CVEs published April 22, 2022
45 CVEs were published on April 22, 2022: 4 critical, 6 high.
- Published
- 45
- Critical
- 4
- High
- 6
- Medium
- 23
- Low
- 1
- Unrated
- 11
- Now in CISA KEV
- 0
- Fix available
- 12
Most affected products
- IBM Cognos Analytics
- 7
- Lenovo BIOS
- 3
- Lenovo Notebook BIOS
- 3
- Lenovo PCManager
- 3
- ASUS RT-AX88U
- 2
- Lenovo Fan Power Controller2 · Lenovo System Management Mod…
- 2
- Lenovo ThinkPad BIOS
- 2
- Uffizio GPS Tracker
- 2
- ASUS WebStorage
- 1
- Johnnson Controls Metasys System Configuration Tool
- 1
Critical 4
- CVE-2021-3897An authentication bypass vulnerability was discovered in an internal service of the Lenovo Fan Power Controller2 (FPC2) and Lenovo System MaLenovo Fan Power Controller2 · Lenovo System Management Mod…
- CVE-2021-3849An authentication bypass vulnerability was discovered in the web interface of the Lenovo Fan Power Controller2 (FPC2) and Lenovo System ManaLenovo Fan Power Controller2 · Lenovo System Management Mod…
- CVE-2022-1440Command Injection vulnerability in git-interface@2.1.1 in yarkeev/git-interfaceyarkeev/git-interface · git-interface
- CVE-2022-26674ASUS RT-AX88U - Format StringASUS RT-AX88U
High 6
- CVE-2022-1427Out-of-bounds Read in mrb_obj_is_kind_of in in mruby/mrubymruby/mruby
- CVE-2022-0354A vulnerability was reported in Lenovo System Update that could allow a local user with interactive system access the ability to execute codLenovo System Update
- CVE-2022-0192A DLL search path vulnerability was reported in Lenovo PCManager prior to version 4.0.40.2175 that could allow privilege escalation.Lenovo PCManager
- CVE-2021-32927Uffizio GPS Tracker Cross-site ScriptingUffizio GPS Tracker
- CVE-2022-1429SQL injection in GridHelperService.php in pimcore/pimcorepimcore/pimcore
- CVE-2022-26672ASUS WebStorage - Use of Hard-coded CredentialsASUS WebStorage
Medium, low and unrated 35
- CVE-2022-1108A potential vulnerability due to improper buffer validation in the SMI handler LenovoFlashDeviceInterface in Thinkpad X1 Fold Gen 1 could beLenovo ThinkPad BIOS
- CVE-2022-1107During an internal product security audit a potential vulnerability due to use of Boot Services in the SmmOEMInt15 SMI handler was discovereLenovo ThinkPad BIOS
- CVE-2022-0636A denial of service vulnerability was reported in Lenovo Thin Installer prior to version 1.3.0039 that could trigger a system crash.Lenovo Thin Installer
- CVE-2021-4212A potential vulnerability in the SMI callback function used in the Legacy BIOS mode driver in some Lenovo Notebook models may allow an attacLenovo BIOS
- CVE-2021-4211A potential vulnerability in the SMI callback function used in the SMBIOS event log driver in some Lenovo Desktop, ThinkStation, and ThinkEdLenovo BIOS
- CVE-2021-4210A potential vulnerability in the SMI callback function used in the NVME driver in some Lenovo Desktop, ThinkStation, and ThinkEdge models maLenovo BIOS
- CVE-2021-3972A potential vulnerability by a driver used during manufacturing process on some consumer Lenovo Notebook devices' BIOS that was mistakenly nLenovo Notebook BIOS
- CVE-2021-3971A potential vulnerability by a driver used during older manufacturing processes on some consumer Lenovo Notebook devices that was mistakenlyLenovo Notebook BIOS
- CVE-2021-3970A potential vulnerability in LenovoVariable SMI Handler due to insufficient validation in some Lenovo Notebook models BIOS may allow an attaLenovo Notebook BIOS
- CVE-2021-3898Versions of Motorola Ready For and Motorola Device Help Android applications prior to 2021-04-08 do not properly verify the server certificaMotorola Device Help Android App · Motorola Ready For Andro…
- CVE-2021-3722A denial of service vulnerability was reported in Lenovo PCManager prior to version 4.0.40.2175 that could allow configuration files to be wLenovo PCManager
- CVE-2021-3721A denial of service vulnerability was reported in Lenovo PCManager prior to version 4.0.20.10282 that could allow an attacker with local accLenovo PCManager
- CVE-2022-27341JFinalCMS v2.0 was discovered to contain a SQL injection vulnerability via the Article Management function.
- CVE-2022-27342Link-Admin v0.0.1 was discovered to contain a SQL injection vulnerability via DictRest.ResponseResult().
- CVE-2022-27340MCMS v5.2.7 contains a Cross-Site Request Forgery (CSRF) via /role/saveOrUpdateRole.do.net.mingsoft:ms-mcms
- CVE-2021-38946IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to cross-site scripting.IBM Cognos Analytics
- CVE-2021-38905IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 could allow an authenticated user to view report pages that they should not have access to.IBM Cognos Analytics
- CVE-2021-38904IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 could allow a remote attacker to obtain credentials from a user's browser via incorrect autoIBM Cognos Analytics
- CVE-2021-38903IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input.IBM Cognos Analytics
- CVE-2021-38886IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicioIBM Cognos Analytics
- CVE-2021-29824IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to priviledge escalation where a lower level user could have read access to toIBM Cognos Analytics
- CVE-2021-20464IBM Cognos Analytics PowerPlay (IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7) could be vulnerable to an XML Bomb attack by a malicious auIBM Cognos Analytics
- CVE-2022-1439Reflected XSS on demo.microweber.org/demo/module/ in microweber/microwebermicroweber/microweber
- CVE-2022-29589Crypt Server before 3.3.0 allows XSS in the index view.
- CVE-2020-14123There is a pointer double free vulnerability in Some MIUI Services.MIUI
- CVE-2021-32929Uffizio GPS Tracker Cross-site Request ForgeryUffizio GPS Tracker
- CVE-2021-36203Johnson Controls Metasys SCT ProJohnnson Controls Metasys System Configuration Tool
- CVE-2022-1437Heap-based Buffer Overflow in radareorg/radare2radareorg/radare2
- CVE-2022-28074Halo-1.5.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via \admin\index.html#/system/tools.
- CVE-2022-26673ASUS RT-AX88U - Stored XSSASUS RT-AX88U
- CVE-2022-27404FreeType commit 1e2eb65048f75c64b68708efed6ce904c31f3b2f was discovered to contain a heap buffer overflow via the function sfnt_init_face.
- CVE-2022-27405FreeType commit 53dfdcd8198d2b3201a23c4bad9190519ba918db was discovered to contain a segmentation violation via the function FNT_Size_Reques
- CVE-2022-27406FreeType commit 22a0cccb4d9d002f33c1ba7a4b36812c7d4f46b5 was discovered to contain a segmentation violation via the function FT_Request_Size
- CVE-2022-29582In the Linux kernel before 5.17.3, fs/io_uring.c has a use-after-free due to a race condition in io_uring timeouts.
- CVE-2022-29583service_windows.go in the kardianos service package for Go omits quoting that is sometimes needed for execution of a Windows service executa