CVEs published April 21, 2022
106 CVEs were published on April 21, 2022: 3 critical, 10 high.
- Published
- 106
- Critical
- 3
- High
- 10
- Medium
- 20
- Low
- 0
- Unrated
- 73
- Now in CISA KEV
- 0
- Fix available
- 19
Most affected products
- Cisco Unified Communications Manager
- 5
- Combodo iTop
- 3
- glpi-project glpi
- 3
- Cisco Umbrella Insights Virtual Appliance
- 2
- IBM Maximo Asset Management
- 2
- Mi App Store
- 2
- MIUI
- 2
- org.owasp.antisamy:antisamy
- 2
- Adobe Experience Manager · com.adobe.acs:acs-aem-commons
- 1
- blazer
- 1
Critical 3
High 10
- CVE-2022-26856Dell EMC Repository Manager version 3.4.0 contains a plain-text password storage vulnerability.Dell Repository Manager
- CVE-2022-24424Dell EMC AppSync versions from 3.9 to 4.3 contain a path traversal vulnerability in AppSync server.Dell AppSync
- CVE-2022-20773Cisco Umbrella Virtual Appliance Static SSH Host Key VulnerabilityCisco Umbrella Insights Virtual Appliance
- CVE-2022-20732Cisco Virtualized Infrastructure Manager Privilege Escalation VulnerabilityCisco Virtualized Infrastructure Manager
- CVE-2022-20783Cisco TelePresence Collaboration Endpoint and RoomOS Software H.323 Denial of Service VulnerabilityCisco RoomOS Software
- CVE-2022-24868Cross site scripting via SVG file upload in GLPIglpi-project glpi
- CVE-2022-24867LDAP password exposure in glpiglpi-project glpi
- CVE-2022-24870Stored Cross-site Scripting in Combodo iTopCombodo iTop
- CVE-2022-0272Improper Restriction of XML External Entity Reference in detekt/detektdetekt/detekt · io.gitlab.arturbosch.detekt:detekt-core
- CVE-2022-1022Cross-site Scripting (XSS) - Stored in chatwoot/chatwootchatwoot/chatwoot
Medium, low and unrated 93
- CVE-2022-29577OWASP AntiSamy before 1.6.7 allows XSS via HTML tag smuggling on STYLE content with crafted input.org.owasp.antisamy:antisamy
- CVE-2022-28367OWASP AntiSamy before 1.6.6 allows XSS via HTML tag smuggling on STYLE content with crafted input.org.owasp.antisamy:antisamy
- CVE-2022-28366Certain Neko-related HTML parsers allow a denial of service via crafted Processing Instruction (PI) input that causes excessive heap memory net.sourceforge.htmlunit:neko-htmlunit
- CVE-2022-24423Dell iDRAC8 versions prior to 2.83.83.83 contain a denial of service vulnerability.Integrated Dell Remote Access Controller
- CVE-2022-22558Dell PowerEdge Server BIOS and Dell Precision Workstation 7910 and 7920 Rack BIOS contain an Improper SMM communication buffer verification Dell PowerEdge Platform
- CVE-2022-27478Victor v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the component admin/profile.php?section=admin.
- CVE-2022-28006Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\employee_delete.php.
- CVE-2022-28007Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\cashadvance_delete.php.
- CVE-2022-28008Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\attendance_delete.php.
- CVE-2022-28009Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\attendance_delete.php.
- CVE-2022-28010Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\overtime_delete.php.
- CVE-2022-28011Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\schedule_delete.php.
- CVE-2022-28012Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\position_delete.php.
- CVE-2022-28013Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\schedule_employee_edit.p
- CVE-2022-28014Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\attendance_edit.php.
- CVE-2022-28015Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\cashadvance_edit.php.
- CVE-2022-28016Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\deduction_edit.php.
- CVE-2022-28017Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\overtime_edit.php.
- CVE-2022-28018Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\schedule_edit.php.
- CVE-2022-28019Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\employee_edit.php.
- CVE-2022-28020Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\position_edit.php.
- CVE-2022-28021Purchase Order Management System v1.0 was discovered to contain a remote code execution (RCE) vulnerability via /purchase_order/admin/?page=
- CVE-2022-28022Purchase Order Management System v1.0 was discovered to contain a SQL injection vulnerability via /purchase_order/classes/Master.php?f=delet
- CVE-2022-28023Purchase Order Management System v1.0 was discovered to contain a SQL injection vulnerability via /purchase_order/classes/Master.php?f=delet
- CVE-2022-28024Student Grading System v1.0 was discovered to contain a SQL injection vulnerability via /student-grading-system/rms.php?page=grade.
- CVE-2022-28025Student Grading System v1.0 was discovered to contain a SQL injection vulnerability via /student-grading-system/rms.php?page=school_year.
- CVE-2022-28026Student Grading System v1.0 was discovered to contain a SQL injection vulnerability via /student-grading-system/rms.php?page=student_p&id=.
- CVE-2022-28028Simple Real Estate Portal System v1.0 was discovered to contain a SQL injection vulnerability via /reps/classes/Master.php?f=delete_amenity.
- CVE-2022-28029Simple Real Estate Portal System v1.0 was discovered to contain a SQL injection vulnerability via /reps/classes/Master.php?f=delete_type.
- CVE-2022-28030Simple Real Estate Portal System v1.0 was discovered to contain a SQL injection vulnerability via /reps/classes/Master.php?f=delete_estate.
- CVE-2022-28410Simple Real Estate Portal System v1.0 was discovered to contain a SQL injection vulnerability via /reps/classes/Users.php?f=delete_agent.
- CVE-2022-28411Simple Real Estate Portal System v1.0 was discovered to contain a SQL injection vulnerability via /reps/admin/?page=agents/manage_agent.
- CVE-2022-28412Car Driving School Managment System v1.0 was discovered to contain a SQL injection vulnerability via /cdsms/classes/Master.php?f=delete_pack
- CVE-2022-28413Car Driving School Management System v1.0 was discovered to contain a SQL injection vulnerability via /cdsms/classes/Master.php?f=delete_enr
- CVE-2022-28414Home Owners Collection Management System v1.0 was discovered to contain a SQL injection vulnerability via /hocms/classes/Master.php?f=delete
- CVE-2022-28415Home Owners Collection Management System v1.0 was discovered to contain a SQL injection vulnerability via /hocms/classes/Master.php?f=delete
- CVE-2022-28416Home Owners Collection Management System v1.0 was discovered to contain a SQL injection vulnerability via /hocms/classes/Master.php?f=delete
- CVE-2022-28417Home Owners Collection Management System v1.0 was discovered to contain a SQL injection vulnerability via /hocms/classes/Master.php?f=delete
- CVE-2022-28426Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/pagerole.php&action=edit&roleid=.
- CVE-2022-28420Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via BabyCare/admin.php?id=theme&setid=.
- CVE-2022-28421Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin.php?id=posts&action=display&value=1&postid=.
- CVE-2022-28422Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/posts.php&action=edit.
- CVE-2022-28423Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/posts.php&action=delete.
- CVE-2022-28424Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/posts.php&find=.
- CVE-2022-28425Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/pagerole.php&action=display&value=1&roleid=.
- CVE-2022-28427Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/inbox.php&action=read&msgid=.
- CVE-2022-28429Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/inbox.php&action=delete&msgid=.
- CVE-2022-28431Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/siteoptions.php&social=remove&sid=2.
- CVE-2022-28432Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin.php?id=siteoptions&social=display&value=0&sid=2.
- CVE-2022-28433Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/uesrs.php&action=display&value=Show&userid=.
- CVE-2022-28434Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin.php?id=siteoptions&social=edit&sid=2.
- CVE-2022-28435Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/siteoptions.php&action=displaygoal&value=1&roleid=1
- CVE-2022-28436Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/uesrs.php&action=display&value=Hide&userid=.
- CVE-2022-28437Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/uesrs.php&action=type&userrole=Admin&userid=3.
- CVE-2022-28438Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/uesrs.php&action=type&userrole=User&userid=.
- CVE-2022-28439Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/uesrs.php&&action=delete&userid=4.
- CVE-2022-28440An arbitrary file upload vulnerability in UCMS v1.6 allows attackers to execute arbitrary code via a crafted PHP file.
- CVE-2022-28445KiteCMS v1.1.1 was discovered to contain an arbitrary file read vulnerability via the background management module.
- CVE-2022-28443UCMS v1.6 was discovered to contain an arbitrary file deletion vulnerability.
- CVE-2022-28444UCMS v1.6 was discovered to contain an arbitrary file read vulnerability.
- CVE-2022-20805Cisco Umbrella Secure Web Gateway File Decryption Bypass VulnerabilityCisco Umbrella Insights Virtual Appliance
- CVE-2022-20804Cisco Unified Communications Products Denial of Service VulnerabilityCisco Unified Communications Manager
- CVE-2022-20795Cisco Adaptive Security Appliance and Cisco Firepower Threat Defense Software AnyConnect SSL VPN Denial of Service VulnerabilityCisco Adaptive Security Appliance (ASA) Software
- CVE-2022-20790Cisco Unified Communications Products Arbitrary File Read VulnerabilityCisco Unified Communications Manager
- CVE-2022-20789Cisco Unified Communications Products Arbitrary File Write VulnerabilityCisco Unified Communications Manager
- CVE-2022-20788Cisco Unified Communications Products Cross-Site Scripting VulnerabilityCisco Unified Communications Manager
- CVE-2022-20787Cisco Unified Communications Products Cross-Site Request Forgery VulnerabilityCisco Unified Communications Manager
- CVE-2022-20786Cisco Unified Communications Manager IM & Presence Service SQL Injection VulnerabilityCisco Unified Communications Manager IM and Presence Service
- CVE-2022-20778Cisco Webex Meetings Cross-Site Scripting VulnerabilityCisco Webex Meetings
- CVE-2022-29566The Bulletproofs 2017/1066 paper mishandles Fiat-Shamir generation because the hash computation fails to include all of the public values fr
- CVE-2022-23711A vulnerability in Kibana could expose sensitive information related to Elastic Stack monitoring in the Kibana page source.Elastic kibana
- CVE-2021-35229Cross-Site Scripting Vulnerability using SQL QuerySolarWinds Database Performance Monitor
- CVE-2022-22969<Issue Description> Spring Security OAuth versions 2.5.x prior to 2.5.2 and older unsupported versions are susceptible to a Denial-of-ServicSpring Security OAuth · org.springframework.security.oauth:…
- CVE-2021-23055On version 2.x before 2.0.3 and 1.x before 1.12.3, the command line restriction that controls snippet use with NGINX Ingress Controller doesNGINX Ingress Controller
- CVE-2021-43708The Labeling tool in Titus Classification Suite 18.8.1910.140 allows users to avoid the generation of a classification label by using Excel'
- CVE-2022-28820Adobe Consulting Services Reflected Cross-Site Scripting Arbitrary Code ExecutionAdobe Experience Manager · com.adobe.acs:acs-aem-commons
- CVE-2020-14117A improper permission configuration vulnerability in Xiaomi Content Center APP.Xiaomi Content Center APP
- CVE-2020-14118An intent redirection vulnerability in the Mi App Store product.Mi App Store
- CVE-2020-14120Some Xiaomi models have a vulnerability in a certain application.MIUI
- CVE-2020-14122Some Xiaomi phones have information leakage vulnerabilities, and some of them may be able to forge a specific identity due to the lack of paMIUI
- CVE-2020-14121A business logic vulnerability exists in Mi App Store.Mi App Store
- CVE-2020-14116An intent redirection vulnerability in the Mi Browser product.Mi Browser
- CVE-2022-24875Potential Secrets being logged to disk in CVEProject/cve-servicesCVEProject cve-services
- CVE-2022-24869Cross Site Scripting in GLPIglpi-project glpi
- CVE-2022-22436IBM Maximo Asset Management 7.6.1.2 is vulnerable to cross-site scripting.IBM Maximo Asset Management
- CVE-2022-22435IBM Maximo Asset Management 7.6.1.2 is vulnerable to cross-site scripting.IBM Maximo Asset Management
- CVE-2022-24272MongoDB Server (mongod) may crash in response to unexpected requestsMongoDB Server
- CVE-2022-27237There is a cross-site scripting (XSS) vulnerability in an NI Web Server component installed with several NI products.
- CVE-2022-29498Blazer before 2.6.0 allows SQL Injection.blazer
- CVE-2016-20014In pam_tacplus.c in pam_tacplus before 1.4.1, pam_sm_acct_mgmt does not zero out the arep data structure.
- CVE-2022-29547The CreateRedirect extension before 2022-04-14 for MediaWiki does not properly check whether the user has permissions to edit the target pag
- CVE-2022-1420Use of Out-of-range Pointer Offset in vim/vimvim/vim
- CVE-2022-29548A reflected XSS issue exists in the Management Console of several WSO2 products.