CVEs published April 1, 2022
102 CVEs were published on April 1, 2022: 8 critical, 44 high. 2 are now in CISA KEV.
- Published
- 102
- Critical
- 8
- High
- 44
- Medium
- 23
- Low
- 2
- Unrated
- 25
- Now in CISA KEV
- 2
- Fix available
- 38
Most affected products
- Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- 12
- MDT Software MDT AutoSave · MDT Software AutoSave for Sy… +1
- 7
- Philips Vue PACS · Philips Vue MyVue +2
- 7
- GitLab
- 6
- Mitsubishi Electric MELSEC iQ-F series FX5U(C) CPU; Mitsubi…
- 6
- Omron CX-Position
- 4
- Dell Wyse Device Agent
- 3
- Moxa NPort IAW5000A-I/O series firmware
- 3
- cocoapods-downloader
- 2
- IBM SterlingPartner Engagement Manager
- 2
Critical 8
- CVE-2022-22965A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.Spring Framework · org.springframework:spring-beans +4
- CVE-2021-32976Moxa NPort IAW5000A-I/O Series Serial Device Server Stack-based Buffer OverflowMoxa NPort IAW5000A-I/O series firmware
- CVE-2021-32974Moxa NPort IAW5000A-I/O Series Serial Device Server Improper Input ValidationMoxa NPort IAW5000A-I/O series firmware
- CVE-2021-32933MDT AutoSave Command InjectionMDT Software MDT AutoSave · MDT Software AutoSave for Sy… +1
- CVE-2021-32953MDT AutoSave SQL InjectionMDT Software MDT AutoSave · MDT Software AutoSave for Sy… +1
- CVE-2022-25017Hitron CHITA 7.2.2.0.3b6-CD devices contain a command injection vulnerability via the Device/DDNS ddnsUsername field.
- CVE-2021-1942Improper handling of permissions of a shared memory region can lead to memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2022-22963In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user toSpring Cloud Function · org.springframework.cloud:spring-cl…
High 44
- CVE-2022-26419Rockwell Automation Studio 5000 Logix Designer Code InjectionOmron CX-Position
- CVE-2022-26022Rockwell Automation Studio 5000 Logix Designer Out-of-Bounds WriteOmron CX-Position
- CVE-2022-26417Rockwell Automation Studio 5000 Logix Designer Use After FreeOmron CX-Position
- CVE-2022-25959Rockwell Automation Studio 5000 Logix Designer Improper Restriction of Operations within the Bounds of a Memory BufferOmron CX-Position
- CVE-2022-1159Rockwell Automation Studio 5000 Logix Designer Code InjectionRockwell Automation Studio 5000 Logix Designer
- CVE-2021-28504On Arista Strata family products which have “TCAM profile” feature enabled when Port IPv4 access-list has a rule which matches on “vxlan” as protocol then that rule and subsequent rules ( rules declared after it in ACL ) do not match on IP protocol fi ...Arista Networks EOS
- CVE-2021-22277AC 800M MMS - Denial of Service vulnerability in MMS communicationABB 800xA, Control Software for AC · ABB Control Builder… +2
- CVE-2021-26624eScan Anti-Virus Local privilege escalation VulnerabilityMicroWorld Technologies eScan Anti-Virus for Linux
- CVE-2021-26623Bandisoft ARK Library Out-of-bound VulnerabilityBandisoft International Bandizip
- CVE-2022-1098Delta Electronics DIAEnergie Uncontrolledly Search Path ElementDIAEnerrgie DIAEnergie
- CVE-2021-33018Philips Vue PACS Use of a Broken or Risky Cryptographic AlgorithmPhilips Vue PACS · Philips Vue MyVue +2
- CVE-2021-33022Philips Vue PACS Cleartext Transmission of Sensitive InformationPhilips Vue PACS · Philips Vue MyVue +2
- CVE-2021-33020Philips Vue PACS Use of a Key Past its Expiration DatePhilips Vue PACS · Philips Vue MyVue +2
- CVE-2021-27501Philips Vue PACS Improper Adherence to Coding StandardsPhilips Vue PACS · Philips Vue MyVue +2
- CVE-2021-32970Moxa NPort IAW5000A-I/O Series Serial Device Server Improper Input ValidationMoxa NPort IAW5000A-I/O series firmware
- CVE-2021-32968Moxa NPort IAW5000A-I/O Series Serial Device Server Classic Buffer OverflowMoxa NPort IAW5000A-I/O Series firmware
- CVE-2021-32960Rockwell Automation FactoryTalk Services Platform Protection Mechanism FailureRockwell Automation FactoryTalk Services Platform
- CVE-2021-32945MDT AutoSave Inadequate Encryption StrengthMDT Software MDT AutoSave · MDT Software AutoSave for Sy… +1
- CVE-2021-32949MDT AutoSave Relative Path TraversalMDT Software MDT AutoSave · MDT Software AutoSave for Sy… +1
- CVE-2021-32957MDT AutoSave Uncontrolled Search Path ElementMDT Software MDT AutoSave · MDT Software AutoSave for Sy… +1
- CVE-2021-32937MDT AutoSave Generation of Error Message Containing Sensitive InformationMDT Software MDT AutoSave · MDT Software AutoSave for Sy… +1
- CVE-2021-32961MDT AutoSave Unrestricted Upload of File with Dangerous TypeMDT Software MDT AutoSave · MDT Software AutoSave for Sy… +1
- CVE-2022-24426Dell Command | Update, Dell Update, and Alienware Update version 4.4.0 contains a Local Privilege Escalation Vulnerability in the Advanced DDell Command Update
- CVE-2022-23155Dell Wyse Management Suite versions 2.0 through 3.5.2 contain an unrestricted file upload vulnerability.Dell Wyse Management Suite
- CVE-2022-24066Command Injectionsimple-git
- CVE-2022-21223Command Injectioncocoapods-downloader
- CVE-2022-24440Command Injectioncocoapods-downloader
- CVE-2022-21235Command Injectiongithub.com/Masterminds/vcs
- CVE-2021-36776Steve API proxy impersonationSUSE Rancher · github.com/rancher/rancher
- CVE-2021-36775Deleting PRTBs associated to a group doesn't cause deletion of corresponding RoleBindingsSUSE Rancher · github.com/rancher/rancher
- CVE-2022-21947rancher desktop: Dashboard API is network accessibleSUSE Rancher
- CVE-2021-35117An Out of Bounds read may potentially occur while processing an IBSS beacon, in Snapdragon Auto, Snapdragon Compute, Snapdragon ConnectivityQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2021-35115Improper handling of multiple session supported by PVM backend can lead to use after free in Snapdragon Auto, Snapdragon MobileQualcomm Snapdragon Auto, Snapdragon Mobile
- CVE-2021-35110Possible buffer overflow to improper validation of hash segment of file while allocating memory in Snapdragon Connectivity, Snapdragon MobilQualcomm Snapdragon Connectivity, Snapdragon Mobile
- CVE-2021-35106Possible out of bound read due to improper length calculation of WMI message.Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2021-35105Possible out of bounds access due to improper input validation during graphics profiling in Snapdragon Auto, Snapdragon Compute, Snapdragon Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2021-35103Possible out of bound write due to improper validation of number of timer values received from firmware while syncing timers in Snapdragon AQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2021-35089Possible buffer overflow due to lack of input IB amount validation while processing the user command in Snapdragon AutoQualcomm Snapdragon Auto
- CVE-2021-35088Possible out of bound read due to improper validation of IE length during SSID IE parse when channel is DFS in Snapdragon Auto, Snapdragon CQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2021-30333Improper validation of buffer size input to the EFS file can lead to memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon CoQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2021-30332Possible assertion due to improper validation of OTA configuration in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, SnapdragQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2021-30329Possible assertion due to improper validation of TCI configuration in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, SnapdragQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2021-30328Possible assertion due to improper validation of invalid NR CSI-IM resource configuration in Snapdragon Auto, Snapdragon Compute, SnapdragonQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2021-1950Improper cleaning of secure memory between authenticated users can lead to face authentication bypass in Snapdragon Auto, Snapdragon ComputeQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
Medium, low and unrated 50
- CVE-2022-25160Cleartext Storage of Sensitive Information vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5U(C) CPU all versions, Mitsubishi ElecMitsubishi Electric MELSEC iQ-F series FX5U(C) CPU; Mitsubi…
- CVE-2022-25158Cleartext Storage of Sensitive Information vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5U(C) CPU all versions, Mitsubishi ElecMitsubishi Electric MELSEC iQ-F series FX5U(C) CPU; Mitsubi…
- CVE-2022-25159Authentication Bypass by Capture-replay vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5U(C) CPU all versions, Mitsubishi ElectriMitsubishi Electric MELSEC iQ-F series FX5U(C) CPU; Mitsubi…
- CVE-2022-25157Use of Password Hash Instead of Password for Authentication vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5U(C) CPU all versionsMitsubishi Electric MELSEC iQ-F series FX5U(C) CPU; Mitsubi…
- CVE-2022-25155Use of Password Hash Instead of Password for Authentication vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5U(C) CPU all versionsMitsubishi Electric MELSEC iQ-F series FX5U(C) CPU; Mitsubi…
- CVE-2022-25156Use of Weak Hash vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5U(C) CPU all versions, Mitsubishi Electric MELSEC iQ-F series FXMitsubishi Electric MELSEC iQ-F series FX5U(C) CPU; Mitsubi…
- CVE-2022-1068Modbus Tools Modbus Slave Stack-Based Buffer OverflowModbus Tools Modbus Slave
- CVE-2020-14479ICSA-20-147-01 Inductive Automation Ignition (Update B)Inductive Automation Ignition 7 Gateway · Inductive Automat…
- CVE-2022-27534Kaspersky Anti-Virus products for home and Kaspersky Endpoint Security with antivirus databases released before 12 March 2022 had a bug in aKaspersky Anti-Virus products for home and Kaspersky Endpoi…
- CVE-2021-27223A denial-of-service issue existed in one of modules that was incorporated in Kaspersky Anti-Virus products for home and Kaspersky Endpoint SKaspersky Anti-Virus products for home and Kaspersky Endpoi…
- CVE-2021-20295It was discovered that the update for the virt:rhel module in the RHSA-2020:4676 (https://access.redhat.com/errata/RHSA-2020:4676) erratum rQEMU
- CVE-2021-3461A flaw was found in keycloak where keycloak may fail to logout user session if the logout request comes from external SAML identity providerkeycloak · org.keycloak:keycloak-parent
- CVE-2021-32503Unauthenticated users can access sensitive web URLs through GET request, which should be restricted to maintenance users only.SICK FTMg
- CVE-2022-0741Improper input validation in all versions of GitLab CE/EE using sendmail to send emails allowed an attacker to steal environment variables vGitLab
- CVE-2022-0425A DNS rebinding vulnerability in the Irker IRC Gateway integration in all versions of GitLab CE/EE since version 7.9 allows an attacker to tGitLab
- CVE-2021-39908In all versions of GitLab CE/EE starting from 0.8.0 before 14.2.6, all versions starting from 14.3 before 14.3.4, and all versions starting GitLab
- CVE-2022-0373Improper access control in GitLab CE/EE versions 12.4 to 14.5.4, 14.5 to 14.6.4, and 12.6 to 14.7.1 allows project non-members to retrieve tGitLab
- CVE-2022-0390Improper access control in Gitlab CE/EE versions 12.7 to 14.5.4, 14.6 to 14.6.4, and 14.7 to 14.7.1 allowed for project non-members to retriGitLab
- CVE-2022-0489An issue has been discovered in GitLab CE/EE affecting all versions starting with 8.15 .GitLab
- CVE-2021-23288Security issues in Intelligent Power ProtectorEaton Intelligent Power Protector
- CVE-2021-23287Security issues in Intelligent Power Manager (IPM 1)Eaton Intelligent Power Manager
- CVE-2022-22950n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expSpring Framework · org.springframework:spring-expression
- CVE-2021-3847An unauthorized access to the execution of the setuid file with capabilities flaw in the Linux kernel OverlayFS subsystem was found in the wkernel
- CVE-2019-14839It was observed that while login into Business-central console, HTTP request discloses sensitive information like username and password whenBusiness-central
- CVE-2021-23247A command injection vulerability found in quick game engine allows arbitrary remote code in quick app.OPPO Quick App
- CVE-2021-20238It was found in OpenShift Container Platform 4 that ignition config, served by the Machine Config Server, can be accessed externally from clopenshift/machine-config-operator
- CVE-2022-1018ICSA-22-088-01 Rockwell Automation ISaGRAFRockwell Automation Connected Component Workbench · Rock… +1
- CVE-2022-0922ICSMA-22-088-01 Philips e-AlertPhilips e-Alert
- CVE-2021-27497Philips Vue PACS Protection Mechanism FailurePhilips Vue PACS · Philips Vue MyVue +2
- CVE-2021-33024Philips Vue PACS Insufficiently Protected CredentialsPhilips Vue PACS · Philips Vue MyVue +2
- CVE-2021-27493Philips Vue PACS Philips Vue PACS · Philips Vue MyVue +2
- CVE-2022-27177A Python format string issue leading to information disclosure and potentially remote code execution in ConsoleMe for all versions prior to ConsoleMe
- CVE-2022-22570A buffer overflow vulnerability found in the UniFi Door Access Reader Lite’s (UA Lite) firmware (Version 3.8.28.24 and earlier) allows a malUniFi Door Access Reader Lite
- CVE-2022-21830A blind self XSS vulnerability exists in RocketChat LiveChat <v1.9 that could allow an attacker to trick a victim pasting malicious code in Rocket.chat Livechat · @rocket.chat/livechat
- CVE-2022-26565A cross-site scripting (XSS) vulnerability in Totaljs all versions before commit 95f54a5commit, allows attackers to execute arbitrary web sc
- CVE-2022-23158Wyse Device Agent version 14.6.1.4 and below contain a sensitive data exposure vulnerability.Dell Wyse Device Agent
- CVE-2022-23157Wyse Device Agent version 14.6.1.4 and below contain a sensitive data exposure vulnerability.Dell Wyse Device Agent
- CVE-2022-23156Wyse Device Agent version 14.6.1.4 and below contain an Improper Authentication vulnerability.Dell Wyse Device Agent
- CVE-2022-1207Out-of-bounds read in radareorg/radare2radareorg/radare2
- CVE-2022-22404IBM App Connect Enterprise Certified Container Dashboard UI (IBM App Connect Enterprise Certified Container 1.5, 2.0, 2.1, 3.0, and 3.1) mayIBM App Connect Enterprise Certified Container
- CVE-2022-22332IBM Sterling Partner Engagement Manager 6.2.0 could allow an attacker to impersonate another user due to missing revocation mechanism for thIBM Sterling Partner Engagement Manager
- CVE-2022-22331IBM SterlingPartner Engagement Manager 6.2.0 could allow a remote authenticated attacker to obtain sensitive information or modify user detaIBM SterlingPartner Engagement Manager
- CVE-2022-22328IBM SterlingPartner Engagement Manager 6.2.0 could allow a malicious user to elevate their privileges and perform unintended operations to aIBM SterlingPartner Engagement Manager
- CVE-2022-22327IBM UrbanCode Deploy (UCD) 7.0.5, 7.1.0, 7.1.1, and 7.1.2 uses weaker than expected cryptographic algorithms that could allow an attacker toIBM UrbanCode Deploy
- CVE-2021-44135pagekit all versions, as of 15-10-2021, is vulnerable to SQL Injection via Comment listing.pagekit/pagekit
- CVE-2022-24181Cross-site scripting (XSS) via Host Header injection in PKP Open Journals System 2.4.8 >= 3.3 allows remote attackers to inject arbitary cod
- CVE-2021-30331Possible buffer overflow due to improper data validation of external commands sent via DIAG interface in Snapdragon Auto, Snapdragon ComputeQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-25691A flaw was found in darkhttpd.darkhttpd
- CVE-2021-33657There is a heap overflow problem in video/SDL_pixels.c in SDL (Simple DirectMedia Layer) 2.x to 2.0.18 versions.SDL2
- CVE-2022-26562An issue in provider/libserver/ECKrbAuth.cpp of Kopano Core <= v11.0.2.51 contains an issue which allows attackers to authenticate even if t