# CVEs published 2022-03-22

21 CVEs were published on March 22, 2022: 1 critical, 4 high. Days are UTC.

- [CVE-2022-25518](https://cve.now/CVE-2022-25518.md): In CMDBuild from version 3.0 to 3.3.2 payload requests are saved in a temporary log table, which allows attackers with database access to re (no CVSS)
- [CVE-2021-33961](https://cve.now/CVE-2021-33961.md): A Cross Site Scripting (XSS) vulnerabililty exists in enhanced-github v5.0.11 via the file name parameter. (no CVSS)
- [CVE-2022-26189](https://cve.now/CVE-2022-26189.md): TOTOLINK N600R V4.3.0cu.7570\_B20200620 was discovered to contain a command injection vulnerability via the langType parameter in the login i (no CVSS)
- [CVE-2022-26188](https://cve.now/CVE-2022-26188.md): TOTOLINK N600R V4.3.0cu.7570\_B20200620 was discovered to contain a command injection vulnerability via /setting/NTPSyncWithHost. (no CVSS)
- [CVE-2022-26187](https://cve.now/CVE-2022-26187.md): TOTOLINK N600R V4.3.0cu.7570\_B20200620 was discovered to contain a command injection vulnerability via the pingCheck function. (no CVSS)
- [CVE-2022-26186](https://cve.now/CVE-2022-26186.md): TOTOLINK N600R V4.3.0cu.7570\_B20200620 was discovered to contain a command injection vulnerability via the exportOvpn interface at cstecgi.c (no CVSS)
- [CVE-2022-1031](https://cve.now/CVE-2022-1031.md): Use After Free in op\_is\_set\_bp in radareorg/radare2 (CVSS 7.3, radareorg/radare2)
- [CVE-2022-26260](https://cve.now/CVE-2022-26260.md): Simple-Plist v1.3.0 was discovered to contain a prototype pollution vulnerability via .parse(). (no CVSS, simple-plist)
- [CVE-2022-27228](https://cve.now/CVE-2022-27228.md): In the vote (aka "Polls, Votes") module before 21.0.100 of Bitrix Site Manager, a remote unauthenticated attacker can execute arbitrary code (no CVSS)
- [CVE-2021-41736](https://cve.now/CVE-2021-41736.md): Faust v2.35.0 was discovered to contain a heap-buffer overflow in the function realPropagate() at propagate.cpp. (no CVSS)
- [CVE-2022-25484](https://cve.now/CVE-2022-25484.md): tcpprep v4.4.1 has a reachable assertion (assert(l2len \> 0)) in packet2tree() at tree.c in tcpprep v4.4.1. (no CVSS)
- [CVE-2022-24774](https://cve.now/CVE-2022-24774.md): Improper Input Validation leading to Path Traversal in CycloneDX BOM Repository Server (CVSS 7.1, cyclonedx-bom-repo-server)
- [CVE-2022-21718](https://cve.now/CVE-2022-21718.md): Renderers can obtain access to random bluetooth device without permission in Electron (CVSS 3.4, electron)
- [CVE-2021-43650](https://cve.now/CVE-2021-43650.md): WebRun 3.6.0.42 is vulnerable to SQL Injection via the P\_0 parameter used to set the username during the login process. (no CVSS)
- [CVE-2022-1036](https://cve.now/CVE-2022-1036.md): Able to create an account with long password leads to memory corruption / Integer Overflow in microweber/microweber (CVSS 5.3, microweber/microweber)
- [CVE-2022-0667](https://cve.now/CVE-2022-0667.md): Assertion failure on delayed DS lookup (CVSS 7.5, ISC BIND)
- [CVE-2021-45809](https://cve.now/CVE-2021-45809.md): GlobalProtect-openconnect versions prior to 1.4.3 are affected by incorrect access control in GPService through DBUS, GUI Application. (no CVSS)
- [CVE-2022-1034](https://cve.now/CVE-2022-1034.md): There is a Unrestricted Upload of File vulnerability in ShowDoc v2.10.3 in star7th/showdoc (CVSS 9.1, star7th/showdoc · showdoc/showdoc)
- [CVE-2021-45810](https://cve.now/CVE-2021-45810.md): GlobalProtect-openconnect versions prior to 2.0.0 (exclusive) are affected by incorrect access control in GPService through DBUS, GUI. (no CVSS)
- [CVE-2022-24764](https://cve.now/CVE-2022-24764.md): Stack buffer overflow in pjproject (CVSS 7.5, pjsip pjproject)
- [CVE-2022-25517](https://cve.now/CVE-2022-25517.md): MyBatis plus v3.4.3 was discovered to contain a SQL injection vulnerability via the Column parameter in /core/conditions/AbstractWrapper.jav (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-03-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.