# CVEs published 2022-04-14

110 CVEs were published on April 14, 2022: 19 critical, 38 high. Days are UTC.

- [CVE-2022-24853](https://cve.now/CVE-2022-24853.md): File system exposure in Metabase (CVSS 5.9, metabase)
- [CVE-2022-24854](https://cve.now/CVE-2022-24854.md): Database bypassing any permissions in Metabase via SQlite attach (CVSS 8.0, metabase)
- [CVE-2022-24855](https://cve.now/CVE-2022-24855.md): XSS vulnerability in Metabase (CVSS 8.7, metabase)
- [CVE-2022-24849](https://cve.now/CVE-2022-24849.md): Contact to DisCatSharp-owned server using authenticated client (CVSS 6.5, Aiko-IT-Systems DisCatSharp · DisCatSharp)
- [CVE-2022-24850](https://cve.now/CVE-2022-24850.md): Category group permissions leaked in Discourse (CVSS 5.3, discourse)
- [CVE-2022-24846](https://cve.now/CVE-2022-24846.md): Unchecked JNDI lookups in GeoWebCache (CVSS 9.1, geowebcache)
- [CVE-2022-24824](https://cve.now/CVE-2022-24824.md): Anonymous user cache poisoning in discourse (CVSS 5.3, discourse)
- [CVE-2020-25164](https://cve.now/CVE-2020-25164.md): B. Braun SpaceCom, Battery Pack SP with Wi-Fi, and Data module compactplus (CVSS 6.5, B. Braun Melsungen AG SpaceCom · B. Braun Melsungen AG B… +1)
- [CVE-2020-25168](https://cve.now/CVE-2020-25168.md): B. Braun SpaceCom, Battery Pack SP with Wi-Fi, and Data module compactplus (CVSS 3.3, B. Braun Melsungen AG SpaceCom · B. Braun Melsungen AG B… +1)
- [CVE-2020-25166](https://cve.now/CVE-2020-25166.md): B. Braun SpaceCom, Battery Pack SP with Wi-Fi, and Data module compactplus (CVSS 7.6, B. Braun Melsungen AG SpaceCom · B. Braun Melsungen AG B… +1)
- [CVE-2020-25154](https://cve.now/CVE-2020-25154.md): B. Braun SpaceCom, Battery Pack SP with Wi-Fi, and Data module compactplus (CVSS 5.4, B. Braun Melsungen AG SpaceCom · B. Braun Melsungen AG B… +1)
- [CVE-2020-25162](https://cve.now/CVE-2020-25162.md): B. Braun SpaceCom, Battery Pack SP with Wi-Fi, and Data module compactplus (CVSS 7.5, B. Braun Melsungen AG SpaceCom · B. Braun Melsungen AG B… +1)
- [CVE-2020-25158](https://cve.now/CVE-2020-25158.md): B. Braun SpaceCom, Battery Pack SP with Wi-Fi, and Data module compactplus (CVSS 7.6, B. Braun Melsungen AG SpaceCom · B. Braun Melsungen AG B… +1)
- [CVE-2020-25152](https://cve.now/CVE-2020-25152.md): B. Braun SpaceCom, Battery Pack SP with Wi-Fi, and Data module compactplus (CVSS 6.5, B. Braun Melsungen AG SpaceCom · B. Braun Melsungen AG B… +1)
- [CVE-2020-25160](https://cve.now/CVE-2020-25160.md): B. Braun SpaceCom, Battery Pack SP with Wi-Fi, and Data module compactplus (CVSS 6.8, B. Braun Melsungen AG SpaceCom · B. Braun Melsungen AG B… +1)
- [CVE-2020-16238](https://cve.now/CVE-2020-16238.md): B. Braun SpaceCom, Battery Pack SP with Wi-Fi, and Data module compactplus (CVSS 6.7, B. Braun Melsungen AG SpaceCom · B. Braun Melsungen AG B… +1)
- [CVE-2020-25156](https://cve.now/CVE-2020-25156.md): B. Braun SpaceCom, Battery Pack SP with Wi-Fi, and Data module compactplus (CVSS 7.2, B. Braun Melsungen AG SpaceCom · B. Braun Melsungen AG B… +1)
- [CVE-2020-25150](https://cve.now/CVE-2020-25150.md): B. Braun SpaceCom, Battery Pack SP with Wi-Fi, and Data module compactplus (CVSS 7.6, B. Braun Melsungen AG SpaceCom · B. Braun Melsungen AG B… +1)
- [CVE-2021-28505](https://cve.now/CVE-2021-28505.md): On affected Arista EOS platforms, if a VXLAN match rule exists in an IPv4 access-list that is applied to the ingress of an L2 or an L3 port/SVI, the VXLAN rule and subsequent ACL rules in that access list will ignore the specified IP protocol. (CVSS 7.5, Arista Networks EOS)
- [CVE-2022-22968](https://cve.now/CVE-2022-22968.md): In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBind (no CVSS, Spring Framework · org.springframework:spring-context)
- [CVE-2022-22966](https://cve.now/CVE-2022-22966.md): An authenticated, high privileged malicious actor with network access to the VMware Cloud Director tenant or provider may be able to exploit (no CVSS, VMware Cloud Director)
- [CVE-2022-27848](https://cve.now/CVE-2022-27848.md): WordPress Modern Events Calendar Lite plugin \<= 6.5.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (CVSS 3.4, Webnus Modern Events Calendar Lite)
- [CVE-2022-1304](https://cve.now/CVE-2022-1304.md): An out-of-bounds read/write vulnerability was found in e2fsprogs 1.46.5. (CVSS 7.8, e2fsprogs)
- [CVE-2022-28711](https://cve.now/CVE-2022-28711.md): A memory corruption vulnerability exists in the cgi.c unescape functionality of ArduPilot APWeb master branch 50b6b7ac - master branch 46177 (CVSS 5.3, ArduPilot APWeb)
- [CVE-2022-22149](https://cve.now/CVE-2022-22149.md): A SQL injection vulnerability exists in the HelpdeskEmailActions.aspx functionality of Lansweeper lansweeper 9.1.20.2. (CVSS 9.1, lansweeper)
- [CVE-2022-21234](https://cve.now/CVE-2022-21234.md): An SQL injection vulnerability exists in the EchoAssets.aspx functionality of Lansweeper lansweeper 9.1.20.2. (CVSS 9.1, lansweeper)
- [CVE-2022-21210](https://cve.now/CVE-2022-21210.md): An SQL injection vulnerability exists in the AssetActions.aspx functionality of Lansweeper lansweeper 9.1.20.2. (CVSS 6.6, lansweeper)
- [CVE-2022-21154](https://cve.now/CVE-2022-21154.md): An integer overflow vulnerability exists in the fltSaveCMP functionality of Leadtools 22. (CVSS 8.8, Leadtools)
- [CVE-2022-21145](https://cve.now/CVE-2022-21145.md): A stored cross-site scripting vulnerability exists in the WebUserActions.aspx functionality of Lansweeper lansweeper 9.1.20.2. (CVSS 9.1, lansweeper)
- [CVE-2021-44394](https://cve.now/CVE-2021-44394.md): Multiple denial of service vulnerabilities exist in the cgiserver.cgi JSON command parser functionality of Reolink RLC-410W v3.0.0.136\_20121 (CVSS 8.6, Reolink RLC-410W)
- [CVE-2021-44375](https://cve.now/CVE-2021-44375.md): Multiple denial of service vulnerabilities exist in the cgiserver.cgi JSON command parser functionality of Reolink RLC-410W v3.0.0.136\_20121 (CVSS 8.6, Reolink RLC-410W)
- [CVE-2021-44366](https://cve.now/CVE-2021-44366.md): Multiple denial of service vulnerabilities exist in the cgiserver.cgi JSON command parser functionality of Reolink RLC-410W v3.0.0.136\_20121 (CVSS 8.6, Reolink RLC-410W)
- [CVE-2021-44357](https://cve.now/CVE-2021-44357.md): Multiple denial of service vulnerabilities exist in the cgiserver.cgi JSON command parser functionality of Reolink RLC-410W v3.0.0.136\_20121 (CVSS 8.6, Reolink RLC-410W)
- [CVE-2021-44356](https://cve.now/CVE-2021-44356.md): Multiple denial of service vulnerabilities exist in the cgiserver.cgi JSON command parser functionality of Reolink RLC-410W v3.0.0.136\_20121 (CVSS 8.6, Reolink RLC-410W)
- [CVE-2021-44355](https://cve.now/CVE-2021-44355.md): Multiple denial of service vulnerabilities exist in the cgiserver.cgi JSON command parser functionality of Reolink RLC-410W v3.0.0.136\_20121 (CVSS 8.6, Reolink RLC-410W)
- [CVE-2021-44354](https://cve.now/CVE-2021-44354.md): Multiple denial of service vulnerabilities exist in the cgiserver.cgi JSON command parser functionality of Reolink RLC-410W v3.0.0.136\_20121 (CVSS 8.6, Reolink RLC-410W)
- [CVE-2021-40426](https://cve.now/CVE-2021-40426.md): A heap-based buffer overflow vulnerability exists in the sphere.c start\_read() functionality of Sound Exchange libsox 14.4.2 and master comm (CVSS 10.0, Sound Exchange libsox)
- [CVE-2021-40425](https://cve.now/CVE-2021-40425.md): An out-of-bounds read vulnerability exists in the IOCTL GetProcessCommand and B\_03 of Webroot Secure Anywhere 21.4. (CVSS 7.1, Webroot Secure Anywhere)
- [CVE-2021-40424](https://cve.now/CVE-2021-40424.md): An out-of-bounds read vulnerability exists in the IOCTL GetProcessCommand and B\_03 of Webroot Secure Anywhere 21.4. (CVSS 7.1, Webroot Secure Anywhere)
- [CVE-2021-40422](https://cve.now/CVE-2021-40422.md): An authentication bypass vulnerability exists in the device password generation functionality of Swift Sensors Gateway SG3-1010. (CVSS 10.0, Swift Sensors Gateway)
- [CVE-2021-40405](https://cve.now/CVE-2021-40405.md): A denial of service vulnerability exists in the cgiserver.cgi Upgrade API functionality of Reolink RLC-410W v3.0.0.136\_20121102. (CVSS 7.7, Reolink RLC-410W)
- [CVE-2021-40402](https://cve.now/CVE-2021-40402.md): An out-of-bounds read vulnerability exists in the RS-274X aperture macro multiple outline primitives functionality of Gerbv 2.7.0 and dev (c (CVSS 9.3, Gerbv)
- [CVE-2021-40400](https://cve.now/CVE-2021-40400.md): An out-of-bounds read vulnerability exists in the RS-274X aperture macro outline primitive functionality of Gerbv 2.7.0 and dev (commit b5f1 (CVSS 9.3, Gerbv)
- [CVE-2021-40398](https://cve.now/CVE-2021-40398.md): An out-of-bounds write vulnerability exists in the parse\_raster\_data functionality of Accusoft ImageGear 19.10. (CVSS 8.1, Accusoft ImageGear)
- [CVE-2021-40392](https://cve.now/CVE-2021-40392.md): An information disclosure vulnerability exists in the Web Application functionality of Moxa MXView Series 3.2.4. (CVSS 5.3, Moxa MXView Series)
- [CVE-2021-40390](https://cve.now/CVE-2021-40390.md): An authentication bypass vulnerability exists in the Web Application functionality of Moxa MXView Series 3.2.4. (CVSS 10.0, Moxa MXView Series)
- [CVE-2021-21967](https://cve.now/CVE-2021-21967.md): An out-of-bounds write vulnerability exists in the OTA update task functionality of Sealevel Systems, Inc. (CVSS 6.5, Sealevel Systems SeaConnect)
- [CVE-2021-21956](https://cve.now/CVE-2021-21956.md): A php unserialize vulnerability exists in the Ai-Bolit functionality of CloudLinux Inc Imunify360 5.10.2. (CVSS 8.2, CloudLinux Imunify360)
- [CVE-2021-21949](https://cve.now/CVE-2021-21949.md): An improper array index validation vulnerability exists in the JPEG-JFIF Scan header parser functionality of Accusoft ImageGear 19.10. (CVSS 9.8, Accusoft ImageGear)
- [CVE-2021-21948](https://cve.now/CVE-2021-21948.md): A heap-based buffer overflow vulnerability exists in the readDatHeadVec functionality of AnyCubic Chitubox AnyCubic Plugin 1.0.0. (CVSS 7.8, Chitubox AnyCubic Plugin · Chitubox Basic)
- [CVE-2021-21947](https://cve.now/CVE-2021-21947.md): Two heap-based buffer overflow vulnerabilities exists in the JPEG-JFIF lossless Huffman image parser functionality of Accusoft ImageGear 19. (CVSS 9.8, Accusoft ImageGear)
- [CVE-2021-21946](https://cve.now/CVE-2021-21946.md): Two heap-based buffer overflow vulnerabilities exists in the JPEG-JFIF lossless Huffman image parser functionality of Accusoft ImageGear 19. (CVSS 9.8, Accusoft ImageGear)
- [CVE-2021-21945](https://cve.now/CVE-2021-21945.md): Two heap-based buffer overflow vulnerabilities exist in the TIFF parser functionality of Accusoft ImageGear 19.10. (CVSS 9.8, Accusoft ImageGear)
- [CVE-2021-21944](https://cve.now/CVE-2021-21944.md): Two heap-based buffer overflow vulnerabilities exist in the TIFF parser functionality of Accusoft ImageGear 19.10. (CVSS 9.8, Accusoft ImageGear)
- [CVE-2021-21943](https://cve.now/CVE-2021-21943.md): A heap-based buffer overflow vulnerability exists in the XWD parser functionality of Accusoft ImageGear 19.10. (CVSS 9.8, Accusoft ImageGear)
- [CVE-2021-21942](https://cve.now/CVE-2021-21942.md): An out-of-bounds write vulnerability exists in the TIFF YCbCr image parser functionality of Accusoft ImageGear 19.10. (CVSS 9.8, Accusoft ImageGear)
- [CVE-2021-21939](https://cve.now/CVE-2021-21939.md): A heap-based buffer overflow vulnerability exists in the XWD parser functionality of Accusoft ImageGear 19.10. (CVSS 9.8, Accusoft ImageGear)
- [CVE-2021-21938](https://cve.now/CVE-2021-21938.md): A heap-based buffer overflow vulnerability exists in the Palette box parser functionality of Accusoft ImageGear 19.10. (CVSS 9.8, Accusoft ImageGear)
- [CVE-2021-21914](https://cve.now/CVE-2021-21914.md): A heap-based buffer overflow vulnerability exists in the DecoderStream::Append functionality of Accusoft ImageGear 19.10. (CVSS 9.8, Accusoft ImageGear)
- [CVE-2021-43257](https://cve.now/CVE-2021-43257.md): Lack of Neutralization of Formula Elements in the CSV API of MantisBT before 2.25.3 allows an unprivileged attacker to execute code or gain (no CVSS, mantisbt/mantisbt)
- [CVE-2022-22391](https://cve.now/CVE-2022-22391.md): IBM Aspera High-Speed Transfer 4.3.1 and earlier could allow an authenticated user to obtain information from non sensitive operating system (CVSS 4.3, IBM Aspera High-Speed Transfer Endpoint · IBM Aspera High-S…)
- [CVE-2022-27817](https://cve.now/CVE-2022-27817.md): SWHKD 1.1.5 consumes the keyboard events of unintended users. (no CVSS, Simple-Wayland-HotKey-Daemon)
- [CVE-2022-27814](https://cve.now/CVE-2022-27814.md): SWHKD 1.1.5 allows arbitrary file-existence tests via the -c option. (no CVSS, Simple-Wayland-HotKey-Daemon)
- [CVE-2022-22198](https://cve.now/CVE-2022-22198.md): Junos OS: MX MS-MPC or MS-MIC, or SRX SPC crashes if it receives a SIP message with a specific contact header format (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2022-22197](https://cve.now/CVE-2022-22197.md): Junos OS and Junos OS Evolved: An rpd core will be observed with proxy BGP route-target filtering enabled and certain route add and delete event happening (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2022-22196](https://cve.now/CVE-2022-22196.md): Junos OS and Junos OS Evolved: The rpd CPU spikes to 100% after a malformed ISIS TLV has been received (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2022-22195](https://cve.now/CVE-2022-22195.md): Junos OS Evolved: Specific packets reaching the RE lead to a counter overflow and eventually a crash (CVSS 7.5, Juniper Networks Junos OS Evolved · Juniper Networks Junos…)
- [CVE-2022-22194](https://cve.now/CVE-2022-22194.md): Junos OS Evolved: PTX series: An attacker sending a crafted GRE packet will cause the PFE to restart (CVSS 7.5, Juniper Networks Junos OS Evolved · Juniper Networks Junos…)
- [CVE-2022-22193](https://cve.now/CVE-2022-22193.md): Junos OS and Junos OS Evolved: In a BGP rib-sharding scenario when a certain CLI command is executed the rpd process might crash (CVSS 5.5, Juniper Networks Junos OS)
- [CVE-2022-22191](https://cve.now/CVE-2022-22191.md): Junos OS: EX4300: PFE Denial of Service (DoS) upon receipt of a flood of specific ARP traffic (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2022-22190](https://cve.now/CVE-2022-22190.md): Paragon Active Assurance Control Center: Information disclosure vulnerability in crafted URL (CVSS 7.4, Juniper Networks Paragon Active Assurance)
- [CVE-2022-22189](https://cve.now/CVE-2022-22189.md): Contrail Service Orchestration: An authenticated local user may have their permissions elevated via the device via management interface without authentication (CVSS 7.3, Juniper Networks Contrail Service Orchestration)
- [CVE-2022-22188](https://cve.now/CVE-2022-22188.md): Junos OS: QFX5100/QFX5110/QFX5120/QFX5200/QFX5210/EX4600/EX4650 Series: When storm control profiling is enabled and a device is under an active storm, a Heap-based Buffer Overflow in the PFE will cause a device to hang. (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2022-22187](https://cve.now/CVE-2022-22187.md): JIMS: Local Privilege Escalation vulnerability via repair functionality (CVSS 7.8, Juniper Networks Juniper Identity Management Service)
- [CVE-2022-22186](https://cve.now/CVE-2022-22186.md): Junos OS: EX4650 Series: Certain traffic received by the Junos OS device on the management interface may be forwarded to egress interfaces instead of discarded (CVSS 7.2, Juniper Networks Junos OS)
- [CVE-2022-22185](https://cve.now/CVE-2022-22185.md): Junos OS: SRX Series: Denial of service vulnerability in flowd daemon upon receipt of a specific fragmented packet (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2022-22183](https://cve.now/CVE-2022-22183.md): Junos OS Evolved: A remote attacker may cause a CPU Denial of Service by sending genuine traffic to a device on a specific IPv4 port. (CVSS 7.5, Juniper Networks Junos OS Evolved · Juniper Networks Junos…)
- [CVE-2022-22182](https://cve.now/CVE-2022-22182.md): Junos OS: A XSS vulnerability allows an attacker to execute commands on a target J-Web session (CVSS 8.8, Juniper Networks Junos OS)
- [CVE-2022-22181](https://cve.now/CVE-2022-22181.md): Junos OS: J-Web can be compromised through reflected XSS attacks (CVSS 8.0, Juniper Networks Junos OS)
- [CVE-2022-25165](https://cve.now/CVE-2022-25165.md): An issue was discovered in Amazon AWS VPN Client 2.0.0. (no CVSS)
- [CVE-2022-25166](https://cve.now/CVE-2022-25166.md): An issue was discovered in Amazon AWS VPN Client 2.0.0. (no CVSS)
- [CVE-2021-45227](https://cve.now/CVE-2021-45227.md): An issue was discovered in COINS Construction Cloud 11.12. (no CVSS)
- [CVE-2022-27007](https://cve.now/CVE-2022-27007.md): nginx njs 0.7.2 is affected suffers from Use-after-free in njs\_function\_frame\_alloc() when it try to invoke from a restored frame saved with (no CVSS)
- [CVE-2022-27008](https://cve.now/CVE-2022-27008.md): nginx njs 0.7.2 is vulnerable to Buffer Overflow. (no CVSS)
- [CVE-2021-45228](https://cve.now/CVE-2021-45228.md): An XSS issue was discovered in COINS Construction Cloud 11.12. (no CVSS)
- [CVE-2022-1257](https://cve.now/CVE-2022-1257.md): Improper Verification of Cryptographic Signature by McAfee Agent (CVSS 6.1, McAfee Agent)
- [CVE-2022-1258](https://cve.now/CVE-2022-1258.md): SQL injection vulnerability in McAfee Agent's ePO extension (CVSS 8.4, McAfee Agent ePO extension)
- [CVE-2022-1256](https://cve.now/CVE-2022-1256.md): Improper Privilege Management in McAfee Agent for Windows (CVSS 7.8, McAfee Agent for Windows)
- [CVE-2022-27456](https://cve.now/CVE-2022-27456.md): MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component VDec::VDec at /sql/sql\_type.cc. (no CVSS)
- [CVE-2022-27457](https://cve.now/CVE-2022-27457.md): MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component my\_mb\_wc\_latin1 at /strings/ctype-latin1.c. (no CVSS)
- [CVE-2022-27455](https://cve.now/CVE-2022-27455.md): MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component my\_wildcmp\_8bit\_impl at /strings/ctype-simple. (no CVSS)
- [CVE-2022-27451](https://cve.now/CVE-2022-27451.md): MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/field\_conv.cc. (no CVSS)
- [CVE-2022-27452](https://cve.now/CVE-2022-27452.md): MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item\_cmpfunc.cc. (no CVSS)
- [CVE-2022-27448](https://cve.now/CVE-2022-27448.md): There is an Assertion failure in MariaDB Server v10.9 and below via 'node-\>pcur-\>rel\_pos == BTR\_PCUR\_ON' at /row/row0mysql.cc. (no CVSS)
- [CVE-2022-27449](https://cve.now/CVE-2022-27449.md): MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item\_func.cc:148. (no CVSS)
- [CVE-2022-27446](https://cve.now/CVE-2022-27446.md): MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item\_cmpfunc.h. (no CVSS)
- [CVE-2022-27447](https://cve.now/CVE-2022-27447.md): MariaDB Server v10.9 and below was discovered to contain a use-after-free via the component Binary\_string::free\_buffer() at /sql/sql\_string. (no CVSS)
- [CVE-2022-27445](https://cve.now/CVE-2022-27445.md): MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/sql\_window.cc. (no CVSS)
- [CVE-2022-27444](https://cve.now/CVE-2022-27444.md): MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item\_subselect.cc. (no CVSS)
- [CVE-2021-43286](https://cve.now/CVE-2021-43286.md): An issue was discovered in ThoughtWorks GoCD before 21.3.0. (no CVSS)
- [CVE-2021-43288](https://cve.now/CVE-2021-43288.md): An issue was discovered in ThoughtWorks GoCD before 21.3.0. (no CVSS)
- [CVE-2021-43289](https://cve.now/CVE-2021-43289.md): An issue was discovered in ThoughtWorks GoCD before 21.3.0. (no CVSS)
- [CVE-2021-43290](https://cve.now/CVE-2021-43290.md): An issue was discovered in ThoughtWorks GoCD before 21.3.0. (no CVSS)
- [CVE-2021-43633](https://cve.now/CVE-2021-43633.md): Sourcecodester Messaging Web Application 1.0 is vulnerable to stored XSS. (no CVSS)
- [CVE-2022-26507](https://cve.now/CVE-2022-26507.md): A heap-based buffer overflow exists in XML Decompression DecodeTreeBlock in AT&T Labs Xmill 0.7. (no CVSS)
- [CVE-2021-43287](https://cve.now/CVE-2021-43287.md): An issue was discovered in ThoughtWorks GoCD before 21.3.0. (no CVSS)
- [CVE-2022-1351](https://cve.now/CVE-2022-1351.md): Stored XSS in Tooltip in pimcore/pimcore (CVSS 6.8, pimcore/pimcore)
- [CVE-2022-1279](https://cve.now/CVE-2022-1279.md): Insecure EBICS messages encryption implementation in ebics-java/ebics-java-client could allow an adjacent attacker to decrypt EBICS payloads (CVSS 6.5, ebics-java-client)
- [CVE-2022-1350](https://cve.now/CVE-2022-1350.md): GhostPCL gsmchunk.c chunk\_free\_object memory corruption (CVSS 4.3, GhostPCL)
- [CVE-2022-1328](https://cve.now/CVE-2022-1328.md): Buffer Overflow in uudecoder in Mutt affecting all versions starting from 0.94.13 before 2.2.3 allows read past end of input line (CVSS 4.3, Mutt)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-04-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.