# CVEs published 2022-04-04

106 CVEs were published on April 4, 2022: 6 critical, 16 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2022-0610](https://cve.now/CVE-2022-0610.md): Inappropriate implementation in Gamepad API in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap co (no CVSS, Google Chrome)
- [CVE-2022-0609](https://cve.now/CVE-2022-0609.md): Use after free in Animation in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a c (CVSS 8.8, KEV, Google Chrome · CefSharp.Common +8)
- [CVE-2022-0608](https://cve.now/CVE-2022-0608.md): Integer overflow in Mojo in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a craf (no CVSS, Google Chrome)
- [CVE-2022-0607](https://cve.now/CVE-2022-0607.md): Use after free in GPU in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a crafted (no CVSS, Google Chrome)
- [CVE-2022-0606](https://cve.now/CVE-2022-0606.md): Use after free in ANGLE in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a craft (no CVSS, Google Chrome)
- [CVE-2022-0605](https://cve.now/CVE-2022-0605.md): Use after free in Webstore API in Google Chrome prior to 98.0.4758.102 allowed an attacker who convinced a user to install a malicious exten (no CVSS, Google Chrome)
- [CVE-2022-0604](https://cve.now/CVE-2022-0604.md): Heap buffer overflow in Tab Groups in Google Chrome prior to 98.0.4758.102 allowed an attacker who convinced a user to install a malicious e (no CVSS, Google Chrome)
- [CVE-2022-0603](https://cve.now/CVE-2022-0603.md): Use after free in File Manager in Google Chrome on Chrome OS prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap co (no CVSS, Google Chrome)
- [CVE-2022-27441](https://cve.now/CVE-2022-27441.md): A stored cross-site scripting (XSS) vulnerability in TPCMS v3.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payl (no CVSS)
- [CVE-2022-27442](https://cve.now/CVE-2022-27442.md): TPCMS v3.2 allows attackers to access the ThinkPHP log directory and obtain sensitive information such as the administrator's user name and (no CVSS)
- [CVE-2021-36826](https://cve.now/CVE-2021-36826.md): WordPress WP Project Manager plugin \<= 2.4.13 - Stored Cross-Site Scripting (XSS) vulnerability (CVSS 5.4, weDevs WP Project Manager)
- [CVE-2021-36851](https://cve.now/CVE-2021-36851.md): WordPress Testimonial Slider plugin \<= 3.5.8.3 - Cross-Site Scripting (XSS) vulnerability (CVSS 4.1, Web-Settler Testimonial Slider – Free Testimonials Slider P…)
- [CVE-2022-25618](https://cve.now/CVE-2022-25618.md): WordPress wpDataTables plugin \<= 2.1.27 - Stored Cross-Site Scripting (XSS) vulnerability (CVSS 3.4, TMS-Plugins wpDataTables – Tables & Table Charts)
- [CVE-2022-25613](https://cve.now/CVE-2022-25613.md): WordPress FV Flowplayer Video Player plugin \<= 7.5.18.727 - Authenticated Persistent Cross-Site Scripting (XSS) vulnerability (CVSS 4.1, FolioVision FV Flowplayer Video Player)
- [CVE-2022-1175](https://cve.now/CVE-2022-1175.md): Improper neutralization of user input in GitLab CE/EE versions 14.4 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versio (CVSS 8.7, GitLab)
- [CVE-2022-1190](https://cve.now/CVE-2022-1190.md): Improper handling of user input in GitLab CE/EE versions 8.3 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowed an atta (CVSS 8.7, GitLab)
- [CVE-2022-1162](https://cve.now/CVE-2022-1162.md): A hardcoded password was set for accounts registered using an OmniAuth provider (e.g. (CVSS 9.1, GitLab)
- [CVE-2022-1148](https://cve.now/CVE-2022-1148.md): Improper authorization in GitLab Pages included with GitLab CE/EE affecting all versions from 11.5 prior to 14.7.7, 14.8 prior to 14.8.5, an (CVSS 5.3, GitLab)
- [CVE-2022-1121](https://cve.now/CVE-2022-1121.md): A lack of appropriate timeouts in GitLab Pages included in GitLab CE/EE all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior t (CVSS 5.3, GitLab Pages)
- [CVE-2022-1111](https://cve.now/CVE-2022-1111.md): A business logic error in Project Import in GitLab CE/EE versions 14.9 prior to 14.9.2, 14.8 prior to 14.8.5, and 14.0 prior to 14.7.7 under (CVSS 2.4, GitLab)
- [CVE-2022-1185](https://cve.now/CVE-2022-1185.md): A denial of service vulnerability when rendering RDoc files in GitLab CE/EE versions 10 to 14.7.7, 14.8.0 to 14.8.5, and 14.9.0 to 14.9.2 al (CVSS 6.5, GitLab)
- [CVE-2022-1120](https://cve.now/CVE-2022-1120.md): Missing filtering in an error message in GitLab CE/EE affecting all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 (CVSS 4.8, GitLab)
- [CVE-2022-1174](https://cve.now/CVE-2022-1174.md): A potential DoS vulnerability was discovered in Gitlab CE/EE versions 13.7 before 14.7.7, all versions starting from 14.8 before 14.8.5, all (CVSS 4.3, GitLab)
- [CVE-2022-1188](https://cve.now/CVE-2022-1188.md): An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.1 before 14.7.7, all versions starting from 14.8 before (CVSS 3.7, GitLab)
- [CVE-2022-1105](https://cve.now/CVE-2022-1105.md): An improper access control vulnerability in GitLab CE/EE affecting all versions from 13.11 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 p (CVSS 4.3, GitLab)
- [CVE-2022-1099](https://cve.now/CVE-2022-1099.md): Adding a very large number of tags to a runner in GitLab CE/EE affecting all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior (CVSS 4.3, GitLab)
- [CVE-2022-1100](https://cve.now/CVE-2022-1100.md): A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions from 13.1 prior to 14.7.7, 14.8.0 prior to 14.8.5, and 1 (CVSS 4.3, GitLab)
- [CVE-2022-1189](https://cve.now/CVE-2022-1189.md): An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.2 before 14.7.7, all versions starting from 14.8 before (CVSS 3.1, GitLab)
- [CVE-2022-0740](https://cve.now/CVE-2022-0740.md): Incorrect authorization in the Asana integration's branch restriction feature in all versions of GitLab CE/EE starting from version 7.8.0 be (CVSS 3.1, GitLab)
- [CVE-2021-32994](https://cve.now/CVE-2021-32994.md): Softing OPC-UA C++ SDK Improper Restriction of Operations within the Bounds of a Memory Buffer (CVSS 7.5, Softing OPC UA C++ SDK)
- [CVE-2021-32982](https://cve.now/CVE-2021-32982.md): Automation Direct CLICK PLC CPU Modules Cleartext Transmission of Sensitive Information (CVSS 7.5, Automation Direct CLICK PLC CPU Modules: C0-1x CPUs)
- [CVE-2021-32986](https://cve.now/CVE-2021-32986.md): Automation Direct CLICK PLC CPU Modules Authentication Bypass Using an Alternate Path or Channel (CVSS 9.8, Automation Direct CLICK PLC CPU Modules: C0-1x CPUs)
- [CVE-2021-32984](https://cve.now/CVE-2021-32984.md): Automation Direct CLICK PLC CPU Modules Authentication Bypass Using an Alternate Path or Channel (CVSS 9.8, Automation Direct CLICK PLC CPU Modules: C0-1x CPUs)
- [CVE-2021-32978](https://cve.now/CVE-2021-32978.md): Automation Direct CLICK PLC CPU Modules Plaintext Storage of a Password (CVSS 7.5, Automation Direct CLICK PLC CPU Modules: C0-1x CPUs)
- [CVE-2021-32980](https://cve.now/CVE-2021-32980.md): Automation Direct CLICK PLC CPU Modules Authentication Bypass Using an Alternate Path or Channel (CVSS 9.8, Automation Direct CLICK PLC CPU Modules: C0-1x CPUs)
- [CVE-2021-33008](https://cve.now/CVE-2021-33008.md): AVEVA System Platform Missing Authentication for Critical Function (CVSS 8.8, AVEVA System Platform)
- [CVE-2021-32981](https://cve.now/CVE-2021-32981.md): AVEVA System Platform Path Traversal (CVSS 7.2, AVEVA System Platform)
- [CVE-2021-32985](https://cve.now/CVE-2021-32985.md): AVEVA System Platform Origin Validation Error (CVSS 7.2, AVEVA System Platform)
- [CVE-2021-33010](https://cve.now/CVE-2021-33010.md): AVEVA System Platform Uncaught Exception (CVSS 7.5, AVEVA System Platform)
- [CVE-2021-32977](https://cve.now/CVE-2021-32977.md): AVEVA System Platform Improper Verification of Cryptographic Signature (CVSS 7.2, AVEVA System Platform)
- [CVE-2022-27650](https://cve.now/CVE-2022-27650.md): A flaw was found in crun where containers were incorrectly started with non-empty default permissions. (no CVSS, crun)
- [CVE-2022-27651](https://cve.now/CVE-2022-27651.md): A flaw was found in buildah where containers were incorrectly started with non-empty default permissions. (no CVSS, buildah · github.com/containers/buildah)
- [CVE-2022-27649](https://cve.now/CVE-2022-27649.md): A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions. (no CVSS, podman · github.com/containers/podman/v4 +3)
- [CVE-2022-23700](https://cve.now/CVE-2022-23700.md): A local unauthorized read access to files vulnerability was discovered in HPE OneView version(s): Prior to 6.6. (no CVSS, HPE OneView)
- [CVE-2022-23699](https://cve.now/CVE-2022-23699.md): A local authentication restriction bypass vulnerability was discovered in HPE OneView version(s): Prior to 6.6. (no CVSS, HPE OneView)
- [CVE-2022-23698](https://cve.now/CVE-2022-23698.md): A remote unauthenticated disclosure of information vulnerability was discovered in HPE OneView version(s): Prior to 6.6. (no CVSS, HPE OneView)
- [CVE-2022-23697](https://cve.now/CVE-2022-23697.md): A remote cross-site scripting (xss) vulnerability was discovered in HPE OneView version(s): Prior to 6.6. (no CVSS, HPE OneView)
- [CVE-2022-27609](https://cve.now/CVE-2022-27609.md): Forcepoint One Endpoint prior to version 22.01 installed on Microsoft Windows does not provide sufficient anti-tampering protection of servi (CVSS 6.0, Forcepoint One Endpoint)
- [CVE-2022-27608](https://cve.now/CVE-2022-27608.md): Forcepoint One Endpoint prior to version 22.01 installed on Microsoft Windows is vulnerable to registry key tampering by users with Administ (CVSS 6.0, Forcepoint One Endpoint)
- [CVE-2022-1233](https://cve.now/CVE-2022-1233.md): URL Confusion When Scheme Not Supplied in medialize/uri.js (CVSS 6.5, medialize/uri.js · urijs)
- [CVE-2022-26572](https://cve.now/CVE-2022-26572.md): Xerox ColorQube 8580 was discovered to contain an access control issue which allows attackers to print, view the status, and obtain sensitiv (no CVSS)
- [CVE-2022-0990](https://cve.now/CVE-2022-0990.md): Server-Side Request Forgery (SSRF) in janeczku/calibre-web (CVSS 9.3, janeczku/calibre-web)
- [CVE-2022-24814](https://cve.now/CVE-2022-24814.md): Cross-site Scripting in Directus (CVSS 8.8, directus)
- [CVE-2022-24813](https://cve.now/CVE-2022-24813.md): Authentication Bypass Using an Alternate Path or Channel in CreateWiki (CVSS 5.3, miraheze CreateWiki)
- [CVE-2022-24787](https://cve.now/CVE-2022-24787.md): Incorrect Comparison in Vyper (CVSS 7.5, vyperlang vyper · vyper)
- [CVE-2021-43464](https://cve.now/CVE-2021-43464.md): A Remiote Code Execution (RCE) vulnerability exiss in Subrion CMS 4.2.1 via modified code in a background field; when the information is mod (no CVSS, intelliants/subrion)
- [CVE-2022-24801](https://cve.now/CVE-2022-24801.md): HTTP Request Smuggling in twisted.web (CVSS 8.1, twisted)
- [CVE-2022-25569](https://cve.now/CVE-2022-25569.md): Bettini Srl GAMS Product Line v4.3.0 was discovered to re-use static SSH keys across installations, allowing unauthenticated attackers to lo (no CVSS)
- [CVE-2020-28062](https://cve.now/CVE-2020-28062.md): An Access Control vulnerability exists in HisiPHP 2.0.11 via special packets that are constructed in $files = Dir::getList($decompath. (no CVSS)
- [CVE-2021-43463](https://cve.now/CVE-2021-43463.md): An Unquoted Service Path vulnerability exists in Ext2Fsd v0.68 via a specially crafted file in the Ext2Srv Service executable service path. (no CVSS)
- [CVE-2021-43462](https://cve.now/CVE-2021-43462.md): A Cross Site Scripting (XSS) vulnerability exists in Rumble Mail Server 0.51.3135 via the username parameter. (no CVSS)
- [CVE-2022-1170](https://cve.now/CVE-2022-1170.md): JobMonster \< 4.5.2.9 - Unauthenticated Reflected Cross-Site Scripting (no CVSS, Noo JobMonster)
- [CVE-2022-1169](https://cve.now/CVE-2022-1169.md): Careerfy \< 3.9.0 - Unauthenticated Reflected Cross-Site Scripting (XSS) (no CVSS, Careerfy)
- [CVE-2022-1168](https://cve.now/CVE-2022-1168.md): JobSearch \< 1.5.1 - Unauthenticated Reflected Cross-Site Scripting (XSS) (no CVSS, WP JobSearch)
- [CVE-2022-1167](https://cve.now/CVE-2022-1167.md): CareerUp \< 2.3.1 - Unauthenticated Reflected Cross-Site Scripting (no CVSS, Careerup)
- [CVE-2022-1166](https://cve.now/CVE-2022-1166.md): JobMonster \< 4.6.6.1 - Directory Listing in Upload Folder (no CVSS, Noo JobMonster)
- [CVE-2022-1165](https://cve.now/CVE-2022-1165.md): Blackhole for Bad Bots \< 3.3.2 - Arbitrary IP Address Blocking via IP Spoofing (no CVSS, Blackhole for Bad Bots)
- [CVE-2022-1164](https://cve.now/CVE-2022-1164.md): Wyzi \< 2.4.3 - Reflected Cross-Site Scripting (XSS) (no CVSS, WYZI Business Finder)
- [CVE-2022-0958](https://cve.now/CVE-2022-0958.md): Mark Posts \< 2.0.1 - Admin+ Stored Cross-Site Scripting (no CVSS, Mark Posts)
- [CVE-2022-0901](https://cve.now/CVE-2022-0901.md): Ad Inserter \< 2.7.12 - Reflected Cross-Site Scripting (no CVSS, Ad Inserter – Ad Manager & AdSense Ads · Ad Inserter Pro)
- [CVE-2022-0887](https://cve.now/CVE-2022-0887.md): Easy Social Icons \< 3.1.4 - Admin+ SQL Injection (no CVSS, Easy Social Icons)
- [CVE-2022-0884](https://cve.now/CVE-2022-0884.md): Profile Builder \< 3.6.8 - Admin+ Stored Cross-Site Scripting (no CVSS, Profile Builder – User Profile & User Registration Forms)
- [CVE-2022-0864](https://cve.now/CVE-2022-0864.md): UpdraftPlus \< 1.22.9 - Reflected Cross-Site Scripting (no CVSS, UpdraftPlus WordPress Backup Plugin)
- [CVE-2022-0837](https://cve.now/CVE-2022-0837.md): Amelia \< 1.0.48 - Customer+ SMS Service Abuse and Sensitive Data Disclosure (no CVSS, Amelia)
- [CVE-2022-0830](https://cve.now/CVE-2022-0830.md): FormBuilder \<= 1.08 - Stored Cross-Site Scripting via CSRF (no CVSS, FormBuilder)
- [CVE-2022-0825](https://cve.now/CVE-2022-0825.md): Amelia \< 1.0.49 - Customer+ Arbitrary Appointments Status Update (no CVSS, Amelia – Events & Appointments Booking Calendar)
- [CVE-2022-0709](https://cve.now/CVE-2022-0709.md): Booking Package \< 1.5.29 - Unauthenticated Sensitive Data Disclosure (no CVSS, Booking Package – Appointment Booking Calendar System)
- [CVE-2022-0537](https://cve.now/CVE-2022-0537.md): MapPress Maps for WordPress \< 2.73.13 - Admin+ File Upload to Remote Code Execution (no CVSS, MapPress Maps for WordPress)
- [CVE-2022-0431](https://cve.now/CVE-2022-0431.md): Google Pagespeed Insights \< 4.0.4 - Reflected Cross-Site Scripting (no CVSS, Insights from Google PageSpeed)
- [CVE-2022-0404](https://cve.now/CVE-2022-0404.md): Material Design for Contact Form 7 \<= 2.6.4 - Subscriber+ Arbitrary Settings Update leading to DoS (no CVSS, Material Design for Contact Form)
- [CVE-2022-0403](https://cve.now/CVE-2022-0403.md): Library File Manager \< 5.2.3 - Subscriber+ Arbitrary File Creation/Upload/Deletion (no CVSS, Library File Manager)
- [CVE-2021-25113](https://cve.now/CVE-2021-25113.md): Dropdown Menu Widget \<= 1.9.7 - Subscriber+ Arbitrary Settings Update to Stored XSS (no CVSS, Dropdown Menu Widget)
- [CVE-2021-25048](https://cve.now/CVE-2021-25048.md): KingComposer \<= 2.9.6 - Subscriber+ Stored Cross-Site Scripting (no CVSS, Page Builder: KingComposer – Free Drag and Drop page builde…)
- [CVE-2021-43461](https://cve.now/CVE-2021-43461.md): Cross Site Scripting (XSS) vulnerability exists in Rumble Mail Server 0.51.3135 via the servername parameter. (no CVSS)
- [CVE-2021-43460](https://cve.now/CVE-2021-43460.md): An Unquoted Service Path vulnerability exists in System Explorer 7.0.0 via via a specially crafted file in the SystemExplorerHelpService ser (no CVSS)
- [CVE-2021-43459](https://cve.now/CVE-2021-43459.md): A Cross Site Scripting (XSS) vulnerability exists in Rumble Mail Server 0.51.3135 via the (1) domain and (2) path parameters. (no CVSS)
- [CVE-2021-43458](https://cve.now/CVE-2021-43458.md): An Unquoted Service Path vulnerability exits in Vembu BDR 4.2.0.1 via a specially crafted file in the (1) hsflowd, (2) VembuBDR360Agent, or (no CVSS)
- [CVE-2021-43457](https://cve.now/CVE-2021-43457.md): An Unquoted Service Path vulnerability exists in bVPN 2.5.1 via a specially crafted file in the waselvpnserv service path. (no CVSS)
- [CVE-2021-43456](https://cve.now/CVE-2021-43456.md): An Unquoted Service Path vulnerablility exists in Rumble Mail Server 0.51.3135 via via a specially crafted file in the RumbleService executa (no CVSS)
- [CVE-2021-43455](https://cve.now/CVE-2021-43455.md): An Unquoted Service Path vulnerability exists in FreeLAN 2.2 via a specially crafted file in the FreeLAN Service path. (no CVSS)
- [CVE-2022-1026](https://cve.now/CVE-2022-1026.md): Kyocera Net View Address Book Exposure (CVSS 8.6, Kyocera Multifunction Printer Net Viewer)
- [CVE-2021-43454](https://cve.now/CVE-2021-43454.md): An Unquoted Service Path vulnerability exists in AnyTXT Searcher 1.2.394 via a specially crafted file in the ATService path. (no CVSS)
- [CVE-2022-28062](https://cve.now/CVE-2022-28062.md): Car Rental System v1.0 contains an arbitrary file upload vulnerability via the Add Car component which allows attackers to upload a webshell (no CVSS)
- [CVE-2022-28063](https://cve.now/CVE-2022-28063.md): Simple Bakery Shop Management System v1.0 contains a file disclosure via /bsms/?page=products. (no CVSS)
- [CVE-2022-27435](https://cve.now/CVE-2022-27435.md): An unrestricted file upload at /public/admin/index.php?add\_product of Ecommerce-Website v1.1.0 allows attackers to upload a webshell via the (no CVSS)
- [CVE-2022-27436](https://cve.now/CVE-2022-27436.md): A cross-site scripting (XSS) vulnerability in /public/admin/index.php?add\_user at Ecommerce-Website v1.1.0 allows attackers to execute arbit (no CVSS)
- [CVE-2022-26616](https://cve.now/CVE-2022-26616.md): PKP Vendor Open Journal System v2.4.8 to v3.3.8 allows attackers to perform reflected cross-site scripting (XSS) attacks via crafted HTTP he (no CVSS)
- [CVE-2021-44138](https://cve.now/CVE-2021-44138.md): There is a Directory traversal vulnerability in Caucho Resin, as distributed in Resin 4.0.52 - 4.0.56, which allows remote attackers to read (no CVSS, com.caucho:resin)
- [CVE-2021-33616](https://cve.now/CVE-2021-33616.md): RSA Archer 6.x through 6.9 SP1 P4 (6.9.1.4) allows stored XSS. (no CVSS)
- [CVE-2022-1225](https://cve.now/CVE-2022-1225.md): Incorrect Privilege Assignment in phpipam/phpipam (CVSS 6.5, phpipam/phpipam)
- [CVE-2022-1223](https://cve.now/CVE-2022-1223.md): Incorrect Authorization in phpipam/phpipam (CVSS 6.5, phpipam/phpipam)
- [CVE-2022-1224](https://cve.now/CVE-2022-1224.md): Improper Authorization in phpipam/phpipam (CVSS 6.5, phpipam/phpipam)
- [CVE-2022-24191](https://cve.now/CVE-2022-24191.md): In HTMLDOC 1.9.14, an infinite loop in the gif\_read\_lzw function can lead to a pointer arbitrarily pointing to heap memory and resulting in (no CVSS)
- [CVE-2022-0939](https://cve.now/CVE-2022-0939.md): Server-Side Request Forgery (SSRF) in janeczku/calibre-web (CVSS 9.0, janeczku/calibre-web)
- [CVE-2022-1222](https://cve.now/CVE-2022-1222.md): Inf loop in gpac/gpac (CVSS 4.0, gpac/gpac)
- [CVE-2022-24785](https://cve.now/CVE-2022-24785.md): Path Traversal in Moment.js (CVSS 7.5, moment · Moment.js)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-04-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.