpm)
- [CVE-2022-26184](https://cve.now/CVE-2022-26184.md): Poetry v1.1.9 and below was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when us (no CVSS, poetry)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-03-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.