CVEs published April 29, 2022
50 CVEs were published on April 29, 2022: 3 critical, 6 high.
- Published
- 50
- Critical
- 3
- High
- 6
- Medium
- 7
- Low
- 3
- Unrated
- 31
- Now in CISA KEV
- 0
- Fix available
- 12
Most affected products
- kernel
- 3
- bfabiszewski/libmobi
- 2
- Delta Electronics ASDA-Soft
- 2
- Elcomplus SmartPTT SCADA Server
- 2
- moodle · moodle/moodle
- 2
- QEMU
- 2
- @yaireo/tagify
- 1
- automad
- 1
- Emlog Pro
- 1
- erudika/scoold
- 1
Critical 3
- CVE-2022-1543Improper handling of Length parameter in erudika/scoolderudika/scoold
- CVE-2022-24900Absolute Path Traversal due to incorrect use of `send_file` call in Piano LED Visualizeronlaj Piano-LED-Visualizer
- CVE-2022-1531SQL injection vulnerability in ARAX-UI Synonym Lookup functionality in rtxteam/rtxrtxteam/rtx
High 6
- CVE-2022-29451WordPress Rara One Click Demo Import plugin <= 1.2.9 - Cross-Site Request Forgery (CSRF) leads to Arbitrary File Upload vulnerabilityRaratheme Rara One Click Demo Import
- CVE-2021-36207Metasys privilege managementJohnson Controls Metasys ADS/ADX/OAS server
- CVE-2022-1403Delta Electronics ASDA-Soft Out-of-bounds WriteDelta Electronics ASDA-Soft
- CVE-2022-1402Delta Electronics ASDA-Soft Out-of-bounds ReadDelta Electronics ASDA-Soft
- CVE-2021-43938Elcomplus SmartPTT SCADA Server Information ExposureElcomplus SmartPTT SCADA Server
- CVE-2021-43937Elcomplus SmartPTT SCADA Server Cross-site Request ForgeryElcomplus SmartPTT SCADA Server
Medium, low and unrated 41
- CVE-2022-29967static_compressed_inmemory_website_callback.c in Glewlwyd through 2.6.2 allows directory traversal.
- CVE-2022-28198NVIDIA Omniverse Nucleus and Cache contain a vulnerability in its configuration of OpenSSL, where an attacker with physical access to the syNVIDIA Omniverse Nucleus · NVIDIA Omniverse Cache
- CVE-2022-29947Woodpecker before 0.15.1 allows XSS via build logs because web/src/components/repo/build/BuildLog.vue lacks escaping.github.com/woodpecker-ci/woodpecker
- CVE-2022-25854Cross-site Scripting (XSS)@yaireo/tagify
- CVE-2022-29945DJI drone devices sold in 2017 through 2022 broadcast unencrypted information about the drone operator's physical location via the AeroScope
- CVE-2022-29414WordPress Subscribe To Comments Reloaded plugin <= 211130 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilitiesWPKube Subscribe To Comments Reloaded
- CVE-2022-29934USU Oracle Optimization before 5.17.5 lacks Polkit authentication, which allows smartcollector users to achieve root access via pkexec.
- CVE-2022-29935USU Oracle Optimization before 5.17.5 allows attackers to discover the quantum credentials via an agent-installer download.
- CVE-2022-29936USU Oracle Optimization before 5.17 allows authenticated quantum users to achieve remote code execution because of /v2/quantum/save-data-upl
- CVE-2022-29937USU Oracle Optimization before 5.17.5 allows authenticated DataCollection users to achieve agent root access because some common OS commands
- CVE-2021-4206A flaw was found in the QXL display device emulation in QEMU.QEMU
- CVE-2022-28994Small HTTP Server version 3.06 suffers from a remote buffer overflow vulnerability via long GET request.
- CVE-2022-28480ALLMediaServer 1.6 is vulnerable to Buffer Overflow via MediaServer.exe.
- CVE-2021-4207A flaw was found in the QXL display device emulation in QEMU.QEMU
- CVE-2022-0984Users with the capability to configure badge criteria (teachers and managers by default) were able to configure course badges with profile fmoodle · moodle/moodle
- CVE-2021-39082IBM UrbanCode Deploy (UCD) 7.1.1.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitiIBM UrbanCode Deploy
- CVE-2022-0985Insufficient capability checks could allow users with the moodle/site:uploadusers capability to delete users, without having the necessary mmoodle · moodle/moodle
- CVE-2022-1353A vulnerability was found in the pfkey_register function in net/key/af_key.c in the Linux kernel.Linux kernel
- CVE-2022-1227A privilege escalation flaw was found in Podman.psgo · github.com/containers/podman/v3 +1
- CVE-2022-1249A NULL pointer dereference flaw was found in pesign's cms_set_pw_data() function of the cms_common.c file.pesign
- CVE-2022-1195A use-after-free vulnerability was found in the Linux kernel in drivers/net/hamradio.kernel
- CVE-2022-1114A heap-use-after-free flaw was found in ImageMagick's RelinquishDCMInfo() function of dcm.c file.ImageMagick
- CVE-2022-1048A use-after-free flaw was found in the Linux kernel’s sound subsystem in the way a user triggers concurrent calls of PCM hw_params.kernel
- CVE-2022-29856A hardcoded cryptographic key in Automation360 22 allows an attacker to decrypt exported RPA packages.
- CVE-2022-28452Red Planet Laundry Management System 1.0 is vulnerable to SQL Injection.
- CVE-2021-41948A cross-site scripting (XSS) vulnerability exists in the "contact us" plugin for Subrion CMS <= 4.2.1 version via "List of subjects".intelliants/subrion
- CVE-2022-1536automad Dashboard cross site scriptingautomad
- CVE-2021-44596Wondershare LTD Dr.
- CVE-2021-44595Wondershare Dr.
- CVE-2021-41942The Magic CMS MSVOD v10 video system has a SQL injection vulnerability.
- CVE-2022-1533Buffer Over-read in bfabiszewski/libmobibfabiszewski/libmobi
- CVE-2022-1534Buffer Over-read at parse_rawml.c:1416 in bfabiszewski/libmobibfabiszewski/libmobi
- CVE-2022-1530Cross-site Scripting (XSS) in livehelperchat/livehelperchatlivehelperchat/livehelperchat · remdex/livehelperchat
- CVE-2022-1526Emlog Pro POST Parameter cross site scriptingEmlog Pro
- CVE-2022-29903The Private Domains extension for MediaWiki through 1.37.2 (before 1ad65d4c1c199b375ea80988d99ab51ae068f766) allows CSRF for editing pages t
- CVE-2022-29904The SemanticDrilldown extension for MediaWiki through 1.37.2 (before e688bdba6434591b5dff689a45e4d53459954773) allows SQL injection with cer
- CVE-2022-29905The FanBoxes extension for MediaWiki through 1.37.2 (before 027ffb0b9d6fe0d823810cf03f5b562a212162d4) allows Special:UserBoxes CSRF.
- CVE-2022-29906The admin API module in the QuizGame extension for MediaWiki through 1.37.2 (before 665e33a68f6fa1167df99c0aa18ed0157cdf9f66) omits a check
- CVE-2022-29907The Nimbus skin for MediaWiki through 1.37.2 (before 6f9c8fb868345701d9544a54d9752515aace39df) allows XSS in Advertise link messages.
- CVE-2021-3982Linux distributions using CAP_SYS_NICE for gnome-shell may be exposed to a privilege escalation issue.gnome-shell
- CVE-2022-1015A flaw was found in the Linux kernel in linux/net/netfilter/nf_tables_api.c of the netfilter subsystem.kernel