CVEs published April 8, 2022
58 CVEs were published on April 8, 2022: 1 critical, 6 high.
- Published
- 58
- Critical
- 1
- High
- 6
- Medium
- 11
- Low
- 0
- Unrated
- 40
- Now in CISA KEV
- 0
- Fix available
- 12
Most affected products
- Dell PowerScale OneFS
- 6
- Dell VNX2
- 4
- radareorg/radare2
- 2
- IBM Planning Analytics
- 1
- IBM Sterling B2B Integrator
- 1
- kevinpapst/kimai2
- 1
- pimcore/pimcore
- 1
- xwiki-platform · org.xwiki.platform:xwiki-platform-skin-ski…
- 1
- xwiki-platform · org.xwiki.platform:xwiki-platform-web
- 1
- xwiki-platform · org.xwiki.platform:xwiki-platform-web-temp…
- 1
Critical 1
High 6
- CVE-2022-26854Dell PowerScale OneFS, versions 8.2.x-9.2.x, contain risky cryptographic algorithms.Dell PowerScale OneFS
- CVE-2022-26852Dell PowerScale OneFS, versions 8.2.x-9.3.x, contain a predictable seed in pseudo-random number generator.Dell PowerScale OneFS
- CVE-2021-36288Dell VNX2 for File version 8.1.21.266 and earlier, contain a path traversal vulnerability which may lead unauthenticated users to read/writeDell VNX2
- CVE-2021-36287Dell VNX2 for file version 8.1.21.266 and earlier, contain an unauthenticated remote code execution vulnerability which may lead unauthenticDell VNX2
- CVE-2022-1284heap-use-after-free in radareorg/radare2radareorg/radare2
- CVE-2022-1219SQL injection in RecyclebinController.php in pimcore/pimcorepimcore/pimcore
Medium, low and unrated 51
- CVE-2022-26588A Cross-Site Request Forgery (CSRF) in IceHrm 31.0.0.OS allows attackers to delete arbitrary users or achieve account takeover via the app/s
- CVE-2022-26180qdPM 9.2 allows Cross-Site Request Forgery (CSRF) via the index.php/myAccount/update URI.
- CVE-2021-43009A Cross Site Scripting (XSS) vulnerability exists in OpServices OpMon through 9.11 via the search parameter in the request URL.
- CVE-2022-26855Dell PowerScale OneFS, versions 8.2.x-9.3.0.x, contains an incorrect default permissions vulnerability.Dell PowerScale OneFS
- CVE-2022-24428Dell PowerScale OneFS, versions 8.2.x, 9.0.0.x, 9.1.0.x, 9.2.0.x, 9.2.1.x, and 9.3.0.x, contain an improper preservation of privileges.Dell PowerScale OneFS
- CVE-2022-22563Dell EMC Powerscale OneFS 8.2.x - 9.2.x omit security-relevant information in /etc/master.passwd.Dell PowerScale OneFS
- CVE-2021-36293Dell VNX2 for File version 8.1.21.266 and earlier, contain a privilege escalation vulnerability.Dell VNX2
- CVE-2021-36290Dell VNX2 for File version 8.1.21.266 and earlier, contain a privilege escalation vulnerability.Dell VNX2
- CVE-2022-24820Unauthenticated user can list hidden document from multiple velocity templatesxwiki-platform · org.xwiki.platform:xwiki-platform-web
- CVE-2022-24819Unauthenticated user can retrieve the list of users through uorgsuggest.vmxwiki-platform · org.xwiki.platform:xwiki-platform-web-temp…
- CVE-2022-24821Incorrect Use of Privileged APIs in org.xwiki.platform.skin.skinxxwiki-platform · org.xwiki.platform:xwiki-platform-skin-ski…
- CVE-2021-43498An Access Control vulnerability exists in ATutor 2.2.4 in password_reminder.php when the g, id, h, form_password_hidden, and form_change HTT
- CVE-2022-1283NULL Pointer Dereference in r_bin_ne_get_entrypoints function in radareorg/radare2radareorg/radare2
- CVE-2021-43515CSV Injection (aka Excel Macro Injection or Formula Injection) exists in creating new timesheet in Kimai.kevinpapst/kimai2
- CVE-2021-43517FOSCAM Camera FI9805E with firmware V4.02.R12.00018510.10012.143900.00000 contains a backdoor that opens Telnet port when special command is
- CVE-2021-43521A Buffer Overflow vulnerability exists in zlog 1.2.15 via zlog_conf_build_with_file in src/zlog/src/conf.c.
- CVE-2022-27047mogu_blog_cms 5.2 suffers from upload arbitrary files without any limitation.
- CVE-2022-27148GPAC mp4box 1.1.0-DEV-rev1663-g881c6a94a-master is vulnerable to Integer Overflow.
- CVE-2022-27146GPAC mp4box 1.1.0-DEV-rev1759-geb2d1e6dd-has a heap-buffer-overflow vulnerability in function gf_isom_apple_enum_tag.
- CVE-2022-22339IBM Planning Analytics 2.0 is vulnerable to server-side request forgery (SSRF).IBM Planning Analytics
- CVE-2020-4668IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.5, 6.1.0.0 through 6.1.0.3, and 6.1.1.0 is vulnerable to cross-site requeIBM Sterling B2B Integrator
- CVE-2021-43483An Access Control vulnerability exists in CLARO KAON CG3000 1.00.67 in the router configuration, which could allow a malicious user to read
- CVE-2021-40656libsixel before 1.10 is vulnerable to Buffer Overflow in libsixel/src/quant.c:867.
- CVE-2022-27044libsixel 1.8.6 is affected by Buffer Overflow in libsixel/src/quant.c:876.
- CVE-2021-41715libsixel 1.10.0 is vulnerable to Use after free in libsixel/src/dither.c:379.
- CVE-2022-27046libsixel 1.8.6 suffers from a Heap Use After Free vulnerability in in libsixel/src/dither.c:388.
- CVE-2021-46367RiteCMS version 3.1.0 and below suffers from a remote code execution vulnerability in the admin panel.
- CVE-2022-24229A cross-site scripting (XSS) vulnerability in ONLYOFFICE Document Server Example before v7.0.0 allows remote attackers inject arbitrary HTML
- CVE-2021-46437An issue was discovered in ZZCMS 2021.
- CVE-2021-46436An issue was discovered in ZZCMS 2021.
- CVE-2022-28002Movie Seat Reservation v1 was discovered to contain an unauthenticated file disclosure vulnerability via /index.php?page=home.
- CVE-2022-28001Movie Seat Reservation v1 was discovered to contain a SQL injection vulnerability at /index.php?page=reserve via the id parameter.
- CVE-2022-28000Car Rental System v1.0 was discovered to contain a SQL injection vulnerability at /Car_Rental/booking.php via the id parameter.
- CVE-2022-27992Zoo Management System v1.0 was discovered to contain a SQL injection vulnerability at /public_html/animals via the class_id parameter.
- CVE-2022-27357Ecommerce-Website v1 was discovered to contain an arbitrary file upload vulnerability via /customer_register.php.
- CVE-2022-27991Online Banking System in PHP v1 was discovered to contain multiple SQL injection vulnerabilities at /staff_login.php via the Staff ID and St
- CVE-2022-27351Zoo Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via /public_html/apply_vacancy.
- CVE-2022-27352Simple House Rental System v1 was discovered to contain an arbitrary file upload vulnerability via /app/register.php.
- CVE-2022-27348Social Codia SMS v1 was discovered to contain a stored cross-site scripting (XSS) vulnerability via add_post.php.
- CVE-2022-27349Social Codia SMS v1 was discovered to contain an arbitrary file upload vulnerability via addteacher.php.
- CVE-2022-27346Ecommece-Website v1.1.0 was discovered to contain an arbitrary file upload vulnerability via /admin/index.php?slides.
- CVE-2022-27063AeroCMS v0.0.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability via view_all_comments.php.
- CVE-2022-27064Musical World v1 was discovered to contain an arbitrary file upload vulnerability via uploaded_songs.php.
- CVE-2022-27062AeroCMS v0.0.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability via add_post.php.
- CVE-2022-26624Bootstrap v3.1.11 and v3.3.7 was discovered to contain a cross-site scripting (XSS) vulnerability via the Title parameter in /vendor/views/a
- CVE-2022-27061AeroCMS v0.0.1 was discovered to contain an arbitrary file upload vulnerability via the Post Image function under the Admin panel.
- CVE-2022-28796jbd2_journal_wait_updates in fs/jbd2/transaction.c in the Linux kernel before 5.17.1 has a use-after-free caused by a transaction_t race con
- CVE-2022-27145GPAC mp4box 1.1.0-DEV-rev1727-g8be34973d-master has a stack-overflow vulnerability in function gf_isom_get_sample_for_movie_time of mp4box.
- CVE-2022-27147GPAC mp4box 1.1.0-DEV-rev1727-g8be34973d-master has a use-after-free vulnerability in function gf_node_get_attribute_by_tag.
- CVE-2022-27152Roku devices running RokuOS v9.4.0 build 4200 or earlier that uses a Realtek WiFi chip is vulnerable to Arbitrary file modification.
- CVE-2022-28805singlevar in lparser.c in Lua from (including) 5.4.0 up to (excluding) 5.4.4 lacks a certain luaK_exp2anyregup call, leading to a heap-based