# CVEs published 2022-04-21

106 CVEs were published on April 21, 2022: 3 critical, 10 high. Days are UTC.

- [CVE-2022-29577](https://cve.now/CVE-2022-29577.md): OWASP AntiSamy before 1.6.7 allows XSS via HTML tag smuggling on STYLE content with crafted input. (no CVSS, org.owasp.antisamy:antisamy)
- [CVE-2022-28367](https://cve.now/CVE-2022-28367.md): OWASP AntiSamy before 1.6.6 allows XSS via HTML tag smuggling on STYLE content with crafted input. (no CVSS, org.owasp.antisamy:antisamy)
- [CVE-2022-28366](https://cve.now/CVE-2022-28366.md): Certain Neko-related HTML parsers allow a denial of service via crafted Processing Instruction (PI) input that causes excessive heap memory (no CVSS, net.sourceforge.htmlunit:neko-htmlunit)
- [CVE-2022-26856](https://cve.now/CVE-2022-26856.md): Dell EMC Repository Manager version 3.4.0 contains a plain-text password storage vulnerability. (CVSS 8.2, Dell Repository Manager)
- [CVE-2022-24424](https://cve.now/CVE-2022-24424.md): Dell EMC AppSync versions from 3.9 to 4.3 contain a path traversal vulnerability in AppSync server. (CVSS 7.5, Dell AppSync)
- [CVE-2022-24423](https://cve.now/CVE-2022-24423.md): Dell iDRAC8 versions prior to 2.83.83.83 contain a denial of service vulnerability. (CVSS 5.3, Integrated Dell Remote Access Controller)
- [CVE-2022-22558](https://cve.now/CVE-2022-22558.md): Dell PowerEdge Server BIOS and Dell Precision Workstation 7910 and 7920 Rack BIOS contain an Improper SMM communication buffer verification (CVSS 5.7, Dell PowerEdge Platform)
- [CVE-2022-27478](https://cve.now/CVE-2022-27478.md): Victor v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the component admin/profile.php?section=admin. (no CVSS)
- [CVE-2022-28006](https://cve.now/CVE-2022-28006.md): Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \\admin\\employee\_delete.php. (no CVSS)
- [CVE-2022-28007](https://cve.now/CVE-2022-28007.md): Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \\admin\\cashadvance\_delete.php. (no CVSS)
- [CVE-2022-28008](https://cve.now/CVE-2022-28008.md): Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \\admin\\attendance\_delete.php. (no CVSS)
- [CVE-2022-28009](https://cve.now/CVE-2022-28009.md): Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \\admin\\attendance\_delete.php. (no CVSS)
- [CVE-2022-28010](https://cve.now/CVE-2022-28010.md): Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \\admin\\overtime\_delete.php. (no CVSS)
- [CVE-2022-28011](https://cve.now/CVE-2022-28011.md): Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \\admin\\schedule\_delete.php. (no CVSS)
- [CVE-2022-28012](https://cve.now/CVE-2022-28012.md): Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \\admin\\position\_delete.php. (no CVSS)
- [CVE-2022-28013](https://cve.now/CVE-2022-28013.md): Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \\admin\\schedule\_employee\_edit.p (no CVSS)
- [CVE-2022-28014](https://cve.now/CVE-2022-28014.md): Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \\admin\\attendance\_edit.php. (no CVSS)
- [CVE-2022-28015](https://cve.now/CVE-2022-28015.md): Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \\admin\\cashadvance\_edit.php. (no CVSS)
- [CVE-2022-28016](https://cve.now/CVE-2022-28016.md): Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \\admin\\deduction\_edit.php. (no CVSS)
- [CVE-2022-28017](https://cve.now/CVE-2022-28017.md): Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \\admin\\overtime\_edit.php. (no CVSS)
- [CVE-2022-28018](https://cve.now/CVE-2022-28018.md): Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \\admin\\schedule\_edit.php. (no CVSS)
- [CVE-2022-28019](https://cve.now/CVE-2022-28019.md): Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \\admin\\employee\_edit.php. (no CVSS)
- [CVE-2022-28020](https://cve.now/CVE-2022-28020.md): Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \\admin\\position\_edit.php. (no CVSS)
- [CVE-2022-28021](https://cve.now/CVE-2022-28021.md): Purchase Order Management System v1.0 was discovered to contain a remote code execution (RCE) vulnerability via /purchase\_order/admin/?page= (no CVSS)
- [CVE-2022-28022](https://cve.now/CVE-2022-28022.md): Purchase Order Management System v1.0 was discovered to contain a SQL injection vulnerability via /purchase\_order/classes/Master.php?f=delet (no CVSS)
- [CVE-2022-28023](https://cve.now/CVE-2022-28023.md): Purchase Order Management System v1.0 was discovered to contain a SQL injection vulnerability via /purchase\_order/classes/Master.php?f=delet (no CVSS)
- [CVE-2022-28024](https://cve.now/CVE-2022-28024.md): Student Grading System v1.0 was discovered to contain a SQL injection vulnerability via /student-grading-system/rms.php?page=grade. (no CVSS)
- [CVE-2022-28025](https://cve.now/CVE-2022-28025.md): Student Grading System v1.0 was discovered to contain a SQL injection vulnerability via /student-grading-system/rms.php?page=school\_year. (no CVSS)
- [CVE-2022-28026](https://cve.now/CVE-2022-28026.md): Student Grading System v1.0 was discovered to contain a SQL injection vulnerability via /student-grading-system/rms.php?page=student\_p&id=. (no CVSS)
- [CVE-2022-28028](https://cve.now/CVE-2022-28028.md): Simple Real Estate Portal System v1.0 was discovered to contain a SQL injection vulnerability via /reps/classes/Master.php?f=delete\_amenity. (no CVSS)
- [CVE-2022-28029](https://cve.now/CVE-2022-28029.md): Simple Real Estate Portal System v1.0 was discovered to contain a SQL injection vulnerability via /reps/classes/Master.php?f=delete\_type. (no CVSS)
- [CVE-2022-28030](https://cve.now/CVE-2022-28030.md): Simple Real Estate Portal System v1.0 was discovered to contain a SQL injection vulnerability via /reps/classes/Master.php?f=delete\_estate. (no CVSS)
- [CVE-2022-28410](https://cve.now/CVE-2022-28410.md): Simple Real Estate Portal System v1.0 was discovered to contain a SQL injection vulnerability via /reps/classes/Users.php?f=delete\_agent. (no CVSS)
- [CVE-2022-28411](https://cve.now/CVE-2022-28411.md): Simple Real Estate Portal System v1.0 was discovered to contain a SQL injection vulnerability via /reps/admin/?page=agents/manage\_agent. (no CVSS)
- [CVE-2022-28412](https://cve.now/CVE-2022-28412.md): Car Driving School Managment System v1.0 was discovered to contain a SQL injection vulnerability via /cdsms/classes/Master.php?f=delete\_pack (no CVSS)
- [CVE-2022-28413](https://cve.now/CVE-2022-28413.md): Car Driving School Management System v1.0 was discovered to contain a SQL injection vulnerability via /cdsms/classes/Master.php?f=delete\_enr (no CVSS)
- [CVE-2022-28414](https://cve.now/CVE-2022-28414.md): Home Owners Collection Management System v1.0 was discovered to contain a SQL injection vulnerability via /hocms/classes/Master.php?f=delete (no CVSS)
- [CVE-2022-28415](https://cve.now/CVE-2022-28415.md): Home Owners Collection Management System v1.0 was discovered to contain a SQL injection vulnerability via /hocms/classes/Master.php?f=delete (no CVSS)
- [CVE-2022-28416](https://cve.now/CVE-2022-28416.md): Home Owners Collection Management System v1.0 was discovered to contain a SQL injection vulnerability via /hocms/classes/Master.php?f=delete (no CVSS)
- [CVE-2022-28417](https://cve.now/CVE-2022-28417.md): Home Owners Collection Management System v1.0 was discovered to contain a SQL injection vulnerability via /hocms/classes/Master.php?f=delete (no CVSS)
- [CVE-2022-28426](https://cve.now/CVE-2022-28426.md): Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/pagerole.php&action=edit&roleid=. (no CVSS)
- [CVE-2022-28420](https://cve.now/CVE-2022-28420.md): Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via BabyCare/admin.php?id=theme&setid=. (no CVSS)
- [CVE-2022-28421](https://cve.now/CVE-2022-28421.md): Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin.php?id=posts&action=display&value=1&postid=. (no CVSS)
- [CVE-2022-28422](https://cve.now/CVE-2022-28422.md): Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/posts.php&action=edit. (no CVSS)
- [CVE-2022-28423](https://cve.now/CVE-2022-28423.md): Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/posts.php&action=delete. (no CVSS)
- [CVE-2022-28424](https://cve.now/CVE-2022-28424.md): Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/posts.php&find=. (no CVSS)
- [CVE-2022-28425](https://cve.now/CVE-2022-28425.md): Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/pagerole.php&action=display&value=1&roleid=. (no CVSS)
- [CVE-2022-28427](https://cve.now/CVE-2022-28427.md): Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/inbox.php&action=read&msgid=. (no CVSS)
- [CVE-2022-28429](https://cve.now/CVE-2022-28429.md): Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/inbox.php&action=delete&msgid=. (no CVSS)
- [CVE-2022-28431](https://cve.now/CVE-2022-28431.md): Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/siteoptions.php&social=remove&sid=2. (no CVSS)
- [CVE-2022-28432](https://cve.now/CVE-2022-28432.md): Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin.php?id=siteoptions&social=display&value=0&sid=2. (no CVSS)
- [CVE-2022-28433](https://cve.now/CVE-2022-28433.md): Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/uesrs.php&action=display&value=Show&userid=. (no CVSS)
- [CVE-2022-28434](https://cve.now/CVE-2022-28434.md): Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin.php?id=siteoptions&social=edit&sid=2. (no CVSS)
- [CVE-2022-28435](https://cve.now/CVE-2022-28435.md): Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/siteoptions.php&action=displaygoal&value=1&roleid=1 (no CVSS)
- [CVE-2022-28436](https://cve.now/CVE-2022-28436.md): Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/uesrs.php&action=display&value=Hide&userid=. (no CVSS)
- [CVE-2022-28437](https://cve.now/CVE-2022-28437.md): Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/uesrs.php&action=type&userrole=Admin&userid=3. (no CVSS)
- [CVE-2022-28438](https://cve.now/CVE-2022-28438.md): Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/uesrs.php&action=type&userrole=User&userid=. (no CVSS)
- [CVE-2022-28439](https://cve.now/CVE-2022-28439.md): Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/uesrs.php&&action=delete&userid=4. (no CVSS)
- [CVE-2022-28440](https://cve.now/CVE-2022-28440.md): An arbitrary file upload vulnerability in UCMS v1.6 allows attackers to execute arbitrary code via a crafted PHP file. (no CVSS)
- [CVE-2022-28445](https://cve.now/CVE-2022-28445.md): KiteCMS v1.1.1 was discovered to contain an arbitrary file read vulnerability via the background management module. (no CVSS)
- [CVE-2022-28443](https://cve.now/CVE-2022-28443.md): UCMS v1.6 was discovered to contain an arbitrary file deletion vulnerability. (no CVSS)
- [CVE-2022-28444](https://cve.now/CVE-2022-28444.md): UCMS v1.6 was discovered to contain an arbitrary file read vulnerability. (no CVSS)
- [CVE-2022-20773](https://cve.now/CVE-2022-20773.md): Cisco Umbrella Virtual Appliance Static SSH Host Key Vulnerability (CVSS 7.5, Cisco Umbrella Insights Virtual Appliance)
- [CVE-2022-20732](https://cve.now/CVE-2022-20732.md): Cisco Virtualized Infrastructure Manager Privilege Escalation Vulnerability (CVSS 7.8, Cisco Virtualized Infrastructure Manager)
- [CVE-2022-20805](https://cve.now/CVE-2022-20805.md): Cisco Umbrella Secure Web Gateway File Decryption Bypass Vulnerability (CVSS 4.1, Cisco Umbrella Insights Virtual Appliance)
- [CVE-2022-20804](https://cve.now/CVE-2022-20804.md): Cisco Unified Communications Products Denial of Service Vulnerability (CVSS 5.3, Cisco Unified Communications Manager)
- [CVE-2022-20795](https://cve.now/CVE-2022-20795.md): Cisco Adaptive Security Appliance and Cisco Firepower Threat Defense Software AnyConnect SSL VPN Denial of Service Vulnerability (CVSS 5.8, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2022-20790](https://cve.now/CVE-2022-20790.md): Cisco Unified Communications Products Arbitrary File Read Vulnerability (CVSS 6.5, Cisco Unified Communications Manager)
- [CVE-2022-20789](https://cve.now/CVE-2022-20789.md): Cisco Unified Communications Products Arbitrary File Write Vulnerability (CVSS 4.9, Cisco Unified Communications Manager)
- [CVE-2022-20788](https://cve.now/CVE-2022-20788.md): Cisco Unified Communications Products Cross-Site Scripting Vulnerability (CVSS 6.1, Cisco Unified Communications Manager)
- [CVE-2022-20787](https://cve.now/CVE-2022-20787.md): Cisco Unified Communications Products Cross-Site Request Forgery Vulnerability (CVSS 5.7, Cisco Unified Communications Manager)
- [CVE-2022-20786](https://cve.now/CVE-2022-20786.md): Cisco Unified Communications Manager IM & Presence Service SQL Injection Vulnerability (CVSS 5.4, Cisco Unified Communications Manager IM and Presence Service)
- [CVE-2022-20783](https://cve.now/CVE-2022-20783.md): Cisco TelePresence Collaboration Endpoint and RoomOS Software H.323 Denial of Service Vulnerability (CVSS 7.5, Cisco RoomOS Software)
- [CVE-2022-20778](https://cve.now/CVE-2022-20778.md): Cisco Webex Meetings Cross-Site Scripting Vulnerability (CVSS 6.1, Cisco Webex Meetings)
- [CVE-2022-29566](https://cve.now/CVE-2022-29566.md): The Bulletproofs 2017/1066 paper mishandles Fiat-Shamir generation because the hash computation fails to include all of the public values fr (no CVSS)
- [CVE-2022-23711](https://cve.now/CVE-2022-23711.md): A vulnerability in Kibana could expose sensitive information related to Elastic Stack monitoring in the Kibana page source. (no CVSS, Elastic kibana)
- [CVE-2021-35229](https://cve.now/CVE-2021-35229.md): Cross-Site Scripting Vulnerability using SQL Query (CVSS 6.8, SolarWinds Database Performance Monitor)
- [CVE-2022-22969](https://cve.now/CVE-2022-22969.md): \<Issue Description\> Spring Security OAuth versions 2.5.x prior to 2.5.2 and older unsupported versions are susceptible to a Denial-of-Servic (no CVSS, Spring Security OAuth · org.springframework.security.oauth:…)
- [CVE-2021-23055](https://cve.now/CVE-2021-23055.md): On version 2.x before 2.0.3 and 1.x before 1.12.3, the command line restriction that controls snippet use with NGINX Ingress Controller does (no CVSS, NGINX Ingress Controller)
- [CVE-2021-43708](https://cve.now/CVE-2021-43708.md): The Labeling tool in Titus Classification Suite 18.8.1910.140 allows users to avoid the generation of a classification label by using Excel' (no CVSS)
- [CVE-2022-28743](https://cve.now/CVE-2022-28743.md): Time-of-check Time-of-use (TOCTOU) Race Condition vulerability in Foscam R2C IP camera running System FW \<= 1.13.1.6, and Application FW \<= (CVSS 9.1)
- [CVE-2022-28820](https://cve.now/CVE-2022-28820.md): Adobe Consulting Services Reflected Cross-Site Scripting Arbitrary Code Execution (CVSS 6.1, Adobe Experience Manager · com.adobe.acs:acs-aem-commons)
- [CVE-2020-14117](https://cve.now/CVE-2020-14117.md): A improper permission configuration vulnerability in Xiaomi Content Center APP. (no CVSS, Xiaomi Content Center APP)
- [CVE-2020-14118](https://cve.now/CVE-2020-14118.md): An intent redirection vulnerability in the Mi App Store product. (no CVSS, Mi App Store)
- [CVE-2020-14120](https://cve.now/CVE-2020-14120.md): Some Xiaomi models have a vulnerability in a certain application. (no CVSS, MIUI)
- [CVE-2020-14122](https://cve.now/CVE-2020-14122.md): Some Xiaomi phones have information leakage vulnerabilities, and some of them may be able to forge a specific identity due to the lack of pa (no CVSS, MIUI)
- [CVE-2020-14121](https://cve.now/CVE-2020-14121.md): A business logic vulnerability exists in Mi App Store. (no CVSS, Mi App Store)
- [CVE-2020-14116](https://cve.now/CVE-2020-14116.md): An intent redirection vulnerability in the Mi Browser product. (no CVSS, Mi Browser)
- [CVE-2022-24875](https://cve.now/CVE-2022-24875.md): Potential Secrets being logged to disk in CVEProject/cve-services (CVSS 5.3, CVEProject cve-services)
- [CVE-2022-24869](https://cve.now/CVE-2022-24869.md): Cross Site Scripting in GLPI (CVSS 4.6, glpi-project glpi)
- [CVE-2022-24868](https://cve.now/CVE-2022-24868.md): Cross site scripting via SVG file upload in GLPI (CVSS 7.3, glpi-project glpi)
- [CVE-2022-24867](https://cve.now/CVE-2022-24867.md): LDAP password exposure in glpi (CVSS 7.5, glpi-project glpi)
- [CVE-2021-41162](https://cve.now/CVE-2021-41162.md): Cross-site Scripting in Combodo iTop (CVSS 9.3, Combodo iTop)
- [CVE-2022-24870](https://cve.now/CVE-2022-24870.md): Stored Cross-site Scripting in Combodo iTop (CVSS 8.7, Combodo iTop)
- [CVE-2022-22436](https://cve.now/CVE-2022-22436.md): IBM Maximo Asset Management 7.6.1.2 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Maximo Asset Management)
- [CVE-2022-22435](https://cve.now/CVE-2022-22435.md): IBM Maximo Asset Management 7.6.1.2 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Maximo Asset Management)
- [CVE-2021-41161](https://cve.now/CVE-2021-41161.md): XSS in csvimport in 3.0.0-beta versions (CVSS 9.3, Combodo iTop)
- [CVE-2022-0272](https://cve.now/CVE-2022-0272.md): Improper Restriction of XML External Entity Reference in detekt/detekt (CVSS 7.3, detekt/detekt · io.gitlab.arturbosch.detekt:detekt-core)
- [CVE-2022-1022](https://cve.now/CVE-2022-1022.md): Cross-site Scripting (XSS) - Stored in chatwoot/chatwoot (CVSS 8.1, chatwoot/chatwoot)
- [CVE-2022-24272](https://cve.now/CVE-2022-24272.md): MongoDB Server (mongod) may crash in response to unexpected requests (CVSS 6.5, MongoDB Server)
- [CVE-2022-27237](https://cve.now/CVE-2022-27237.md): There is a cross-site scripting (XSS) vulnerability in an NI Web Server component installed with several NI products. (no CVSS)
- [CVE-2022-29498](https://cve.now/CVE-2022-29498.md): Blazer before 2.6.0 allows SQL Injection. (no CVSS, blazer)
- [CVE-2016-20014](https://cve.now/CVE-2016-20014.md): In pam\_tacplus.c in pam\_tacplus before 1.4.1, pam\_sm\_acct\_mgmt does not zero out the arep data structure. (no CVSS)
- [CVE-2022-29547](https://cve.now/CVE-2022-29547.md): The CreateRedirect extension before 2022-04-14 for MediaWiki does not properly check whether the user has permissions to edit the target pag (no CVSS)
- [CVE-2022-1420](https://cve.now/CVE-2022-1420.md): Use of Out-of-range Pointer Offset in vim/vim (CVSS 6.8, vim/vim)
- [CVE-2022-29548](https://cve.now/CVE-2022-29548.md): A reflected XSS issue exists in the Management Console of several WSO2 products. (CVSS 4.6)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-04-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.