# CVEs published 2022-04-20

44 CVEs were published on April 20, 2022: 6 critical, 5 high. 3 are now in CISA KEV. Days are UTC.

- [CVE-2022-27926](https://cve.now/CVE-2022-27926.md): A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration (aka ZCS) 9.0 allo (CVSS 6.1, KEV)
- [CVE-2022-27925](https://cve.now/CVE-2022-27925.md): Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. (CVSS 7.2, KEV)
- [CVE-2022-27924](https://cve.now/CVE-2022-27924.md): Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 allows an unauthenticated attacker to inject arbitrary memcache commands into a targeted insta (CVSS 9.8, KEV)
- [CVE-2022-29536](https://cve.now/CVE-2022-29536.md): In GNOME Epiphany before 41.4 and 42.x before 42.2, an HTML document can trigger a client buffer overflow (in ephy\_string\_shorten in the UI (no CVSS)
- [CVE-2022-24865](https://cve.now/CVE-2022-24865.md): Improper access control in humhub (CVSS 6.5, humhub)
- [CVE-2021-43481](https://cve.now/CVE-2021-43481.md): An SQL Injection vulnerability exists in Webtareas 2.4p3 and earlier via the $uq HTTP POST parameter in editapprovalstage.php. (no CVSS)
- [CVE-2021-37740](https://cve.now/CVE-2021-37740.md): A denial of service vulnerability exists in MDT's firmware for the KNXnet/IP Secure router SCN-IP100.03 and KNX IP interface SCN-IP000.03 be (no CVSS)
- [CVE-2022-24872](https://cve.now/CVE-2022-24872.md): Improper Access Control in shopware (CVSS 8.1, shopware platform · shopware/platform +1)
- [CVE-2022-24871](https://cve.now/CVE-2022-24871.md): Server-Side Request Forgery (SSRF) in Shopware (CVSS 7.2, shopware platform · shopware/platform +1)
- [CVE-2022-26133](https://cve.now/CVE-2022-26133.md): SharedSecretClusterAuthenticator in Atlassian Bitbucket Data Center versions 5.14.0 and later before 7.6.14, 7.7.0 and later prior to 7.17.6 (CVSS 9.8, Atlassian Bitbucket Data Center)
- [CVE-2022-0540](https://cve.now/CVE-2022-0540.md): A vulnerability in Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially crafted HTTP reques (CVSS 9.8, Atlassian Jira Core Server · Atlassian Jira Software Ser… +3)
- [CVE-2022-24864](https://cve.now/CVE-2022-24864.md): Malicious Javascript injection in OriginProtocol/origin-website (CVSS 4.1, OriginProtocol origin-website)
- [CVE-2022-24862](https://cve.now/CVE-2022-24862.md): Server-Side Request Forgery in Databasir (CVSS 7.7, vran-dev databasir)
- [CVE-2022-24861](https://cve.now/CVE-2022-24861.md): Remote Code Execution in Databasir (CVSS 9.9, vran-dev databasir)
- [CVE-2022-24799](https://cve.now/CVE-2022-24799.md): Cross Site Scripting in Wire Webapp (CVSS 9.6, wireapp wire-webapp)
- [CVE-2022-26519](https://cve.now/CVE-2022-26519.md): Interlogix Hills ComNav Improper Restriction of Excessive Authentication Attempts (CVSS 5.5, Interlogix Hills ComNav)
- [CVE-2022-0567](https://cve.now/CVE-2022-0567.md): A flaw was found in ovn-kubernetes. (no CVSS, ovn-kubernetes)
- [CVE-2022-1318](https://cve.now/CVE-2022-1318.md): Hills ComNav Inadequate Encryption Strength (CVSS 6.2, Interlogix ComNav)
- [CVE-2022-1039](https://cve.now/CVE-2022-1039.md): ICSA-22-104-03 Red Lion DA50N (CVSS 9.6, Red Lion DA50N)
- [CVE-2022-26516](https://cve.now/CVE-2022-26516.md): ICSA-22-104-03 Red Lion DA50N (CVSS 8.4, Red Lion DA50N)
- [CVE-2022-27179](https://cve.now/CVE-2022-27179.md): ICSA-22-104-03 Red Lion DA50N (CVSS 4.6, Red Lion DA50N)
- [CVE-2021-43988](https://cve.now/CVE-2021-43988.md): ICSA-22-109-03 FANUC ROBOGUIDE Simulation Platform (CVSS 6.1, FANUC ROBOGUIDE)
- [CVE-2021-43933](https://cve.now/CVE-2021-43933.md): ICSA-22-109-03 FANUC ROBOGUIDE Simulation Platform (CVSS 6.1, FANUC ROBOGUIDE)
- [CVE-2021-38483](https://cve.now/CVE-2021-38483.md): ICSA-22-109-03 FANUC ROBOGUIDE Simulation Platform (CVSS 6.0, FANUC ROBOGUIDE)
- [CVE-2021-43986](https://cve.now/CVE-2021-43986.md): ICSA-22-109-03 FANUC ROBOGUIDE Simulation Platform (CVSS 6.0, FANUC ROBOGUIDE)
- [CVE-2021-43990](https://cve.now/CVE-2021-43990.md): ICSA-22-109-03 FANUC ROBOGUIDE Simulation Platform (CVSS 6.1, FANUC ROBOGUIDE)
- [CVE-2022-1254](https://cve.now/CVE-2022-1254.md): SWG URL redirection vulnerability (CVSS 6.1, McAfee Secure Web Gateway)
- [CVE-2022-25344](https://cve.now/CVE-2022-25344.md): An XSS issue was discovered on Olivetti d-COLOR MF3555 2XD\_S000.002.271 devices. (no CVSS)
- [CVE-2022-25343](https://cve.now/CVE-2022-25343.md): An issue was discovered on Olivetti d-COLOR MF3555 2XD\_S000.002.271 devices. (no CVSS)
- [CVE-2022-25342](https://cve.now/CVE-2022-25342.md): An issue was discovered on Olivetti d-COLOR MF3555 2XD\_S000.002.271 devices. (no CVSS)
- [CVE-2022-29527](https://cve.now/CVE-2022-29527.md): Amazon AWS amazon-ssm-agent before 3.1.1208.0 creates a world-writable sudoers file, which allows local attackers to inject Sudo rules and e (no CVSS)
- [CVE-2022-29266](https://cve.now/CVE-2022-29266.md): apisix/jwt-auth may leak secrets in error response (no CVSS, Apache Software Foundation Apache APISIX)
- [CVE-2022-27629](https://cve.now/CVE-2022-27629.md): Cross-site request forgery (CSRF) vulnerability in 'MicroPayments - Paid Author Subscriptions, Content, Downloads, Membership' versions prio (no CVSS, VideoWhisper MicroPayments - Paid Author Subscriptions, Con…)
- [CVE-2022-24675](https://cve.now/CVE-2022-24675.md): encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data. (no CVSS, stdlib)
- [CVE-2022-27536](https://cve.now/CVE-2022-27536.md): Certificate.Verify in crypto/x509 in Go 1.18.x before 1.18.1 can be caused to panic on macOS when presented with certain malformed certifica (no CVSS, stdlib)
- [CVE-2022-28327](https://cve.now/CVE-2022-28327.md): The generic P-256 feature in crypto/elliptic in Go before 1.17.9 and 1.18.x before 1.18.1 allows a panic via long scalar input. (no CVSS, stdlib)
- [CVE-2022-29528](https://cve.now/CVE-2022-29528.md): An issue was discovered in MISP before 2.4.158. (no CVSS)
- [CVE-2022-29529](https://cve.now/CVE-2022-29529.md): An issue was discovered in MISP before 2.4.158. (no CVSS)
- [CVE-2022-29530](https://cve.now/CVE-2022-29530.md): An issue was discovered in MISP before 2.4.158. (no CVSS)
- [CVE-2022-29531](https://cve.now/CVE-2022-29531.md): An issue was discovered in MISP before 2.4.158. (no CVSS)
- [CVE-2022-29532](https://cve.now/CVE-2022-29532.md): An issue was discovered in MISP before 2.4.158. (no CVSS)
- [CVE-2022-29533](https://cve.now/CVE-2022-29533.md): An issue was discovered in MISP before 2.4.158. (no CVSS)
- [CVE-2022-29534](https://cve.now/CVE-2022-29534.md): An issue was discovered in MISP before 2.4.158. (no CVSS)
- [CVE-2022-29537](https://cve.now/CVE-2022-29537.md): gp\_rtp\_builder\_do\_hevc in ietf/rtp\_pck\_mpeg4.c in GPAC 2.0.0 has a heap-based buffer over-read, as demonstrated by MP4Box. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-04-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.