# CVEs published 2022-04-28

57 CVEs were published on April 28, 2022: 4 critical, 6 high. Days are UTC.

- [CVE-2022-24449](https://cve.now/CVE-2022-24449.md): Solar appScreener through 3.10.4, when a valid license is not present, allows XXE and SSRF attacks via a crafted XML document. (no CVSS)
- [CVE-2022-28454](https://cve.now/CVE-2022-28454.md): Limbas 4.3.36.1319 is vulnerable to Cross Site Scripting (XSS). (no CVSS)
- [CVE-2022-29556](https://cve.now/CVE-2022-29556.md): The iot-manager microservice 1.0.0 in Northern.tech Mender Enterprise before 3.2.2 allows SSRF because the Azure IoT Hub integration provide (no CVSS)
- [CVE-2022-29555](https://cve.now/CVE-2022-29555.md): The Deviceconnect microservice through 1.3.0 in Northern.tech Mender Enterprise before 3.2.2. (no CVSS)
- [CVE-2022-28477](https://cve.now/CVE-2022-28477.md): WBCE CMS 1.5.2 is vulnerable to Cross Site Scripting (XSS). (no CVSS)
- [CVE-2022-24898](https://cve.now/CVE-2022-24898.md): Arbitrary file access through XML parsing in org.xwiki.commons:xwiki-commons-xml (CVSS 4.9, xwiki-commons · org.xwiki.commons:xwiki-commons-xml)
- [CVE-2022-28060](https://cve.now/CVE-2022-28060.md): SQL Injection vulnerability in Victor CMS v1.0, via the user\_name parameter to /includes/login.php. (no CVSS)
- [CVE-2022-29081](https://cve.now/CVE-2022-29081.md): Zoho ManageEngine Access Manager Plus before 4302, Password Manager Pro before 12007, and PAM360 before 5401 are vulnerable to access-contro (no CVSS)
- [CVE-2022-29411](https://cve.now/CVE-2022-29411.md): WordPress Hermit 音乐播放器 plugin \<= 3.1.6 - Unauthenticated SQL Injection SQLi) vulnerability (CVSS 8.3, Mufeng Hermit 音乐播放器)
- [CVE-2022-29412](https://cve.now/CVE-2022-29412.md): WordPress Hermit 音乐播放器 plugin \<= 3.1.6 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities (CVSS 5.4, Mufeng Hermit 音乐播放器)
- [CVE-2022-29413](https://cve.now/CVE-2022-29413.md): WordPress Hermit 音乐播放器 plugin \<= 3.1.6 - Cross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS) vulnerability (CVSS 4.7, Mufeng Hermit 音乐播放器)
- [CVE-2022-29410](https://cve.now/CVE-2022-29410.md): WordPress Hermit 音乐播放器 plugin \<= 3.1.6 - Authenticated SQL Injection (SQLi) vulnerability (CVSS 7.4, Mufeng Hermit 音乐播放器)
- [CVE-2022-22443](https://cve.now/CVE-2022-22443.md): IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. (CVSS 5.4, IBM InfoSphere Information Server)
- [CVE-2022-22441](https://cve.now/CVE-2022-22441.md): IBM InfoSphere Information Server 11.7 could allow an authenticated user to view information of higher privileged users and groups due to a (CVSS 6.5, IBM InfoSphere Information Server)
- [CVE-2022-22427](https://cve.now/CVE-2022-22427.md): IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. (CVSS 5.2, IBM InfoSphere Information Server)
- [CVE-2022-22322](https://cve.now/CVE-2022-22322.md): IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. (CVSS 5.4, IBM InfoSphere Information Server)
- [CVE-2021-38952](https://cve.now/CVE-2021-38952.md): IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. (CVSS 5.4, IBM InfoSphere Information Server)
- [CVE-2022-1514](https://cve.now/CVE-2022-1514.md): Stored XSS via upload plugin functionality in zip format in neorazorx/facturascripts (CVSS 9.0, neorazorx/facturascripts · facturascripts/facturascripts)
- [CVE-2022-29415](https://cve.now/CVE-2022-29415.md): WordPress Ravpage plugin \<= 2.16 - Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability (CVSS 6.1, Mati Skiba @ Rav Messer Ravpage)
- [CVE-2022-27860](https://cve.now/CVE-2022-27860.md): WordPress Footer Text plugin \<= 2.0.3 - Cross-Site Request Forgery (CSRF) leading to Cross-Site Scripting (XSS) vulnerability (CVSS 6.1, Shea Bunge Footer Text)
- [CVE-2022-29585](https://cve.now/CVE-2022-29585.md): In Mahara before 20.10.5, 21.04.4, 21.10.2, and 22.04.0, a site using Isolated Institutions is vulnerable if more than ten groups are used. (no CVSS)
- [CVE-2022-29584](https://cve.now/CVE-2022-29584.md): Mahara before 20.10.5, 21.04.4, 21.10.2, and 22.04.0 allows stored XSS when a particular Cascading Style Sheets (CSS) class for embedly is u (no CVSS)
- [CVE-2022-22783](https://cve.now/CVE-2022-22783.md): Process memory exposure in Zoom on-premise Meeting services (CVSS 6.5, Zoom Video Communications Zoom On-Premise Meeting Connector…)
- [CVE-2022-22782](https://cve.now/CVE-2022-22782.md): Local privilege escalation in Windows Zoom Clients (CVSS 7.9, Zoom Video Communications Zoom Client for Meetings for W… +2)
- [CVE-2022-22781](https://cve.now/CVE-2022-22781.md): Update package downgrade in Zoom Client for Meetings for MacOS (CVSS 7.5, Zoom Video Communications Zoom Client for Meetings for MacOS)
- [CVE-2021-43939](https://cve.now/CVE-2021-43939.md): Elcomplus SmartPtt Improper Authorization (CVSS 8.8, Elcomplus SmartPTT)
- [CVE-2021-43932](https://cve.now/CVE-2021-43932.md): Elcomplus SmartPtt Cross-site Scripting (CVSS 9.0, Elcomplus SmartPTT)
- [CVE-2021-43934](https://cve.now/CVE-2021-43934.md): Elcomplus SmartPtt Unrestricted Upload of File with Dangerous Type (CVSS 9.8, Elcomplus SmartPTT)
- [CVE-2021-43930](https://cve.now/CVE-2021-43930.md): Elcomplus SmartPtt Path Traversal (CVSS 4.9, Elcomplus SmartPTT)
- [CVE-2022-24892](https://cve.now/CVE-2022-24892.md): Multiple valid tokens for password reset in Shopware (CVSS 6.4, shopware · shopware/shopware)
- [CVE-2022-24879](https://cve.now/CVE-2022-24879.md): Malfunction of Cross-Site Request Forgery token validation (CVSS 7.5, shopware · shopware/shopware)
- [CVE-2022-28117](https://cve.now/CVE-2022-28117.md): A Server-Side Request Forgery (SSRF) in feed\_parser class of Navigate CMS v2.9.4 allows remote attackers to force the application to make ar (no CVSS)
- [CVE-2022-28114](https://cve.now/CVE-2022-28114.md): DSCMS v3.0 was discovered to contain an arbitrary file deletion vulnerability via /controller/Adv.php. (no CVSS)
- [CVE-2022-28102](https://cve.now/CVE-2022-28102.md): A cross-site scripting (XSS) vulnerability in PHP MySQL Admin Panel Generator v1 allows attackers to execute arbitrary web scripts or HTML v (no CVSS)
- [CVE-2022-28101](https://cve.now/CVE-2022-28101.md): Turtlapp Turtle Note v0.7.2.6 does not filter the \<meta\> tag during markdown parsing, allowing attackers to execute HTML injection. (no CVSS)
- [CVE-2022-24873](https://cve.now/CVE-2022-24873.md): Non-Stored Cross-site Scripting in Shopware storefront (CVSS 5.4, shopware · shopware/shopware)
- [CVE-2021-41945](https://cve.now/CVE-2021-41945.md): Encode OSS httpx \< 0.23.0 is affected by improper input validation in \`httpx.URL\`, \`httpx.Client\` and some functions using \`httpx.URL.copy\_w (no CVSS, httpx)
- [CVE-2022-24935](https://cve.now/CVE-2022-24935.md): Lexmark products through 2022-02-10 have Incorrect Access Control. (no CVSS)
- [CVE-2022-29152](https://cve.now/CVE-2022-29152.md): The Ericom PowerTerm WebConnect 6.0 login portal can unsafely write an XSS payload from the AppPortal cookie into the page. (no CVSS)
- [CVE-2021-41921](https://cve.now/CVE-2021-41921.md): novel-plus V3.6.1 allows unrestricted file uploads. (no CVSS)
- [CVE-2021-33436](https://cve.now/CVE-2021-33436.md): NoMachine for Windows prior to version 6.15.1 and 7.5.2 suffer from local privilege escalation due to the lack of safe DLL loading. (no CVSS)
- [CVE-2022-1509](https://cve.now/CVE-2022-1509.md): Command Injection Vulnerability in hestiacp/hestiacp (CVSS 9.9, hestiacp/hestiacp)
- [CVE-2022-29821](https://cve.now/CVE-2022-29821.md): In JetBrains Rider before 2022.1 local code execution via links in ReSharper Quick Documentation was possible (CVSS 6.9, JetBrains Rider)
- [CVE-2022-29820](https://cve.now/CVE-2022-29820.md): In JetBrains PyCharm before 2022.1 exposure of the debugger port to the internal network was possible (CVSS 3.0, JetBrains PyCharm)
- [CVE-2022-29819](https://cve.now/CVE-2022-29819.md): In JetBrains IntelliJ IDEA before 2022.1 local code execution via links in Quick Documentation was possible (CVSS 6.9, JetBrains IntelliJ IDEA)
- [CVE-2022-29818](https://cve.now/CVE-2022-29818.md): In JetBrains IntelliJ IDEA before 2022.1 origin checks in the internal web server were flawed (CVSS 3.9, JetBrains IntelliJ IDEA)
- [CVE-2022-29817](https://cve.now/CVE-2022-29817.md): In JetBrains IntelliJ IDEA before 2022.1 reflected XSS via error messages in internal web server was possible (CVSS 3.9, JetBrains IntelliJ IDEA)
- [CVE-2022-29816](https://cve.now/CVE-2022-29816.md): In JetBrains IntelliJ IDEA before 2022.1 HTML injection into IDE messages was possible (CVSS 2.8, JetBrains IntelliJ IDEA)
- [CVE-2022-29815](https://cve.now/CVE-2022-29815.md): In JetBrains IntelliJ IDEA before 2022.1 local code execution via workspace settings was possible (CVSS 6.9, JetBrains IntelliJ IDEA)
- [CVE-2022-29814](https://cve.now/CVE-2022-29814.md): In JetBrains IntelliJ IDEA before 2022.1 local code execution via HTML descriptions in custom JSON schemas was possible (CVSS 6.9, JetBrains IntelliJ IDEA)
- [CVE-2022-29813](https://cve.now/CVE-2022-29813.md): In JetBrains IntelliJ IDEA before 2022.1 local code execution via custom Pandoc path was possible (CVSS 6.9, JetBrains IntelliJ IDEA)
- [CVE-2022-29812](https://cve.now/CVE-2022-29812.md): In JetBrains IntelliJ IDEA before 2022.1 notification mechanisms about using Unicode directionality formatting characters were insufficient (CVSS 2.3, JetBrains IntelliJ IDEA)
- [CVE-2022-29811](https://cve.now/CVE-2022-29811.md): In JetBrains Hub before 2022.1.14638 stored XSS via project icon was possible. (CVSS 6.1, JetBrains Hub)
- [CVE-2022-28719](https://cve.now/CVE-2022-28719.md): Missing authentication for critical function in AssetView prior to Ver.13.2.0 allows a remote unauthenticated attacker with some knowledge o (no CVSS, Hammock AssetView)
- [CVE-2022-1511](https://cve.now/CVE-2022-1511.md): Missing Authorization in snipe/snipe-it (CVSS 6.5, snipe/snipe-it)
- [CVE-2022-28892](https://cve.now/CVE-2022-28892.md): Mahara before 20.10.5, 21.04.4, 21.10.2, and 22.04.0 is vulnerable to Cross Site Request Forgery (CSRF) because randomly generated tokens ar (no CVSS)
- [CVE-2022-29869](https://cve.now/CVE-2022-29869.md): cifs-utils through 6.14, with verbose logging, can cause an information leak when a file contains = (equal sign) characters but is not a val (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-04-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.