CVEs published April 10, 2022
39 CVEs were published on April 10, 2022: 1 critical, 2 high.
- Published
- 39
- Critical
- 1
- High
- 2
- Medium
- 2
- Low
- 0
- Unrated
- 34
- Now in CISA KEV
- 0
- Fix available
- 4
Most affected products
- mruby/mruby
- 2
- hhurz/tableexport.jquery.plugin · tableexport.jquery.plugin
- 1
- polonel/trudesk
- 1
- tildearrow Furnace
- 1
Critical 1
High 2
Medium, low and unrated 36
- CVE-2022-27961A cross-site scripting (XSS) vulnerability at /ofcms/company-c-47 in OFCMS v1.1.4 allows attackers to execute arbitrary web scripts or HTML
- CVE-2022-27477Newbee-Mall v1.0.0 was discovered to contain an arbitrary file upload via the Upload function at /admin/goods/edit.
- CVE-2022-27960Insecure permissions configured in the user_id parameter at SysUserController.java of OFCMS v1.1.4 allows attackers to access and arbitraril
- CVE-2022-27958Insecure permissions configured in the userid parameter at /user/getuserprofile of FEBS-Security v1.0 allows attackers to access and arbitra
- CVE-2022-27476A cross-site scripting (XSS) vulnerability at /admin/goods/update in Newbee-Mall v1.0.0 allows attackers to execute arbitrary web scripts or
- CVE-2022-27125zbzcms v1.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the neirong parameter at /php/ajax.php.
- CVE-2022-27126zbzcms v1.0 was discovered to contain a SQL injection vulnerability via the art parameter at /include/make.php.
- CVE-2022-27127zbzcms v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /php/ajax.php.
- CVE-2022-27128An incorrect access control issue at /admin/run_ajax.php in zbzcms v1.0 allows attackers to arbitrarily add administrator accounts.
- CVE-2022-27129An arbitrary file upload vulnerability at /admin/ajax.php in zbzcms v1.0 allows attackers to execute arbitrary code via a crafted PHP file.
- CVE-2022-27131An arbitrary file upload vulnerability at /zbzedit/php/zbz.php in zbzcms v1.0 allows attackers to execute arbitrary code via a crafted PHP f
- CVE-2022-27133zbzcms v1.0 was discovered to contain an arbitrary file deletion vulnerability via /include/up.php.
- CVE-2022-27268InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain a remote code execution (RCE) vulnerability
- CVE-2022-27269InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain a remote code execution (RCE) vulnerability
- CVE-2022-27270InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain a remote code execution (RCE) vulnerability
- CVE-2022-27271InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain a remote code execution (RCE) vulnerability
- CVE-2022-27272InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain a remote code execution (RCE) vulnerability
- CVE-2022-27273InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain a remote code execution (RCE) vulnerability
- CVE-2022-27274InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain a remote code execution (RCE) vulnerability
- CVE-2022-27275InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain a remote code execution (RCE) vulnerability
- CVE-2022-27276InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain a remote code execution (RCE) vulnerability
- CVE-2022-27277InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain an arbitrary file deletion vulnerability vi
- CVE-2022-27279InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain an arbitrary file read via the function sub
- CVE-2022-27280InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain a stored cross-site scripting (XSS) vulnera
- CVE-2022-27286D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formSetWanNonLogin.
- CVE-2022-27287D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formSetWanPPPoE.
- CVE-2022-27288D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formSetWanPPTP.
- CVE-2022-27289D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formSetWanL2TP.
- CVE-2022-27290D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formSetWanDhcpplus.
- CVE-2022-27291D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formdumpeasysetup.
- CVE-2022-27292D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formLanguageChange.
- CVE-2022-27293D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formWlanSetup.
- CVE-2022-27294D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formWlanWizardSetup.
- CVE-2022-27295D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formAdvanceSetup.
- CVE-2022-1289tildearrow Furnace Incomplete Fix CVE-2022-1211 denial of servicetildearrow Furnace
- CVE-2022-1286heap-buffer-overflow in mrb_vm_exec in mruby/mruby in mruby/mrubymruby/mruby