CVEs published April 28, 2022
57 CVEs were published on April 28, 2022: 4 critical, 6 high.
- Published
- 57
- Critical
- 4
- High
- 6
- Medium
- 21
- Low
- 5
- Unrated
- 21
- Now in CISA KEV
- 0
- Fix available
- 21
Most affected products
- JetBrains IntelliJ IDEA
- 8
- IBM InfoSphere Information Server
- 5
- Elcomplus SmartPTT
- 4
- Mufeng Hermit 音乐播放器
- 4
- shopware · shopware/shopware
- 3
- Hammock AssetView
- 1
- hestiacp/hestiacp
- 1
- httpx
- 1
- JetBrains Hub
- 1
- JetBrains PyCharm
- 1
Critical 4
- CVE-2022-1514Stored XSS via upload plugin functionality in zip format in neorazorx/facturascriptsneorazorx/facturascripts · facturascripts/facturascripts
- CVE-2021-43932Elcomplus SmartPtt Cross-site ScriptingElcomplus SmartPTT
- CVE-2021-43934Elcomplus SmartPtt Unrestricted Upload of File with Dangerous TypeElcomplus SmartPTT
- CVE-2022-1509Command Injection Vulnerability in hestiacp/hestiacphestiacp/hestiacp
High 6
- CVE-2022-29411WordPress Hermit 音乐播放器 plugin <= 3.1.6 - Unauthenticated SQL Injection SQLi) vulnerabilityMufeng Hermit 音乐播放器
- CVE-2022-29410WordPress Hermit 音乐播放器 plugin <= 3.1.6 - Authenticated SQL Injection (SQLi) vulnerabilityMufeng Hermit 音乐播放器
- CVE-2022-22782Local privilege escalation in Windows Zoom ClientsZoom Video Communications Zoom Client for Meetings for W… +2
- CVE-2022-22781Update package downgrade in Zoom Client for Meetings for MacOSZoom Video Communications Zoom Client for Meetings for MacOS
- CVE-2021-43939Elcomplus SmartPtt Improper AuthorizationElcomplus SmartPTT
- CVE-2022-24879Malfunction of Cross-Site Request Forgery token validationshopware · shopware/shopware
Medium, low and unrated 47
- CVE-2022-24449Solar appScreener through 3.10.4, when a valid license is not present, allows XXE and SSRF attacks via a crafted XML document.
- CVE-2022-28454Limbas 4.3.36.1319 is vulnerable to Cross Site Scripting (XSS).
- CVE-2022-29556The iot-manager microservice 1.0.0 in Northern.tech Mender Enterprise before 3.2.2 allows SSRF because the Azure IoT Hub integration provide
- CVE-2022-29555The Deviceconnect microservice through 1.3.0 in Northern.tech Mender Enterprise before 3.2.2.
- CVE-2022-28477WBCE CMS 1.5.2 is vulnerable to Cross Site Scripting (XSS).
- CVE-2022-24898Arbitrary file access through XML parsing in org.xwiki.commons:xwiki-commons-xmlxwiki-commons · org.xwiki.commons:xwiki-commons-xml
- CVE-2022-28060SQL Injection vulnerability in Victor CMS v1.0, via the user_name parameter to /includes/login.php.
- CVE-2022-29081Zoho ManageEngine Access Manager Plus before 4302, Password Manager Pro before 12007, and PAM360 before 5401 are vulnerable to access-contro
- CVE-2022-29412WordPress Hermit 音乐播放器 plugin <= 3.1.6 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilitiesMufeng Hermit 音乐播放器
- CVE-2022-29413WordPress Hermit 音乐播放器 plugin <= 3.1.6 - Cross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS) vulnerabilityMufeng Hermit 音乐播放器
- CVE-2022-22443IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting.IBM InfoSphere Information Server
- CVE-2022-22441IBM InfoSphere Information Server 11.7 could allow an authenticated user to view information of higher privileged users and groups due to a IBM InfoSphere Information Server
- CVE-2022-22427IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting.IBM InfoSphere Information Server
- CVE-2022-22322IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting.IBM InfoSphere Information Server
- CVE-2021-38952IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting.IBM InfoSphere Information Server
- CVE-2022-29415WordPress Ravpage plugin <= 2.16 - Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerabilityMati Skiba @ Rav Messer Ravpage
- CVE-2022-27860WordPress Footer Text plugin <= 2.0.3 - Cross-Site Request Forgery (CSRF) leading to Cross-Site Scripting (XSS) vulnerabilityShea Bunge Footer Text
- CVE-2022-29585In Mahara before 20.10.5, 21.04.4, 21.10.2, and 22.04.0, a site using Isolated Institutions is vulnerable if more than ten groups are used.
- CVE-2022-29584Mahara before 20.10.5, 21.04.4, 21.10.2, and 22.04.0 allows stored XSS when a particular Cascading Style Sheets (CSS) class for embedly is u
- CVE-2022-22783Process memory exposure in Zoom on-premise Meeting servicesZoom Video Communications Zoom On-Premise Meeting Connector…
- CVE-2021-43930Elcomplus SmartPtt Path TraversalElcomplus SmartPTT
- CVE-2022-24892Multiple valid tokens for password reset in Shopwareshopware · shopware/shopware
- CVE-2022-28117A Server-Side Request Forgery (SSRF) in feed_parser class of Navigate CMS v2.9.4 allows remote attackers to force the application to make ar
- CVE-2022-28114DSCMS v3.0 was discovered to contain an arbitrary file deletion vulnerability via /controller/Adv.php.
- CVE-2022-28102A cross-site scripting (XSS) vulnerability in PHP MySQL Admin Panel Generator v1 allows attackers to execute arbitrary web scripts or HTML v
- CVE-2022-28101Turtlapp Turtle Note v0.7.2.6 does not filter the <meta> tag during markdown parsing, allowing attackers to execute HTML injection.
- CVE-2022-24873Non-Stored Cross-site Scripting in Shopware storefrontshopware · shopware/shopware
- CVE-2021-41945Encode OSS httpx < 0.23.0 is affected by improper input validation in `httpx.URL`, `httpx.Client` and some functions using `httpx.URL.copy_whttpx
- CVE-2022-24935Lexmark products through 2022-02-10 have Incorrect Access Control.
- CVE-2022-29152The Ericom PowerTerm WebConnect 6.0 login portal can unsafely write an XSS payload from the AppPortal cookie into the page.
- CVE-2021-41921novel-plus V3.6.1 allows unrestricted file uploads.
- CVE-2021-33436NoMachine for Windows prior to version 6.15.1 and 7.5.2 suffer from local privilege escalation due to the lack of safe DLL loading.
- CVE-2022-29821In JetBrains Rider before 2022.1 local code execution via links in ReSharper Quick Documentation was possibleJetBrains Rider
- CVE-2022-29820In JetBrains PyCharm before 2022.1 exposure of the debugger port to the internal network was possibleJetBrains PyCharm
- CVE-2022-29819In JetBrains IntelliJ IDEA before 2022.1 local code execution via links in Quick Documentation was possibleJetBrains IntelliJ IDEA
- CVE-2022-29818In JetBrains IntelliJ IDEA before 2022.1 origin checks in the internal web server were flawedJetBrains IntelliJ IDEA
- CVE-2022-29817In JetBrains IntelliJ IDEA before 2022.1 reflected XSS via error messages in internal web server was possibleJetBrains IntelliJ IDEA
- CVE-2022-29816In JetBrains IntelliJ IDEA before 2022.1 HTML injection into IDE messages was possibleJetBrains IntelliJ IDEA
- CVE-2022-29815In JetBrains IntelliJ IDEA before 2022.1 local code execution via workspace settings was possibleJetBrains IntelliJ IDEA
- CVE-2022-29814In JetBrains IntelliJ IDEA before 2022.1 local code execution via HTML descriptions in custom JSON schemas was possibleJetBrains IntelliJ IDEA
- CVE-2022-29813In JetBrains IntelliJ IDEA before 2022.1 local code execution via custom Pandoc path was possibleJetBrains IntelliJ IDEA
- CVE-2022-29812In JetBrains IntelliJ IDEA before 2022.1 notification mechanisms about using Unicode directionality formatting characters were insufficientJetBrains IntelliJ IDEA
- CVE-2022-29811In JetBrains Hub before 2022.1.14638 stored XSS via project icon was possible.JetBrains Hub
- CVE-2022-28719Missing authentication for critical function in AssetView prior to Ver.13.2.0 allows a remote unauthenticated attacker with some knowledge oHammock AssetView
- CVE-2022-1511Missing Authorization in snipe/snipe-itsnipe/snipe-it
- CVE-2022-28892Mahara before 20.10.5, 21.04.4, 21.10.2, and 22.04.0 is vulnerable to Cross Site Request Forgery (CSRF) because randomly generated tokens ar
- CVE-2022-29869cifs-utils through 6.14, with verbose logging, can cause an information leak when a file contains = (equal sign) characters but is not a val