# CVEs published 2022-04-12

166 CVEs were published on April 12, 2022: 1 critical, 19 high. Days are UTC.

- [CVE-2022-26589](https://cve.now/CVE-2022-26589.md): A Cross-Site Request Forgery (CSRF) in Pluck CMS v4.7.15 allows attackers to delete arbitrary pages. (no CVSS)
- [CVE-2022-26151](https://cve.now/CVE-2022-26151.md): Citrix XenMobile Server 10.12 through RP11, 10.13 through RP7, and 10.14 through RP4 allows Command Injection. (no CVSS)
- [CVE-2021-44520](https://cve.now/CVE-2021-44520.md): In Citrix XenMobile Server through 10.12 RP9, there is an Authenticated Command Injection vulnerability, leading to remote code execution wi (no CVSS)
- [CVE-2022-1330](https://cve.now/CVE-2022-1330.md): stored xss due to unsantized anchor url in alvarotrigo/fullpage.js (CVSS 9.4, alvarotrigo/fullpage.js · fullpage.js)
- [CVE-2022-27419](https://cve.now/CVE-2022-27419.md): rtl\_433 21.12 was discovered to contain a stack overflow in the function acurite\_00275rm\_decode at /devices/acurite.c. (no CVSS)
- [CVE-2022-29052](https://cve.now/CVE-2022-29052.md): Jenkins Google Compute Engine Plugin 4.3.8 and earlier stores private keys unencrypted in cloud agent config.xml files on the Jenkins contro (no CVSS, Jenkins project Jenkins Google Compute Engine Plugin · org.…)
- [CVE-2022-29051](https://cve.now/CVE-2022-29051.md): Missing permission checks in Jenkins Publish Over FTP Plugin 1.16 and earlier allow attackers with Overall/Read permission to connect to an (no CVSS, Jenkins project Jenkins Publish Over FTP Plugin · org.jenki…)
- [CVE-2022-29050](https://cve.now/CVE-2022-29050.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Publish Over FTP Plugin 1.16 and earlier allows attackers to connect to an FTP (no CVSS, Jenkins project Jenkins Publish Over FTP Plugin · org.jenki…)
- [CVE-2022-29048](https://cve.now/CVE-2022-29048.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Subversion Plugin 2.15.3 and earlier allows attackers to connect to an attacker (no CVSS, Jenkins project Jenkins Subversion Plugin · org.jenkins-ci.…)
- [CVE-2022-29047](https://cve.now/CVE-2022-29047.md): Jenkins Pipeline: Shared Groovy Libraries Plugin 564.ve62a\_4eb\_b\_e039 and earlier, except 2.21.3, allows attackers able to submit pull reque (no CVSS, Jenkins project Jenkins Pipeline: Shared Groovy Libraries P…)
- [CVE-2022-29046](https://cve.now/CVE-2022-29046.md): Jenkins Subversion Plugin 2.15.3 and earlier does not escape the name and description of List Subversion tags (and more) parameters on views (no CVSS, Jenkins project Jenkins Subversion Plugin · org.jenkins-ci.…)
- [CVE-2022-29044](https://cve.now/CVE-2022-29044.md): Jenkins Node and Label parameter Plugin 1.10.3 and earlier does not escape the name and description of Node and Label parameters on views di (no CVSS, Jenkins project Jenkins Node and Label parameter Plugin · o…)
- [CVE-2022-29043](https://cve.now/CVE-2022-29043.md): Jenkins Mask Passwords Plugin 3.0 and earlier does not escape the name and description of Non-Stored Password parameters on views displaying (no CVSS, Jenkins project Jenkins Mask Passwords Plugin · org.jenkins…)
- [CVE-2022-29042](https://cve.now/CVE-2022-29042.md): Jenkins Job Generator Plugin 1.22 and earlier does not escape the name and description of Generator Parameter and Generator Choice parameter (no CVSS, Jenkins project Jenkins Job Generator Plugin · org.jenkins-…)
- [CVE-2022-29041](https://cve.now/CVE-2022-29041.md): Jenkins Jira Plugin 3.7 and earlier, except 3.6.1, does not escape the name and description of Jira Issue and Jira Release Version parameter (no CVSS, Jenkins project Jenkins Jira Plugin · org.jenkins-ci.plugin…)
- [CVE-2022-29040](https://cve.now/CVE-2022-29040.md): Jenkins Git Parameter Plugin 0.9.15 and earlier does not escape the name and description of Git parameters on views displaying parameters, r (no CVSS, Jenkins project Jenkins Git Parameter Plugin · org.jenkins-…)
- [CVE-2022-29039](https://cve.now/CVE-2022-29039.md): Jenkins Gerrit Trigger Plugin 2.35.2 and earlier does not escape the name and description of Base64 Encoded String parameters on views displ (no CVSS, Jenkins project Jenkins Gerrit Trigger Plugin · com.sonyeri…)
- [CVE-2022-29038](https://cve.now/CVE-2022-29038.md): Jenkins Extended Choice Parameter Plugin 346.vd87693c5a\_86c and earlier does not escape the name and description of Extended Choice paramete (no CVSS, Jenkins project Jenkins Extended Choice Parameter Plugin ·…)
- [CVE-2022-29037](https://cve.now/CVE-2022-29037.md): Jenkins CVS Plugin 2.19 and earlier does not escape the name and description of CVS Symbolic Name parameters on views displaying parameters, (no CVSS, Jenkins project Jenkins CVS Plugin · org.jenkins-ci.plugins…)
- [CVE-2022-27386](https://cve.now/CVE-2022-27386.md): MariaDB Server v10.7 and below was discovered to contain a segmentation fault via the component sql/sql\_class.cc. (no CVSS)
- [CVE-2022-27387](https://cve.now/CVE-2022-27387.md): MariaDB Server v10.7 and below was discovered to contain a global buffer overflow in the component decimal\_bin\_size, which is exploited via (no CVSS)
- [CVE-2022-27385](https://cve.now/CVE-2022-27385.md): An issue in the component Used\_tables\_and\_const\_cache::used\_tables\_and\_const\_cache\_join of MariaDB Server v10.7 and below was discovered to (no CVSS)
- [CVE-2022-27384](https://cve.now/CVE-2022-27384.md): An issue in the component Item\_subselect::init\_expr\_cache\_tracker of MariaDB Server v10.6 and below was discovered to allow attackers to cau (no CVSS)
- [CVE-2022-27382](https://cve.now/CVE-2022-27382.md): MariaDB Server v10.7 and below was discovered to contain a segmentation fault via the component Item\_field::used\_tables/update\_depend\_map\_fo (no CVSS)
- [CVE-2022-27383](https://cve.now/CVE-2022-27383.md): MariaDB Server v10.6 and below was discovered to contain an use-after-free in the component my\_strcasecmp\_8bit, which is exploited via speci (no CVSS)
- [CVE-2022-27380](https://cve.now/CVE-2022-27380.md): An issue in the component my\_decimal::operator= of MariaDB Server v10.6.3 and below was discovered to allow attackers to cause a Denial of S (no CVSS)
- [CVE-2022-27381](https://cve.now/CVE-2022-27381.md): An issue in the component Field::set\_default of MariaDB Server v10.6 and below was discovered to allow attackers to cause a Denial of Servic (no CVSS)
- [CVE-2022-27378](https://cve.now/CVE-2022-27378.md): An issue in the component Create\_tmp\_table::finalize of MariaDB Server v10.7 and below was discovered to allow attackers to cause a Denial o (no CVSS)
- [CVE-2022-27379](https://cve.now/CVE-2022-27379.md): An issue in the component Arg\_comparator::compare\_real\_fixed of MariaDB Server v10.6.2 and below was discovered to allow attackers to cause (no CVSS)
- [CVE-2022-27377](https://cve.now/CVE-2022-27377.md): MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component Item\_func\_in::cleanup(), which is exploited vi (no CVSS)
- [CVE-2022-27376](https://cve.now/CVE-2022-27376.md): MariaDB Server v10.6.5 and below was discovered to contain an use-after-free in the component Item\_args::walk\_arg, which is exploited via sp (no CVSS)
- [CVE-2022-0915](https://cve.now/CVE-2022-0915.md): Logitech Sync desktop application prior to 2.4.574 - TOCTOU during installation leads to privelege escalation (CVSS 6.0, Logitech Sync)
- [CVE-2022-24767](https://cve.now/CVE-2022-24767.md): GitHub: Git for Windows' uninstaller vulnerable to DLL hijacking when run under the SYSTEM user account. (CVSS 7.8, Microsoft Visual Studio)
- [CVE-2022-24413](https://cve.now/CVE-2022-24413.md): Dell PowerScale OneFS, versions 8.2.2-9.3.x, contain a time-of-check-to-time-of-use vulnerability. (CVSS 4.4, Dell PowerScale OneFS)
- [CVE-2022-24412](https://cve.now/CVE-2022-24412.md): Dell EMC PowerScale OneFS 8.2.x - 9.3.0.x contain an improper handling of value vulnerability. (CVSS 7.5, Dell PowerScale OneFS)
- [CVE-2022-24411](https://cve.now/CVE-2022-24411.md): Dell PowerScale OneFS 8.2.2 and above contain an elevation of privilege vulnerability. (CVSS 7.8, Dell PowerScale OneFS)
- [CVE-2022-23163](https://cve.now/CVE-2022-23163.md): Dell PowerScale OneFS, 8.2,x, 9.1.0.x, 9.2.1.x, and 9.3.0.x contain a denial of service vulnerability. (CVSS 4.7, Dell PowerScale OneFS)
- [CVE-2022-23161](https://cve.now/CVE-2022-23161.md): Dell PowerScale OneFS versions 8.2.x - 9.3.0.x contain a denial-of-service vulnerability in SmartConnect. (CVSS 7.5, Dell PowerScale OneFS)
- [CVE-2022-23160](https://cve.now/CVE-2022-23160.md): Dell PowerScale OneFS, versions 8.2.0-9.3.0, contains an Improper Handling of Insufficient Permissions vulnerability. (CVSS 5.4, Dell PowerScale OneFS)
- [CVE-2022-23159](https://cve.now/CVE-2022-23159.md): Dell PowerScale OneFS, 8.2.2 - 9.3.0.x, contain a missing release of memory after effective lifetime vulnerability. (CVSS 4.8, Dell PowerScale OneFS)
- [CVE-2022-22565](https://cve.now/CVE-2022-22565.md): Dell PowerScale OneFS, versions 9.0.0-9.3.0, contain an improper authorization of index containing sensitive information. (CVSS 4.7, Dell PowerScale OneFS)
- [CVE-2022-22562](https://cve.now/CVE-2022-22562.md): Dell PowerScale OneFS, versions 8.2.0-9.3.0, contain a improper handling of missing values exploit. (CVSS 7.5, Dell PowerScale OneFS)
- [CVE-2022-22561](https://cve.now/CVE-2022-22561.md): Dell PowerScale OneFS, versions 8.2.x-9.3.0.x, contain an improper restriction of excessive authentication attempts. (CVSS 8.1, Dell PowerScale OneFS)
- [CVE-2022-22560](https://cve.now/CVE-2022-22560.md): Dell EMC PowerScale OneFS 8.1.x - 9.1.x contain hard coded credentials. (CVSS 7.1, Dell PowerScale OneFS)
- [CVE-2022-22559](https://cve.now/CVE-2022-22559.md): Dell PowerScale OneFS, version 9.3.0, contains a use of a broken or risky cryptographic algorithm. (CVSS 7.5, Dell PowerScale OneFS)
- [CVE-2022-22550](https://cve.now/CVE-2022-22550.md): Dell PowerScale OneFS, versions 8.2.2 and above, contain a password disclosure vulnerability. (CVSS 6.7, Dell PowerScale OneFS)
- [CVE-2022-22549](https://cve.now/CVE-2022-22549.md): Dell PowerScale OneFS, 8.2.x-9.3.x, contains a Improper Certificate Validation. (CVSS 7.5, Dell PowerScale OneFS)
- [CVE-2022-24070](https://cve.now/CVE-2022-24070.md): Apache Subversion mod\_dav\_svn is vulnerable to memory corruption (no CVSS, Apache Software Foundation Apache Subversion)
- [CVE-2021-28544](https://cve.now/CVE-2021-28544.md): Apache Subversion SVN authz protected copyfrom paths regression (no CVSS, Apache Software Foundation Apache Subversion)
- [CVE-2022-24842](https://cve.now/CVE-2022-24842.md): Improper Privilege Management in MinIO (CVSS 8.8, minio)
- [CVE-2022-24812](https://cve.now/CVE-2022-24812.md): FGAC API Key privilege escalation in Grafana (CVSS 8.0, grafana)
- [CVE-2022-28397](https://cve.now/CVE-2022-28397.md): An arbitrary file upload vulnerability in the file upload module of Ghost CMS v4.42.0 allows attackers to execute arbitrary code via a craft (no CVSS, ghost)
- [CVE-2022-27952](https://cve.now/CVE-2022-27952.md): An arbitrary file upload vulnerability in the file upload module of PayloadCMS v0.15.0 allows attackers to execute arbitrary code via a craf (no CVSS, payload)
- [CVE-2022-27262](https://cve.now/CVE-2022-27262.md): An arbitrary file upload vulnerability in the file upload module of Skipper v0.9.1 allows attackers to execute arbitrary code via a crafted (no CVSS)
- [CVE-2022-27263](https://cve.now/CVE-2022-27263.md): An arbitrary file upload vulnerability in the file upload module of Strapi v4.1.5 allows attackers to execute arbitrary code via a crafted f (no CVSS, strapi)
- [CVE-2022-27261](https://cve.now/CVE-2022-27261.md): An arbitrary file write vulnerability in Express-FileUpload v1.3.1 allows attackers to upload multiple files with the same name, causing an (no CVSS, express-fileupload)
- [CVE-2022-27260](https://cve.now/CVE-2022-27260.md): An arbitrary file upload vulnerability in the file upload component of ButterCMS v1.2.8 allows attackers to execute arbitrary code via a cra (no CVSS, buttercms)
- [CVE-2022-27139](https://cve.now/CVE-2022-27139.md): An arbitrary file upload vulnerability in the file upload module of Ghost v4.39.0 allows attackers to execute arbitrary code via a crafted S (no CVSS, ghost)
- [CVE-2022-21155](https://cve.now/CVE-2022-21155.md): Fernhill SCADA Uncontrolled Resource Consumption (CVSS 7.5, Fernhill SCADA Server)
- [CVE-2021-39814](https://cve.now/CVE-2021-39814.md): In ppmp\_validate\_wsm of drm\_fw.c, there is a possible out of bounds write due to an incorrect bounds check. (no CVSS, Android)
- [CVE-2022-21202](https://cve.now/CVE-2022-21202.md): ICSA-22-090-03 Fuji Electric Alpha5 (CVSS 3.3, Fuji Electric Alpha5)
- [CVE-2021-39812](https://cve.now/CVE-2021-39812.md): In TBD of TBD, there is a possible out of bounds read due to a use after free. (no CVSS, Android)
- [CVE-2022-24383](https://cve.now/CVE-2022-24383.md): ICSA-22-090-03 Fuji Electric Alpha5 (CVSS 7.8, Fuji Electric Alpha5)
- [CVE-2022-21228](https://cve.now/CVE-2022-21228.md): ICSA-22-090-03 Fuji Electric Alpha5 (CVSS 7.8, Fuji Electric Alpha5)
- [CVE-2022-21214](https://cve.now/CVE-2022-21214.md): ICSA-22-090-03 Fuji Electric Alpha5 (CVSS 7.8, Fuji Electric Alpha5)
- [CVE-2022-21168](https://cve.now/CVE-2022-21168.md): ICSA-22-090-03 Fuji Electric Alpha5 (CVSS 3.3, Fuji Electric Alpha5)
- [CVE-2021-39809](https://cve.now/CVE-2021-39809.md): In avrc\_ctrl\_pars\_vendor\_rsp of avrc\_pars\_ct.cc, there is a possible out of bounds read due to a missing bounds check. (no CVSS, Android)
- [CVE-2021-39808](https://cve.now/CVE-2021-39808.md): In createNotificationChannelGroup of PreferencesHelper.java, there is a possible way for a service to run in foreground without user notific (no CVSS, Android)
- [CVE-2021-39807](https://cve.now/CVE-2021-39807.md): In handleNfcStateChanged of SecureNfcEnabler.java, there is a possible way to enable NFC from the Guest account due to a missing permission (no CVSS, Android)
- [CVE-2021-39804](https://cve.now/CVE-2021-39804.md): In reinit of HeifDecoderImpl.cpp, there is a possible crash due to a missing null check. (no CVSS, Android)
- [CVE-2021-39805](https://cve.now/CVE-2021-39805.md): In l2cble\_process\_sig\_cmd of l2c\_ble.cc, there is a possible out of bounds read due to a missing bounds check. (no CVSS, Android)
- [CVE-2021-39803](https://cve.now/CVE-2021-39803.md): In ~Impl of C2AllocatorIon.cpp, there is a possible out of bounds read due to a use after free. (no CVSS, Android)
- [CVE-2021-39802](https://cve.now/CVE-2021-39802.md): In change\_pte\_range of mprotect.c , there is a possible way to make a shared mmap writable due to a permissions bypass. (no CVSS, Android)
- [CVE-2021-39800](https://cve.now/CVE-2021-39800.md): In ion\_ioctl of ion-ioctl.c, there is a possible way to leak kernel head data due to a use after free. (no CVSS, Android)
- [CVE-2021-39801](https://cve.now/CVE-2021-39801.md): In ion\_ioctl of ion-ioctl.c, there is a possible use after free due to improper locking. (no CVSS, Android)
- [CVE-2021-39799](https://cve.now/CVE-2021-39799.md): In AttributionSource of AttributionSource.java, there is a possible permission bypass due to improper input validation. (no CVSS, Android)
- [CVE-2021-39798](https://cve.now/CVE-2021-39798.md): In Bitmap\_createFromParcel of Bitmap.cpp, there is a possible arbitrary code execution due to a missing bounds check. (no CVSS, Android)
- [CVE-2021-39796](https://cve.now/CVE-2021-39796.md): In HarmfulAppWarningActivity of HarmfulAppWarningActivity.java, there is a possible way to trick victim to install harmful app due to a tapj (no CVSS, Android)
- [CVE-2021-39797](https://cve.now/CVE-2021-39797.md): In several functions of of LauncherApps.java, there is a possible escalation of privilege due to a logic error in the code. (no CVSS, Android)
- [CVE-2021-39794](https://cve.now/CVE-2021-39794.md): In broadcastPortInfo of AdbService.java, there is a possible way for apps to run code as the shell user, if wireless debugging is enabled, d (no CVSS, Android)
- [CVE-2021-0694](https://cve.now/CVE-2021-0694.md): In setServiceForegroundInnerLocked of ActiveServices.java, there is a possible way for a background application to regain foreground permiss (no CVSS, Android)
- [CVE-2021-0707](https://cve.now/CVE-2021-0707.md): In dma\_buf\_release of dma-buf.c, there is a possible memory corruption due to a use after free. (no CVSS, Android)
- [CVE-2022-23703](https://cve.now/CVE-2022-23703.md): A security vulnerability has been identified in HPE Nimble Storage Hybrid Flash Arrays, HPE Nimble Storage All Flash Arrays and HPE Nimble S (no CVSS, HPE Nimble Storage Hybrid Flash Arrays; Nimble Storage All…)
- [CVE-2022-23702](https://cve.now/CVE-2022-23702.md): A potential security vulnerability has been identified in HPE Superdome Flex and Superdome Flex 280 Servers. (no CVSS, HPE Superdome Flex Server; HPE Superdome Flex 280 Server)
- [CVE-2021-41004](https://cve.now/CVE-2021-41004.md): A remote vulnerability was discovered in Aruba Instant On 1930 Switch Series version(s): Firmware below v1.0.7.0. (no CVSS, Aruba Instant On 1930 Switch Series)
- [CVE-2021-41005](https://cve.now/CVE-2021-41005.md): A remote vulnerability was discovered in Aruba Instant On 1930 Switch Series version(s): Firmware below v1.0.7.0. (no CVSS, Aruba Instant On 1930 Switch Series)
- [CVE-2022-28795](https://cve.now/CVE-2022-28795.md): A vulnerability within the Avira Password Manager Browser Extensions provided a potential loophole where, if a user visited a page crafted b (no CVSS, Avira Password Manager – Browser Extensions)
- [CVE-2022-28215](https://cve.now/CVE-2022-28215.md): SAP NetWeaver ABAP Server and ABAP Platform - versions 740, 750, 787, allows an unauthenticated attacker to redirect users to a malicious si (no CVSS, SAP SE SAP NetWeaver ABAP Server and ABAP Platform)
- [CVE-2022-28772](https://cve.now/CVE-2022-28772.md): By overlong input values an attacker may force overwrite of the internal program stack in SAP Web Dispatcher - versions 7.53, 7.77, 7.81, 7. (no CVSS, SAP SE SAP NetWeaver · SAP SE SAP Web Dispatcher)
- [CVE-2022-27669](https://cve.now/CVE-2022-27669.md): An unauthenticated user can use functions of XML Data Archiving Service of SAP NetWeaver Application Server for Java - version 7.50, to whic (no CVSS, SAP SE SAP NetWeaver Application Server for Java)
- [CVE-2022-27671](https://cve.now/CVE-2022-27671.md): A CSRF token visible in the URL may possibly lead to information disclosure vulnerability. (no CVSS, SAP SE SAP BusinessObjects Business Intelligence Platform)
- [CVE-2022-28773](https://cve.now/CVE-2022-28773.md): Due to an uncontrolled recursion in SAP Web Dispatcher and SAP Internet Communication Manager, the application may crash, leading to denial (no CVSS, SAP SE SAP NetWeaver · SAP SE SAP Web Dispatcher)
- [CVE-2022-27657](https://cve.now/CVE-2022-27657.md): A highly privileged remote attacker, can gain unauthorized access to display contents of restricted directories by exploiting insufficient v (no CVSS, SAP SE SAP Focused Run)
- [CVE-2022-28216](https://cve.now/CVE-2022-28216.md): SAP BusinessObjects Business Intelligence Platform (BI Workspace) - version 420, is susceptible to a Cross-Site Scripting attack by an unaut (no CVSS, SAP SE SAP BusinessObjects Business Intelligence Platform)
- [CVE-2022-28770](https://cve.now/CVE-2022-28770.md): Due to insufficient input validation, SAPUI5 library(vbm) - versions 750, 753, 754, 755, 75, allows an unauthenticated attacker to inject a (no CVSS, SAP SE SAPUI5)
- [CVE-2022-28213](https://cve.now/CVE-2022-28213.md): When a user access SOAP Web services in SAP BusinessObjects Business Intelligence Platform - version 420, 430, it does not sufficiently vali (no CVSS, SAP SE SAP BusinessObjects Business Intelligence Platform)
- [CVE-2022-27654](https://cve.now/CVE-2022-27654.md): When a user opens a manipulated Photoshop Document (.psd, 2d.x3d) received from untrusted sources in SAP 3D Visual Enterprise Viewer - versi (no CVSS, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2022-22541](https://cve.now/CVE-2022-22541.md): SAP BusinessObjects Business Intelligence Platform - versions 420, 430, may allow legitimate users to access information they shouldn't see (no CVSS, SAP SE SAP BusinessObjects Business Intelligence Platform)
- [CVE-2022-27670](https://cve.now/CVE-2022-27670.md): SAP SQL Anywhere - version 17.0, allows an authenticated attacker to prevent legitimate users from accessing a SQL Anywhere database server (no CVSS, SAP SE SAP SQL Anywhere Server)
- [CVE-2022-27655](https://cve.now/CVE-2022-27655.md): When a user opens a manipulated Universal 3D (.u3d, 3difr.x3d) received from untrusted sources in SAP 3D Visual Enterprise Viewer - version (no CVSS, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2022-26106](https://cve.now/CVE-2022-26106.md): When a user opens a manipulated Computer Graphics Metafile (.cgm, CgmCore.dll) received from untrusted sources in SAP 3D Visual Enterprise V (no CVSS, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2022-26105](https://cve.now/CVE-2022-26105.md): SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, is susceptible to script execution attack by an unauthe (no CVSS, SAP SE SAP NetWeaver Enterprise Portal)
- [CVE-2022-26108](https://cve.now/CVE-2022-26108.md): When a user opens a manipulated Picture Exchange (.pcx, 2d.x3d) received from untrusted sources in SAP 3D Visual Enterprise Viewer - version (no CVSS, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2022-26109](https://cve.now/CVE-2022-26109.md): When a user opens a manipulated Portable Document Format (.pdf, PDFView.x3d) received from untrusted sources in SAP 3D Visual Enterprise Vie (no CVSS, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2022-27667](https://cve.now/CVE-2022-27667.md): Under certain conditions, SAP BusinessObjects Business Intelligence platform, Client Management Console (CMC) - version 430, allows an attac (no CVSS, SAP SE SAP BusinessObjects Business Intelligence Platform)
- [CVE-2022-26107](https://cve.now/CVE-2022-26107.md): When a user opens a manipulated Jupiter Tesselation (.jt, JTReader.x3d) received from untrusted sources in SAP 3D Visual Enterprise Viewer - (no CVSS, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2021-36914](https://cve.now/CVE-2021-36914.md): WordPress CalderaWP License Manager plugin \<= 1.2.11 - Cross-Site Request Forgery (CSRF) vulnerability leading to Reflected Cross-Site Scripting (XSS) (CVSS 6.1, Desertsnowman, Shelob9 CalderaWP License Manager)
- [CVE-2021-42255](https://cve.now/CVE-2021-42255.md): AppGuard Enterprise before 6.7.100.1 creates a Temporary File in a Directory with Insecure Permissions. (no CVSS)
- [CVE-2022-27473](https://cve.now/CVE-2022-27473.md): SQL injection vulnerability in Topics Searching feature of Roothub 2.6.0 allows unauthorized attackers to execute arbitrary SQL commands via (no CVSS)
- [CVE-2022-27472](https://cve.now/CVE-2022-27472.md): SQL injection vulnerability in Topics Counting feature of Roothub 2.6.0 allows unauthorized attackers to execute arbitrary SQL commands via (no CVSS)
- [CVE-2021-31805](https://cve.now/CVE-2021-31805.md): Forced OGNL evaluation, when evaluated on raw not validated user input in tag attributes, may lead to RCE. (no CVSS, Apache Software Foundation Apache Struts · org.apache.strut…)
- [CVE-2022-21803](https://cve.now/CVE-2022-21803.md): Prototype Pollution (CVSS 7.3, nconf)
- [CVE-2022-28036](https://cve.now/CVE-2022-28036.md): AtomCMS 2.0 is vulnerable to SQL Injection via Atom.CMS\_admin\_ajax\_navigation.php (no CVSS)
- [CVE-2022-28035](https://cve.now/CVE-2022-28035.md): Atom.CMS 2.0 is vulnerable to SQL Injection via Atom.CMS\_admin\_ajax\_blur-save.php (no CVSS)
- [CVE-2022-28034](https://cve.now/CVE-2022-28034.md): AtomCMS 2.0 is vulnerabie to SQL Injection via Atom.CMS\_admin\_ajax\_list-sort.php (no CVSS)
- [CVE-2022-28033](https://cve.now/CVE-2022-28033.md): Atom.CMS 2.0 is vulnerable to SQL Injection via Atom.CMS\_admin\_uploads.php (no CVSS)
- [CVE-2022-28032](https://cve.now/CVE-2022-28032.md): AtomCMS 2.0 is vulnerable to SQL Injection via Atom.CMS\_admin\_ajax\_pages.php (no CVSS)
- [CVE-2022-27165](https://cve.now/CVE-2022-27165.md): CSZ CMS 1.2.2 is vulnerable to SQL Injection via cszcms\_admin\_Plugin\_manager\_setstatus (no CVSS)
- [CVE-2022-27164](https://cve.now/CVE-2022-27164.md): CSZ CMS 1.2.2 is vulnerable to SQL Injection via cszcms\_admin\_Users\_viewUsers (no CVSS)
- [CVE-2022-27163](https://cve.now/CVE-2022-27163.md): CSZ CMS 1.2.2 is vulnerable to SQL Injection via cszcms\_admin\_Users\_editUser (no CVSS)
- [CVE-2022-27162](https://cve.now/CVE-2022-27162.md): CSZ CMS 1.2.2 is vulnerable to SQL Injection via cszcms\_admin\_Members\_editUser (no CVSS)
- [CVE-2022-27161](https://cve.now/CVE-2022-27161.md): Csz Cms 1.2.2 is vulnerable to SQL Injection via cszcms\_admin\_Members\_viewUsers (no CVSS)
- [CVE-2021-32040](https://cve.now/CVE-2021-32040.md): Large aggregation pipelines with a specific stage can crash mongod under default configuration (CVSS 6.5, MongoDB Server)
- [CVE-2022-0878](https://cve.now/CVE-2022-0878.md): Novel attack against the Combined Charging System (CCS) in electric vehicles to remotely cause a denial of service (CVSS 4.6, Combined Charging System)
- [CVE-2022-24248](https://cve.now/CVE-2022-24248.md): RiteCMS version 3.1.0 and below suffers from an arbitrary file deletion via path traversal vulnerability in Admin Panel. (no CVSS)
- [CVE-2022-0142](https://cve.now/CVE-2022-0142.md): Visual Form Builder \< 3.0.6 - CSV Injection (no CVSS, Visual Form Builder)
- [CVE-2022-0141](https://cve.now/CVE-2022-0141.md): Visual Form Builder \< 3.0.8 - Entries Deletion/Restoration via CSRF (no CVSS, Visual Form Builder)
- [CVE-2022-0140](https://cve.now/CVE-2022-0140.md): Visual Form Builder \< 3.0.6 - Unauthenticated Information Disclosure (no CVSS, Visual Form Builder)
- [CVE-2022-24247](https://cve.now/CVE-2022-24247.md): RiteCMS version 3.1.0 and below suffers from an arbitrary file overwrite via path traversal vulnerability in Admin Panel. (no CVSS)
- [CVE-2022-28663](https://cve.now/CVE-2022-28663.md): A vulnerability has been identified in Simcenter Femap (All versions \< V2022.1.2). (no CVSS, Siemens Simcenter Femap)
- [CVE-2022-28662](https://cve.now/CVE-2022-28662.md): A vulnerability has been identified in Simcenter Femap (All versions \< V2022.1.2). (no CVSS, Siemens Simcenter Femap)
- [CVE-2022-28661](https://cve.now/CVE-2022-28661.md): A vulnerability has been identified in Simcenter Femap (All versions \< V2022.1.2). (no CVSS, Siemens Simcenter Femap)
- [CVE-2022-28329](https://cve.now/CVE-2022-28329.md): A vulnerability has been identified in SCALANCE W1788-1 M12 (All versions \< V3.0.0), SCALANCE W1788-2 EEC M12 (All versions \< V3.0.0), SCALA (no CVSS, Siemens SCALANCE W1788-1 M12 · Siemens SCALANCE W1788-2… +2)
- [CVE-2022-28328](https://cve.now/CVE-2022-28328.md): A vulnerability has been identified in SCALANCE W1788-1 M12 (All versions \< V3.0.0), SCALANCE W1788-2 EEC M12 (All versions \< V3.0.0), SCALA (no CVSS, Siemens SCALANCE W1788-1 M12 · Siemens SCALANCE W1788-2… +2)
- [CVE-2022-27481](https://cve.now/CVE-2022-27481.md): A vulnerability has been identified in SCALANCE W1788-1 M12 (All versions \< V3.0.0), SCALANCE W1788-2 EEC M12 (All versions \< V3.0.0), SCALA (no CVSS, Siemens SCALANCE W1788-1 M12 · Siemens SCALANCE W1788-2… +2)
- [CVE-2022-27480](https://cve.now/CVE-2022-27480.md): A vulnerability has been identified in SICAM A8000 CP-8031 (All versions \< V4.80), SICAM A8000 CP-8050 (All versions \< V4.80). (no CVSS, Siemens SICAM A8000 CP-8031 · Siemens SICAM A8000 CP-8050)
- [CVE-2022-27241](https://cve.now/CVE-2022-27241.md): A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions \< V7.23.31), Mendix Applications using Mendix 8 (All (no CVSS, Siemens Mendix Applications using Mendix)
- [CVE-2022-27194](https://cve.now/CVE-2022-27194.md): A vulnerability has been identified in SIMATIC PCS neo (Administration Console) (All versions \< V3.1 SP1), SINETPLAN (All versions), TIA Por (no CVSS, Siemens SIMATIC PCS neo · Siemens SINETPLAN +1)
- [CVE-2022-26380](https://cve.now/CVE-2022-26380.md): A vulnerability has been identified in SCALANCE X302-7 EEC (230V), SCALANCE X302-7 EEC (230V, coated), SCALANCE X302-7 EEC (24V), SCALANCE X (no CVSS, Siemens SCALANCE X302-7 EEC · Siemens SCALANCE X304-2FE +18)
- [CVE-2022-26335](https://cve.now/CVE-2022-26335.md): A vulnerability has been identified in SCALANCE X302-7 EEC (230V), SCALANCE X302-7 EEC (230V, coated), SCALANCE X302-7 EEC (24V), SCALANCE X (no CVSS, Siemens SCALANCE X302-7 EEC · Siemens SCALANCE X304-2FE +18)
- [CVE-2022-26334](https://cve.now/CVE-2022-26334.md): A vulnerability has been identified in SCALANCE X302-7 EEC (230V), SCALANCE X302-7 EEC (230V, coated), SCALANCE X302-7 EEC (24V), SCALANCE X (no CVSS, Siemens SCALANCE X302-7 EEC · Siemens SCALANCE X304-2FE +18)
- [CVE-2022-25756](https://cve.now/CVE-2022-25756.md): A vulnerability has been identified in SCALANCE X302-7 EEC (230V), SCALANCE X302-7 EEC (230V, coated), SCALANCE X302-7 EEC (24V), SCALANCE X (no CVSS, Siemens SCALANCE X302-7 EEC · Siemens SCALANCE X304-2FE +18)
- [CVE-2022-25755](https://cve.now/CVE-2022-25755.md): A vulnerability has been identified in SCALANCE X302-7 EEC (230V), SCALANCE X302-7 EEC (230V, coated), SCALANCE X302-7 EEC (24V), SCALANCE X (no CVSS, Siemens SCALANCE X302-7 EEC · Siemens SCALANCE X304-2FE +18)
- [CVE-2022-25754](https://cve.now/CVE-2022-25754.md): A vulnerability has been identified in SCALANCE X302-7 EEC (230V), SCALANCE X302-7 EEC (230V, coated), SCALANCE X302-7 EEC (24V), SCALANCE X (no CVSS, Siemens SCALANCE X302-7 EEC · Siemens SCALANCE X304-2FE +18)
- [CVE-2022-25753](https://cve.now/CVE-2022-25753.md): A vulnerability has been identified in SCALANCE X302-7 EEC (230V), SCALANCE X302-7 EEC (230V, coated), SCALANCE X302-7 EEC (24V), SCALANCE X (no CVSS, Siemens SCALANCE X302-7 EEC · Siemens SCALANCE X304-2FE +18)
- [CVE-2022-25752](https://cve.now/CVE-2022-25752.md): A vulnerability has been identified in SCALANCE X302-7 EEC (230V), SCALANCE X302-7 EEC (230V, coated), SCALANCE X302-7 EEC (24V), SCALANCE X (no CVSS, Siemens SCALANCE X302-7 EEC · Siemens SCALANCE X304-2FE +18)
- [CVE-2022-25751](https://cve.now/CVE-2022-25751.md): A vulnerability has been identified in SCALANCE X302-7 EEC (230V), SCALANCE X302-7 EEC (230V, coated), SCALANCE X302-7 EEC (24V), SCALANCE X (no CVSS, Siemens SCALANCE X302-7 EEC · Siemens SCALANCE X304-2FE +18)
- [CVE-2022-25650](https://cve.now/CVE-2022-25650.md): A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions \< V7.23.27), Mendix Applications using Mendix 8 (All (no CVSS, Siemens Mendix Applications using Mendix)
- [CVE-2022-23450](https://cve.now/CVE-2022-23450.md): A vulnerability has been identified in SIMATIC Energy Manager Basic (All versions \< V7.3 Update 1), SIMATIC Energy Manager PRO (All versions (no CVSS, Siemens SIMATIC Energy Manager Basic · Siemens SIMATIC Ener…)
- [CVE-2022-23449](https://cve.now/CVE-2022-23449.md): A vulnerability has been identified in SIMATIC Energy Manager Basic (All versions \< V7.3 Update 1), SIMATIC Energy Manager PRO (All versions (no CVSS, Siemens SIMATIC Energy Manager Basic · Siemens SIMATIC Ener…)
- [CVE-2022-23448](https://cve.now/CVE-2022-23448.md): A vulnerability has been identified in SIMATIC Energy Manager Basic (All versions \< V7.3 Update 1), SIMATIC Energy Manager PRO (All versions (no CVSS, Siemens SIMATIC Energy Manager Basic · Siemens SIMATIC Ener…)
- [CVE-2021-42029](https://cve.now/CVE-2021-42029.md): A vulnerability has been identified in SIMATIC STEP 7 (TIA Portal) V15 (All versions), SIMATIC STEP 7 (TIA Portal) V16 (All versions \< V16 U (no CVSS, Siemens SIMATIC STEP 7 (TIA Portal))
- [CVE-2021-40368](https://cve.now/CVE-2021-40368.md): A vulnerability has been identified in SIMATIC S7-400 CPU 412-1 DP V7 (All versions), SIMATIC S7-400 CPU 412-2 DP V7 (All versions), SIMA (CVSS 7.5, Siemens SIMATIC S7-400 CPU 412-1 DP · Siemens SIMATIC S… +18)
- [CVE-2022-1302](https://cve.now/CVE-2022-1302.md): Malformed Goose Message in LibIEC61850 may result in a denial of service (CVSS 7.5, MZ Automation libIEC61850)
- [CVE-2022-29080](https://cve.now/CVE-2022-29080.md): The npm-dependency-versions package through 0.3.0 for Node.js allows command injection if an attacker is able to call dependencyVersions wit (no CVSS, npm-dependency-versions)
- [CVE-2022-0436](https://cve.now/CVE-2022-0436.md): Path Traversal in gruntjs/grunt (CVSS 7.1, gruntjs/grunt · grunt)
- [CVE-2022-24765](https://cve.now/CVE-2022-24765.md): Uncontrolled search for the Git directory in Git for Windows (CVSS 6.0, git-for-windows git)
- [CVE-2022-25622](https://cve.now/CVE-2022-25622.md): The PROFINET (PNIO) stack, when integrated with the Interniche IP stack, improperly handles internal resources for TCP segments where the mi (CVSS 5.3, Siemens SIMATIC CFU DIQ · Siemens SIMATIC CFU PA +70)
- [CVE-2022-27140](https://cve.now/CVE-2022-27140.md): An arbitrary file upload vulnerability in the file upload module of express-fileupload 1.3.1 allows attackers to execute arbitrary code via (no CVSS)
- [CVE-2022-27416](https://cve.now/CVE-2022-27416.md): Tcpreplay v4.4.1 was discovered to contain a double-free via \_\_interceptor\_free. (no CVSS)
- [CVE-2022-27418](https://cve.now/CVE-2022-27418.md): Tcpreplay v4.4.1 has a heap-based buffer overflow in do\_checksum\_math at /tcpedit/checksum.c. (no CVSS)
- [CVE-2022-28346](https://cve.now/CVE-2022-28346.md): An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. (no CVSS, django)
- [CVE-2022-28347](https://cve.now/CVE-2022-28347.md): A SQL injection issue was discovered in QuerySet.explain() in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. (no CVSS, django)
- [CVE-2022-29036](https://cve.now/CVE-2022-29036.md): Jenkins Credentials Plugin 1111.v35a\_307992395 and earlier, except 1087.1089.v2f1b\_9a\_b\_040e4, 1074.1076.v39c30cecb\_0e2, and 2.6.1.1, does n (no CVSS, Jenkins project Jenkins Credentials Plugin · org.jenkins-ci…)
- [CVE-2022-29045](https://cve.now/CVE-2022-29045.md): Jenkins promoted builds Plugin 873.v6149db\_d64130 and earlier, except 3.10.1, does not escape the name and description of Promoted Build par (no CVSS, Jenkins project Jenkins promoted builds Plugin · org.jenkin…)
- [CVE-2022-29049](https://cve.now/CVE-2022-29049.md): Jenkins promoted builds Plugin 873.v6149db\_d64130 and earlier, except 3.10.1, does not validate the names of promotions defined in Job DSL, (no CVSS, Jenkins project Jenkins promoted builds Plugin · org.jenkin…)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-04-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.