# CVEs published 2022-04-19

131 CVEs were published on April 19, 2022: 6 critical, 29 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2022-24826](https://cve.now/CVE-2022-24826.md): Git LFS can execute a binary from the current directory on Windows (CVSS 9.8, git-lfs · github.com/git-lfs/git-lfs/v3 +1)
- [CVE-2022-24860](https://cve.now/CVE-2022-24860.md): Databasir 1.01 has Use of Hard-coded Cryptographic Key vulnerability. (CVSS 7.4, vran-dev databasir)
- [CVE-2022-24858](https://cve.now/CVE-2022-24858.md): Default redirect callback vulnerable to open redirects (CVSS 6.1, nextauthjs next-auth · next-auth)
- [CVE-2022-0071](https://cve.now/CVE-2022-0071.md): Hotdog Container Escape (CVSS 8.8, Amazon Web Services Hotdog)
- [CVE-2022-0070](https://cve.now/CVE-2022-0070.md): Log4j hot patch package privilege escalation (CVSS 8.8, Amazon Web Services log4j-cve-2021-44228-hotpatch)
- [CVE-2021-3101](https://cve.now/CVE-2021-3101.md): Hotdog Container Escape (CVSS 8.8, Amazon Web Services Hotdog)
- [CVE-2021-3100](https://cve.now/CVE-2021-3100.md): Log4j hot patch package privilege escalation (CVSS 8.8, Amazon Web Services log4j-cve-2021-44228-hotpatch)
- [CVE-2022-21498](https://cve.now/CVE-2022-21498.md): Vulnerability in the Java VM component of Oracle Database Server. (CVSS 6.5, Oracle Database - Enterprise Edition)
- [CVE-2022-21497](https://cve.now/CVE-2022-21497.md): Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Middleware (component: Web Services Security). (CVSS 8.1, Oracle Web Services Manager)
- [CVE-2022-21496](https://cve.now/CVE-2022-21496.md): Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JNDI). (CVSS 5.3, Oracle Java SE JDK and JRE)
- [CVE-2022-21494](https://cve.now/CVE-2022-21494.md): Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). (CVSS 4.0, Oracle Solaris Operating System)
- [CVE-2022-21493](https://cve.now/CVE-2022-21493.md): Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). (CVSS 5.9, Oracle Solaris Operating System)
- [CVE-2022-21492](https://cve.now/CVE-2022-21492.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Server). (CVSS 6.1, Oracle Business Intelligence Enterprise Edition)
- [CVE-2022-21491](https://cve.now/CVE-2022-21491.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 7.8, Oracle VM VirtualBox)
- [CVE-2022-21490](https://cve.now/CVE-2022-21490.md): Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). (CVSS 6.3, Oracle MySQL Cluster)
- [CVE-2022-21489](https://cve.now/CVE-2022-21489.md): Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). (CVSS 6.3, Oracle MySQL Cluster)
- [CVE-2022-21488](https://cve.now/CVE-2022-21488.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 3.8, Oracle VM VirtualBox)
- [CVE-2022-21487](https://cve.now/CVE-2022-21487.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 3.8, Oracle VM VirtualBox)
- [CVE-2022-21486](https://cve.now/CVE-2022-21486.md): Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). (CVSS 2.9, Oracle MySQL Cluster)
- [CVE-2022-21485](https://cve.now/CVE-2022-21485.md): Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). (CVSS 2.9, Oracle MySQL Cluster)
- [CVE-2022-21484](https://cve.now/CVE-2022-21484.md): Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). (CVSS 2.9, Oracle MySQL Cluster)
- [CVE-2022-21483](https://cve.now/CVE-2022-21483.md): Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). (CVSS 6.3, Oracle MySQL Cluster)
- [CVE-2022-21482](https://cve.now/CVE-2022-21482.md): Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). (CVSS 6.3, Oracle MySQL Cluster)
- [CVE-2022-21481](https://cve.now/CVE-2022-21481.md): Vulnerability in the PeopleSoft Enterprise FIN Cash Management product of Oracle PeopleSoft (component: Financial Gateway). (CVSS 5.4, Oracle PeopleSoft Enterprise FIN Cash Management)
- [CVE-2022-21480](https://cve.now/CVE-2022-21480.md): Vulnerability in the Oracle Transportation Management product of Oracle Supply Chain (component: User Interface). (CVSS 6.1, Oracle Transportation Management)
- [CVE-2022-1019](https://cve.now/CVE-2022-1019.md): Automated Logic WebCtrl Server Open Redirection Vulnerability (CVSS 5.2, Automated Logic WebCtrl Server)
- [CVE-2022-21479](https://cve.now/CVE-2022-21479.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 5.5, Oracle MySQL Server)
- [CVE-2022-21478](https://cve.now/CVE-2022-21478.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 5.5, Oracle MySQL Server)
- [CVE-2022-21477](https://cve.now/CVE-2022-21477.md): Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Attachments, File Upload). (CVSS 5.4, Oracle Applications Framework)
- [CVE-2022-21476](https://cve.now/CVE-2022-21476.md): Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). (CVSS 7.5, Oracle Java SE JDK and JRE)
- [CVE-2022-21475](https://cve.now/CVE-2022-21475.md): Vulnerability in the Oracle Banking Payments product of Oracle Financial Services Applications (component: Infrastructure). (CVSS 5.9, Oracle Banking Payments)
- [CVE-2022-21474](https://cve.now/CVE-2022-21474.md): Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications (component: Infrastructure). (CVSS 5.9, Oracle Banking Trade Finance)
- [CVE-2022-21473](https://cve.now/CVE-2022-21473.md): Vulnerability in the Oracle Banking Treasury Management product of Oracle Financial Services Applications (component: Infrastructure). (CVSS 5.9, Oracle Banking Treasury Management)
- [CVE-2022-21472](https://cve.now/CVE-2022-21472.md): Vulnerability in the Oracle FLEXCUBE Universal Banking product of Oracle Financial Services Applications (component: Infrastructure). (CVSS 5.9, Oracle FLEXCUBE Universal Banking)
- [CVE-2022-21471](https://cve.now/CVE-2022-21471.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 6.5, Oracle VM VirtualBox)
- [CVE-2022-21470](https://cve.now/CVE-2022-21470.md): Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Process Scheduler). (CVSS 6.1, Oracle PeopleSoft Enterprise PT PeopleTools)
- [CVE-2022-21469](https://cve.now/CVE-2022-21469.md): Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: UI Framework). (CVSS 4.7, Oracle Enterprise Manager Base Platform)
- [CVE-2022-21468](https://cve.now/CVE-2022-21468.md): Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Popups). (CVSS 6.1, Oracle Applications Framework)
- [CVE-2022-21467](https://cve.now/CVE-2022-21467.md): Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Attachments). (CVSS 6.5, Oracle Agile PLM Framework)
- [CVE-2022-21466](https://cve.now/CVE-2022-21466.md): Vulnerability in the Oracle Commerce Guided Search product of Oracle Commerce (component: Tools and Frameworks). (CVSS 7.5, Commerce Guided Search / Oracle Commerce Experience Manager)
- [CVE-2022-21465](https://cve.now/CVE-2022-21465.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 6.7, Oracle VM VirtualBox)
- [CVE-2022-21464](https://cve.now/CVE-2022-21464.md): Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Business Logic Infra SEC). (CVSS 8.2, Oracle JD Edwards EnterpriseOne Tools)
- [CVE-2022-21463](https://cve.now/CVE-2022-21463.md): Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). (CVSS 5.5, Oracle Solaris Operating System)
- [CVE-2022-21462](https://cve.now/CVE-2022-21462.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2022-21461](https://cve.now/CVE-2022-21461.md): Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). (CVSS 5.5, Oracle Solaris Operating System)
- [CVE-2022-21460](https://cve.now/CVE-2022-21460.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Logging). (CVSS 4.4, Oracle MySQL Server)
- [CVE-2022-21459](https://cve.now/CVE-2022-21459.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 5.5, Oracle MySQL Server)
- [CVE-2022-21458](https://cve.now/CVE-2022-21458.md): Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Navigation Pages, Portal, Query). (CVSS 6.1, Oracle PeopleSoft Enterprise PT PeopleTools)
- [CVE-2022-21457](https://cve.now/CVE-2022-21457.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: PAM Auth Plugin). (CVSS 5.9, Oracle MySQL Server)
- [CVE-2022-21456](https://cve.now/CVE-2022-21456.md): Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Navigation Pages, Portal, Query). (CVSS 6.1, Oracle PeopleSoft Enterprise PT PeopleTools)
- [CVE-2022-21454](https://cve.now/CVE-2022-21454.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Group Replication Plugin). (CVSS 6.5, Oracle MySQL Server)
- [CVE-2022-21453](https://cve.now/CVE-2022-21453.md): Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). (CVSS 6.1, Oracle WebLogic Server)
- [CVE-2022-21452](https://cve.now/CVE-2022-21452.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2022-21451](https://cve.now/CVE-2022-21451.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). (CVSS 4.4, Oracle MySQL Server)
- [CVE-2022-21450](https://cve.now/CVE-2022-21450.md): Vulnerability in the PeopleSoft Enterprise PRTL Interaction Hub product of Oracle PeopleSoft (component: My Links). (CVSS 5.4, Oracle PeopleSoft Enterprise PRTL Interaction Hub)
- [CVE-2022-21449](https://cve.now/CVE-2022-21449.md): Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). (CVSS 7.5, Oracle Java SE JDK and JRE)
- [CVE-2022-21448](https://cve.now/CVE-2022-21448.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Visual Analyzer). (CVSS 6.1, Oracle Business Intelligence Enterprise Edition)
- [CVE-2022-21447](https://cve.now/CVE-2022-21447.md): Vulnerability in the PeopleSoft Enterprise CS Academic Advisement product of Oracle PeopleSoft (component: Advising Notes). (CVSS 6.5, Oracle PeopleSoft Enterprise CS Academic Advisement)
- [CVE-2022-21446](https://cve.now/CVE-2022-21446.md): Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility). (CVSS 8.2, Oracle Solaris Operating System)
- [CVE-2022-21445](https://cve.now/CVE-2022-21445.md): Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: ADF Faces). (CVSS 9.8, KEV, Oracle Application Development Framework)
- [CVE-2022-21444](https://cve.now/CVE-2022-21444.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). (CVSS 4.4, Oracle MySQL Server)
- [CVE-2022-21443](https://cve.now/CVE-2022-21443.md): Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). (CVSS 3.7, Oracle Java SE JDK and JRE)
- [CVE-2022-21442](https://cve.now/CVE-2022-21442.md): Vulnerability in Oracle GoldenGate (component: OGG Core Library). (CVSS 8.8, Oracle GoldenGate)
- [CVE-2022-21441](https://cve.now/CVE-2022-21441.md): Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). (CVSS 7.5, Oracle WebLogic Server)
- [CVE-2022-21440](https://cve.now/CVE-2022-21440.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 5.5, Oracle MySQL Server)
- [CVE-2022-21438](https://cve.now/CVE-2022-21438.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2022-21437](https://cve.now/CVE-2022-21437.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2022-21436](https://cve.now/CVE-2022-21436.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2022-21435](https://cve.now/CVE-2022-21435.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2022-21434](https://cve.now/CVE-2022-21434.md): Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). (CVSS 5.3, Oracle Java SE JDK and JRE)
- [CVE-2022-21431](https://cve.now/CVE-2022-21431.md): Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications Applications (component: Connecti (CVSS 10.0, Oracle Communications Billing and Revenue Management)
- [CVE-2022-21430](https://cve.now/CVE-2022-21430.md): Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications Applications (component: Connecti (CVSS 8.5, Oracle Communications Billing and Revenue Management)
- [CVE-2022-21427](https://cve.now/CVE-2022-21427.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2022-21426](https://cve.now/CVE-2022-21426.md): Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). (CVSS 5.3, Oracle Java SE JDK and JRE)
- [CVE-2022-21425](https://cve.now/CVE-2022-21425.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). (CVSS 5.5, Oracle MySQL Server)
- [CVE-2022-21424](https://cve.now/CVE-2022-21424.md): Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications Applications (component: Connecti (CVSS 8.3, Oracle Communications Billing and Revenue Management)
- [CVE-2022-21423](https://cve.now/CVE-2022-21423.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). (CVSS 2.7, Oracle MySQL Server)
- [CVE-2022-21422](https://cve.now/CVE-2022-21422.md): Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications Applications (component: Connecti (CVSS 7.5, Oracle Communications Billing and Revenue Management)
- [CVE-2022-21421](https://cve.now/CVE-2022-21421.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Web General). (CVSS 7.5, Oracle Business Intelligence Enterprise Edition)
- [CVE-2022-21420](https://cve.now/CVE-2022-21420.md): Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). (CVSS 9.8, Oracle Coherence)
- [CVE-2022-21419](https://cve.now/CVE-2022-21419.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Visual Analyzer). (CVSS 6.1, Oracle Business Intelligence Enterprise Edition)
- [CVE-2022-21418](https://cve.now/CVE-2022-21418.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). (CVSS 5.0, Oracle MySQL Server)
- [CVE-2022-21417](https://cve.now/CVE-2022-21417.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2022-21416](https://cve.now/CVE-2022-21416.md): Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility). (CVSS 5.0, Oracle Solaris Operating System)
- [CVE-2022-21415](https://cve.now/CVE-2022-21415.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2022-21414](https://cve.now/CVE-2022-21414.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2022-21413](https://cve.now/CVE-2022-21413.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2022-21412](https://cve.now/CVE-2022-21412.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2022-21411](https://cve.now/CVE-2022-21411.md): Vulnerability in the RDBMS Gateway / Generic ODBC Connectivity component of Oracle Database Server. (CVSS 5.4, Oracle Database - Enterprise Edition)
- [CVE-2022-21410](https://cve.now/CVE-2022-21410.md): Vulnerability in the Oracle Database - Enterprise Edition Sharding component of Oracle Database Server. (CVSS 7.2, Oracle Database - Enterprise Edition)
- [CVE-2022-21409](https://cve.now/CVE-2022-21409.md): Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime). (CVSS 6.1, Oracle JD Edwards EnterpriseOne Tools)
- [CVE-2022-21405](https://cve.now/CVE-2022-21405.md): Vulnerability in the OSS Support Tools product of Oracle Support Tools (component: Oracle Explorer). (CVSS 5.5, Oracle OSS Support Tools)
- [CVE-2022-21404](https://cve.now/CVE-2022-21404.md): Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Reactive WebServer). (CVSS 8.1, Oracle Helidon)
- [CVE-2021-23283](https://cve.now/CVE-2021-23283.md): Security issues in Eaton Intelligent Power Protector (IPP) (CVSS 5.2, Eaton Intelligent Power Protector)
- [CVE-2022-28222](https://cve.now/CVE-2022-28222.md): CleanTalk AntiSpam \<= 5.173 Reflected XSS (CVSS 6.1, CleanTalk AntiSpam)
- [CVE-2021-4096](https://cve.now/CVE-2021-4096.md): Fancy Product Designer \<= 4.7.5 - Cross-Site Request Forgery to Arbitrary File Upload (CVSS 8.8, fancy-product-designer Fancy Product Designer)
- [CVE-2022-1186](https://cve.now/CVE-2022-1186.md): Be POPIA Compliant \<= 1.1.5 - Sensitive Information Exposure (CVSS 5.3, bepopiacompliant Be POPIA Compliant)
- [CVE-2022-0993](https://cve.now/CVE-2022-0993.md): SiteGround Security \<= 1.2.5 - Authorization Weakness to Authentication Bypass (CVSS 8.1, siteground Security Optimizer – The All-In-One Protection P…)
- [CVE-2022-1119](https://cve.now/CVE-2022-1119.md): Simple File List \<= 3.2.7 - Arbitrary File Download (CVSS 7.5, eemitch Simple File List)
- [CVE-2022-1187](https://cve.now/CVE-2022-1187.md): WP YouTube Live \<= 1.7.21 - Reflected Cross-Site Scripting (CVSS 6.1, macbookandrew WP YouTube Live)
- [CVE-2022-28221](https://cve.now/CVE-2022-28221.md): CleanTalk AntiSpam \<= 5.173 Reflected XSS (CVSS 6.1, CleanTalk AntiSpam)
- [CVE-2022-0992](https://cve.now/CVE-2022-0992.md): SiteGround Security \<= 1.2.5 - Authentication Bypass via 2FA Setup (CVSS 9.8, siteground Security Optimizer – The All-In-One Protection P…)
- [CVE-2022-27527](https://cve.now/CVE-2022-27527.md): A Memory Corruption vulnerability may lead to code execution through maliciously crafted DLL files. (no CVSS, Navisworks)
- [CVE-2022-25788](https://cve.now/CVE-2022-25788.md): A maliciously crafted JT file in Autodesk AutoCAD 2022 may be used to write beyond the allocated buffer while parsing JT files. (no CVSS, Autodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, Aut…)
- [CVE-2021-26625](https://cve.now/CVE-2021-26625.md): tobesoft Nexacro arbitrary file download vulnerability (CVSS 8.8, tobesoft Co. Nexacro)
- [CVE-2021-26626](https://cve.now/CVE-2021-26626.md): tobesoft XPLATFORM Arbitrary file execution Vulnerability (CVSS 8.1, tobesoft Co. XPLATFORM)
- [CVE-2021-26627](https://cve.now/CVE-2021-26627.md): EDrhyme QCP 200W Information Exposure Vulnerability (CVSS 7.5, EDrhyme Co. QCP)
- [CVE-2022-1384](https://cve.now/CVE-2022-1384.md): Authorized users are allowed to install old plugin versions from the Marketplace (CVSS 4.7, Mattermost · github.com/mattermost/mattermost-server/v6 +2)
- [CVE-2022-1385](https://cve.now/CVE-2022-1385.md): Invitation Email is resent as a Reminder after invalidating pending email invites (CVSS 3.7, Mattermost · github.com/mattermost/mattermost-server/v6 +2)
- [CVE-2022-27863](https://cve.now/CVE-2022-27863.md): WordPress VikBooking Hotel Booking Engine & PMS plugin \<= 1.5.3 - Sensitive Data Exposure vulnerability (CVSS 5.3, E4J s.r.l. VikBooking Hotel Booking Engine & PMS)
- [CVE-2022-27862](https://cve.now/CVE-2022-27862.md): WordPress VikBooking Hotel Booking Engine & PMS plugin \<= 1.5.3 - Arbitrary File Upload leading to RCE (CVSS 9.8, E4J s.r.l. VikBooking Hotel Booking Engine & PMS)
- [CVE-2022-24825](https://cve.now/CVE-2022-24825.md): Smokescreen SSRF via deny list bypass (CVSS 5.8, stripe smokescreen · github.com/stripe/smokescreen)
- [CVE-2022-27104](https://cve.now/CVE-2022-27104.md): An Unauthenticated time-based blind SQL injection vulnerability exists in Forma LMS prior to v.1.4.3. (no CVSS)
- [CVE-2022-27055](https://cve.now/CVE-2022-27055.md): ecjia-daojia 1.38.1-20210202629 is vulnerable to information leakage via content/apps/installer/classes/Helper.php. (no CVSS)
- [CVE-2022-25648](https://cve.now/CVE-2022-25648.md): Command Injection (CVSS 8.1, git)
- [CVE-2021-39078](https://cve.now/CVE-2021-39078.md): IBM Security Guardium 10.5 stores user credentials in plain clear text which can be read by a local privileged user. (CVSS 4.1, IBM Security Guardium)
- [CVE-2021-39076](https://cve.now/CVE-2021-39076.md): IBM Security Guardium 10.5 and 11.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt sensitive inf (CVSS 3.7, IBM Security Guardium)
- [CVE-2021-39072](https://cve.now/CVE-2021-39072.md): IBM Security Guardium 11.3 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Stri (CVSS 5.9, IBM Security Guardium)
- [CVE-2021-39033](https://cve.now/CVE-2021-39033.md): IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.5 and 6.1.0.0 through 6.1.1.0 could allow a remote attacker to obtain sen (CVSS 4.3, IBM Sterling B2B Integrator)
- [CVE-2021-44519](https://cve.now/CVE-2021-44519.md): In Citrix XenMobile Server through 10.12 RP9, there is an Authenticated Directory Traversal vulnerability, leading to remote code execution. (no CVSS)
- [CVE-2022-29315](https://cve.now/CVE-2022-29315.md): Invicti Acunetix before 14 allows CSV injection via the Description field on the Add Targets page, if the Export CSV feature is used. (no CVSS)
- [CVE-2022-26595](https://cve.now/CVE-2022-26595.md): Liferay Portal 7.3.7, 7.4.0, and 7.4.1, and Liferay DXP 7.2 fix pack 13, and 7.3 fix pack 2 does not properly check user permission when acc (no CVSS, com.liferay.portal:release.portal.bom · com.liferay.port… +2)
- [CVE-2022-26593](https://cve.now/CVE-2022-26593.md): Cross-site scripting (XSS) vulnerability in the Asset module's asset categories selector in Liferay Portal 7.3.3 through 7.4.0, and Liferay (no CVSS, com.liferay:com.liferay.asset.taglib · com.liferay.portal:r…)
- [CVE-2021-41570](https://cve.now/CVE-2021-41570.md): Veritas NetBackup OpsCenter Analytics 9.1 allows XSS via the NetBackup Master Server Name, Display Name, NetBackup User Name, or NetBackup P (no CVSS)
- [CVE-2022-27927](https://cve.now/CVE-2022-27927.md): A SQL injection vulnerability exists in Microfinance Management System 1.0 when MySQL is being used as the application database. (no CVSS)
- [CVE-2021-43129](https://cve.now/CVE-2021-43129.md): A bypass exists for Desire2Learn/D2L Brightspace’s “Disable Right Click” option in the quizzing feature, which allows a quiz-taker to access (no CVSS)
- [CVE-2022-0645](https://cve.now/CVE-2022-0645.md): Open redirect vulnerability via endpoint authorize\_and\_redirect/?redirect= in posthog/posthog (CVSS 6.1, posthog/posthog)
- [CVE-2022-1065](https://cve.now/CVE-2022-1065.md): Multi Factor Authentication Bypass in various versions of Abacus ERP (CVSS 8.1, Abacus Research AG Abacus ERP)
- [CVE-2022-28108](https://cve.now/CVE-2022-28108.md): Selenium Server (Grid) before 4 allows CSRF because it permits non-JSON content types such as application/x-www-form-urlencoded, multipart/f (no CVSS, selenium · org.seleniumhq.selenium:selenium-grid +1)
- [CVE-2022-1329](https://cve.now/CVE-2022-1329.md): Elementor Website Builder 3.6.0 - 3.6.2 - Missing Authorization to Remote Code Execution (CVSS 8.8, elemntor Elementor Website Builder)
- [CVE-2022-29153](https://cve.now/CVE-2022-29153.md): HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11.4 may allow server side request forgery when the Consul client agent f (no CVSS, github.com/hashicorp/consul)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-04-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.