CVEs published March 30, 2022
130 CVEs were published on March 30, 2022: 2 critical, 11 high.
- Published
- 130
- Critical
- 2
- High
- 11
- Medium
- 7
- Low
- 3
- Unrated
- 107
- Now in CISA KEV
- 0
- Fix available
- 22
Most affected products
- Android
- 55
- Joomla! Project Joomla! CMS
- 5
- openemr/openemr
- 5
- Bosch CPP Firmware
- 2
- Joomla! Project Joomla! CMS · Joomla! Project joomla/fil… +1
- 2
- Profelis IT Consultancy SambaBox
- 2
- vim/vim
- 2
- Wyze Cam Pan · Wyze Cam
- 2
- Apache Software Foundation Apache DolphinScheduler · org… +1
- 1
- com.wutka:jox
- 1
Critical 2
High 11
- CVE-2019-9564Authentication bypass in Wyze Cam Pan v2, Cam v2 and Cam v3Wyze Cam Pan · Wyze Cam
- CVE-2019-12266Stack buffer overflow in Wyze Cam Pan v2, Cam v2 and Cam v3Wyze Cam Pan · Wyze Cam
- CVE-2021-45031Weak Authentication in Login Function of USC+Mepsan USC+
- CVE-2022-22772TIBCO Managed File Transfer Platform Server Remote Code Execution VulnerabilityTIBCO Software TIBCO Managed File Transfer Platform Server…
- CVE-2022-22996SanDisk Professional G-RAID 4/8 Software Utility, Privilege EscalationSanDisk Professional G-RAID 4/8 Software Utility
- CVE-2022-1155Old sessions are not blocked by the login enable function. in snipe/snipe-itsnipe/snipe-it
- CVE-2022-1181Stored Cross Site Scripting in openemr/openemropenemr/openemr
- CVE-2022-1178Stored Cross Site Scripting in openemr/openemropenemr/openemr
- CVE-2022-1154Use after free in utf_ptr2char in vim/vimvim/vim
- CVE-2022-1160heap buffer overflow in get_one_sourceline in vim/vimvim/vim
- CVE-2022-24763Infinite Loop in PJSIPpjsip pjproject
Medium, low and unrated 117
- CVE-2021-43663totolink EX300_v2 V4.0.3c.140_B20210429 was discovered to contain a command injection vulnerability via the component cloudupdate_check.
- CVE-2021-43662totolink EX300_v2, ver V4.0.3c.140_B20210429 and A720R ,ver V4.1.5cu.470_B20200911 have an issue which causes uncontrolled resource consumpt
- CVE-2021-43661totolink EX300_v2 V4.0.3c.140_B20210429 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /ho
- CVE-2021-43664totolink EX300_v2 V4.0.3c.140_B20210429 was discovered to contain a command injection vulnerability via the component process forceugpo
- CVE-2022-26644Online Banking System Protect v1.0 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities via parameters on user prof
- CVE-2022-26646Online Banking System Protect v1.0 was discovered to contain a local file inclusion (LFI) vulnerability via the pages parameter.
- CVE-2021-46006In Totolink A3100R V5.9c.4577, "test.asp" contains an API-like function, which is not authenticated.
- CVE-2022-25008totolink EX300_v2 V4.0.3c.140_B20210429 and EX1200T V4.1.2cu.5230_B20210706 does not contain an authentication mechanism.
- CVE-2022-26645A remote code execution (RCE) vulnerability in Online Banking System Protect v1.0 allows attackers to execute arbitrary code via a crafted P
- CVE-2021-46008In totolink a3100r V5.9c.4577, the hard-coded telnet password can be discovered from official released firmware.
- CVE-2021-46009In Totolink A3100R V5.9c.4577, multiple pages can be read by curl or Burp Suite without authentication.
- CVE-2021-46007totolink a3100r V5.9c.4577 is vulnerable to os command injection.
- CVE-2021-46010Totolink A3100R V5.9c.4577 suffers from Use of Insufficiently Random Values via the web configuration.
- CVE-2021-33523MashZone NextGen through 10.7 GA allows a remote authenticated user, with access to the admin console, to upload a new JDBC driver that can
- CVE-2021-33208The "Register an Ehcache Configuration File" admin feature in MashZone NextGen through 10.7 GA allows XXE attacks via a malicious XML config
- CVE-2021-33581MashZone NextGen through 10.7 GA has an SSRF vulnerability that allows an attacker to interact with arbitrary TCP services, by abusing the f
- CVE-2021-38362In RSA Archer 6.x through 6.9 SP3 (6.9.3.0), an authenticated attacker can make a GET request to a REST API endpoint that is vulnerable to a
- CVE-2021-45900Vivoh Webinar Manager before 3.6.3.0 has improper API authentication.
- CVE-2021-43142An XML External Entity (XXE) vulnerability exists in wuta jox 1.16 in the readObject method in JOXSAXBeanInput.com.wutka:jox
- CVE-2021-40645An SQL Injection vulnerability exists in glorylion JFinalOA as of 9/7/2021 in the defkey parameter getHaveDoneTaskDataList method of the Flo
- CVE-2021-40644An SQL Injection vulnerability exists in oasys oa_system as of 9/7/2021 in resources/mappers/notice-mapper.xml.
- CVE-2022-24135QingScan 1.3.0 is affected by Cross Site Scripting (XSS) vulnerability in all search functions.
- CVE-2022-27772spring-boot versions prior to version v2.2.11.RELEASE was vulnerable to temporary directory hijacking.org.springframework.boot:spring-boot
- CVE-2022-24132phpshe V1.8 is affected by a denial of service (DoS) attack in the registry's verification code, which can paralyze the target service.
- CVE-2021-44312An issue was discovered in Firmware Analysis and Comparison Tool v3.2.
- CVE-2021-44310An issue was discovered in Firmware Analysis and Comparison Tool v3.2.
- CVE-2022-0998An integer overflow flaw was found in the Linux kernel’s virtio device driver code in the way a user triggers the vhost_vdpa_config_validateKernel
- CVE-2021-23851Buffer Overflow vulnerability in the recovery image web-based interfaceBosch CPP Firmware
- CVE-2021-23850Buffer Overflow vulnerability in the recovery image telnet serverBosch CPP Firmware
- CVE-2021-39754In ContextImpl, there is a possible way to determine whether an app is installed, without query permissions, due to side channel informationAndroid
- CVE-2022-20002In incfs, there is a possible way of mounting on arbitrary paths due to a missing permission check.Android
- CVE-2021-39791In WallpaperManagerService, there is a possible way to determine whether an app is installed, without query permissions, due to side channelAndroid
- CVE-2021-39790In Dialer, there is a possible way to manipulate visual voicemail settings due to a missing permission check.Android
- CVE-2021-39789In Telecom, there is a possible leak of TTY mode change due to a missing permission check.Android
- CVE-2021-39788In TelecomManager, there is a possible way to check if a particular self managed phone account was registered on the device due to side chanAndroid
- CVE-2021-39787In SystemUI, there is a possible arbitrary Activity launch due to a confused deputy.Android
- CVE-2021-39786In NFC, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2021-39784In CellBroadcastReceiver, there is a possible path to enable specific cellular features due to a missing permission check.Android
- CVE-2021-39783In rcsservice, there is a possible way to modify TTY mode due to a missing permission check.Android
- CVE-2021-39782In Telephony, there is a possible unauthorized modification of the PLMN SIM file due to a missing permission check.Android
- CVE-2021-39781In SmsController, there is a possible information disclosure due to a permissions bypass.Android
- CVE-2021-39780In Traceur, there is a possible bypass of developer settings requirements for capturing system traces due to a missing permission check.Android
- CVE-2021-39779In getCallStateUsingPackage of Telecom Service, there is a missing permission check.Android
- CVE-2021-39778In Telecomm, there is a possible way to determine whether an app is installed, without query permissions, due to improper input validation.Android
- CVE-2021-39777In Telephony, there is a possible way to determine whether an app is installed, without query permissions, due to a missing permission checkAndroid
- CVE-2021-39776In NFC, there is a possible memory corruption due to a use after free.Android
- CVE-2021-39775In People, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information discAndroid
- CVE-2021-39774In Bluetooth, there is a possible out of bounds read due to a missing bounds check.Android
- CVE-2021-39773In VpnManagerService, there is a possible disclosure of installed VPN packages due to side channel information disclosure.Android
- CVE-2021-39772In Bluetooth, there is a possible way to access the a2dp audio control switch due to a missing permission check.Android
- CVE-2021-39771In Settings, there is a possible way to misrepresent which app wants to add a wifi network due to improper input validation.Android
- CVE-2021-39770In Framework, there is a possible disclosure of the device owner package due to a missing permission check.Android
- CVE-2021-39769In Device Policy, there is a possible way to determine whether an app is installed, without query permissions, due to a missing permission cAndroid
- CVE-2021-39768In Settings, there is a possible way to add an auto-connect WiFi network without the user's consent due to a missing permission check.Android
- CVE-2021-39767In miniadb, there is a possible way to get read/write access to recovery system properties due to an insecure default value.Android
- CVE-2021-39766In Settings, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information diAndroid
- CVE-2021-39765In Gallery, there is a possible permission bypass due to a confused deputy.Android
- CVE-2021-39764In Settings, there is a possible way to display an incorrect app name due to improper input validation.Android
- CVE-2021-39763In Settings, there is a possible way to make the user enable WiFi due to improper input validation.Android
- CVE-2021-39762In tremolo, there is a possible out of bounds read due to an integer overflow.Android
- CVE-2021-39761In Media, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclAndroid
- CVE-2021-39760In AudioService, there is a possible way to determine whether an app is installed, without query permissions, due to side channel informatioAndroid
- CVE-2021-39759In libstagefright, there is a possible out of bounds write due to an integer overflow.Android
- CVE-2021-39758In WindowManager, there is a possible way to start a foreground activity from the background due to a missing permission check.Android
- CVE-2021-39757In PermissionController, there is a possible permission bypass due to an unsafe PendingIntent.Android
- CVE-2021-39756In Framework, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information dAndroid
- CVE-2021-39755In DevicePolicyManager, there is a possible way to reveal the existence of an installed package without proper query permissions due to sideAndroid
- CVE-2021-39753In DomainVerificationService, there is a possible way to access app domain verification information due to a missing permission check.Android
- CVE-2021-39752In Bubbles, there is a possible way to interfere with Bubbles due to a permissions bypass.Android
- CVE-2021-39751In Settings, there is a possible way to read Bluetooth device names without proper permissions due to a missing permission check.Android
- CVE-2021-39750In PackageManager, there is a possible way to change the splash screen theme of other apps due to a missing permission check.Android
- CVE-2021-39749In WindowManager, there is a possible way to start non-exported and protected activities due to a missing permission check.Android
- CVE-2021-39748In InputMethodEditor, there is a possible way to access some files accessible to Settings due to an unsafe PendingIntent.Android
- CVE-2021-39747In Settings Provider, there is a possible way to list values of non-readable global settings due to a permissions bypass.Android
- CVE-2021-39746In PermissionController, there is a possible way to delete some local files due to an unsafe PendingIntent.Android
- CVE-2021-39745In DevicePolicyManager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel infAndroid
- CVE-2021-39744In DevicePolicyManager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel infAndroid
- CVE-2021-39743In PackageManager, there is a possible way to update the last usage time of another package due to a missing permission check.Android
- CVE-2021-39742In Voicemail, there is a possible way to retrieve a trackable identifier due to a missing permission check.Android
- CVE-2021-39741In Keymaster, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2021-39740In Messaging, there is a possible way to bypass attachment restrictions due to improper input validation.Android
- CVE-2021-39739In ArrayMap, there is a possible leak of the content of SMS messages due to log information disclosure.Android
- CVE-2021-1033In createGeneralSlice of ConnectedDevicesSliceProvider.java.java, there is a possible permission bypass due to an unsafe PendingIntent.Android
- CVE-2021-1000In createBluetoothDeviceSlice of ConnectedDevicesSliceProvider.java, there is a possible permission bypass due to an unsafe PendingIntent.Android
- CVE-2022-23136There is a stored XSS vulnerability in ZTE home gateway product.ZXHN F680
- CVE-2021-3456An improper authorization handling flaw was found in Foreman.smart_proxy_salt
- CVE-2022-27907Sonatype Nexus Repository Manager 3.x before 3.38.0 allows SSRF.
- CVE-2022-23801[20220309] - Core - XSS attack vector through SVGJoomla! Project Joomla! CMS
- CVE-2022-23800[20220308] - Core - Inadequate content filtering within the filter codeJoomla! Project Joomla! CMS · Joomla! Project joomla/fil… +1
- CVE-2022-23799[20220307] - Core - Variable Tampering on JInput $_REQUEST dataJoomla! Project Joomla! CMS · Joomla! Project joomla/inp… +1
- CVE-2022-23798[20220306] - Core - Inadequate validation of internal URLsJoomla! Project Joomla! CMS
- CVE-2022-23797[20220305] - Core - Inadequate filtering on the selected IdsJoomla! Project Joomla! CMS
- CVE-2022-23796[20220304] - Core - Missing input validation within com_fields class inputsJoomla! Project Joomla! CMS
- CVE-2022-23795[20220303] - Core - User row are not bound to a authentication mechanismJoomla! Project Joomla! CMS
- CVE-2022-23794[20220302] - Core - Path Disclosure within filesystem error messagesJoomla! Project Joomla! CMS · Joomla! Project joomla/fil… +1
- CVE-2022-23793[20220301] - Core - Zip Slip within the Tar extractorJoomla! Project Joomla! CMS · Joomla! Project joomla/arc… +1
- CVE-2022-25619Authenticated Command Injection to RCEProfelis IT Consultancy SambaBox
- CVE-2022-25620Stored Cross-Site Scripting (XSS)Profelis IT Consultancy SambaBox
- CVE-2022-24131DouPHP v1.6 Release 20220121 is affected by Cross Site Scripting (XSS) through /admin/login.php in the background, which will lead to JavaSc
- CVE-2022-1179Non-Privilege User Can Created New Rule and Lead to Stored Cross Site Scripting in openemr/openemropenemr/openemr
- CVE-2022-1180Reflected Cross Site Scripting in openemr/openemropenemr/openemr
- CVE-2022-1177Accounting User Can Download Patient Reports in openemr in openemr/openemropenemr/openemr
- CVE-2022-23869In RuoYi v4.7.2 through the WebUI, user test1 does not have permission to reset the password of user test3, but the password of user test3 c
- CVE-2022-23868RuoYi v4.7.2 contains a CSV injection vulnerability through ruoyi-admin when a victim opens .xlsx log file.
- CVE-2022-1172Null Pointer Dereference Caused Segmentation Fault in gpac/gpacgpac/gpac
- CVE-2022-25598Apache DolphinScheduler user registration is vulnerable to ReDoS attacksApache Software Foundation Apache DolphinScheduler · org… +1
- CVE-2022-1163Cross-site Scripting (XSS) - Stored in mineweb/minewebcmsmineweb/minewebcms
- CVE-2022-27816SWHKD 1.1.5 unsafely uses the /tmp/swhks.pid pathname.Simple-Wayland-HotKey-Daemon
- CVE-2022-24693Baicells Nova436Q and Neutrino 430 devices with firmware through QRTB 2.7.8 have hardcoded credentials that are easily discovered, and can b
- CVE-2020-24769SQL injection vulnerability in takeconfirm.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the classes par
- CVE-2020-24770SQL injection vulnerability in modrules.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the id parameter.
- CVE-2020-24771Incorrect access control in NexusPHP 1.5.beta5.20120707 allows unauthorized attackers to access published content.
- CVE-2020-35501A flaw was found in the Linux kernels implementation of audit rules, where a syscall can unexpectedly not be correctly not be logged by the kernel
- CVE-2022-28202An XSS issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2.
- CVE-2022-28205An issue was discovered in MediaWiki through 1.37.1.
- CVE-2022-28206An issue was discovered in MediaWiki through 1.37.1.
- CVE-2022-28209An issue was discovered in Mediawiki through 1.37.1.