# CVEs published 2022-04-05

120 CVEs were published on April 5, 2022: 1 critical, 19 high. Days are UTC.

- [CVE-2022-26912](https://cve.now/CVE-2022-26912.md): Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (CVSS 8.3, Microsoft Edge)
- [CVE-2022-26909](https://cve.now/CVE-2022-26909.md): Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (CVSS 8.3, Microsoft Edge)
- [CVE-2022-26908](https://cve.now/CVE-2022-26908.md): Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (CVSS 8.3, Microsoft Edge)
- [CVE-2022-26900](https://cve.now/CVE-2022-26900.md): Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (CVSS 8.3, Microsoft Edge)
- [CVE-2022-26895](https://cve.now/CVE-2022-26895.md): Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (CVSS 8.3, Microsoft Edge)
- [CVE-2022-26894](https://cve.now/CVE-2022-26894.md): Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (CVSS 8.3, Microsoft Edge)
- [CVE-2022-26891](https://cve.now/CVE-2022-26891.md): Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (CVSS 8.3, Microsoft Edge)
- [CVE-2022-24523](https://cve.now/CVE-2022-24523.md): Microsoft Edge (Chromium-based) Spoofing Vulnerability (CVSS 4.3, Microsoft Edge)
- [CVE-2022-24475](https://cve.now/CVE-2022-24475.md): Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (CVSS 8.3, Microsoft Edge)
- [CVE-2022-23974](https://cve.now/CVE-2022-23974.md): Pinot segment push endpoint has a vulnerability in unprotected environments (no CVSS, Apache Software Foundation Apache Pinot · org.apache.pinot:…)
- [CVE-2022-28468](https://cve.now/CVE-2022-28468.md): Payroll Management System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter. (no CVSS)
- [CVE-2022-28116](https://cve.now/CVE-2022-28116.md): Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter. (no CVSS)
- [CVE-2022-28467](https://cve.now/CVE-2022-28467.md): Online Student Admission v1.0 was discovered to contain a SQL injection vulnerability via the txtapplicationID parameter. (no CVSS)
- [CVE-2022-27304](https://cve.now/CVE-2022-27304.md): Student Grading System v1.0 was discovered to contain a SQL injection vulnerability via the user parameter. (no CVSS)
- [CVE-2022-28115](https://cve.now/CVE-2022-28115.md): Online Sports Complex Booking v1.0 was discovered to contain a SQL injection vulnerability via the id parameter. (no CVSS)
- [CVE-2022-27124](https://cve.now/CVE-2022-27124.md): Insurance Management System 1.0 was discovered to contain a SQL injection vulnerability via the username parameter. (no CVSS)
- [CVE-2022-27123](https://cve.now/CVE-2022-27123.md): Employee Performance Evaluation v1.0 was discovered to contain a SQL injection vulnerability via the email parameter. (no CVSS)
- [CVE-2022-26628](https://cve.now/CVE-2022-26628.md): Matrimony v1.0 was discovered to contain a SQL injection vulnerability via the Password parameter. (no CVSS)
- [CVE-2022-24811](https://cve.now/CVE-2022-24811.md): Cross-site Scripting in Combodo iTop (CVSS 5.4, Combodo iTop)
- [CVE-2022-28219](https://cve.now/CVE-2022-28219.md): Cewolf in Zoho ManageEngine ADAudit Plus before 7060 is vulnerable to an unauthenticated XXE attack that leads to Remote Code Execution. (no CVSS)
- [CVE-2022-24780](https://cve.now/CVE-2022-24780.md): Code Injection in Combodo iTop (CVSS 8.8, Combodo iTop)
- [CVE-2022-25373](https://cve.now/CVE-2022-25373.md): Zoho ManageEngine SupportCenter Plus before 11020 allows Stored XSS in the request history. (no CVSS)
- [CVE-2022-25245](https://cve.now/CVE-2022-25245.md): Zoho ManageEngine ServiceDesk Plus before 13001 allows anyone to know the organisation's default currency name. (no CVSS)
- [CVE-2022-24978](https://cve.now/CVE-2022-24978.md): Zoho ManageEngine ADAudit Plus before 7055 allows authenticated Privilege Escalation on Integrated products. (no CVSS)
- [CVE-2022-26630](https://cve.now/CVE-2022-26630.md): Jellycms v3.8.1 and below was discovered to contain an arbitrary file upload vulnerability via \\app.\\admin\\Controllers\\db.php. (no CVSS)
- [CVE-2022-28651](https://cve.now/CVE-2022-28651.md): In JetBrains IntelliJ IDEA before 2021.3.3 it was possible to get passwords from protected fields (CVSS 8.4, JetBrains IntelliJ IDEA)
- [CVE-2022-28650](https://cve.now/CVE-2022-28650.md): In JetBrains YouTrack before 2022.1.43700 it was possible to inject JavaScript into Markdown in the YouTrack Classic UI (CVSS 7.3, JetBrains YouTrack)
- [CVE-2022-28649](https://cve.now/CVE-2022-28649.md): In JetBrains YouTrack before 2022.1.43563 it was possible to include an iframe from a third-party domain in the issue description (CVSS 4.6, JetBrains YouTrack)
- [CVE-2022-28648](https://cve.now/CVE-2022-28648.md): In JetBrains YouTrack before 2022.1.43563 HTML code from the issue description was being rendered (CVSS 5.7, JetBrains YouTrack)
- [CVE-2022-1244](https://cve.now/CVE-2022-1244.md): heap-buffer-overflow in radareorg/radare2 (CVSS 7.5, radareorg/radare2)
- [CVE-2022-26635](https://cve.now/CVE-2022-26635.md): PHP-Memcached v2.2.0 and below contains an improper NULL termination which allows attackers to execute CLRF injection. (no CVSS)
- [CVE-2022-22356](https://cve.now/CVE-2022-22356.md): IBM MQ Appliance 9.2 CD and 9.2 LTS could allow an attacker to enumerate account credentials due to an observable discrepancy in valid and i (CVSS 5.3, IBM MQ Appliance)
- [CVE-2022-22355](https://cve.now/CVE-2022-22355.md): IBM MQ Appliance 9.2 CD and 9.2 LTS are vulnerable to a denial of service in the Login component of the application which could allow an att (CVSS 5.3, IBM MQ Appliance)
- [CVE-2022-0602](https://cve.now/CVE-2022-0602.md): Cross-site Scripting (XSS) - DOM in tastyigniter/tastyigniter (CVSS 7.4, tastyigniter/tastyigniter)
- [CVE-2021-41752](https://cve.now/CVE-2021-41752.md): Stack overflow vulnerability in Jerryscript before commit e1ce7dd7271288be8c0c8136eea9107df73a8ce2 on Oct 20, 2021 due to an unbounded recur (no CVSS)
- [CVE-2022-27463](https://cve.now/CVE-2022-27463.md): Open redirect vulnerability in objects/login.json.php in WWBN AVideo through 11.6, allows attackers to arbitrarily redirect users from a cra (no CVSS, wwbn/avideo)
- [CVE-2020-19229](https://cve.now/CVE-2020-19229.md): Jeesite 1.2.7 uses the apache shiro version 1.2.3 affected by CVE-2016-4437. (no CVSS)
- [CVE-2021-28428](https://cve.now/CVE-2021-28428.md): File upload vulnerability in HorizontCMS before 1.0.0-beta.3 via uploading a .htaccess and \*.hello files using the Media Files upload functi (no CVSS)
- [CVE-2020-28847](https://cve.now/CVE-2020-28847.md): Cross Site Scripting (XSS) vulnerability in xCss Valine v1.4.14 via the nick parameter to /classes/Comment. (no CVSS, valine)
- [CVE-2022-27462](https://cve.now/CVE-2022-27462.md): Cross Site Scripting (XSS) vulnerability in objects/function.php in function getDeviceID in WWBN AVideo through 11.6, via the yptDevice para (no CVSS)
- [CVE-2021-41751](https://cve.now/CVE-2021-41751.md): Buffer overflow vulnerability in file ecma-builtin-array-prototype.c:909 in function ecma\_builtin\_array\_prototype\_object\_slice in Jerryscrip (no CVSS)
- [CVE-2021-30080](https://cve.now/CVE-2021-30080.md): An issue was discovered in the route lookup process in beego before 1.12.11 that allows attackers to bypass access control. (no CVSS, github.com/astaxie/beego · github.com/beego/beego +1)
- [CVE-2021-27116](https://cve.now/CVE-2021-27116.md): An issue was discovered in file profile.go in function MemProf in beego through 2.0.2, allows attackers to launch symlink attacks locally. (CVSS 7.8, github.com/beego/beego/v2 · github.com/beego/beego)
- [CVE-2021-27117](https://cve.now/CVE-2021-27117.md): An issue was discovered in file profile.go in function GetCPUProfile in beego through 2.0.2, allows attackers to launch symlink attacks loca (CVSS 7.8, github.com/beego/beego/v2 · github.com/beego/beego)
- [CVE-2020-23349](https://cve.now/CVE-2020-23349.md): An intent redirection issue was doscovered in Sina Weibo Android SDK 4.2.7 (com.sina.weibo.sdk.share.WbShareTransActivity), any unexported A (no CVSS)
- [CVE-2022-1243](https://cve.now/CVE-2022-1243.md): CRHTLF can lead to invalid protocol extraction potentially leading to XSS in medialize/uri.js (CVSS 7.2, medialize/uri.js · urijs)
- [CVE-2021-41245](https://cve.now/CVE-2021-41245.md): Possible Cross-Site Request Forgery in Combodo iTop (CVSS 6.5, Combodo iTop)
- [CVE-2021-38834](https://cve.now/CVE-2021-38834.md): easy-mock v1.5.0-v1.6.0 allows remote attackers to bypass the vm2 sandbox and execute arbitrary system commands through special js code. (no CVSS)
- [CVE-2022-1236](https://cve.now/CVE-2022-1236.md): Weak Password Requirements in weseek/growi (CVSS 4.3, weseek/growi)
- [CVE-2022-1235](https://cve.now/CVE-2022-1235.md): Weak secrethash can be brute-forced in livehelperchat/livehelperchat (CVSS 7.5, livehelperchat/livehelperchat · remdex/livehelperchat)
- [CVE-2022-25154](https://cve.now/CVE-2022-25154.md): A DLL hijacking vulnerability in Samsung portable SSD T5 PC software before 1.6.9 could allow a local attacker to escalate privileges. (no CVSS)
- [CVE-2022-23909](https://cve.now/CVE-2022-23909.md): There is an unquoted service path in Sherpa Connector Service (SherpaConnectorService.exe) 2020.2.20328.2050. (no CVSS)
- [CVE-2021-39114](https://cve.now/CVE-2021-39114.md): Affected versions of Atlassian Confluence Server and Data Center allow users with a valid account on a Confluence Data Center instance to ex (CVSS 8.8, Atlassian Confluence Server · Atlassian Confluence Data Cen…)
- [CVE-2022-1212](https://cve.now/CVE-2022-1212.md): Use-After-Free in str\_escape in mruby/mruby in mruby/mruby (CVSS 9.3, mruby/mruby)
- [CVE-2022-1213](https://cve.now/CVE-2022-1213.md): SSRF filter bypass port 80, 433 in livehelperchat/livehelperchat (CVSS 7.7, livehelperchat/livehelperchat · remdex/livehelperchat)
- [CVE-2021-33207](https://cve.now/CVE-2021-33207.md): The HTTP client in MashZone NextGen through 10.7 GA deserializes untrusted data when it gets an HTTP response with a 570 status code. (no CVSS)
- [CVE-2022-25356](https://cve.now/CVE-2022-25356.md): Alt-N MDaemon Security Gateway through 8.5.0 allows SecurityGateway.dll?view=login XML Injection. (CVSS 5.3)
- [CVE-2022-26281](https://cve.now/CVE-2022-26281.md): BigAnt Server v5.6.06 was discovered to contain an incorrect access control issue. (no CVSS)
- [CVE-2021-43008](https://cve.now/CVE-2021-43008.md): Improper Access Control in Adminer versions 1.12.0 to 4.6.2 (fixed in version 4.6.3) allows an attacker to achieve Arbitrary File Read on th (no CVSS, vrana/adminer)
- [CVE-2021-45891](https://cve.now/CVE-2021-45891.md): An issue was discovered in Softwarebuero Zauner ARC 4.2.0.4., that allows attackers to escalate privileges within the application, since all (no CVSS)
- [CVE-2021-44109](https://cve.now/CVE-2021-44109.md): A buffer overflow in lib/sbi/message.c in Open5GS 2.3.6 and earlier allows remote attackers to Denial of Service via a crafted sbi request. (no CVSS)
- [CVE-2021-44108](https://cve.now/CVE-2021-44108.md): A null pointer dereference in src/amf/namf-handler.c in Open5GS 2.3.6 and earlier allows remote attackers to Denial of Service via a crafted (no CVSS)
- [CVE-2022-26615](https://cve.now/CVE-2022-26615.md): A cross-site scripting (XSS) vulnerability in College Website Content Management System v1.0 allows attackers to execute arbitrary web scrip (no CVSS)
- [CVE-2022-24231](https://cve.now/CVE-2022-24231.md): Simple Student Information System v1.0 was discovered to contain a SQL injection vulnerability via add/Student. (no CVSS)
- [CVE-2021-45892](https://cve.now/CVE-2021-45892.md): An issue was discovered in Softwarebuero Zauner ARC 4.2.0.4. (no CVSS)
- [CVE-2021-45893](https://cve.now/CVE-2021-45893.md): An issue was discovered in Softwarebuero Zauner ARC 4.2.0.4. (no CVSS)
- [CVE-2021-42324](https://cve.now/CVE-2021-42324.md): An issue was discovered on DCN (Digital China Networks) S4600-10P-SI devices before R0241.0470. (no CVSS)
- [CVE-2021-45894](https://cve.now/CVE-2021-45894.md): An issue was discovered in Softwarebuero Zauner ARC 4.2.0.4. (no CVSS)
- [CVE-2022-25584](https://cve.now/CVE-2022-25584.md): Seyeon Tech Co., Ltd FlexWATCH FW3170-PS-E Network Video System 4.23-3000\_GY allows attackers to access sensitive information. (no CVSS)
- [CVE-2022-0470](https://cve.now/CVE-2022-0470.md): Out of bounds memory access in V8 in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to potentially exploit heap corruption vi (no CVSS, Google Chrome)
- [CVE-2022-0469](https://cve.now/CVE-2022-0469.md): Use after free in Cast in Google Chrome prior to 98.0.4758.80 allowed a remote attacker who convinced a user to engage in specific interacti (no CVSS, Google Chrome)
- [CVE-2022-0468](https://cve.now/CVE-2022-0468.md): Use after free in Payments in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to potentially exploit heap corruption via a cra (no CVSS, Google Chrome)
- [CVE-2022-0467](https://cve.now/CVE-2022-0467.md): Inappropriate implementation in Pointer Lock in Google Chrome on Windows prior to 98.0.4758.80 allowed a remote attacker to bypass navigatio (no CVSS, Google Chrome)
- [CVE-2022-0466](https://cve.now/CVE-2022-0466.md): Inappropriate implementation in Extensions Platform in Google Chrome prior to 98.0.4758.80 allowed an attacker who convinced a user to insta (no CVSS, Google Chrome)
- [CVE-2022-0465](https://cve.now/CVE-2022-0465.md): Use after free in Extensions in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to potentially exploit heap corruption via use (no CVSS, Google Chrome)
- [CVE-2022-0464](https://cve.now/CVE-2022-0464.md): Use after free in Accessibility in Google Chrome prior to 98.0.4758.80 allowed a remote attacker who convinced a user to engage in specific (no CVSS, Google Chrome)
- [CVE-2022-0463](https://cve.now/CVE-2022-0463.md): Use after free in Accessibility in Google Chrome prior to 98.0.4758.80 allowed a remote attacker who convinced a user to engage in specific (no CVSS, Google Chrome)
- [CVE-2022-0462](https://cve.now/CVE-2022-0462.md): Inappropriate implementation in Scroll in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to leak cross-origin data via a craf (no CVSS, Google Chrome)
- [CVE-2022-0461](https://cve.now/CVE-2022-0461.md): Policy bypass in COOP in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to bypass iframe sandbox via a crafted HTML page. (no CVSS, Google Chrome)
- [CVE-2022-0460](https://cve.now/CVE-2022-0460.md): Use after free in Window Dialogue in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to potentially exploit heap corruption vi (no CVSS, Google Chrome)
- [CVE-2022-0459](https://cve.now/CVE-2022-0459.md): Use after free in Screen Capture in Google Chrome prior to 98.0.4758.80 allowed a remote attacker who had compromised the renderer process a (no CVSS, Google Chrome)
- [CVE-2022-0458](https://cve.now/CVE-2022-0458.md): Use after free in Thumbnail Tab Strip in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to potentially exploit heap corruptio (no CVSS, Google Chrome)
- [CVE-2022-0457](https://cve.now/CVE-2022-0457.md): Type confusion in V8 in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to potentially exploit heap corruption via a crafted H (no CVSS, Google Chrome)
- [CVE-2022-0456](https://cve.now/CVE-2022-0456.md): Use after free in Web Search in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to potentially exploit heap corruption via pro (no CVSS, Google Chrome)
- [CVE-2022-0455](https://cve.now/CVE-2022-0455.md): Inappropriate implementation in Full Screen Mode in Google Chrome on Android prior to 98.0.4758.80 allowed a remote attacker to spoof the co (no CVSS, Google Chrome)
- [CVE-2022-0454](https://cve.now/CVE-2022-0454.md): Heap buffer overflow in ANGLE in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to potentially exploit heap corruption via a (no CVSS, Google Chrome)
- [CVE-2022-0453](https://cve.now/CVE-2022-0453.md): Use after free in Reader Mode in Google Chrome prior to 98.0.4758.80 allowed a remote attacker who had compromised the renderer process to p (no CVSS, Google Chrome)
- [CVE-2022-0452](https://cve.now/CVE-2022-0452.md): Use after free in Safe Browsing in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to potentially perform a sandbox escape via (no CVSS, Google Chrome)
- [CVE-2022-26619](https://cve.now/CVE-2022-26619.md): Halo Blog CMS v1.4.17 was discovered to allow attackers to upload arbitrary files via the Attachment Upload function. (no CVSS)
- [CVE-2022-0809](https://cve.now/CVE-2022-0809.md): Out of bounds memory access in WebXR in Google Chrome prior to 99.0.4844.51 allowed a remote attacker to potentially exploit heap corruption (no CVSS, Google Chrome)
- [CVE-2022-0808](https://cve.now/CVE-2022-0808.md): Use after free in Chrome OS Shell in Google Chrome on Chrome OS prior to 99.0.4844.51 allowed a remote attacker who convinced a user to enga (no CVSS, Google Chrome)
- [CVE-2022-0807](https://cve.now/CVE-2022-0807.md): Inappropriate implementation in Autofill in Google Chrome prior to 99.0.4844.51 allowed a remote attacker to bypass navigation restrictions (no CVSS, Google Chrome)
- [CVE-2022-0806](https://cve.now/CVE-2022-0806.md): Data leak in Canvas in Google Chrome prior to 99.0.4844.51 allowed a remote attacker who convinced a user to engage in screen sharing to pot (no CVSS, Google Chrome)
- [CVE-2022-0805](https://cve.now/CVE-2022-0805.md): Use after free in Browser Switcher in Google Chrome prior to 99.0.4844.51 allowed a remote attacker who convinced a user to engage in specif (no CVSS, Google Chrome)
- [CVE-2022-0804](https://cve.now/CVE-2022-0804.md): Inappropriate implementation in Full screen mode in Google Chrome on Android prior to 99.0.4844.51 allowed a remote attacker to hide the con (no CVSS, Google Chrome)
- [CVE-2022-0803](https://cve.now/CVE-2022-0803.md): Inappropriate implementation in Permissions in Google Chrome prior to 99.0.4844.51 allowed a remote attacker to tamper with the contents of (no CVSS, Google Chrome)
- [CVE-2022-0802](https://cve.now/CVE-2022-0802.md): Inappropriate implementation in Full screen mode in Google Chrome on Android prior to 99.0.4844.51 allowed a remote attacker to hide the con (no CVSS, Google Chrome)
- [CVE-2022-0800](https://cve.now/CVE-2022-0800.md): Heap buffer overflow in Cast UI in Google Chrome prior to 99.0.4844.51 allowed a remote attacker who convinced a user to engage in specific (no CVSS, Google Chrome)
- [CVE-2022-0799](https://cve.now/CVE-2022-0799.md): Insufficient policy enforcement in Installer in Google Chrome on Windows prior to 99.0.4844.51 allowed a remote attacker to perform local pr (no CVSS, Google Chrome)
- [CVE-2022-0798](https://cve.now/CVE-2022-0798.md): Use after free in MediaStream in Google Chrome prior to 99.0.4844.51 allowed an attacker who convinced a user to install a malicious extensi (no CVSS, Google Chrome)
- [CVE-2022-0797](https://cve.now/CVE-2022-0797.md): Out of bounds memory access in Mojo in Google Chrome prior to 99.0.4844.51 allowed a remote attacker to perform an out of bounds memory writ (no CVSS, Google Chrome)
- [CVE-2022-0796](https://cve.now/CVE-2022-0796.md): Use after free in Media in Google Chrome prior to 99.0.4844.51 allowed a remote attacker to potentially exploit heap corruption via a crafte (no CVSS, Google Chrome)
- [CVE-2022-0795](https://cve.now/CVE-2022-0795.md): Type confusion in Blink Layout in Google Chrome prior to 99.0.4844.51 allowed a remote attacker to potentially exploit heap corruption via a (no CVSS, Google Chrome)
- [CVE-2022-0794](https://cve.now/CVE-2022-0794.md): Use after free in WebShare in Google Chrome prior to 99.0.4844.51 allowed a remote attacker who convinced a user to engage in specific user (no CVSS, Google Chrome)
- [CVE-2022-0793](https://cve.now/CVE-2022-0793.md): Use after free in Cast in Google Chrome prior to 99.0.4844.51 allowed an attacker who convinced a user to install a malicious extension and (no CVSS, Google Chrome)
- [CVE-2022-0792](https://cve.now/CVE-2022-0792.md): Out of bounds read in ANGLE in Google Chrome prior to 99.0.4844.51 allowed a remote attacker to potentially exploit heap corruption via a cr (no CVSS, Google Chrome)
- [CVE-2022-0791](https://cve.now/CVE-2022-0791.md): Use after free in Omnibox in Google Chrome prior to 99.0.4844.51 allowed a remote attacker who convinced a user to engage in specific user i (no CVSS, Google Chrome)
- [CVE-2022-0790](https://cve.now/CVE-2022-0790.md): Use after free in Cast UI in Google Chrome prior to 99.0.4844.51 allowed a remote attacker who convinced a user to engage in specific user i (no CVSS, Google Chrome)
- [CVE-2022-0789](https://cve.now/CVE-2022-0789.md): Heap buffer overflow in ANGLE in Google Chrome prior to 99.0.4844.51 allowed a remote attacker to potentially exploit heap corruption via a (no CVSS, Google Chrome)
- [CVE-2022-26585](https://cve.now/CVE-2022-26585.md): Mingsoft MCMS v5.2.7 was discovered to contain a SQL injection vulnerability via /cms/content/list. (no CVSS, net.mingsoft:ms-mcms)
- [CVE-2022-23732](https://cve.now/CVE-2022-23732.md): Path traversal in GitHub Enterprise Server management console leading to a bypass of CSRF protections (no CVSS, GitHub Enterprise Server)
- [CVE-2022-24795](https://cve.now/CVE-2022-24795.md): Buffer Overflow and Integer Overflow in yajl-ruby (CVSS 5.9, brianmario yajl-ruby · yajl-ruby)
- [CVE-2022-26356](https://cve.now/CVE-2022-26356.md): Racy interactions between dirty vram tracking and paging log dirty hypercalls Activation of log dirty mode done by XEN\_DMOP\_track\_dirty\_vram (no CVSS, xen)
- [CVE-2022-26357](https://cve.now/CVE-2022-26357.md): race in VT-d domain ID cleanup Xen domain IDs are up to 15 bits wide. (no CVSS, xen)
- [CVE-2022-26358](https://cve.now/CVE-2022-26358.md): IOMMU: RMRR (VT-d) and unity map (AMD-Vi) handling issues T\[his CNA information record relates to multiple CVEs; the text explains which asp (no CVSS, xen)
- [CVE-2022-26359](https://cve.now/CVE-2022-26359.md): IOMMU: RMRR (VT-d) and unity map (AMD-Vi) handling issues T\[his CNA information record relates to multiple CVEs; the text explains which asp (no CVSS, xen)
- [CVE-2022-26360](https://cve.now/CVE-2022-26360.md): IOMMU: RMRR (VT-d) and unity map (AMD-Vi) handling issues T\[his CNA information record relates to multiple CVEs; the text explains which asp (no CVSS, xen)
- [CVE-2022-26361](https://cve.now/CVE-2022-26361.md): IOMMU: RMRR (VT-d) and unity map (AMD-Vi) handling issues T\[his CNA information record relates to multiple CVEs; the text explains which asp (no CVSS, xen)
- [CVE-2022-26982](https://cve.now/CVE-2022-26982.md): SimpleMachinesForum 2.1.1 and earlier allows remote authenticated administrators to execute arbitrary code by inserting a vulnerable php cod (no CVSS)
- [CVE-2022-26986](https://cve.now/CVE-2022-26986.md): SQL Injection in ImpressCMS 1.4.3 and earlier allows remote attackers to inject into the code in unintended way, this allows an attacker to (no CVSS, impresscms/impresscms)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-04-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.