# CVEs published 2022-04-18

98 CVEs were published on April 18, 2022: 39 critical, 6 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2022-24841](https://cve.now/CVE-2022-24841.md): Improper Authorization in github.com/fleetdm/fleet (CVSS 6.5, fleetdm fleet)
- [CVE-2022-29457](https://cve.now/CVE-2022-29457.md): Zoho ManageEngine ADSelfService Plus before 6121, ADAuditPlus 7060, Exchange Reporter Plus 5701, and ADManagerPlus 7131 allow NTLM Hash disc (no CVSS)
- [CVE-2022-24863](https://cve.now/CVE-2022-24863.md): Denial of service in http-swagger (CVSS 7.5, swaggo http-swagger · github.com/swaggo/http-swagger)
- [CVE-2022-1112](https://cve.now/CVE-2022-1112.md): Autolinks \<= 1.0.1 - Stored Cross-Site Scripting via CSRF (no CVSS, Autolinks)
- [CVE-2022-1091](https://cve.now/CVE-2022-1091.md): Safe SVG \< 1.9.10 - SVG Sanitisation Bypass (no CVSS, Safe SVG · darylldoyle/safe-svg)
- [CVE-2022-1090](https://cve.now/CVE-2022-1090.md): Good & Bad Comments \<= 1.0.0 - Admin+ Stored Cross-Site Scripting (no CVSS, Good & Bad comments)
- [CVE-2022-1088](https://cve.now/CVE-2022-1088.md): Page Security & Membership \<= 1.5.15 - Admin+ Stored Cross-Site Scripting (no CVSS, Page Security & Membership)
- [CVE-2022-1063](https://cve.now/CVE-2022-1063.md): Thank Me Later \<= 3.3.4 - Admin+ Stored Cross-Site Scripting (no CVSS, Thank Me Later)
- [CVE-2022-1054](https://cve.now/CVE-2022-1054.md): RSVP and Event Management \< 2.7.8 - Unauthenticated Entries Export (no CVSS, RSVP and Event Management Plugin)
- [CVE-2022-1037](https://cve.now/CVE-2022-1037.md): EXMAGE \< 1.0.7 - Admin+ Blind SSRF (no CVSS, EXMAGE – WordPress Image Links)
- [CVE-2022-1020](https://cve.now/CVE-2022-1020.md): Woo Product Table \< 3.1.2 - Unauthenticated Arbitrary Function Call (no CVSS, Product Table for WooCommerce)
- [CVE-2022-1001](https://cve.now/CVE-2022-1001.md): WP Downgrade \< 1.2.3 - Admin+ Stored Cross-Site Scripting (no CVSS, WP Downgrade | Specific Core Version)
- [CVE-2022-0994](https://cve.now/CVE-2022-0994.md): Hummingbird \< 3.3.2 - Admin+ Stored Cross-Site Scripting (no CVSS, Hummingbird – Optimize Speed, Enable Cache, Minify CSS & De…)
- [CVE-2022-0879](https://cve.now/CVE-2022-0879.md): Caldera Forms \< 1.9.7 - Reflected Cross-Site Scripting (no CVSS, Caldera Forms – More Than Contact Forms)
- [CVE-2022-0785](https://cve.now/CVE-2022-0785.md): Daily Prayer Time \< 2022.03.01 - Unauthenticated SQLi (no CVSS, Daily Prayer Time)
- [CVE-2022-0780](https://cve.now/CVE-2022-0780.md): SearchIQ \< 3.9 - Unauthenticated Stored XSS (no CVSS, SearchIQ – The Search Solution)
- [CVE-2022-0765](https://cve.now/CVE-2022-0765.md): Loco Translate \< 2.6.1 - Authenticated Stored Cross-Site Scripting (no CVSS, Loco Translate)
- [CVE-2022-0737](https://cve.now/CVE-2022-0737.md): Text Hover \< 4.2 - Admin+ Stored Cross-Site Scripting (no CVSS, Text Hover)
- [CVE-2022-0707](https://cve.now/CVE-2022-0707.md): Easy Digital Downloads \< 2.11.6 - Arbitrary Payment Note Insertion via CSRF (no CVSS, Easy Digital Downloads – Simple eCommerce for Selling Digit…)
- [CVE-2022-0706](https://cve.now/CVE-2022-0706.md): Easy Digital Downloads \< 2.11.6 - Admin+ Stored Cross-Site Scripting (no CVSS, Easy Digital Downloads – Simple eCommerce for Selling Digit…)
- [CVE-2022-0661](https://cve.now/CVE-2022-0661.md): Ad Injection \<= 1.2.0.19 - Admin+ Stored Cross-Site Scripting & RCE (no CVSS, Ad Injection)
- [CVE-2021-25120](https://cve.now/CVE-2021-25120.md): Easy Social Feed \< 6.2.7 - Reflected Cross-Site Scripting (no CVSS, Easy Social Feed Pro · Easy Social Feed – Social Photos Gal…)
- [CVE-2020-35632](https://cve.now/CVE-2020-35632.md): Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. (CVSS 10.0, CGAL Project libcgal)
- [CVE-2020-35631](https://cve.now/CVE-2020-35631.md): Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. (CVSS 10.0, CGAL Project libcgal)
- [CVE-2020-35630](https://cve.now/CVE-2020-35630.md): Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. (CVSS 10.0, CGAL Project libcgal)
- [CVE-2020-35629](https://cve.now/CVE-2020-35629.md): Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. (CVSS 10.0, CGAL Project libcgal)
- [CVE-2020-28635](https://cve.now/CVE-2020-28635.md): Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. (CVSS 10.0, CGAL Project libcgal)
- [CVE-2020-28634](https://cve.now/CVE-2020-28634.md): Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. (CVSS 10.0, CGAL Project libcgal)
- [CVE-2020-28633](https://cve.now/CVE-2020-28633.md): Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. (CVSS 10.0, CGAL Project libcgal)
- [CVE-2020-28632](https://cve.now/CVE-2020-28632.md): Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. (CVSS 10.0, CGAL Project libcgal)
- [CVE-2020-28631](https://cve.now/CVE-2020-28631.md): Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. (CVSS 10.0, CGAL Project libcgal)
- [CVE-2020-28630](https://cve.now/CVE-2020-28630.md): Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. (CVSS 10.0, CGAL Project libcgal)
- [CVE-2020-28629](https://cve.now/CVE-2020-28629.md): Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. (CVSS 10.0, CGAL Project libcgal)
- [CVE-2020-28628](https://cve.now/CVE-2020-28628.md): Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. (CVSS 10.0, CGAL Project libcgal)
- [CVE-2020-28627](https://cve.now/CVE-2020-28627.md): Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. (CVSS 10.0, CGAL Project libcgal)
- [CVE-2020-28626](https://cve.now/CVE-2020-28626.md): Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. (CVSS 10.0, CGAL Project libcgal)
- [CVE-2020-28625](https://cve.now/CVE-2020-28625.md): Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. (CVSS 10.0, CGAL Project libcgal)
- [CVE-2020-28624](https://cve.now/CVE-2020-28624.md): Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. (CVSS 10.0, CGAL Project libcgal)
- [CVE-2020-28623](https://cve.now/CVE-2020-28623.md): Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. (CVSS 10.0, CGAL Project libcgal)
- [CVE-2020-28622](https://cve.now/CVE-2020-28622.md): Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. (CVSS 10.0, CGAL Project libcgal)
- [CVE-2020-28621](https://cve.now/CVE-2020-28621.md): Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. (CVSS 10.0, CGAL Project libcgal)
- [CVE-2020-28620](https://cve.now/CVE-2020-28620.md): Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. (CVSS 10.0, CGAL Project libcgal)
- [CVE-2020-28619](https://cve.now/CVE-2020-28619.md): Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. (CVSS 10.0, CGAL Project libcgal)
- [CVE-2020-28618](https://cve.now/CVE-2020-28618.md): Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. (CVSS 10.0, CGAL Project libcgal)
- [CVE-2020-28617](https://cve.now/CVE-2020-28617.md): Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. (CVSS 10.0, CGAL Project libcgal)
- [CVE-2020-28616](https://cve.now/CVE-2020-28616.md): Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. (CVSS 10.0, CGAL Project libcgal)
- [CVE-2020-28615](https://cve.now/CVE-2020-28615.md): Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. (CVSS 10.0, CGAL Project libcgal)
- [CVE-2020-28614](https://cve.now/CVE-2020-28614.md): Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. (CVSS 10.0, CGAL Project libcgal)
- [CVE-2020-28613](https://cve.now/CVE-2020-28613.md): Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. (CVSS 10.0, CGAL Project libcgal)
- [CVE-2020-28612](https://cve.now/CVE-2020-28612.md): Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. (CVSS 10.0, CGAL Project libcgal)
- [CVE-2020-28611](https://cve.now/CVE-2020-28611.md): Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. (CVSS 10.0, CGAL Project libcgal)
- [CVE-2020-28610](https://cve.now/CVE-2020-28610.md): Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. (CVSS 10.0, CGAL Project libcgal)
- [CVE-2020-28609](https://cve.now/CVE-2020-28609.md): Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. (CVSS 10.0, CGAL Project libcgal)
- [CVE-2020-28608](https://cve.now/CVE-2020-28608.md): Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. (CVSS 10.0, CGAL Project libcgal)
- [CVE-2020-28607](https://cve.now/CVE-2020-28607.md): Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. (CVSS 10.0, CGAL Project libcgal)
- [CVE-2020-28606](https://cve.now/CVE-2020-28606.md): Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. (CVSS 10.0, CGAL Project libcgal)
- [CVE-2020-28605](https://cve.now/CVE-2020-28605.md): Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. (CVSS 10.0, CGAL Project libcgal)
- [CVE-2020-28604](https://cve.now/CVE-2020-28604.md): Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. (CVSS 10.0, CGAL Project libcgal)
- [CVE-2020-28603](https://cve.now/CVE-2020-28603.md): Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. (CVSS 10.0, CGAL Project libcgal)
- [CVE-2020-28602](https://cve.now/CVE-2020-28602.md): Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. (CVSS 10.0, CGAL Project libcgal)
- [CVE-2020-25167](https://cve.now/CVE-2020-25167.md): OSIsoft PI Vision Incorrect Authorization (CVSS 4.9, OSIsoft PI Vision)
- [CVE-2020-25163](https://cve.now/CVE-2020-25163.md): OSIsoft PI Vision Cross-site Scripting (CVSS 7.7, OSIsoft PI Vision)
- [CVE-2022-25226](https://cve.now/CVE-2022-25226.md): ThinVNC version 1.0b1 allows an unauthenticated user to bypass the authentication process via 'http://thin-vnc:8080/cmd?cmd=connect' by obta (no CVSS, ThinVNC)
- [CVE-2011-4917](https://cve.now/CVE-2011-4917.md): In the Linux kernel through 3.1 there is an information disclosure issue via /proc/stat. (no CVSS, Linux kernel)
- [CVE-2021-42778](https://cve.now/CVE-2021-42778.md): A heap double free issue was found in Opensc before version 0.22.0 in sc\_pkcs15\_free\_tokeninfo. (no CVSS, opensc)
- [CVE-2011-1762](https://cve.now/CVE-2011-1762.md): A flaw exists in Wordpress related to the 'wp-admin/press-this.php 'script improperly checking user permissions when publishing posts. (no CVSS, wordpress)
- [CVE-2021-3503](https://cve.now/CVE-2021-3503.md): A flaw was found in Wildfly where insufficient RBAC restrictions may lead to expose metrics data. (no CVSS, wildfly · org.wildfly:wildfly-metrics)
- [CVE-2021-3681](https://cve.now/CVE-2021-3681.md): A flaw was found in Ansible Galaxy Collections. (no CVSS, ansible)
- [CVE-2021-3624](https://cve.now/CVE-2021-3624.md): There is an integer overflow vulnerability in dcraw. (no CVSS, dcraw)
- [CVE-2022-27853](https://cve.now/CVE-2022-27853.md): WordPress Contest Gallery plugin \<= 13.1.0.9 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (CVSS 4.8, Contest Gallery)
- [CVE-2022-1341](https://cve.now/CVE-2022-1341.md): An issue was discovered in in bwm-ng v0.6.2. (no CVSS, bwm-ng)
- [CVE-2021-23286](https://cve.now/CVE-2021-23286.md): Security issues in Eaton Intelligent Power Manager Infrastructure (CVSS 5.7, Eaton Intelligent Power Manager Infrastructure)
- [CVE-2021-23284](https://cve.now/CVE-2021-23284.md): Security issues in Eaton Intelligent Power Manager Infrastructure (CVSS 5.7, Eaton Intelligent Power Manager Infrastructure)
- [CVE-2021-23285](https://cve.now/CVE-2021-23285.md): Security issues in Eaton Intelligent Power Manager Infrastructure (CVSS 3.1, Eaton Intelligent Power Manager Infrastructure)
- [CVE-2022-23975](https://cve.now/CVE-2022-23975.md): WordPress Access Demo Importer plugin \<= 1.0.7 - Cross-Site Request Forgery (CSRF) vulnerability leading to Arbitrary Plugin Activation (CVSS 6.5, AccessPress Themes Access Demo Importer)
- [CVE-2022-23976](https://cve.now/CVE-2022-23976.md): WordPress Access Demo Importer plugin \<= 1.0.7 - Cross-Site Request Forgery (CSRF) vulnerability leading to Data Reset (Posts / Pages / Media) (CVSS 8.1, AccessPress Themes Access Demo Importer)
- [CVE-2022-27652](https://cve.now/CVE-2022-27652.md): A flaw was found in cri-o, where containers were incorrectly started with non-empty default permissions. (no CVSS, cri-o · github.com/cri-o/cri-o)
- [CVE-2022-27530](https://cve.now/CVE-2022-27530.md): A maliciously crafted TIF or PICT file in Autodesk AutoCAD 2022, 2021, 2020, 2019 can be used to write beyond the allocated buffer through B (no CVSS, Autodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, Aut…)
- [CVE-2022-27529](https://cve.now/CVE-2022-27529.md): A maliciously crafted PICT, BMP, PSD or TIF file in Autodesk AutoCAD 2022, 2021, 2020, 2019 may be used to write beyond the allocated buffer (no CVSS, Autodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, Aut…)
- [CVE-2022-27526](https://cve.now/CVE-2022-27526.md): A malicious crafted TGA file when consumed through DesignReview.exe application could lead to memory corruption vulnerability. (no CVSS, Autodesk Design Review)
- [CVE-2022-27525](https://cve.now/CVE-2022-27525.md): A malicious crafted .dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by wr (no CVSS, Autodesk® Design Review)
- [CVE-2020-6099](https://cve.now/CVE-2020-6099.md): An exploitable code execution vulnerability exists in the file format parsing functionality of Graphisoft BIMx Desktop Viewer 2019.2.2328. (CVSS 8.8, Graphisoft BIMx Desktop Viewer)
- [CVE-2020-13590](https://cve.now/CVE-2020-13590.md): Multiple exploitable SQL injection vulnerabilities exist in the 'entities/fields' page of the Rukovoditel Project Management App 2.7.2. (CVSS 5.4, Rukovoditel Project Management App)
- [CVE-2020-13567](https://cve.now/CVE-2020-13567.md): Multiple SQL injection vulnerabilities exist in phpGACL 3.3.7. (CVSS 8.8, OpenEMR · phpGACL)
- [CVE-2020-13495](https://cve.now/CVE-2020-13495.md): An exploitable vulnerability exists in the way Pixar OpenUSD 20.05 handles file offsets in binary USD files. (CVSS 4.3, Apple macOS · Pixar OpenUSD)
- [CVE-2021-46122](https://cve.now/CVE-2021-46122.md): Tp-Link TL-WR840N (EU) v6.20 Firmware (0.9.1 4.17 v0001.0 Build 201124 Rel.64328n) is vulnerable to Buffer Overflow via the Password reset f (no CVSS)
- [CVE-2022-26665](https://cve.now/CVE-2022-26665.md): An Insecure Direct Object Reference issue exists in the Tyler Odyssey Portal platform before 17.1.20. (no CVSS)
- [CVE-2022-26631](https://cve.now/CVE-2022-26631.md): Automatic Question Paper Generator v1.0 contains a Time-Based Blind SQL injection vulnerability via the id GET parameter. (no CVSS)
- [CVE-2022-28810](https://cve.now/CVE-2022-28810.md): Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary operating OS command (CVSS 6.8, KEV)
- [CVE-2022-27908](https://cve.now/CVE-2022-27908.md): Zoho ManageEngine OpManager before 125588 (and before 125603) is vulnerable to authenticated SQL Injection in the Inventory Reports module. (no CVSS)
- [CVE-2021-3652](https://cve.now/CVE-2021-3652.md): A flaw was found in 389-ds-base. (no CVSS, 389-ds-base)
- [CVE-2021-42779](https://cve.now/CVE-2021-42779.md): A heap use after free issue was found in Opensc before version 0.22.0 in sc\_file\_valid. (no CVSS, opensc)
- [CVE-2021-42780](https://cve.now/CVE-2021-42780.md): A use after return issue was found in Opensc before version 0.22.0 in insert\_pin function that could potentially crash programs using the li (no CVSS, opensc)
- [CVE-2021-42781](https://cve.now/CVE-2021-42781.md): Heap buffer overflow issues were found in Opensc before version 0.22.0 in pkcs15-oberthur.c that could potentially crash programs using the (no CVSS, opensc)
- [CVE-2021-42782](https://cve.now/CVE-2021-42782.md): Stack buffer overflow issues were found in Opensc before version 0.22.0 in various places that could potentially crash programs using the li (no CVSS, opensc)
- [CVE-2022-24859](https://cve.now/CVE-2022-24859.md): Manipulated inline images can cause Infinite Loop in PyPDF2 (CVSS 6.2, py-pdf PyPDF2 · pypdf2)
- [CVE-2022-29458](https://cve.now/CVE-2022-29458.md): ncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert\_strings in tinfo/read\_entry.c in the termi (CVSS 7.1)
- [CVE-2022-29464](https://cve.now/CVE-2022-29464.md): Certain WSO2 products allow unrestricted file upload with resultant remote code execution. (CVSS 9.8, KEV)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-04-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.