# CVEs published 2022-03-31

45 CVEs were published on March 31, 2022: 2 critical, 7 high. Days are UTC.

- [CVE-2022-24803](https://cve.now/CVE-2022-24803.md): Command Injection vulnerability in asciidoctor-include-ext (CVSS 10.0, jirutka asciidoctor-include-ext · asciidoctor-include-ext)
- [CVE-2022-24802](https://cve.now/CVE-2022-24802.md): Prototype Pollution in deepmerge-ts (CVSS 8.1, RebeccaStevens deepmerge-ts · deepmerge-ts)
- [CVE-2022-24798](https://cve.now/CVE-2022-24798.md): Insufficient password hash filtering in some IRRd queries and exports (CVSS 7.5, irrdnet irrd · irrd)
- [CVE-2022-24791](https://cve.now/CVE-2022-24791.md): Use after free in Wasmtime (CVSS 8.1, bytecodealliance wasmtime · wasmtime)
- [CVE-2022-24794](https://cve.now/CVE-2022-24794.md): Open Redirect in express-openid-connect (CVSS 7.5, auth0 express-openid-connect · express-openid-connect)
- [CVE-2022-24796](https://cve.now/CVE-2022-24796.md): Remote Command Injection in RaspberryMatic (CVSS 10.0, jens-maus RaspberryMatic)
- [CVE-2022-24797](https://cve.now/CVE-2022-24797.md): Exposure of Sensitive Information in Pomerium (CVSS 6.5, pomerium · github.com/pomerium/pomerium)
- [CVE-2022-24758](https://cve.now/CVE-2022-24758.md): Insertion of Sensitive Information into Log File affects Jupyter Notebook (CVSS 7.5, jupyter notebook · notebook)
- [CVE-2022-27966](https://cve.now/CVE-2022-27966.md): Xshell v7.0.0099 and below contains a binary hijack vulnerability which allows attackers to execute arbitrary code via a crafted .exe file. (no CVSS)
- [CVE-2022-27964](https://cve.now/CVE-2022-27964.md): Xmanager v7.0.0096 and below contains a binary hijack vulnerability which allows attackers to execute arbitrary code via a crafted .exe file (no CVSS)
- [CVE-2022-27965](https://cve.now/CVE-2022-27965.md): Xlpd v7.0.0094 and below contains a binary hijack vulnerability which allows attackers to execute arbitrary code via a crafted .exe file. (no CVSS)
- [CVE-2022-27963](https://cve.now/CVE-2022-27963.md): Xftp 7.0.0088p and below contains a binary hijack vulnerability which allows attackers to execute arbitrary code via a crafted .exe file. (no CVSS)
- [CVE-2022-27052](https://cve.now/CVE-2022-27052.md): FreeFtpd version 1.0.13 and below contains an unquoted service path vulnerability which allows local users to launch processes with elevated (no CVSS)
- [CVE-2022-27049](https://cve.now/CVE-2022-27049.md): Raidrive before v2021.12.35 allows attackers to arbitrarily move log files by pre-creating a mountpoint and log files before Raidrive is ins (no CVSS)
- [CVE-2022-27050](https://cve.now/CVE-2022-27050.md): BitComet Service for Windows before version 1.8.6 contains an unquoted service path vulnerability which allows attackers to escalate privile (no CVSS)
- [CVE-2021-43722](https://cve.now/CVE-2021-43722.md): D-Link DIR-645 1.03 A1 is vulnerable to Buffer Overflow. (no CVSS)
- [CVE-2022-26546](https://cve.now/CVE-2022-26546.md): Hospital Management System v1.0 was discovered to lack an authorization component, allowing attackers to access sensitive information and ob (no CVSS)
- [CVE-2021-43707](https://cve.now/CVE-2021-43707.md): Cross Site Scripting (XSS) vulnerability exists in Maccms v10 via link\_Name parameter. (no CVSS)
- [CVE-2021-43479](https://cve.now/CVE-2021-43479.md): A Remote Code Execution (RCE) vulnerability exists in The-Secretary 2.5 via install.php. (no CVSS)
- [CVE-2021-43478](https://cve.now/CVE-2021-43478.md): A vulnerability exists in Hoosk 1.8.0 in /install/index.php, due to a failure to check if config.php already exists in the root directory, w (no CVSS)
- [CVE-2021-43484](https://cve.now/CVE-2021-43484.md): A Remote Code Execution (RCE) vulnerability exists in Simple Client Management System 1.0 in create.php due to the failure to validate the e (no CVSS)
- [CVE-2021-37517](https://cve.now/CVE-2021-37517.md): An Access Control vulnerability exists in Dolibarr ERP/CRM 13.0.2, fixed version is 14.0.0,in the forgot-password function becuase the appli (no CVSS, dolibarr/dolibarr)
- [CVE-2021-42946](https://cve.now/CVE-2021-42946.md): A Cross Site Scripting (XSS) vulnerability exists in htmly.2.8.1 via the Copyright field in the /admin/config page. (no CVSS)
- [CVE-2021-42868](https://cve.now/CVE-2021-42868.md): A Cross Site Scripting (XSS) vulnerability exists in Chikista Patient Management Software 2.0.2 in the first\_name parameter in (1) patient/i (no CVSS)
- [CVE-2021-42867](https://cve.now/CVE-2021-42867.md): A Cross Site Scripting (XSS) vulnerability exists in DanPros htmly 2.8.1 via the Description field in (1) admin/config, and (2) index.php pa (no CVSS)
- [CVE-2021-42866](https://cve.now/CVE-2021-42866.md): A Cross Site Scripting vulnerabilty exists in Pixelimity 1.0 via the Site Description field in pixelimity/admin/setting.php (no CVSS)
- [CVE-2021-42869](https://cve.now/CVE-2021-42869.md): A Cross Site Scripting (XSS) vulnerability exists in Chikista Patient Management Software 2.0.2 via the last\_name parameter in the (1) patie (no CVSS)
- [CVE-2021-36625](https://cve.now/CVE-2021-36625.md): An SQL Injection vulnerability exists in Dolibarr ERP/CRM 13.0.2 (fixed version is 14.0.0) via a POST request to the country\_id parameter in (no CVSS, dolibarr/dolibarr)
- [CVE-2022-22311](https://cve.now/CVE-2022-22311.md): IBM Security Verify Access could allow a user, using man in the middle techniques, to obtain sensitive information or possibly change some i (CVSS 4.8, IBM Security Verify Access)
- [CVE-2021-43506](https://cve.now/CVE-2021-43506.md): An SQL Injection vulnerability exists in Sourcecodester Simple Client Management System 1.0 via the password parameter in Login.php. (no CVSS)
- [CVE-2021-43505](https://cve.now/CVE-2021-43505.md): Multiple Cross Site Scripting (XSS) vulnerabilities exist in Ssourcecodester Simple Client Management System v1 via (1) Add new Client and ( (no CVSS)
- [CVE-2021-34257](https://cve.now/CVE-2021-34257.md): Multiple Remote Code Execution (RCE) vulnerabilities exist in WPanel 4 4.3.1 and below via a malicious PHP file upload to (1) Dashboard's Av (no CVSS, wpanel/wpanel4-cms)
- [CVE-2022-0350](https://cve.now/CVE-2022-0350.md): Cross-site Scripting (XSS) - Stored in vanessa219/vditor (CVSS 6.1, vanessa219/vditor · vditor)
- [CVE-2022-24136](https://cve.now/CVE-2022-24136.md): Hospital Management System v1.0 is affected by an unrestricted upload of dangerous file type vulerability in treatmentrecord.php. (no CVSS)
- [CVE-2022-1176](https://cve.now/CVE-2022-1176.md): Loose comparison causes IDOR on multiple endpoints in livehelperchat/livehelperchat (CVSS 7.5, livehelperchat/livehelperchat · remdex/livehelperchat)
- [CVE-2022-25915](https://cve.now/CVE-2022-25915.md): Improper access control vulnerability in ELECOM LAN routers (WRC-1167GST2 firmware v1.25 and prior, WRC-1167GST2A firmware v1.25 and prior, (no CVSS, ELECOM CO. ELECOM LAN routers)
- [CVE-2022-1191](https://cve.now/CVE-2022-1191.md): SSRF on index.php/cobrowse/proxycss/ in livehelperchat/livehelperchat (CVSS 8.7, livehelperchat/livehelperchat)
- [CVE-2022-28128](https://cve.now/CVE-2022-28128.md): Untrusted search path vulnerability in AttacheCase ver.3.6.1.0 and earlier allows an attacker to gain privileges and execute arbitrary code (no CVSS, HiBARA Software AttacheCase)
- [CVE-2022-27496](https://cve.now/CVE-2022-27496.md): Cross-site scripting vulnerability in Zero-channel BBS Plus v0.7.4 and earlier allows a remote attacker to inject an arbitrary script via un (no CVSS, Zero-Channel BBS Plus Developers Zero-channel BBS Plus)
- [CVE-2022-26019](https://cve.now/CVE-2022-26019.md): Improper access control vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions prior to 2.6.0 and pfSense Plus software (no CVSS, pfSense CE and pfSense Plus)
- [CVE-2022-25348](https://cve.now/CVE-2022-25348.md): Untrusted search path vulnerability in AttacheCase ver.4.0.2.7 and earlier allows an attacker to gain privileges and execute arbitrary code (no CVSS, HiBARA Software AttacheCase)
- [CVE-2022-24299](https://cve.now/CVE-2022-24299.md): Improper input validation vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions prior to 2.6.0 and pfSense Plus softwar (no CVSS, pfSense CE and pfSense Plus)
- [CVE-2022-23183](https://cve.now/CVE-2022-23183.md): Missing authorization vulnerability in Advanced Custom Fields versions prior to 5.12.1 and Advanced Custom Fields Pro versions prior to 5.12 (no CVSS, Delicious Brains Advanced Custom Fields)
- [CVE-2022-22986](https://cve.now/CVE-2022-22986.md): Netcommunity OG410X and OG810X series (Netcommunity OG410Xa, OG410Xi, OG810Xa, and OG810Xi firmware Ver.2.28 and earlier) allow an attacker (no CVSS, NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION (NTT East)…)
- [CVE-2021-20729](https://cve.now/CVE-2021-20729.md): Cross-site scripting vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions 2.5.2 and earlier, and pfSense Plus software (no CVSS, pfSense CE and pfSense Plus)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-03-31
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.