# CVEs published 2022-04-22

45 CVEs were published on April 22, 2022: 4 critical, 6 high. Days are UTC.

- [CVE-2022-1427](https://cve.now/CVE-2022-1427.md): Out-of-bounds Read in mrb\_obj\_is\_kind\_of in in mruby/mruby (CVSS 7.7, mruby/mruby)
- [CVE-2021-3897](https://cve.now/CVE-2021-3897.md): An authentication bypass vulnerability was discovered in an internal service of the Lenovo Fan Power Controller2 (FPC2) and Lenovo System Ma (CVSS 9.8, Lenovo Fan Power Controller2 · Lenovo System Management Mod…)
- [CVE-2021-3849](https://cve.now/CVE-2021-3849.md): An authentication bypass vulnerability was discovered in the web interface of the Lenovo Fan Power Controller2 (FPC2) and Lenovo System Mana (CVSS 9.8, Lenovo Fan Power Controller2 · Lenovo System Management Mod…)
- [CVE-2022-1108](https://cve.now/CVE-2022-1108.md): A potential vulnerability due to improper buffer validation in the SMI handler LenovoFlashDeviceInterface in Thinkpad X1 Fold Gen 1 could be (CVSS 6.7, Lenovo ThinkPad BIOS)
- [CVE-2022-1107](https://cve.now/CVE-2022-1107.md): During an internal product security audit a potential vulnerability due to use of Boot Services in the SmmOEMInt15 SMI handler was discovere (CVSS 6.7, Lenovo ThinkPad BIOS)
- [CVE-2022-0636](https://cve.now/CVE-2022-0636.md): A denial of service vulnerability was reported in Lenovo Thin Installer prior to version 1.3.0039 that could trigger a system crash. (CVSS 5.0, Lenovo Thin Installer)
- [CVE-2022-0354](https://cve.now/CVE-2022-0354.md): A vulnerability was reported in Lenovo System Update that could allow a local user with interactive system access the ability to execute cod (CVSS 7.3, Lenovo System Update)
- [CVE-2022-0192](https://cve.now/CVE-2022-0192.md): A DLL search path vulnerability was reported in Lenovo PCManager prior to version 4.0.40.2175 that could allow privilege escalation. (CVSS 7.3, Lenovo PCManager)
- [CVE-2021-4212](https://cve.now/CVE-2021-4212.md): A potential vulnerability in the SMI callback function used in the Legacy BIOS mode driver in some Lenovo Notebook models may allow an attac (CVSS 6.7, Lenovo BIOS)
- [CVE-2021-4211](https://cve.now/CVE-2021-4211.md): A potential vulnerability in the SMI callback function used in the SMBIOS event log driver in some Lenovo Desktop, ThinkStation, and ThinkEd (CVSS 6.7, Lenovo BIOS)
- [CVE-2021-4210](https://cve.now/CVE-2021-4210.md): A potential vulnerability in the SMI callback function used in the NVME driver in some Lenovo Desktop, ThinkStation, and ThinkEdge models ma (CVSS 6.7, Lenovo BIOS)
- [CVE-2021-3972](https://cve.now/CVE-2021-3972.md): A potential vulnerability by a driver used during manufacturing process on some consumer Lenovo Notebook devices' BIOS that was mistakenly n (CVSS 6.7, Lenovo Notebook BIOS)
- [CVE-2021-3971](https://cve.now/CVE-2021-3971.md): A potential vulnerability by a driver used during older manufacturing processes on some consumer Lenovo Notebook devices that was mistakenly (CVSS 6.7, Lenovo Notebook BIOS)
- [CVE-2021-3970](https://cve.now/CVE-2021-3970.md): A potential vulnerability in LenovoVariable SMI Handler due to insufficient validation in some Lenovo Notebook models BIOS may allow an atta (CVSS 6.7, Lenovo Notebook BIOS)
- [CVE-2021-3898](https://cve.now/CVE-2021-3898.md): Versions of Motorola Ready For and Motorola Device Help Android applications prior to 2021-04-08 do not properly verify the server certifica (CVSS 6.8, Motorola Device Help Android App · Motorola Ready For Andro…)
- [CVE-2021-3722](https://cve.now/CVE-2021-3722.md): A denial of service vulnerability was reported in Lenovo PCManager prior to version 4.0.40.2175 that could allow configuration files to be w (CVSS 5.0, Lenovo PCManager)
- [CVE-2021-3721](https://cve.now/CVE-2021-3721.md): A denial of service vulnerability was reported in Lenovo PCManager prior to version 4.0.20.10282 that could allow an attacker with local acc (CVSS 5.5, Lenovo PCManager)
- [CVE-2022-27341](https://cve.now/CVE-2022-27341.md): JFinalCMS v2.0 was discovered to contain a SQL injection vulnerability via the Article Management function. (no CVSS)
- [CVE-2022-27342](https://cve.now/CVE-2022-27342.md): Link-Admin v0.0.1 was discovered to contain a SQL injection vulnerability via DictRest.ResponseResult(). (no CVSS)
- [CVE-2022-27340](https://cve.now/CVE-2022-27340.md): MCMS v5.2.7 contains a Cross-Site Request Forgery (CSRF) via /role/saveOrUpdateRole.do. (no CVSS, net.mingsoft:ms-mcms)
- [CVE-2022-1440](https://cve.now/CVE-2022-1440.md): Command Injection vulnerability in git-interface@2.1.1 in yarkeev/git-interface (CVSS 9.8, yarkeev/git-interface · git-interface)
- [CVE-2021-38946](https://cve.now/CVE-2021-38946.md): IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Cognos Analytics)
- [CVE-2021-38905](https://cve.now/CVE-2021-38905.md): IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 could allow an authenticated user to view report pages that they should not have access to. (CVSS 4.3, IBM Cognos Analytics)
- [CVE-2021-38904](https://cve.now/CVE-2021-38904.md): IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 could allow a remote attacker to obtain credentials from a user's browser via incorrect auto (CVSS 4.6, IBM Cognos Analytics)
- [CVE-2021-38903](https://cve.now/CVE-2021-38903.md): IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. (CVSS 5.4, IBM Cognos Analytics)
- [CVE-2021-38886](https://cve.now/CVE-2021-38886.md): IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicio (CVSS 4.3, IBM Cognos Analytics)
- [CVE-2021-29824](https://cve.now/CVE-2021-29824.md): IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to priviledge escalation where a lower level user could have read access to to (CVSS 3.1, IBM Cognos Analytics)
- [CVE-2021-20464](https://cve.now/CVE-2021-20464.md): IBM Cognos Analytics PowerPlay (IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7) could be vulnerable to an XML Bomb attack by a malicious au (CVSS 6.5, IBM Cognos Analytics)
- [CVE-2022-1439](https://cve.now/CVE-2022-1439.md): Reflected XSS on demo.microweber.org/demo/module/ in microweber/microweber (CVSS 6.3, microweber/microweber)
- [CVE-2022-29589](https://cve.now/CVE-2022-29589.md): Crypt Server before 3.3.0 allows XSS in the index view. (no CVSS)
- [CVE-2020-14123](https://cve.now/CVE-2020-14123.md): There is a pointer double free vulnerability in Some MIUI Services. (no CVSS, MIUI)
- [CVE-2021-32927](https://cve.now/CVE-2021-32927.md): Uffizio GPS Tracker Cross-site Scripting (CVSS 7.1, Uffizio GPS Tracker)
- [CVE-2021-32929](https://cve.now/CVE-2021-32929.md): Uffizio GPS Tracker Cross-site Request Forgery (CVSS 4.3, Uffizio GPS Tracker)
- [CVE-2021-36203](https://cve.now/CVE-2021-36203.md): Johnson Controls Metasys SCT Pro (CVSS 5.3, Johnnson Controls Metasys System Configuration Tool)
- [CVE-2022-1437](https://cve.now/CVE-2022-1437.md): Heap-based Buffer Overflow in radareorg/radare2 (CVSS 5.3, radareorg/radare2)
- [CVE-2022-28074](https://cve.now/CVE-2022-28074.md): Halo-1.5.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via \\admin\\index.html#/system/tools. (no CVSS)
- [CVE-2022-1429](https://cve.now/CVE-2022-1429.md): SQL injection in GridHelperService.php in pimcore/pimcore (CVSS 7.2, pimcore/pimcore)
- [CVE-2022-26674](https://cve.now/CVE-2022-26674.md): ASUS RT-AX88U - Format String (CVSS 9.8, ASUS RT-AX88U)
- [CVE-2022-26673](https://cve.now/CVE-2022-26673.md): ASUS RT-AX88U - Stored XSS (CVSS 5.4, ASUS RT-AX88U)
- [CVE-2022-26672](https://cve.now/CVE-2022-26672.md): ASUS WebStorage - Use of Hard-coded Credentials (CVSS 7.3, ASUS WebStorage)
- [CVE-2022-27404](https://cve.now/CVE-2022-27404.md): FreeType commit 1e2eb65048f75c64b68708efed6ce904c31f3b2f was discovered to contain a heap buffer overflow via the function sfnt\_init\_face. (no CVSS)
- [CVE-2022-27405](https://cve.now/CVE-2022-27405.md): FreeType commit 53dfdcd8198d2b3201a23c4bad9190519ba918db was discovered to contain a segmentation violation via the function FNT\_Size\_Reques (no CVSS)
- [CVE-2022-27406](https://cve.now/CVE-2022-27406.md): FreeType commit 22a0cccb4d9d002f33c1ba7a4b36812c7d4f46b5 was discovered to contain a segmentation violation via the function FT\_Request\_Size (no CVSS)
- [CVE-2022-29582](https://cve.now/CVE-2022-29582.md): In the Linux kernel before 5.17.3, fs/io\_uring.c has a use-after-free due to a race condition in io\_uring timeouts. (no CVSS)
- [CVE-2022-29583](https://cve.now/CVE-2022-29583.md): service\_windows.go in the kardianos service package for Go omits quoting that is sometimes needed for execution of a Windows service executa (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-04-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.