CVEs published April 27, 2022
63 CVEs were published on April 27, 2022: 1 critical, 7 high.
- Published
- 63
- Critical
- 1
- High
- 7
- Medium
- 19
- Low
- 9
- Unrated
- 27
- Now in CISA KEV
- 0
- Fix available
- 21
Most affected products
- Bender / ebee CC612 · Bender / ebee CC613 +2
- 8
- IBM QRadar SIEM
- 7
- nextcloud security-advisories
- 5
- NVIDIA Jetson AGX Xavier series, Jetson Xavier NX
- 4
- SonicWall SonicOS
- 4
- IBM Security Verify Password Synchronization Plug-in for Wi…
- 2
- redis
- 2
- AMD-Xilinx Zynq-7000 SoC FSBL
- 1
- apicast
- 1
- esapi-java-legacy · org.owasp.esapi:esapi
- 1
Critical 1
High 7
- CVE-2022-28194NVIDIA Jetson Linux Driver Package contains a vulnerability in the Cboot module tegrabl_cbo.c, where, if TFTP is enabled, a local attacker wNVIDIA Jetson AGX Xavier series, Jetson Xavier NX
- CVE-2022-22521Privilege Escalation in Miele Benchmark Programming ToolMiele Benchmark Programming Tool
- CVE-2021-34602Bender Charge Controller: Long URL could lead to webserver crashBender / ebee CC612 · Bender / ebee CC613 +2
- CVE-2021-34592Bender Charge Controller: Command injection via Web interfaceBender / ebee CC612 · Bender / ebee CC613 +2
- CVE-2021-34591Bender Charge Controller: Local privilege EscalationBender / ebee CC612 · Bender / ebee CC613 +2
- CVE-2021-34589Bender Charge Controller: RFID leakBender / ebee CC612 · Bender / ebee CC613 +2
- CVE-2021-34588Bender Charge Controller: Unprotected data exportBender / ebee CC612 · Bender / ebee CC613 +2
Medium, low and unrated 55
- CVE-2022-29859component/common/network/dhcp/dhcps.c in ambiot amb1_sdk (aka SDK for Ameba1) before 2022-03-11 mishandles data structures for DHCP packet d
- CVE-2021-3523A flaw was found in 3Scale APICast in versions prior to 2.11.0, where it incorrectly identified connections for reuse.apicast
- CVE-2022-24736A Malformed Lua script can crash Redisredis
- CVE-2022-24735Lua scripts can be manipulated to overcome ACL rules in Redisredis
- CVE-2022-28197NVIDIA Jetson Linux Driver Package contains a vulnerability in the Cboot ext4_mount function, where Insufficient validation of untrusted datNVIDIA Jetson AGX Xavier series, Jetson Xavier NX
- CVE-2022-28196NVIDIA Jetson Linux Driver Package contains a vulnerability in the Cboot blob_decompress function, where insufficient validation of untrusteNVIDIA Jetson AGX Xavier series, Jetson Xavier NX, Jetson T…
- CVE-2022-28195NVIDIA Jetson Linux Driver Package contains a vulnerability in the Cboot ext4_read_file function, where insufficient validation of untrustedNVIDIA Jetson AGX Xavier series, Jetson Xavier NX
- CVE-2022-28193NVIDIA Jetson Linux Driver Package contains a vulnerability in the Cboot module tegrabl_cbo.c, where insufficient validation of untrusted daNVIDIA Jetson AGX Xavier series, Jetson Xavier NX
- CVE-2022-22315IBM UrbanCode Deploy (UCD) 7.2.2.1 could allow an authenticated user with special permissions to obtain elevated privileges due to improper IBM UrbanCode Deploy
- CVE-2022-24372Linksys MR9600 devices before 2.0.5 allow attackers to read arbitrary files via a symbolic link to the root directory of a NAS SMB share.
- CVE-2022-1507chafa: NULL Pointer Dereference in function gif_internal_decode_frame at libnsgif.c:599 allows attackers to cause a denial of service (crash) via a crafted input file. in hpjansson/chafahpjansson/chafa
- CVE-2021-25266An insecure data storage vulnerability allows a physical attacker with root privileges to retrieve TOTP secret keys from unlocked phones in Sophos Intercept X for Mobile · Sophos Authenticator
- CVE-2022-22278A vulnerability in SonicOS CFS (Content filtering service) returns a large 403 forbidden HTTP response message to the source address when usSonicWall SonicOS
- CVE-2022-22277A vulnerability in SonicOS SNMP service resulting exposure of Wireless Access Point sensitive information in cleartext.SonicWall SonicOS
- CVE-2022-22276A vulnerability in SonicOS SNMP service resulting exposure of sensitive information to an unauthorized user.SonicWall SonicOS
- CVE-2022-22275Improper Restriction of TCP Communication Channel in HTTP/S inbound traffic from WAN to DMZ bypassing security policy until TCP handshake poSonicWall SonicOS
- CVE-2022-23822In this physical attack, an attacker may potentially exploit the Zynq-7000 SoC First Stage Boot Loader (FSBL) by bypassing authentication anAMD-Xilinx Zynq-7000 SoC FSBL
- CVE-2022-22345IBM QRadar 7.3, 7.4, and 7.5 is vulnerable to cross-site scripting.IBM QRadar SIEM
- CVE-2022-22323IBM Security Identity Manager (IBM Security Verify Password Synchronization Plug-in for Windows AD 10.x) is vulnerable to a denial of servicIBM Security Verify Password Synchronization Plug-in for Wi…
- CVE-2022-22312IBM Security Identity Manager (IBM Security Verify Password Synchronization Plug-in for Windows AD 10.x) is vulnerable to a denial of servicIBM Security Verify Password Synchronization Plug-in for Wi…
- CVE-2021-38939IBM QRadar SIEM 7.3, 7.4, and 7.5 stores potentially sensitive information in log files that could be read by an user with access to creatinIBM QRadar SIEM
- CVE-2021-38919IBM QRadar SIEM 7.3, 7.4, and 7.5 in some senarios may reveal authorized service tokens to other QRadar users.IBM QRadar SIEM
- CVE-2021-38878IBM QRadar 7.3, 7.4, and 7.5 could allow a malicious actor to impersonate an actor due to key exchange without entity authentication.IBM QRadar SIEM
- CVE-2021-38874IBM QRadar SIEM 7.3, 7.4, and 7.5 allows for users to access information across tenant and domain boundaries in some situations.IBM QRadar SIEM
- CVE-2021-38869IBM QRadar SIEM 7.3, 7.4, and 7.5 in some situations may not automatically log users out after they exceede their idle timeout.IBM QRadar SIEM
- CVE-2021-29776IBM QRadar SIEM 7.3, 7.4, and 7.5 could allow an authenticated user to obtain sensitive information from another user's dashboard providing IBM QRadar SIEM
- CVE-2022-27336Seacms v11.6 was discovered to contain a remote code execution (RCE) vulnerability via the component /admin/weixin.php.
- CVE-2021-34590Bender Charge Controller: Cross-site ScriptingBender / ebee CC612 · Bender / ebee CC613 +2
- CVE-2021-34587Bender Charge Controller: Long URL could lead to webserver crashBender / ebee CC612 · Bender / ebee CC613 +2
- CVE-2022-24889Insufficient Verification of Data Authenticity in Nextcloud Servernextcloud security-advisories
- CVE-2022-29505Due to build misconfiguration in openssl dependency, LINE for Windows before 7.8 is vulnerable to DLL injection that could lead to privilegeLINE for Windows
- CVE-2022-24888Possible Injection in Nextcloud Servernextcloud security-advisories
- CVE-2022-27905In ControlUp Real-Time Agent before 8.6, an unquoted path can result in privilege escalation.
- CVE-2022-24887Open Redirect in Nextcloud Talknextcloud security-advisories
- CVE-2022-24886Exposure of Sensitive Information to an Unauthorized Actor in com.nextcloud.clientnextcloud security-advisories
- CVE-2022-24885Improper Authentication in Nextcloud Android Filesnextcloud security-advisories
- CVE-2022-28464Apifox through 2.1.6 is vulnerable to Cross Site Scripting (XSS) which can lead to remote code execution.
- CVE-2021-46424Telesquare TLR-2005KSH 1.0.0 is affected by an arbitrary file deletion vulnerability that allows a remote attacker to delete any file, even
- CVE-2021-46423Telesquare TLR-2005KSH 1.0.0 is affected by an unauthenticated file download vulnerability that allows a remote attacker to download a full
- CVE-2021-46422Telesquare SDT-CW3B1 1.1.0 is affected by an OS command injection vulnerability that allows a remote attacker to execute OS commands without
- CVE-2021-46421Franklin Fueling Systems FFS T5 Series 1.8.7.7299 is affected by an unauthenticated directory traversal vulnerability, which allows an attac
- CVE-2021-46420Franklin Fueling Systems FFS TS-550 evo 2.23.4.8936 is affected by an unauthenticated directory traversal vulnerability, which allows an att
- CVE-2022-1504XSS in /demo/module/?module=HERE in microweber/microwebermicroweber/microweber
- CVE-2021-46441In the "webupg" binary of D-Link DIR-825 G1, because of the lack of parameter verification, attackers can use "cmd" parameters to execute ar
- CVE-2021-46442In the "webupg" binary of D-Link DIR-825 G1, attackers can bypass authentication through parameters "autoupgrade.asp", and perform functions
- CVE-2022-1503GetSimple CMS Content Module edit.php cross site scriptingGetSimple CMS
- CVE-2022-29810The Hashicorp go-getter library before 1.5.11 does not redact an SSH key from a URL query parameter.github.com/hashicorp/go-getter
- CVE-2022-29700A lack of password length restriction in Zammad v5.1.0 allows for the creation of extremely long passwords which can cause a Denial of Servi
- CVE-2022-29701A lack of rate limiting in the 'forgot password' feature of Zammad v5.1.0 allows attackers to send an excessive amount of reset requests for
- CVE-2022-27332An access control issue in Zammad v5.0.3 allows attackers to write entries to the CTI caller log without authentication.
- CVE-2022-27331An access control issue in Zammad v5.0.3 broadcasts administrative configuration changes to all users who have an active application instanc
- CVE-2022-28085A flaw was found in htmldoc commit 31f7804.
- CVE-2021-41041In Eclipse Openj9 before version 0.32.0, Java 8 & 11 fail to throw the exception captured during bytecode verification when verification is The Eclipse Foundation Eclipse OpenJ9
- CVE-2022-24891Cross-site Scripting in org.owasp.esapi:esapi -- antisamy-esapi.xml configuration fileesapi-java-legacy · org.owasp.esapi:esapi
- CVE-2022-27239In cifs-utils through 6.14, a stack-based buffer overflow when parsing the mount.cifs ip= command-line argument could lead to local attacker