CVEs published April 5, 2022
120 CVEs were published on April 5, 2022: 1 critical, 19 high.
- Published
- 120
- Critical
- 1
- High
- 19
- Medium
- 10
- Low
- 0
- Unrated
- 90
- Now in CISA KEV
- 0
- Fix available
- 71
Most affected products
- Google Chrome
- 39
- Microsoft Edge
- 9
- xen
- 6
- Combodo iTop
- 3
- JetBrains YouTrack
- 3
- github.com/beego/beego/v2 · github.com/beego/beego
- 2
- IBM MQ Appliance
- 2
- livehelperchat/livehelperchat · remdex/livehelperchat
- 2
- Apache Software Foundation Apache Pinot · org.apache.pinot:…
- 1
- Atlassian Confluence Server · Atlassian Confluence Data Cen…
- 1
Critical 1
High 19
- CVE-2022-26912Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityMicrosoft Edge
- CVE-2022-26909Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityMicrosoft Edge
- CVE-2022-26908Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityMicrosoft Edge
- CVE-2022-26900Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityMicrosoft Edge
- CVE-2022-26895Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityMicrosoft Edge
- CVE-2022-26894Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityMicrosoft Edge
- CVE-2022-26891Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityMicrosoft Edge
- CVE-2022-24475Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityMicrosoft Edge
- CVE-2022-24780Code Injection in Combodo iTopCombodo iTop
- CVE-2022-28651In JetBrains IntelliJ IDEA before 2021.3.3 it was possible to get passwords from protected fieldsJetBrains IntelliJ IDEA
- CVE-2022-28650In JetBrains YouTrack before 2022.1.43700 it was possible to inject JavaScript into Markdown in the YouTrack Classic UIJetBrains YouTrack
- CVE-2022-1244heap-buffer-overflow in radareorg/radare2radareorg/radare2
- CVE-2022-0602Cross-site Scripting (XSS) - DOM in tastyigniter/tastyignitertastyigniter/tastyigniter
- CVE-2021-27116An issue was discovered in file profile.go in function MemProf in beego through 2.0.2, allows attackers to launch symlink attacks locally.github.com/beego/beego/v2 · github.com/beego/beego
- CVE-2021-27117An issue was discovered in file profile.go in function GetCPUProfile in beego through 2.0.2, allows attackers to launch symlink attacks locagithub.com/beego/beego/v2 · github.com/beego/beego
- CVE-2022-1243CRHTLF can lead to invalid protocol extraction potentially leading to XSS in medialize/uri.jsmedialize/uri.js · urijs
- CVE-2022-1235Weak secrethash can be brute-forced in livehelperchat/livehelperchatlivehelperchat/livehelperchat · remdex/livehelperchat
- CVE-2021-39114Affected versions of Atlassian Confluence Server and Data Center allow users with a valid account on a Confluence Data Center instance to exAtlassian Confluence Server · Atlassian Confluence Data Cen…
- CVE-2022-1213SSRF filter bypass port 80, 433 in livehelperchat/livehelperchatlivehelperchat/livehelperchat · remdex/livehelperchat
Medium, low and unrated 100
- CVE-2022-24523Microsoft Edge (Chromium-based) Spoofing VulnerabilityMicrosoft Edge
- CVE-2022-23974Pinot segment push endpoint has a vulnerability in unprotected environmentsApache Software Foundation Apache Pinot · org.apache.pinot:…
- CVE-2022-28468Payroll Management System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter.
- CVE-2022-28116Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter.
- CVE-2022-28467Online Student Admission v1.0 was discovered to contain a SQL injection vulnerability via the txtapplicationID parameter.
- CVE-2022-27304Student Grading System v1.0 was discovered to contain a SQL injection vulnerability via the user parameter.
- CVE-2022-28115Online Sports Complex Booking v1.0 was discovered to contain a SQL injection vulnerability via the id parameter.
- CVE-2022-27124Insurance Management System 1.0 was discovered to contain a SQL injection vulnerability via the username parameter.
- CVE-2022-27123Employee Performance Evaluation v1.0 was discovered to contain a SQL injection vulnerability via the email parameter.
- CVE-2022-26628Matrimony v1.0 was discovered to contain a SQL injection vulnerability via the Password parameter.
- CVE-2022-24811Cross-site Scripting in Combodo iTopCombodo iTop
- CVE-2022-28219Cewolf in Zoho ManageEngine ADAudit Plus before 7060 is vulnerable to an unauthenticated XXE attack that leads to Remote Code Execution.
- CVE-2022-25373Zoho ManageEngine SupportCenter Plus before 11020 allows Stored XSS in the request history.
- CVE-2022-25245Zoho ManageEngine ServiceDesk Plus before 13001 allows anyone to know the organisation's default currency name.
- CVE-2022-24978Zoho ManageEngine ADAudit Plus before 7055 allows authenticated Privilege Escalation on Integrated products.
- CVE-2022-26630Jellycms v3.8.1 and below was discovered to contain an arbitrary file upload vulnerability via \app.\admin\Controllers\db.php.
- CVE-2022-28649In JetBrains YouTrack before 2022.1.43563 it was possible to include an iframe from a third-party domain in the issue descriptionJetBrains YouTrack
- CVE-2022-28648In JetBrains YouTrack before 2022.1.43563 HTML code from the issue description was being renderedJetBrains YouTrack
- CVE-2022-26635PHP-Memcached v2.2.0 and below contains an improper NULL termination which allows attackers to execute CLRF injection.
- CVE-2022-22356IBM MQ Appliance 9.2 CD and 9.2 LTS could allow an attacker to enumerate account credentials due to an observable discrepancy in valid and iIBM MQ Appliance
- CVE-2022-22355IBM MQ Appliance 9.2 CD and 9.2 LTS are vulnerable to a denial of service in the Login component of the application which could allow an attIBM MQ Appliance
- CVE-2021-41752Stack overflow vulnerability in Jerryscript before commit e1ce7dd7271288be8c0c8136eea9107df73a8ce2 on Oct 20, 2021 due to an unbounded recur
- CVE-2022-27463Open redirect vulnerability in objects/login.json.php in WWBN AVideo through 11.6, allows attackers to arbitrarily redirect users from a crawwbn/avideo
- CVE-2020-19229Jeesite 1.2.7 uses the apache shiro version 1.2.3 affected by CVE-2016-4437.
- CVE-2021-28428File upload vulnerability in HorizontCMS before 1.0.0-beta.3 via uploading a .htaccess and *.hello files using the Media Files upload functi
- CVE-2020-28847Cross Site Scripting (XSS) vulnerability in xCss Valine v1.4.14 via the nick parameter to /classes/Comment.valine
- CVE-2022-27462Cross Site Scripting (XSS) vulnerability in objects/function.php in function getDeviceID in WWBN AVideo through 11.6, via the yptDevice para
- CVE-2021-41751Buffer overflow vulnerability in file ecma-builtin-array-prototype.c:909 in function ecma_builtin_array_prototype_object_slice in Jerryscrip
- CVE-2021-30080An issue was discovered in the route lookup process in beego before 1.12.11 that allows attackers to bypass access control.github.com/astaxie/beego · github.com/beego/beego +1
- CVE-2020-23349An intent redirection issue was doscovered in Sina Weibo Android SDK 4.2.7 (com.sina.weibo.sdk.share.WbShareTransActivity), any unexported A
- CVE-2021-41245Possible Cross-Site Request Forgery in Combodo iTopCombodo iTop
- CVE-2021-38834easy-mock v1.5.0-v1.6.0 allows remote attackers to bypass the vm2 sandbox and execute arbitrary system commands through special js code.
- CVE-2022-1236Weak Password Requirements in weseek/growiweseek/growi
- CVE-2022-25154A DLL hijacking vulnerability in Samsung portable SSD T5 PC software before 1.6.9 could allow a local attacker to escalate privileges.
- CVE-2022-23909There is an unquoted service path in Sherpa Connector Service (SherpaConnectorService.exe) 2020.2.20328.2050.
- CVE-2021-33207The HTTP client in MashZone NextGen through 10.7 GA deserializes untrusted data when it gets an HTTP response with a 570 status code.
- CVE-2022-25356Alt-N MDaemon Security Gateway through 8.5.0 allows SecurityGateway.dll?view=login XML Injection.
- CVE-2022-26281BigAnt Server v5.6.06 was discovered to contain an incorrect access control issue.
- CVE-2021-43008Improper Access Control in Adminer versions 1.12.0 to 4.6.2 (fixed in version 4.6.3) allows an attacker to achieve Arbitrary File Read on thvrana/adminer
- CVE-2021-45891An issue was discovered in Softwarebuero Zauner ARC 4.2.0.4., that allows attackers to escalate privileges within the application, since all
- CVE-2021-44109A buffer overflow in lib/sbi/message.c in Open5GS 2.3.6 and earlier allows remote attackers to Denial of Service via a crafted sbi request.
- CVE-2021-44108A null pointer dereference in src/amf/namf-handler.c in Open5GS 2.3.6 and earlier allows remote attackers to Denial of Service via a crafted
- CVE-2022-26615A cross-site scripting (XSS) vulnerability in College Website Content Management System v1.0 allows attackers to execute arbitrary web scrip
- CVE-2022-24231Simple Student Information System v1.0 was discovered to contain a SQL injection vulnerability via add/Student.
- CVE-2021-45892An issue was discovered in Softwarebuero Zauner ARC 4.2.0.4.
- CVE-2021-45893An issue was discovered in Softwarebuero Zauner ARC 4.2.0.4.
- CVE-2021-42324An issue was discovered on DCN (Digital China Networks) S4600-10P-SI devices before R0241.0470.
- CVE-2021-45894An issue was discovered in Softwarebuero Zauner ARC 4.2.0.4.
- CVE-2022-25584Seyeon Tech Co., Ltd FlexWATCH FW3170-PS-E Network Video System 4.23-3000_GY allows attackers to access sensitive information.
- CVE-2022-0470Out of bounds memory access in V8 in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to potentially exploit heap corruption viGoogle Chrome
- CVE-2022-0469Use after free in Cast in Google Chrome prior to 98.0.4758.80 allowed a remote attacker who convinced a user to engage in specific interactiGoogle Chrome
- CVE-2022-0468Use after free in Payments in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to potentially exploit heap corruption via a craGoogle Chrome
- CVE-2022-0467Inappropriate implementation in Pointer Lock in Google Chrome on Windows prior to 98.0.4758.80 allowed a remote attacker to bypass navigatioGoogle Chrome
- CVE-2022-0466Inappropriate implementation in Extensions Platform in Google Chrome prior to 98.0.4758.80 allowed an attacker who convinced a user to instaGoogle Chrome
- CVE-2022-0465Use after free in Extensions in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to potentially exploit heap corruption via useGoogle Chrome
- CVE-2022-0464Use after free in Accessibility in Google Chrome prior to 98.0.4758.80 allowed a remote attacker who convinced a user to engage in specific Google Chrome
- CVE-2022-0463Use after free in Accessibility in Google Chrome prior to 98.0.4758.80 allowed a remote attacker who convinced a user to engage in specific Google Chrome
- CVE-2022-0462Inappropriate implementation in Scroll in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to leak cross-origin data via a crafGoogle Chrome
- CVE-2022-0461Policy bypass in COOP in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to bypass iframe sandbox via a crafted HTML page.Google Chrome
- CVE-2022-0460Use after free in Window Dialogue in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to potentially exploit heap corruption viGoogle Chrome
- CVE-2022-0459Use after free in Screen Capture in Google Chrome prior to 98.0.4758.80 allowed a remote attacker who had compromised the renderer process aGoogle Chrome
- CVE-2022-0458Use after free in Thumbnail Tab Strip in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to potentially exploit heap corruptioGoogle Chrome
- CVE-2022-0457Type confusion in V8 in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HGoogle Chrome
- CVE-2022-0456Use after free in Web Search in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to potentially exploit heap corruption via proGoogle Chrome
- CVE-2022-0455Inappropriate implementation in Full Screen Mode in Google Chrome on Android prior to 98.0.4758.80 allowed a remote attacker to spoof the coGoogle Chrome
- CVE-2022-0454Heap buffer overflow in ANGLE in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to potentially exploit heap corruption via a Google Chrome
- CVE-2022-0453Use after free in Reader Mode in Google Chrome prior to 98.0.4758.80 allowed a remote attacker who had compromised the renderer process to pGoogle Chrome
- CVE-2022-0452Use after free in Safe Browsing in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to potentially perform a sandbox escape viaGoogle Chrome
- CVE-2022-26619Halo Blog CMS v1.4.17 was discovered to allow attackers to upload arbitrary files via the Attachment Upload function.
- CVE-2022-0809Out of bounds memory access in WebXR in Google Chrome prior to 99.0.4844.51 allowed a remote attacker to potentially exploit heap corruptionGoogle Chrome
- CVE-2022-0808Use after free in Chrome OS Shell in Google Chrome on Chrome OS prior to 99.0.4844.51 allowed a remote attacker who convinced a user to engaGoogle Chrome
- CVE-2022-0807Inappropriate implementation in Autofill in Google Chrome prior to 99.0.4844.51 allowed a remote attacker to bypass navigation restrictions Google Chrome
- CVE-2022-0806Data leak in Canvas in Google Chrome prior to 99.0.4844.51 allowed a remote attacker who convinced a user to engage in screen sharing to potGoogle Chrome
- CVE-2022-0805Use after free in Browser Switcher in Google Chrome prior to 99.0.4844.51 allowed a remote attacker who convinced a user to engage in specifGoogle Chrome
- CVE-2022-0804Inappropriate implementation in Full screen mode in Google Chrome on Android prior to 99.0.4844.51 allowed a remote attacker to hide the conGoogle Chrome
- CVE-2022-0803Inappropriate implementation in Permissions in Google Chrome prior to 99.0.4844.51 allowed a remote attacker to tamper with the contents of Google Chrome
- CVE-2022-0802Inappropriate implementation in Full screen mode in Google Chrome on Android prior to 99.0.4844.51 allowed a remote attacker to hide the conGoogle Chrome
- CVE-2022-0800Heap buffer overflow in Cast UI in Google Chrome prior to 99.0.4844.51 allowed a remote attacker who convinced a user to engage in specific Google Chrome
- CVE-2022-0799Insufficient policy enforcement in Installer in Google Chrome on Windows prior to 99.0.4844.51 allowed a remote attacker to perform local prGoogle Chrome
- CVE-2022-0798Use after free in MediaStream in Google Chrome prior to 99.0.4844.51 allowed an attacker who convinced a user to install a malicious extensiGoogle Chrome
- CVE-2022-0797Out of bounds memory access in Mojo in Google Chrome prior to 99.0.4844.51 allowed a remote attacker to perform an out of bounds memory writGoogle Chrome
- CVE-2022-0796Use after free in Media in Google Chrome prior to 99.0.4844.51 allowed a remote attacker to potentially exploit heap corruption via a crafteGoogle Chrome
- CVE-2022-0795Type confusion in Blink Layout in Google Chrome prior to 99.0.4844.51 allowed a remote attacker to potentially exploit heap corruption via aGoogle Chrome
- CVE-2022-0794Use after free in WebShare in Google Chrome prior to 99.0.4844.51 allowed a remote attacker who convinced a user to engage in specific user Google Chrome
- CVE-2022-0793Use after free in Cast in Google Chrome prior to 99.0.4844.51 allowed an attacker who convinced a user to install a malicious extension and Google Chrome
- CVE-2022-0792Out of bounds read in ANGLE in Google Chrome prior to 99.0.4844.51 allowed a remote attacker to potentially exploit heap corruption via a crGoogle Chrome
- CVE-2022-0791Use after free in Omnibox in Google Chrome prior to 99.0.4844.51 allowed a remote attacker who convinced a user to engage in specific user iGoogle Chrome
- CVE-2022-0790Use after free in Cast UI in Google Chrome prior to 99.0.4844.51 allowed a remote attacker who convinced a user to engage in specific user iGoogle Chrome
- CVE-2022-0789Heap buffer overflow in ANGLE in Google Chrome prior to 99.0.4844.51 allowed a remote attacker to potentially exploit heap corruption via a Google Chrome
- CVE-2022-26585Mingsoft MCMS v5.2.7 was discovered to contain a SQL injection vulnerability via /cms/content/list.net.mingsoft:ms-mcms
- CVE-2022-23732Path traversal in GitHub Enterprise Server management console leading to a bypass of CSRF protectionsGitHub Enterprise Server
- CVE-2022-24795Buffer Overflow and Integer Overflow in yajl-rubybrianmario yajl-ruby · yajl-ruby
- CVE-2022-26356Racy interactions between dirty vram tracking and paging log dirty hypercalls Activation of log dirty mode done by XEN_DMOP_track_dirty_vramxen
- CVE-2022-26357race in VT-d domain ID cleanup Xen domain IDs are up to 15 bits wide.xen
- CVE-2022-26358IOMMU: RMRR (VT-d) and unity map (AMD-Vi) handling issues T[his CNA information record relates to multiple CVEs; the text explains which aspxen
- CVE-2022-26359IOMMU: RMRR (VT-d) and unity map (AMD-Vi) handling issues T[his CNA information record relates to multiple CVEs; the text explains which aspxen
- CVE-2022-26360IOMMU: RMRR (VT-d) and unity map (AMD-Vi) handling issues T[his CNA information record relates to multiple CVEs; the text explains which aspxen
- CVE-2022-26361IOMMU: RMRR (VT-d) and unity map (AMD-Vi) handling issues T[his CNA information record relates to multiple CVEs; the text explains which aspxen
- CVE-2022-26982SimpleMachinesForum 2.1.1 and earlier allows remote authenticated administrators to execute arbitrary code by inserting a vulnerable php cod
- CVE-2022-26986SQL Injection in ImpressCMS 1.4.3 and earlier allows remote attackers to inject into the code in unintended way, this allows an attacker to impresscms/impresscms