CVEs published April 14, 2022
110 CVEs were published on April 14, 2022: 19 critical, 38 high.
- Published
- 110
- Critical
- 19
- High
- 38
- Medium
- 22
- Low
- 2
- Unrated
- 29
- Now in CISA KEV
- 0
- Fix available
- 30
Most affected products
- Accusoft ImageGear
- 11
- B. Braun Melsungen AG SpaceCom · B. Braun Melsungen AG B… +1
- 11
- Juniper Networks Junos OS
- 10
- Reolink RLC-410W
- 8
- lansweeper
- 4
- Juniper Networks Junos OS Evolved · Juniper Networks Junos…
- 3
- metabase
- 3
- discourse
- 2
- Gerbv
- 2
- Moxa MXView Series
- 2
Critical 19
- CVE-2022-24846Unchecked JNDI lookups in GeoWebCachegeowebcache
- CVE-2022-22149A SQL injection vulnerability exists in the HelpdeskEmailActions.aspx functionality of Lansweeper lansweeper 9.1.20.2.lansweeper
- CVE-2022-21234An SQL injection vulnerability exists in the EchoAssets.aspx functionality of Lansweeper lansweeper 9.1.20.2.lansweeper
- CVE-2022-21145A stored cross-site scripting vulnerability exists in the WebUserActions.aspx functionality of Lansweeper lansweeper 9.1.20.2.lansweeper
- CVE-2021-40426A heap-based buffer overflow vulnerability exists in the sphere.c start_read() functionality of Sound Exchange libsox 14.4.2 and master commSound Exchange libsox
- CVE-2021-40422An authentication bypass vulnerability exists in the device password generation functionality of Swift Sensors Gateway SG3-1010.Swift Sensors Gateway
- CVE-2021-40402An out-of-bounds read vulnerability exists in the RS-274X aperture macro multiple outline primitives functionality of Gerbv 2.7.0 and dev (cGerbv
- CVE-2021-40400An out-of-bounds read vulnerability exists in the RS-274X aperture macro outline primitive functionality of Gerbv 2.7.0 and dev (commit b5f1Gerbv
- CVE-2021-40390An authentication bypass vulnerability exists in the Web Application functionality of Moxa MXView Series 3.2.4.Moxa MXView Series
- CVE-2021-21949An improper array index validation vulnerability exists in the JPEG-JFIF Scan header parser functionality of Accusoft ImageGear 19.10.Accusoft ImageGear
- CVE-2021-21947Two heap-based buffer overflow vulnerabilities exists in the JPEG-JFIF lossless Huffman image parser functionality of Accusoft ImageGear 19.Accusoft ImageGear
- CVE-2021-21946Two heap-based buffer overflow vulnerabilities exists in the JPEG-JFIF lossless Huffman image parser functionality of Accusoft ImageGear 19.Accusoft ImageGear
- CVE-2021-21945Two heap-based buffer overflow vulnerabilities exist in the TIFF parser functionality of Accusoft ImageGear 19.10.Accusoft ImageGear
- CVE-2021-21944Two heap-based buffer overflow vulnerabilities exist in the TIFF parser functionality of Accusoft ImageGear 19.10.Accusoft ImageGear
- CVE-2021-21943A heap-based buffer overflow vulnerability exists in the XWD parser functionality of Accusoft ImageGear 19.10.Accusoft ImageGear
- CVE-2021-21942An out-of-bounds write vulnerability exists in the TIFF YCbCr image parser functionality of Accusoft ImageGear 19.10.Accusoft ImageGear
- CVE-2021-21939A heap-based buffer overflow vulnerability exists in the XWD parser functionality of Accusoft ImageGear 19.10.Accusoft ImageGear
- CVE-2021-21938A heap-based buffer overflow vulnerability exists in the Palette box parser functionality of Accusoft ImageGear 19.10.Accusoft ImageGear
- CVE-2021-21914A heap-based buffer overflow vulnerability exists in the DecoderStream::Append functionality of Accusoft ImageGear 19.10.Accusoft ImageGear
High 38
- CVE-2022-24854Database bypassing any permissions in Metabase via SQlite attachmetabase
- CVE-2022-24855XSS vulnerability in Metabasemetabase
- CVE-2020-25166B. Braun SpaceCom, Battery Pack SP with Wi-Fi, and Data module compactplusB. Braun Melsungen AG SpaceCom · B. Braun Melsungen AG B… +1
- CVE-2020-25162B. Braun SpaceCom, Battery Pack SP with Wi-Fi, and Data module compactplusB. Braun Melsungen AG SpaceCom · B. Braun Melsungen AG B… +1
- CVE-2020-25158B. Braun SpaceCom, Battery Pack SP with Wi-Fi, and Data module compactplusB. Braun Melsungen AG SpaceCom · B. Braun Melsungen AG B… +1
- CVE-2020-25156B. Braun SpaceCom, Battery Pack SP with Wi-Fi, and Data module compactplusB. Braun Melsungen AG SpaceCom · B. Braun Melsungen AG B… +1
- CVE-2020-25150B. Braun SpaceCom, Battery Pack SP with Wi-Fi, and Data module compactplusB. Braun Melsungen AG SpaceCom · B. Braun Melsungen AG B… +1
- CVE-2021-28505On affected Arista EOS platforms, if a VXLAN match rule exists in an IPv4 access-list that is applied to the ingress of an L2 or an L3 port/SVI, the VXLAN rule and subsequent ACL rules in that access list will ignore the specified IP protocol.Arista Networks EOS
- CVE-2022-1304An out-of-bounds read/write vulnerability was found in e2fsprogs 1.46.5.e2fsprogs
- CVE-2022-21154An integer overflow vulnerability exists in the fltSaveCMP functionality of Leadtools 22.Leadtools
- CVE-2021-44394Multiple denial of service vulnerabilities exist in the cgiserver.cgi JSON command parser functionality of Reolink RLC-410W v3.0.0.136_20121Reolink RLC-410W
- CVE-2021-44375Multiple denial of service vulnerabilities exist in the cgiserver.cgi JSON command parser functionality of Reolink RLC-410W v3.0.0.136_20121Reolink RLC-410W
- CVE-2021-44366Multiple denial of service vulnerabilities exist in the cgiserver.cgi JSON command parser functionality of Reolink RLC-410W v3.0.0.136_20121Reolink RLC-410W
- CVE-2021-44357Multiple denial of service vulnerabilities exist in the cgiserver.cgi JSON command parser functionality of Reolink RLC-410W v3.0.0.136_20121Reolink RLC-410W
- CVE-2021-44356Multiple denial of service vulnerabilities exist in the cgiserver.cgi JSON command parser functionality of Reolink RLC-410W v3.0.0.136_20121Reolink RLC-410W
- CVE-2021-44355Multiple denial of service vulnerabilities exist in the cgiserver.cgi JSON command parser functionality of Reolink RLC-410W v3.0.0.136_20121Reolink RLC-410W
- CVE-2021-44354Multiple denial of service vulnerabilities exist in the cgiserver.cgi JSON command parser functionality of Reolink RLC-410W v3.0.0.136_20121Reolink RLC-410W
- CVE-2021-40425An out-of-bounds read vulnerability exists in the IOCTL GetProcessCommand and B_03 of Webroot Secure Anywhere 21.4.Webroot Secure Anywhere
- CVE-2021-40424An out-of-bounds read vulnerability exists in the IOCTL GetProcessCommand and B_03 of Webroot Secure Anywhere 21.4.Webroot Secure Anywhere
- CVE-2021-40405A denial of service vulnerability exists in the cgiserver.cgi Upgrade API functionality of Reolink RLC-410W v3.0.0.136_20121102.Reolink RLC-410W
- CVE-2021-40398An out-of-bounds write vulnerability exists in the parse_raster_data functionality of Accusoft ImageGear 19.10.Accusoft ImageGear
- CVE-2021-21956A php unserialize vulnerability exists in the Ai-Bolit functionality of CloudLinux Inc Imunify360 5.10.2.CloudLinux Imunify360
- CVE-2021-21948A heap-based buffer overflow vulnerability exists in the readDatHeadVec functionality of AnyCubic Chitubox AnyCubic Plugin 1.0.0.Chitubox AnyCubic Plugin · Chitubox Basic
- CVE-2022-22198Junos OS: MX MS-MPC or MS-MIC, or SRX SPC crashes if it receives a SIP message with a specific contact header formatJuniper Networks Junos OS
- CVE-2022-22197Junos OS and Junos OS Evolved: An rpd core will be observed with proxy BGP route-target filtering enabled and certain route add and delete event happeningJuniper Networks Junos OS
- CVE-2022-22195Junos OS Evolved: Specific packets reaching the RE lead to a counter overflow and eventually a crashJuniper Networks Junos OS Evolved · Juniper Networks Junos…
- CVE-2022-22194Junos OS Evolved: PTX series: An attacker sending a crafted GRE packet will cause the PFE to restartJuniper Networks Junos OS Evolved · Juniper Networks Junos…
- CVE-2022-22190Paragon Active Assurance Control Center: Information disclosure vulnerability in crafted URLJuniper Networks Paragon Active Assurance
- CVE-2022-22189Contrail Service Orchestration: An authenticated local user may have their permissions elevated via the device via management interface without authenticationJuniper Networks Contrail Service Orchestration
- CVE-2022-22188Junos OS: QFX5100/QFX5110/QFX5120/QFX5200/QFX5210/EX4600/EX4650 Series: When storm control profiling is enabled and a device is under an active storm, a Heap-based Buffer Overflow in the PFE will cause a device to hang.Juniper Networks Junos OS
- CVE-2022-22187JIMS: Local Privilege Escalation vulnerability via repair functionalityJuniper Networks Juniper Identity Management Service
- CVE-2022-22186Junos OS: EX4650 Series: Certain traffic received by the Junos OS device on the management interface may be forwarded to egress interfaces instead of discardedJuniper Networks Junos OS
- CVE-2022-22185Junos OS: SRX Series: Denial of service vulnerability in flowd daemon upon receipt of a specific fragmented packetJuniper Networks Junos OS
- CVE-2022-22183Junos OS Evolved: A remote attacker may cause a CPU Denial of Service by sending genuine traffic to a device on a specific IPv4 port.Juniper Networks Junos OS Evolved · Juniper Networks Junos…
- CVE-2022-22182Junos OS: A XSS vulnerability allows an attacker to execute commands on a target J-Web sessionJuniper Networks Junos OS
- CVE-2022-22181Junos OS: J-Web can be compromised through reflected XSS attacksJuniper Networks Junos OS
- CVE-2022-1258SQL injection vulnerability in McAfee Agent's ePO extensionMcAfee Agent ePO extension
- CVE-2022-1256Improper Privilege Management in McAfee Agent for WindowsMcAfee Agent for Windows
Medium, low and unrated 53
- CVE-2022-24853File system exposure in Metabasemetabase
- CVE-2022-24849Contact to DisCatSharp-owned server using authenticated clientAiko-IT-Systems DisCatSharp · DisCatSharp
- CVE-2022-24850Category group permissions leaked in Discoursediscourse
- CVE-2022-24824Anonymous user cache poisoning in discoursediscourse
- CVE-2020-25164B. Braun SpaceCom, Battery Pack SP with Wi-Fi, and Data module compactplusB. Braun Melsungen AG SpaceCom · B. Braun Melsungen AG B… +1
- CVE-2020-25168B. Braun SpaceCom, Battery Pack SP with Wi-Fi, and Data module compactplusB. Braun Melsungen AG SpaceCom · B. Braun Melsungen AG B… +1
- CVE-2020-25154B. Braun SpaceCom, Battery Pack SP with Wi-Fi, and Data module compactplusB. Braun Melsungen AG SpaceCom · B. Braun Melsungen AG B… +1
- CVE-2020-25152B. Braun SpaceCom, Battery Pack SP with Wi-Fi, and Data module compactplusB. Braun Melsungen AG SpaceCom · B. Braun Melsungen AG B… +1
- CVE-2020-25160B. Braun SpaceCom, Battery Pack SP with Wi-Fi, and Data module compactplusB. Braun Melsungen AG SpaceCom · B. Braun Melsungen AG B… +1
- CVE-2020-16238B. Braun SpaceCom, Battery Pack SP with Wi-Fi, and Data module compactplusB. Braun Melsungen AG SpaceCom · B. Braun Melsungen AG B… +1
- CVE-2022-22968In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBindSpring Framework · org.springframework:spring-context
- CVE-2022-22966An authenticated, high privileged malicious actor with network access to the VMware Cloud Director tenant or provider may be able to exploitVMware Cloud Director
- CVE-2022-27848WordPress Modern Events Calendar Lite plugin <= 6.5.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityWebnus Modern Events Calendar Lite
- CVE-2022-28711A memory corruption vulnerability exists in the cgi.c unescape functionality of ArduPilot APWeb master branch 50b6b7ac - master branch 46177ArduPilot APWeb
- CVE-2022-21210An SQL injection vulnerability exists in the AssetActions.aspx functionality of Lansweeper lansweeper 9.1.20.2.lansweeper
- CVE-2021-40392An information disclosure vulnerability exists in the Web Application functionality of Moxa MXView Series 3.2.4.Moxa MXView Series
- CVE-2021-21967An out-of-bounds write vulnerability exists in the OTA update task functionality of Sealevel Systems, Inc.Sealevel Systems SeaConnect
- CVE-2021-43257Lack of Neutralization of Formula Elements in the CSV API of MantisBT before 2.25.3 allows an unprivileged attacker to execute code or gain mantisbt/mantisbt
- CVE-2022-22391IBM Aspera High-Speed Transfer 4.3.1 and earlier could allow an authenticated user to obtain information from non sensitive operating systemIBM Aspera High-Speed Transfer Endpoint · IBM Aspera High-S…
- CVE-2022-27817SWHKD 1.1.5 consumes the keyboard events of unintended users.Simple-Wayland-HotKey-Daemon
- CVE-2022-27814SWHKD 1.1.5 allows arbitrary file-existence tests via the -c option.Simple-Wayland-HotKey-Daemon
- CVE-2022-22196Junos OS and Junos OS Evolved: The rpd CPU spikes to 100% after a malformed ISIS TLV has been receivedJuniper Networks Junos OS
- CVE-2022-22193Junos OS and Junos OS Evolved: In a BGP rib-sharding scenario when a certain CLI command is executed the rpd process might crashJuniper Networks Junos OS
- CVE-2022-22191Junos OS: EX4300: PFE Denial of Service (DoS) upon receipt of a flood of specific ARP trafficJuniper Networks Junos OS
- CVE-2022-25165An issue was discovered in Amazon AWS VPN Client 2.0.0.
- CVE-2022-25166An issue was discovered in Amazon AWS VPN Client 2.0.0.
- CVE-2021-45227An issue was discovered in COINS Construction Cloud 11.12.
- CVE-2022-27007nginx njs 0.7.2 is affected suffers from Use-after-free in njs_function_frame_alloc() when it try to invoke from a restored frame saved with
- CVE-2022-27008nginx njs 0.7.2 is vulnerable to Buffer Overflow.
- CVE-2021-45228An XSS issue was discovered in COINS Construction Cloud 11.12.
- CVE-2022-1257Improper Verification of Cryptographic Signature by McAfee AgentMcAfee Agent
- CVE-2022-27456MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component VDec::VDec at /sql/sql_type.cc.
- CVE-2022-27457MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component my_mb_wc_latin1 at /strings/ctype-latin1.c.
- CVE-2022-27455MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component my_wildcmp_8bit_impl at /strings/ctype-simple.
- CVE-2022-27451MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/field_conv.cc.
- CVE-2022-27452MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item_cmpfunc.cc.
- CVE-2022-27448There is an Assertion failure in MariaDB Server v10.9 and below via 'node->pcur->rel_pos == BTR_PCUR_ON' at /row/row0mysql.cc.
- CVE-2022-27449MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item_func.cc:148.
- CVE-2022-27446MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item_cmpfunc.h.
- CVE-2022-27447MariaDB Server v10.9 and below was discovered to contain a use-after-free via the component Binary_string::free_buffer() at /sql/sql_string.
- CVE-2022-27445MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/sql_window.cc.
- CVE-2022-27444MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item_subselect.cc.
- CVE-2021-43286An issue was discovered in ThoughtWorks GoCD before 21.3.0.
- CVE-2021-43288An issue was discovered in ThoughtWorks GoCD before 21.3.0.
- CVE-2021-43289An issue was discovered in ThoughtWorks GoCD before 21.3.0.
- CVE-2021-43290An issue was discovered in ThoughtWorks GoCD before 21.3.0.
- CVE-2021-43633Sourcecodester Messaging Web Application 1.0 is vulnerable to stored XSS.
- CVE-2022-26507A heap-based buffer overflow exists in XML Decompression DecodeTreeBlock in AT&T Labs Xmill 0.7.
- CVE-2021-43287An issue was discovered in ThoughtWorks GoCD before 21.3.0.
- CVE-2022-1351Stored XSS in Tooltip in pimcore/pimcorepimcore/pimcore
- CVE-2022-1279Insecure EBICS messages encryption implementation in ebics-java/ebics-java-client could allow an adjacent attacker to decrypt EBICS payloadsebics-java-client
- CVE-2022-1350GhostPCL gsmchunk.c chunk_free_object memory corruptionGhostPCL
- CVE-2022-1328Buffer Overflow in uudecoder in Mutt affecting all versions starting from 0.94.13 before 2.2.3 allows read past end of input lineMutt