# CVEs published 2022-04-13

51 CVEs were published on April 13, 2022: 5 critical, 10 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2021-43154](https://cve.now/CVE-2021-43154.md): Cross Site Scripting (XSS) vulnerability exists in CMS Made Simple 2.2.15 via the Name field in an Add Category action in moduleinterface.ph (no CVSS)
- [CVE-2022-24847](https://cve.now/CVE-2022-24847.md): Improper Input Validation in GeoServer (CVSS 7.2, geoserver · org.geoserver:gs-main)
- [CVE-2022-24845](https://cve.now/CVE-2022-24845.md): Integer bounds error in Vyper (CVSS 8.8, vyperlang vyper · vyper)
- [CVE-2022-24843](https://cve.now/CVE-2022-24843.md): Path Traversal in github.com/flipped-aurora/gin-vue-admin (CVSS 7.5, flipped-aurora gin-vue-admin)
- [CVE-2022-24844](https://cve.now/CVE-2022-24844.md): SQL Injection in github.com/flipped-aurora/gin-vue-admin (CVSS 8.1, flipped-aurora gin-vue-admin)
- [CVE-2022-24828](https://cve.now/CVE-2022-24828.md): Missing input validation can lead to command execution in composer (CVSS 8.3, composer · composer/composer)
- [CVE-2022-24818](https://cve.now/CVE-2022-24818.md): Unchecked JNDI lookups in GeoTools (CVSS 8.2, geotools)
- [CVE-2022-24816](https://cve.now/CVE-2022-24816.md): Improper Control of Generation of Code in jai-ext (CVSS 10.0, KEV, geosolutions-it jai-ext · it.geosolutions.jaiext.jiffle:… +1)
- [CVE-2022-27479](https://cve.now/CVE-2022-27479.md): SQL injection vulnerability in chart data API (no CVSS, Apache Software Foundation Apache Superset · apache-superset)
- [CVE-2022-0023](https://cve.now/CVE-2022-0023.md): PAN-OS: Denial-of-Service (DoS) Vulnerability in DNS Proxy (CVSS 5.9, Palo Alto Networks PAN-OS · Palo Alto Networks Prisma Access)
- [CVE-2022-24788](https://cve.now/CVE-2022-24788.md): Buffer overflow in Vyper (CVSS 7.1, vyperlang vyper · vyper)
- [CVE-2021-41119](https://cve.now/CVE-2021-41119.md): DoS vulnerabiliity in wire-server json parser (CVSS 5.3, wireapp wire-server)
- [CVE-2022-1347](https://cve.now/CVE-2022-1347.md): Stored XSS in the "Username" & "Email" input fields leads to account takeover of Admin & Co-admin users in causefx/organizr (CVSS 9.6, causefx/organizr)
- [CVE-2022-1345](https://cve.now/CVE-2022-1345.md): Stored XSS viva .svg file upload in causefx/organizr (CVSS 9.0, causefx/organizr)
- [CVE-2022-1346](https://cve.now/CVE-2022-1346.md): Multiple Stored XSS in causefx/organizr (CVSS 9.0, causefx/organizr)
- [CVE-2022-1344](https://cve.now/CVE-2022-1344.md): Stored XSS due to no sanitization in the filename in causefx/organizr (CVSS 9.0, causefx/organizr)
- [CVE-2022-27524](https://cve.now/CVE-2022-27524.md): An out-of-bounds read can be exploited in Autodesk TrueView 2022 may lead to an exposure of sensitive information or a crash through using a (no CVSS, Autodesk Trueview)
- [CVE-2022-27523](https://cve.now/CVE-2022-27523.md): A buffer over-read can be exploited in Autodesk TrueView 2022 may lead to an exposure of sensitive information or a crash through using a ma (no CVSS, Autodesk Trueview)
- [CVE-2022-27505](https://cve.now/CVE-2022-27505.md): Reflected cross site scripting (XSS) (no CVSS, Citirx Citrix SD-WAN)
- [CVE-2022-27506](https://cve.now/CVE-2022-27506.md): Hard-coded credentials allow administrators to access the shell via the SD-WAN CLI (no CVSS, Citirx Citrix SD-WAN)
- [CVE-2022-1332](https://cve.now/CVE-2022-1332.md): Restricted custom admin role can bypass the restrictions and view the server logs and server config.json file contents (CVSS 4.3, Mattermost · github.com/mattermost/mattermost-server/v6 +2)
- [CVE-2022-1333](https://cve.now/CVE-2022-1333.md): A specifically drafted Playbook could trigger large amount of webhook requests leading to Denial of Service (CVSS 3.5, Mattermost Playbooks)
- [CVE-2022-1337](https://cve.now/CVE-2022-1337.md): OOM DoS in Mattermost image proxy (CVSS 4.3, Mattermost · github.com/mattermost/mattermost-server +2)
- [CVE-2022-22955](https://cve.now/CVE-2022-22955.md): VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955 & CVE-2022-22956) in the OAuth2 ACS framework. (no CVSS, VMware Workspace ONE Access)
- [CVE-2022-22958](https://cve.now/CVE-2022-22958.md): VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities (CVE-2022-22957 & CV (no CVSS, VMware Workspace ONE Access, Identity Manager and vRealize…)
- [CVE-2022-22961](https://cve.now/CVE-2022-22961.md): VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an information disclosure vulnerability due to returning exces (no CVSS, VMware Workspace ONE Access, Identity Manager and vRealize…)
- [CVE-2022-22959](https://cve.now/CVE-2022-22959.md): VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a cross site request forgery vulnerability. (no CVSS, VMware Workspace ONE Access, Identity Manager and vRealize…)
- [CVE-2022-27503](https://cve.now/CVE-2022-27503.md): Cross-site Scripting (XSS) vulnerability in Citrix StoreFront affects version 1912 before CU5 and version 3.12 before CU9 (no CVSS, Citrix StoreFront)
- [CVE-2022-27846](https://cve.now/CVE-2022-27846.md): WordPress Yoo Slider plugin \<= 2.0.0 - Cross-Site Request Forgery (CSRF) vulnerability leading to Slider Creation / Modification (CVSS 4.3, Yooslider Yoo Slider – Image Slider & Video Slider)
- [CVE-2022-27847](https://cve.now/CVE-2022-27847.md): WordPress Yoo Slider plugin \<= 2.0.0 - Cross-Site Request Forgery (CSRF) vulnerability leading to Template Import (CVSS 4.3, Yooslider Yoo Slider – Image Slider & Video Slider)
- [CVE-2022-1280](https://cve.now/CVE-2022-1280.md): A use-after-free vulnerability was found in drm\_lease\_held in drivers/gpu/drm/drm\_lease.c in the Linux kernel due to a race problem. (no CVSS, kernel)
- [CVE-2021-42136](https://cve.now/CVE-2021-42136.md): A stored Cross-Site Scripting (XSS) vulnerability in the Missing Data Codes functionality of REDCap before 11.4.0 allows remote attackers to (no CVSS)
- [CVE-2021-46167](https://cve.now/CVE-2021-46167.md): An access control issue in the authentication module of wizplat PD065 v1.19 allows attackers to access sensitive data and cause a Denial of (no CVSS)
- [CVE-2022-28052](https://cve.now/CVE-2022-28052.md): Directory Traversal vulnerability in file cn/roothub/store/FileSystemStorageService in function store in Roothub 2.6.0 allows remote attacke (no CVSS)
- [CVE-2022-26144](https://cve.now/CVE-2022-26144.md): An XSS issue was discovered in MantisBT before 2.25.3. (no CVSS, mantisbt/mantisbt)
- [CVE-2022-27256](https://cve.now/CVE-2022-27256.md): A PHP Local File inclusion vulnerability in the Redbasic theme for Hubzilla before version 7.2 allows remote attackers to include arbitrary (no CVSS)
- [CVE-2022-26643](https://cve.now/CVE-2022-26643.md): An issue in EasyIO CPT Graphics v0.8 allows attackers to discover valid users in the application. (no CVSS)
- [CVE-2021-43741](https://cve.now/CVE-2021-43741.md): CMSimple 5.4 is vulnerable to Directory Traversal. (no CVSS)
- [CVE-2021-43742](https://cve.now/CVE-2021-43742.md): CMSimple 5.4 is vulnerable to Cross Site Scripting (XSS) via the file upload feature. (no CVSS)
- [CVE-2022-24308](https://cve.now/CVE-2022-24308.md): Automox Agent prior to version 37 on Windows and Linux and Version 36 on OSX could allow for a non privileged user to obtain sensitive infor (no CVSS)
- [CVE-2020-29653](https://cve.now/CVE-2020-29653.md): Froxlor through 0.10.22 does not perform validation on user input passed in the customermail GET parameter. (no CVSS, froxlor/froxlor)
- [CVE-2022-27475](https://cve.now/CVE-2022-27475.md): Cross site scripting (XSS) vulnerability in tramyardg hotel-mgmt-system, allows attackers to execute arbitrary code when when /admin.php is (no CVSS)
- [CVE-2022-1339](https://cve.now/CVE-2022-1339.md): SQL injection in ElementController.php in pimcore/pimcore (CVSS 8.8, pimcore/pimcore)
- [CVE-2022-29156](https://cve.now/CVE-2022-29156.md): drivers/infiniband/ulp/rtrs/rtrs-clt.c in the Linux kernel before 5.16.12 has a double free related to rtrs\_clt\_dev\_release. (no CVSS)
- [CVE-2022-22279](https://cve.now/CVE-2022-22279.md): A post-authentication arbitrary file read vulnerability impacting end-of-life Secure Remote Access (SRA) products and older firmware version (no CVSS, SonicWall SRA/SMA100)
- [CVE-2015-20107](https://cve.now/CVE-2015-20107.md): In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. (CVSS 7.8)
- [CVE-2022-22956](https://cve.now/CVE-2022-22956.md): VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955 & CVE-2022-22956) in the OAuth2 ACS framework. (no CVSS, VMware Workspace ONE Access)
- [CVE-2022-22957](https://cve.now/CVE-2022-22957.md): VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities (CVE-2022-22957 & CV (no CVSS, VMware Workspace ONE Access, Identity Manager and vRealize…)
- [CVE-2022-22960](https://cve.now/CVE-2022-22960.md): VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper permissio (CVSS 7.8, KEV, VMware Workspace ONE Access, Identity Manager and vRealize…)
- [CVE-2022-25795](https://cve.now/CVE-2022-25795.md): A Memory Corruption Vulnerability in Autodesk TrueView 2022 and 2021 may lead to remote code execution through maliciously crafted DWG files (no CVSS, Revit, Navisworks, Autodesk® Advance Steel, AutoCAD®, AutoC…)
- [CVE-2022-25797](https://cve.now/CVE-2022-25797.md): A maliciously crafted PDF file in Autodesk AutoCAD 2022, 2021, 2020, 2019 can be used to dereference for a write beyond the allocated buffer (no CVSS, Autodesk Trueview)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-04-13
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.