CVEs published March 25, 2022
77 CVEs were published on March 25, 2022: 6 critical, 13 high. 2 are now in CISA KEV.
- Published
- 77
- Critical
- 6
- High
- 13
- Medium
- 5
- Low
- 2
- Unrated
- 51
- Now in CISA KEV
- 2
- Fix available
- 19
Most affected products
- kernel
- 8
- libvirt
- 2
- openexr
- 2
- PressTigers Simple Event Planner
- 2
- Synology DiskStation Manager
- 2
- 3scale
- 1
- caribou
- 1
- Cloud Controller (CAPI) by cloud foundry
- 1
- clusterlabs/pcs
- 1
- com.predic8:soa-model-parent · com.predic8:soa-model-core
- 1
Critical 6
- CVE-2022-24783Sandbox bypass leading to arbitrary code execution in Denodenoland deno · deno
- CVE-2021-26622Genian NAC remote code execution vulnerabilityGenians Co. Genian NAC Suite · Genians Co. Genian NAC V5.0…
- CVE-2022-1040An authentication bypass vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version vSophos Firewall
- CVE-2022-1064SQL injection through marking blog comments on bulk as spam in forkcms/forkcmsforkcms/forkcms
- CVE-2022-22687Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in Authentication functionality in Synology DiskStationSynology DiskStation Manager
- CVE-2022-22995Western Digital My Cloud OS 5 and My Cloud Home Unauthenticated Arbitrary File Write Vulnerability in NetatalkWestern Digital My Cloud
High 13
- CVE-2021-40905The web management console of CheckMK Enterprise Edition (versions 1.5.0 to 2.0.0p9) does not properly sanitise the uploading of ".mkp" file
- CVE-2022-0995An out-of-bounds (OOB) memory write flaw was found in the Linux kernel’s watch_queue event notification subsystem.kernel
- CVE-2021-3422Indexer denial-of-service via malformed S2S requestSplunk Enterprise
- CVE-2021-26621Netis Korea MEX01 Buffer overflow vulnerabilityNetU MEX01
- CVE-2021-26620IPTIME NAS2dual improper authentication vulnerabilityEFM Networks Co. ipTIME NAS product
- CVE-2022-0988Delta Electronics DIAEnergie CLEARTEXT Transmission of Sensitive InformationDelta Electronics DIAEnergie
- CVE-2021-44477GE Gas Power ToolBoxST Improper Restriction of XML External Entity ReferenceGE Gas Power ToolBoxST
- CVE-2021-44462Horner Automation Cscape EnvisionRV Improper Input ValidationHorner Automation Cscape EnvisionRV
- CVE-2021-35254Authenticated Remote Code Execution in WebHelpDesk 12.7.8SolarWinds WebHelpDesk
- CVE-2022-24778Incorrect Authorization in imgcryptcontainerd imgcrypt · github.com/containerd/imgcrypt
- CVE-2022-24777Denial of Service via reachable assertion in grpc-swiftgrpc-swift
- CVE-2022-22688Improper neutralization of special elements used in a command ('Command Injection') vulnerability in File service functionality in Synology Synology DiskStation Manager
- CVE-2018-25032zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.nokogiri
Medium, low and unrated 58
- CVE-2022-22274A Stack-based buffer overflow vulnerability in the SonicOS via HTTP request allows a remote unauthenticated attacker to cause Denial of ServSonicWall SonicOS
- CVE-2021-40906CheckMK Raw Edition software (versions 1.5.0 to 1.6.0) does not sanitise the input of a web service parameter that is in an unauthenticated
- CVE-2021-40904The web management console of CheckMK Raw Edition (versions 1.5.0 to 1.6.0) allows a misconfiguration of the web-app Dokuwiki (installed by
- CVE-2022-24784Discoverability of user password hash in Statamic CMSstatamic cms · statamic/cms
- CVE-2021-44683The DuckDuckGo browser 7.64.4 on iOS allows Address Bar Spoofing due to mishandling of the JavaScript window.open function (used to open a s
- CVE-2022-26659Docker Desktop installer on Windows in versions before 4.6.0 allows an attacker to overwrite any administrator writable files by creating a
- CVE-2022-25523TypesetterCMS v5.1 was discovered to contain a Cross-Site Request Forgery (CSRF) which is exploited via a crafted POST request.
- CVE-2021-44905Incorrect permissions in the Bluetooth Services in the Fortessa FTBTLD Smart Lock as of 12-13-2022 allows a remote attacker to disable the l
- CVE-2022-24643A stored cross-site scripting (XSS) issue was discovered in the OpenEMR Hospital Information Management System version 6.0.0.
- CVE-2022-26197Joget DX 7 was discovered to contain a cross-site scripting (XSS) vulnerability via the Datalist table.
- CVE-2022-27920libkiwix 10.0.0 and 10.0.1 allows XSS in the built-in webserver functionality via the search suggestions URL parameter.
- CVE-2022-27919Gradle Enterprise before 2022.1 allows remote code execution if the installation process did not specify an initial configuration file.
- CVE-2022-27906Mendelson OFTP2 before 1.1 b43 is affected by directory traversal.
- CVE-2022-27886Maccms v10 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in /admin.php/admin/ulog/index.html via the wd par
- CVE-2022-27887Maccms v10 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in /admin.php/admin/vod/data.html via the repeat p
- CVE-2022-27884Maccms v10 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in /admin.php/admin/plog/index.html via the wd par
- CVE-2022-27885Maccms v10 was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities in /admin.php/admin/website/data.html via
- CVE-2022-26573Maccms v10 was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities in /admin.php/admin/art/data.html via the
- CVE-2022-25590SurveyKing v0.2.0 was discovered to retain users' session cookies after logout, allowing attackers to login to the system and access data us
- CVE-2022-0759A flaw was found in all versions of kubeclient up to (but not including) v4.9.3, the Ruby client for Kubernetes REST API, in the way it parskubeclient
- CVE-2022-0983An SQL injection risk was identified in Badges code relating to configuring criteria.moodle · moodle/moodle
- CVE-2022-0494A kernel information leak flaw was identified in the scsi_ioctl function in drivers/scsi/scsi_ioctl.c in the Linux kernel.kernel
- CVE-2022-0500A flaw was found in unrestricted eBPF usage by the BPF_BTF_LOAD, leading to a possible out-of-bounds memory write in the Linux kernel’s BPF kernel · :linux_kernel:
- CVE-2022-1049A flaw was found in the Pacemaker configuration tool (pcs).clusterlabs/pcs
- CVE-2021-20323A POST based reflected Cross Site Scripting vulnerability on has been identified in Keycloak.keycloak-services · org.keycloak:keycloak-core
- CVE-2022-0322A flaw was found in the sctp_make_strreset_req function in net/sctp/sm_make_chunk.c in the SCTP network protocol in the Linux kernel with a kernel
- CVE-2021-3814It was found that 3scale's APIdocs does not validate the access token, in the case of invalid token, it uses session auth instead.3scale
- CVE-2021-3582A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device.QEMU
- CVE-2021-3567A flaw was found in Caribou due to a regression of CVE-2020-25712 fix.caribou
- CVE-2021-20290An improper authorization handling flaw was found in Foreman.smart_proxy_openscap
- CVE-2021-4202A use-after-free flaw was found in nci_request in net/nfc/nci/core.c in NFC Controller Interface (NCI) in the Linux kernel.kernel
- CVE-2021-4157An out of memory bounds write flaw (1 or 2 bytes of memory) in the Linux kernel NFS subsystem was found in the way users use mirroring (replkernel
- CVE-2021-22100In cloud foundry CAPI versions prior to 1.122, a denial-of-service attack in which a developer can push a service broker that (accidentally Cloud Controller (CAPI) by cloud foundry
- CVE-2022-25612WordPress Simple Event Planner plugin <= 1.5.4 - Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilitiesPressTigers Simple Event Planner
- CVE-2022-25611WordPress Simple Event Planner plugin <= 1.5.4 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityPressTigers Simple Event Planner
- CVE-2022-25610WordPress Simple Ajax Chat plugin <= 20220115 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerabilityJeff Starr Simple Ajax Chat
- CVE-2022-25606WordPress WP-DownloadManager plugin <= 1.68.5 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilitiesLester 'GaMerZ' Chan WP-DownloadManager
- CVE-2021-44768Delta Electronics CNCSoft Out-of-bounds ReadDelta Electronics CNCSoft
- CVE-2021-43636Two Buffer Overflow vulnerabilities exists in T10 V2_Firmware V4.1.8cu.5207_B20210320 in the http_request_parse function when processing hos
- CVE-2022-27882slaacd in OpenBSD 6.9 and 7.0 before 2022-03-22 has an integer signedness error and resultant heap-based buffer overflow triggerable by a cr
- CVE-2022-27881engine.c in slaacd in OpenBSD 6.9 and 7.0 before 2022-02-21 has a buffer overflow triggerable by an IPv6 router advertisement with more than
- CVE-2022-26263Yonyou u8 v13.0 was discovered to contain a DOM-based cross-site scripting (XSS) vulnerability via the component /u8sl/WebHelp.
- CVE-2022-25582A stored cross-site scripting (XSS) vulnerability in the Column module of ClassCMS v2.5 and below allows attackers to execute arbitrary web
- CVE-2022-25577ALF-BanCO v8.2.5 and below was discovered to use a hardcoded password to encrypt the SQLite database containing the user's data.
- CVE-2021-43091An SQL Injection vlnerability exits in Yeswiki doryphore 20211012 via the email parameter in the registration form.yeswiki/yeswiki
- CVE-2022-25574A stored cross-site scripting (XSS) vulnerability in the upload function of /admin/show.php allows attackers to execute arbitrary web script
- CVE-2021-46426phpIPAM 1.4.4 allows Reflected XSS and CSRF via app/admin/subnets/find_free_section_subnets.php of the subnets functionality.
- CVE-2021-43090An XML External Entity (XXE) vulnerability exists in soa-model before 1.6.4 in the WSDLParser function.com.predic8:soa-model-parent · com.predic8:soa-model-core
- CVE-2020-21554A File Deletion vulnerability exists in TinyShop 3.1.1 in the back_list parameter in controllers\admin.php, which could let a malicious user
- CVE-2022-27227In PowerDNS Authoritative Server before 4.4.3, 4.5.x before 4.5.4, and 4.6.x before 4.6.1 and PowerDNS Recursor before 4.4.8, 4.5.x before 4
- CVE-2021-44751F-Secure SAFE Browser vulnerable to USSD attacksF-Secure SAFE Browser for Android
- CVE-2021-3933An integer overflow could occur when OpenEXR processes a crafted file on systems where size_t < 64 bits.openexr
- CVE-2021-3941In ImfChromaticities.cpp routine RGBtoXYZ(), there are some division operations such as `float Z = (1 - chroma.white.x - chroma.white.y) * Yopenexr
- CVE-2021-4147A flaw was found in the libvirt libxl driver.libvirt
- CVE-2021-4203A use-after-free read flaw was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and SO_PEERGROUPS race with listen() (and cokernel
- CVE-2022-0330A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the way a user may run malicious code onkernel
- CVE-2022-0435A stack overflow flaw was found in the Linux kernel's TIPC protocol functionality in the way a user sends a packet with malicious content whkernel
- CVE-2022-0897A flaw was found in the libvirt nwfilter driver.libvirt