# CVEs published 2022-04-08

58 CVEs were published on April 8, 2022: 1 critical, 6 high. Days are UTC.

- [CVE-2022-26588](https://cve.now/CVE-2022-26588.md): A Cross-Site Request Forgery (CSRF) in IceHrm 31.0.0.OS allows attackers to delete arbitrary users or achieve account takeover via the app/s (no CVSS)
- [CVE-2022-26180](https://cve.now/CVE-2022-26180.md): qdPM 9.2 allows Cross-Site Request Forgery (CSRF) via the index.php/myAccount/update URI. (no CVSS)
- [CVE-2021-43009](https://cve.now/CVE-2021-43009.md): A Cross Site Scripting (XSS) vulnerability exists in OpServices OpMon through 9.11 via the search parameter in the request URL. (no CVSS)
- [CVE-2022-26855](https://cve.now/CVE-2022-26855.md): Dell PowerScale OneFS, versions 8.2.x-9.3.0.x, contains an incorrect default permissions vulnerability. (CVSS 5.5, Dell PowerScale OneFS)
- [CVE-2022-26854](https://cve.now/CVE-2022-26854.md): Dell PowerScale OneFS, versions 8.2.x-9.2.x, contain risky cryptographic algorithms. (CVSS 8.1, Dell PowerScale OneFS)
- [CVE-2022-26852](https://cve.now/CVE-2022-26852.md): Dell PowerScale OneFS, versions 8.2.x-9.3.x, contain a predictable seed in pseudo-random number generator. (CVSS 8.1, Dell PowerScale OneFS)
- [CVE-2022-26851](https://cve.now/CVE-2022-26851.md): Dell PowerScale OneFS, 8.2.2-9.3.x, contains a predictable file name from observable state vulnerability. (CVSS 9.1, Dell PowerScale OneFS)
- [CVE-2022-24428](https://cve.now/CVE-2022-24428.md): Dell PowerScale OneFS, versions 8.2.x, 9.0.0.x, 9.1.0.x, 9.2.0.x, 9.2.1.x, and 9.3.0.x, contain an improper preservation of privileges. (CVSS 6.3, Dell PowerScale OneFS)
- [CVE-2022-22563](https://cve.now/CVE-2022-22563.md): Dell EMC Powerscale OneFS 8.2.x - 9.2.x omit security-relevant information in /etc/master.passwd. (CVSS 4.4, Dell PowerScale OneFS)
- [CVE-2021-36293](https://cve.now/CVE-2021-36293.md): Dell VNX2 for File version 8.1.21.266 and earlier, contain a privilege escalation vulnerability. (CVSS 6.4, Dell VNX2)
- [CVE-2021-36290](https://cve.now/CVE-2021-36290.md): Dell VNX2 for File version 8.1.21.266 and earlier, contain a privilege escalation vulnerability. (CVSS 6.4, Dell VNX2)
- [CVE-2021-36288](https://cve.now/CVE-2021-36288.md): Dell VNX2 for File version 8.1.21.266 and earlier, contain a path traversal vulnerability which may lead unauthenticated users to read/write (CVSS 8.6, Dell VNX2)
- [CVE-2021-36287](https://cve.now/CVE-2021-36287.md): Dell VNX2 for file version 8.1.21.266 and earlier, contain an unauthenticated remote code execution vulnerability which may lead unauthentic (CVSS 7.3, Dell VNX2)
- [CVE-2022-24820](https://cve.now/CVE-2022-24820.md): Unauthenticated user can list hidden document from multiple velocity templates (CVSS 5.3, xwiki-platform · org.xwiki.platform:xwiki-platform-web)
- [CVE-2022-24819](https://cve.now/CVE-2022-24819.md): Unauthenticated user can retrieve the list of users through uorgsuggest.vm (CVSS 5.3, xwiki-platform · org.xwiki.platform:xwiki-platform-web-temp…)
- [CVE-2022-24821](https://cve.now/CVE-2022-24821.md): Incorrect Use of Privileged APIs in org.xwiki.platform.skin.skinx (CVSS 6.8, xwiki-platform · org.xwiki.platform:xwiki-platform-skin-ski…)
- [CVE-2022-1284](https://cve.now/CVE-2022-1284.md): heap-use-after-free in radareorg/radare2 (CVSS 7.5, radareorg/radare2)
- [CVE-2021-43498](https://cve.now/CVE-2021-43498.md): An Access Control vulnerability exists in ATutor 2.2.4 in password\_reminder.php when the g, id, h, form\_password\_hidden, and form\_change HTT (no CVSS)
- [CVE-2022-1283](https://cve.now/CVE-2022-1283.md): NULL Pointer Dereference in r\_bin\_ne\_get\_entrypoints function in radareorg/radare2 (CVSS 6.6, radareorg/radare2)
- [CVE-2021-43515](https://cve.now/CVE-2021-43515.md): CSV Injection (aka Excel Macro Injection or Formula Injection) exists in creating new timesheet in Kimai. (no CVSS, kevinpapst/kimai2)
- [CVE-2021-43517](https://cve.now/CVE-2021-43517.md): FOSCAM Camera FI9805E with firmware V4.02.R12.00018510.10012.143900.00000 contains a backdoor that opens Telnet port when special command is (no CVSS)
- [CVE-2021-43521](https://cve.now/CVE-2021-43521.md): A Buffer Overflow vulnerability exists in zlog 1.2.15 via zlog\_conf\_build\_with\_file in src/zlog/src/conf.c. (no CVSS)
- [CVE-2022-27047](https://cve.now/CVE-2022-27047.md): mogu\_blog\_cms 5.2 suffers from upload arbitrary files without any limitation. (no CVSS)
- [CVE-2022-27148](https://cve.now/CVE-2022-27148.md): GPAC mp4box 1.1.0-DEV-rev1663-g881c6a94a-master is vulnerable to Integer Overflow. (no CVSS)
- [CVE-2022-27146](https://cve.now/CVE-2022-27146.md): GPAC mp4box 1.1.0-DEV-rev1759-geb2d1e6dd-has a heap-buffer-overflow vulnerability in function gf\_isom\_apple\_enum\_tag. (no CVSS)
- [CVE-2022-22339](https://cve.now/CVE-2022-22339.md): IBM Planning Analytics 2.0 is vulnerable to server-side request forgery (SSRF). (CVSS 6.5, IBM Planning Analytics)
- [CVE-2020-4668](https://cve.now/CVE-2020-4668.md): IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.5, 6.1.0.0 through 6.1.0.3, and 6.1.1.0 is vulnerable to cross-site reque (CVSS 4.3, IBM Sterling B2B Integrator)
- [CVE-2021-43483](https://cve.now/CVE-2021-43483.md): An Access Control vulnerability exists in CLARO KAON CG3000 1.00.67 in the router configuration, which could allow a malicious user to read (no CVSS)
- [CVE-2021-40656](https://cve.now/CVE-2021-40656.md): libsixel before 1.10 is vulnerable to Buffer Overflow in libsixel/src/quant.c:867. (no CVSS)
- [CVE-2022-27044](https://cve.now/CVE-2022-27044.md): libsixel 1.8.6 is affected by Buffer Overflow in libsixel/src/quant.c:876. (no CVSS)
- [CVE-2021-41715](https://cve.now/CVE-2021-41715.md): libsixel 1.10.0 is vulnerable to Use after free in libsixel/src/dither.c:379. (no CVSS)
- [CVE-2022-27046](https://cve.now/CVE-2022-27046.md): libsixel 1.8.6 suffers from a Heap Use After Free vulnerability in in libsixel/src/dither.c:388. (no CVSS)
- [CVE-2021-46367](https://cve.now/CVE-2021-46367.md): RiteCMS version 3.1.0 and below suffers from a remote code execution vulnerability in the admin panel. (no CVSS)
- [CVE-2022-24229](https://cve.now/CVE-2022-24229.md): A cross-site scripting (XSS) vulnerability in ONLYOFFICE Document Server Example before v7.0.0 allows remote attackers inject arbitrary HTML (no CVSS)
- [CVE-2021-46437](https://cve.now/CVE-2021-46437.md): An issue was discovered in ZZCMS 2021. (no CVSS)
- [CVE-2021-46436](https://cve.now/CVE-2021-46436.md): An issue was discovered in ZZCMS 2021. (no CVSS)
- [CVE-2022-1219](https://cve.now/CVE-2022-1219.md): SQL injection in RecyclebinController.php in pimcore/pimcore (CVSS 7.2, pimcore/pimcore)
- [CVE-2022-28002](https://cve.now/CVE-2022-28002.md): Movie Seat Reservation v1 was discovered to contain an unauthenticated file disclosure vulnerability via /index.php?page=home. (no CVSS)
- [CVE-2022-28001](https://cve.now/CVE-2022-28001.md): Movie Seat Reservation v1 was discovered to contain a SQL injection vulnerability at /index.php?page=reserve via the id parameter. (no CVSS)
- [CVE-2022-28000](https://cve.now/CVE-2022-28000.md): Car Rental System v1.0 was discovered to contain a SQL injection vulnerability at /Car\_Rental/booking.php via the id parameter. (no CVSS)
- [CVE-2022-27992](https://cve.now/CVE-2022-27992.md): Zoo Management System v1.0 was discovered to contain a SQL injection vulnerability at /public\_html/animals via the class\_id parameter. (no CVSS)
- [CVE-2022-27357](https://cve.now/CVE-2022-27357.md): Ecommerce-Website v1 was discovered to contain an arbitrary file upload vulnerability via /customer\_register.php. (no CVSS)
- [CVE-2022-27991](https://cve.now/CVE-2022-27991.md): Online Banking System in PHP v1 was discovered to contain multiple SQL injection vulnerabilities at /staff\_login.php via the Staff ID and St (no CVSS)
- [CVE-2022-27351](https://cve.now/CVE-2022-27351.md): Zoo Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via /public\_html/apply\_vacancy. (no CVSS)
- [CVE-2022-27352](https://cve.now/CVE-2022-27352.md): Simple House Rental System v1 was discovered to contain an arbitrary file upload vulnerability via /app/register.php. (no CVSS)
- [CVE-2022-27348](https://cve.now/CVE-2022-27348.md): Social Codia SMS v1 was discovered to contain a stored cross-site scripting (XSS) vulnerability via add\_post.php. (no CVSS)
- [CVE-2022-27349](https://cve.now/CVE-2022-27349.md): Social Codia SMS v1 was discovered to contain an arbitrary file upload vulnerability via addteacher.php. (no CVSS)
- [CVE-2022-27346](https://cve.now/CVE-2022-27346.md): Ecommece-Website v1.1.0 was discovered to contain an arbitrary file upload vulnerability via /admin/index.php?slides. (no CVSS)
- [CVE-2022-27063](https://cve.now/CVE-2022-27063.md): AeroCMS v0.0.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability via view\_all\_comments.php. (no CVSS)
- [CVE-2022-27064](https://cve.now/CVE-2022-27064.md): Musical World v1 was discovered to contain an arbitrary file upload vulnerability via uploaded\_songs.php. (no CVSS)
- [CVE-2022-27062](https://cve.now/CVE-2022-27062.md): AeroCMS v0.0.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability via add\_post.php. (no CVSS)
- [CVE-2022-26624](https://cve.now/CVE-2022-26624.md): Bootstrap v3.1.11 and v3.3.7 was discovered to contain a cross-site scripting (XSS) vulnerability via the Title parameter in /vendor/views/a (no CVSS)
- [CVE-2022-27061](https://cve.now/CVE-2022-27061.md): AeroCMS v0.0.1 was discovered to contain an arbitrary file upload vulnerability via the Post Image function under the Admin panel. (no CVSS)
- [CVE-2022-28796](https://cve.now/CVE-2022-28796.md): jbd2\_journal\_wait\_updates in fs/jbd2/transaction.c in the Linux kernel before 5.17.1 has a use-after-free caused by a transaction\_t race con (no CVSS)
- [CVE-2022-27145](https://cve.now/CVE-2022-27145.md): GPAC mp4box 1.1.0-DEV-rev1727-g8be34973d-master has a stack-overflow vulnerability in function gf\_isom\_get\_sample\_for\_movie\_time of mp4box. (no CVSS)
- [CVE-2022-27147](https://cve.now/CVE-2022-27147.md): GPAC mp4box 1.1.0-DEV-rev1727-g8be34973d-master has a use-after-free vulnerability in function gf\_node\_get\_attribute\_by\_tag. (no CVSS)
- [CVE-2022-27152](https://cve.now/CVE-2022-27152.md): Roku devices running RokuOS v9.4.0 build 4200 or earlier that uses a Realtek WiFi chip is vulnerable to Arbitrary file modification. (no CVSS)
- [CVE-2022-28805](https://cve.now/CVE-2022-28805.md): singlevar in lparser.c in Lua from (including) 5.4.0 up to (excluding) 5.4.4 lacks a certain luaK\_exp2anyregup call, leading to a heap-based (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-04-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.