CVEs published April 26, 2022
36 CVEs were published on April 26, 2022: 3 critical, 5 high. 2 are now in CISA KEV.
- Published
- 36
- Critical
- 3
- High
- 5
- Medium
- 5
- Low
- 0
- Unrated
- 23
- Now in CISA KEV
- 2
- Fix available
- 7
Most affected products
- Alexander Ustimenko Psychological tests & quizzes
- 2
- FreeRDP
- 2
- Apache Software Foundation Apache CouchDB
- 1
- Apache Software Foundation Apache Doris · pydoris
- 1
- ballcat-projects ballcat-codegen · com.hccake:ballcat-codeg…
- 1
- discourse-assign
- 1
- getgrav/grav
- 1
- No Vendor Information MaxBoard
- 1
- Palantir Foundry Issues
- 1
- rhsso · org.keycloak:keycloak-core
- 1
Critical 3
- CVE-2022-29499The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorrect data validation.
- CVE-2022-24706Remote Code Execution Vulnerability in PackagingApache Software Foundation Apache CouchDB
- CVE-2022-24882Server side NTLM does not properly check parameters in FreeRDPFreeRDP
High 5
- CVE-2021-26628MaxBoard XSS and File Upload VulnerabilityNo Vendor Information MaxBoard
- CVE-2021-26629tobesoft XPLATFORM Path Traversal Vulnerabilitytobesoft Co. XPLATFORM
- CVE-2022-1173stored xss in getgrav/gravgetgrav/grav
- CVE-2022-24881Command Injection in Ballcat Codegenballcat-projects ballcat-codegen · com.hccake:ballcat-codeg…
- CVE-2022-24883FreeRDP Server authentication might allow invalid credentials to passFreeRDP
Medium, low and unrated 28
- CVE-2022-27888The Foundry Issues service was found to be logging in a manner that captured session tokens.Palantir Foundry Issues
- CVE-2022-26564HotelDruid Hotel Management Software v3.0.3 contains a cross-site scripting (XSS) vulnerability via the prezzoperiodo4 parameter in creaprez
- CVE-2022-28918GreenCMS v2.3.0603 was discovered to contain an arbitrary file deletion vulnerability via /index.php?m=admin&c=custom&a=plugindelhandle&plug
- CVE-2022-28527dhcms v20170919 was discovered to contain an arbitrary folder deletion vulnerability via /admin.php?r=admin/AdminBackup/del.
- CVE-2022-28528bloofoxCMS v0.5.2.1 was discovered to contain an arbitrary file upload vulnerability via /admin/index.php?mode=content&page=media&action=edi
- CVE-2022-28524ED01-CMS v20180505 was discovered to contain a SQL injection vulnerability via the component post.php.
- CVE-2022-28525ED01-CMS v20180505 was discovered to contain an arbitrary file upload vulnerability via /admin/users.php?source=edit_user&id=1.
- CVE-2022-28522ZCMS v20170206 was discovered to contain a stored cross-site scripting (XSS) vulnerability via index.php?m=home&c=message&a=add.
- CVE-2022-28523HongCMS 3.0.0 allows arbitrary file deletion via the component /admin/index.php/template/ajax?action=delete.
- CVE-2022-28521ZCMS v20170206 was discovered to contain a file inclusion vulnerability via index.php?m=home&c=home&a=sp_set_config.
- CVE-2022-28058Verydows v2.0 was discovered to contain an arbitrary file deletion vulnerability via \backend\file_controller.php.
- CVE-2022-28059Verydows v2.0 was discovered to contain an arbitrary file deletion vulnerability via \backend\database_controller.php.
- CVE-2022-28450nopCommerce 4.50.1 is vulnerable to Cross Site Scripting (XSS) via the "Text" parameter (forums) when creating a new post, which allows a re
- CVE-2022-28449nopCommerce 4.50.1 is vulnerable to Cross Site Scripting (XSS).
- CVE-2022-28448nopCommerce 4.50.1 is vulnerable to Cross Site Scripting (XSS).
- CVE-2022-24866Exposure of Sensitive Information to an Unauthorized Actor in Discourse Assigndiscourse-assign
- CVE-2022-27854WordPress Psychological tests & quizzes plugin <= 0.21.19 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityAlexander Ustimenko Psychological tests & quizzes
- CVE-2022-1466Due to improper authorization, Red Hat Single Sign-On is vulnerable to users performing actions that they should not be allowed to perform.rhsso · org.keycloak:keycloak-core
- CVE-2021-36895WordPress Tripetto plugin <= 5.1.4 - Unauthenticated Cross-Site Scripting (XSS) vulnerability via SVG image uploadTripetto
- CVE-2021-36867WordPress Psychological tests & quizzes plugin <= 0.21.19 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityAlexander Ustimenko Psychological tests & quizzes
- CVE-2022-28218An issue was discovered in CipherMail Webmail Messenger 1.1.1 through 4.1.4.
- CVE-2022-23942Apache Doris hardcoded cryptography initializationApache Software Foundation Apache Doris · pydoris
- CVE-2022-27985CuppaCMS v1.0 was discovered to contain a SQL injection vulnerability via /administrator/alerts/alertLightbox.php.
- CVE-2022-27984CuppaCMS v1.0 was discovered to contain a SQL injection vulnerability via the menu_filter parameter at /administrator/templates/default/html
- CVE-2022-27469Monstaftp v2.10.3 was discovered to allow attackers to execute Server-Side Request Forgery (SSRF).
- CVE-2022-27468Monstaftp v2.10.3 was discovered to contain an arbitrary file upload which allows attackers to execute arbitrary code via a crafted file upl
- CVE-2022-27299Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the component room.php.
- CVE-2022-29806ZoneMinder before 1.36.13 allows remote code execution via an invalid language.