CVEs published in March 2022
21 tracked CVEs from 5 vendors had their first vendor advisory published in March 2022: 2 critical, 8 high, 1 in CISA KEV. Newest first.
5 more from this month are covered only by Red Hat's per-package records, listed on the Red Hat vendor page.
- Added
CVE-2022-26019High
Improper access control vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions prior to 2.6.0 and pfSense…
pfSense · 1 advisory - Added
CVE-2022-24299High
Improper input validation vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions prior to 2.6.0 and pfSense…
pfSense · 1 advisory - Added
CVE-2021-20729Medium
Cross-site scripting vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions 2.5.2 and earlier, and pfSense…
pfSense · 1 advisory - Added
CVE-2022-28144Medium
Proxmox · 1 advisory - Added
CVE-2022-28143Medium
Proxmox · 1 advisory - Added
CVE-2022-28142High
Jenkins Proxmox Plugin 0.6.0 and earlier disables SSL/TLS certificate validation globally for the Jenkins controller JVM
Proxmox · 3 advisories - Added
CVE-2022-28141Medium
Jenkins Proxmox Plugin 0.5.0 and earlier stores the Proxmox Datacenter password unencrypted in the global config.xml file on the…
Proxmox · 1 advisory - Added
CVE-2022-0331Medium
Sophos Firewall: information disclosure vulnerability in Webadmin
Sophos · 1 advisory - Added
CVE-2021-3422High
Splunk Enterprise: The lack of validation of a key-value field in the Splunk-to-Splunk protocol
Splunk · 1 advisory - Added
CVE-2022-1040CriticalCISA KEV
Sophos Firewall Authentication Bypass Vulnerability
Sophos · 1 advisory - Added
Sophos UTM: Confd log files contain local users', including root’s, SHA512crypt password hashes with insecure access permissions.
Sophos · 1 advisory - Added
CVE-2022-0386High
Sophos UTM: post-auth SQL injection vulnerability in the Mail Manager potentially
Sophos · 1 advisory - Added
CVE-2021-43958Critical
Various rest resources in Fisheye and Crucible before version 4.8.9 allowed remote attackers to brute force user login…
Atlassian · 1 advisory - Added
CVE-2021-43957High
Atlassian · 1 advisory - Added
CVE-2021-43956Medium
The jQuery deserialize library in Fisheye and Crucible before version 4.8.9 allowed remote attackers to to inject arbitrary HTML…
Atlassian · 1 advisory - Added
CVE-2021-43955Medium
The /rest-service-fecru/server-v1 resource in Fisheye and Crucible before version 4.8.9 allowed authenticated remote attackers…
Atlassian · 1 advisory - Added
CVE-2021-43954Medium
The DefaultRepositoryAdminService class in Fisheye and Crucible before version 4.8.9 allowed remote attackers, who have 'can add…
Atlassian · 1 advisory - Added
CVE-2022-21132Medium
Directory traversal vulnerability in pfSense-pkg-WireGuard pfSense-pkg-WireGuard 0.1.5 versions prior to 0.1.5_4 and…
pfSense · 1 advisory - Added
CVE-2021-43944High
This issue exists to document that a security improvement in the way that Jira Server and Data Center use templates has been…
Atlassian · 1 advisory - Added
CVE-2021-36809Medium
local attacker can overwrite arbitrary files on the system with VPN client logs using administrator privileges, potentially…
Sophos · 1 advisory - Added
CVE-2021-41282High
pfSense: diag_routes.php in pfSense 2.5.2 allows sed data injection.
pfSense · 1 advisory