CVEs published March 31, 2022
45 CVEs were published on March 31, 2022: 2 critical, 7 high.
- Published
- 45
- Critical
- 2
- High
- 7
- Medium
- 3
- Low
- 0
- Unrated
- 33
- Now in CISA KEV
- 0
- Fix available
- 13
Most affected products
- pfSense CE and pfSense Plus
- 3
- dolibarr/dolibarr
- 2
- HiBARA Software AttacheCase
- 2
- auth0 express-openid-connect · express-openid-connect
- 1
- bytecodealliance wasmtime · wasmtime
- 1
- Delicious Brains Advanced Custom Fields
- 1
- ELECOM CO. ELECOM LAN routers
- 1
- IBM Security Verify Access
- 1
- irrdnet irrd · irrd
- 1
- jens-maus RaspberryMatic
- 1
Critical 2
High 7
- CVE-2022-24802Prototype Pollution in deepmerge-tsRebeccaStevens deepmerge-ts · deepmerge-ts
- CVE-2022-24798Insufficient password hash filtering in some IRRd queries and exportsirrdnet irrd · irrd
- CVE-2022-24791Use after free in Wasmtimebytecodealliance wasmtime · wasmtime
- CVE-2022-24794Open Redirect in express-openid-connectauth0 express-openid-connect · express-openid-connect
- CVE-2022-24758Insertion of Sensitive Information into Log File affects Jupyter Notebookjupyter notebook · notebook
- CVE-2022-1176Loose comparison causes IDOR on multiple endpoints in livehelperchat/livehelperchatlivehelperchat/livehelperchat · remdex/livehelperchat
- CVE-2022-1191SSRF on index.php/cobrowse/proxycss/ in livehelperchat/livehelperchatlivehelperchat/livehelperchat
Medium, low and unrated 36
- CVE-2022-24797Exposure of Sensitive Information in Pomeriumpomerium · github.com/pomerium/pomerium
- CVE-2022-27966Xshell v7.0.0099 and below contains a binary hijack vulnerability which allows attackers to execute arbitrary code via a crafted .exe file.
- CVE-2022-27964Xmanager v7.0.0096 and below contains a binary hijack vulnerability which allows attackers to execute arbitrary code via a crafted .exe file
- CVE-2022-27965Xlpd v7.0.0094 and below contains a binary hijack vulnerability which allows attackers to execute arbitrary code via a crafted .exe file.
- CVE-2022-27963Xftp 7.0.0088p and below contains a binary hijack vulnerability which allows attackers to execute arbitrary code via a crafted .exe file.
- CVE-2022-27052FreeFtpd version 1.0.13 and below contains an unquoted service path vulnerability which allows local users to launch processes with elevated
- CVE-2022-27049Raidrive before v2021.12.35 allows attackers to arbitrarily move log files by pre-creating a mountpoint and log files before Raidrive is ins
- CVE-2022-27050BitComet Service for Windows before version 1.8.6 contains an unquoted service path vulnerability which allows attackers to escalate privile
- CVE-2021-43722D-Link DIR-645 1.03 A1 is vulnerable to Buffer Overflow.
- CVE-2022-26546Hospital Management System v1.0 was discovered to lack an authorization component, allowing attackers to access sensitive information and ob
- CVE-2021-43707Cross Site Scripting (XSS) vulnerability exists in Maccms v10 via link_Name parameter.
- CVE-2021-43479A Remote Code Execution (RCE) vulnerability exists in The-Secretary 2.5 via install.php.
- CVE-2021-43478A vulnerability exists in Hoosk 1.8.0 in /install/index.php, due to a failure to check if config.php already exists in the root directory, w
- CVE-2021-43484A Remote Code Execution (RCE) vulnerability exists in Simple Client Management System 1.0 in create.php due to the failure to validate the e
- CVE-2021-37517An Access Control vulnerability exists in Dolibarr ERP/CRM 13.0.2, fixed version is 14.0.0,in the forgot-password function becuase the applidolibarr/dolibarr
- CVE-2021-42946A Cross Site Scripting (XSS) vulnerability exists in htmly.2.8.1 via the Copyright field in the /admin/config page.
- CVE-2021-42868A Cross Site Scripting (XSS) vulnerability exists in Chikista Patient Management Software 2.0.2 in the first_name parameter in (1) patient/i
- CVE-2021-42867A Cross Site Scripting (XSS) vulnerability exists in DanPros htmly 2.8.1 via the Description field in (1) admin/config, and (2) index.php pa
- CVE-2021-42866A Cross Site Scripting vulnerabilty exists in Pixelimity 1.0 via the Site Description field in pixelimity/admin/setting.php
- CVE-2021-42869A Cross Site Scripting (XSS) vulnerability exists in Chikista Patient Management Software 2.0.2 via the last_name parameter in the (1) patie
- CVE-2021-36625An SQL Injection vulnerability exists in Dolibarr ERP/CRM 13.0.2 (fixed version is 14.0.0) via a POST request to the country_id parameter indolibarr/dolibarr
- CVE-2022-22311IBM Security Verify Access could allow a user, using man in the middle techniques, to obtain sensitive information or possibly change some iIBM Security Verify Access
- CVE-2021-43506An SQL Injection vulnerability exists in Sourcecodester Simple Client Management System 1.0 via the password parameter in Login.php.
- CVE-2021-43505Multiple Cross Site Scripting (XSS) vulnerabilities exist in Ssourcecodester Simple Client Management System v1 via (1) Add new Client and (
- CVE-2021-34257Multiple Remote Code Execution (RCE) vulnerabilities exist in WPanel 4 4.3.1 and below via a malicious PHP file upload to (1) Dashboard's Avwpanel/wpanel4-cms
- CVE-2022-0350Cross-site Scripting (XSS) - Stored in vanessa219/vditorvanessa219/vditor · vditor
- CVE-2022-24136Hospital Management System v1.0 is affected by an unrestricted upload of dangerous file type vulerability in treatmentrecord.php.
- CVE-2022-25915Improper access control vulnerability in ELECOM LAN routers (WRC-1167GST2 firmware v1.25 and prior, WRC-1167GST2A firmware v1.25 and prior, ELECOM CO. ELECOM LAN routers
- CVE-2022-28128Untrusted search path vulnerability in AttacheCase ver.3.6.1.0 and earlier allows an attacker to gain privileges and execute arbitrary code HiBARA Software AttacheCase
- CVE-2022-27496Cross-site scripting vulnerability in Zero-channel BBS Plus v0.7.4 and earlier allows a remote attacker to inject an arbitrary script via unZero-Channel BBS Plus Developers Zero-channel BBS Plus
- CVE-2022-26019Improper access control vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions prior to 2.6.0 and pfSense Plus software pfSense CE and pfSense Plus
- CVE-2022-25348Untrusted search path vulnerability in AttacheCase ver.4.0.2.7 and earlier allows an attacker to gain privileges and execute arbitrary code HiBARA Software AttacheCase
- CVE-2022-24299Improper input validation vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions prior to 2.6.0 and pfSense Plus softwarpfSense CE and pfSense Plus
- CVE-2022-23183Missing authorization vulnerability in Advanced Custom Fields versions prior to 5.12.1 and Advanced Custom Fields Pro versions prior to 5.12Delicious Brains Advanced Custom Fields
- CVE-2022-22986Netcommunity OG410X and OG810X series (Netcommunity OG410Xa, OG410Xi, OG810Xa, and OG810Xi firmware Ver.2.28 and earlier) allow an attacker NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION (NTT East)…
- CVE-2021-20729Cross-site scripting vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions 2.5.2 and earlier, and pfSense Plus softwarepfSense CE and pfSense Plus