CVEs published March 28, 2022
113 CVEs were published on March 28, 2022: 4 critical, 4 high.
- Published
- 113
- Critical
- 4
- High
- 4
- Medium
- 18
- Low
- 10
- Unrated
- 77
- Now in CISA KEV
- 0
- Fix available
- 43
Most affected products
- GitLab
- 14
- WEKA INTEREST Security Scanner
- 6
- impresscms/impresscms
- 4
- ISS BlackICE PC Protection
- 3
- Schneider Electric StruxureWare Data Center Expert
- 2
- Akismet Privacy Policies
- 1
- Amelia – Events & Appointments Booking Calendar
- 1
- Apache Software Foundation Apache APISIX
- 1
- Bank Mellat
- 1
- Block Bad Bots and Stop Bad Bots Crawlers and Spiders and A…
- 1
Critical 4
- CVE-2022-0735An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.10 before 14.6.5, all versions starting from 14.7 beforGitLab
- CVE-2021-22795A CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause reSchneider Electric StruxureWare Data Center Expert
- CVE-2021-22794A CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause remote code exSchneider Electric StruxureWare Data Center Expert
- CVE-2022-0342An authentication bypass vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.20 through 4.70, USG FLEX series fiZyxel USG/ZyWALL series firmware · Zyxel USG FLEX series… +3
High 4
- CVE-2022-24789 Deserialization of untrusted data in C1 CMS.Orckestra C1-CMS-Foundation · C1CMS.Assemblies
- CVE-2022-0427Missing sanitization of HTML attributes in Jupyter notebooks in all versions of GitLab CE/EE since version 14.5 allows an attacker to perforGitLab
- CVE-2021-22797A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal) vulnerability exists that could cause malicious scriSchneider Electric EcoStruxure Control Expert · Schneide… +1
- CVE-2019-6834A CWE-502: Deserialization of Untrusted Data vulnerability exists which could allow an attacker to execute arbitrary code on the targeted sySchneider Electric Software Update (SESU) – SUT Service com…
Medium, low and unrated 105
- CVE-2022-26296BOOM: The Berkeley Out-of-Order RISC-V Processor commit d77c2c3 was discovered to allow unauthorized disclosure of information to an attacke
- CVE-2022-26641TP-LINK TL-WR840N(ES)_V6.20 was discovered to contain a buffer overflow via the httpRemotePort parameter.
- CVE-2022-26642TP-LINK TL-WR840N(ES)_V6.20 was discovered to contain a buffer overflow via the X_TP_ClonedMACAddress parameter.
- CVE-2022-26639TP-LINK TL-WR840N(ES)_V6.20 was discovered to contain a buffer overflow via the DNSServers parameter.
- CVE-2022-26640TP-LINK TL-WR840N(ES)_V6.20 was discovered to contain a buffer overflow via the minAddress parameter.
- CVE-2021-43105A vulnerability in the bailiwick checking function in Technitium DNS Server <= v7.0 exists that allows specific malicious users to inject `N
- CVE-2022-26291lrzip v0.641 was discovered to contain a multiple concurrency use-after-free between the functions zpaq_decompress_buf() and clear_rulist().
- CVE-2022-26280Libarchive v3.6.0 was discovered to contain an out-of-bounds read via the component zipx_lzma_alone_init.
- CVE-2021-43103A File Upload vulnerability exists in bbs 5.3 is via ForumManageAction.java in a GetType function, which lets a remote malicious user execut
- CVE-2021-43102A File Upload vulnerability exists in bbs 5.3 is via HelpManageAction.java in a GetType function, which lets a remote malicious user execute
- CVE-2021-43101A File Upload vulnerability exists in bbs 5.3 is via MembershipCardManageAction.java in a GetType function, which lets a remote malicious us
- CVE-2021-43100A File Upload vulnerability exists in bbs 5.3 is via TopicManageAction.java in a GetType function, which lets a remote malicious user execut
- CVE-2021-43099An Archive Extraction (AKA "Zip Slip) vulnerability exists in bbs 5.3 in the UpgradeNow function in UpgradeManageAction.java, which unzips t
- CVE-2021-43098A File Upload vulnerability exists in bbs v5.3 via QuestionManageAction.java in a getType function.
- CVE-2021-43097A Server-side Template Injection (SSTI) vulnerability exists in bbs 5.3 in TemplateManageAction.javawhich could let a malicoius user execute
- CVE-2022-26278Tenda AC9 v15.03.2.21_cn was discovered to contain a stack overflow via the time parameter in the PowerSaveSet function.
- CVE-2017-20016WEKA INTEREST Security Scanner Portscan memory allocationWEKA INTEREST Security Scanner
- CVE-2017-20015WEKA INTEREST Security Scanner LAN Viewer denial of serviceWEKA INTEREST Security Scanner
- CVE-2017-20014WEKA INTEREST Security Scanner Webspider denial of serviceWEKA INTEREST Security Scanner
- CVE-2017-20013WEKA INTEREST Security Scanner Stresstest Configuration denial of serviceWEKA INTEREST Security Scanner
- CVE-2017-20012WEKA INTEREST Security Scanner Stresstest Scheme denial of serviceWEKA INTEREST Security Scanner
- CVE-2017-20011WEKA INTEREST Security Scanner HTTP denial of serviceWEKA INTEREST Security Scanner
- CVE-2010-10001Shemes GrabIt NZB Date Parser denial of serviceShemes GrabIt
- CVE-2008-10001Pro2col Stingray FTS cross site scritingPro2col Stingray FTS
- CVE-2005-10001Netegrity SiteMinder Login smpwservicescgi.exe redirectNetegrity SiteMinder
- CVE-2003-5003ISS BlackICE PC Protection Update cross site scritingISS BlackICE PC Protection
- CVE-2003-5002ISS BlackICE PC Protection Update cleartext transmissionISS BlackICE PC Protection
- CVE-2003-5001ISS BlackICE PC Protection Cross Site Scripting Detection privileges managementISS BlackICE PC Protection
- CVE-2021-4191An issue has been discovered in GitLab CE/EE affecting versions 13.0 to 14.6.5, 14.7 to 14.7.4, and 14.8 to 14.8.2.GitLab
- CVE-2022-0283An issue has been discovered affecting GitLab versions prior to 13.5.GitLab
- CVE-2022-0136A vulnerability was discovered in GitLab versions 10.5 to 14.5.4, 14.6 to 14.6.4, and 14.7 to 14.7.1.GitLab
- CVE-2021-39876In all versions of GitLab CE/EE since version 11.3, the endpoint for auto-completing Assignee discloses the members of private groups.GitLab
- CVE-2022-0488An issue has been discovered in GitLab CE/EE affecting all versions starting with version 8.10.GitLab
- CVE-2022-0249A vulnerability was discovered in GitLab starting with version 12.GitLab
- CVE-2022-0344An issue has been discovered in GitLab affecting all versions starting from 10.0 before 14.5.4, all versions starting from 10.1 before 14.6.GitLab
- CVE-2022-0123An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1.GitLab
- CVE-2022-0738An issue has been discovered in GitLab affecting all versions starting from 14.6 before 14.6.5, all versions starting from 14.7 before 14.7.GitLab
- CVE-2022-0751Inaccurate display of Snippet files containing special characters in all versions of GitLab CE/EE allows an attacker to create Snippets withGitLab
- CVE-2022-0371An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.4 before 14.5.4, all versions starting from 14.6 beforeGitLab
- CVE-2022-0549An issue has been discovered in GitLab CE/EE affecting all versions before 14.3.6, all versions starting from 14.4 before 14.4.4, all versioGitLab
- CVE-2022-27658Under certain conditions, SAP Innovation management - version 2.0, allows an attacker to access information which could lead to information SAP SE SAP Innovation management
- CVE-2018-25030Mirmay Secure Private Browser / File Manager Auto Lock improper authenticationMirmay Secure Private Browser · Mirmay File Manager
- CVE-2022-26980Teampass 2.1.26 allows reflected XSS via the index.php PATH_INFO.nilsteampassnet/teampass
- CVE-2015-10002Kiddoware Kids Place Home Button Protection denial of serviceKiddoware Kids Place
- CVE-2022-0846SpeakOut! Email Petitions < 2.14.15.1 - Unauthenticated SQLiSpeakOut! Email Petitions
- CVE-2022-0833Church Admin < 3.4.135 - Unauthenticated Plugin's Backup DisclosureChurch Admin
- CVE-2022-0818Coupon Affiliates < 4.16.4.5 - Unauthenticated Stored XSSWooCommerce Affiliate Plugin – Coupon Affiliates
- CVE-2022-0787Limit Login Attempts (Spam Protection) < 5.1 - Unauthenticated SQLiLimit Login Attempts
- CVE-2022-0784Title Experiments Free < 9.0.1 - Unauthenticated SQLiTitle Experiments Free
- CVE-2022-0770Translate WordPress with GTranslate < 2.9.9 - CSRF to Account TakeoverTranslate WordPress with GTranslate
- CVE-2022-0720Amelia < 1.0.47 - Customer+ Arbitrary Appointments Update and Sensitive Data DisclosureAmelia – Events & Appointments Booking Calendar
- CVE-2022-0680Plezi < 1.0.3 - Unauthenticated Stored XSSPlezi
- CVE-2022-0679Narnoo Distributor <= 2.5.1 - Unauthenticated LFI to Arbitrary File Read / RCENarnoo Distributor
- CVE-2022-0647Bulk Creator <= 1.0.1 - Reflected Cross-Site ScriptingBulk Creator
- CVE-2022-0643Bank Mellat <= 1.3.7 - Reflected Cross-Site ScriptingBank Mellat
- CVE-2022-0641Popup Like box < 3.6.1 - Reflected Cross-Site ScriptingPopup Like box – Page Plugin
- CVE-2022-0621dTabs <= 1.4 - Reflected Cross-Site ScriptingdTabs
- CVE-2022-0620Delete Old Orders <= 0.2 - Reflected Cross-Site ScriptingDelete Old Orders
- CVE-2022-0619Database Peek <= 1.2 - Reflected Cross-Site ScriptingDatabase Peek
- CVE-2022-0600Conference Scheduler < 2.4.3 - Reflected Cross-Site ScriptingConference Scheduler
- CVE-2022-0599Mapping Multiple URLs Redirect Same Page <= 5.8 - Reflected Cross-Site ScriptingMapping multiple URLs redirect same page
- CVE-2022-0595Drag and Drop Multiple File Upload - Contact Form 7 < 1.3.6.3 - Unauthenticated Stored XSSDrag and Drop Multiple File Upload – Contact Form
- CVE-2022-0499Sermon Browser <= 0.45.22 - Arbitrary File Upload via CSRFSermon Browser
- CVE-2022-0493String Locator < 2.5.0 - Admin+ Arbitrary File ReadString locator
- CVE-2022-0479Popup Builder < 4.1.1 - SQL Injection to Reflected Cross-Site ScriptingPopup Builder – Create highly converting, mobile friendly m…
- CVE-2022-0450Menu Image, Icons made easy < 3.0.8 - Subscriber+ Stored Cross-Site ScriptingMenu Image, Icons made easy
- CVE-2022-0397WPC Smart Wishlist for WooCommerce < 2.9.4 - Reflected Cross-Site ScriptingWPC Smart Wishlist for WooCommerce
- CVE-2022-0388Interactive Medical Drawing of Human Body < 2.6 - Admin+ Stored XSSInteractive Medical Drawing of Human Body
- CVE-2021-25071Akismet Privacy Policies <= 2.0.1 - Reflected Cross-Site ScriptingAkismet Privacy Policies
- CVE-2021-25070WP Block and Stop Bad Bots < 6.88 - Unauthenticated SQLiBlock Bad Bots and Stop Bad Bots Crawlers and Spiders and A…
- CVE-2021-25068Sync WooCommerce Product feed to Google Shopping <= 1.2.4 - Admin+ SQLiSync WooCommerce Product feed to Google Shopping
- CVE-2021-25064Wow Countdowns <= 3.1.2 - Admin+ SQLiWow Countdowns – easily create any countdowns, counters and…
- CVE-2021-25012Pz-LinkCard <= 2.4.4.4 - Reflected Cross-Site ScriptingPz-LinkCard
- CVE-2021-24978OSMapper <= 2.1.5 - Unauthenticated Arbitrary Post DeletionOSMapper
- CVE-2021-24962WordPress File Upload < 4.16.3 - Contributor+ Path Traversal to RCEWordPress File Upload
- CVE-2021-24746Sassy Social Share < 3.3.40 - Reflected Cross-Site ScriptingSocial Sharing Plugin – Sassy Social Share
- CVE-2022-0221A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could result in information disclosure when openiSchneider Electric SCADAPack Workbench
- CVE-2021-44124Hiby Music Hiby OS R3 Pro 1.5 and 1.6 is vulnerable to Directory Traversal.
- CVE-2021-43721Leanote 2.7.0 is vulnerable to Cross Site Scripting (XSS) in the markdown type note.
- CVE-2021-43725There is a Cross Site Scripting (XSS) vulnerability in SpotPage_login.php of Spotweb 1.5.1 and below, which allows remote attackers to injec
- CVE-2022-23884Mojang Bedrock Dedicated Server 1.18.2 is affected by an integer overflow leading to a bound check bypass caused by PurchaseReceiptPacket::_
- CVE-2022-23882TuziCMS 2.0.6 is affected by SQL injection in \App\Manage\Controller\BannerController.class.php.
- CVE-2021-46434EMQ X Dashboard V3.0.0 is affected by username enumeration in the "/api /v3/auth" interface.
- CVE-2021-46433In fenom 2.12.1 and before, there is a way in fenom/src/Fenom/Template.php function getTemplateCode()to bypass sandbox to execute arbitrary fenom/fenom
- CVE-2022-25757Apache APISIX: the body_schema check in request-validation plugin can be bypassedApache Software Foundation Apache APISIX
- CVE-2022-27950In drivers/hid/hid-elo.c in the Linux kernel before 5.16.11, a memory leak exists for a certain hid_parse error condition.
- CVE-2021-454913CX System through 2022-03-17 stores cleartext passwords in a database.
- CVE-2021-45490The client applications in 3CX on Windows, the 3CX app for iOS, and the 3CX application for Android through 2022-03-17 lack SSL certificate
- CVE-2022-26273EyouCMS v1.5.4 was discovered to lack parameter filtering in \user\controller\shop.php, leading to payment logic vulnerabilities.
- CVE-2021-44617A SQL Injection vulnerability exits in the Ramo plugin for GLPI 9.4.6 via the idu parameter in plugins/ramo/ramoapirest.php/getOutdated.
- CVE-2021-44213OX App Suite through 7.10.5 allows XSS via uuencoding in a multipart/alternative message.
- CVE-2021-44212OX App Suite through 7.10.5 allows XSS via a trailing control character such as the SCRIPT\t substring.
- CVE-2021-44211OX App Suite through 7.10.5 allows XSS via the class attribute of an element in an HTML e-mail signature.
- CVE-2022-2627174cmsSE v3.4.1 was discovered to contain an arbitrary file read vulnerability via the $url parameter at \index\controller\Download.php.
- CVE-2021-44210OX App Suite through 7.10.5 allows XSS via NIFF (Notation Interchange File Format) data.
- CVE-2021-44209OX App Suite through 7.10.5 allows XSS via an HTML 5 element such as AUDIO.
- CVE-2021-44208OX App Suite through 7.10.5 allows XSS via an unknown system message in Chat.
- CVE-2021-26601ImpressCMS before 1.4.3 allows libraries/image-editor/image-edit.php image_temp Directory Traversal.impresscms/impresscms
- CVE-2021-26600ImpressCMS before 1.4.3 has plugins/preloads/autologin.php type confusion with resultant Authentication Bypass (!= instead of !==).impresscms/impresscms
- CVE-2021-26599ImpressCMS before 1.4.3 allows include/findusers.php groups SQL Injection.impresscms/impresscms
- CVE-2022-26268Xiaohuanxiong v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /app/controller/Books.php.
- CVE-2021-26598ImpressCMS before 1.4.3 has Incorrect Access Control because include/findusers.php allows access by unauthenticated attackers (who are, by dimpresscms/impresscms
- CVE-2022-26259A buffer over flow in Xiongmai DVR devices NBD80X16S-KL, NBD80X09S-KL, NBD80X08S-KL, NBD80X09RA-KL, AHB80X04R-MH, AHB80X04R-MH-V2, AHB80X04-
- CVE-2022-1056Out-of-bounds Read error in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file.libtiff
- CVE-2022-24303Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled.pillow