CVEs published April 19, 2022
131 CVEs were published on April 19, 2022: 6 critical, 29 high. 1 is now in CISA KEV.
- Published
- 131
- Critical
- 6
- High
- 29
- Medium
- 74
- Low
- 9
- Unrated
- 13
- Now in CISA KEV
- 1
- Fix available
- 26
Most affected products
- Oracle MySQL Server
- 24
- Oracle MySQL Cluster
- 7
- Oracle Java SE JDK and JRE
- 6
- Oracle Solaris Operating System
- 6
- Oracle VM VirtualBox
- 5
- Oracle Business Intelligence Enterprise Edition
- 4
- Oracle Communications Billing and Revenue Management
- 4
- IBM Security Guardium
- 3
- Oracle Database - Enterprise Edition
- 3
- Oracle PeopleSoft Enterprise PT PeopleTools
- 3
Critical 6
- CVE-2022-24826Git LFS can execute a binary from the current directory on Windowsgit-lfs · github.com/git-lfs/git-lfs/v3 +1
- CVE-2022-21445Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: ADF Faces).Oracle Application Development Framework
- CVE-2022-21431Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications Applications (component: ConnectiOracle Communications Billing and Revenue Management
- CVE-2022-21420Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core).Oracle Coherence
- CVE-2022-0992SiteGround Security <= 1.2.5 - Authentication Bypass via 2FA Setupsiteground Security Optimizer – The All-In-One Protection P…
- CVE-2022-27862WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.5.3 - Arbitrary File Upload leading to RCEE4J s.r.l. VikBooking Hotel Booking Engine & PMS
High 29
- CVE-2022-24860Databasir 1.01 has Use of Hard-coded Cryptographic Key vulnerability.vran-dev databasir
- CVE-2022-0071Hotdog Container EscapeAmazon Web Services Hotdog
- CVE-2022-0070Log4j hot patch package privilege escalationAmazon Web Services log4j-cve-2021-44228-hotpatch
- CVE-2021-3101Hotdog Container EscapeAmazon Web Services Hotdog
- CVE-2021-3100Log4j hot patch package privilege escalationAmazon Web Services log4j-cve-2021-44228-hotpatch
- CVE-2022-21497Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Middleware (component: Web Services Security).Oracle Web Services Manager
- CVE-2022-21491Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).Oracle VM VirtualBox
- CVE-2022-21476Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries).Oracle Java SE JDK and JRE
- CVE-2022-21466Vulnerability in the Oracle Commerce Guided Search product of Oracle Commerce (component: Tools and Frameworks).Commerce Guided Search / Oracle Commerce Experience Manager
- CVE-2022-21464Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Business Logic Infra SEC).Oracle JD Edwards EnterpriseOne Tools
- CVE-2022-21449Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries).Oracle Java SE JDK and JRE
- CVE-2022-21446Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility).Oracle Solaris Operating System
- CVE-2022-21442Vulnerability in Oracle GoldenGate (component: OGG Core Library).Oracle GoldenGate
- CVE-2022-21441Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).Oracle WebLogic Server
- CVE-2022-21430Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications Applications (component: ConnectiOracle Communications Billing and Revenue Management
- CVE-2022-21424Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications Applications (component: ConnectiOracle Communications Billing and Revenue Management
- CVE-2022-21422Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications Applications (component: ConnectiOracle Communications Billing and Revenue Management
- CVE-2022-21421Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Web General).Oracle Business Intelligence Enterprise Edition
- CVE-2022-21410Vulnerability in the Oracle Database - Enterprise Edition Sharding component of Oracle Database Server.Oracle Database - Enterprise Edition
- CVE-2022-21404Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Reactive WebServer).Oracle Helidon
- CVE-2021-4096Fancy Product Designer <= 4.7.5 - Cross-Site Request Forgery to Arbitrary File Uploadfancy-product-designer Fancy Product Designer
- CVE-2022-0993SiteGround Security <= 1.2.5 - Authorization Weakness to Authentication Bypasssiteground Security Optimizer – The All-In-One Protection P…
- CVE-2022-1119Simple File List <= 3.2.7 - Arbitrary File Downloadeemitch Simple File List
- CVE-2021-26625tobesoft Nexacro arbitrary file download vulnerabilitytobesoft Co. Nexacro
- CVE-2021-26626tobesoft XPLATFORM Arbitrary file execution Vulnerabilitytobesoft Co. XPLATFORM
- CVE-2021-26627EDrhyme QCP 200W Information Exposure VulnerabilityEDrhyme Co. QCP
- CVE-2022-25648Command Injectiongit
- CVE-2022-1065Multi Factor Authentication Bypass in various versions of Abacus ERPAbacus Research AG Abacus ERP
- CVE-2022-1329Elementor Website Builder 3.6.0 - 3.6.2 - Missing Authorization to Remote Code Executionelemntor Elementor Website Builder
Medium, low and unrated 96
- CVE-2022-24858Default redirect callback vulnerable to open redirectsnextauthjs next-auth · next-auth
- CVE-2022-21498Vulnerability in the Java VM component of Oracle Database Server.Oracle Database - Enterprise Edition
- CVE-2022-21496Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JNDI).Oracle Java SE JDK and JRE
- CVE-2022-21494Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel).Oracle Solaris Operating System
- CVE-2022-21493Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel).Oracle Solaris Operating System
- CVE-2022-21492Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Server).Oracle Business Intelligence Enterprise Edition
- CVE-2022-21490Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General).Oracle MySQL Cluster
- CVE-2022-21489Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General).Oracle MySQL Cluster
- CVE-2022-21488Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).Oracle VM VirtualBox
- CVE-2022-21487Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).Oracle VM VirtualBox
- CVE-2022-21486Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General).Oracle MySQL Cluster
- CVE-2022-21485Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General).Oracle MySQL Cluster
- CVE-2022-21484Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General).Oracle MySQL Cluster
- CVE-2022-21483Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General).Oracle MySQL Cluster
- CVE-2022-21482Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General).Oracle MySQL Cluster
- CVE-2022-21481Vulnerability in the PeopleSoft Enterprise FIN Cash Management product of Oracle PeopleSoft (component: Financial Gateway).Oracle PeopleSoft Enterprise FIN Cash Management
- CVE-2022-21480Vulnerability in the Oracle Transportation Management product of Oracle Supply Chain (component: User Interface).Oracle Transportation Management
- CVE-2022-1019Automated Logic WebCtrl Server Open Redirection VulnerabilityAutomated Logic WebCtrl Server
- CVE-2022-21479Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).Oracle MySQL Server
- CVE-2022-21478Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).Oracle MySQL Server
- CVE-2022-21477Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Attachments, File Upload).Oracle Applications Framework
- CVE-2022-21475Vulnerability in the Oracle Banking Payments product of Oracle Financial Services Applications (component: Infrastructure).Oracle Banking Payments
- CVE-2022-21474Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications (component: Infrastructure).Oracle Banking Trade Finance
- CVE-2022-21473Vulnerability in the Oracle Banking Treasury Management product of Oracle Financial Services Applications (component: Infrastructure).Oracle Banking Treasury Management
- CVE-2022-21472Vulnerability in the Oracle FLEXCUBE Universal Banking product of Oracle Financial Services Applications (component: Infrastructure).Oracle FLEXCUBE Universal Banking
- CVE-2022-21471Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).Oracle VM VirtualBox
- CVE-2022-21470Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Process Scheduler).Oracle PeopleSoft Enterprise PT PeopleTools
- CVE-2022-21469Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: UI Framework).Oracle Enterprise Manager Base Platform
- CVE-2022-21468Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Popups).Oracle Applications Framework
- CVE-2022-21467Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Attachments).Oracle Agile PLM Framework
- CVE-2022-21465Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).Oracle VM VirtualBox
- CVE-2022-21463Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel).Oracle Solaris Operating System
- CVE-2022-21462Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).Oracle MySQL Server
- CVE-2022-21461Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel).Oracle Solaris Operating System
- CVE-2022-21460Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Logging).Oracle MySQL Server
- CVE-2022-21459Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).Oracle MySQL Server
- CVE-2022-21458Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Navigation Pages, Portal, Query).Oracle PeopleSoft Enterprise PT PeopleTools
- CVE-2022-21457Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: PAM Auth Plugin).Oracle MySQL Server
- CVE-2022-21456Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Navigation Pages, Portal, Query).Oracle PeopleSoft Enterprise PT PeopleTools
- CVE-2022-21454Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Group Replication Plugin).Oracle MySQL Server
- CVE-2022-21453Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console).Oracle WebLogic Server
- CVE-2022-21452Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).Oracle MySQL Server
- CVE-2022-21451Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).Oracle MySQL Server
- CVE-2022-21450Vulnerability in the PeopleSoft Enterprise PRTL Interaction Hub product of Oracle PeopleSoft (component: My Links).Oracle PeopleSoft Enterprise PRTL Interaction Hub
- CVE-2022-21448Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Visual Analyzer).Oracle Business Intelligence Enterprise Edition
- CVE-2022-21447Vulnerability in the PeopleSoft Enterprise CS Academic Advisement product of Oracle PeopleSoft (component: Advising Notes).Oracle PeopleSoft Enterprise CS Academic Advisement
- CVE-2022-21444Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL).Oracle MySQL Server
- CVE-2022-21443Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries).Oracle Java SE JDK and JRE
- CVE-2022-21440Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).Oracle MySQL Server
- CVE-2022-21438Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).Oracle MySQL Server
- CVE-2022-21437Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).Oracle MySQL Server
- CVE-2022-21436Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).Oracle MySQL Server
- CVE-2022-21435Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).Oracle MySQL Server
- CVE-2022-21434Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries).Oracle Java SE JDK and JRE
- CVE-2022-21427Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS).Oracle MySQL Server
- CVE-2022-21426Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP).Oracle Java SE JDK and JRE
- CVE-2022-21425Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL).Oracle MySQL Server
- CVE-2022-21423Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).Oracle MySQL Server
- CVE-2022-21419Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Visual Analyzer).Oracle Business Intelligence Enterprise Edition
- CVE-2022-21418Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).Oracle MySQL Server
- CVE-2022-21417Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).Oracle MySQL Server
- CVE-2022-21416Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility).Oracle Solaris Operating System
- CVE-2022-21415Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication).Oracle MySQL Server
- CVE-2022-21414Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).Oracle MySQL Server
- CVE-2022-21413Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML).Oracle MySQL Server
- CVE-2022-21412Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).Oracle MySQL Server
- CVE-2022-21411Vulnerability in the RDBMS Gateway / Generic ODBC Connectivity component of Oracle Database Server.Oracle Database - Enterprise Edition
- CVE-2022-21409Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime).Oracle JD Edwards EnterpriseOne Tools
- CVE-2022-21405Vulnerability in the OSS Support Tools product of Oracle Support Tools (component: Oracle Explorer).Oracle OSS Support Tools
- CVE-2021-23283Security issues in Eaton Intelligent Power Protector (IPP)Eaton Intelligent Power Protector
- CVE-2022-28222CleanTalk AntiSpam <= 5.173 Reflected XSSCleanTalk AntiSpam
- CVE-2022-1186Be POPIA Compliant <= 1.1.5 - Sensitive Information Exposurebepopiacompliant Be POPIA Compliant
- CVE-2022-1187WP YouTube Live <= 1.7.21 - Reflected Cross-Site Scriptingmacbookandrew WP YouTube Live
- CVE-2022-28221CleanTalk AntiSpam <= 5.173 Reflected XSSCleanTalk AntiSpam
- CVE-2022-27527A Memory Corruption vulnerability may lead to code execution through maliciously crafted DLL files.Navisworks
- CVE-2022-25788A maliciously crafted JT file in Autodesk AutoCAD 2022 may be used to write beyond the allocated buffer while parsing JT files.Autodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, Aut…
- CVE-2022-1384Authorized users are allowed to install old plugin versions from the MarketplaceMattermost · github.com/mattermost/mattermost-server/v6 +2
- CVE-2022-1385Invitation Email is resent as a Reminder after invalidating pending email invitesMattermost · github.com/mattermost/mattermost-server/v6 +2
- CVE-2022-27863WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.5.3 - Sensitive Data Exposure vulnerabilityE4J s.r.l. VikBooking Hotel Booking Engine & PMS
- CVE-2022-24825Smokescreen SSRF via deny list bypassstripe smokescreen · github.com/stripe/smokescreen
- CVE-2022-27104An Unauthenticated time-based blind SQL injection vulnerability exists in Forma LMS prior to v.1.4.3.
- CVE-2022-27055ecjia-daojia 1.38.1-20210202629 is vulnerable to information leakage via content/apps/installer/classes/Helper.php.
- CVE-2021-39078IBM Security Guardium 10.5 stores user credentials in plain clear text which can be read by a local privileged user.IBM Security Guardium
- CVE-2021-39076IBM Security Guardium 10.5 and 11.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt sensitive infIBM Security Guardium
- CVE-2021-39072IBM Security Guardium 11.3 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP StriIBM Security Guardium
- CVE-2021-39033IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.5 and 6.1.0.0 through 6.1.1.0 could allow a remote attacker to obtain senIBM Sterling B2B Integrator
- CVE-2021-44519In Citrix XenMobile Server through 10.12 RP9, there is an Authenticated Directory Traversal vulnerability, leading to remote code execution.
- CVE-2022-29315Invicti Acunetix before 14 allows CSV injection via the Description field on the Add Targets page, if the Export CSV feature is used.
- CVE-2022-26595Liferay Portal 7.3.7, 7.4.0, and 7.4.1, and Liferay DXP 7.2 fix pack 13, and 7.3 fix pack 2 does not properly check user permission when acccom.liferay.portal:release.portal.bom · com.liferay.port… +2
- CVE-2022-26593Cross-site scripting (XSS) vulnerability in the Asset module's asset categories selector in Liferay Portal 7.3.3 through 7.4.0, and Liferay com.liferay:com.liferay.asset.taglib · com.liferay.portal:r…
- CVE-2021-41570Veritas NetBackup OpsCenter Analytics 9.1 allows XSS via the NetBackup Master Server Name, Display Name, NetBackup User Name, or NetBackup P
- CVE-2022-27927A SQL injection vulnerability exists in Microfinance Management System 1.0 when MySQL is being used as the application database.
- CVE-2021-43129A bypass exists for Desire2Learn/D2L Brightspace’s “Disable Right Click” option in the quizzing feature, which allows a quiz-taker to access
- CVE-2022-0645Open redirect vulnerability via endpoint authorize_and_redirect/?redirect= in posthog/posthogposthog/posthog
- CVE-2022-28108Selenium Server (Grid) before 4 allows CSRF because it permits non-JSON content types such as application/x-www-form-urlencoded, multipart/fselenium · org.seleniumhq.selenium:selenium-grid +1
- CVE-2022-29153HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11.4 may allow server side request forgery when the Consul client agent fgithub.com/hashicorp/consul