CVEs published in March 2022
2,440 vulnerabilities, 400 critical, 18 exploited.
- mdempfle advanced iframeAdvanced iFrame < 2022 - Reflected Cross-Site Scripting6.1 Medium
- conversios, unknown conversios.io – google analytics and google shopping plugin for woocommerce +1 moreConversios.io < 4.6.2 - Subscriber+ SQL Injection8.8 High
- custom content shortcode project content shortcode, unknown custom content shortcode +1 moreCustom Content Shortcode < 4.0.2 - Authenticated Stored Cross-Site Scripting5.4 Medium
- custom content shortcode project content shortcode, unknown custom content shortcode +1 moreCustom Content Shortcode < 4.0.2 - Authenticated Arbitrary File Access / LFI4.3 Medium
- custom content shortcode project content shortcode, unknown custom content shortcode +1 moreCustom Content Shortcode < 4.0.1 - Unauthorised Arbitrary Post Metadata Access4.3 Medium
- nicdark cost calculatorCost Calculator < 1.6 - Contributor+ Stored Cross-Site Scripting5.4 Medium
- wp-eventmanager wp event manager, unknown wp event manager – easily build your calendar of events! +1 moreWP Event Manager < 3.1.23 - Admin+ Stored Cross-Site Scripting4.8 Medium
- unknown tradetracker-storeTradetracker-Store < 4.6.60 - Admin+ SQL Injection7.2 High
- hotscot contact form, unknown hotscot contact form +1 moreHotscot Contact Form < 1.3 - Admin+ SQL Injection7.2 High
- unknown all-in-one wp migration, servmask one-stop wp migration +1 moreAll-in-One WP Migration < 7.41 - Admin+ Arbitrary File Upload to RCE7.2 High
- janeczku calibre-web, janeczku/calibre-web +1 moreServer-Side Request Forgery (SSRF) in janeczku/calibre-web6.5 Medium
- janeczku calibre-web, janeczku/calibre-web +1 moreServer-Side Request Forgery (SSRF) in janeczku/calibre-web9.1 Critical
- foxit pdf reader, pdf editor +1 moreFoxit PDF Reader and Editor before 11.2.1 and PhantomPDF before 10.1.7 allow a NULL pointer...5.5 Medium
- tp-link omada software controllerTP-Link Omada SDN Software Controller before 5.0.15 does not check if the authentication method...7.5 High
- otris update managerotris Update Manager 1.2.1.0 allows local users to achieve SYSTEM access via unauthenticated...7.8 High
fluent-bitOSS-FuzzHeap-use-after-free in cb_stdout_flushNo scoreclamavOSS-FuzzStack-buffer-overflow in load_regex_matcherNo score- abantecartAbantecart through 1.3.2 allows remote authenticated administrators to execute arbitrary code by...7.2 High
- libtiff, debian linux, fedoraproject fedora +1 more +3 moreReachable Assertion in tiffcp in libtiff 4.3.0 allows attackers to cause a denial-of-service via...5.5 Medium
- linux kernel, fedoraproject fedora, netapp h300e firmware +26 more +28 moreImportant: kernel security, bug fix, and enhancement update7.8 High
- salesagility salesagility/suitecrm, suitecrm +1 moreMissing Authorization in salesagility/suitecrm5.4 Medium
- salesagility salesagility/suitecrm, suitecrm +1 moreMissing Authorization in salesagility/suitecrm7.1 High
- archivy archivy/archivy, archivy project archivy +1 moreOpen Redirect in archivy/archivy3.4 Low
- occlum project occlumThe pointer-validation logic in util/mem_util.rs in Occlum before 0.26.0 for Intel SGX acts as a...5.5 Medium
- f-secure safe, safe browser for android version 18.5 +1 moreUniversal Cross-Site Scripting Vulnerability in F-Secure SAFE Browser Protection for Android5.5 Medium
- f-secure safe, safe browser for android version 18.5 +1 moreUniversal Cross-Site Scripting Vulnerability in F-Secure SAFE Browser for Android5.5 Medium
- medialize medialize/uri.js, uri.js project uri.js +1 moreOpen Redirect in medialize/uri.js8.0 High
- nitely nitely/spirit, spirit-project spirit +1 moreMultiple Open Redirect in nitely/spirit4.3 Medium
- genieacsOS Command Injection in GenieACS9.8 Critical
- razorengine project razorengineCode injection in RazorEngine9.8 Critical
- debian linux, linux kernel, fedoraproject fedora +8 more +10 morest21nfca_connectivity_event_received in drivers/nfc/st21nfca/se.c in the Linux kernel through 5...7.8 High
ghostscriptOSS-FuzzUNKNOWN READ in pdfi_read_cff_fontNo scorefluent-bitOSS-FuzzStack-buffer-overflow in msgpack_sbuffer_writeNo score- readymedia project readymedia, debian linux +1 moreA DNS rebinding issue in ReadyMedia (formerly MiniDLNA) before 1.3.1 allows a remote web server...7.4 High
- debian linux, fedoraproject fedora, network block device project block device +2 moreIn nbd-server in nbd before 3.24, there is a stack-based buffer overflow. An attacker can cause a...9.8 Critical
- debian linux, fedoraproject fedora, network block device project block device +2 moreIn nbd-server in nbd before 3.24, there is an integer overflow with a resultant heap-based buffer...9.8 Critical
- mozilla firefox, firefox esr, firefox for android +4 more +6 moreAn unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable...9.6 Critical
- mozilla firefox, firefox esr, firefox for android +4 more +6 moreRemoving an XSLT parameter during processing could have lead to an exploitable use-after-free. We...8.8 High
- pytorchlightning pytorchlightning/pytorch-lightning, lightningai pytorch lightning +1 moreCode Injection in pytorchlightning/pytorch-lightning7.3 High
- radare radare2, radareorg radareorg/radare2 +1 moreUse After Free in r_reg_get_name_idx in radareorg/radare27.3 High
- espruinoEspruino 2v11 release was discovered to contain a stack buffer overflow via src/jsvar.c in...7.8 High
- espruinoEspruino 2v11.251 was discovered to contain a stack buffer overflow via src/jsvar.c in...7.8 High
- marktextMark Text v0.16.3 was discovered to contain a DOM-based cross-site scripting (XSS) vulnerability...9.6 Critical
- golang go, debian linux, netapp astra trident +2 moreregexp.Compile in Go before 1.16.15 and 1.17.x before 1.17.8 allows stack exhaustion via a deeply...7.5 High
- apache any23An XML external entity (XXE) injection vulnerability exists in the Apache Any23 RDFa XSLTStylesheet extractor9.1 Critical
- mingsoft mcmsRemote code execution in net.mingsoft:ms-mcms9.8 Critical
- tradingpaints trading paintsAn issue was discovered in Rhinode Trading Paints through 2.0.36. TP Updater.exe uses cleartext...7.5 High
- tp-link archer c20i firmwareThere is remote authenticated OS command injection on TP-Link Archer C20i 0.9.1 3.2 v003a.0 Build...8.8 High
- secomea gatemanagerLogged-in Administrator may get unrestricted file system access9.9 Critical
- hcltech bigfix compliance"TLS-RSA cipher suites are not disabled in BigFix Compliance up to v2.0.5. If TLS 2.0 and secure...7.5 High
- Show moreLoading…