CVEs published April 6, 2022
59 CVEs were published on April 6, 2022: 5 critical, 17 high.
- Published
- 59
- Critical
- 5
- High
- 17
- Medium
- 15
- Low
- 1
- Unrated
- 21
- Now in CISA KEV
- 0
- Fix available
- 7
Most affected products
- Fortinet FortiWAN
- 6
- Cisco Web Security Appliance
- 3
- Fortinet FortiEDR
- 3
- radareorg/radare2
- 3
- Cisco Identity Services Engine Software
- 2
- Cisco TelePresence Video Communication Server (VCS) Express…
- 2
- Fortinet FortiClientLinux
- 2
- pjsip pjproject
- 2
- Apache Software Foundation Apache NiFi · org.apache.nifi:ni…
- 1
- async
- 1
Critical 5
- CVE-2022-20755Cisco Expressway Series and Cisco TelePresence Video Communication Server VulnerabilitiesCisco TelePresence Video Communication Server (VCS) Express…
- CVE-2022-20754Cisco Expressway Series and Cisco TelePresence Video Communication Server VulnerabilitiesCisco TelePresence Video Communication Server (VCS) Express…
- CVE-2021-26114Multiple improper neutralization of special elements used in an SQL command vulnerabilities in FortiWAN before 4.5.9 may allow an unauthentiFortinet FortiWAN
- CVE-2022-23441A use of hard-coded cryptographic key vulnerability [CWE-321] in FortiEDR versions 5.0.2, 5.0.1, 5.0.0, 4.0.0 may allow an unauthenticated aFortinet FortiEDR
- CVE-2022-24786Potential out-of-bound read/write in PJSIPpjsip pjproject
High 17
- CVE-2022-20762Cisco Ultra Cloud Core - Subscriber Microservices Infrastructure Privilege Escalation VulnerabilityCisco Ultra Cloud Core - Subscriber Microservices Infrastru…
- CVE-2022-20756Cisco Identity Services Engine RADIUS Service Denial of Service VulnerabilityCisco Identity Services Engine Software
- CVE-2022-24822Denial of Service in @podium/layout and @podium/proxypodium-lib proxy · @podium/layout +1
- CVE-2021-32585An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiWAN before 4.5.9 may allow an attacker to perfFortinet FortiWAN
- CVE-2021-22127An improper input validation vulnerability in FortiClient for Linux 6.4.x before 6.4.3, FortiClient for Linux 6.2.x before 6.2.9 may allow aFortinet FortiClientLinux
- CVE-2021-26104Multiple OS command injection (CWE-78) vulnerabilities in the command line interface of FortiManager 6.2.7 and below, 6.4.5 and below and alFortinet FortiManager, FortiAnalyzer, FortiPortal
- CVE-2022-1240Heap buffer overflow in libr/bin/format/mach0/mach0.c in radareorg/radare2radareorg/radare2
- CVE-2022-1237Improper Validation of Array Index in radareorg/radare2radareorg/radare2
- CVE-2021-44169A improper initialization in Fortinet FortiClient (Windows) version 6.0.10 and below, version 6.2.9 and below, version 6.4.7 and below, versFortinet FortiClientWindows
- CVE-2022-23440A use of hard-coded cryptographic key vulnerability [CWE-321] in the registration mechanism of FortiEDR collectors versions 5.0.2, 5.0.1, 5.Fortinet FortiEDR
- CVE-2021-24009Multiple improper neutralization of special elements used in an OS command vulnerabilities (CWE-78) in the Web GUI of FortiWAN before 4.5.9 Fortinet FortiWAN
- CVE-2021-26112Multiple stack-based buffer overflow vulnerabilities [CWE-121] both in network daemons and in the command line interpreter of FortiWAN beforFortinet FortiWAN
- CVE-2022-1234XSS in livehelperchat in livehelperchat/livehelperchatlivehelperchat/livehelperchat
- CVE-2022-1248SAP Information System POST Request add_admin.php improper authenticationSAP Information System
- CVE-2022-1238Out-of-bounds Write in libr/bin/format/ne/ne.c in radareorg/radare2radareorg/radare2
- CVE-2022-1253Heap-based Buffer Overflow in strukturag/libde265strukturag/libde265
- CVE-2022-24793Potential heap buffer overflow when parsing DNS packets in PJSIPpjsip pjproject
Medium, low and unrated 37
- CVE-2020-22253Xiongmai Technology Co devices AHB7008T-MH-V2, AHB7804R-ELS, AHB7804R-MH-V2, AHB7808R-MS-V2, AHB7808R-MS, AHB7808T-MS-V2, AHB7804R-LMS, and
- CVE-2022-26613PHP-CMS v1.0 was discovered to contain a SQL injection vulnerability via the category parameter in categorymenu.php.
- CVE-2022-26607A remote code execution (RCE) vulnerability in baigo CMS v3.0-alpha-2 was discovered to allow attackers to execute arbitrary code via upload
- CVE-2022-26605eZiosuite v2.0.7 contains an authenticated arbitrary file upload via the Avatar upload functionality.
- CVE-2022-26591FANTEC GmbH MWiD25-DS Firmware v2.000.030 allows unauthenticated attackers to access and download arbitrary files via a crafted GET request.
- CVE-2022-20675Multiple Cisco Security Products Simple Network Management Protocol Service Denial of Service VulnerabilityCisco Web Security Appliance
- CVE-2022-20665Cisco StarOS Command Injection VulnerabilityCisco ASR 5000 Series Software
- CVE-2022-20741Cisco Secure Network Analytics Network Diagrams Application Cross-Site Scripting VulnerabilityCisco Secure Network Analytics
- CVE-2022-20763Cisco Webex Meetings Java Deserialization VulnerabilityCisco Webex Meetings
- CVE-2022-20774Cisco IP Phone 6800, 7800, and 8800 Series with Multiplatform Firmware Cross-Site Request Forgery VulnerabilityCisco IP Phone 7800 Series with Multiplatform Firmware
- CVE-2022-20781Cisco Web Security Appliance Stored Cross-Site Scripting VulnerabilityCisco Web Security Appliance
- CVE-2022-20782Cisco Identity Services Engine Sensitive Information Disclosure VulnerabilityCisco Identity Services Engine Software
- CVE-2022-20784Cisco Web Security Appliance Filter Bypass VulnerabilityCisco Web Security Appliance
- CVE-2022-26850Insufficiently protected credentialsApache Software Foundation Apache NiFi · org.apache.nifi:ni…
- CVE-2021-26113A use of a one-way hash with a predictable salt vulnerability [CWE-760] in FortiWAN before 4.5.9 may allow an attacker who has previously coFortinet FortiWAN
- CVE-2021-26116An improper neutralization of special elements used in an OS command vulnerability in the command line interpreter of FortiAuthenticator befFortinet FortiAuthenticator
- CVE-2021-41026A relative path traversal in FortiWeb versions 6.4.1, 6.4.0, and 6.3.0 through 6.3.15 may allow an authenticated attacker to retrieve arbitrFortinet FortiWeb
- CVE-2022-22410IBM Watson Query with Cloud Pak for Data as a Service could allow an authenticated user to obtain sensitive information that would allow theIBM Watson Query
- CVE-2022-27110OrangeHRM 4.10 is vulnerable to a Host header injection redirect via viewPersonalDetails endpoint.
- CVE-2022-27109OrangeHRM 4.10 suffers from a Referer header injection redirect vulnerability.
- CVE-2022-27108OrangeHRM 4.10 is vulnerable to Insecure Direct Object Reference (IDOR) via the end point symfony/web/index.php/time/createTimesheet`.
- CVE-2022-27107OrangeHRM 4.10 is vulnerable to Stored XSS in the "Share Video" section under "OrangeBuzz" via the GET/POST "createVideo[linkAddress]" param
- CVE-2021-43205An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiClient for Linux version 7.0.2 and below, 6.4.Fortinet FortiClientLinux
- CVE-2021-32593A use of a broken or risky cryptographic algorithm vulnerability [CWE-327] in the Dynamic Tunnel Protocol of FortiWAN before 4.5.9 may allowFortinet FortiWAN
- CVE-2020-29013An improper input validation vulnerability in the sniffer interface of FortiSandbox before 3.2.2 may allow an authenticated attacker to sileFortinet FortiSandbox
- CVE-2022-23446A improper control of a resource through its lifetime in Fortinet FortiEDR version 5.0.3 and earlier allows attacker to make the whole appliFortinet FortiEDR
- CVE-2021-40375Apperta Foundation OpenEyes 3.5.1 allows remote attackers to view the sensitive information of patients without having the intended level of
- CVE-2021-40374A stored cross-site scripting (XSS) vulnerability was identified in Apperta Foundation OpenEyes 3.5.1.
- CVE-2021-30497Ivanti Avalanche (Premise) 6.3.2 allows remote unauthenticated users to read arbitrary files via Absolute Path Traversal.
- CVE-2022-26110An issue was discovered in HTCondor 8.8.x before 8.8.16, 9.0.x before 9.0.10, and 9.1.x before 9.6.0.
- CVE-2021-45104An issue was discovered in HTCondor 9.0.x before 9.0.10 and 9.1.x before 9.5.1.
- CVE-2021-45103An issue was discovered in HTCondor 9.0.x before 9.0.10 and 9.1.x before 9.5.1.
- CVE-2022-26952Digi Passport Firmware through 1.5.1,1 is affected by a buffer overflow in the function for building the Location header string when an unau
- CVE-2022-26953Digi Passport Firmware through 1.5.1,1 is affected by a buffer overflow.
- CVE-2022-26250Synaman v5.1 and below was discovered to contain weak file permissions which allows authenticated attackers to escalate privileges.
- CVE-2022-26251The HTTP interface of Synaman v5.1 and below was discovered to allow authenticated attackers to execute arbitrary code and escalate privileg
- CVE-2021-43138In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js async