CVEs published March 23, 2022
110 CVEs were published on March 23, 2022: 13 critical, 10 high.
- Published
- 110
- Critical
- 13
- High
- 10
- Medium
- 16
- Low
- 3
- Unrated
- 68
- Now in CISA KEV
- 0
- Fix available
- 19
Most affected products
- Rockwell Automation FactoryTalk AssetCentre
- 9
- GE UR family
- 6
- McAfee ePolicy Orchestrator
- 6
- kernel
- 4
- argoproj argo-cd · github.com/argoproj/argo-cd +1
- 3
- HP LaserJet Pro Printers; HP Pagewide Pro Printers; HP Offi…
- 3
- ISC BIND
- 3
- Money Transfer Management System
- 3
- Rockwell Automation Connected Components Workbench
- 3
- Apache Software Foundation Apache Traffic Server
- 2
Critical 13
- CVE-2022-24768Improper access control allows admin privilege escalation in Argo CDargoproj argo-cd · github.com/argoproj/argo-cd +1
- CVE-2022-0888Ninja Forms - File Uploads Extension <= 3.3.0 - Arbitrary File UploadSaturdayDrive Ninja Forms - File Uploads
- CVE-2021-27476Rockwell Automation FactoryTalk AssetCentre OS Command InjectionRockwell Automation FactoryTalk AssetCentre
- CVE-2021-27470Rockwell Automation FactoryTalk AssetCentre Deserialization of Untrusted DataRockwell Automation FactoryTalk AssetCentre
- CVE-2021-27466Rockwell Automation FactoryTalk AssetCentre Deserialization of Untrusted DataRockwell Automation FactoryTalk AssetCentre
- CVE-2021-27474Rockwell Automation FactoryTalk AssetCentre Use of Potentially Dangerous FunctionRockwell Automation FactoryTalk AssetCentre
- CVE-2021-27468Rockwell Automation FactoryTalk AssetCentre SQL InjectionRockwell Automation FactoryTalk AssetCentre
- CVE-2021-27472Rockwell Automation FactoryTalk AssetCentre SQL InjectionRockwell Automation FactoryTalk AssetCentre
- CVE-2021-27462Rockwell Automation FactoryTalk AssetCentre Deserialization of Untrusted DataRockwell Automation FactoryTalk AssetCentre
- CVE-2021-27464Rockwell Automation FactoryTalk AssetCentre SQL InjectionRockwell Automation FactoryTalk AssetCentre
- CVE-2021-27460Rockwell Automation FactoryTalk AssetCentre Deserialization of Untrusted DataRockwell Automation FactoryTalk AssetCentre
- CVE-2021-27426GE UR family insecure default variable initializationGE UR family
- CVE-2021-27428GE UR family Unrestricted Upload of File with Dangerous TypeGE UR family
High 10
- CVE-2022-24730Path traversal and improper access control allows leaking out-of-bound files from Argo CD repo-serverargoproj argo-cd · github.com/argoproj/argo-cd +1
- CVE-2022-24757Sensitive Auth & Cookie data stored in Jupyter server logsjupyter-server jupyter_server · jupyter-server
- CVE-2022-0834Amelia <= 1.0.46 - Stored Cross Site Scripting via lastNameameliabooking Booking for Appointments and Events Calendar…
- CVE-2022-0889Ninja Forms - File Uploads Extension <= 3.3.12 - Reflected Cross-Site ScriptingSaturdayDrive Ninja Forms - File Uploads
- CVE-2021-27475Rockwell Automation Connected Components Workbench Deserialization of Untrusted DataRockwell Automation Connected Components Workbench
- CVE-2021-27471Rockwell Automation Connected Components Workbench Path TraversalRockwell Automation Connected Components Workbench
- CVE-2021-27422GE UR family exposure of sensitive information to an unauthorized actorGE UR family
- CVE-2021-27430GE UR family hardcoded credentialsGE UR bootloader binary
- CVE-2022-0635Versions affected: BIND 9.18.0 When a vulnerable version of named receives a series of specific queries, the named process will eventually tISC BIND
- CVE-2022-1033Unrestricted Upload of File with Dangerous Type in crater-invoice/cratercrater-invoice/crater
Medium, low and unrated 87
- CVE-2022-27083Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /cgi-bin/uploadAccessCodePic.
- CVE-2022-27081Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/SetLanInfo.
- CVE-2022-27082Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/SetInternetLanInfo.
- CVE-2022-27080Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/setWorkmode.
- CVE-2022-27079Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/setPicListItem.
- CVE-2022-27078Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/setAdInfoDetail.
- CVE-2022-27076Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/delAd.
- CVE-2022-27077Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /cgi-bin/uploadWeiXinPic.
- CVE-2022-26536Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/setFixTools.
- CVE-2022-26290Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/WriteFacMac.
- CVE-2021-31326D-Link DIR-816 A2 1.10 B05 allows unauthenticated attackers to arbitrarily reset the device via a crafted tokenid parameter to /goform/form2
- CVE-2022-26289Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/exeCommand.
- CVE-2022-25266Passwork On-Premise Edition before 4.6.13 allows migration/downloadExportFile Directory Traversal (to read files).
- CVE-2022-25269Passwork On-Premise Edition before 4.6.13 has multiple XSS issues.
- CVE-2022-25268Passwork On-Premise Edition before 4.6.13 allows CSRF via the groups, password, and history subsystems.
- CVE-2022-25267Passwork On-Premise Edition before 4.6.13 allows migration/uploadExportFile Directory Traversal (to upload files).
- CVE-2020-20096Whatsapp iOS 2.19.80 and prior and Android 2.19.222 and prior user interface does not properly represent URI messages to the user, which res
- CVE-2020-20095iMessage (Messages app) iOS 12.4 and prior user interface does not properly represent URI messages to the user, which results in URI spoofin
- CVE-2020-20094Instagram iOS 106.0 and prior and Android 107.0.0.11 and prior user interface does not properly represent URI messages to the user, which re
- CVE-2020-20093The Facebook Messenger app for iOS 227.0 and prior and Android 228.1.0.10.116 and prior user interface does not properly represent URI messa
- CVE-2022-25041OpenEMR v6.0.0 was discovered to contain an incorrect access control issue.
- CVE-2022-27192The Reporting module in Aseco Lietuva document management system DVS Avilys before 3.5.58 allows unauthorized file download.
- CVE-2022-24934wpsupdater.exe in Kingsoft WPS Office through 11.2.0.10382 allows remote code execution by modifying HKEY_CURRENT_USER in the registry.
- CVE-2022-22819NXP LPC55S66JBD64, LPC55S66JBD100, LPC55S66JEV98, LPC55S69JBD64, LPC55S69JBD100, and LPC55S69JEV98 microcontrollers (ROM version 1B) have a
- CVE-2022-27254The remote keyless system on Honda Civic 2018 vehicles sends the same RF signal for each door-open request, which allows for a replay attack
- CVE-2022-24731Path traversal allows leaking out-of-bound files from Argo CD repo-serverargoproj argo-cd · github.com/argoproj/argo-cd +1
- CVE-2022-23881ZZZCMS zzzphp v2.1.0 was discovered to contain a remote command execution (RCE) vulnerability via danger_key() at zzz_template.php.
- CVE-2022-23880An arbitrary file upload vulnerability in the File Management function module of taoCMS v3.0.2 allows attackers to execute arbitrary code vi
- CVE-2022-0750Photoswipe Masonry Gallery <= 1.2.14 Stored Cross-Site Scriptingdeanoakley Photoswipe Masonry Gallery
- CVE-2022-22952VMware Carbon Black App Control (8.5.x prior to 8.5.14, 8.6.x prior to 8.6.6, 8.7.x prior to 8.7.4 and 8.8.x prior to 8.8.2) contains a fileVMware Carbon Black App Control
- CVE-2021-4150A use-after-free flaw was found in the add_partition in block/partitions/core.c in the Linux kernel.kernel
- CVE-2022-22951VMware Carbon Black App Control (8.5.x prior to 8.5.14, 8.6.x prior to 8.6.6, 8.7.x prior to 8.7.4 and 8.8.x prior to 8.8.2) contains an OS VMware Carbon Black App Control
- CVE-2021-4148A vulnerability was found in the Linux kernel's block_invalidatepage in fs/buffer.c in the filesystem.kernel
- CVE-2021-4149A vulnerability was found in btrfs_alloc_tree_b in fs/btrfs/extent-tree.c in the Linux kernel due to an improper lock operation in btrfs.kernel
- CVE-2021-4197An unprivileged write to the file handler flaw in the Linux kernel's control groups and namespaces subsystem was found in the way users havekernel
- CVE-2022-0981A flaw was found in Quarkus.quarkus
- CVE-2021-3748A use-after-free vulnerability was found in the virtio-net device of QEMU.QEMU
- CVE-2021-27473Rockwell Automation Connected Components Workbench Improper Input ValidationRockwell Automation Connected Components Workbench
- CVE-2021-27424GE UR family exposure of sensitive information to an unauthorized actorGE UR family
- CVE-2021-27420GE UR family input validationGE UR family
- CVE-2021-27418GE UR family input validationGE UR family
- CVE-2022-25609WordPress Yoo Slider plugin <= 2.0.0 - Stored Cross-Site Scripting (XSS) vulnerabilityYooslider Yoo Slider – Image Slider & Video Slider
- CVE-2022-25608WordPress Yoo Slider – Image Slider & Video Slider plugin <= 2.0.0 - Cross-Site Request Forgery (CSRF) vulnerability leading to slider Duplicate/DeleteYooslider Yoo Slider – Image Slider & Video Slider
- CVE-2021-27456Philips Gemini PET/CT Storage of Sensitive Data in a Mechanism Without Access ControlPhilips Gemini 16 Slice · Philips Gemini Dual +9
- CVE-2021-4180An information exposure flaw in openstack-tripleo-heat-templates allows an external user to discover the internal IP or hostname.openstack-tripleo-heat-templates · tripleo-heat-templates
- CVE-2022-24293Certain HP Print devices may be vulnerable to potential information disclosure, denial of service, or remote code execution.HP LaserJet Pro Printers; HP Pagewide Pro Printers; HP Offi…
- CVE-2022-24291Certain HP Print devices may be vulnerable to potential information disclosure, denial of service, or remote code execution.HP LaserJet Pro Printers; HP Pagewide Pro Printers; HP Offi…
- CVE-2021-4219A flaw was found in ImageMagick.imagemagick
- CVE-2022-24292Certain HP Print devices may be vulnerable to potential information disclosure, denial of service, or remote code execution.HP LaserJet Pro Printers; HP Pagewide Pro Printers; HP Offi…
- CVE-2022-0996A vulnerability was found in the 389 Directory Server that allows expired passwords to access the database to cause improper authentication.389-ds-base
- CVE-2022-0854A memory leak flaw was found in the Linux kernel’s DMA subsystem, in the way a user calls DMA_FROM_DEVICE.Kernel
- CVE-2022-1030Okta Advanced Server Access Client for Linux and macOS prior to version 1.58.0 was found to be vulnerable to command injection via a specialOkta Advanced Server Access Client
- CVE-2022-25223Money Transfer Management System Version 1.0 allows an authenticated user to inject SQL queries in 'mtms/admin/?page=transaction/view_detailMoney Transfer Management System
- CVE-2022-25222Money Transfer Management System Version 1.0 allows an unauthenticated user to inject SQL queries in 'admin/maintenance/manage_branch.php' aMoney Transfer Management System
- CVE-2022-25221Money Transfer Management System Version 1.0 allows an attacker to inject JavaScript code in the URL and then trick a user into visit the liMoney Transfer Management System
- CVE-2021-3589An authorization flaw was found in Foreman Ansible.Foreman Ansible · foreman_ansible
- CVE-2022-26243Tenda AC10-1200 v15.03.06.23_EN was discovered to contain a buffer overflow in the setSmartPowerManagement function.
- CVE-2021-38772Tenda AC10-1200 v15.03.06.23_EN was discovered to contain a buffer overflow via the list parameter in the fromSetIpMacBind function.
- CVE-2021-38278Tenda AC10-1200 v15.03.06.23_EN was discovered to contain a buffer overflow via the urls parameter in the saveParentControlInfo function.
- CVE-2021-46064IrfanView 4.59 is vulnerable to buffer overflow via the function at address 0x413c70 (in 32bit version of the binary).
- CVE-2021-44139Sentinel 1.8.2 is vulnerable to Server-side request forgery (SSRF).
- CVE-2022-22316IBM MQ Appliance 9.2 CD and 9.2 LTS could allow an authenticated and authorized user to cause a denial of service due to incorrectly configuIBM MQ Appliance
- CVE-2021-43737An issus was discovered in xiaohuanxiong CMS 5.0.17.
- CVE-2021-43738An issue was discovered in xiaohuanxiong CMS 5.0.17.
- CVE-2021-43736CmsWing CMS 1.3.7 is affected by a Remote Code Execution (RCE) vulnerability via parameter: log rule
- CVE-2022-23242TeamViewer Linux - Deletion command not properly executed after process crashTeamViewer for Linux
- CVE-2021-43735CmsWing 1.3.7 is affected by a SQLi vulnerability via parameter: behavior rule.
- CVE-2022-0861ePO XML extended entity vulnerabilityMcAfee ePolicy Orchestrator
- CVE-2022-0862ePO password change vulnerabilityMcAfee ePolicy Orchestrator
- CVE-2022-0858Cross-site scripting vulnerability in ePOMcAfee ePolicy Orchestrator
- CVE-2022-0859ePO database restoration vulnerabilityMcAfee ePolicy Orchestrator
- CVE-2022-0857ePO Reflected Cross-site scripting vulnerabilityMcAfee ePolicy Orchestrator
- CVE-2022-0842ePO blind SQL Injection vulnerabilityMcAfee ePolicy Orchestrator
- CVE-2021-44759Improper authentication vulnerability in TLS origin verificationApache Software Foundation Apache Traffic Server
- CVE-2021-44040HTTP request line fuzzing attacksApache Software Foundation Apache Traffic Server
- CVE-2021-25220DNS forwarders - cache poisoning vulnerabilityISC BIND
- CVE-2021-45757ASUS AC68U <=3.0.0.4.385.20852 is affected by a buffer overflow in blocking.cgi, which may cause a denial of service (DoS).
- CVE-2021-45756Asus RT-AC68U <3.0.0.4.385.20633 and RT-AC5300 <3.0.0.4.384.82072 are affected by a buffer overflow in blocking_request.cgi.
- CVE-2022-0396DoS from specifically crafted TCP packetsISC BIND
- CVE-2022-27666A heap buffer overflow flaw was found in IPsec ESP transformation code in net/ipv4/esp4.c and net/ipv6/esp6.c.
- CVE-2021-28275A Denial of Service vulnerability exists in jhead 3.04 and 3.05 due to a wild address read in the Get16u function in exif.c in will cause se
- CVE-2021-28276A Denial of Service vulnerability exists in jhead 3.04 and 3.05 via a wild address read in the ProcessCanonMakerNoteDir function in makernot
- CVE-2021-28277A Heap-based Buffer Overflow vulnerabilty exists in jhead 3.04 and 3.05 is affected by: Buffer Overflow via the RemoveUnknownSections functi
- CVE-2021-28278A Heap-based Buffer Overflow vulnerability exists in jhead 3.04 and 3.05 via the RemoveSectionType function in jpgfile.c.
- CVE-2021-3618ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatibALPACA
- CVE-2021-4156An out-of-bounds read flaw was found in libsndfile's FLAC codec functionality.libsndfile
- CVE-2021-44226Razer Synapse before 3.7.0228.022817 allows privilege escalation because it relies on %PROGRAMDATA%\Razer\Synapse3\Service\bin even if %PROG