CVEs published in April 2022
3,733 vulnerabilities, 310 critical, 15 exploited.
- debian linux, fedoraproject fedora, xen +2 moreIOMMU: RMRR (VT-d) and unity map (AMD-Vi) handling issues T[his CNA information record relates to...7.8 High
- xen, debian linux, fedoraproject fedora +2 morerace in VT-d domain ID cleanup Xen domain IDs are up to 15 bits wide. VT-d hardware may allow for...7.0 High
- xen, debian linux, fedoraproject fedora +2 moreRacy interactions between dirty vram tracking and paging log dirty hypercalls Activation of log...5.6 Medium
- brianmario yajl-rubyBuffer Overflow and Integer Overflow in yajl-ruby5.9 Medium
github.com/ipfs/go-ipfsGoOpened exploitable ports in default docker-compose.yaml in go-ipfsNo score- tpcms project tpcmsTPCMS v3.2 allows attackers to access the ThinkPHP log directory and obtain sensitive information...7.5 High
- tpcms project tpcmsA stored cross-site scripting (XSS) vulnerability in TPCMS v3.2 allows attackers to execute...4.8 Medium
- wedevs wp project manager, wp project manager (wordpress plugin) +1 moreWordPress WP Project Manager plugin <= 2.4.13 - Stored Cross-Site Scripting (XSS) vulnerability5.4 Medium
- web-settler testimonial slider – free testimonials slider plugin (wordpress plugin), testimonial slider +1 moreWordPress Testimonial Slider plugin <= 3.5.8.3 - Cross-Site Scripting (XSS) vulnerability4.1 Medium
- tms-outsource wpdatatables lite, tms-plugins wpdatatables – tables & table charts (wordpress plugin) +1 moreWordPress wpDataTables plugin <= 2.1.27 - Stored Cross-Site Scripting (XSS) vulnerability3.4 Low
- foliovision fv flowplayer video player (wordpress plugin), fv flowplayer video player +1 moreWordPress FV Flowplayer Video Player plugin <= 7.5.18.727 - Authenticated Persistent Cross-Site Scripting (XSS) vulnerability4.1 Medium
- gitlabImproper handling of user input in GitLab CE/EE versions 8.3 prior to 14.7.7, 14.8 prior to 14.8...8.7 High
- gitlabImproper neutralization of user input in GitLab CE/EE versions 14.4 before 14.7.7, all versions...8.7 High
- gitlabA hardcoded password was set for accounts registered using an OmniAuth provider (e.g. OAuth, LDAP...9.1 Critical
- gitlabImproper authorization in GitLab Pages included with GitLab CE/EE affecting all versions from 11...5.3 Medium
- gitlab, gitlab pages +1 moreA lack of appropriate timeouts in GitLab Pages included in GitLab CE/EE all versions prior to 14...5.3 Medium
- gitlabA business logic error in Project Import in GitLab CE/EE versions 14.9 prior to 14.9.2, 14.8...2.4 Low
- gitlabA denial of service vulnerability when rendering RDoc files in GitLab CE/EE versions 10 to 14.7.7...6.5 Medium
- gitlabMissing filtering in an error message in GitLab CE/EE affecting all versions prior to 14.7.7, 14...4.8 Medium
- gitlabA potential DoS vulnerability was discovered in Gitlab CE/EE versions 13.7 before 14.7.7, all...4.3 Medium
- gitlabAn issue has been discovered in GitLab CE/EE affecting all versions starting from 12.1 before 14...3.7 Low
- gitlabAn improper access control vulnerability in GitLab CE/EE affecting all versions from 13.11 prior...4.3 Medium
- gitlabAdding a very large number of tags to a runner in GitLab CE/EE affecting all versions prior to 14...4.3 Medium
- gitlabA potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions from 13.1...4.3 Medium
- gitlabAn issue has been discovered in GitLab CE/EE affecting all versions starting from 12.2 before 14...3.1 Low
- gitlabIncorrect authorization in the Asana integration's branch restriction feature in all versions of...3.1 Low
- softing opc ua c++ sdk (software development kit), opc ua c\+\+ software development kit +1 moreSofting OPC-UA C++ SDK Improper Restriction of Operations within the Bounds of a Memory Buffer7.5 High
- automation direct click plc cpu modules: c0-1x cpus, automationdirect c0-10are-d firmware, c0-10dd1e-d firmware +18 more +20 moreAutomation Direct CLICK PLC CPU Modules Cleartext Transmission of Sensitive Information7.5 High
- automation direct click plc cpu modules: c0-1x cpus, automationdirect c0-10are-d firmware, c0-10dd1e-d firmware +18 more +20 moreAutomation Direct CLICK PLC CPU Modules Authentication Bypass Using an Alternate Path or Channel9.8 Critical
- automation direct click plc cpu modules: c0-1x cpus, automationdirect c0-10are-d firmware, c0-10dd1e-d firmware +18 more +20 moreAutomation Direct CLICK PLC CPU Modules Authentication Bypass Using an Alternate Path or Channel9.8 Critical
- automation direct click plc cpu modules: c0-1x cpus, automationdirect c0-10are-d firmware, c0-10dd1e-d firmware +18 more +20 moreAutomation Direct CLICK PLC CPU Modules Plaintext Storage of a Password7.5 High
- automation direct click plc cpu modules: c0-1x cpus, automationdirect c0-10are-d firmware, c0-10dd1e-d firmware +18 more +20 moreAutomation Direct CLICK PLC CPU Modules Authentication Bypass Using an Alternate Path or Channel9.8 Critical
- aveva system platformAVEVA System Platform Missing Authentication for Critical Function8.8 High
- aveva system platformAVEVA System Platform Path Traversal7.2 High
- aveva system platformAVEVA System Platform Origin Validation Error7.2 High
- aveva system platformAVEVA System Platform Uncaught Exception7.5 High
- aveva system platformAVEVA System Platform Improper Verification of Cryptographic Signature7.2 High
- containers crun, fedoraproject fedora, redhat enterprise linux +1 more +3 moreImportant: container-tools:rhel8 security, bug fix, and enhancement update7.5 High
- hewlett packard enterprise (hpe) hpe oneview, hp oneview +1 moreA local unauthorized read access to files vulnerability was discovered in HPE OneView version(s):...5.5 Medium
- hewlett packard enterprise (hpe) hpe oneview, hp oneview +1 moreA local authentication restriction bypass vulnerability was discovered in HPE OneView version(s):...7.8 High
- hewlett packard enterprise (hpe) hpe oneview, hp oneview +1 moreA remote unauthenticated disclosure of information vulnerability was discovered in HPE OneView...7.5 High
- hewlett packard enterprise (hpe) hpe oneview, hp oneview +1 moreA remote cross-site scripting (xss) vulnerability was discovered in HPE OneView version(s): Prior...6.1 Medium
- forcepoint one endpointForcepoint One Endpoint prior to version 22.01 installed on Microsoft Windows does not provide...6.0 Medium
- forcepoint one endpointForcepoint One Endpoint prior to version 22.01 installed on Microsoft Windows is vulnerable to...6.0 Medium
- medialize medialize/uri.js, uri.js project uri.js +1 moreURL Confusion When Scheme Not Supplied in medialize/uri.js6.5 Medium
- xerox colorqube 8580 firmwareXerox ColorQube 8580 was discovered to contain an access control issue which allows attackers to...7.5 High
- janeczku calibre-web, janeczku/calibre-web +1 moreServer-Side Request Forgery (SSRF) in janeczku/calibre-web9.3 Critical
- directusCross-site Scripting in Directus8.8 High
- miraheze createwikiAuthentication Bypass Using an Alternate Path or Channel in CreateWiki5.3 Medium
- vyperlang vyperIncorrect Comparison in Vyper7.5 High
- Show moreLoading…