CVEs published March 24, 2022
31 CVEs were published on March 24, 2022: 1 critical, 8 high.
- Published
- 31
- Critical
- 1
- High
- 8
- Medium
- 7
- Low
- 0
- Unrated
- 15
- Now in CISA KEV
- 0
- Fix available
- 13
Most affected products
- forkcms/forkcms
- 2
- Nozomi Networks Guardian · Nozomi Networks CMC
- 2
- radareorg/radare2
- 2
- anchorcms/anchor-cms
- 1
- discourse
- 1
- dpgaspar Flask-AppBuilder · flask-appbuilder
- 1
- go-gitea/gitea · code.gitea.io/gitea
- 1
- horovod/horovod · horovod
- 1
- IBM Power 9 AC922
- 1
- math-geon Geon
- 1
Critical 1
High 8
- CVE-2022-24781Malicious users can take over the session of other playersmath-geon Geon
- CVE-2022-0551Authenticated RCE on project configuration import in Guardian/CMC before 22.0.0Nozomi Networks Guardian · Nozomi Networks CMC
- CVE-2022-0550Authenticated RCE on logo report upload in Guardian/CMC before 22.0.0Nozomi Networks Guardian · Nozomi Networks CMC
- CVE-2022-1058Open Redirect on login in go-gitea/giteago-gitea/gitea · code.gitea.io/gitea
- CVE-2022-1052Heap Buffer Overflow in iterate_chained_fixups in radareorg/radare2radareorg/radare2
- CVE-2022-1061Heap Buffer Overflow in parseDragons in radareorg/radare2radareorg/radare2
- CVE-2022-0315Insecure Temporary File in horovod/horovodhorovod/horovod · horovod
- CVE-2021-43666A Denial of Service vulnerability exists in mbed TLS 3.0.0 and earlier in the mbedtls_pkcs12_derivation function when an input password's le
Medium, low and unrated 22
- CVE-2022-25576Anchor CMS v0.12.7 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component anchor/routes/posts.php.anchorcms/anchor-cms
- CVE-2022-26279EyouCMS v1.5.5 was discovered to have no access control in the component /data/sqldata.
- CVE-2022-26272A remote code execution (RCE) vulnerability in Ionize v1.0.8.1 allows attackers to execute arbitrary code via a crafted string written to th
- CVE-2022-25575Multiple cross-site scripting (XSS) vulnerabilities in Parking Management System v1.0 allows attackers to execute arbitrary web scripts or H
- CVE-2022-26301TuziCMS v2.0.6 was discovered to contain a SQL injection vulnerability via the component App\Manage\Controller\ZhuantiController.class.php.
- CVE-2022-26249Survey King v0.3.0 does not filter data properly when exporting excel files, allowing attackers to execute arbitrary code or access sensitiv
- CVE-2022-24782Secure category names leaked via user activity export in Discoursediscourse
- CVE-2022-25571Bluedon Information Security Technologies Co.,Ltd Internet Access Detector v1.0 was discovered to contain an information leak which allows a
- CVE-2022-24776Open Redirect in Flask-AppBuilderdpgaspar Flask-AppBuilder · flask-appbuilder
- CVE-2022-22374The BMC (IBM Power 9 AC922 OP910, OP920, OP930, and OP940) may be subject to a firmware downgrade attack which may affect its ability to opeIBM Power 9 AC922
- CVE-2021-43084An SQL Injection vulnerability exists in Dreamer CMS 4.0.0 via the tableName parameter.
- CVE-2022-21820NVIDIA DCGM contains a vulnerability in nvhostengine, where a network user can cause detection of error conditions without action, which mayNVIDIA Data Center GPU Manager
- CVE-2022-25568MotionEye v0.42.1 and below allows attackers to access sensitive information via a GET request to /config/list.motioneye
- CVE-2022-26629An Access Control vulnerability exists in SoroushPlus+ Messenger 1.0.30 in the Lock Screen Security Feature function due to insufficient per
- CVE-2022-0955Cross-site Scripting (XSS) - Stored in pimcore/data-hubpimcore/data-hub
- CVE-2021-39491A Cross Site Scripting (XSS) vulnerability exists in Yogesh Ojha reNgine v1.0 via the Scan Engine name file in the Scan Engine deletion conf
- CVE-2021-43659In halo 1.4.14, the function point of uploading the avatar, any file can be uploaded, such as uploading an HTML file, which will cause a sto
- CVE-2021-43700An issue was discovered in ApiManager 1.1.
- CVE-2022-0145Cross-site Scripting (XSS) - Stored in forkcms/forkcmsforkcms/forkcms
- CVE-2022-27820OWASP Zed Attack Proxy (ZAP) through w2022-03-21 does not verify the TLS certificate chain of an HTTPS server.org.zaproxy:zap
- CVE-2022-24769Default inheritable capabilities for linux container should be emptymoby · github.com/moby/moby +1
- CVE-2022-27811GNOME OCRFeeder before 0.8.4 allows OS command injection via shell metacharacters in a PDF or image filename.