# CVEs published 2022-04-07

46 CVEs were published on April 7, 2022: 1 critical, 17 high. Days are UTC.

- [CVE-2022-24681](https://cve.now/CVE-2022-24681.md): Zoho ManageEngine ADSelfService Plus before 6121 allows XSS via the welcome name attribute to the Reset Password, Unlock Account, or User Mu (no CVSS)
- [CVE-2021-43474](https://cve.now/CVE-2021-43474.md): An Access Control vulnerability exists in D-Link DIR-823G REVA1 1.02B05 (Lastest) via any parameter in the HNAP1 function (no CVSS)
- [CVE-2021-43453](https://cve.now/CVE-2021-43453.md): A Heap-based Buffer Overflow vulnerability exists in JerryScript 2.4.0 and prior versions via an out-of-bounds read in parser\_parse\_for\_stat (no CVSS)
- [CVE-2021-36202](https://cve.now/CVE-2021-36202.md): Metasys UI (CVSS 8.4, Johnson Controls Metasys)
- [CVE-2022-26676](https://cve.now/CVE-2022-26676.md): aEnrich a+HRD - Broken Access Control (CVSS 9.8, aEnrich a+HRD)
- [CVE-2022-26675](https://cve.now/CVE-2022-26675.md): aEnrich a+HRD - Path Traversal (CVSS 7.5, aEnrich a+HRD)
- [CVE-2022-26671](https://cve.now/CVE-2022-26671.md): TAIWAN SECOM CO., LTD., a xDoor Access Control and Personnel Attendance Management system - Hard-coded Credentials (CVSS 7.3, TAIWAN SECOM CO., LTD., Personnel Attendance Management sys…)
- [CVE-2022-26670](https://cve.now/CVE-2022-26670.md): D-Link DIR-878 - Command Injection (CVSS 8.8, D-Link DIR-878)
- [CVE-2022-25597](https://cve.now/CVE-2022-25597.md): ASUS RT-AC86U - Command Injection (CVSS 8.8, ASUS RT-AC86U)
- [CVE-2022-25596](https://cve.now/CVE-2022-25596.md): ASUS RT-AC86U - Heap-based buffer overflow (CVSS 8.8, ASUS RT-AC86U)
- [CVE-2022-25595](https://cve.now/CVE-2022-25595.md): ASUS RT-AC86U - Improper Input Validation (CVSS 6.5, ASUS RT-AC86U)
- [CVE-2022-25594](https://cve.now/CVE-2022-25594.md): Microprogram parking lot management system - Exposure of Sensitive Information to an Unauthorized Actor (CVSS 5.3, Microprogram parking lot management system)
- [CVE-2022-23973](https://cve.now/CVE-2022-23973.md): ASUS RT-AX56U - Stack overflew (CVSS 8.8, ASUS RT-AX56U)
- [CVE-2022-23972](https://cve.now/CVE-2022-23972.md): ASUS RT-AX56U - SQL Injection (CVSS 8.8, ASUS RT-AX56U)
- [CVE-2022-23971](https://cve.now/CVE-2022-23971.md): ASUS RT-AX56U - Path Traversal (CVSS 8.1, ASUS RT-AX56U)
- [CVE-2022-23970](https://cve.now/CVE-2022-23970.md): ASUS RT-AX56U - Path Traversal (CVSS 8.1, ASUS RT-AX56U)
- [CVE-2022-0935](https://cve.now/CVE-2022-0935.md): Host Header injection in password Reset in livehelperchat/livehelperchat (CVSS 8.8, livehelperchat/livehelperchat)
- [CVE-2022-0677](https://cve.now/CVE-2022-0677.md): Improper Handling of Length Parameter Inconsistency vulnerability in Bitdefender Update Server (VA-10144) (CVSS 7.5, Bitdefender Update Server · Bitdefender GravityZone +2)
- [CVE-2022-22519](https://cve.now/CVE-2022-22519.md): Special HTTP(s) Requests can cause a buffer-read causing a crash of the webserver and the runtime system. (CVSS 7.5, CODESYS Control RTE · CODESYS Control Win +14)
- [CVE-2022-22518](https://cve.now/CVE-2022-22518.md): A bug in the CODESYS V3 CmpUserMgr component fails to correctly apply a security policy. (CVSS 6.5, CODESYS Control for BeagleBone SL · CODESYS Control for… +8)
- [CVE-2022-22517](https://cve.now/CVE-2022-22517.md): Communication Components in multiple CODESYS products vulnerable to communication channel disruption (CVSS 7.5, CODESYS Control RTE · CODESYS Control Win +20)
- [CVE-2022-22516](https://cve.now/CVE-2022-22516.md): CODESYS driver SysDrv3S allows SYSTEM users on Microsoft Windows to read and write in restricted memory space. (CVSS 7.8, CODESYS Control RTE · CODESYS Control Win +1)
- [CVE-2022-22515](https://cve.now/CVE-2022-22515.md): A component of the CODESYS Control runtime system allows read and write access to configuration files (CVSS 8.1, CODESYS Control RTE · CODESYS Control Win +15)
- [CVE-2022-22514](https://cve.now/CVE-2022-22514.md): Untrusted Pointer Dereference in multiple CODESYS products can lead to a DoS. (CVSS 7.1, CODESYS Control RTE · CODESYS Control Win +18)
- [CVE-2022-22513](https://cve.now/CVE-2022-22513.md): Null Pointer Dereference in multiple CODESYS products can lead to a DoS. (CVSS 6.5, CODESYS Control RTE · CODESYS Control Win +18)
- [CVE-2022-26612](https://cve.now/CVE-2022-26612.md): Arbitrary file write in FileUtil#unpackEntries on Windows (no CVSS, Apache Software Foundation Apache Hadoop · org.apache.hadoo…)
- [CVE-2021-43432](https://cve.now/CVE-2021-43432.md): A Cross Site Scripting (XSS) vulnerability exists in Exrick XMall Admin Panel as of 11/7/2021 via the GET parameter in product-add.jsp. (no CVSS)
- [CVE-2021-43430](https://cve.now/CVE-2021-43430.md): An Access Control vulnerability exists in BigAntSoft BigAnt office messenger 5.6 via im\_webserver, which could let a malicious user upload P (no CVSS)
- [CVE-2021-43429](https://cve.now/CVE-2021-43429.md): A Denial of Service vulnerability exists in CORTX-S3 Server as of 11/7/2021 via the mempool\_destroy method due to a failture to release lock (no CVSS)
- [CVE-2021-43421](https://cve.now/CVE-2021-43421.md): A File Upload vulnerability exists in Studio-42 elFinder 2.0.4 to 2.1.59 via connector.minimal.php, which allows a remote malicious user to (no CVSS, studio-42/elfinder)
- [CVE-2022-27022](https://cve.now/CVE-2022-27022.md): There is a stack overflow vulnerability in the SetSysTimeCfg() function in the httpd service of Tenda AC9 V15.03.2.21\_cn. (no CVSS)
- [CVE-2022-26627](https://cve.now/CVE-2022-26627.md): Online Project Time Management System v1.0 was discovered to contain an arbitrary file write vulnerability which allows attackers to execute (no CVSS)
- [CVE-2022-25339](https://cve.now/CVE-2022-25339.md): ownCloud owncloud/android 2.20 has Incorrect Access Control for local attackers. (no CVSS)
- [CVE-2022-27016](https://cve.now/CVE-2022-27016.md): There is a stack overflow vulnerability in the SetStaticRouteCfg() function in the httpd service of Tenda AC9 15.03.2.21\_cn. (no CVSS)
- [CVE-2022-25338](https://cve.now/CVE-2022-25338.md): ownCloud owncloud/android before 2.20 has Incorrect Access Control for physically proximate attackers. (no CVSS)
- [CVE-2021-46419](https://cve.now/CVE-2021-46419.md): An unauthorized file deletion vulnerability in Telesquare TLR-2855KS6 via DELETE method can allow deletion of system files and scripts. (no CVSS)
- [CVE-2021-46418](https://cve.now/CVE-2021-46418.md): An unauthorized file creation vulnerability in Telesquare TLR-2855KS6 via PUT method can allow creation of CGI scripts. (no CVSS)
- [CVE-2021-46417](https://cve.now/CVE-2021-46417.md): Insecure handling of a download function leads to disclosure of internal files due to path traversal with root privileges in Franklin Fuelin (no CVSS)
- [CVE-2021-46416](https://cve.now/CVE-2021-46416.md): Insecure direct object reference in SUNNY TRIPOWER 5.0 Firmware version 3.10.16.R leads to unauthorized user groups accessing due to insecur (CVSS 5.4)
- [CVE-2022-23900](https://cve.now/CVE-2022-23900.md): A command injection vulnerability in the API of the Wavlink WL-WN531P3 router, version M31G3.V5030.201204, allows an attacker to achieve una (no CVSS)
- [CVE-2022-27818](https://cve.now/CVE-2022-27818.md): SWHKD 1.1.5 unsafely uses the /tmp/swhkd.sock pathname. (no CVSS, Simple-Wayland-HotKey-Daemon)
- [CVE-2022-27819](https://cve.now/CVE-2022-27819.md): SWHKD 1.1.5 allows unsafe parsing via the -c option. (no CVSS, Simple-Wayland-HotKey-Daemon)
- [CVE-2020-27373](https://cve.now/CVE-2020-27373.md): Dr Trust USA iCheck Connect BP Monitor BP Testing 118 1.2.1 is vulnerable to Plain text command over BLE. (no CVSS)
- [CVE-2020-27374](https://cve.now/CVE-2020-27374.md): Dr Trust USA iCheck Connect BP Monitor BP Testing 118 1.2.1 is vulnerable to a Replay Attack to BP Monitoring. (no CVSS)
- [CVE-2020-27375](https://cve.now/CVE-2020-27375.md): Dr Trust USA iCheck Connect BP Monitor BP Testing 118 version 1.2.1 is vulnerable to Transmitting Write Requests and Chars. (no CVSS)
- [CVE-2020-27376](https://cve.now/CVE-2020-27376.md): Dr Trust USA iCheck Connect BP Monitor BP Testing 118 version 1.2.1 is vulnerable to Missing Authentication. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-04-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.