CVEs published April 1, 2022
102 CVEs were published on April 1, 2022: 8 critical, 44 high. 2 are now in CISA KEV.
- Published
- 102
- Critical
- 8
- High
- 44
- Medium
- 23
- Low
- 2
- Unrated
- 25
- Now in CISA KEV
- 2
- Fix available
- 38
Most affected products
- Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- 12
- MDT Software MDT AutoSave · MDT Software AutoSave for Sy… +1
- 7
- Philips Vue PACS · Philips Vue MyVue +2
- 7
- GitLab
- 6
- Mitsubishi Electric MELSEC iQ-F series FX5U(C) CPU; Mitsubi…
- 6
- Omron CX-Position
- 4
- Dell Wyse Device Agent
- 3
- Moxa NPort IAW5000A-I/O series firmware
- 3
- cocoapods-downloader
- 2
- IBM SterlingPartner Engagement Manager
- 2
Critical 8
- CVE-2022-22965A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.Spring Framework · org.springframework:spring-beans +4
- CVE-2021-32976Moxa NPort IAW5000A-I/O Series Serial Device Server Stack-based Buffer OverflowMoxa NPort IAW5000A-I/O series firmware
- CVE-2021-32974Moxa NPort IAW5000A-I/O Series Serial Device Server Improper Input ValidationMoxa NPort IAW5000A-I/O series firmware
- CVE-2021-32933MDT AutoSave Command InjectionMDT Software MDT AutoSave · MDT Software AutoSave for Sy… +1
- CVE-2021-32953MDT AutoSave SQL InjectionMDT Software MDT AutoSave · MDT Software AutoSave for Sy… +1
- CVE-2022-25017Hitron CHITA 7.2.2.0.3b6-CD devices contain a command injection vulnerability via the Device/DDNS ddnsUsername field.
- CVE-2021-1942Improper handling of permissions of a shared memory region can lead to memory corruption in Snapdragon Auto, Snapdragon Compute…Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2022-22963In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user toSpring Cloud Function · org.springframework.cloud:spring-cl…
High 44
- CVE-2022-26419Rockwell Automation Studio 5000 Logix Designer Code InjectionOmron CX-Position
- CVE-2022-26022Rockwell Automation Studio 5000 Logix Designer Out-of-Bounds WriteOmron CX-Position
- CVE-2022-26417Rockwell Automation Studio 5000 Logix Designer Use After FreeOmron CX-Position
- CVE-2022-25959Rockwell Automation Studio 5000 Logix Designer Improper Restriction of Operations within the Bounds of a Memory BufferOmron CX-Position
- CVE-2022-1159Rockwell Automation Studio 5000 Logix Designer Code InjectionRockwell Automation Studio 5000 Logix Designer
- CVE-2021-28504On Arista Strata family products which have “TCAM profile” feature enabled when Port IPv4 access-list has a rule which matches on “vxlan”…Arista Networks EOS
- CVE-2021-22277AC 800M MMS - Denial of Service vulnerability in MMS communicationABB 800xA, Control Software for AC · ABB Control Builder… +2
- CVE-2021-26624eScan Anti-Virus Local privilege escalation VulnerabilityMicroWorld Technologies eScan Anti-Virus for Linux
- CVE-2021-26623Bandisoft ARK Library Out-of-bound VulnerabilityBandisoft International Bandizip
- CVE-2022-1098Delta Electronics DIAEnergie Uncontrolledly Search Path ElementDIAEnerrgie DIAEnergie
- CVE-2021-33018Philips Vue PACS Use of a Broken or Risky Cryptographic AlgorithmPhilips Vue PACS · Philips Vue MyVue +2
- CVE-2021-33022Philips Vue PACS Cleartext Transmission of Sensitive InformationPhilips Vue PACS · Philips Vue MyVue +2
- CVE-2021-33020Philips Vue PACS Use of a Key Past its Expiration DatePhilips Vue PACS · Philips Vue MyVue +2
- CVE-2021-27501Philips Vue PACS Improper Adherence to Coding StandardsPhilips Vue PACS · Philips Vue MyVue +2
- CVE-2021-32970Moxa NPort IAW5000A-I/O Series Serial Device Server Improper Input ValidationMoxa NPort IAW5000A-I/O series firmware
- CVE-2021-32968Moxa NPort IAW5000A-I/O Series Serial Device Server Classic Buffer OverflowMoxa NPort IAW5000A-I/O Series firmware
- CVE-2021-32960Rockwell Automation FactoryTalk Services Platform Protection Mechanism FailureRockwell Automation FactoryTalk Services Platform
- CVE-2021-32945MDT AutoSave Inadequate Encryption StrengthMDT Software MDT AutoSave · MDT Software AutoSave for Sy… +1
- CVE-2021-32949MDT AutoSave Relative Path TraversalMDT Software MDT AutoSave · MDT Software AutoSave for Sy… +1
- CVE-2021-32957MDT AutoSave Uncontrolled Search Path ElementMDT Software MDT AutoSave · MDT Software AutoSave for Sy… +1
- CVE-2021-32937MDT AutoSave Generation of Error Message Containing Sensitive InformationMDT Software MDT AutoSave · MDT Software AutoSave for Sy… +1
- CVE-2021-32961MDT AutoSave Unrestricted Upload of File with Dangerous TypeMDT Software MDT AutoSave · MDT Software AutoSave for Sy… +1
- CVE-2022-24426Dell Command | Update, Dell Update, and Alienware Update version 4.4.0 contains a Local Privilege Escalation Vulnerability in the Advanced…Dell Command Update
- CVE-2022-23155Dell Wyse Management Suite versions 2.0 through 3.5.2 contain an unrestricted file upload vulnerability.Dell Wyse Management Suite
- CVE-2022-24066Command Injectionsimple-git
Show all 44 entriesShow fewer entries
- CVE-2022-21223Command Injectioncocoapods-downloader
- CVE-2022-24440Command Injectioncocoapods-downloader
- CVE-2022-21235Command Injectiongithub.com/Masterminds/vcs
- CVE-2021-36776Steve API proxy impersonationSUSE Rancher · github.com/rancher/rancher
- CVE-2021-36775Deleting PRTBs associated to a group doesn't cause deletion of corresponding RoleBindingsSUSE Rancher · github.com/rancher/rancher
- CVE-2022-21947rancher desktop: Dashboard API is network accessibleSUSE Rancher
- CVE-2021-35117An Out of Bounds read may potentially occur while processing an IBSS beacon, in Snapdragon Auto, Snapdragon Compute, Snapdragon…Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2021-35115Improper handling of multiple session supported by PVM backend can lead to use after free in Snapdragon Auto, Snapdragon MobileQualcomm Snapdragon Auto, Snapdragon Mobile
- CVE-2021-35110Possible buffer overflow to improper validation of hash segment of file while allocating memory in Snapdragon Connectivity, Snapdragon…Qualcomm Snapdragon Connectivity, Snapdragon Mobile
- CVE-2021-35106Possible out of bound read due to improper length calculation of WMI message.Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2021-35105Possible out of bounds access due to improper input validation during graphics profiling in Snapdragon Auto, Snapdragon Compute…Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2021-35103Possible out of bound write due to improper validation of number of timer values received from firmware while syncing timers in Snapdragon…Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2021-35089Possible buffer overflow due to lack of input IB amount validation while processing the user command in Snapdragon AutoQualcomm Snapdragon Auto
- CVE-2021-35088Possible out of bound read due to improper validation of IE length during SSID IE parse when channel is DFS in Snapdragon Auto, Snapdragon…Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2021-30333Improper validation of buffer size input to the EFS file can lead to memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon…Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2021-30332Possible assertion due to improper validation of OTA configuration in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity…Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2021-30329Possible assertion due to improper validation of TCI configuration in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity…Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2021-30328Possible assertion due to improper validation of invalid NR CSI-IM resource configuration in Snapdragon Auto, Snapdragon Compute…Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2021-1950Improper cleaning of secure memory between authenticated users can lead to face authentication bypass in Snapdragon Auto, Snapdragon…Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
Medium, low and unrated 50
- CVE-2022-25160Cleartext Storage of Sensitive Information vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5U(C) CPU all versions, Mitsubishi…Mitsubishi Electric MELSEC iQ-F series FX5U(C) CPU; Mitsubi…
- CVE-2022-25158Cleartext Storage of Sensitive Information vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5U(C) CPU all versions, Mitsubishi…Mitsubishi Electric MELSEC iQ-F series FX5U(C) CPU; Mitsubi…
- CVE-2022-25159Authentication Bypass by Capture-replay vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5U(C) CPU all versions, Mitsubishi…Mitsubishi Electric MELSEC iQ-F series FX5U(C) CPU; Mitsubi…
- CVE-2022-25157Use of Password Hash Instead of Password for Authentication vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5U(C) CPU all…Mitsubishi Electric MELSEC iQ-F series FX5U(C) CPU; Mitsubi…
- CVE-2022-25155Use of Password Hash Instead of Password for Authentication vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5U(C) CPU all…Mitsubishi Electric MELSEC iQ-F series FX5U(C) CPU; Mitsubi…
- CVE-2022-25156Use of Weak Hash vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5U(C) CPU all versions, Mitsubishi Electric MELSEC iQ-F series…Mitsubishi Electric MELSEC iQ-F series FX5U(C) CPU; Mitsubi…
- CVE-2022-1068Modbus Tools Modbus Slave Stack-Based Buffer OverflowModbus Tools Modbus Slave
- CVE-2020-14479ICSA-20-147-01 Inductive Automation Ignition (Update B)Inductive Automation Ignition 7 Gateway · Inductive Automat…
- CVE-2022-27534Kaspersky Anti-Virus products for home and Kaspersky Endpoint Security with antivirus databases released before 12 March 2022 had a bug in…Kaspersky Anti-Virus products for home and Kaspersky Endpoi…
- CVE-2021-27223A denial-of-service issue existed in one of modules that was incorporated in Kaspersky Anti-Virus products for home and Kaspersky Endpoint…Kaspersky Anti-Virus products for home and Kaspersky Endpoi…
- CVE-2021-20295It was discovered that the update for the virt:rhel module in the RHSA-2020:4676 (https://access.redhat.com/errata/RHSA-2020:4676) erratum…QEMU
- CVE-2021-3461A flaw was found in keycloak where keycloak may fail to logout user session if the logout request comes from external SAML identity…keycloak · org.keycloak:keycloak-parent
- CVE-2021-32503Unauthenticated users can access sensitive web URLs through GET request, which should be restricted to maintenance users only.SICK FTMg
- CVE-2022-0741Improper input validation in all versions of GitLab CE/EE using sendmail to send emails allowed an attacker to steal environment variables…GitLab
- CVE-2022-0425A DNS rebinding vulnerability in the Irker IRC Gateway integration in all versions of GitLab CE/EE since version 7.9 allows an attacker to…GitLab
- CVE-2021-39908In all versions of GitLab CE/EE starting from 0.8.0 before 14.2.6, all versions starting from 14.3 before 14.3.4, and all versions…GitLab
- CVE-2022-0373Improper access control in GitLab CE/EE versions 12.4 to 14.5.4, 14.5 to 14.6.4, and 12.6 to 14.7.1 allows project non-members to retrieve…GitLab
- CVE-2022-0390Improper access control in Gitlab CE/EE versions 12.7 to 14.5.4, 14.6 to 14.6.4, and 14.7 to 14.7.1 allowed for project non-members to…GitLab
- CVE-2022-0489An issue has been discovered in GitLab CE/EE affecting all versions starting with 8.15 .GitLab
- CVE-2021-23288Security issues in Intelligent Power ProtectorEaton Intelligent Power Protector
- CVE-2021-23287Security issues in Intelligent Power Manager (IPM 1)Eaton Intelligent Power Manager
- CVE-2022-22950n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expSpring Framework · org.springframework:spring-expression
- CVE-2021-3847An unauthorized access to the execution of the setuid file with capabilities flaw in the Linux kernel OverlayFS subsystem was found in the…kernel
- CVE-2019-14839It was observed that while login into Business-central console, HTTP request discloses sensitive information like username and password…Business-central
- CVE-2021-23247A command injection vulerability found in quick game engine allows arbitrary remote code in quick app.OPPO Quick App
Show all 50 entriesShow fewer entries
- CVE-2021-20238It was found in OpenShift Container Platform 4 that ignition config, served by the Machine Config Server, can be accessed externally from…openshift/machine-config-operator
- CVE-2022-1018ICSA-22-088-01 Rockwell Automation ISaGRAFRockwell Automation Connected Component Workbench · Rock… +1
- CVE-2022-0922ICSMA-22-088-01 Philips e-AlertPhilips e-Alert
- CVE-2021-27497Philips Vue PACS Protection Mechanism FailurePhilips Vue PACS · Philips Vue MyVue +2
- CVE-2021-33024Philips Vue PACS Insufficiently Protected CredentialsPhilips Vue PACS · Philips Vue MyVue +2
- CVE-2021-27493Philips Vue PACSPhilips Vue PACS · Philips Vue MyVue +2
- CVE-2022-27177A Python format string issue leading to information disclosure and potentially remote code execution in ConsoleMe for all versions prior…ConsoleMe
- CVE-2022-22570A buffer overflow vulnerability found in the UniFi Door Access Reader Lite’s (UA Lite) firmware (Version 3.8.28.24 and earlier) allows a…UniFi Door Access Reader Lite
- CVE-2022-21830A blind self XSS vulnerability exists in RocketChat LiveChat <v1.9 that could allow an attacker to trick a victim pasting malicious code…Rocket.chat Livechat · @rocket.chat/livechat
- CVE-2022-26565A cross-site scripting (XSS) vulnerability in Totaljs all versions before commit 95f54a5commit, allows attackers to execute arbitrary web…
- CVE-2022-23158Wyse Device Agent version 14.6.1.4 and below contain a sensitive data exposure vulnerability.Dell Wyse Device Agent
- CVE-2022-23157Wyse Device Agent version 14.6.1.4 and below contain a sensitive data exposure vulnerability.Dell Wyse Device Agent
- CVE-2022-23156Wyse Device Agent version 14.6.1.4 and below contain an Improper Authentication vulnerability.Dell Wyse Device Agent
- CVE-2022-1207Out-of-bounds read in radareorg/radare2radareorg/radare2
- CVE-2022-22404IBM App Connect Enterprise Certified Container Dashboard UI (IBM App Connect Enterprise Certified Container 1.5, 2.0, 2.1, 3.0, and 3.1)…IBM App Connect Enterprise Certified Container
- CVE-2022-22332IBM Sterling Partner Engagement Manager 6.2.0 could allow an attacker to impersonate another user due to missing revocation mechanism for…IBM Sterling Partner Engagement Manager
- CVE-2022-22331IBM SterlingPartner Engagement Manager 6.2.0 could allow a remote authenticated attacker to obtain sensitive information or modify user…IBM SterlingPartner Engagement Manager
- CVE-2022-22328IBM SterlingPartner Engagement Manager 6.2.0 could allow a malicious user to elevate their privileges and perform unintended operations to…IBM SterlingPartner Engagement Manager
- CVE-2022-22327IBM UrbanCode Deploy (UCD) 7.0.5, 7.1.0, 7.1.1, and 7.1.2 uses weaker than expected cryptographic algorithms that could allow an attacker…IBM UrbanCode Deploy
- CVE-2021-44135pagekit all versions, as of 15-10-2021, is vulnerable to SQL Injection via Comment listing.pagekit/pagekit
- CVE-2022-24181Cross-site scripting (XSS) via Host Header injection in PKP Open Journals System 2.4.8 >= 3.3 allows remote attackers to inject arbitary…
- CVE-2021-30331Possible buffer overflow due to improper data validation of external commands sent via DIAG interface in Snapdragon Auto, Snapdragon…Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-25691A flaw was found in darkhttpd.darkhttpd
- CVE-2021-33657There is a heap overflow problem in video/SDL_pixels.c in SDL (Simple DirectMedia Layer) 2.x to 2.0.18 versions.SDL2
- CVE-2022-26562An issue in provider/libserver/ECKrbAuth.cpp of Kopano Core <= v11.0.2.51 contains an issue which allows attackers to authenticate even if…