# CVEs published 2022-03-24 31 CVEs were published on March 24, 2022: 1 critical, 8 high. Days are UTC. - [CVE-2022-25576](https://cve.now/CVE-2022-25576.md): Anchor CMS v0.12.7 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component anchor/routes/posts.php. (no CVSS, anchorcms/anchor-cms) - [CVE-2022-26279](https://cve.now/CVE-2022-26279.md): EyouCMS v1.5.5 was discovered to have no access control in the component /data/sqldata. (no CVSS) - [CVE-2022-26272](https://cve.now/CVE-2022-26272.md): A remote code execution (RCE) vulnerability in Ionize v1.0.8.1 allows attackers to execute arbitrary code via a crafted string written to th (no CVSS) - [CVE-2022-25575](https://cve.now/CVE-2022-25575.md): Multiple cross-site scripting (XSS) vulnerabilities in Parking Management System v1.0 allows attackers to execute arbitrary web scripts or H (no CVSS) - [CVE-2022-26301](https://cve.now/CVE-2022-26301.md): TuziCMS v2.0.6 was discovered to contain a SQL injection vulnerability via the component App\\Manage\\Controller\\ZhuantiController.class.php. (no CVSS) - [CVE-2022-26249](https://cve.now/CVE-2022-26249.md): Survey King v0.3.0 does not filter data properly when exporting excel files, allowing attackers to execute arbitrary code or access sensitiv (no CVSS) - [CVE-2022-24782](https://cve.now/CVE-2022-24782.md): Secure category names leaked via user activity export in Discourse (CVSS 4.3, discourse) - [CVE-2022-24781](https://cve.now/CVE-2022-24781.md): Malicious users can take over the session of other players (CVSS 7.1, math-geon Geon) - [CVE-2022-25571](https://cve.now/CVE-2022-25571.md): Bluedon Information Security Technologies Co.,Ltd Internet Access Detector v1.0 was discovered to contain an information leak which allows a (no CVSS) - [CVE-2022-24776](https://cve.now/CVE-2022-24776.md): Open Redirect in Flask-AppBuilder (CVSS 6.1, dpgaspar Flask-AppBuilder · flask-appbuilder) - [CVE-2022-22374](https://cve.now/CVE-2022-22374.md): The BMC (IBM Power 9 AC922 OP910, OP920, OP930, and OP940) may be subject to a firmware downgrade attack which may affect its ability to ope (CVSS 6.5, IBM Power 9 AC922) - [CVE-2021-43084](https://cve.now/CVE-2021-43084.md): An SQL Injection vulnerability exists in Dreamer CMS 4.0.0 via the tableName parameter. (no CVSS) - [CVE-2022-0153](https://cve.now/CVE-2022-0153.md): SQL Injection in forkcms/forkcms (CVSS 9.6, forkcms/forkcms) - [CVE-2022-21820](https://cve.now/CVE-2022-21820.md): NVIDIA DCGM contains a vulnerability in nvhostengine, where a network user can cause detection of error conditions without action, which may (CVSS 6.3, NVIDIA Data Center GPU Manager) - [CVE-2022-25568](https://cve.now/CVE-2022-25568.md): MotionEye v0.42.1 and below allows attackers to access sensitive information via a GET request to /config/list. (no CVSS, motioneye) - [CVE-2022-26629](https://cve.now/CVE-2022-26629.md): An Access Control vulnerability exists in SoroushPlus+ Messenger 1.0.30 in the Lock Screen Security Feature function due to insufficient per (no CVSS) - [CVE-2022-0955](https://cve.now/CVE-2022-0955.md): Cross-site Scripting (XSS) - Stored in pimcore/data-hub (CVSS 6.5, pimcore/data-hub) - [CVE-2021-39491](https://cve.now/CVE-2021-39491.md): A Cross Site Scripting (XSS) vulnerability exists in Yogesh Ojha reNgine v1.0 via the Scan Engine name file in the Scan Engine deletion conf (no CVSS) - [CVE-2022-0551](https://cve.now/CVE-2022-0551.md): Authenticated RCE on project configuration import in Guardian/CMC before 22.0.0 (CVSS 7.2, Nozomi Networks Guardian · Nozomi Networks CMC) - [CVE-2022-0550](https://cve.now/CVE-2022-0550.md): Authenticated RCE on logo report upload in Guardian/CMC before 22.0.0 (CVSS 7.2, Nozomi Networks Guardian · Nozomi Networks CMC) - [CVE-2022-1058](https://cve.now/CVE-2022-1058.md): Open Redirect on login in go-gitea/gitea (CVSS 7.2, go-gitea/gitea · code.gitea.io/gitea) - [CVE-2021-43659](https://cve.now/CVE-2021-43659.md): In halo 1.4.14, the function point of uploading the avatar, any file can be uploaded, such as uploading an HTML file, which will cause a sto (no CVSS) - [CVE-2022-1052](https://cve.now/CVE-2022-1052.md): Heap Buffer Overflow in iterate\_chained\_fixups in radareorg/radare2 (CVSS 7.3, radareorg/radare2) - [CVE-2021-43700](https://cve.now/CVE-2021-43700.md): An issue was discovered in ApiManager 1.1. (no CVSS) - [CVE-2022-0145](https://cve.now/CVE-2022-0145.md): Cross-site Scripting (XSS) - Stored in forkcms/forkcms (CVSS 6.8, forkcms/forkcms) - [CVE-2022-1061](https://cve.now/CVE-2022-1061.md): Heap Buffer Overflow in parseDragons in radareorg/radare2 (CVSS 7.3, radareorg/radare2) - [CVE-2022-0315](https://cve.now/CVE-2022-0315.md): Insecure Temporary File in horovod/horovod (CVSS 8.2, horovod/horovod · horovod) - [CVE-2022-27820](https://cve.now/CVE-2022-27820.md): OWASP Zed Attack Proxy (ZAP) through w2022-03-21 does not verify the TLS certificate chain of an HTTPS server. (no CVSS, org.zaproxy:zap) - [CVE-2021-43666](https://cve.now/CVE-2021-43666.md): A Denial of Service vulnerability exists in mbed TLS 3.0.0 and earlier in the mbedtls\_pkcs12\_derivation function when an input password's le (CVSS 7.5) - [CVE-2022-24769](https://cve.now/CVE-2022-24769.md): Default inheritable capabilities for linux container should be empty (CVSS 5.9, moby · github.com/moby/moby +1) - [CVE-2022-27811](https://cve.now/CVE-2022-27811.md): GNOME OCRFeeder before 0.8.4 allows OS command injection via shell metacharacters in a PDF or image filename. (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2022-03-24 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.