# CVEs published 2022-04-15

234 CVEs were published on April 15, 2022: 5 critical, 106 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2022-29287](https://cve.now/CVE-2022-29287.md): Kentico CMS before 13.0.66 has an Insecure Direct Object Reference vulnerability. (CVSS 4.9)
- [CVE-2022-29020](https://cve.now/CVE-2022-29020.md): ForestBlog through 2022-02-16 allows admin/profile/save userAvatar XSS during addition of a user avatar. (no CVSS)
- [CVE-2022-1365](https://cve.now/CVE-2022-1365.md): Exposure of Private Personal Information to an Unauthorized Actor in lquixada/cross-fetch (CVSS 8.8, lquixada/cross-fetch)
- [CVE-2022-29281](https://cve.now/CVE-2022-29281.md): Notable before 1.9.0-beta.8 doesn't effectively prevent the opening of executable files when clicking on a link. (no CVSS)
- [CVE-2022-24279](https://cve.now/CVE-2022-24279.md): Prototype Pollution (CVSS 7.5, madlib-object-utils)
- [CVE-2022-29072](https://cve.now/CVE-2022-29072.md): 7-Zip through 21.07 on Windows allows privilege escalation and command execution when a file with the .7z extension is dragged to the Help\>C (no CVSS)
- [CVE-2022-27426](https://cve.now/CVE-2022-27426.md): A Server-Side Request Forgery (SSRF) in Chamilo LMS v1.11.13 allows attackers to enumerate the internal network and execute arbitrary system (no CVSS)
- [CVE-2022-27425](https://cve.now/CVE-2022-27425.md): Chamilo LMS v1.11.13 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /blog/blog.php. (no CVSS)
- [CVE-2022-27423](https://cve.now/CVE-2022-27423.md): Chamilo LMS v1.11.13 was discovered to contain a SQL injection vulnerability via the blog\_id parameter at /blog/blog.php. (no CVSS)
- [CVE-2022-27421](https://cve.now/CVE-2022-27421.md): Chamilo LMS v1.11.13 lacks validation on the user modification form, allowing attackers to escalate privileges to Platform Admin. (no CVSS)
- [CVE-2022-27422](https://cve.now/CVE-2022-27422.md): A reflected cross-site scripting (XSS) vulnerability in Chamilo LMS v1.11.13 allows attackers to execute arbitrary web scripts or HTML via u (no CVSS)
- [CVE-2022-26924](https://cve.now/CVE-2022-26924.md): YARP Denial of Service Vulnerability (CVSS 7.5, Microsoft YARP · Yarp.ReverseProxy)
- [CVE-2022-26921](https://cve.now/CVE-2022-26921.md): Visual Studio Code Elevation of Privilege Vulnerability (CVSS 7.3, Microsoft Visual Studio Code)
- [CVE-2022-26920](https://cve.now/CVE-2022-26920.md): Windows Graphics Component Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2022-26919](https://cve.now/CVE-2022-26919.md): Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2022-26918](https://cve.now/CVE-2022-26918.md): Windows Fax Compose Form Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-26917](https://cve.now/CVE-2022-26917.md): Windows Fax Compose Form Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-26916](https://cve.now/CVE-2022-26916.md): Windows Fax Compose Form Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-26915](https://cve.now/CVE-2022-26915.md): Windows Secure Channel Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2022-26914](https://cve.now/CVE-2022-26914.md): Win32k Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-26911](https://cve.now/CVE-2022-26911.md): Skype for Business Information Disclosure Vulnerability (CVSS 6.5, Microsoft Lync Server 2013 CU10 · Microsoft Skype for Bu… +1)
- [CVE-2022-26910](https://cve.now/CVE-2022-26910.md): Skype for Business and Lync Spoofing Vulnerability (CVSS 5.3, Microsoft Skype for Business Server 2015 CU12 · Microsoft S…)
- [CVE-2022-26907](https://cve.now/CVE-2022-26907.md): Azure SDK for .NET Information Disclosure Vulnerability (CVSS 5.3, Microsoft Azure SDK for .Net · Microsoft.Rest.ClientRuntime)
- [CVE-2022-26904](https://cve.now/CVE-2022-26904.md): Windows User Profile Service Elevation of Privilege Vulnerability (CVSS 7.0, KEV, Microsoft Windows)
- [CVE-2022-26903](https://cve.now/CVE-2022-26903.md): Windows Graphics Component Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows · Microsoft Excel for Android +5)
- [CVE-2022-26901](https://cve.now/CVE-2022-26901.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office 2019 for Mac · Microsoft Office Online… +5)
- [CVE-2022-26898](https://cve.now/CVE-2022-26898.md): Azure Site Recovery Remote Code Execution Vulnerability (CVSS 7.2, Microsoft Azure Site Recovery VMWare to Azure)
- [CVE-2022-26897](https://cve.now/CVE-2022-26897.md): Azure Site Recovery Information Disclosure Vulnerability (CVSS 4.9, Microsoft Azure Site Recovery VMWare to Azure)
- [CVE-2022-26896](https://cve.now/CVE-2022-26896.md): Azure Site Recovery Information Disclosure Vulnerability (CVSS 4.9, Microsoft Azure Site Recovery VMWare to Azure)
- [CVE-2022-26832](https://cve.now/CVE-2022-26832.md): .NET Framework Denial of Service Vulnerability (CVSS 7.5, Microsoft .NET Framework 3.5 AND · Microsoft .NET Framework)
- [CVE-2022-26831](https://cve.now/CVE-2022-26831.md): Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2022-26830](https://cve.now/CVE-2022-26830.md): DiskUsage.exe Remote Code Execution Vulnerability (CVSS 7.5, Microsoft Windows Server · Microsoft Windows)
- [CVE-2022-26829](https://cve.now/CVE-2022-26829.md): Windows DNS Server Remote Code Execution Vulnerability (CVSS 6.6, Microsoft Windows Server)
- [CVE-2022-26828](https://cve.now/CVE-2022-26828.md): Windows Bluetooth Driver Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2022-26827](https://cve.now/CVE-2022-26827.md): Windows File Server Resource Management Service Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2022-26826](https://cve.now/CVE-2022-26826.md): Windows DNS Server Remote Code Execution Vulnerability (CVSS 7.2, Microsoft Windows)
- [CVE-2022-26825](https://cve.now/CVE-2022-26825.md): Windows DNS Server Remote Code Execution Vulnerability (CVSS 7.2, Microsoft Windows Server)
- [CVE-2022-26824](https://cve.now/CVE-2022-26824.md): Windows DNS Server Remote Code Execution Vulnerability (CVSS 7.2, Microsoft Windows Server)
- [CVE-2022-26823](https://cve.now/CVE-2022-26823.md): Windows DNS Server Remote Code Execution Vulnerability (CVSS 7.2, Microsoft Windows Server)
- [CVE-2022-26822](https://cve.now/CVE-2022-26822.md): Windows DNS Server Remote Code Execution Vulnerability (CVSS 6.6, Microsoft Windows Server)
- [CVE-2022-26821](https://cve.now/CVE-2022-26821.md): Windows DNS Server Remote Code Execution Vulnerability (CVSS 6.6, Microsoft Windows Server)
- [CVE-2022-26820](https://cve.now/CVE-2022-26820.md): Windows DNS Server Remote Code Execution Vulnerability (CVSS 6.6, Microsoft Windows Server)
- [CVE-2022-26819](https://cve.now/CVE-2022-26819.md): Windows DNS Server Remote Code Execution Vulnerability (CVSS 6.6, Microsoft Windows Server)
- [CVE-2022-26818](https://cve.now/CVE-2022-26818.md): Windows DNS Server Remote Code Execution Vulnerability (CVSS 6.6, Microsoft Windows Server)
- [CVE-2022-26817](https://cve.now/CVE-2022-26817.md): Windows DNS Server Remote Code Execution Vulnerability (CVSS 6.6, Microsoft Windows Server)
- [CVE-2022-26816](https://cve.now/CVE-2022-26816.md): Windows DNS Server Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows Server)
- [CVE-2022-26815](https://cve.now/CVE-2022-26815.md): Windows DNS Server Remote Code Execution Vulnerability (CVSS 7.2, Microsoft Windows Server)
- [CVE-2022-26814](https://cve.now/CVE-2022-26814.md): Windows DNS Server Remote Code Execution Vulnerability (CVSS 6.6, Microsoft Windows Server)
- [CVE-2022-26813](https://cve.now/CVE-2022-26813.md): Windows DNS Server Remote Code Execution Vulnerability (CVSS 7.2, Microsoft Windows Server)
- [CVE-2022-26812](https://cve.now/CVE-2022-26812.md): Windows DNS Server Remote Code Execution Vulnerability (CVSS 7.2, Microsoft Windows Server)
- [CVE-2022-26811](https://cve.now/CVE-2022-26811.md): Windows DNS Server Remote Code Execution Vulnerability (CVSS 7.2, Microsoft Windows Server)
- [CVE-2022-26810](https://cve.now/CVE-2022-26810.md): Windows File Server Resource Management Service Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-26809](https://cve.now/CVE-2022-26809.md): Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVSS 9.8, Microsoft Windows)
- [CVE-2022-26808](https://cve.now/CVE-2022-26808.md): Windows File Explorer Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2022-26807](https://cve.now/CVE-2022-26807.md): Windows Work Folder Service Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2022-26803](https://cve.now/CVE-2022-26803.md): Windows Print Spooler Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-26802](https://cve.now/CVE-2022-26802.md): Windows Print Spooler Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-26801](https://cve.now/CVE-2022-26801.md): Windows Print Spooler Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-26798](https://cve.now/CVE-2022-26798.md): Windows Print Spooler Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-26797](https://cve.now/CVE-2022-26797.md): Windows Print Spooler Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-26796](https://cve.now/CVE-2022-26796.md): Windows Print Spooler Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-26795](https://cve.now/CVE-2022-26795.md): Windows Print Spooler Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-26794](https://cve.now/CVE-2022-26794.md): Windows Print Spooler Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-26793](https://cve.now/CVE-2022-26793.md): Windows Print Spooler Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-26792](https://cve.now/CVE-2022-26792.md): Windows Print Spooler Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-26791](https://cve.now/CVE-2022-26791.md): Windows Print Spooler Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-26790](https://cve.now/CVE-2022-26790.md): Windows Print Spooler Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-26789](https://cve.now/CVE-2022-26789.md): Windows Print Spooler Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-26788](https://cve.now/CVE-2022-26788.md): PowerShell Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows · Microsoft PowerShell +1)
- [CVE-2022-26787](https://cve.now/CVE-2022-26787.md): Windows Print Spooler Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-26786](https://cve.now/CVE-2022-26786.md): Windows Print Spooler Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-26785](https://cve.now/CVE-2022-26785.md): Windows Hyper-V Shared Virtual Hard Disks Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows Server)
- [CVE-2022-26784](https://cve.now/CVE-2022-26784.md): Windows Cluster Shared Volume (CSV) Denial of Service Vulnerability (CVSS 6.5, Microsoft Windows Server)
- [CVE-2022-26783](https://cve.now/CVE-2022-26783.md): Windows Hyper-V Shared Virtual Hard Disks Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows Server)
- [CVE-2022-24550](https://cve.now/CVE-2022-24550.md): Windows Telephony Server Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-24549](https://cve.now/CVE-2022-24549.md): Windows AppX Package Manager Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-24548](https://cve.now/CVE-2022-24548.md): Microsoft Defender Denial of Service Vulnerability (CVSS 5.5, Microsoft Malware Protection Engine)
- [CVE-2022-24547](https://cve.now/CVE-2022-24547.md): Windows Digital Media Receiver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-24546](https://cve.now/CVE-2022-24546.md): Windows DWM Core Library Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-24545](https://cve.now/CVE-2022-24545.md): Windows Kerberos Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2022-24544](https://cve.now/CVE-2022-24544.md): Windows Kerberos Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-24543](https://cve.now/CVE-2022-24543.md): Windows Upgrade Assistant Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows Upgrade Assistant)
- [CVE-2022-24542](https://cve.now/CVE-2022-24542.md): Windows Win32k Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-24541](https://cve.now/CVE-2022-24541.md): Windows Server Service Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2022-24540](https://cve.now/CVE-2022-24540.md): Windows ALPC Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2022-24539](https://cve.now/CVE-2022-24539.md): Windows Hyper-V Shared Virtual Hard Disks Information Disclosure Vulnerability (CVSS 8.1, Microsoft Windows Server)
- [CVE-2022-24538](https://cve.now/CVE-2022-24538.md): Windows Cluster Shared Volume (CSV) Denial of Service Vulnerability (CVSS 6.5, Microsoft Windows Server)
- [CVE-2022-24537](https://cve.now/CVE-2022-24537.md): Windows Hyper-V Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-24536](https://cve.now/CVE-2022-24536.md): Windows DNS Server Remote Code Execution Vulnerability (CVSS 7.2, Microsoft Windows Server)
- [CVE-2022-24534](https://cve.now/CVE-2022-24534.md): Win32 Stream Enumeration Remote Code Execution Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2022-24533](https://cve.now/CVE-2022-24533.md): Remote Desktop Protocol Remote Code Execution Vulnerability (CVSS 8.0, Microsoft Windows)
- [CVE-2022-24532](https://cve.now/CVE-2022-24532.md): HEVC Video Extensions Remote Code Execution Vulnerability (CVSS 7.8, Microsoft HEVC Video Extension · Microsoft HEVC Video Exten…)
- [CVE-2022-24530](https://cve.now/CVE-2022-24530.md): Windows Installer Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-24528](https://cve.now/CVE-2022-24528.md): Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2022-24527](https://cve.now/CVE-2022-24527.md): Microsoft Endpoint Configuration Manager Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Endpoint Configuration Manager)
- [CVE-2022-24521](https://cve.now/CVE-2022-24521.md): Windows Common Log File System Driver Elevation of Privilege Vulnerability (CVSS 7.8, KEV, Microsoft Windows)
- [CVE-2022-24513](https://cve.now/CVE-2022-24513.md): Visual Studio Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Visual Studio)
- [CVE-2022-24500](https://cve.now/CVE-2022-24500.md): Windows SMB Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2022-24499](https://cve.now/CVE-2022-24499.md): Windows Installer Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-24498](https://cve.now/CVE-2022-24498.md): Windows iSCSI Target Service Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2022-24497](https://cve.now/CVE-2022-24497.md): Windows Network File System Remote Code Execution Vulnerability (CVSS 9.8, Microsoft Windows)
- [CVE-2022-24496](https://cve.now/CVE-2022-24496.md): Windows Local Security Authority (LSA) Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-24495](https://cve.now/CVE-2022-24495.md): Windows Direct Show Remote Code Execution Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2022-24494](https://cve.now/CVE-2022-24494.md): Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-24493](https://cve.now/CVE-2022-24493.md): Microsoft Local Security Authority (LSA) Server Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2022-24492](https://cve.now/CVE-2022-24492.md): Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2022-24491](https://cve.now/CVE-2022-24491.md): Windows Network File System Remote Code Execution Vulnerability (CVSS 9.8, Microsoft Windows)
- [CVE-2022-24490](https://cve.now/CVE-2022-24490.md): Windows Hyper-V Shared Virtual Hard Disks Information Disclosure Vulnerability (CVSS 8.1, Microsoft Windows Server)
- [CVE-2022-24489](https://cve.now/CVE-2022-24489.md): Cluster Client Failover (CCF) Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows Server)
- [CVE-2022-24488](https://cve.now/CVE-2022-24488.md): Windows Desktop Bridge Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-24487](https://cve.now/CVE-2022-24487.md): Windows Local Security Authority Subsystem Service (LSASS) Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2022-24486](https://cve.now/CVE-2022-24486.md): Windows Kerberos Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-24485](https://cve.now/CVE-2022-24485.md): Win32 File Enumeration Remote Code Execution Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2022-24484](https://cve.now/CVE-2022-24484.md): Windows Cluster Shared Volume (CSV) Denial of Service Vulnerability (CVSS 5.5, Microsoft Windows Server)
- [CVE-2022-24483](https://cve.now/CVE-2022-24483.md): Windows Kernel Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2022-24482](https://cve.now/CVE-2022-24482.md): Windows ALPC Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2022-24481](https://cve.now/CVE-2022-24481.md): Windows Common Log File System Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-24479](https://cve.now/CVE-2022-24479.md): Connected User Experiences and Telemetry Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-24474](https://cve.now/CVE-2022-24474.md): Windows Win32k Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-24473](https://cve.now/CVE-2022-24473.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office 2019 for Mac · Microsoft 365 Apps for E… +2)
- [CVE-2022-24472](https://cve.now/CVE-2022-24472.md): Microsoft SharePoint Server Spoofing Vulnerability (CVSS 8.0, Microsoft SharePoint Enterprise Server · Microsoft Share… +1)
- [CVE-2022-23292](https://cve.now/CVE-2022-23292.md): Microsoft Power BI Spoofing Vulnerability (CVSS 3.7, Microsoft On-Premises Data Gateway)
- [CVE-2022-23268](https://cve.now/CVE-2022-23268.md): Windows Hyper-V Denial of Service Vulnerability (CVSS 6.5, Microsoft Windows Server · Microsoft Windows)
- [CVE-2022-23259](https://cve.now/CVE-2022-23259.md): Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Dynamics 365 (on-premises))
- [CVE-2022-23257](https://cve.now/CVE-2022-23257.md): Windows Hyper-V Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2022-22009](https://cve.now/CVE-2022-22009.md): Windows Hyper-V Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-22008](https://cve.now/CVE-2022-22008.md): Windows Hyper-V Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-21983](https://cve.now/CVE-2022-21983.md): Win32 Stream Enumeration Remote Code Execution Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2022-24857](https://cve.now/CVE-2022-24857.md): Multi factor authentication bypass in django-mfa3 (CVSS 7.3, xi django-mfa3 · django-mfa3)
- [CVE-2022-24851](https://cve.now/CVE-2022-24851.md): Stored XSS and path traversal in LDAPAccountManager/lam (CVSS 8.1, LDAPAccountManager lam)
- [CVE-2022-27048](https://cve.now/CVE-2022-27048.md): A vulnerability has been discovered in Moxa MGate which allows an attacker to perform a man-in-the-middle (MITM) attack on the device. (no CVSS)
- [CVE-2022-28113](https://cve.now/CVE-2022-28113.md): An issue in upload.csp of FANTEC GmbH MWiD25-DS Firmware v2.000.030 allows attackers to write files and reset the user passwords without hav (no CVSS)
- [CVE-2022-27158](https://cve.now/CVE-2022-27158.md): pearweb \< 1.32 suffers from Deserialization of Untrusted Data. (no CVSS)
- [CVE-2021-44507](https://cve.now/CVE-2021-44507.md): An issue was discovered in FIS GT.M through V7.0-000 (related to the YottaDB code base). (no CVSS)
- [CVE-2022-27157](https://cve.now/CVE-2022-27157.md): pearweb \< 1.32 is suffers from a Weak Password Recovery Mechanism via include/users/passwordmanage.php. (no CVSS)
- [CVE-2021-44510](https://cve.now/CVE-2021-44510.md): An issue was discovered in FIS GT.M through V7.0-000 (related to the YottaDB code base). (no CVSS)
- [CVE-2021-44509](https://cve.now/CVE-2021-44509.md): An issue was discovered in FIS GT.M through V7.0-000 (related to the YottaDB code base). (no CVSS)
- [CVE-2021-44508](https://cve.now/CVE-2021-44508.md): An issue was discovered in FIS GT.M through V7.0-000 (related to the YottaDB code base). (no CVSS)
- [CVE-2021-44506](https://cve.now/CVE-2021-44506.md): An issue was discovered in FIS GT.M through V7.0-000 (related to the YottaDB code base). (no CVSS)
- [CVE-2022-27257](https://cve.now/CVE-2022-27257.md): A PHP Local File Inclusion vulneraility in the default Redbasic theme for Hubzilla before version 7.2 allows remote attackers to include arb (no CVSS)
- [CVE-2021-44505](https://cve.now/CVE-2021-44505.md): An issue was discovered in FIS GT.M through V7.0-000 (related to the YottaDB code base). (no CVSS)
- [CVE-2021-44504](https://cve.now/CVE-2021-44504.md): An issue was discovered in FIS GT.M through V7.0-000 (related to the YottaDB code base). (no CVSS)
- [CVE-2021-44503](https://cve.now/CVE-2021-44503.md): An issue was discovered in FIS GT.M through V7.0-000 (related to the YottaDB code base). (no CVSS)
- [CVE-2021-44502](https://cve.now/CVE-2021-44502.md): An issue was discovered in FIS GT.M through V7.0-000 (related to the YottaDB code base). (no CVSS)
- [CVE-2021-44501](https://cve.now/CVE-2021-44501.md): An issue was discovered in FIS GT.M through V7.0-000 (related to the YottaDB code base). (no CVSS)
- [CVE-2021-44500](https://cve.now/CVE-2021-44500.md): An issue was discovered in FIS GT.M through V7.0-000 (related to the YottaDB code base). (no CVSS)
- [CVE-2021-44499](https://cve.now/CVE-2021-44499.md): An issue was discovered in FIS GT.M through V7.0-000 (related to the YottaDB code base). (no CVSS)
- [CVE-2021-44498](https://cve.now/CVE-2021-44498.md): An issue was discovered in FIS GT.M through V7.0-000 (related to the YottaDB code base). (no CVSS)
- [CVE-2021-44497](https://cve.now/CVE-2021-44497.md): An issue was discovered in FIS GT.M through V7.0-000 (related to the YottaDB code base). (no CVSS)
- [CVE-2021-44496](https://cve.now/CVE-2021-44496.md): An issue was discovered in FIS GT.M through V7.0-000 (related to the YottaDB code base). (no CVSS)
- [CVE-2021-44495](https://cve.now/CVE-2021-44495.md): An issue was discovered in YottaDB through r1.32 and V7.0-000 and FIS GT.M through V7.0-000. (no CVSS)
- [CVE-2021-44494](https://cve.now/CVE-2021-44494.md): An issue was discovered in YottaDB through r1.32 and V7.0-000 and FIS GT.M through V7.0-000. (no CVSS)
- [CVE-2021-44493](https://cve.now/CVE-2021-44493.md): An issue was discovered in YottaDB through r1.32 and V7.0-000 and FIS GT.M through V7.0-000. (no CVSS)
- [CVE-2022-27367](https://cve.now/CVE-2022-27367.md): Cscms Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the component dance\_Topic.php\_del. (no CVSS)
- [CVE-2022-27369](https://cve.now/CVE-2022-27369.md): Cscms Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the component news\_News.php\_hy. (no CVSS)
- [CVE-2022-27368](https://cve.now/CVE-2022-27368.md): Cscms Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the component dance\_Lists.php\_zhuan. (no CVSS)
- [CVE-2022-27365](https://cve.now/CVE-2022-27365.md): Cscms Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the component dance\_Dance.php\_del. (no CVSS)
- [CVE-2022-27366](https://cve.now/CVE-2022-27366.md): Cscms Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the component dance\_Dance.php\_hy. (no CVSS)
- [CVE-2021-44492](https://cve.now/CVE-2021-44492.md): An issue was discovered in YottaDB through r1.32 and V7.0-000 and FIS GT.M through V7.0-000. (no CVSS)
- [CVE-2021-44491](https://cve.now/CVE-2021-44491.md): An issue was discovered in YottaDB through r1.32 and V7.0-000. (no CVSS)
- [CVE-2021-44490](https://cve.now/CVE-2021-44490.md): An issue was discovered in YottaDB through r1.32 and V7.0-000. (no CVSS)
- [CVE-2021-44489](https://cve.now/CVE-2021-44489.md): An issue was discovered in YottaDB through r1.32 and V7.0-000. (no CVSS)
- [CVE-2021-44488](https://cve.now/CVE-2021-44488.md): An issue was discovered in YottaDB through r1.32 and V7.0-000. (no CVSS)
- [CVE-2021-44487](https://cve.now/CVE-2021-44487.md): An issue was discovered in YottaDB through r1.32 and V7.0-000. (no CVSS)
- [CVE-2021-44486](https://cve.now/CVE-2021-44486.md): An issue was discovered in YottaDB through r1.32 and V7.0-000. (no CVSS)
- [CVE-2021-44485](https://cve.now/CVE-2021-44485.md): An issue was discovered in YottaDB through r1.32 and V7.0-000. (no CVSS)
- [CVE-2021-44484](https://cve.now/CVE-2021-44484.md): An issue was discovered in YottaDB through r1.32 and V7.0-000. (no CVSS)
- [CVE-2021-44483](https://cve.now/CVE-2021-44483.md): An issue was discovered in YottaDB through r1.32 and V7.0-000. (no CVSS)
- [CVE-2021-44482](https://cve.now/CVE-2021-44482.md): An issue was discovered in YottaDB through r1.32 and V7.0-000. (no CVSS)
- [CVE-2021-44481](https://cve.now/CVE-2021-44481.md): An issue was discovered in YottaDB through r1.32 and V7.0-000. (no CVSS)
- [CVE-2021-36205](https://cve.now/CVE-2021-36205.md): Metasys session token (CVSS 8.1, Johnson Controls Metasys)
- [CVE-2022-27852](https://cve.now/CVE-2022-27852.md): WordPress KB Support plugin \<= 1.5.5 - Multiple Unauth. Stored Cross-Site Scripting (XSS) vulnerabilities (CVSS 6.1, WPChill Media Labs L.L.C KB Support)
- [CVE-2021-36828](https://cve.now/CVE-2021-36828.md): WordPress WP Maintenance plugin \<= 6.0.4 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (CVSS 4.8, Florent Maillefaud WP Maintenance)
- [CVE-2022-27851](https://cve.now/CVE-2022-27851.md): WordPress Use Any Font plugin \<= 6.1.7 - Cross-Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Dnesscarkey Use Any Font | Custom Font Uploader)
- [CVE-2022-27850](https://cve.now/CVE-2022-27850.md): WordPress Simple Ajax Chat plugin \<= 20220115 - Multiple Cross-Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Jeff Starr Simple Ajax Chat)
- [CVE-2022-27849](https://cve.now/CVE-2022-27849.md): WordPress Simple Ajax Chat plugin \<= 20220115 - Sensitive Information Disclosure vulnerability (CVSS 5.3, Jeff Starr Simple Ajax Chat)
- [CVE-2021-42230](https://cve.now/CVE-2021-42230.md): Seowon 130-SLC router all versions as of 2021-09-15 is vulnerable to Remote Code Execution via the queriesCnt parameter. (no CVSS)
- [CVE-2022-27258](https://cve.now/CVE-2022-27258.md): Multiple Cross-Site Scripting (XSS) vulnerabilities in Hubzilla 7.0.3 and earlier allows remote attacker to include arbitrary web script or (no CVSS)
- [CVE-2022-21159](https://cve.now/CVE-2022-21159.md): A denial of service vulnerability exists in the parseNormalModeParameters functionality of MZ Automation GmbH libiec61850 1.5.0. (CVSS 7.5, MZ Automation libiec61850)
- [CVE-2022-26594](https://cve.now/CVE-2022-26594.md): Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.3.5 through 7.4.0, and Liferay DXP 7.3 before service pack 3 allow r (no CVSS, com.liferay:com.liferay.dynamic.data.mapping.form.field.typ…)
- [CVE-2022-28109](https://cve.now/CVE-2022-28109.md): Selenium Selenium Grid (formerly Selenium Standalone Server) Fixed in 4.0.0-alpha-7 is affected by: DNS rebinding. (no CVSS)
- [CVE-2022-23865](https://cve.now/CVE-2022-23865.md): Nyron 1.0 is affected by a SQL injection vulnerability through Nyron/Library/Catalog/winlibsrch.aspx. (no CVSS)
- [CVE-2022-1231](https://cve.now/CVE-2022-1231.md): XSS via Embedded SVG in SVG Diagram Format in plantuml/plantuml (CVSS 9.3, plantuml/plantuml)
- [CVE-2022-20720](https://cve.now/CVE-2022-20720.md): Cisco IOx Application Hosting Environment Vulnerabilities (CVSS 5.5, Cisco IOS)
- [CVE-2022-20721](https://cve.now/CVE-2022-20721.md): Cisco IOx Application Hosting Environment Vulnerabilities (CVSS 5.5, Cisco IOS)
- [CVE-2022-20722](https://cve.now/CVE-2022-20722.md): Cisco IOx Application Hosting Environment Vulnerabilities (CVSS 5.5, Cisco IOS)
- [CVE-2022-20723](https://cve.now/CVE-2022-20723.md): Cisco IOx Application Hosting Environment Vulnerabilities (CVSS 5.5, Cisco IOS)
- [CVE-2022-20724](https://cve.now/CVE-2022-20724.md): Cisco IOx Application Hosting Environment Vulnerabilities (CVSS 5.5, Cisco IOS)
- [CVE-2022-20725](https://cve.now/CVE-2022-20725.md): Cisco IOx Application Hosting Environment Vulnerabilities (CVSS 5.5, Cisco IOS)
- [CVE-2022-20726](https://cve.now/CVE-2022-20726.md): Cisco IOx Application Hosting Environment Vulnerabilities (CVSS 5.5, Cisco IOS)
- [CVE-2022-20727](https://cve.now/CVE-2022-20727.md): Cisco IOx Application Hosting Environment Vulnerabilities (CVSS 5.5, Cisco IOS)
- [CVE-2022-20731](https://cve.now/CVE-2022-20731.md): Cisco Catalyst Digital Building Series Switches and Cisco Catalyst Micro Switches Vulnerabilities (CVSS 4.6, Cisco IOS ROMMON Software)
- [CVE-2022-20735](https://cve.now/CVE-2022-20735.md): Cisco SD-WAN vManage Software Cross-Site Request Forgery Vulnerability (CVSS 6.5, Cisco SD-WAN vManage)
- [CVE-2022-20739](https://cve.now/CVE-2022-20739.md): Cisco SD-WAN vManage Software Privilege Escalation Vulnerability (CVSS 7.3, Cisco SD-WAN vManage)
- [CVE-2022-20747](https://cve.now/CVE-2022-20747.md): Cisco SD-WAN vManage Software Information Disclosure Vulnerability (CVSS 6.5, Cisco SD-WAN vManage)
- [CVE-2022-20758](https://cve.now/CVE-2022-20758.md): Cisco IOS XR Software Border Gateway Protocol Ethernet VPN Denial of Service Vulnerability (CVSS 6.8, Cisco IOS XR Software)
- [CVE-2022-20761](https://cve.now/CVE-2022-20761.md): Cisco 1000 Series Connected Grid Router Integrated Wireless Access Point Denial of Service Vulnerability (CVSS 7.4, Cisco IOS)
- [CVE-2022-20622](https://cve.now/CVE-2022-20622.md): Cisco Embedded Wireless Controller with Catalyst Access Points IP Flood Denial of Service Vulnerability (CVSS 8.6, Cisco Aironet Access Point Software)
- [CVE-2022-20661](https://cve.now/CVE-2022-20661.md): Cisco Catalyst Digital Building Series Switches and Cisco Catalyst Micro Switches Vulnerabilities (CVSS 4.6, Cisco IOS ROMMON Software)
- [CVE-2022-20676](https://cve.now/CVE-2022-20676.md): Cisco IOS XE Software Tool Command Language Privilege Escalation Vulnerability (CVSS 5.1, Cisco IOS XE Software)
- [CVE-2022-20677](https://cve.now/CVE-2022-20677.md): Cisco IOx Application Hosting Environment Vulnerabilities (CVSS 5.5, Cisco IOS)
- [CVE-2022-20678](https://cve.now/CVE-2022-20678.md): Cisco IOS XE Software AppNav-XE Denial of Service Vulnerability (CVSS 8.6, Cisco IOS XE Software)
- [CVE-2022-20679](https://cve.now/CVE-2022-20679.md): Cisco IOS XE Software IPSec Denial of Service Vulnerability (CVSS 6.8, Cisco IOS XE Software)
- [CVE-2022-20681](https://cve.now/CVE-2022-20681.md): Cisco IOS XE Software for Cisco Catalyst 9000 Family Switches and Catalyst 9000 Family Wireless Controllers Privilege Escalation Vulnerability (CVSS 7.8, Cisco IOS XE Software)
- [CVE-2022-20682](https://cve.now/CVE-2022-20682.md): Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family CAPWAP Denial of Service Vulnerability (CVSS 8.6, Cisco IOS XE Software)
- [CVE-2022-20683](https://cve.now/CVE-2022-20683.md): Cisco IOS XE Software for Catalyst 9800 Series Wireless Controllers Application Visibility and Control Denial of Service Vulnerability (CVSS 8.6, Cisco IOS XE Software)
- [CVE-2022-20684](https://cve.now/CVE-2022-20684.md): Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family SNMP Trap Denial of Service Vulnerability (CVSS 7.4, Cisco IOS XE Software)
- [CVE-2022-20692](https://cve.now/CVE-2022-20692.md): Cisco IOS XE Software NETCONF Over SSH Denial of Service Vulnerability (CVSS 7.7, Cisco IOS XE Software)
- [CVE-2022-20693](https://cve.now/CVE-2022-20693.md): Cisco IOS XE Software Web UI API Injection Vulnerability (CVSS 4.7, Cisco IOS XE Software)
- [CVE-2022-20694](https://cve.now/CVE-2022-20694.md): Cisco IOS XE Software Border Gateway Protocol Resource Public Key Infrastructure Denial of Service Vulnerability (CVSS 6.8, Cisco IOS XE Software)
- [CVE-2022-20695](https://cve.now/CVE-2022-20695.md): Cisco Wireless LAN Controller Management Interface Authentication Bypass Vulnerability (CVSS 10.0, Cisco Wireless LAN Controller)
- [CVE-2022-20697](https://cve.now/CVE-2022-20697.md): Cisco IOS and IOS XE Software Web Services Denial of Service Vulnerability (CVSS 8.6, Cisco IOS)
- [CVE-2022-20714](https://cve.now/CVE-2022-20714.md): Cisco IOS XR Software for ASR 9000 Series Routers Lightspeed-Plus Line Cards Denial of Service Vulnerability (CVSS 8.6, Cisco IOS XR Software)
- [CVE-2022-20716](https://cve.now/CVE-2022-20716.md): Cisco SD-WAN Solution Improper Access Control Vulnerability (CVSS 7.8, Cisco SD-WAN Solution)
- [CVE-2022-20717](https://cve.now/CVE-2022-20717.md): Cisco SD-WAN vEdge Routers Denial of Service Vulnerability (CVSS 5.5, Cisco SD-WAN vEdge router)
- [CVE-2022-20718](https://cve.now/CVE-2022-20718.md): Cisco IOx Application Hosting Environment Vulnerabilities (CVSS 5.5, Cisco IOS)
- [CVE-2022-20719](https://cve.now/CVE-2022-20719.md): Cisco IOx Application Hosting Environment Vulnerabilities (CVSS 5.5, Cisco IOS)
- [CVE-2022-27043](https://cve.now/CVE-2022-27043.md): Yearning versions 2.3.1 and 2.3.2 Interstellar GA and 2.3.4 - 2.3.6 Neptune is vulnerable to Directory Traversal. (no CVSS)
- [CVE-2022-28049](https://cve.now/CVE-2022-28049.md): NGINX NJS 0.7.2 was discovered to contain a NULL pointer dereference via the component njs\_vmcode\_array at /src/njs\_vmcode.c. (no CVSS)
- [CVE-2022-28048](https://cve.now/CVE-2022-28048.md): STB v2.27 was discovered to contain an integer shift of invalid size in the component stbi\_\_jpeg\_decode\_block\_prog\_ac. (no CVSS)
- [CVE-2022-28044](https://cve.now/CVE-2022-28044.md): Irzip v0.640 was discovered to contain a heap memory corruption via the component lrzip.c:initialise\_control. (no CVSS)
- [CVE-2022-27474](https://cve.now/CVE-2022-27474.md): SuiteCRM v7.11.23 was discovered to allow remote code execution via a crafted payload injected into the FirstName text field. (no CVSS)
- [CVE-2022-28869](https://cve.now/CVE-2022-28869.md): Address Bar Spoofing Vulnerability in F-Secure SAFE Browser for Android (CVSS 4.3, F-Secure Mobile Security)
- [CVE-2022-28868](https://cve.now/CVE-2022-28868.md): Address Bar Spoofing Vulnerability in F-Secure SAFE Browser for Android (CVSS 4.3, F-Secure Mobile Security)
- [CVE-2022-28870](https://cve.now/CVE-2022-28870.md): Address Bar Spoofing Vulnerability in F-Secure SAFE Browser for Android (CVSS 4.3, F-Secure Mobile Security)
- [CVE-2022-28345](https://cve.now/CVE-2022-28345.md): The Signal app before 5.34 for iOS allows URI spoofing via RTLO injection. (no CVSS)
- [CVE-2021-40386](https://cve.now/CVE-2021-40386.md): Kaseya Unitrends Client/Agent through 10.5,5 allows remote attackers to execute arbitrary code. (no CVSS)
- [CVE-2022-27188](https://cve.now/CVE-2022-27188.md): OS command injection vulnerability exists in CENTUM VP R4.01.00 to R4.03.00, CENTUM VP Small R4.01.00 to R4.03.00, CENTUM VP Basic R4.01.00 (no CVSS, Yokogawa Electric CENTUM VP series with VP6E5150(Graphic Bu…)
- [CVE-2022-26034](https://cve.now/CVE-2022-26034.md): Improper authentication vulnerability in the communication protocol provided by AD (Automation Design) server of CENTUM VP R6.01.10 to R6.09 (no CVSS, Yokogawa Electric CENTUM VP series with VP6E5000(AD Suite E…)
- [CVE-2022-26498](https://cve.now/CVE-2022-26498.md): An issue was discovered in Asterisk through 19.x. (no CVSS)
- [CVE-2022-26499](https://cve.now/CVE-2022-26499.md): An SSRF issue was discovered in Asterisk through 19.x. (no CVSS)
- [CVE-2022-26651](https://cve.now/CVE-2022-26651.md): An issue was discovered in Asterisk through 19.x and Certified Asterisk through 16.8-cert13. (no CVSS)
- [CVE-2022-28041](https://cve.now/CVE-2022-28041.md): stb\_image.h v2.27 was discovered to contain an integer overflow via the function stbi\_\_jpeg\_decode\_block\_prog\_dc. (no CVSS)
- [CVE-2022-28042](https://cve.now/CVE-2022-28042.md): stb\_image.h v2.27 was discovered to contain an heap-based use-after-free via the function stbi\_\_jpeg\_huff\_decode. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-04-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.