CVEs published April 20, 2022
44 CVEs were published on April 20, 2022: 6 critical, 5 high. 3 are now in CISA KEV.
- Published
- 44
- Critical
- 6
- High
- 5
- Medium
- 12
- Low
- 0
- Unrated
- 21
- Now in CISA KEV
- 3
- Fix available
- 19
Most affected products
- FANUC ROBOGUIDE
- 5
- Red Lion DA50N
- 3
- stdlib
- 3
- shopware platform · shopware/platform +1
- 2
- vran-dev databasir
- 2
- Apache Software Foundation Apache APISIX
- 1
- Atlassian Bitbucket Data Center
- 1
- Atlassian Jira Core Server · Atlassian Jira Software Ser… +3
- 1
- humhub
- 1
- Interlogix ComNav
- 1
Critical 6
- CVE-2022-27924Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 allows an unauthenticated attacker to inject arbitrary memcache commands into a targeted insta
- CVE-2022-26133SharedSecretClusterAuthenticator in Atlassian Bitbucket Data Center versions 5.14.0 and later before 7.6.14, 7.7.0 and later prior to 7.17.6Atlassian Bitbucket Data Center
- CVE-2022-0540A vulnerability in Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially crafted HTTP requesAtlassian Jira Core Server · Atlassian Jira Software Ser… +3
- CVE-2022-24861Remote Code Execution in Databasirvran-dev databasir
- CVE-2022-24799Cross Site Scripting in Wire Webappwireapp wire-webapp
- CVE-2022-1039ICSA-22-104-03 Red Lion DA50NRed Lion DA50N
High 5
- CVE-2022-27925Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it.
- CVE-2022-24872Improper Access Control in shopwareshopware platform · shopware/platform +1
- CVE-2022-24871Server-Side Request Forgery (SSRF) in Shopwareshopware platform · shopware/platform +1
- CVE-2022-24862Server-Side Request Forgery in Databasirvran-dev databasir
- CVE-2022-26516ICSA-22-104-03 Red Lion DA50NRed Lion DA50N
Medium, low and unrated 33
- CVE-2022-27926A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration (aka ZCS) 9.0 allo
- CVE-2022-29536In GNOME Epiphany before 41.4 and 42.x before 42.2, an HTML document can trigger a client buffer overflow (in ephy_string_shorten in the UI
- CVE-2022-24865Improper access control in humhubhumhub
- CVE-2021-43481An SQL Injection vulnerability exists in Webtareas 2.4p3 and earlier via the $uq HTTP POST parameter in editapprovalstage.php.
- CVE-2021-37740A denial of service vulnerability exists in MDT's firmware for the KNXnet/IP Secure router SCN-IP100.03 and KNX IP interface SCN-IP000.03 be
- CVE-2022-24864Malicious Javascript injection in OriginProtocol/origin-websiteOriginProtocol origin-website
- CVE-2022-26519Interlogix Hills ComNav Improper Restriction of Excessive Authentication AttemptsInterlogix Hills ComNav
- CVE-2022-0567A flaw was found in ovn-kubernetes.ovn-kubernetes
- CVE-2022-1318Hills ComNav Inadequate Encryption StrengthInterlogix ComNav
- CVE-2022-27179ICSA-22-104-03 Red Lion DA50NRed Lion DA50N
- CVE-2021-43988ICSA-22-109-03 FANUC ROBOGUIDE Simulation PlatformFANUC ROBOGUIDE
- CVE-2021-43933ICSA-22-109-03 FANUC ROBOGUIDE Simulation PlatformFANUC ROBOGUIDE
- CVE-2021-38483ICSA-22-109-03 FANUC ROBOGUIDE Simulation PlatformFANUC ROBOGUIDE
- CVE-2021-43986ICSA-22-109-03 FANUC ROBOGUIDE Simulation PlatformFANUC ROBOGUIDE
- CVE-2021-43990ICSA-22-109-03 FANUC ROBOGUIDE Simulation PlatformFANUC ROBOGUIDE
- CVE-2022-1254SWG URL redirection vulnerabilityMcAfee Secure Web Gateway
- CVE-2022-25344An XSS issue was discovered on Olivetti d-COLOR MF3555 2XD_S000.002.271 devices.
- CVE-2022-25343An issue was discovered on Olivetti d-COLOR MF3555 2XD_S000.002.271 devices.
- CVE-2022-25342An issue was discovered on Olivetti d-COLOR MF3555 2XD_S000.002.271 devices.
- CVE-2022-29527Amazon AWS amazon-ssm-agent before 3.1.1208.0 creates a world-writable sudoers file, which allows local attackers to inject Sudo rules and e
- CVE-2022-29266apisix/jwt-auth may leak secrets in error responseApache Software Foundation Apache APISIX
- CVE-2022-27629Cross-site request forgery (CSRF) vulnerability in 'MicroPayments - Paid Author Subscriptions, Content, Downloads, Membership' versions prioVideoWhisper MicroPayments - Paid Author Subscriptions, Con…
- CVE-2022-24675encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data.stdlib
- CVE-2022-27536Certificate.Verify in crypto/x509 in Go 1.18.x before 1.18.1 can be caused to panic on macOS when presented with certain malformed certificastdlib
- CVE-2022-28327The generic P-256 feature in crypto/elliptic in Go before 1.17.9 and 1.18.x before 1.18.1 allows a panic via long scalar input.stdlib
- CVE-2022-29528An issue was discovered in MISP before 2.4.158.
- CVE-2022-29529An issue was discovered in MISP before 2.4.158.
- CVE-2022-29530An issue was discovered in MISP before 2.4.158.
- CVE-2022-29531An issue was discovered in MISP before 2.4.158.
- CVE-2022-29532An issue was discovered in MISP before 2.4.158.
- CVE-2022-29533An issue was discovered in MISP before 2.4.158.
- CVE-2022-29534An issue was discovered in MISP before 2.4.158.
- CVE-2022-29537gp_rtp_builder_do_hevc in ietf/rtp_pck_mpeg4.c in GPAC 2.0.0 has a heap-based buffer over-read, as demonstrated by MP4Box.