CVEs published April 11, 2022
186 CVEs were published on April 11, 2022: 3 critical, 30 high. 1 is now in CISA KEV.
- Published
- 186
- Critical
- 3
- High
- 30
- Medium
- 50
- Low
- 12
- Unrated
- 91
- Now in CISA KEV
- 1
- Fix available
- 98
Most affected products
- Samsung Mobile Devices
- 38
- Huawei HarmonyOS · Huawei EMUI +1
- 6
- Autodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, Aut…
- 3
- Samsung Mobile Galaxy Store
- 3
- Advanced Booking Calendar
- 2
- Autodesk Navisworks
- 2
- Export All URLs
- 2
- GitLab
- 2
- Huawei HarmonyOS · Huawei EMUI
- 2
- IBM Hardware Management Console
- 2
Critical 3
- CVE-2022-1161ICSA-22-090-05 Rockwell Automation Logix ControllersRockwell Automation 1768 CompactLogix controllers · Roc… +15
- CVE-2022-22954VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection.VMware Workspace ONE Access and Identity Manager
- CVE-2022-1045Stored XSS viva .svg file upload in polonel/trudeskpolonel/trudesk
High 30
- CVE-2022-24839Uncontrolled Resource Consumption in org.cyberneko.html (nokogiri fork)sparklemotion nekohtml · org.nokogiri:nekohtml
- CVE-2022-24833Persistent Cross-site Scripting (XSS) vulnerability in PrivateBinPrivateBin · privatebin/privatebin
- CVE-2022-24832Bundled ldap-authentication-plugin fails to neutralise LDAP special elements in usernamesgocd
- CVE-2022-24827SQL Injection in elide-datastore-aggregationyahoo elide · com.yahoo.elide:elide-datastore-aggregation
- CVE-2022-1316Incorrect Permission Assignment for Critical Resource in zerotier/zerotieronezerotier/zerotierone
- CVE-2022-24829Missing authentication in Gardengarden-io garden
- CVE-2022-0835AVEVA System Platform Cleartext Storage of Sensitive Information in MemoryAVEVA System Platform
- CVE-2022-0999mySCADA myPRO Command InjectionmySCADA myPRO
- CVE-2022-27838Improper access control vulnerability in FactoryCamera prior to version 2.1.96 allows attacker to access the file with system privilege.Samsung Mobile FactoryCamera
- CVE-2022-27836Improper access control and path traversal vulnerability in Storage Manager and Storage Manager Service prior to SMR Apr-2022 Release 1 alloSamsung Mobile Devices
- CVE-2022-27835Improper boundary check in UWB firmware prior to SMR Apr-2022 Release 1 allows arbitrary memory write.Samsung Mobile Devices
- CVE-2022-27830Improper validation vulnerability in SemBlurInfo prior to SMR Apr-2022 Release 1 allows attackers to launch certain activities.Samsung Mobile Devices
- CVE-2022-27829Improper validation vulnerability in VerifyCredentialResponse prior to SMR Apr-2022 Release 1 allows attackers to launch certain activities.Samsung Mobile Devices
- CVE-2022-27828Improper validation vulnerability in MediaMonitorEvent prior to SMR Apr-2022 Release 1 allows attackers to launch certain activities.Samsung Mobile Devices
- CVE-2022-27826Improper validation vulnerability in SemSuspendDialogInfo prior to SMR Apr-2022 Release 1 allows attackers to launch certain activities.Samsung Mobile Devices
- CVE-2022-27827Improper validation vulnerability in MediaMonitorDimension prior to SMR Apr-2022 Release 1 allows attackers to launch certain activities.Samsung Mobile Devices
- CVE-2022-27572Heap-based buffer overflow vulnerability in parser_ipma function of libsimba library prior to SMR Apr-2022 Release 1 allows code execution bSamsung Mobile Devices
- CVE-2022-27571Heap-based buffer overflow vulnerability in sheifd_get_info_image function in libsimba library prior to SMR Apr-2022 Release 1 allows code eSamsung Mobile Devices
- CVE-2022-27570Heap-based buffer overflow vulnerability in parser_single_iref function in libsimba library prior to SMR Apr-2022 Release 1 allows code execSamsung Mobile Devices
- CVE-2022-27568Heap-based buffer overflow vulnerability in parser_iloc function in libsimba library prior to SMR Apr-2022 Release 1 allows code execution bSamsung Mobile Devices
- CVE-2022-27569Heap-based buffer overflow vulnerability in parser_infe function in libsimba library prior to SMR Apr-2022 Release 1 allows code execution bSamsung Mobile Devices
- CVE-2022-26098Heap-based buffer overflow vulnerability in sheifd_create function of libsimba library prior to SMR Apr-2022 Release 1 allows code executionSamsung Mobile Devices
- CVE-2022-26092Improper boundary check in Quram Agif library prior to SMR Apr-2022 Release 1 allows arbitrary code execution.Samsung Mobile Devices
- CVE-2022-24815SQL Injection when creating an application with Reactive SQL backend generator-jhipster
- CVE-2022-26413A command injection vulnerability in the CGI program of Zyxel VMG3312-T20A firmware version 5.30(ABFX.5)C0 could allow a local authenticatedZyxel VMG3312-T20A firmware
- CVE-2022-0556A local privilege escalation vulnerability caused by incorrect permission assignment in some directories of the Zyxel AP Configurator (ZAC) Zyxel AP Configurator
- CVE-2022-1295Prototype Pollution in alvarotrigo/fullpage.jsalvarotrigo/fullpage.js · fullpage.js
- CVE-2022-1252Use of a Broken or Risky Cryptographic Algorithm in gnuboard/gnuboard5gnuboard/gnuboard5
- CVE-2022-0936Cross-site Scripting (XSS) - Stored in autolab/autolabautolab/autolab
- CVE-2022-24836Inefficient Regular Expression Complexity in Nokogirisparklemotion nokogiri · nokogiri
Medium, low and unrated 153
- CVE-2022-24838Command Injection in Appointment Emails for Nextcloud Calendarnextcloud security-advisories
- CVE-2022-24837Enumerable upload file names in hedgedochedgedoc
- CVE-2022-25614WordPress eRoom plugin <= 1.3.7 - Cross-Site Request Forgery (CSRF) leading to Sync with Zoom Meetings vulnerabilityStylemixThemes eRoom – Zoom Meetings & Webinar
- CVE-2022-25615WordPress eRoom plugin <= 1.3.8 - Cross-Site Request Forgery (CSRF) vulnerability leading to Cache DeletionStylemixThemes eRoom – Zoom Meetings & Webinar
- CVE-2022-0552A flaw was found in the original fix for the netty-codec-http CVE-2021-21409, where the OpenShift Logging openshift-logging/elasticsearch6-rorigin-aggregated-logging/elasticsearch
- CVE-2021-4047The release of OpenShift 4.9.6 included four CVE fixes for the haproxy package, however the patch for CVE-2021-39242 was missing.OpenShift
- CVE-2022-22964VMware Horizon Agent for Linux (prior to 22.x) contains a local privilege escalation that allows a user to escalate to root due to a vulneraVMware Horizon Agent for Linux
- CVE-2022-22962VMware Horizon Agent for Linux (prior to 22.x) contains a local privilege escalation as a user is able to change the default shared folder lVMware Horizon Agent for Linux
- CVE-2022-1157Missing sanitization of logged exception messages in all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 of GitLab GitLab
- CVE-2022-1193Improper access control in GitLab CE/EE versions 10.7 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allows a malicious actGitLab
- CVE-2021-40065The communication module has a service logic error vulnerability.Successful exploitation of this vulnerability may affect data confidentialiHuawei HarmonyOS · Huawei EMUI +1
- CVE-2021-46740The device authentication service module has a defect vulnerability introduced in the design process.Successful exploitation of this vulneraHuawei HarmonyOS · Huawei EMUI
- CVE-2021-46742The multi-window module has a vulnerability of unauthorized insertion and tampering of Settings.Secure data.Successful exploitation of this Huawei HarmonyOS · Huawei EMUI +1
- CVE-2022-22253The DFX module has a vulnerability of improper validation of integrity check values.Successful exploitation of this vulnerability may affectHuawei HarmonyOS · Huawei EMUI +1
- CVE-2022-22254A permission bypass vulnerability exists when the NFC CAs access the TEE.Successful exploitation of this vulnerability may affect data confiHuawei HarmonyOS · Huawei EMUI +1
- CVE-2022-22255The application framework has a common DoS vulnerability.Successful exploitation of this vulnerability may affect the availability.Huawei HarmonyOS · Huawei EMUI
- CVE-2022-22256The DFX module has an access control vulnerability.Successful exploitation of this vulnerability may affect data confidentiality.Huawei HarmonyOS · Huawei EMUI +1
- CVE-2022-22257The customization framework has a vulnerability of improper permission control.Successful exploitation of this vulnerability may affect dataHuawei HarmonyOS · Huawei EMUI +1
- CVE-2022-22258The Wi-Fi module has an event notification vulnerability.Successful exploitation of this vulnerability may allow third-party applications toHarmonyOS;EMUI;Magic UI
- CVE-2022-27845WordPress Plausible Analytics plugin <= 1.2.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityPlausibleHQ Plausible Analytics
- CVE-2022-27844WordPress WPvivid plugin <= 0.9.70 - Arbitrary File Read vulnerabilityWPvivid Team Migration, Backup, Staging – WPvivid
- CVE-2022-1067ICSMA-22-095-01 LifePoint Informatics Patient PortalLifePoint Informatics Patient Portal
- CVE-2022-1262A command injection vulnerability in the protest binary allows an attacker with access to the remote command line interface to execute arbitD-Link Routers
- CVE-2022-22572A non-admin user with user management permission can escalate his privilege to admin user via password reset functionality.Ivanti Incapptic Connect
- CVE-2022-22571An authenticated high privileged user can perform a stored XSS attack due to incorrect output encoding in Incapptic connect and affects all Ivanti Incapptic Connect
- CVE-2022-20080In SUB2AF, there is a possible memory corruption due to a race condition.MediaTek MT6580, MT6735, MT6737, MT6739, MT6753, MT6757, MT…
- CVE-2022-20079In vow, there is a possible read of uninitialized data due to a improper input validation.MediaTek MT6781, MT6785, MT6833, MT6853, MT6853T, MT6873, M…
- CVE-2022-20078In vow, there is a possible memory corruption due to a race condition.MediaTek MT6833, MT6853, MT6853T, MT6873, MT6877, MT6883, M…
- CVE-2022-20077In vow, there is a possible memory corruption due to a race condition.MediaTek MT6781, MT6785, MT6833, MT6853, MT6853T, MT6873, M…
- CVE-2022-20075In ged, there is a possible out of bounds write due to an integer overflow.MediaTek MT6580, MT6731, MT6735, MT6750S, MT6753, MT6755S,…
- CVE-2022-20076In ged, there is a possible memory corruption due to an incorrect error handling.MediaTek MT6580, MT6731, MT6735, MT6750S, MT6753, MT6755S,…
- CVE-2022-20074In preloader (partition), there is a possible out of bounds write due to a missing bounds check.MediaTek MT6761, MT6762, MT6763, MT6765, MT6768, MT6769, MT…
- CVE-2022-20073In preloader (usb), there is a possible out of bounds write due to a integer underflow.MediaTek MT2601, MT6580, MT6735, MT6739, MT6761, MT6763, MT…
- CVE-2022-20072In search engine service, there is a possible way to change the default search engine due to an incorrect comparison.MediaTek MT6580, MT6735, MT6737, MT6739, MT6753, MT6755, MT…
- CVE-2022-20070In ssmr, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6731, MT6732, MT6735, MT6737, MT6739, MT6750, MT…
- CVE-2022-20071In ccu, there is a possible escalation of privilege due to a missing certificate validation.MediaTek MT6833, MT6853, MT6873, MT6877, MT6885, MT6893, MT…
- CVE-2022-20069In preloader (usb), there is a possible out of bounds write due to an integer overflow.MediaTek MT6580, MT6735, MT6739, MT6761, MT6762, MT6763, MT…
- CVE-2022-20068In mobile_log_d, there is a possible symbolic link following due to an improper link resolution.MediaTek MT6731, MT6732, MT6735, MT6737, MT6739, MT6761, MT…
- CVE-2022-20052In mdp, there is a possible memory corruption due to a use after free.MediaTek MT6580, MT6735, MT6737, MT6739, MT6750, MT6753, MT…
- CVE-2022-20067In mdp, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6731, MT6735, MT6739, MT6750, MT6755, MT6755S, M…
- CVE-2022-20066In atf (hwfde), there is a possible leak of sensitive information due to incorrect error handling.MediaTek MT6580, MT6739, MT6761, MT6765, MT6769, MT6771, MT…
- CVE-2022-20064In ccci, there is a possible leak of kernel pointer due to an incorrect bounds check.MediaTek MT6580, MT6737, MT6739, MT6761, MT6762, MT6763, MT…
- CVE-2022-20065In ccci, there is a possible out of bounds read due to a missing bounds check.MediaTek MT6580, MT6737, MT6739, MT6761, MT6762, MT6765, MT…
- CVE-2022-20063In atf (spm), there is a possible out of bounds write due to a missing bounds check.MediaTek MT6765, MT8385, MT8666, MT8667, MT8766, MT8786, MT…
- CVE-2022-20062In mdp, there is a possible memory corruption due to a use after free.MediaTek MT6765, MT6785, MT6833, MT6853, MT6853T, MT6873, M…
- CVE-2022-20081In A-GPS, there is a possible man in the middle attack due to improper certificate validation.MediaTek MT6580, MT6735, MT6737, MT6739, MT6753, MT6761, MT…
- CVE-2022-27528A maliciously crafted DWFX and SKP files in Autodesk Navisworks 2022 can be used to trigger use-after-free vulnerability.Autodesk Navisworks
- CVE-2022-25796A Double Free vulnerability allows remote malicious actors to execute arbitrary code on DWF file in Autodesk Navisworks 2022 within affectedAutodesk Navisworks
- CVE-2022-25792A maliciously crafted DXF file in Autodesk AutoCAD 2022, 2021, 2020, 2019 and Autodesk Navisworks 2022 can be used to write beyond the allocAutodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, Aut…
- CVE-2022-25790A maliciously crafted DWF file in Autodesk AutoCAD 2022, 2021, 2020, 2019 and Autodesk Navisworks 2022 can be used to write beyond the allocAutodesk Navisworks, Advanced Steel, Civil 3D, AutoCAD, Aut…
- CVE-2022-25791A Memory Corruption vulnerability for DWF and DWFX files in Autodesk AutoCAD 2022, 2021, 2020, 2019 and Autodesk Navisworks 2022 may lead toAutodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, Aut…
- CVE-2022-25789A maliciously crafted DWF, 3DS and DWFX files in Autodesk AutoCAD 2022, 2021, 2020, 2019 can be used to trigger use-after-free vulnerabilityAutodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, Aut…
- CVE-2021-38125Unauthenticated remote code execution in Micro Focus Operations Bridge containerized, affecting versions 2021.05, 2021.08, and newer versionOperations Bridge containerized.
- CVE-2021-36893WordPress Responsive Tabs plugin <= 4.0.5 - Cross-Site Scripting (XSS) vulnerabilityWP Darko Responsive Tabs
- CVE-2022-27577The vulnerability in the MSC800 in all versions before 4.15 allows for an attacker to predict the TCP initial sequence number.SICK MSC800
- CVE-2022-27578An attacker can perform a privilege escalation through the SICK OEE if the application is installed in a directory where non authenticated oSICK Overall Equipment Effectiveness
- CVE-2022-28778Improper access control vulnerability in Samsung Security Supporter prior to version 1.2.40.0 allows attacker to set the arbitrary folder asSamsung Mobile Samsung Security Supporter
- CVE-2022-28779Uncontrolled search path element vulnerability in Samsung Android USB Driver windows installer program prior to version 1.7.50 allows attackSamsung Mobile Samsung Android USB Driver windows installer
- CVE-2022-28777Improper access control vulnerability in Samsung Members prior to version 13.6.08.5 allows local attacker to execute call function without CSamsung Mobile Samsung Members
- CVE-2022-28776Improper access control vulnerability in Galaxy Store prior to version 4.5.36.4 allows attacker to install applications from Galaxy Store wiSamsung Mobile Galaxy Store
- CVE-2022-28775Improper access control vulnerability in Samsung Flow prior to version 4.8.06.5 allows attacker to write the file without Samsung Flow permiSamsung Mobile Samsung Flow
- CVE-2021-36846WordPress Chaty plugin <= 2.8.3 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityPremio Chaty
- CVE-2021-43177As a result of an incomplete fix for CVE-2015-7225, in versions of devise-two-factor prior to 4.0.2 it is possible to reuse a One-Time-PasswTinfoil devise-two-factor · devise-two-factor
- CVE-2021-22055The SchedulerServer in Vmware photon allows remote attackers to inject logs through \r in the package parameter.Photon OS
- CVE-2022-28544Path traversal vulnerability in unzip method of InstallAgentCommonHelper in Galaxy store prior to version 4.5.40.5 allows attacker to accessSamsung Mobile Galaxy Store
- CVE-2022-28542Improper sanitization of incoming intent in Galaxy Store prior to version 4.5.40.5 allows local attackers to access privileged content proviSamsung Mobile Galaxy Store
- CVE-2022-28543Path traversal vulnerability in Samsung Flow prior to version 4.8.07.4 allows local attackers to read arbitrary files as Samsung Flow permisSamsung Mobile Samsung Flow
- CVE-2022-28541Uncontrolled search path element vulnerability in Samsung Update prior to version 3.0.77.0 allows attackers to execute arbitrary code as SamSamsung Mobile Samsung Update
- CVE-2022-27843DLL hijacking vulnerability in Kies prior to version 2.6.4.22014_2 allows attacker to execute abitrary code.Samsung Mobile Kies
- CVE-2022-27841Improper exception handling in Samsung Pass prior to version 3.7.07.5 allows physical attacker to view the screen that is previously runningSamsung Mobile Samsung Pass
- CVE-2022-27842DLL hijacking vulnerability in Smart Switch PC prior to version 4.2.22022_4 allows attacker to execute abitrary code.Samsung Mobile Smart Switch PC
- CVE-2022-27840Improper access control vulnerability in SamsungRecovery prior to version 8.1.43.0 allows local attckers to delete arbitrary files as SamsunSamsung Mobile Samsung Recovery
- CVE-2022-27839Improper authentication vulnerability in SecretMode in Samsung Internet prior to version 16.2.1 allows attackers to access bookmark tab withSamsung Mobile Samsung Internet
- CVE-2022-27837A vulnerability using PendingIntent in Accessibility prior to version 12.5.3.2 in Android R(11.0) and 13.0.1.1 in Android S(12.0) allows attSamsung Mobile Accessibility
- CVE-2022-27834Use after free vulnerability in dsp_context_unload_graph function of DSP driver prior to SMR Apr-2022 Release 1 allows attackers to perform Samsung Mobile Devices
- CVE-2022-27832Improper boundary check in media.extractor library prior to SMR Apr-2022 Release 1 allows attackers to cause denial of service via a craftedSamsung Mobile Devices
- CVE-2022-27833Improper input validation in DSP driver prior to SMR Apr-2022 Release 1 allows out-of-bounds write by integer overflow.Samsung Mobile Devices
- CVE-2022-27831Improper boundary check in sflvd_rdbuf_bits of libsflvextractor prior to SMR Apr-2022 Release 1 allows attackers to read out of bounds memorSamsung Mobile Devices
- CVE-2022-27825Improper size check in sapefd_parse_meta_HEADER function of libsapeextractor library prior to SMR Apr-2022 Release 1 allows out of bounds reSamsung Mobile Devices
- CVE-2022-27824Improper size check of in sapefd_parse_meta_DESCRIPTION function of libsapeextractor library prior to SMR Apr-2022 Release 1 allows out of bSamsung Mobile Devices
- CVE-2022-27822Information exposure vulnerability in ril property setting prior to SMR April-2022 Release 1 allows access to EF_RUIMID value without permisSamsung Mobile Devices
- CVE-2022-27823Improper size check in sapefd_parse_meta_HEADER_old function of libsapeextractor library prior to SMR Apr-2022 Release 1 allows out of boundSamsung Mobile Devices
- CVE-2022-27821Improper boundary check in Quram Agif library prior to SMR Apr-2022 Release 1 allows attackers to cause denial of service via crafted image Samsung Mobile Devices
- CVE-2022-27576Information exposure vulnerability in Samsung DeX Home prior to SMR April-2022 Release 1 allows to access currently launched foreground app Samsung Mobile Devices
- CVE-2022-27575Information exposure vulnerability in One UI Home prior to SMR April-2022 Release 1 allows to access currently launched foreground app inforSamsung Mobile Devices
- CVE-2022-27573Improper input validation vulnerability in parser_infe and sheifd_find_itemIndexin fuctions of libsimba library prior to SMR Apr-2022 ReleasSamsung Mobile Devices
- CVE-2022-27574Improper input validation vulnerability in parser_iloc and sheifd_find_itemIndexin fuctions of libsimba library prior to SMR Apr-2022 ReleasSamsung Mobile Devices
- CVE-2022-27567Null pointer dereference vulnerability in parser_hvcC function of libsimba library prior to SMR Apr-2022 Release 1 allows out of bounds writSamsung Mobile Devices
- CVE-2022-26099Null pointer dereference vulnerability in parser_infe function of libsimba library prior to SMR Apr-2022 Release 1 allows out of bounds readSamsung Mobile Devices
- CVE-2022-26097Null pointer dereference vulnerability in parser_unknown_property function in libsimba library prior to SMR Apr-2022 Release 1 allows out ofSamsung Mobile Devices
- CVE-2022-26096Null pointer dereference vulnerability in parser_ispe function in libsimba library prior to SMR Apr-2022 Release 1 allows out of bounds writSamsung Mobile Devices
- CVE-2022-26095Null pointer dereference vulnerability in parser_colr function in libsimba library prior to SMR Apr-2022 Release 1 allows out of bounds writSamsung Mobile Devices
- CVE-2022-26094Null pointer dereference vulnerability in parser_auxC function in libsimba library prior to SMR Apr-2022 Release 1 allows out of bounds writSamsung Mobile Devices
- CVE-2022-26093Null pointer dereference vulnerability in parser_irot function in libsimba library prior to SMR Apr-2022 Release 1 allows out of bounds writSamsung Mobile Devices
- CVE-2022-26091Improper access control vulnerability in Knox Manage prior to SMR Apr-2022 Release 1 allows that physical attackers can bypass Knox Manage uSamsung Mobile Devices
- CVE-2022-26090Improper access control vulnerability in SamsungContacts prior to SMR Apr-2022 Release 1 allows that attackers can access contact informatioSamsung Mobile SamsungContacts
- CVE-2022-25833Improper authentication in ImsService prior to SMR Apr-2022 Release 1 allows attackers to get IMSI without READ_PRIVILEGED_PHONE_STATE permiSamsung Mobile Devices
- CVE-2022-25832Improper authentication vulnerability in S Secure prior to SMR Apr-2022 Release 1 allows physical attackers to use locked Myfiles app withouSamsung Mobile Devices
- CVE-2021-36896WordPress Pricing Table plugin <= 1.5.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityW3 Eden Pricing Table
- CVE-2022-25831Improper access control vulnerability in S Secure prior to SMR Apr-2022 Release 1 allows physical attackers to access secured data in certaiSamsung Mobile Devices
- CVE-2021-36848WordPress Social Media Feather plugin <= 2.0.4 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilitySocialmediafeather Social Media Feather
- CVE-2021-36910WordPress WP-Appbox plugin <= 4.3.20 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityMarcel Schmilgeit WP-Appbox
- CVE-2022-24804Private group name exposure in discoursediscourse
- CVE-2021-43442A Logic Flaw vulnerability exists in i3 International Inc Annexxus Camera V5.2.0 build 150317 (Ax46), V5.0.9 build 151106 (Ax68), and V5.0.9
- CVE-2021-39068IBM Curam Social Program Management 8.0.1 and 7.0.11 is vulnerable to cross-site scripting.IBM Curam Social Program Management
- CVE-2021-38930IBM System Storage DS8000 Management Console (HMC) R8.5 88.5x.x.x, R9.1 89.1x.0.0, and R9.2 89.2x.0.0 could allow a remote attacker to obtaiIBM Hardware Management Console
- CVE-2021-38929IBM System Storage DS8000 Management Console (HMC) R8.5 88.5x.x.x, R9.1 89.1x.0.0, and R9.2 89.2x.0.0 could allow a remote attacker to obtaiIBM Hardware Management Console
- CVE-2021-37292An Access Control vulnerability exists in KevinLAB Inc Building Energy Management System 4ST BEMS 1.0.0 due to an undocumented backdoor acco
- CVE-2022-29035In JetBrains Ktor Native before version 2.0.0 random values used for nonce generation weren't using SecureRandom implementationsJetBrains Ktor
- CVE-2021-37293A Directory Traversal vulnerability exists in KevinLAB Inc Building Energy Management System 4ST BEMS 1.0.0 via the page GET parameter in in
- CVE-2021-37291An SQL Injection vulnerability exists in KevinLAB Inc Building Energy Management System 4ST BEMS 1.0.0 ivia the input_id POST parameter in i
- CVE-2021-40219Bolt CMS <= 4.2 is vulnerable to Remote Code Execution.bolt/core
- CVE-2022-27111Jfinal_CMS 5.1.0 allows attackers to use the feedback function to send malicious XSS code to the administrator backend and execute it.
- CVE-2022-1023Podcast Importer SecondLine < 1.3.8 - Admin+ SQLiPodcast Importer SecondLine
- CVE-2022-1008One Click Demo Import < 3.1.0 - Admin+ Arbitrary File UploadOne Click Demo Import
- CVE-2022-1007Advanced Booking Calendar < 1.7.1 - Reflected Cross-Site ScriptingAdvanced Booking Calendar
- CVE-2022-1006Advanced Booking Calendar < 1.7.1 - Admin+ SQLiAdvanced Booking Calendar
- CVE-2022-0989NS WooCommerce Watermark <= 2.11.3 - Abuse of FunctionalityNS WooCommerce Watermark
- CVE-2022-0969Image optimization & Lazy Load < 3.3.2 - Admin+ Stored Cross-Site ScriptingImage optimization & Lazy Load by Optimole
- CVE-2022-0949WP Block and Stop Bad Bots < 6.930 - Unauthenticated SQLiBlock Bad Bots and Stop Bad Bots Crawlers and Spiders and A…
- CVE-2022-0920Salon booking system < 7.6.3 - Customer+ Bookings/Customers Data DisclosureSalon booking system
- CVE-2022-0919Salon booking system < 7.6.3 - Unauthenticated Sensitive Data DisclosureSalon booking system
- CVE-2022-0914Export All URLs < 4.3 - Private/Draft Post/Page Title Disclosure via CSRFExport All URLs
- CVE-2022-0892Export All URLs < 4.2 - Reflected Cross-Site ScriptingExport All URLs
- CVE-2022-0840Easy Social Icons < 3.2.1 - Admin+ Stored Cross-Site Scripting in add iconEasy Social Icons
- CVE-2022-0828Download Manager < 3.2.39 - Unauthenticated brute force of files master keyDownload Manager
- CVE-2022-0728Easy Smooth Scroll Links < 2.23.1 - Admin+ Stored Cross-Site ScriptingEasy Smooth Scroll Links
- CVE-2022-0531WPvivid Backup and Migration Plugin < 0.9.70 - Reflected Cross-Site ScriptingMigration, Backup, Staging – WPvivid
- CVE-2022-0471Favicon by RealFaviconGenerator < 1.3.23 - Reflected Cross-Site ScriptingFavicon by RealFaviconGenerator
- CVE-2022-0447Post Grid < 2.1.16 - Reflected Cross-Site Scripting via post_typesPost Grid
- CVE-2022-0314Nimble Page Builder < 3.2.2 - Reflected Cross-Site ScriptingNimble Page Builder
- CVE-2022-0271LearnPress < 4.1.6 - Reflected Cross-Site ScriptingLearnPress – WordPress LMS Plugin
- CVE-2022-0246iQ Block Country < 1.2.13 - Admin+ Arbitrary File Deletion via Zip SlipiQ Block Country
- CVE-2021-25090GridKit Portfolio < 2.1.0 - Subscriber+ Stored Cross-Site ScriptingPortfolio Gallery, Product Catalog – Grid KIT Portfolio
- CVE-2021-24987Super Socializer < 7.13.30 - Reflected Cross-Site ScriptingSocial Share, Social Login and Social Comments Plugin – Sup…
- CVE-2021-24986Post Grid < 2.1.16 - Reflected Cross-Site Scripting via keywordPost Grid
- CVE-2022-27156Daylight Studio Fuel CMS 1.5.1 is vulnerable to HTML Injection.
- CVE-2022-27115In Studio-42 elFinder 2.1.60, there is a vulnerability that causes remote code execution through file name bypass for file upload.studio-42/elfinder
- CVE-2022-27088Ivanti DSM Remote <= 6.3.1.1862 is vulnerable to an unquoted service path allowing local users to launch processes with elevated privileges.
- CVE-2022-27089In Fujitsu PlugFree Network <= 7.3.0.3, an Unquoted service path in PFNService.exe software allows a local attacker to potentially escalate
- CVE-2022-27041Due to lack of protection, parameter student_id in OpenSIS Classic 8.0 /modules/eligibility/Student.php can be used to inject SQL queries to
- CVE-2022-26414A potential buffer overflow vulnerability was identified in some internal functions of Zyxel VMG3312-T20A firmware version 5.30(ABFX.5)C0, wZyxel VMG3312-T20A firmware
- CVE-2022-1297Out-of-bounds Read in r_bin_ne_get_entrypoints function in radareorg/radare2radareorg/radare2
- CVE-2022-1296Out-of-bounds read in `r_bin_ne_get_relocs` function in radareorg/radare2radareorg/radare2
- CVE-2021-32162A Cross-site request forgery (CSRF) vulnerability exists in Webmin 1.973 through the File Manager feature.
- CVE-2021-32161A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 through the File Manager feature.
- CVE-2021-32160A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 through the Add Users feature.
- CVE-2021-32159A Cross-site request forgery (CSRF) vulnerability exists in Webmin 1.973 via the Upload and Download feature.
- CVE-2021-32158A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 via the Upload and Download feature.
- CVE-2021-32157A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 via the Scheduled Cron Jobs feature.
- CVE-2021-32156A cross-site request forgery (CSRF) vulnerability exists in Webmin 1.973 via the Scheduled Cron Jobs feature.
- CVE-2022-28893The SUNRPC subsystem in the Linux kernel through 5.17.2 can call xs_xprt_free before ensuring that sockets are in the intended state.
- CVE-2022-25794An Out-Of-Bounds Read Vulnerability in Autodesk FBX Review version 1.5.2 and prior may lead to code execution through maliciously crafted AcAutodesk FBX Review