# CVEs published 2022-03-30

130 CVEs were published on March 30, 2022: 2 critical, 11 high. Days are UTC.

- [CVE-2021-43663](https://cve.now/CVE-2021-43663.md): totolink EX300\_v2 V4.0.3c.140\_B20210429 was discovered to contain a command injection vulnerability via the component cloudupdate\_check. (no CVSS)
- [CVE-2021-43662](https://cve.now/CVE-2021-43662.md): totolink EX300\_v2, ver V4.0.3c.140\_B20210429 and A720R ,ver V4.1.5cu.470\_B20200911 have an issue which causes uncontrolled resource consumpt (no CVSS)
- [CVE-2021-43661](https://cve.now/CVE-2021-43661.md): totolink EX300\_v2 V4.0.3c.140\_B20210429 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /ho (no CVSS)
- [CVE-2021-43664](https://cve.now/CVE-2021-43664.md): totolink EX300\_v2 V4.0.3c.140\_B20210429 was discovered to contain a command injection vulnerability via the component process forceugpo (no CVSS)
- [CVE-2022-26644](https://cve.now/CVE-2022-26644.md): Online Banking System Protect v1.0 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities via parameters on user prof (no CVSS)
- [CVE-2022-26646](https://cve.now/CVE-2022-26646.md): Online Banking System Protect v1.0 was discovered to contain a local file inclusion (LFI) vulnerability via the pages parameter. (no CVSS)
- [CVE-2021-46006](https://cve.now/CVE-2021-46006.md): In Totolink A3100R V5.9c.4577, "test.asp" contains an API-like function, which is not authenticated. (no CVSS)
- [CVE-2022-25008](https://cve.now/CVE-2022-25008.md): totolink EX300\_v2 V4.0.3c.140\_B20210429 and EX1200T V4.1.2cu.5230\_B20210706 does not contain an authentication mechanism. (no CVSS)
- [CVE-2022-26645](https://cve.now/CVE-2022-26645.md): A remote code execution (RCE) vulnerability in Online Banking System Protect v1.0 allows attackers to execute arbitrary code via a crafted P (no CVSS)
- [CVE-2021-46008](https://cve.now/CVE-2021-46008.md): In totolink a3100r V5.9c.4577, the hard-coded telnet password can be discovered from official released firmware. (no CVSS)
- [CVE-2021-46009](https://cve.now/CVE-2021-46009.md): In Totolink A3100R V5.9c.4577, multiple pages can be read by curl or Burp Suite without authentication. (no CVSS)
- [CVE-2021-46007](https://cve.now/CVE-2021-46007.md): totolink a3100r V5.9c.4577 is vulnerable to os command injection. (no CVSS)
- [CVE-2021-46010](https://cve.now/CVE-2021-46010.md): Totolink A3100R V5.9c.4577 suffers from Use of Insufficiently Random Values via the web configuration. (no CVSS)
- [CVE-2021-33523](https://cve.now/CVE-2021-33523.md): MashZone NextGen through 10.7 GA allows a remote authenticated user, with access to the admin console, to upload a new JDBC driver that can (no CVSS)
- [CVE-2021-33208](https://cve.now/CVE-2021-33208.md): The "Register an Ehcache Configuration File" admin feature in MashZone NextGen through 10.7 GA allows XXE attacks via a malicious XML config (no CVSS)
- [CVE-2022-24790](https://cve.now/CVE-2022-24790.md): HTTP Request Smuggling in puma (CVSS 9.1, puma)
- [CVE-2021-33581](https://cve.now/CVE-2021-33581.md): MashZone NextGen through 10.7 GA has an SSRF vulnerability that allows an attacker to interact with arbitrary TCP services, by abusing the f (no CVSS)
- [CVE-2021-38362](https://cve.now/CVE-2021-38362.md): In RSA Archer 6.x through 6.9 SP3 (6.9.3.0), an authenticated attacker can make a GET request to a REST API endpoint that is vulnerable to a (no CVSS)
- [CVE-2021-45900](https://cve.now/CVE-2021-45900.md): Vivoh Webinar Manager before 3.6.3.0 has improper API authentication. (no CVSS)
- [CVE-2021-43142](https://cve.now/CVE-2021-43142.md): An XML External Entity (XXE) vulnerability exists in wuta jox 1.16 in the readObject method in JOXSAXBeanInput. (no CVSS, com.wutka:jox)
- [CVE-2021-40645](https://cve.now/CVE-2021-40645.md): An SQL Injection vulnerability exists in glorylion JFinalOA as of 9/7/2021 in the defkey parameter getHaveDoneTaskDataList method of the Flo (no CVSS)
- [CVE-2021-40644](https://cve.now/CVE-2021-40644.md): An SQL Injection vulnerability exists in oasys oa\_system as of 9/7/2021 in resources/mappers/notice-mapper.xml. (no CVSS)
- [CVE-2019-9564](https://cve.now/CVE-2019-9564.md): Authentication bypass in Wyze Cam Pan v2, Cam v2 and Cam v3 (CVSS 7.5, Wyze Cam Pan · Wyze Cam)
- [CVE-2019-12266](https://cve.now/CVE-2019-12266.md): Stack buffer overflow in Wyze Cam Pan v2, Cam v2 and Cam v3 (CVSS 7.6, Wyze Cam Pan · Wyze Cam)
- [CVE-2021-45031](https://cve.now/CVE-2021-45031.md): Weak Authentication in Login Function of USC+ (CVSS 7.7, Mepsan USC+)
- [CVE-2022-24135](https://cve.now/CVE-2022-24135.md): QingScan 1.3.0 is affected by Cross Site Scripting (XSS) vulnerability in all search functions. (no CVSS)
- [CVE-2022-28223](https://cve.now/CVE-2022-28223.md): Tekon KIO devices through 2022-03-30 allow an authenticated admin user to escalate privileges to root by uploading a malicious Lua plugin. (CVSS 9.1)
- [CVE-2022-27772](https://cve.now/CVE-2022-27772.md): spring-boot versions prior to version v2.2.11.RELEASE was vulnerable to temporary directory hijacking. (no CVSS, org.springframework.boot:spring-boot)
- [CVE-2022-24132](https://cve.now/CVE-2022-24132.md): phpshe V1.8 is affected by a denial of service (DoS) attack in the registry's verification code, which can paralyze the target service. (no CVSS)
- [CVE-2022-22772](https://cve.now/CVE-2022-22772.md): TIBCO Managed File Transfer Platform Server Remote Code Execution Vulnerability (CVSS 8.5, TIBCO Software TIBCO Managed File Transfer Platform Server…)
- [CVE-2021-44312](https://cve.now/CVE-2021-44312.md): An issue was discovered in Firmware Analysis and Comparison Tool v3.2. (no CVSS)
- [CVE-2021-44310](https://cve.now/CVE-2021-44310.md): An issue was discovered in Firmware Analysis and Comparison Tool v3.2. (no CVSS)
- [CVE-2022-0998](https://cve.now/CVE-2022-0998.md): An integer overflow flaw was found in the Linux kernel’s virtio device driver code in the way a user triggers the vhost\_vdpa\_config\_validate (no CVSS, Kernel)
- [CVE-2021-23851](https://cve.now/CVE-2021-23851.md): Buffer Overflow vulnerability in the recovery image web-based interface (CVSS 6.8, Bosch CPP Firmware)
- [CVE-2021-23850](https://cve.now/CVE-2021-23850.md): Buffer Overflow vulnerability in the recovery image telnet server (CVSS 6.8, Bosch CPP Firmware)
- [CVE-2022-22996](https://cve.now/CVE-2022-22996.md): SanDisk Professional G-RAID 4/8 Software Utility, Privilege Escalation (CVSS 7.8, SanDisk Professional G-RAID 4/8 Software Utility)
- [CVE-2021-39754](https://cve.now/CVE-2021-39754.md): In ContextImpl, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information (no CVSS, Android)
- [CVE-2022-20002](https://cve.now/CVE-2022-20002.md): In incfs, there is a possible way of mounting on arbitrary paths due to a missing permission check. (no CVSS, Android)
- [CVE-2021-39791](https://cve.now/CVE-2021-39791.md): In WallpaperManagerService, there is a possible way to determine whether an app is installed, without query permissions, due to side channel (no CVSS, Android)
- [CVE-2021-39790](https://cve.now/CVE-2021-39790.md): In Dialer, there is a possible way to manipulate visual voicemail settings due to a missing permission check. (no CVSS, Android)
- [CVE-2021-39789](https://cve.now/CVE-2021-39789.md): In Telecom, there is a possible leak of TTY mode change due to a missing permission check. (no CVSS, Android)
- [CVE-2021-39788](https://cve.now/CVE-2021-39788.md): In TelecomManager, there is a possible way to check if a particular self managed phone account was registered on the device due to side chan (no CVSS, Android)
- [CVE-2021-39787](https://cve.now/CVE-2021-39787.md): In SystemUI, there is a possible arbitrary Activity launch due to a confused deputy. (no CVSS, Android)
- [CVE-2021-39786](https://cve.now/CVE-2021-39786.md): In NFC, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Android)
- [CVE-2021-39784](https://cve.now/CVE-2021-39784.md): In CellBroadcastReceiver, there is a possible path to enable specific cellular features due to a missing permission check. (no CVSS, Android)
- [CVE-2021-39783](https://cve.now/CVE-2021-39783.md): In rcsservice, there is a possible way to modify TTY mode due to a missing permission check. (no CVSS, Android)
- [CVE-2021-39782](https://cve.now/CVE-2021-39782.md): In Telephony, there is a possible unauthorized modification of the PLMN SIM file due to a missing permission check. (no CVSS, Android)
- [CVE-2021-39781](https://cve.now/CVE-2021-39781.md): In SmsController, there is a possible information disclosure due to a permissions bypass. (no CVSS, Android)
- [CVE-2021-39780](https://cve.now/CVE-2021-39780.md): In Traceur, there is a possible bypass of developer settings requirements for capturing system traces due to a missing permission check. (no CVSS, Android)
- [CVE-2021-39779](https://cve.now/CVE-2021-39779.md): In getCallStateUsingPackage of Telecom Service, there is a missing permission check. (no CVSS, Android)
- [CVE-2021-39778](https://cve.now/CVE-2021-39778.md): In Telecomm, there is a possible way to determine whether an app is installed, without query permissions, due to improper input validation. (no CVSS, Android)
- [CVE-2021-39777](https://cve.now/CVE-2021-39777.md): In Telephony, there is a possible way to determine whether an app is installed, without query permissions, due to a missing permission check (no CVSS, Android)
- [CVE-2021-39776](https://cve.now/CVE-2021-39776.md): In NFC, there is a possible memory corruption due to a use after free. (no CVSS, Android)
- [CVE-2021-39775](https://cve.now/CVE-2021-39775.md): In People, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disc (no CVSS, Android)
- [CVE-2021-39774](https://cve.now/CVE-2021-39774.md): In Bluetooth, there is a possible out of bounds read due to a missing bounds check. (no CVSS, Android)
- [CVE-2021-39773](https://cve.now/CVE-2021-39773.md): In VpnManagerService, there is a possible disclosure of installed VPN packages due to side channel information disclosure. (no CVSS, Android)
- [CVE-2021-39772](https://cve.now/CVE-2021-39772.md): In Bluetooth, there is a possible way to access the a2dp audio control switch due to a missing permission check. (no CVSS, Android)
- [CVE-2021-39771](https://cve.now/CVE-2021-39771.md): In Settings, there is a possible way to misrepresent which app wants to add a wifi network due to improper input validation. (no CVSS, Android)
- [CVE-2021-39770](https://cve.now/CVE-2021-39770.md): In Framework, there is a possible disclosure of the device owner package due to a missing permission check. (no CVSS, Android)
- [CVE-2021-39769](https://cve.now/CVE-2021-39769.md): In Device Policy, there is a possible way to determine whether an app is installed, without query permissions, due to a missing permission c (no CVSS, Android)
- [CVE-2021-39768](https://cve.now/CVE-2021-39768.md): In Settings, there is a possible way to add an auto-connect WiFi network without the user's consent due to a missing permission check. (no CVSS, Android)
- [CVE-2021-39767](https://cve.now/CVE-2021-39767.md): In miniadb, there is a possible way to get read/write access to recovery system properties due to an insecure default value. (no CVSS, Android)
- [CVE-2021-39766](https://cve.now/CVE-2021-39766.md): In Settings, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information di (no CVSS, Android)
- [CVE-2021-39765](https://cve.now/CVE-2021-39765.md): In Gallery, there is a possible permission bypass due to a confused deputy. (no CVSS, Android)
- [CVE-2021-39764](https://cve.now/CVE-2021-39764.md): In Settings, there is a possible way to display an incorrect app name due to improper input validation. (no CVSS, Android)
- [CVE-2021-39763](https://cve.now/CVE-2021-39763.md): In Settings, there is a possible way to make the user enable WiFi due to improper input validation. (no CVSS, Android)
- [CVE-2021-39762](https://cve.now/CVE-2021-39762.md): In tremolo, there is a possible out of bounds read due to an integer overflow. (no CVSS, Android)
- [CVE-2021-39761](https://cve.now/CVE-2021-39761.md): In Media, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information discl (no CVSS, Android)
- [CVE-2021-39760](https://cve.now/CVE-2021-39760.md): In AudioService, there is a possible way to determine whether an app is installed, without query permissions, due to side channel informatio (no CVSS, Android)
- [CVE-2021-39759](https://cve.now/CVE-2021-39759.md): In libstagefright, there is a possible out of bounds write due to an integer overflow. (no CVSS, Android)
- [CVE-2021-39758](https://cve.now/CVE-2021-39758.md): In WindowManager, there is a possible way to start a foreground activity from the background due to a missing permission check. (no CVSS, Android)
- [CVE-2021-39757](https://cve.now/CVE-2021-39757.md): In PermissionController, there is a possible permission bypass due to an unsafe PendingIntent. (no CVSS, Android)
- [CVE-2021-39756](https://cve.now/CVE-2021-39756.md): In Framework, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information d (no CVSS, Android)
- [CVE-2021-39755](https://cve.now/CVE-2021-39755.md): In DevicePolicyManager, there is a possible way to reveal the existence of an installed package without proper query permissions due to side (no CVSS, Android)
- [CVE-2021-39753](https://cve.now/CVE-2021-39753.md): In DomainVerificationService, there is a possible way to access app domain verification information due to a missing permission check. (no CVSS, Android)
- [CVE-2021-39752](https://cve.now/CVE-2021-39752.md): In Bubbles, there is a possible way to interfere with Bubbles due to a permissions bypass. (no CVSS, Android)
- [CVE-2021-39751](https://cve.now/CVE-2021-39751.md): In Settings, there is a possible way to read Bluetooth device names without proper permissions due to a missing permission check. (no CVSS, Android)
- [CVE-2021-39750](https://cve.now/CVE-2021-39750.md): In PackageManager, there is a possible way to change the splash screen theme of other apps due to a missing permission check. (no CVSS, Android)
- [CVE-2021-39749](https://cve.now/CVE-2021-39749.md): In WindowManager, there is a possible way to start non-exported and protected activities due to a missing permission check. (no CVSS, Android)
- [CVE-2021-39748](https://cve.now/CVE-2021-39748.md): In InputMethodEditor, there is a possible way to access some files accessible to Settings due to an unsafe PendingIntent. (no CVSS, Android)
- [CVE-2021-39747](https://cve.now/CVE-2021-39747.md): In Settings Provider, there is a possible way to list values of non-readable global settings due to a permissions bypass. (no CVSS, Android)
- [CVE-2021-39746](https://cve.now/CVE-2021-39746.md): In PermissionController, there is a possible way to delete some local files due to an unsafe PendingIntent. (no CVSS, Android)
- [CVE-2021-39745](https://cve.now/CVE-2021-39745.md): In DevicePolicyManager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel inf (no CVSS, Android)
- [CVE-2021-39744](https://cve.now/CVE-2021-39744.md): In DevicePolicyManager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel inf (no CVSS, Android)
- [CVE-2021-39743](https://cve.now/CVE-2021-39743.md): In PackageManager, there is a possible way to update the last usage time of another package due to a missing permission check. (no CVSS, Android)
- [CVE-2021-39742](https://cve.now/CVE-2021-39742.md): In Voicemail, there is a possible way to retrieve a trackable identifier due to a missing permission check. (no CVSS, Android)
- [CVE-2021-39741](https://cve.now/CVE-2021-39741.md): In Keymaster, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Android)
- [CVE-2021-39740](https://cve.now/CVE-2021-39740.md): In Messaging, there is a possible way to bypass attachment restrictions due to improper input validation. (no CVSS, Android)
- [CVE-2021-39739](https://cve.now/CVE-2021-39739.md): In ArrayMap, there is a possible leak of the content of SMS messages due to log information disclosure. (no CVSS, Android)
- [CVE-2021-1033](https://cve.now/CVE-2021-1033.md): In createGeneralSlice of ConnectedDevicesSliceProvider.java.java, there is a possible permission bypass due to an unsafe PendingIntent. (no CVSS, Android)
- [CVE-2021-1000](https://cve.now/CVE-2021-1000.md): In createBluetoothDeviceSlice of ConnectedDevicesSliceProvider.java, there is a possible permission bypass due to an unsafe PendingIntent. (no CVSS, Android)
- [CVE-2022-23136](https://cve.now/CVE-2022-23136.md): There is a stored XSS vulnerability in ZTE home gateway product. (no CVSS, ZXHN F680)
- [CVE-2021-3456](https://cve.now/CVE-2021-3456.md): An improper authorization handling flaw was found in Foreman. (no CVSS, smart\_proxy\_salt)
- [CVE-2022-27907](https://cve.now/CVE-2022-27907.md): Sonatype Nexus Repository Manager 3.x before 3.38.0 allows SSRF. (no CVSS)
- [CVE-2022-23801](https://cve.now/CVE-2022-23801.md): \[20220309\] - Core - XSS attack vector through SVG (no CVSS, Joomla! Project Joomla! CMS)
- [CVE-2022-23800](https://cve.now/CVE-2022-23800.md): \[20220308\] - Core - Inadequate content filtering within the filter code (no CVSS, Joomla! Project Joomla! CMS · Joomla! Project joomla/fil… +1)
- [CVE-2022-23799](https://cve.now/CVE-2022-23799.md): \[20220307\] - Core - Variable Tampering on JInput $\_REQUEST data (no CVSS, Joomla! Project Joomla! CMS · Joomla! Project joomla/inp… +1)
- [CVE-2022-23798](https://cve.now/CVE-2022-23798.md): \[20220306\] - Core - Inadequate validation of internal URLs (no CVSS, Joomla! Project Joomla! CMS)
- [CVE-2022-23797](https://cve.now/CVE-2022-23797.md): \[20220305\] - Core - Inadequate filtering on the selected Ids (no CVSS, Joomla! Project Joomla! CMS)
- [CVE-2022-23796](https://cve.now/CVE-2022-23796.md): \[20220304\] - Core - Missing input validation within com\_fields class inputs (no CVSS, Joomla! Project Joomla! CMS)
- [CVE-2022-23795](https://cve.now/CVE-2022-23795.md): \[20220303\] - Core - User row are not bound to a authentication mechanism (no CVSS, Joomla! Project Joomla! CMS)
- [CVE-2022-23794](https://cve.now/CVE-2022-23794.md): \[20220302\] - Core - Path Disclosure within filesystem error messages (no CVSS, Joomla! Project Joomla! CMS · Joomla! Project joomla/fil… +1)
- [CVE-2022-23793](https://cve.now/CVE-2022-23793.md): \[20220301\] - Core - Zip Slip within the Tar extractor (no CVSS, Joomla! Project Joomla! CMS · Joomla! Project joomla/arc… +1)
- [CVE-2022-25619](https://cve.now/CVE-2022-25619.md): Authenticated Command Injection to RCE (CVSS 3.8, Profelis IT Consultancy SambaBox)
- [CVE-2022-25620](https://cve.now/CVE-2022-25620.md): Stored Cross-Site Scripting (XSS) (CVSS 3.8, Profelis IT Consultancy SambaBox)
- [CVE-2022-1155](https://cve.now/CVE-2022-1155.md): Old sessions are not blocked by the login enable function. in snipe/snipe-it (CVSS 7.4, snipe/snipe-it)
- [CVE-2022-24131](https://cve.now/CVE-2022-24131.md): DouPHP v1.6 Release 20220121 is affected by Cross Site Scripting (XSS) through /admin/login.php in the background, which will lead to JavaSc (no CVSS)
- [CVE-2022-1179](https://cve.now/CVE-2022-1179.md): Non-Privilege User Can Created New Rule and Lead to Stored Cross Site Scripting in openemr/openemr (CVSS 4.6, openemr/openemr)
- [CVE-2022-1180](https://cve.now/CVE-2022-1180.md): Reflected Cross Site Scripting in openemr/openemr (CVSS 4.6, openemr/openemr)
- [CVE-2022-1181](https://cve.now/CVE-2022-1181.md): Stored Cross Site Scripting in openemr/openemr (CVSS 8.0, openemr/openemr)
- [CVE-2022-1177](https://cve.now/CVE-2022-1177.md): Accounting User Can Download Patient Reports in openemr in openemr/openemr (CVSS 6.5, openemr/openemr)
- [CVE-2022-1178](https://cve.now/CVE-2022-1178.md): Stored Cross Site Scripting in openemr/openemr (CVSS 7.3, openemr/openemr)
- [CVE-2022-23869](https://cve.now/CVE-2022-23869.md): In RuoYi v4.7.2 through the WebUI, user test1 does not have permission to reset the password of user test3, but the password of user test3 c (no CVSS)
- [CVE-2022-23868](https://cve.now/CVE-2022-23868.md): RuoYi v4.7.2 contains a CSV injection vulnerability through ruoyi-admin when a victim opens .xlsx log file. (no CVSS)
- [CVE-2022-1172](https://cve.now/CVE-2022-1172.md): Null Pointer Dereference Caused Segmentation Fault in gpac/gpac (CVSS 5.6, gpac/gpac)
- [CVE-2022-25598](https://cve.now/CVE-2022-25598.md): Apache DolphinScheduler user registration is vulnerable to ReDoS attacks (no CVSS, Apache Software Foundation Apache DolphinScheduler · org… +1)
- [CVE-2022-1163](https://cve.now/CVE-2022-1163.md): Cross-site Scripting (XSS) - Stored in mineweb/minewebcms (CVSS 6.8, mineweb/minewebcms)
- [CVE-2022-27816](https://cve.now/CVE-2022-27816.md): SWHKD 1.1.5 unsafely uses the /tmp/swhks.pid pathname. (no CVSS, Simple-Wayland-HotKey-Daemon)
- [CVE-2022-24693](https://cve.now/CVE-2022-24693.md): Baicells Nova436Q and Neutrino 430 devices with firmware through QRTB 2.7.8 have hardcoded credentials that are easily discovered, and can b (no CVSS)
- [CVE-2020-24769](https://cve.now/CVE-2020-24769.md): SQL injection vulnerability in takeconfirm.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the classes par (no CVSS)
- [CVE-2020-24770](https://cve.now/CVE-2020-24770.md): SQL injection vulnerability in modrules.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the id parameter. (no CVSS)
- [CVE-2020-24771](https://cve.now/CVE-2020-24771.md): Incorrect access control in NexusPHP 1.5.beta5.20120707 allows unauthorized attackers to access published content. (no CVSS)
- [CVE-2020-35501](https://cve.now/CVE-2020-35501.md): A flaw was found in the Linux kernels implementation of audit rules, where a syscall can unexpectedly not be correctly not be logged by the (CVSS 3.4, kernel)
- [CVE-2022-1154](https://cve.now/CVE-2022-1154.md): Use after free in utf\_ptr2char in vim/vim (CVSS 7.8, vim/vim)
- [CVE-2022-1160](https://cve.now/CVE-2022-1160.md): heap buffer overflow in get\_one\_sourceline in vim/vim (CVSS 7.3, vim/vim)
- [CVE-2022-24763](https://cve.now/CVE-2022-24763.md): Infinite Loop in PJSIP (CVSS 7.5, pjsip pjproject)
- [CVE-2022-28202](https://cve.now/CVE-2022-28202.md): An XSS issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. (no CVSS)
- [CVE-2022-28205](https://cve.now/CVE-2022-28205.md): An issue was discovered in MediaWiki through 1.37.1. (no CVSS)
- [CVE-2022-28206](https://cve.now/CVE-2022-28206.md): An issue was discovered in MediaWiki through 1.37.1. (no CVSS)
- [CVE-2022-28209](https://cve.now/CVE-2022-28209.md): An issue was discovered in Mediawiki through 1.37.1. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-03-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.