# CVEs published 2022-03-25

77 CVEs were published on March 25, 2022: 6 critical, 13 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2022-22274](https://cve.now/CVE-2022-22274.md): A Stack-based buffer overflow vulnerability in the SonicOS via HTTP request allows a remote unauthenticated attacker to cause Denial of Serv (no CVSS, SonicWall SonicOS)
- [CVE-2021-40906](https://cve.now/CVE-2021-40906.md): CheckMK Raw Edition software (versions 1.5.0 to 1.6.0) does not sanitise the input of a web service parameter that is in an unauthenticated (no CVSS)
- [CVE-2021-40905](https://cve.now/CVE-2021-40905.md): The web management console of CheckMK Enterprise Edition (versions 1.5.0 to 2.0.0p9) does not properly sanitise the uploading of ".mkp" file (CVSS 8.8)
- [CVE-2021-40904](https://cve.now/CVE-2021-40904.md): The web management console of CheckMK Raw Edition (versions 1.5.0 to 1.6.0) allows a misconfiguration of the web-app Dokuwiki (installed by (no CVSS)
- [CVE-2022-24784](https://cve.now/CVE-2022-24784.md): Discoverability of user password hash in Statamic CMS (CVSS 3.7, statamic cms · statamic/cms)
- [CVE-2022-24783](https://cve.now/CVE-2022-24783.md): Sandbox bypass leading to arbitrary code execution in Deno (CVSS 10.0, denoland deno · deno)
- [CVE-2021-44683](https://cve.now/CVE-2021-44683.md): The DuckDuckGo browser 7.64.4 on iOS allows Address Bar Spoofing due to mishandling of the JavaScript window.open function (used to open a s (no CVSS)
- [CVE-2022-26659](https://cve.now/CVE-2022-26659.md): Docker Desktop installer on Windows in versions before 4.6.0 allows an attacker to overwrite any administrator writable files by creating a (no CVSS)
- [CVE-2022-25523](https://cve.now/CVE-2022-25523.md): TypesetterCMS v5.1 was discovered to contain a Cross-Site Request Forgery (CSRF) which is exploited via a crafted POST request. (no CVSS)
- [CVE-2021-44905](https://cve.now/CVE-2021-44905.md): Incorrect permissions in the Bluetooth Services in the Fortessa FTBTLD Smart Lock as of 12-13-2022 allows a remote attacker to disable the l (no CVSS)
- [CVE-2022-24643](https://cve.now/CVE-2022-24643.md): A stored cross-site scripting (XSS) issue was discovered in the OpenEMR Hospital Information Management System version 6.0.0. (no CVSS)
- [CVE-2022-26197](https://cve.now/CVE-2022-26197.md): Joget DX 7 was discovered to contain a cross-site scripting (XSS) vulnerability via the Datalist table. (no CVSS)
- [CVE-2022-27920](https://cve.now/CVE-2022-27920.md): libkiwix 10.0.0 and 10.0.1 allows XSS in the built-in webserver functionality via the search suggestions URL parameter. (no CVSS)
- [CVE-2022-27919](https://cve.now/CVE-2022-27919.md): Gradle Enterprise before 2022.1 allows remote code execution if the installation process did not specify an initial configuration file. (no CVSS)
- [CVE-2022-27906](https://cve.now/CVE-2022-27906.md): Mendelson OFTP2 before 1.1 b43 is affected by directory traversal. (no CVSS)
- [CVE-2022-27886](https://cve.now/CVE-2022-27886.md): Maccms v10 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in /admin.php/admin/ulog/index.html via the wd par (no CVSS)
- [CVE-2022-27887](https://cve.now/CVE-2022-27887.md): Maccms v10 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in /admin.php/admin/vod/data.html via the repeat p (no CVSS)
- [CVE-2022-27884](https://cve.now/CVE-2022-27884.md): Maccms v10 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in /admin.php/admin/plog/index.html via the wd par (no CVSS)
- [CVE-2022-27885](https://cve.now/CVE-2022-27885.md): Maccms v10 was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities in /admin.php/admin/website/data.html via (no CVSS)
- [CVE-2022-26573](https://cve.now/CVE-2022-26573.md): Maccms v10 was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities in /admin.php/admin/art/data.html via the (no CVSS)
- [CVE-2022-25590](https://cve.now/CVE-2022-25590.md): SurveyKing v0.2.0 was discovered to retain users' session cookies after logout, allowing attackers to login to the system and access data us (no CVSS)
- [CVE-2022-0759](https://cve.now/CVE-2022-0759.md): A flaw was found in all versions of kubeclient up to (but not including) v4.9.3, the Ruby client for Kubernetes REST API, in the way it pars (no CVSS, kubeclient)
- [CVE-2022-0995](https://cve.now/CVE-2022-0995.md): An out-of-bounds (OOB) memory write flaw was found in the Linux kernel’s watch\_queue event notification subsystem. (CVSS 7.8, KEV, kernel)
- [CVE-2022-0983](https://cve.now/CVE-2022-0983.md): An SQL injection risk was identified in Badges code relating to configuring criteria. (no CVSS, moodle · moodle/moodle)
- [CVE-2022-0494](https://cve.now/CVE-2022-0494.md): A kernel information leak flaw was identified in the scsi\_ioctl function in drivers/scsi/scsi\_ioctl.c in the Linux kernel. (no CVSS, kernel)
- [CVE-2022-0500](https://cve.now/CVE-2022-0500.md): A flaw was found in unrestricted eBPF usage by the BPF\_BTF\_LOAD, leading to a possible out-of-bounds memory write in the Linux kernel’s BPF (no CVSS, kernel · :linux\_kernel:)
- [CVE-2022-1049](https://cve.now/CVE-2022-1049.md): A flaw was found in the Pacemaker configuration tool (pcs). (no CVSS, clusterlabs/pcs)
- [CVE-2021-20323](https://cve.now/CVE-2021-20323.md): A POST based reflected Cross Site Scripting vulnerability on has been identified in Keycloak. (no CVSS, keycloak-services · org.keycloak:keycloak-core)
- [CVE-2022-0322](https://cve.now/CVE-2022-0322.md): A flaw was found in the sctp\_make\_strreset\_req function in net/sctp/sm\_make\_chunk.c in the SCTP network protocol in the Linux kernel with a (no CVSS, kernel)
- [CVE-2021-3814](https://cve.now/CVE-2021-3814.md): It was found that 3scale's APIdocs does not validate the access token, in the case of invalid token, it uses session auth instead. (no CVSS, 3scale)
- [CVE-2021-3582](https://cve.now/CVE-2021-3582.md): A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. (no CVSS, QEMU)
- [CVE-2021-3567](https://cve.now/CVE-2021-3567.md): A flaw was found in Caribou due to a regression of CVE-2020-25712 fix. (no CVSS, caribou)
- [CVE-2021-20290](https://cve.now/CVE-2021-20290.md): An improper authorization handling flaw was found in Foreman. (no CVSS, smart\_proxy\_openscap)
- [CVE-2021-4202](https://cve.now/CVE-2021-4202.md): A use-after-free flaw was found in nci\_request in net/nfc/nci/core.c in NFC Controller Interface (NCI) in the Linux kernel. (no CVSS, kernel)
- [CVE-2021-3422](https://cve.now/CVE-2021-3422.md): Indexer denial-of-service via malformed S2S request (CVSS 7.5, Splunk Enterprise)
- [CVE-2021-4157](https://cve.now/CVE-2021-4157.md): An out of memory bounds write flaw (1 or 2 bytes of memory) in the Linux kernel NFS subsystem was found in the way users use mirroring (repl (no CVSS, kernel)
- [CVE-2021-22100](https://cve.now/CVE-2021-22100.md): In cloud foundry CAPI versions prior to 1.122, a denial-of-service attack in which a developer can push a service broker that (accidentally (no CVSS, Cloud Controller (CAPI) by cloud foundry)
- [CVE-2021-26622](https://cve.now/CVE-2021-26622.md): Genian NAC remote code execution vulnerability (CVSS 9.6, Genians Co. Genian NAC Suite · Genians Co. Genian NAC V5.0…)
- [CVE-2021-26621](https://cve.now/CVE-2021-26621.md): Netis Korea MEX01 Buffer overflow vulnerability (CVSS 8.1, NetU MEX01)
- [CVE-2021-26620](https://cve.now/CVE-2021-26620.md): IPTIME NAS2dual improper authentication vulnerability (CVSS 7.5, EFM Networks Co. ipTIME NAS product)
- [CVE-2022-25612](https://cve.now/CVE-2022-25612.md): WordPress Simple Event Planner plugin \<= 1.5.4 - Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities (CVSS 4.1, PressTigers Simple Event Planner)
- [CVE-2022-25611](https://cve.now/CVE-2022-25611.md): WordPress Simple Event Planner plugin \<= 1.5.4 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (CVSS 4.1, PressTigers Simple Event Planner)
- [CVE-2022-25610](https://cve.now/CVE-2022-25610.md): WordPress Simple Ajax Chat plugin \<= 20220115 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability (CVSS 3.4, Jeff Starr Simple Ajax Chat)
- [CVE-2022-25606](https://cve.now/CVE-2022-25606.md): WordPress WP-DownloadManager plugin \<= 1.68.5 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities (CVSS 4.8, Lester 'GaMerZ' Chan WP-DownloadManager)
- [CVE-2021-44768](https://cve.now/CVE-2021-44768.md): Delta Electronics CNCSoft Out-of-bounds Read (CVSS 6.1, Delta Electronics CNCSoft)
- [CVE-2022-0988](https://cve.now/CVE-2022-0988.md): Delta Electronics DIAEnergie CLEARTEXT Transmission of Sensitive Information (CVSS 7.1, Delta Electronics DIAEnergie)
- [CVE-2021-44477](https://cve.now/CVE-2021-44477.md): GE Gas Power ToolBoxST Improper Restriction of XML External Entity Reference (CVSS 7.5, GE Gas Power ToolBoxST)
- [CVE-2021-44462](https://cve.now/CVE-2021-44462.md): Horner Automation Cscape EnvisionRV Improper Input Validation (CVSS 7.8, Horner Automation Cscape EnvisionRV)
- [CVE-2021-35254](https://cve.now/CVE-2021-35254.md): Authenticated Remote Code Execution in WebHelpDesk 12.7.8 (CVSS 8.2, SolarWinds WebHelpDesk)
- [CVE-2021-43636](https://cve.now/CVE-2021-43636.md): Two Buffer Overflow vulnerabilities exists in T10 V2\_Firmware V4.1.8cu.5207\_B20210320 in the http\_request\_parse function when processing hos (no CVSS)
- [CVE-2022-24778](https://cve.now/CVE-2022-24778.md): Incorrect Authorization in imgcrypt (CVSS 7.5, containerd imgcrypt · github.com/containerd/imgcrypt)
- [CVE-2022-27882](https://cve.now/CVE-2022-27882.md): slaacd in OpenBSD 6.9 and 7.0 before 2022-03-22 has an integer signedness error and resultant heap-based buffer overflow triggerable by a cr (no CVSS)
- [CVE-2022-27881](https://cve.now/CVE-2022-27881.md): engine.c in slaacd in OpenBSD 6.9 and 7.0 before 2022-02-21 has a buffer overflow triggerable by an IPv6 router advertisement with more than (no CVSS)
- [CVE-2022-26263](https://cve.now/CVE-2022-26263.md): Yonyou u8 v13.0 was discovered to contain a DOM-based cross-site scripting (XSS) vulnerability via the component /u8sl/WebHelp. (no CVSS)
- [CVE-2022-25582](https://cve.now/CVE-2022-25582.md): A stored cross-site scripting (XSS) vulnerability in the Column module of ClassCMS v2.5 and below allows attackers to execute arbitrary web (no CVSS)
- [CVE-2022-24777](https://cve.now/CVE-2022-24777.md): Denial of Service via reachable assertion in grpc-swift (CVSS 7.5, grpc-swift)
- [CVE-2022-25577](https://cve.now/CVE-2022-25577.md): ALF-BanCO v8.2.5 and below was discovered to use a hardcoded password to encrypt the SQLite database containing the user's data. (no CVSS)
- [CVE-2021-43091](https://cve.now/CVE-2021-43091.md): An SQL Injection vlnerability exits in Yeswiki doryphore 20211012 via the email parameter in the registration form. (no CVSS, yeswiki/yeswiki)
- [CVE-2022-25574](https://cve.now/CVE-2022-25574.md): A stored cross-site scripting (XSS) vulnerability in the upload function of /admin/show.php allows attackers to execute arbitrary web script (no CVSS)
- [CVE-2021-46426](https://cve.now/CVE-2021-46426.md): phpIPAM 1.4.4 allows Reflected XSS and CSRF via app/admin/subnets/find\_free\_section\_subnets.php of the subnets functionality. (no CVSS)
- [CVE-2021-43090](https://cve.now/CVE-2021-43090.md): An XML External Entity (XXE) vulnerability exists in soa-model before 1.6.4 in the WSDLParser function. (no CVSS, com.predic8:soa-model-parent · com.predic8:soa-model-core)
- [CVE-2020-21554](https://cve.now/CVE-2020-21554.md): A File Deletion vulnerability exists in TinyShop 3.1.1 in the back\_list parameter in controllers\\admin.php, which could let a malicious user (no CVSS)
- [CVE-2022-27227](https://cve.now/CVE-2022-27227.md): In PowerDNS Authoritative Server before 4.4.3, 4.5.x before 4.5.4, and 4.6.x before 4.6.1 and PowerDNS Recursor before 4.4.8, 4.5.x before 4 (no CVSS)
- [CVE-2022-1040](https://cve.now/CVE-2022-1040.md): An authentication bypass vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v (CVSS 9.8, KEV, Sophos Firewall)
- [CVE-2022-1064](https://cve.now/CVE-2022-1064.md): SQL injection through marking blog comments on bulk as spam in forkcms/forkcms (CVSS 9.0, forkcms/forkcms)
- [CVE-2021-44751](https://cve.now/CVE-2021-44751.md): F-Secure SAFE Browser vulnerable to USSD attacks (CVSS 4.3, F-Secure SAFE Browser for Android)
- [CVE-2022-22687](https://cve.now/CVE-2022-22687.md): Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in Authentication functionality in Synology DiskStation (CVSS 9.8, Synology DiskStation Manager)
- [CVE-2022-22688](https://cve.now/CVE-2022-22688.md): Improper neutralization of special elements used in a command ('Command Injection') vulnerability in File service functionality in Synology (CVSS 8.8, Synology DiskStation Manager)
- [CVE-2018-25032](https://cve.now/CVE-2018-25032.md): zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches. (CVSS 7.5, nokogiri)
- [CVE-2021-3933](https://cve.now/CVE-2021-3933.md): An integer overflow could occur when OpenEXR processes a crafted file on systems where size\_t \< 64 bits. (no CVSS, openexr)
- [CVE-2021-3941](https://cve.now/CVE-2021-3941.md): In ImfChromaticities.cpp routine RGBtoXYZ(), there are some division operations such as \`float Z = (1 - chroma.white.x - chroma.white.y) \* Y (no CVSS, openexr)
- [CVE-2021-4147](https://cve.now/CVE-2021-4147.md): A flaw was found in the libvirt libxl driver. (no CVSS, libvirt)
- [CVE-2021-4203](https://cve.now/CVE-2021-4203.md): A use-after-free read flaw was found in sock\_getsockopt() in net/core/sock.c due to SO\_PEERCRED and SO\_PEERGROUPS race with listen() (and co (no CVSS, kernel)
- [CVE-2022-0330](https://cve.now/CVE-2022-0330.md): A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the way a user may run malicious code on (no CVSS, kernel)
- [CVE-2022-0435](https://cve.now/CVE-2022-0435.md): A stack overflow flaw was found in the Linux kernel's TIPC protocol functionality in the way a user sends a packet with malicious content wh (no CVSS, kernel)
- [CVE-2022-0897](https://cve.now/CVE-2022-0897.md): A flaw was found in the libvirt nwfilter driver. (no CVSS, libvirt)
- [CVE-2022-22995](https://cve.now/CVE-2022-22995.md): Western Digital My Cloud OS 5 and My Cloud Home Unauthenticated Arbitrary File Write Vulnerability in Netatalk (CVSS 10.0, Western Digital My Cloud)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-03-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.