CVEs published March 22, 2022
21 CVEs were published on March 22, 2022: 1 critical, 4 high.
- Published
- 21
- Critical
- 1
- High
- 4
- Medium
- 1
- Low
- 1
- Unrated
- 14
- Now in CISA KEV
- 0
- Fix available
- 6
Most affected products
- cyclonedx-bom-repo-server
- 1
- electron
- 1
- ISC BIND
- 1
- microweber/microweber
- 1
- pjsip pjproject
- 1
- radareorg/radare2
- 1
- simple-plist
- 1
- star7th/showdoc · showdoc/showdoc
- 1
Critical 1
High 4
- CVE-2022-1031Use After Free in op_is_set_bp in radareorg/radare2radareorg/radare2
- CVE-2022-24774Improper Input Validation leading to Path Traversal in CycloneDX BOM Repository Servercyclonedx-bom-repo-server
- CVE-2022-0667Assertion failure on delayed DS lookupISC BIND
- CVE-2022-24764Stack buffer overflow in pjprojectpjsip pjproject
Medium, low and unrated 16
- CVE-2022-25518In CMDBuild from version 3.0 to 3.3.2 payload requests are saved in a temporary log table, which allows attackers with database access to re
- CVE-2021-33961A Cross Site Scripting (XSS) vulnerabililty exists in enhanced-github v5.0.11 via the file name parameter.
- CVE-2022-26189TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via the langType parameter in the login i
- CVE-2022-26188TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via /setting/NTPSyncWithHost.
- CVE-2022-26187TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via the pingCheck function.
- CVE-2022-26186TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via the exportOvpn interface at cstecgi.c
- CVE-2022-26260Simple-Plist v1.3.0 was discovered to contain a prototype pollution vulnerability via .parse().simple-plist
- CVE-2022-27228In the vote (aka "Polls, Votes") module before 21.0.100 of Bitrix Site Manager, a remote unauthenticated attacker can execute arbitrary code
- CVE-2021-41736Faust v2.35.0 was discovered to contain a heap-buffer overflow in the function realPropagate() at propagate.cpp.
- CVE-2022-25484tcpprep v4.4.1 has a reachable assertion (assert(l2len > 0)) in packet2tree() at tree.c in tcpprep v4.4.1.
- CVE-2022-21718Renderers can obtain access to random bluetooth device without permission in Electronelectron
- CVE-2021-43650WebRun 3.6.0.42 is vulnerable to SQL Injection via the P_0 parameter used to set the username during the login process.
- CVE-2022-1036Able to create an account with long password leads to memory corruption / Integer Overflow in microweber/microwebermicroweber/microweber
- CVE-2021-45809GlobalProtect-openconnect versions prior to 1.4.3 are affected by incorrect access control in GPService through DBUS, GUI Application.
- CVE-2021-45810GlobalProtect-openconnect versions prior to 2.0.0 (exclusive) are affected by incorrect access control in GPService through DBUS, GUI.
- CVE-2022-25517MyBatis plus v3.4.3 was discovered to contain a SQL injection vulnerability via the Column parameter in /core/conditions/AbstractWrapper.jav