CVEs published in April 2022
3,733 vulnerabilities, 310 critical, 15 exploited.
- ping identity pingid desktop PingID Desktop encryption libraries misconfiguration can lead to sensitive data exposure 8.0 High
- pingidentity pingid, pingid windows login, ping identity pingid mobile application +2 more PingID iOS mobile application prior to 1.19 vulnerable to pre-computed dictionary attacks 6.6 Medium
- pingidentity pingid, pingid windows login, ping identity pingid mobile application +2 more PingID Android mobile application prior to 1.19 vulnerable to pre-computed dictionary attacks 6.6 Medium
- ping identity pingid windows login, pingidentity pingid integration for windows login +1 more PingID Windows Login RSA cryptographic weakness with possible offline MFA bypass 7.7 High
- mediawiki An issue was discovered in MediaWiki through 1.37.2. The SecurePoll extension allows a leak... 7.5 High
- apache nifi Improper Restriction of XML External Entity References in Multiple Components 7.5 High
-
radare2OSS-Fuzz Heap-use-after-free in r_asm_free No score - glewlwyd project glewlwyd static_compressed_inmemory_website_callback.c in Glewlwyd through 2.6.2 allows directory traversal. 7.5 High
- nvidia omniverse nucleus, omniverse cache +1 more NVIDIA Omniverse Nucleus and Cache contain a vulnerability in its configuration of OpenSSL, where... 6.6 Medium
- woodpecker-ci woodpecker Woodpecker allows cross-site scripting (XSS) via build logs 6.1 Medium
- tagify project tagify Cross-site Scripting (XSS) 5.4 Medium
- dji air 2 firmware, air 2s firmware, fhantom 4 pro firmware +8 more +10 more DJI drone devices sold in 2017 through 2022 broadcast unencrypted information about the drone... 4.0 Medium
- erudika erudika/scoold, scoold +1 more Improper handling of Length parameter in erudika/scoold 9.3 Critical
- rarathemes rara one click demo import, raratheme rara one click demo import (wordpress plugin) +1 more WordPress Rara One Click Demo Import plugin <= 1.2.9 - Cross-Site Request Forgery (CSRF) leads to Arbitrary File Upload vulnerability 8.8 High
- wpkube subscribe to comments reloaded, subscribe to comments reloaded (wordpress plugin) +1 more WordPress Subscribe To Comments Reloaded plugin <= 211130 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities 5.4 Medium
- johnson controls metasys ads/adx/oas server, johnsoncontrols metasys application and data server, metasys extended application and data server +1 more +3 more Metasys privilege management 8.8 High
- usu oracle optimization USU Oracle Optimization before 5.17.5 lacks Polkit authentication, which allows smartcollector... 7.8 High
- usu oracle optimization USU Oracle Optimization before 5.17.5 allows attackers to discover the quantum credentials via an... 7.5 High
- usu oracle optimization USU Oracle Optimization before 5.17 allows authenticated quantum users to achieve remote code... 8.8 High
- usu oracle optimization USU Oracle Optimization before 5.17.5 allows authenticated DataCollection users to achieve agent... 8.8 High
-
ezsystems/ezplatform-kernelPackagist Object state limitation has no effect No score - qemu, debian linux, redhat enterprise linux +2 more A flaw was found in the QXL display device emulation in QEMU. An integer overflow in the... 8.2 High
- smallsrv small http server Small HTTP Server version 3.06 suffers from a remote buffer overflow vulnerability via long GET... 9.8 Critical
- allmediaserver ALLMediaServer 1.6 is vulnerable to Buffer Overflow via MediaServer.exe. 9.8 Critical
- delta electronics asda-soft, deltaww asda soft +1 more Delta Electronics ASDA-Soft Out-of-bounds Write 7.8 High
- delta electronics asda-soft, deltaww asda soft +1 more Delta Electronics ASDA-Soft Out-of-bounds Read 7.8 High
- qemu, debian linux, redhat enterprise linux +2 more A flaw was found in the QXL display device emulation in QEMU. A double fetch of guest controlled... 8.2 High
- moodle, fedoraproject fedora, redhat enterprise linux +2 more Missing authorization in Moodle 4.3 Medium
- ibm urbancode deploy IBM UrbanCode Deploy (UCD) 7.1.1.2 uses weaker than expected cryptographic algorithms that could... 5.9 Medium
- moodle Improper Authentication in moodle 4.3 Medium
- podman project podman, fedoraproject fedora, psgo project psgo +13 more +15 more Podman publishes a malicious image to public registries 8.8 High
- microsoft pesign A NULL pointer dereference flaw was found in pesign's cms_set_pw_data() function of the... 3.3 Low
-
ibexa/corePackagist Object state limitation has no effect No score - ibexa kernel, digital experience platform, ez platform kernel +2 more +4 more Object state limitation has no effect 9.8 Critical
- imagemagick A heap-use-after-free flaw was found in ImageMagick's RelinquishDCMInfo() function of dcm.c file.... 7.1 High
- elcomplus smartptt scada server, smartptt scada server +1 more Elcomplus SmartPTT SCADA Server Information Exposure 8.1 High
- elcomplus smartptt scada server, smartptt scada server +1 more Elcomplus SmartPTT SCADA Server Cross-site Request Forgery 7.6 High
- automationanywhere automation 360 A hardcoded cryptographic key in Automation360 22 allows an attacker to decrypt exported RPA... 7.5 High
- [unknown] dpdk, dpdk data plane development kit, openvswitch +1 more +3 more A flaw was found in dpdk. This flaw allows a malicious vhost-user master to attach an unexpected... 6.5 Medium
- [unknown] dpdk, dpdk data plane development kit, fedoraproject fedora +2 more +4 more A flaw was found in the vhost library in DPDK. Function vhost_user_set_inflight_fd() does not... 7.5 High
- redplanetcomputers laundry management system Red Planet Laundry Management System 1.0 is vulnerable to SQL Injection. 9.8 Critical
- piano led visualizer project led visualizer, onlaj piano-led-visualizer +1 more Absolute Path Traversal due to incorrect use of `send_file` call in Piano LED Visualizer 9.9 Critical
- intelliants subrion Subrion CMS Cross-site Scripting (XSS) vulnerability in the `contact us` plugin 5.4 Medium
- automad automad Dashboard cross site scripting 3.5 Low
- wondershare dr.fone Wondershare LTD Dr. Fone as of 2021-12-06 version is affected by Remote code execution. Due to... 9.8 Critical
- wondershare dr.fone Wondershare Dr. Fone Latest version as of 2021-12-06 is vulnerable to Incorrect Access Control. A... 8.8 High
- msvod cms The Magic CMS MSVOD v10 video system has a SQL injection vulnerability. Attackers can use... 7.5 High
- google android In various functions of the USB gadget subsystem, there is a possible out of bounds write due to... 6.8 Medium
- bfabiszewski bfabiszewski/libmobi, libmobi project libmobi +1 more Buffer Over-read in bfabiszewski/libmobi 6.6 Medium
- bfabiszewski bfabiszewski/libmobi, libmobi project libmobi +1 more Buffer Over-read at parse_rawml.c:1416 in bfabiszewski/libmobi 6.6 Medium
- Show olderLoading…