CVEs published April 25, 2022
79 CVEs were published on April 25, 2022: 1 critical, 8 high.
- Published
- 79
- Critical
- 1
- High
- 8
- Medium
- 9
- Low
- 0
- Unrated
- 61
- Now in CISA KEV
- 0
- Fix available
- 39
Most affected products
- myCred
- 3
- openemr/openemr
- 3
- DW Question Answer Pro
- 2
- IBM Planning Analytics Workspace
- 2
- 5 Stars Rating Funnel WordPress Plugin | RRatingg
- 1
- Admin Word Count Column
- 1
- Advanced Page Visit Counter – Advanced WordPress Visit Coun…
- 1
- All F-Secure Endpoint Protection products on Windows and Ma…
- 1
- amr users
- 1
- Anti-Malware Security and Brute-Force Firewall
- 1
Critical 1
High 8
- CVE-2021-35250Directory Transversal Vulnerability in Serv-U 15.3SolarWinds Serv-U
- CVE-2022-25866Command Injectionczproject/git-php
- CVE-2022-1461Non Privilege User can Enable or Disable Registered in openemr/openemropenemr/openemr
- CVE-2022-1459Non-Privilege User Can View Patient’s Disclosures in openemr/openemropenemr/openemr
- CVE-2022-1458Stored XSS Leads To Session Hijacking in openemr/openemropenemr/openemr
- CVE-2021-40680There is a Directory Traversal vulnerability in Artica Proxy (4.30.000000 SP206 through SP255, and VMware appliance 4.30.000000 through SP27
- CVE-2022-23457Path Traversal in ESAPIOWASP ESAPI org.owasp.esapi:esapi · org.owasp.esapi:esapi
- CVE-2022-24792 Potential infinite loop when parsing WAV format file in PJSIPpjsip pjproject
Medium, low and unrated 70
- CVE-2022-24880Potential Captcha Validate Bypass in flask-session-captchaTethik flask-session-captcha · flask-session-captcha
- CVE-2022-29419WordPress 3xSocializer plugin <= 0.98.22 - Authenticated SQL Injection (SQLi) vulnerabilityDon Crowther 3xSocializer
- CVE-2022-29418WordPress Night Mode plugin <= 1.0.0 - Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilityMark Daniels Night Mode
- CVE-2022-29417WordPress ShortPixel Adaptive Images plugin <= 3.3.1 - Subscriber+ Plugin Settings Update vulnerabilityShortPixel Adaptive Images
- CVE-2022-0477An issue has been discovered in GitLab affecting all versions starting from 11.9 before 14.5.4, all versions starting from 14.6.0 before 14.GitLab
- CVE-2022-28290Reflective Cross-Site Scripting vulnerability in WordPress Country Selector Plugin Version 1.6.5.WordPress Country Selector Plugin
- CVE-2022-1396Donorbox < 7.1.7 - Admin+ Stored Cross-Site ScriptingDonorbox – Free Recurring Donation Form
- CVE-2022-1392Videos sync PDF <= 1.7.4 - Unauthenticated LFIVideos sync PDF
- CVE-2022-1391Cab fare calculator < 1.0.4 - Unauthenticated LFICab fare calculator
- CVE-2022-1390Admin Word Count Column <= 2.2 - Unauthenticated Arbitrary File ReadAdmin Word Count Column
- CVE-2022-1228Opensea < 1.0.3 - Admin+ Stored XSSOpensea
- CVE-2022-1156Books & Papers <= 0.20210223 - Admin+ Stored Cross-Site ScriptingBooks & Papers
- CVE-2022-1153LayerSlider < 7.1.2 - Admin+ Stored Cross-Site ScriptingLayerSlider
- CVE-2022-1152Menubar < 5.8 - Reflected Cross-Site ScriptingMenubar
- CVE-2022-1094Amr Users < 4.59.4 - Admin+ Stored Cross-Site Scriptingamr users
- CVE-2022-1092myCred < 2.4.4 - Subscriber+ Import/Export to Email Address DisclosuremyCred
- CVE-2022-1027Page Restriction WordPress < 1.2.7 - Admin+ Stored Cross-Site ScriptingPage Restriction WordPress (WP) – Protect WP Pages/Post
- CVE-2022-0953Anti-Malware Security and Brute-Force Firewall < 4.20.96 - Reflected Cross-Site ScriptingAnti-Malware Security and Brute-Force Firewall
- CVE-2022-0876Social comments by WpDevArt < 2.5.0 - Admin+ Stored Cross-Site ScriptingSocial comments by WpDevArt
- CVE-2022-0782Donations <= 1.8 - Unauthenticated SQLiDonations
- CVE-2022-0769Users Ultra <= 3.1.0 - Unauthenticated SQL InjectionUsers Ultra Membership, Users Community and Member Profiles…
- CVE-2022-0693Master Elements <= 8.0 - Unauthenticated SQLiMaster Elements
- CVE-2022-06575 Stars Rating Funnel < 1.2.53 - Unauthenticated SQLi5 Stars Rating Funnel WordPress Plugin | RRatingg
- CVE-2022-0656uDraw < 3.3.3 - Unauthenticated Arbitrary File AccessWeb To Print Shop : uDraw
- CVE-2022-0634ThirstyAffiliates < 3.10.5 - Subscriber+ unauthorized image upload + CSRFThirstyAffiliates
- CVE-2022-0541Flo Launch < 2.4.1 - Missing Authentication Allow Full Site Takeoverflo-launch
- CVE-2022-0398ThirstyAffiliates Affiliate Link Manager < 3.10.5 - Subscriber+ Arbitrary Affiliate Links CreationThirstyAffiliates Affiliate Link Manager
- CVE-2022-0363myCred < 2.4.4 - Subscriber+ Arbitrary Post CreationmyCred
- CVE-2022-0287Mycred < 2.4.4.1 - Subscriber+ User E-mail Addresses DisclosuremyCred
- CVE-2021-4225SP Project & Document Manager < 4.24 - Subscriber+ Shell UploadSP Project & Document Manager
- CVE-2021-46782Pricing Table by Supsystic < 1.9.5 - Reflected Cross-Site ScriptingPricing Table by Supsystic
- CVE-2021-46781Coming Soon by Supsystic < 1.7.6 - Reflected Cross-Site ScriptingComing Soon by Supsystic
- CVE-2021-46780Easy Google Maps < 1.9.32 - Reflected Cross-Site ScriptingEasy Google Maps
- CVE-2021-25111English WordPress Admin < 1.5.2 - Unauthenticated Open RedirectEnglish WordPress Admin
- CVE-2021-25094Tatsu < 3.3.12 - Unauthenticated RCETatsu
- CVE-2021-24957Advanced Page Visit Counter < 6.1.6 - Subscriber+ Blind SQL injectionAdvanced Page Visit Counter – Advanced WordPress Visit Coun…
- CVE-2021-24805DW Question & Answer Pro <= 1.3.4 - Multiple CSRFDW Question Answer Pro
- CVE-2021-24800DW Question & Answer Pro <= 1.3.4 - Arbitrary Comment Edition via IDORDW Question Answer Pro
- CVE-2022-27374Tenda AX12 V22.03.01.21_CN was discovered to contain a Cross-Site Request Forgery (CSRF) via the function sub_42E328 at /goform/SysToolReboo
- CVE-2022-27375Tenda AX12 V22.03.01.21_CN was discovered to contain a Cross-Site Request Forgery (CSRF) via the function sub_422168 at /goform/WifiExtraSet
- CVE-2022-26596Cross-site scripting (XSS) vulnerability in Journal module's web content display configuration page in Liferay Portal 7.1.0 through 7.3.3, acom.liferay:com.liferay.journal.content.web · com.liferay.p…
- CVE-2022-22392IBM Planning Analytics Local 2.0 could allow an attacker to upload arbitrary executable files which, when executed by an unsuspecting victimIBM Planning Analytics Workspace
- CVE-2021-39040IBM Planning Analytics Workspace 2.0 could be vulnerable to malicious file upload by not validating the file types or sizes.IBM Planning Analytics Workspace
- CVE-2022-26597Cross-site scripting (XSS) vulnerability in the Layout module's Open Graph integration in Liferay Portal 7.3.0 through 7.4.0, and Liferay DXcom.liferay:com.liferay.layout.seo.web · com.liferay.portal…
- CVE-2022-26111The BeanShell components of IRISNext through 9.8.28 allow execution of arbitrary commands on the target server by creating a custom search (
- CVE-2022-29078The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputejs
- CVE-2022-28094SCBS Online Sports Venue Reservation System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the fid parameter
- CVE-2022-28093SCBS Online Sports Venue Reservation System v1.0 was discovered to contain a local file inclusion vulnerability which allow attackers to exe
- CVE-2022-27311Gibbon v3.4.4 and below allows attackers to execute a Server-Side Request Forgery (SSRF) via a crafted URL.gibbon
- CVE-2022-28506There is a heap-buffer-overflow in GIFLIB 5.2.1 function DumpScreen2RGB() in gif2rgb.c:298:45.
- CVE-2022-27135xpdf 4.03 has heap buffer overflow in the function readXRefTable located in XRef.cc.
- CVE-2022-28053Typemill v1.5.3 was discovered to contain an arbitrary file upload vulnerability via the upload function.
- CVE-2022-27429Jizhicms v1.9.5 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via /admin.php/Plugins/update.html.
- CVE-2022-27428A stored cross-site scripting (XSS) vulnerability in /index.php/album/add of GalleryCMS v2.0 allows attackers to execute arbitrary web scrip
- CVE-2022-28586XSS in edit page of Hoosk 1.8.0 allows attacker to execute javascript code in user browser via edit page with XSS payload bypass filter some
- CVE-2022-27103element-plus 2.0.5 is vulnerable to Cross Site Scripting (XSS) via el-table-column.element-plus
- CVE-2021-36460VeryFitPro (com.veryfit2hr.second) 3.2.8 hashes the account's password locally on the device and uses the hash to authenticate in all commun
- CVE-2021-45836An authenticated attacker can execute arbitrary commands as root in Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517) by injecting a
- CVE-2021-45840It is possible to execute arbitrary commands as root in Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517) by sending specifically cra
- CVE-2021-45842It is possible to obtain the first administrator's hash set up in Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517) on the system as
- CVE-2022-28871Denial-of-Service (DoS) VulnerabilityAll F-Secure Endpoint Protection products on Windows and Ma…
- CVE-2022-29264An issue was discovered in coreboot 4.13 through 4.16.
- CVE-2022-29603A SQL Injection vulnerability exists in UniverSIS UniverSIS-API through 1.2.1 via the $select parameter to multiple API endpoints.
- CVE-2019-25059Artifex Ghostscript through 9.26 mishandles .completefont.
- CVE-2022-29077A heap-based buffer overflow exists in rippled before 1.8.5.
- CVE-2022-29546HtmlUnit NekoHtml Parser before 2.61.0 suffers from a denial of service vulnerability.net.sourceforge.htmlunit:neko-htmlunit
- CVE-2021-45837It is possible to execute arbitrary commands as root in Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517) by sending a specifically c
- CVE-2021-45839It is possible to obtain the first administrator's hash set up on the system in Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517) as
- CVE-2021-45841In Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517), an attacker can self-sign session cookies by knowing the target's MAC address a
- CVE-2022-1441MP4Box is a component of GPAC-2.0.0, which is a widely-used third-party package on RPM Fusion.gpac