# CVEs published 2022-03-29

105 CVEs were published on March 29, 2022: 17 critical, 13 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2021-41594](https://cve.now/CVE-2021-41594.md): In RSA Archer 6.9.SP1 P3, if some application functions are precluded by the Administrator, this can be bypassed by intercepting the API req (no CVSS)
- [CVE-2022-26951](https://cve.now/CVE-2022-26951.md): Archer 6.x through 6.10 (6.10.0.0) contains a reflected XSS vulnerability. (CVSS 6.5)
- [CVE-2022-26950](https://cve.now/CVE-2022-26950.md): Archer 6.x through 6.9 P2 (6.9.0.2) is affected by an open redirect vulnerability. (CVSS 5.4)
- [CVE-2022-26949](https://cve.now/CVE-2022-26949.md): Archer 6.x through 6.9 SP2 P1 (6.9.2.1) contains an improper access control vulnerability on attachments. (CVSS 5.3)
- [CVE-2022-26948](https://cve.now/CVE-2022-26948.md): The Archer RSS feed integration for Archer 6.x through 6.9 SP1 (6.9.1.0) is affected by an insecure credential storage vulnerability. (CVSS 5.8)
- [CVE-2022-26947](https://cve.now/CVE-2022-26947.md): Archer 6.x through 6.9 SP3 (6.9.3.0) contains a reflected XSS vulnerability. (CVSS 6.3)
- [CVE-2022-27432](https://cve.now/CVE-2022-27432.md): A Cross-Site Request Forgery (CSRF) in Pluck CMS v4.7.15 allows attackers to change the password of any given user by exploiting this featur (no CVSS)
- [CVE-2022-27815](https://cve.now/CVE-2022-27815.md): SWHKD 1.1.5 unsafely uses the /tmp/swhkd.pid pathname. (no CVSS, Simple-Wayland-HotKey-Daemon)
- [CVE-2015-3298](https://cve.now/CVE-2015-3298.md): Yubico ykneo-openpgp before 1.0.10 has a typo in which an invalid PIN can be used. (no CVSS)
- [CVE-2022-26244](https://cve.now/CVE-2022-26244.md): A stored cross-site scripting (XSS) vulnerability in Hospital Patient Record Management System v1.0 allows attackers to execute arbitrary we (no CVSS)
- [CVE-2021-44082](https://cve.now/CVE-2021-44082.md): textpattern 4.8.7 is vulnerable to Cross Site Scripting (XSS) via /textpattern/index.php,Body. (no CVSS)
- [CVE-2022-26871](https://cve.now/CVE-2022-26871.md): An arbitrary file upload vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to upload an arbitrary fil (CVSS 9.8, KEV, Trend Micro Apex Central)
- [CVE-2022-21821](https://cve.now/CVE-2022-21821.md): NVIDIA CUDA Toolkit SDK contains an integer overflow vulnerability in cuobjdump.To exploit this vulnerability, a remote attacker would requi (CVSS 7.8, NVIDIA CUDA Toolkit)
- [CVE-2021-43118](https://cve.now/CVE-2021-43118.md): A Remote Command Injection vulnerability exists in DrayTek Vigor 2960 1.5.1.3, DrayTek Vigor 3900 1.5.1.3, and DrayTek Vigor 300B 1.5.1.3 vi (no CVSS)
- [CVE-2021-42911](https://cve.now/CVE-2021-42911.md): A Format String vulnerability exists in DrayTek Vigor 2960 \<= 1.5.1.3, DrayTek Vigor 3900 \<= 1.5.1.3, and DrayTek Vigor 300B \<= 1.5.1.3 in t (no CVSS)
- [CVE-2021-43110](https://cve.now/CVE-2021-43110.md): An Access Conrol vulnerability exists in PuneethReddyHC online-shopping-system as of 11/01/2021 in add\_products. (no CVSS)
- [CVE-2021-43109](https://cve.now/CVE-2021-43109.md): An SQL Injection vulnerability exits in PuneethReddyHC online-shopping-system as of 11/01/2021 via the p parameter in product.php. (no CVSS)
- [CVE-2022-1122](https://cve.now/CVE-2022-1122.md): A flaw was found in the opj2\_decompress program in openjpeg2 2.4.0 in the way it handles an input directory with a large number of files. (no CVSS, openjpeg2)
- [CVE-2022-22948](https://cve.now/CVE-2022-22948.md): The vCenter Server contains an information disclosure vulnerability due to improper permission of files. (CVSS 6.5, KEV, VMware vCenter Server and VMware Cloud Foundation)
- [CVE-2021-42970](https://cve.now/CVE-2021-42970.md): Cross Site Scripting (XSS) vulnerability exists in cxuucms v3 via the imgurl of /feedback/post/ content parameter. (no CVSS)
- [CVE-2022-27175](https://cve.now/CVE-2022-27175.md): Delta Electronics DIAEnergie SQL Injection in GetCalcTagList (CVSS 9.8, Delta Electronics DIAEnergie)
- [CVE-2022-26839](https://cve.now/CVE-2022-26839.md): Delta Electronics DIAEnergie Incorrect Default Permissions (CVSS 7.8, Delta Electronics DIAEnergie)
- [CVE-2022-26667](https://cve.now/CVE-2022-26667.md): Delta Electronics DIAEnergie SQL Injection in GetDemandAnalysisData (CVSS 9.8, Delta Electronics DIAEnergie)
- [CVE-2022-26338](https://cve.now/CVE-2022-26338.md): Delta Electronics DIAEnergie SQL Injection in DIAE\_hierarchyHandler.ashx (CVSS 9.8, Delta Electronics DIAEnergie)
- [CVE-2022-26514](https://cve.now/CVE-2022-26514.md): Delta Electronics DIAEnergie SQL Injection in DIAE\_tagHandler.ashx (CVSS 9.8, Delta Electronics DIAEnergie)
- [CVE-2022-26666](https://cve.now/CVE-2022-26666.md): Delta Electronics DIAEnergie SQL Injection in HandlerDialogECC.ashx (CVSS 9.8, Delta Electronics DIAEnergie)
- [CVE-2022-26887](https://cve.now/CVE-2022-26887.md): Delta Electronics DIAEnergie SQL Injection in DIAE\_HandlerTag\_KID.ashx (CVSS 9.8, Delta Electronics DIAEnergie)
- [CVE-2022-26836](https://cve.now/CVE-2022-26836.md): Delta Electronics DIAEnergie SQL Injection in HandlerExport.ashx/Calendar.ashx (CVSS 9.8, Delta Electronics DIAEnergie)
- [CVE-2022-26349](https://cve.now/CVE-2022-26349.md): Delta Electronics DIAEnergie SQL Injection in DIAE\_eccoefficientHandler.ashx (CVSS 9.8, Delta Electronics DIAEnergie)
- [CVE-2022-26065](https://cve.now/CVE-2022-26065.md): Delta Electronics DIAEnergie SQL Injection in GetLatestDemandNode and GetDemandAnalysisData (CVSS 9.8, Delta Electronics DIAEnergie)
- [CVE-2022-26013](https://cve.now/CVE-2022-26013.md): Delta Electronics DIAEnergie SQL Injection in DIAE\_dmdsetHandler.ashx (CVSS 9.8, Delta Electronics DIAEnergie)
- [CVE-2022-25880](https://cve.now/CVE-2022-25880.md): Delta Electronics DIAEnergie SQL Injection in DIAE\_hierarchyHandler.ashx (CVSS 9.8, Delta Electronics DIAEnergie)
- [CVE-2022-0923](https://cve.now/CVE-2022-0923.md): Delta Electronics DIAEnergie SQL Injection in HandlerDialog\_KID.ashx (CVSS 9.8, Delta Electronics DIAEnergie)
- [CVE-2022-26069](https://cve.now/CVE-2022-26069.md): Delta Electronics DIAEnergie SQL Injection in HandlerPage\_KID.ashx (CVSS 9.8, Delta Electronics DIAEnergie)
- [CVE-2022-25347](https://cve.now/CVE-2022-25347.md): Delta Electronics DIAEnergie Path Traversal (CVSS 9.8, Delta Electronics DIAEnergie)
- [CVE-2022-25980](https://cve.now/CVE-2022-25980.md): Delta Electronics DIAEnergie SQL Injection in HandlerCommon.ashx (CVSS 9.8, Delta Electronics DIAEnergie)
- [CVE-2022-26059](https://cve.now/CVE-2022-26059.md): Delta Electronics DIAEnergie SQL Injection in GetQueryData (CVSS 9.8, Delta Electronics DIAEnergie)
- [CVE-2021-44081](https://cve.now/CVE-2021-44081.md): A buffer overflow vulnerability exists in the AMF of open5gs 2.1.4. (no CVSS)
- [CVE-2021-43701](https://cve.now/CVE-2021-43701.md): CSZ CMS 1.2.9 has a Time and Boolean-based Blind SQL Injection vulnerability in the endpoint /admin/export/getcsv/article\_db, via the fieldS (no CVSS)
- [CVE-2022-0343](https://cve.now/CVE-2022-0343.md): Local Priviledge escalation in Perfetto Dev scripts (CVSS 3.3, Google Perfetto Dev Scripts)
- [CVE-2021-22572](https://cve.now/CVE-2021-22572.md): Data-transfer-project information disclosure via tmp directory (CVSS 5.5, Google Data-Transfer-Project)
- [CVE-2022-1055](https://cve.now/CVE-2022-1055.md): Use after Free in tc\_new\_tfilter allowing for privilege escalation in Linux Kernel (CVSS 8.6, Linux Kernel)
- [CVE-2022-28160](https://cve.now/CVE-2022-28160.md): Jenkins Tests Selector Plugin 1.3.3 and earlier allows users with Item/Configure permission to read arbitrary files on the Jenkins controlle (no CVSS, Jenkins project Jenkins Tests Selector Plugin · org.jenkins…)
- [CVE-2022-28159](https://cve.now/CVE-2022-28159.md): Jenkins Tests Selector Plugin 1.3.3 and earlier does not escape the Properties File Path option for Choosing Tests parameters, resulting in (no CVSS, Jenkins project Jenkins Tests Selector Plugin · org.jenkins…)
- [CVE-2022-28158](https://cve.now/CVE-2022-28158.md): A missing permission check in Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier allows attackers with Overall/Read permission to enu (no CVSS, Jenkins project Jenkins Pipeline: Phoenix AutoTest Plugin ·…)
- [CVE-2022-28157](https://cve.now/CVE-2022-28157.md): Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier allows attackers with Item/Configure permission to upload arbitrary files from the (no CVSS, Jenkins project Jenkins Pipeline: Phoenix AutoTest Plugin ·…)
- [CVE-2022-28156](https://cve.now/CVE-2022-28156.md): Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier allows attackers with Item/Configure permission to copy arbitrary files and direct (no CVSS, Jenkins project Jenkins Pipeline: Phoenix AutoTest Plugin ·…)
- [CVE-2022-28155](https://cve.now/CVE-2022-28155.md): Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. (no CVSS, Jenkins project Jenkins Pipeline: Phoenix AutoTest Plugin ·…)
- [CVE-2022-28154](https://cve.now/CVE-2022-28154.md): Jenkins Coverage/Complexity Scatter Plot Plugin 1.1.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) att (no CVSS, Jenkins project Jenkins Coverage/Complexity Scatter Plot Pl…)
- [CVE-2022-28153](https://cve.now/CVE-2022-28153.md): Jenkins SiteMonitor Plugin 0.6 and earlier does not escape URLs of sites to monitor in tooltips, resulting in a stored cross-site scripting (no CVSS, Jenkins project Jenkins SiteMonitor Plugin · org.jvnet.huds…)
- [CVE-2022-28152](https://cve.now/CVE-2022-28152.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Job and Node ownership Plugin 0.13.0 and earlier allows attackers to restore th (no CVSS, Jenkins project Jenkins Job and Node ownership Plugin · com…)
- [CVE-2022-28151](https://cve.now/CVE-2022-28151.md): A missing permission check in Jenkins Job and Node ownership Plugin 0.13.0 and earlier allows attackers with Item/Read permission to change (no CVSS, Jenkins project Jenkins Job and Node ownership Plugin · com…)
- [CVE-2022-28150](https://cve.now/CVE-2022-28150.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Job and Node ownership Plugin 0.13.0 and earlier allows attackers to change the (no CVSS, Jenkins project Jenkins Job and Node ownership Plugin · com…)
- [CVE-2022-28149](https://cve.now/CVE-2022-28149.md): Jenkins Job and Node ownership Plugin 0.13.0 and earlier does not escape the names of the secondary owners, resulting in a stored cross-site (no CVSS, Jenkins project Jenkins Job and Node ownership Plugin · com…)
- [CVE-2022-28148](https://cve.now/CVE-2022-28148.md): The file browser in Jenkins Continuous Integration with Toad Edge Plugin 2.3 and earlier may interpret some paths to files as absolute on Wi (no CVSS, Jenkins project Jenkins Continuous Integration with Toad Ed…)
- [CVE-2022-28147](https://cve.now/CVE-2022-28147.md): A missing permission check in Jenkins Continuous Integration with Toad Edge Plugin 2.3 and earlier allows attackers with Overall/Read permis (no CVSS, Jenkins project Jenkins Continuous Integration with Toad Ed…)
- [CVE-2022-28146](https://cve.now/CVE-2022-28146.md): Jenkins Continuous Integration with Toad Edge Plugin 2.3 and earlier allows attackers with Item/Configure permission to read arbitrary files (no CVSS, Jenkins project Jenkins Continuous Integration with Toad Ed…)
- [CVE-2022-28145](https://cve.now/CVE-2022-28145.md): Jenkins Continuous Integration with Toad Edge Plugin 2.3 and earlier does not apply Content-Security-Policy headers to report files it serve (no CVSS, Jenkins project Jenkins Continuous Integration with Toad Ed…)
- [CVE-2022-28144](https://cve.now/CVE-2022-28144.md): Jenkins Proxmox Plugin 0.7.0 and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read (no CVSS, Jenkins project Jenkins Proxmox Plugin · org.jenkins-ci.plu…)
- [CVE-2022-28143](https://cve.now/CVE-2022-28143.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Proxmox Plugin 0.7.0 and earlier allows attackers to connect to an attacker-spe (no CVSS, Jenkins project Jenkins Proxmox Plugin · org.jenkins-ci.plu…)
- [CVE-2022-28142](https://cve.now/CVE-2022-28142.md): Jenkins Proxmox Plugin 0.6.0 and earlier disables SSL/TLS certificate validation globally for the Jenkins controller JVM when configured to (no CVSS, Jenkins project Jenkins Proxmox Plugin · org.jenkins-ci.plu…)
- [CVE-2022-28141](https://cve.now/CVE-2022-28141.md): Jenkins Proxmox Plugin 0.5.0 and earlier stores the Proxmox Datacenter password unencrypted in the global config.xml file on the Jenkins con (no CVSS, Jenkins project Jenkins Proxmox Plugin · org.jenkins-ci.plu…)
- [CVE-2022-28140](https://cve.now/CVE-2022-28140.md): Jenkins Flaky Test Handler Plugin 1.2.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. (no CVSS, Jenkins project Jenkins Flaky Test Handler Plugin · org.jen…)
- [CVE-2022-28139](https://cve.now/CVE-2022-28139.md): A missing permission check in Jenkins RocketChat Notifier Plugin 1.4.10 and earlier allows attackers with Overall/Read permission to connect (no CVSS, Jenkins project Jenkins RocketChat Notifier Plugin · org.je…)
- [CVE-2022-28138](https://cve.now/CVE-2022-28138.md): A cross-site request forgery (CSRF) vulnerability in Jenkins RocketChat Notifier Plugin 1.4.10 and earlier allows attackers to connect to an (no CVSS, Jenkins project Jenkins RocketChat Notifier Plugin · org.je…)
- [CVE-2022-28137](https://cve.now/CVE-2022-28137.md): A missing permission check in Jenkins JiraTestResultReporter Plugin 165.v817928553942 and earlier allows attackers with Overall/Read permiss (no CVSS, Jenkins project Jenkins JiraTestResultReporter Plugin · org…)
- [CVE-2022-28136](https://cve.now/CVE-2022-28136.md): A cross-site request forgery (CSRF) vulnerability in Jenkins JiraTestResultReporter Plugin 165.v817928553942 and earlier allows attackers to (CVSS 8.8, Jenkins project Jenkins JiraTestResultReporter Plugin · org…)
- [CVE-2022-28135](https://cve.now/CVE-2022-28135.md): Jenkins instant-messaging Plugin 1.41 and earlier stores passwords for group chats unencrypted in the global configuration file of plugins b (no CVSS, Jenkins project Jenkins instant-messaging Plugin · org.jvne…)
- [CVE-2022-28134](https://cve.now/CVE-2022-28134.md): Jenkins Bitbucket Server Integration Plugin 3.1.0 and earlier does not perform permission checks in several HTTP endpoints, allowing attacke (no CVSS, Jenkins project Jenkins Bitbucket Server Integration Plugin…)
- [CVE-2022-28133](https://cve.now/CVE-2022-28133.md): Jenkins Bitbucket Server Integration Plugin 3.1.0 and earlier does not limit URL schemes for callback URLs on OAuth consumers, resulting in (no CVSS, Jenkins project Jenkins Bitbucket Server Integration Plugin…)
- [CVE-2022-23903](https://cve.now/CVE-2022-23903.md): A Cross Site Scripting (XSS) vulnerability exists in pearadmin pear-admin-think \<=5.0.6, which allows a login account to access arbitrary fu (no CVSS)
- [CVE-2022-23901](https://cve.now/CVE-2022-23901.md): A stack overflow re2c 2.2 exists due to infinite recursion issues in src/dfa/dead\_rules.cc. (no CVSS)
- [CVE-2022-23059](https://cve.now/CVE-2022-23059.md): Shopizer - Stored XSS in Manage Images (CVSS 4.8, shopizer-ecommerce Shopizer · com.shopizer:shopizer)
- [CVE-2022-1032](https://cve.now/CVE-2022-1032.md): Insecure deserialization of not validated module file in crater-invoice/crater (CVSS 7.2, crater-invoice/crater)
- [CVE-2021-46743](https://cve.now/CVE-2021-46743.md): In Firebase PHP-JWT before 6.0.0, an algorithm-confusion issue (e.g., RS256 / HS256) exists via the kid (aka Key ID) header, when multiple t (no CVSS, firebase/php-jwt)
- [CVE-2022-1087](https://cve.now/CVE-2022-1087.md): htmly Edit Profile Module cross site scripting (CVSS 3.5, htmly)
- [CVE-2022-1086](https://cve.now/CVE-2022-1086.md): DolphinPHP User Management Page cross site scripting (CVSS 3.5, DolphinPHP)
- [CVE-2022-1085](https://cve.now/CVE-2022-1085.md): CLTPHP POST Parameter cross site scripting (CVSS 3.5, CLTPHP)
- [CVE-2022-1084](https://cve.now/CVE-2022-1084.md): SourceCodester One Church Management System Session userregister.php improper authentication (CVSS 7.3, SourceCodester One Church Management System)
- [CVE-2022-1083](https://cve.now/CVE-2022-1083.md): Microfinance Management System sql injection (CVSS 7.3, Microfinance Management System)
- [CVE-2022-1082](https://cve.now/CVE-2022-1082.md): SourceCodester Microfinance Management System Login Page login.php sql injection (CVSS 7.3, SourceCodester Microfinance Management System)
- [CVE-2022-1081](https://cve.now/CVE-2022-1081.md): SourceCodester Microfinance Management System addcustomerHandler.php cross site scripting (CVSS 4.3, SourceCodester Microfinance Management System)
- [CVE-2022-1080](https://cve.now/CVE-2022-1080.md): SourceCodester One Church Management System attendancy.php sql injection (CVSS 7.3, SourceCodester One Church Management System)
- [CVE-2022-1079](https://cve.now/CVE-2022-1079.md): SourceCodester One Church Management System churchprofile.php cross site scripting (CVSS 4.3, SourceCodester One Church Management System)
- [CVE-2022-1078](https://cve.now/CVE-2022-1078.md): SourceCodester College Website Management System sql injection (CVSS 7.3, SourceCodester College Website Management System)
- [CVE-2022-1077](https://cve.now/CVE-2022-1077.md): TEM FLEX-1080/FLEX-1085 Log information disclosure (CVSS 5.3, TEM FLEX-1080 · TEM FLEX-1085)
- [CVE-2022-1076](https://cve.now/CVE-2022-1076.md): Automatic Question Paper Generator System My Account Page login.php cross site scripting (CVSS 4.3, Automatic Question Paper Generator System)
- [CVE-2022-1075](https://cve.now/CVE-2022-1075.md): College Website Management System Contact cross site scripting (CVSS 3.5, College Website Management System)
- [CVE-2022-1074](https://cve.now/CVE-2022-1074.md): TEM FLEX-1085 injection (CVSS 4.3, TEM FLEX-1085)
- [CVE-2022-1073](https://cve.now/CVE-2022-1073.md): Automatic Question Paper Generator password recovery (CVSS 7.3, Automatic Question Paper Generator)
- [CVE-2022-23937](https://cve.now/CVE-2022-23937.md): In Wind River VxWorks 6.9 and 7, a specific crafted packet may lead to an out-of-bounds read during an IKE initial exchange scenario. (CVSS 5.3)
- [CVE-2022-24957](https://cve.now/CVE-2022-24957.md): DHC Vision eQMS through 5.4.8.322 has Persistent XSS due to insufficient encoding of untrusted input/output. (no CVSS)
- [CVE-2022-24956](https://cve.now/CVE-2022-24956.md): An issue was discovered in Shopware B2B-Suite through 4.4.1. (no CVSS)
- [CVE-2022-25420](https://cve.now/CVE-2022-25420.md): NTT Resonant Incorporated goo blog App Web Application 1.0 is vulnerable to CLRF injection. (no CVSS)
- [CVE-2021-44581](https://cve.now/CVE-2021-44581.md): An SQL Injection vulnerabilty exists in Kreado Kreasfero 1.5 via the id parameter. (no CVSS)
- [CVE-2021-45865](https://cve.now/CVE-2021-45865.md): A File Upload vulnerability exists in Sourcecodester Student Attendance Manageent System 1.0 via the file upload functionality. (no CVSS)
- [CVE-2021-45866](https://cve.now/CVE-2021-45866.md): A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Student Attendance Management System 1.0 via the couse filed in i (no CVSS)
- [CVE-2022-26269](https://cve.now/CVE-2022-26269.md): Suzuki Connect v1.0.15 allows attackers to tamper with displayed messages via spoofed CAN messages. (no CVSS)
- [CVE-2022-0331](https://cve.now/CVE-2022-0331.md): An information disclosure vulnerability in Webadmin allows an unauthenticated remote attacker to read the device serial number in Sophos Fir (CVSS 5.3, Sophos Firewall)
- [CVE-2022-1050](https://cve.now/CVE-2022-1050.md): A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. (no CVSS, QEMU)
- [CVE-2022-22934](https://cve.now/CVE-2022-22934.md): An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. (no CVSS, SaltStack Salt · salt)
- [CVE-2022-22935](https://cve.now/CVE-2022-22935.md): An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. (CVSS 3.7, SaltStack Salt · salt)
- [CVE-2022-22936](https://cve.now/CVE-2022-22936.md): An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. (CVSS 8.8, SaltStack Salt · salt)
- [CVE-2022-22941](https://cve.now/CVE-2022-22941.md): An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. (CVSS 8.8, SaltStack Salt · salt)
- [CVE-2022-25521](https://cve.now/CVE-2022-25521.md): NUUO v03.11.00 was discovered to contain access control issue. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-03-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.