# CVEs published 2022-04-03

25 CVEs were published on April 3, 2022: 0 critical, 2 high. Days are UTC.

- [CVE-2022-27249](https://cve.now/CVE-2022-27249.md): An unrestricted file upload vulnerability in IdeaRE RefTree before 2021.09.17 allows remote authenticated users to execute arbitrary code by (no CVSS)
- [CVE-2022-27248](https://cve.now/CVE-2022-27248.md): A directory traversal vulnerability in IdeaRE RefTree before 2021.09.17 allows remote authenticated users to download arbitrary .dwg files f (no CVSS)
- [CVE-2022-26530](https://cve.now/CVE-2022-26530.md): swaylock before 1.6 allows attackers to trigger a crash and achieve unlocked access to a Wayland compositor. (no CVSS)
- [CVE-2022-26233](https://cve.now/CVE-2022-26233.md): Barco Control Room Management through Suite 2.9 Build 0275 was discovered to be vulnerable to directory traversal, allowing attackers to acc (no CVSS)
- [CVE-2021-30066](https://cve.now/CVE-2021-30066.md): On Schneider Electric ConneXium Tofino Firewall TCSEFEA23F3F22 before 03.23, TCSEFEA23F3F20/21, and Belden Tofino Xenon Security Appliance, (no CVSS)
- [CVE-2021-30065](https://cve.now/CVE-2021-30065.md): On Schneider Electric ConneXium Tofino Firewall TCSEFEA23F3F22 before 03.23, TCSEFEA23F3F20/21, and Belden Tofino Xenon Security Appliance, (CVSS 7.5)
- [CVE-2021-30064](https://cve.now/CVE-2021-30064.md): On Schneider Electric ConneXium Tofino Firewall TCSEFEA23F3F22 before 03.23, TCSEFEA23F3F20/21, and Belden Tofino Xenon Security Appliance, (no CVSS)
- [CVE-2021-30063](https://cve.now/CVE-2021-30063.md): On Schneider Electric ConneXium Tofino OPCLSM TCSEFM0000 before 03.23 and Belden Tofino Xenon Security Appliance, crafted OPC packets can ca (no CVSS)
- [CVE-2021-30062](https://cve.now/CVE-2021-30062.md): On Schneider Electric ConneXium Tofino OPCLSM TCSEFM0000 before 03.23 and Belden Tofino Xenon Security Appliance, crafted OPC packets can by (no CVSS)
- [CVE-2021-30061](https://cve.now/CVE-2021-30061.md): On Schneider Electric ConneXium Tofino Firewall TCSEFEA23F3F22 before 03.23, TCSEFEA23F3F20/21, and Belden Tofino Xenon Security Appliance, (no CVSS)
- [CVE-2022-28391](https://cve.now/CVE-2022-28391.md): BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compat (CVSS 8.8)
- [CVE-2022-28388](https://cve.now/CVE-2022-28388.md): usb\_8dev\_start\_xmit in drivers/net/can/usb/usb\_8dev.c in the Linux kernel through 5.17.1 has a double free. (CVSS 5.5)
- [CVE-2022-28389](https://cve.now/CVE-2022-28389.md): mcba\_usb\_start\_xmit in drivers/net/can/usb/mcba\_usb.c in the Linux kernel through 5.17.1 has a double free. (no CVSS)
- [CVE-2022-28390](https://cve.now/CVE-2022-28390.md): ems\_usb\_start\_xmit in drivers/net/can/usb/ems\_usb.c in the Linux kernel through 5.17.1 has a double free. (no CVSS)
- [CVE-2022-0406](https://cve.now/CVE-2022-0406.md): Improper Authorization in janeczku/calibre-web (CVSS 4.3, janeczku/calibre-web)
- [CVE-2022-28381](https://cve.now/CVE-2022-28381.md): Mediaserver.exe in ALLMediaServer 1.6 has a stack-based buffer overflow that allows remote attackers to execute arbitrary code via a long st (no CVSS)
- [CVE-2022-0405](https://cve.now/CVE-2022-0405.md): Improper Access Control in janeczku/calibre-web (CVSS 4.3, janeczku/calibre-web)
- [CVE-2022-28380](https://cve.now/CVE-2022-28380.md): The rc-httpd component through 2022-03-31 for 9front (Plan 9 fork) allows ..%2f directory traversal if serve-static is used. (no CVSS)
- [CVE-2022-28379](https://cve.now/CVE-2022-28379.md): jc21.com Nginx Proxy Manager before 2.9.17 allows XSS during item deletion. (CVSS 6.8)
- [CVE-2022-28378](https://cve.now/CVE-2022-28378.md): Craft CMS before 3.7.29 allows XSS. (no CVSS, craftcms/cms)
- [CVE-2022-1211](https://cve.now/CVE-2022-1211.md): tildearrow Furnace FUR to VGM Converter stack-based overflow (CVSS 6.3, tildearrow Furnace)
- [CVE-2022-0088](https://cve.now/CVE-2022-0088.md): Cross-Site Request Forgery (CSRF) in yourls/yourls (CVSS 3.5, yourls/yourls)
- [CVE-2022-28376](https://cve.now/CVE-2022-28376.md): Verizon 5G Home LVSKIHP outside devices through 2022-02-15 allow anyone (knowing the device's serial number) to access a CPE admin website, (no CVSS)
- [CVE-2022-1210](https://cve.now/CVE-2022-1210.md): LibTIFF tiff2ps resource consumption (CVSS 4.3, LibTIFF)
- [CVE-2022-28368](https://cve.now/CVE-2022-28368.md): Dompdf 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets (CSS) statement (with (no CVSS, dompdf/dompdf)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-04-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.