CVEs published April 7, 2022
46 CVEs were published on April 7, 2022: 1 critical, 17 high.
- Published
- 46
- Critical
- 1
- High
- 17
- Medium
- 5
- Low
- 0
- Unrated
- 23
- Now in CISA KEV
- 0
- Fix available
- 14
Most affected products
- ASUS RT-AX56U
- 4
- ASUS RT-AC86U
- 3
- aEnrich a+HRD
- 2
- CODESYS Control RTE · CODESYS Control Win +18
- 2
- Simple-Wayland-HotKey-Daemon
- 2
- Apache Software Foundation Apache Hadoop · org.apache.hadoo…
- 1
- Bitdefender Update Server · Bitdefender GravityZone +2
- 1
- CODESYS Control for BeagleBone SL · CODESYS Control for… +8
- 1
- CODESYS Control RTE · CODESYS Control Win +1
- 1
- CODESYS Control RTE · CODESYS Control Win +14
- 1
Critical 1
High 17
- CVE-2021-36202Metasys UIJohnson Controls Metasys
- CVE-2022-26675aEnrich a+HRD - Path TraversalaEnrich a+HRD
- CVE-2022-26671TAIWAN SECOM CO., LTD., a xDoor Access Control and Personnel Attendance Management system - Hard-coded CredentialsTAIWAN SECOM CO., LTD., Personnel Attendance Management sys…
- CVE-2022-26670D-Link DIR-878 - Command InjectionD-Link DIR-878
- CVE-2022-25597ASUS RT-AC86U - Command InjectionASUS RT-AC86U
- CVE-2022-25596ASUS RT-AC86U - Heap-based buffer overflowASUS RT-AC86U
- CVE-2022-23973ASUS RT-AX56U - Stack overflewASUS RT-AX56U
- CVE-2022-23972ASUS RT-AX56U - SQL InjectionASUS RT-AX56U
- CVE-2022-23971ASUS RT-AX56U - Path TraversalASUS RT-AX56U
- CVE-2022-23970ASUS RT-AX56U - Path TraversalASUS RT-AX56U
- CVE-2022-0935Host Header injection in password Reset in livehelperchat/livehelperchatlivehelperchat/livehelperchat
- CVE-2022-0677Improper Handling of Length Parameter Inconsistency vulnerability in Bitdefender Update Server (VA-10144)Bitdefender Update Server · Bitdefender GravityZone +2
- CVE-2022-22519Special HTTP(s) Requests can cause a buffer-read causing a crash of the webserver and the runtime system.CODESYS Control RTE · CODESYS Control Win +14
- CVE-2022-22517Communication Components in multiple CODESYS products vulnerable to communication channel disruptionCODESYS Control RTE · CODESYS Control Win +20
- CVE-2022-22516CODESYS driver SysDrv3S allows SYSTEM users on Microsoft Windows to read and write in restricted memory space.CODESYS Control RTE · CODESYS Control Win +1
- CVE-2022-22515A component of the CODESYS Control runtime system allows read and write access to configuration filesCODESYS Control RTE · CODESYS Control Win +15
- CVE-2022-22514Untrusted Pointer Dereference in multiple CODESYS products can lead to a DoS.CODESYS Control RTE · CODESYS Control Win +18
Medium, low and unrated 28
- CVE-2022-24681Zoho ManageEngine ADSelfService Plus before 6121 allows XSS via the welcome name attribute to the Reset Password, Unlock Account, or User Mu
- CVE-2021-43474An Access Control vulnerability exists in D-Link DIR-823G REVA1 1.02B05 (Lastest) via any parameter in the HNAP1 function
- CVE-2021-43453A Heap-based Buffer Overflow vulnerability exists in JerryScript 2.4.0 and prior versions via an out-of-bounds read in parser_parse_for_stat
- CVE-2022-25595ASUS RT-AC86U - Improper Input ValidationASUS RT-AC86U
- CVE-2022-25594Microprogram parking lot management system - Exposure of Sensitive Information to an Unauthorized ActorMicroprogram parking lot management system
- CVE-2022-22518A bug in the CODESYS V3 CmpUserMgr component fails to correctly apply a security policy.CODESYS Control for BeagleBone SL · CODESYS Control for… +8
- CVE-2022-22513Null Pointer Dereference in multiple CODESYS products can lead to a DoS.CODESYS Control RTE · CODESYS Control Win +18
- CVE-2022-26612Arbitrary file write in FileUtil#unpackEntries on WindowsApache Software Foundation Apache Hadoop · org.apache.hadoo…
- CVE-2021-43432A Cross Site Scripting (XSS) vulnerability exists in Exrick XMall Admin Panel as of 11/7/2021 via the GET parameter in product-add.jsp.
- CVE-2021-43430An Access Control vulnerability exists in BigAntSoft BigAnt office messenger 5.6 via im_webserver, which could let a malicious user upload P
- CVE-2021-43429A Denial of Service vulnerability exists in CORTX-S3 Server as of 11/7/2021 via the mempool_destroy method due to a failture to release lock
- CVE-2021-43421A File Upload vulnerability exists in Studio-42 elFinder 2.0.4 to 2.1.59 via connector.minimal.php, which allows a remote malicious user to studio-42/elfinder
- CVE-2022-27022There is a stack overflow vulnerability in the SetSysTimeCfg() function in the httpd service of Tenda AC9 V15.03.2.21_cn.
- CVE-2022-26627Online Project Time Management System v1.0 was discovered to contain an arbitrary file write vulnerability which allows attackers to execute
- CVE-2022-25339ownCloud owncloud/android 2.20 has Incorrect Access Control for local attackers.
- CVE-2022-27016There is a stack overflow vulnerability in the SetStaticRouteCfg() function in the httpd service of Tenda AC9 15.03.2.21_cn.
- CVE-2022-25338ownCloud owncloud/android before 2.20 has Incorrect Access Control for physically proximate attackers.
- CVE-2021-46419An unauthorized file deletion vulnerability in Telesquare TLR-2855KS6 via DELETE method can allow deletion of system files and scripts.
- CVE-2021-46418An unauthorized file creation vulnerability in Telesquare TLR-2855KS6 via PUT method can allow creation of CGI scripts.
- CVE-2021-46417Insecure handling of a download function leads to disclosure of internal files due to path traversal with root privileges in Franklin Fuelin
- CVE-2021-46416Insecure direct object reference in SUNNY TRIPOWER 5.0 Firmware version 3.10.16.R leads to unauthorized user groups accessing due to insecur
- CVE-2022-23900A command injection vulnerability in the API of the Wavlink WL-WN531P3 router, version M31G3.V5030.201204, allows an attacker to achieve una
- CVE-2022-27818SWHKD 1.1.5 unsafely uses the /tmp/swhkd.sock pathname.Simple-Wayland-HotKey-Daemon
- CVE-2022-27819SWHKD 1.1.5 allows unsafe parsing via the -c option.Simple-Wayland-HotKey-Daemon
- CVE-2020-27373Dr Trust USA iCheck Connect BP Monitor BP Testing 118 1.2.1 is vulnerable to Plain text command over BLE.
- CVE-2020-27374Dr Trust USA iCheck Connect BP Monitor BP Testing 118 1.2.1 is vulnerable to a Replay Attack to BP Monitoring.
- CVE-2020-27375Dr Trust USA iCheck Connect BP Monitor BP Testing 118 version 1.2.1 is vulnerable to Transmitting Write Requests and Chars.
- CVE-2020-27376Dr Trust USA iCheck Connect BP Monitor BP Testing 118 version 1.2.1 is vulnerable to Missing Authentication.