CVEs published April 4, 2022
106 CVEs were published on April 4, 2022: 6 critical, 16 high. 1 is now in CISA KEV.
- Published
- 106
- Critical
- 6
- High
- 16
- Medium
- 19
- Low
- 5
- Unrated
- 60
- Now in CISA KEV
- 1
- Fix available
- 60
Most affected products
- GitLab
- 14
- Google Chrome
- 7
- Automation Direct CLICK PLC CPU Modules: C0-1x CPUs
- 5
- AVEVA System Platform
- 5
- HPE OneView
- 4
- phpipam/phpipam
- 3
- Forcepoint One Endpoint
- 2
- janeczku/calibre-web
- 2
- Noo JobMonster
- 2
- Ad Inserter – Ad Manager & AdSense Ads · Ad Inserter Pro
- 1
Critical 6
- CVE-2022-1162A hardcoded password was set for accounts registered using an OmniAuth provider (e.g.GitLab
- CVE-2021-32986Automation Direct CLICK PLC CPU Modules Authentication Bypass Using an Alternate Path or ChannelAutomation Direct CLICK PLC CPU Modules: C0-1x CPUs
- CVE-2021-32984Automation Direct CLICK PLC CPU Modules Authentication Bypass Using an Alternate Path or ChannelAutomation Direct CLICK PLC CPU Modules: C0-1x CPUs
- CVE-2021-32980Automation Direct CLICK PLC CPU Modules Authentication Bypass Using an Alternate Path or ChannelAutomation Direct CLICK PLC CPU Modules: C0-1x CPUs
- CVE-2022-0990Server-Side Request Forgery (SSRF) in janeczku/calibre-webjaneczku/calibre-web
- CVE-2022-0939Server-Side Request Forgery (SSRF) in janeczku/calibre-webjaneczku/calibre-web
High 16
- CVE-2022-0609Use after free in Animation in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a cGoogle Chrome · CefSharp.Common +8
- CVE-2022-1175Improper neutralization of user input in GitLab CE/EE versions 14.4 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versioGitLab
- CVE-2022-1190Improper handling of user input in GitLab CE/EE versions 8.3 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowed an attaGitLab
- CVE-2021-32994Softing OPC-UA C++ SDK Improper Restriction of Operations within the Bounds of a Memory BufferSofting OPC UA C++ SDK
- CVE-2021-32982Automation Direct CLICK PLC CPU Modules Cleartext Transmission of Sensitive InformationAutomation Direct CLICK PLC CPU Modules: C0-1x CPUs
- CVE-2021-32978Automation Direct CLICK PLC CPU Modules Plaintext Storage of a PasswordAutomation Direct CLICK PLC CPU Modules: C0-1x CPUs
- CVE-2021-33008AVEVA System Platform Missing Authentication for Critical FunctionAVEVA System Platform
- CVE-2021-32981AVEVA System Platform Path TraversalAVEVA System Platform
- CVE-2021-32985AVEVA System Platform Origin Validation ErrorAVEVA System Platform
- CVE-2021-33010AVEVA System Platform Uncaught ExceptionAVEVA System Platform
- CVE-2021-32977AVEVA System Platform Improper Verification of Cryptographic SignatureAVEVA System Platform
- CVE-2022-24814Cross-site Scripting in Directusdirectus
- CVE-2022-24787Incorrect Comparison in Vypervyperlang vyper · vyper
- CVE-2022-24801HTTP Request Smuggling in twisted.webtwisted
- CVE-2022-1026Kyocera Net View Address Book ExposureKyocera Multifunction Printer Net Viewer
- CVE-2022-24785Path Traversal in Moment.jsmoment · Moment.js
Medium, low and unrated 84
- CVE-2022-0610Inappropriate implementation in Gamepad API in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap coGoogle Chrome
- CVE-2022-0608Integer overflow in Mojo in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a crafGoogle Chrome
- CVE-2022-0607Use after free in GPU in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a craftedGoogle Chrome
- CVE-2022-0606Use after free in ANGLE in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a craftGoogle Chrome
- CVE-2022-0605Use after free in Webstore API in Google Chrome prior to 98.0.4758.102 allowed an attacker who convinced a user to install a malicious extenGoogle Chrome
- CVE-2022-0604Heap buffer overflow in Tab Groups in Google Chrome prior to 98.0.4758.102 allowed an attacker who convinced a user to install a malicious eGoogle Chrome
- CVE-2022-0603Use after free in File Manager in Google Chrome on Chrome OS prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap coGoogle Chrome
- CVE-2022-27441A stored cross-site scripting (XSS) vulnerability in TPCMS v3.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payl
- CVE-2022-27442TPCMS v3.2 allows attackers to access the ThinkPHP log directory and obtain sensitive information such as the administrator's user name and
- CVE-2021-36826WordPress WP Project Manager plugin <= 2.4.13 - Stored Cross-Site Scripting (XSS) vulnerabilityweDevs WP Project Manager
- CVE-2021-36851WordPress Testimonial Slider plugin <= 3.5.8.3 - Cross-Site Scripting (XSS) vulnerabilityWeb-Settler Testimonial Slider – Free Testimonials Slider P…
- CVE-2022-25618WordPress wpDataTables plugin <= 2.1.27 - Stored Cross-Site Scripting (XSS) vulnerabilityTMS-Plugins wpDataTables – Tables & Table Charts
- CVE-2022-25613WordPress FV Flowplayer Video Player plugin <= 7.5.18.727 - Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilityFolioVision FV Flowplayer Video Player
- CVE-2022-1148Improper authorization in GitLab Pages included with GitLab CE/EE affecting all versions from 11.5 prior to 14.7.7, 14.8 prior to 14.8.5, anGitLab
- CVE-2022-1121A lack of appropriate timeouts in GitLab Pages included in GitLab CE/EE all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior tGitLab Pages
- CVE-2022-1111A business logic error in Project Import in GitLab CE/EE versions 14.9 prior to 14.9.2, 14.8 prior to 14.8.5, and 14.0 prior to 14.7.7 underGitLab
- CVE-2022-1185A denial of service vulnerability when rendering RDoc files in GitLab CE/EE versions 10 to 14.7.7, 14.8.0 to 14.8.5, and 14.9.0 to 14.9.2 alGitLab
- CVE-2022-1120Missing filtering in an error message in GitLab CE/EE affecting all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2GitLab
- CVE-2022-1174A potential DoS vulnerability was discovered in Gitlab CE/EE versions 13.7 before 14.7.7, all versions starting from 14.8 before 14.8.5, allGitLab
- CVE-2022-1188An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.1 before 14.7.7, all versions starting from 14.8 beforeGitLab
- CVE-2022-1105An improper access control vulnerability in GitLab CE/EE affecting all versions from 13.11 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 pGitLab
- CVE-2022-1099Adding a very large number of tags to a runner in GitLab CE/EE affecting all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior GitLab
- CVE-2022-1100A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions from 13.1 prior to 14.7.7, 14.8.0 prior to 14.8.5, and 1GitLab
- CVE-2022-1189An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.2 before 14.7.7, all versions starting from 14.8 beforeGitLab
- CVE-2022-0740Incorrect authorization in the Asana integration's branch restriction feature in all versions of GitLab CE/EE starting from version 7.8.0 beGitLab
- CVE-2022-27650A flaw was found in crun where containers were incorrectly started with non-empty default permissions.crun
- CVE-2022-27651A flaw was found in buildah where containers were incorrectly started with non-empty default permissions.buildah · github.com/containers/buildah
- CVE-2022-27649A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions.podman · github.com/containers/podman/v4 +3
- CVE-2022-23700A local unauthorized read access to files vulnerability was discovered in HPE OneView version(s): Prior to 6.6.HPE OneView
- CVE-2022-23699A local authentication restriction bypass vulnerability was discovered in HPE OneView version(s): Prior to 6.6.HPE OneView
- CVE-2022-23698A remote unauthenticated disclosure of information vulnerability was discovered in HPE OneView version(s): Prior to 6.6.HPE OneView
- CVE-2022-23697A remote cross-site scripting (xss) vulnerability was discovered in HPE OneView version(s): Prior to 6.6.HPE OneView
- CVE-2022-27609Forcepoint One Endpoint prior to version 22.01 installed on Microsoft Windows does not provide sufficient anti-tampering protection of serviForcepoint One Endpoint
- CVE-2022-27608Forcepoint One Endpoint prior to version 22.01 installed on Microsoft Windows is vulnerable to registry key tampering by users with AdministForcepoint One Endpoint
- CVE-2022-1233URL Confusion When Scheme Not Supplied in medialize/uri.jsmedialize/uri.js · urijs
- CVE-2022-26572Xerox ColorQube 8580 was discovered to contain an access control issue which allows attackers to print, view the status, and obtain sensitiv
- CVE-2022-24813Authentication Bypass Using an Alternate Path or Channel in CreateWikimiraheze CreateWiki
- CVE-2021-43464A Remiote Code Execution (RCE) vulnerability exiss in Subrion CMS 4.2.1 via modified code in a background field; when the information is modintelliants/subrion
- CVE-2022-25569Bettini Srl GAMS Product Line v4.3.0 was discovered to re-use static SSH keys across installations, allowing unauthenticated attackers to lo
- CVE-2020-28062An Access Control vulnerability exists in HisiPHP 2.0.11 via special packets that are constructed in $files = Dir::getList($decompath.
- CVE-2021-43463An Unquoted Service Path vulnerability exists in Ext2Fsd v0.68 via a specially crafted file in the Ext2Srv Service executable service path.
- CVE-2021-43462A Cross Site Scripting (XSS) vulnerability exists in Rumble Mail Server 0.51.3135 via the username parameter.
- CVE-2022-1170JobMonster < 4.5.2.9 - Unauthenticated Reflected Cross-Site ScriptingNoo JobMonster
- CVE-2022-1169Careerfy < 3.9.0 - Unauthenticated Reflected Cross-Site Scripting (XSS)Careerfy
- CVE-2022-1168JobSearch < 1.5.1 - Unauthenticated Reflected Cross-Site Scripting (XSS)WP JobSearch
- CVE-2022-1167CareerUp < 2.3.1 - Unauthenticated Reflected Cross-Site ScriptingCareerup
- CVE-2022-1166JobMonster < 4.6.6.1 - Directory Listing in Upload FolderNoo JobMonster
- CVE-2022-1165Blackhole for Bad Bots < 3.3.2 - Arbitrary IP Address Blocking via IP SpoofingBlackhole for Bad Bots
- CVE-2022-1164Wyzi < 2.4.3 - Reflected Cross-Site Scripting (XSS)WYZI Business Finder
- CVE-2022-0958Mark Posts < 2.0.1 - Admin+ Stored Cross-Site ScriptingMark Posts
- CVE-2022-0901Ad Inserter < 2.7.12 - Reflected Cross-Site ScriptingAd Inserter – Ad Manager & AdSense Ads · Ad Inserter Pro
- CVE-2022-0887Easy Social Icons < 3.1.4 - Admin+ SQL InjectionEasy Social Icons
- CVE-2022-0884Profile Builder < 3.6.8 - Admin+ Stored Cross-Site ScriptingProfile Builder – User Profile & User Registration Forms
- CVE-2022-0864UpdraftPlus < 1.22.9 - Reflected Cross-Site ScriptingUpdraftPlus WordPress Backup Plugin
- CVE-2022-0837Amelia < 1.0.48 - Customer+ SMS Service Abuse and Sensitive Data DisclosureAmelia
- CVE-2022-0830FormBuilder <= 1.08 - Stored Cross-Site Scripting via CSRFFormBuilder
- CVE-2022-0825Amelia < 1.0.49 - Customer+ Arbitrary Appointments Status UpdateAmelia – Events & Appointments Booking Calendar
- CVE-2022-0709Booking Package < 1.5.29 - Unauthenticated Sensitive Data DisclosureBooking Package – Appointment Booking Calendar System
- CVE-2022-0537MapPress Maps for WordPress < 2.73.13 - Admin+ File Upload to Remote Code ExecutionMapPress Maps for WordPress
- CVE-2022-0431Google Pagespeed Insights < 4.0.4 - Reflected Cross-Site ScriptingInsights from Google PageSpeed
- CVE-2022-0404Material Design for Contact Form 7 <= 2.6.4 - Subscriber+ Arbitrary Settings Update leading to DoSMaterial Design for Contact Form
- CVE-2022-0403Library File Manager < 5.2.3 - Subscriber+ Arbitrary File Creation/Upload/DeletionLibrary File Manager
- CVE-2021-25113Dropdown Menu Widget <= 1.9.7 - Subscriber+ Arbitrary Settings Update to Stored XSSDropdown Menu Widget
- CVE-2021-25048KingComposer <= 2.9.6 - Subscriber+ Stored Cross-Site ScriptingPage Builder: KingComposer – Free Drag and Drop page builde…
- CVE-2021-43461Cross Site Scripting (XSS) vulnerability exists in Rumble Mail Server 0.51.3135 via the servername parameter.
- CVE-2021-43460An Unquoted Service Path vulnerability exists in System Explorer 7.0.0 via via a specially crafted file in the SystemExplorerHelpService ser
- CVE-2021-43459A Cross Site Scripting (XSS) vulnerability exists in Rumble Mail Server 0.51.3135 via the (1) domain and (2) path parameters.
- CVE-2021-43458An Unquoted Service Path vulnerability exits in Vembu BDR 4.2.0.1 via a specially crafted file in the (1) hsflowd, (2) VembuBDR360Agent, or
- CVE-2021-43457An Unquoted Service Path vulnerability exists in bVPN 2.5.1 via a specially crafted file in the waselvpnserv service path.
- CVE-2021-43456An Unquoted Service Path vulnerablility exists in Rumble Mail Server 0.51.3135 via via a specially crafted file in the RumbleService executa
- CVE-2021-43455An Unquoted Service Path vulnerability exists in FreeLAN 2.2 via a specially crafted file in the FreeLAN Service path.
- CVE-2021-43454An Unquoted Service Path vulnerability exists in AnyTXT Searcher 1.2.394 via a specially crafted file in the ATService path.
- CVE-2022-28062Car Rental System v1.0 contains an arbitrary file upload vulnerability via the Add Car component which allows attackers to upload a webshell
- CVE-2022-28063Simple Bakery Shop Management System v1.0 contains a file disclosure via /bsms/?page=products.
- CVE-2022-27435An unrestricted file upload at /public/admin/index.php?add_product of Ecommerce-Website v1.1.0 allows attackers to upload a webshell via the
- CVE-2022-27436A cross-site scripting (XSS) vulnerability in /public/admin/index.php?add_user at Ecommerce-Website v1.1.0 allows attackers to execute arbit
- CVE-2022-26616PKP Vendor Open Journal System v2.4.8 to v3.3.8 allows attackers to perform reflected cross-site scripting (XSS) attacks via crafted HTTP he
- CVE-2021-44138There is a Directory traversal vulnerability in Caucho Resin, as distributed in Resin 4.0.52 - 4.0.56, which allows remote attackers to readcom.caucho:resin
- CVE-2021-33616RSA Archer 6.x through 6.9 SP1 P4 (6.9.1.4) allows stored XSS.
- CVE-2022-1225Incorrect Privilege Assignment in phpipam/phpipamphpipam/phpipam
- CVE-2022-1223Incorrect Authorization in phpipam/phpipamphpipam/phpipam
- CVE-2022-1224Improper Authorization in phpipam/phpipamphpipam/phpipam
- CVE-2022-24191In HTMLDOC 1.9.14, an infinite loop in the gif_read_lzw function can lead to a pointer arbitrarily pointing to heap memory and resulting in
- CVE-2022-1222Inf loop in gpac/gpacgpac/gpac