CVEs published March 29, 2022
105 CVEs were published on March 29, 2022: 17 critical, 13 high. 2 are now in CISA KEV.
- Published
- 105
- Critical
- 17
- High
- 13
- Medium
- 15
- Low
- 6
- Unrated
- 54
- Now in CISA KEV
- 2
- Fix available
- 43
Most affected products
- Delta Electronics DIAEnergie
- 17
- Jenkins project Jenkins Continuous Integration with Toad Ed…
- 4
- Jenkins project Jenkins Job and Node ownership Plugin · com…
- 4
- Jenkins project Jenkins Pipeline: Phoenix AutoTest Plugin ·…
- 4
- Jenkins project Jenkins Proxmox Plugin · org.jenkins-ci.plu…
- 4
- SaltStack Salt · salt
- 4
- SourceCodester One Church Management System
- 3
- Jenkins project Jenkins Bitbucket Server Integration Plugin…
- 2
- Jenkins project Jenkins JiraTestResultReporter Plugin · org…
- 2
- Jenkins project Jenkins RocketChat Notifier Plugin · org.je…
- 2
Critical 17
- CVE-2022-26871An arbitrary file upload vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to upload an arbitrary filTrend Micro Apex Central
- CVE-2022-27175Delta Electronics DIAEnergie SQL Injection in GetCalcTagListDelta Electronics DIAEnergie
- CVE-2022-26667Delta Electronics DIAEnergie SQL Injection in GetDemandAnalysisDataDelta Electronics DIAEnergie
- CVE-2022-26338Delta Electronics DIAEnergie SQL Injection in DIAE_hierarchyHandler.ashxDelta Electronics DIAEnergie
- CVE-2022-26514Delta Electronics DIAEnergie SQL Injection in DIAE_tagHandler.ashxDelta Electronics DIAEnergie
- CVE-2022-26666Delta Electronics DIAEnergie SQL Injection in HandlerDialogECC.ashxDelta Electronics DIAEnergie
- CVE-2022-26887Delta Electronics DIAEnergie SQL Injection in DIAE_HandlerTag_KID.ashxDelta Electronics DIAEnergie
- CVE-2022-26836Delta Electronics DIAEnergie SQL Injection in HandlerExport.ashx/Calendar.ashxDelta Electronics DIAEnergie
- CVE-2022-26349Delta Electronics DIAEnergie SQL Injection in DIAE_eccoefficientHandler.ashxDelta Electronics DIAEnergie
- CVE-2022-26065Delta Electronics DIAEnergie SQL Injection in GetLatestDemandNode and GetDemandAnalysisDataDelta Electronics DIAEnergie
- CVE-2022-26013Delta Electronics DIAEnergie SQL Injection in DIAE_dmdsetHandler.ashxDelta Electronics DIAEnergie
- CVE-2022-25880Delta Electronics DIAEnergie SQL Injection in DIAE_hierarchyHandler.ashxDelta Electronics DIAEnergie
- CVE-2022-0923Delta Electronics DIAEnergie SQL Injection in HandlerDialog_KID.ashxDelta Electronics DIAEnergie
- CVE-2022-26069Delta Electronics DIAEnergie SQL Injection in HandlerPage_KID.ashxDelta Electronics DIAEnergie
- CVE-2022-25347Delta Electronics DIAEnergie Path TraversalDelta Electronics DIAEnergie
- CVE-2022-25980Delta Electronics DIAEnergie SQL Injection in HandlerCommon.ashxDelta Electronics DIAEnergie
- CVE-2022-26059Delta Electronics DIAEnergie SQL Injection in GetQueryDataDelta Electronics DIAEnergie
High 13
- CVE-2022-21821NVIDIA CUDA Toolkit SDK contains an integer overflow vulnerability in cuobjdump.To exploit this vulnerability, a remote attacker would requiNVIDIA CUDA Toolkit
- CVE-2022-26839Delta Electronics DIAEnergie Incorrect Default PermissionsDelta Electronics DIAEnergie
- CVE-2022-1055Use after Free in tc_new_tfilter allowing for privilege escalation in Linux KernelLinux Kernel
- CVE-2022-28136A cross-site request forgery (CSRF) vulnerability in Jenkins JiraTestResultReporter Plugin 165.v817928553942 and earlier allows attackers toJenkins project Jenkins JiraTestResultReporter Plugin · org…
- CVE-2022-1032Insecure deserialization of not validated module file in crater-invoice/cratercrater-invoice/crater
- CVE-2022-1084SourceCodester One Church Management System Session userregister.php improper authenticationSourceCodester One Church Management System
- CVE-2022-1083Microfinance Management System sql injectionMicrofinance Management System
- CVE-2022-1082SourceCodester Microfinance Management System Login Page login.php sql injectionSourceCodester Microfinance Management System
- CVE-2022-1080SourceCodester One Church Management System attendancy.php sql injectionSourceCodester One Church Management System
- CVE-2022-1078SourceCodester College Website Management System sql injectionSourceCodester College Website Management System
- CVE-2022-1073Automatic Question Paper Generator password recoveryAutomatic Question Paper Generator
- CVE-2022-22936An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1.SaltStack Salt · salt
- CVE-2022-22941An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1.SaltStack Salt · salt
Medium, low and unrated 75
- CVE-2021-41594In RSA Archer 6.9.SP1 P3, if some application functions are precluded by the Administrator, this can be bypassed by intercepting the API req
- CVE-2022-26951Archer 6.x through 6.10 (6.10.0.0) contains a reflected XSS vulnerability.
- CVE-2022-26950Archer 6.x through 6.9 P2 (6.9.0.2) is affected by an open redirect vulnerability.
- CVE-2022-26949Archer 6.x through 6.9 SP2 P1 (6.9.2.1) contains an improper access control vulnerability on attachments.
- CVE-2022-26948The Archer RSS feed integration for Archer 6.x through 6.9 SP1 (6.9.1.0) is affected by an insecure credential storage vulnerability.
- CVE-2022-26947Archer 6.x through 6.9 SP3 (6.9.3.0) contains a reflected XSS vulnerability.
- CVE-2022-27432A Cross-Site Request Forgery (CSRF) in Pluck CMS v4.7.15 allows attackers to change the password of any given user by exploiting this featur
- CVE-2022-27815SWHKD 1.1.5 unsafely uses the /tmp/swhkd.pid pathname.Simple-Wayland-HotKey-Daemon
- CVE-2015-3298Yubico ykneo-openpgp before 1.0.10 has a typo in which an invalid PIN can be used.
- CVE-2022-26244A stored cross-site scripting (XSS) vulnerability in Hospital Patient Record Management System v1.0 allows attackers to execute arbitrary we
- CVE-2021-44082textpattern 4.8.7 is vulnerable to Cross Site Scripting (XSS) via /textpattern/index.php,Body.
- CVE-2021-43118A Remote Command Injection vulnerability exists in DrayTek Vigor 2960 1.5.1.3, DrayTek Vigor 3900 1.5.1.3, and DrayTek Vigor 300B 1.5.1.3 vi
- CVE-2021-42911A Format String vulnerability exists in DrayTek Vigor 2960 <= 1.5.1.3, DrayTek Vigor 3900 <= 1.5.1.3, and DrayTek Vigor 300B <= 1.5.1.3 in t
- CVE-2021-43110An Access Conrol vulnerability exists in PuneethReddyHC online-shopping-system as of 11/01/2021 in add_products.
- CVE-2021-43109An SQL Injection vulnerability exits in PuneethReddyHC online-shopping-system as of 11/01/2021 via the p parameter in product.php.
- CVE-2022-1122A flaw was found in the opj2_decompress program in openjpeg2 2.4.0 in the way it handles an input directory with a large number of files.openjpeg2
- CVE-2022-22948The vCenter Server contains an information disclosure vulnerability due to improper permission of files.VMware vCenter Server and VMware Cloud Foundation
- CVE-2021-42970Cross Site Scripting (XSS) vulnerability exists in cxuucms v3 via the imgurl of /feedback/post/ content parameter.
- CVE-2021-44081A buffer overflow vulnerability exists in the AMF of open5gs 2.1.4.
- CVE-2021-43701CSZ CMS 1.2.9 has a Time and Boolean-based Blind SQL Injection vulnerability in the endpoint /admin/export/getcsv/article_db, via the fieldS
- CVE-2022-0343Local Priviledge escalation in Perfetto Dev scriptsGoogle Perfetto Dev Scripts
- CVE-2021-22572Data-transfer-project information disclosure via tmp directoryGoogle Data-Transfer-Project
- CVE-2022-28160Jenkins Tests Selector Plugin 1.3.3 and earlier allows users with Item/Configure permission to read arbitrary files on the Jenkins controlleJenkins project Jenkins Tests Selector Plugin · org.jenkins…
- CVE-2022-28159Jenkins Tests Selector Plugin 1.3.3 and earlier does not escape the Properties File Path option for Choosing Tests parameters, resulting in Jenkins project Jenkins Tests Selector Plugin · org.jenkins…
- CVE-2022-28158A missing permission check in Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier allows attackers with Overall/Read permission to enuJenkins project Jenkins Pipeline: Phoenix AutoTest Plugin ·…
- CVE-2022-28157Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier allows attackers with Item/Configure permission to upload arbitrary files from theJenkins project Jenkins Pipeline: Phoenix AutoTest Plugin ·…
- CVE-2022-28156Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier allows attackers with Item/Configure permission to copy arbitrary files and directJenkins project Jenkins Pipeline: Phoenix AutoTest Plugin ·…
- CVE-2022-28155Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Jenkins project Jenkins Pipeline: Phoenix AutoTest Plugin ·…
- CVE-2022-28154Jenkins Coverage/Complexity Scatter Plot Plugin 1.1.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attJenkins project Jenkins Coverage/Complexity Scatter Plot Pl…
- CVE-2022-28153Jenkins SiteMonitor Plugin 0.6 and earlier does not escape URLs of sites to monitor in tooltips, resulting in a stored cross-site scripting Jenkins project Jenkins SiteMonitor Plugin · org.jvnet.huds…
- CVE-2022-28152A cross-site request forgery (CSRF) vulnerability in Jenkins Job and Node ownership Plugin 0.13.0 and earlier allows attackers to restore thJenkins project Jenkins Job and Node ownership Plugin · com…
- CVE-2022-28151A missing permission check in Jenkins Job and Node ownership Plugin 0.13.0 and earlier allows attackers with Item/Read permission to change Jenkins project Jenkins Job and Node ownership Plugin · com…
- CVE-2022-28150A cross-site request forgery (CSRF) vulnerability in Jenkins Job and Node ownership Plugin 0.13.0 and earlier allows attackers to change theJenkins project Jenkins Job and Node ownership Plugin · com…
- CVE-2022-28149Jenkins Job and Node ownership Plugin 0.13.0 and earlier does not escape the names of the secondary owners, resulting in a stored cross-siteJenkins project Jenkins Job and Node ownership Plugin · com…
- CVE-2022-28148The file browser in Jenkins Continuous Integration with Toad Edge Plugin 2.3 and earlier may interpret some paths to files as absolute on WiJenkins project Jenkins Continuous Integration with Toad Ed…
- CVE-2022-28147A missing permission check in Jenkins Continuous Integration with Toad Edge Plugin 2.3 and earlier allows attackers with Overall/Read permisJenkins project Jenkins Continuous Integration with Toad Ed…
- CVE-2022-28146Jenkins Continuous Integration with Toad Edge Plugin 2.3 and earlier allows attackers with Item/Configure permission to read arbitrary filesJenkins project Jenkins Continuous Integration with Toad Ed…
- CVE-2022-28145Jenkins Continuous Integration with Toad Edge Plugin 2.3 and earlier does not apply Content-Security-Policy headers to report files it serveJenkins project Jenkins Continuous Integration with Toad Ed…
- CVE-2022-28144Jenkins Proxmox Plugin 0.7.0 and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/ReadJenkins project Jenkins Proxmox Plugin · org.jenkins-ci.plu…
- CVE-2022-28143A cross-site request forgery (CSRF) vulnerability in Jenkins Proxmox Plugin 0.7.0 and earlier allows attackers to connect to an attacker-speJenkins project Jenkins Proxmox Plugin · org.jenkins-ci.plu…
- CVE-2022-28142Jenkins Proxmox Plugin 0.6.0 and earlier disables SSL/TLS certificate validation globally for the Jenkins controller JVM when configured to Jenkins project Jenkins Proxmox Plugin · org.jenkins-ci.plu…
- CVE-2022-28141Jenkins Proxmox Plugin 0.5.0 and earlier stores the Proxmox Datacenter password unencrypted in the global config.xml file on the Jenkins conJenkins project Jenkins Proxmox Plugin · org.jenkins-ci.plu…
- CVE-2022-28140Jenkins Flaky Test Handler Plugin 1.2.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Jenkins project Jenkins Flaky Test Handler Plugin · org.jen…
- CVE-2022-28139A missing permission check in Jenkins RocketChat Notifier Plugin 1.4.10 and earlier allows attackers with Overall/Read permission to connectJenkins project Jenkins RocketChat Notifier Plugin · org.je…
- CVE-2022-28138A cross-site request forgery (CSRF) vulnerability in Jenkins RocketChat Notifier Plugin 1.4.10 and earlier allows attackers to connect to anJenkins project Jenkins RocketChat Notifier Plugin · org.je…
- CVE-2022-28137A missing permission check in Jenkins JiraTestResultReporter Plugin 165.v817928553942 and earlier allows attackers with Overall/Read permissJenkins project Jenkins JiraTestResultReporter Plugin · org…
- CVE-2022-28135Jenkins instant-messaging Plugin 1.41 and earlier stores passwords for group chats unencrypted in the global configuration file of plugins bJenkins project Jenkins instant-messaging Plugin · org.jvne…
- CVE-2022-28134Jenkins Bitbucket Server Integration Plugin 3.1.0 and earlier does not perform permission checks in several HTTP endpoints, allowing attackeJenkins project Jenkins Bitbucket Server Integration Plugin…
- CVE-2022-28133Jenkins Bitbucket Server Integration Plugin 3.1.0 and earlier does not limit URL schemes for callback URLs on OAuth consumers, resulting in Jenkins project Jenkins Bitbucket Server Integration Plugin…
- CVE-2022-23903A Cross Site Scripting (XSS) vulnerability exists in pearadmin pear-admin-think <=5.0.6, which allows a login account to access arbitrary fu
- CVE-2022-23901A stack overflow re2c 2.2 exists due to infinite recursion issues in src/dfa/dead_rules.cc.
- CVE-2022-23059Shopizer - Stored XSS in Manage Imagesshopizer-ecommerce Shopizer · com.shopizer:shopizer
- CVE-2021-46743In Firebase PHP-JWT before 6.0.0, an algorithm-confusion issue (e.g., RS256 / HS256) exists via the kid (aka Key ID) header, when multiple tfirebase/php-jwt
- CVE-2022-1087htmly Edit Profile Module cross site scriptinghtmly
- CVE-2022-1086DolphinPHP User Management Page cross site scriptingDolphinPHP
- CVE-2022-1085CLTPHP POST Parameter cross site scriptingCLTPHP
- CVE-2022-1081SourceCodester Microfinance Management System addcustomerHandler.php cross site scriptingSourceCodester Microfinance Management System
- CVE-2022-1079SourceCodester One Church Management System churchprofile.php cross site scriptingSourceCodester One Church Management System
- CVE-2022-1077TEM FLEX-1080/FLEX-1085 Log information disclosureTEM FLEX-1080 · TEM FLEX-1085
- CVE-2022-1076Automatic Question Paper Generator System My Account Page login.php cross site scriptingAutomatic Question Paper Generator System
- CVE-2022-1075College Website Management System Contact cross site scriptingCollege Website Management System
- CVE-2022-1074TEM FLEX-1085 injectionTEM FLEX-1085
- CVE-2022-23937In Wind River VxWorks 6.9 and 7, a specific crafted packet may lead to an out-of-bounds read during an IKE initial exchange scenario.
- CVE-2022-24957DHC Vision eQMS through 5.4.8.322 has Persistent XSS due to insufficient encoding of untrusted input/output.
- CVE-2022-24956An issue was discovered in Shopware B2B-Suite through 4.4.1.
- CVE-2022-25420NTT Resonant Incorporated goo blog App Web Application 1.0 is vulnerable to CLRF injection.
- CVE-2021-44581An SQL Injection vulnerabilty exists in Kreado Kreasfero 1.5 via the id parameter.
- CVE-2021-45865A File Upload vulnerability exists in Sourcecodester Student Attendance Manageent System 1.0 via the file upload functionality.
- CVE-2021-45866A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Student Attendance Management System 1.0 via the couse filed in i
- CVE-2022-26269Suzuki Connect v1.0.15 allows attackers to tamper with displayed messages via spoofed CAN messages.
- CVE-2022-0331An information disclosure vulnerability in Webadmin allows an unauthenticated remote attacker to read the device serial number in Sophos FirSophos Firewall
- CVE-2022-1050A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device.QEMU
- CVE-2022-22934An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1.SaltStack Salt · salt
- CVE-2022-22935An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1.SaltStack Salt · salt
- CVE-2022-25521NUUO v03.11.00 was discovered to contain access control issue.