CVEs published in April 2022
3,733 vulnerabilities, 310 critical, 15 exploited.
- siemens simatic energy manager basic, simatic energy manager pro +1 moreA vulnerability has been identified in SIMATIC Energy Manager Basic (All versions < V7.3 Update 1...7.3 High
- siemens simatic energy manager basic, simatic energy manager pro +1 moreA vulnerability has been identified in SIMATIC Energy Manager Basic (All versions < V7.3 Update 1...7.8 High
- siemens simatic step 7 (tia portal) v15, simatic step 7 (tia portal) v16, simatic step 7 (tia portal) v17 +1 more +3 moreA vulnerability has been identified in SIMATIC STEP 7 (TIA Portal) V15 (All versions), SIMATIC...7.8 High
- siemens simatic s7-400 cpu 412-1 dp v7, simatic s7-400 cpu 412-2 dp v7, simatic s7-400 cpu 412-2 pn/dp v7 +21 more +23 moreA vulnerability has been identified in SIMATIC S7-400 H V6 CPU family (incl. SIPLUS variants) ...7.5 High
- mz automation libiec61850Malformed Goose Message in LibIEC61850 may result in a denial of service7.5 High
- npm-dependency-versions project npm-dependency-versionsCommand injection in npm-dependency-versions9.8 Critical
grokOSS-FuzzUse-of-uninitialized-value in grk::N_SCALAR::DecompressIrrev::vtransNo score- jenkins promoted builds, jenkins project promoted builds plugin +1 morePromotion names in Jenkins promoted builds Plugin are not validated when using Job DSL5.4 Medium
- jenkins promoted builds, jenkins project promoted builds plugin +1 moreStored Cross-site Scripting vulnerability in Jenkins Promoted Builds Plugin5.4 Medium
- jenkins credentials, jenkins project credentials plugin +1 moreCross-site Scripting in Jenkins Credentials Plugin5.4 Medium
- broadcom tcpreplayTcpreplay v4.4.1 has a heap-based buffer overflow in do_checksum_math at /tcpedit/checksum.c.7.8 High
- broadcom tcpreplayTcpreplay v4.4.1 was discovered to contain a double-free via __interceptor_free.7.8 High
- express-fileupload project express-fileuploadAn arbitrary file upload vulnerability in the file upload module of Express-Fileupload v1.3.1...9.8 Critical
- siemens simatic cfu diq, simatic cfu pa, simatic et 200al im 157-1 pn +85 more +87 moreA vulnerability has been identified in SIMATIC CFU DIQ (All versions), SIMATIC CFU PA (All...5.3 Medium
- git-for-windows git, apple xcode, debian linux +1 more +3 moreUncontrolled search for the Git directory in Git for Windows6.0 Medium
- gruntjs grunt, gruntjs/grunt +1 morePath Traversal in gruntjs/grunt7.1 High
nokogiriRubyGemsDenial of Service (DoS) in Nokogiri on JRuby7.5 HighnokogiriRubyGemsXML Injection in Xerces Java affects Nokogiri6.5 Medium- nekohtml project nekohtml, oracle weblogic server +1 moreUncontrolled Resource Consumption in org.cyberneko.html (nokogiri fork)7.5 High
nokogiriRubyGemsOut-of-bounds Write in zlib affects Nokogiri7.5 High- nextcloud calendar, kiteworks security-advisories +1 moreCommand Injection in Appointment Emails for Nextcloud Calendar5.3 Medium
- privatebinPersistent Cross-site Scripting (XSS) vulnerability in PrivateBin8.2 High
- hedgedocEnumerable upload file names in hedgedoc5.3 Medium
- gocdBundled ldap-authentication-plugin fails to neutralise LDAP special elements in usernames8.2 High
- zerotier zerotier/zerotierone, zerotierone +1 moreIncorrect Permission Assignment for Critical Resource in zerotier/zerotierone8.8 High
- gardenMissing authentication in Garden8.1 High
- stylemixthemes eroom – zoom meetings & webinar (wordpress plugin), eroom - zoom meetings \& webinar +1 moreWordPress eRoom plugin <= 1.3.7 - Cross-Site Request Forgery (CSRF) leading to Sync with Zoom Meetings vulnerability4.3 Medium
- stylemixthemes eroom – zoom meetings & webinar (wordpress plugin), eroom - zoom meetings \& webinar +1 moreWordPress eRoom plugin <= 1.3.8 - Cross-Site Request Forgery (CSRF) vulnerability leading to Cache Deletion4.3 Medium
- redhat origin-aggregated-loggingA flaw was found in the original fix for the netty-codec-http CVE-2021-21409, where the OpenShift...5.9 Medium
- redhat openshiftThe release of OpenShift 4.9.6 included four CVE fixes for the haproxy package, however the patch...7.5 High
- myscada mypromySCADA myPRO Command Injection8.8 High
- aveva system platformAVEVA System Platform Cleartext Storage of Sensitive Information in Memory8.1 High
- vmware horizon, horizon agent for linux +1 moreVMware Horizon Client for Linux (prior to 22.x) contains a local privilege escalation that allows...7.8 High
- vmware horizon, horizon agent for linux +1 moreVMware Horizon Client for Linux (prior to 22.x) contains a local privilege escalation as a user...7.8 High
- gitlabMissing sanitization of logged exception messages in all versions prior to 14.7.7, 14.8 prior to...2.6 Low
- gitlabImproper access control in GitLab CE/EE versions 10.7 prior to 14.7.7, 10.8 prior to 14.8.5, and...4.3 Medium
- huawei emui, harmonyos, magic ui +2 moreThe communication module has a service logic error vulnerability.Successful exploitation of this...7.5 High
- huawei emui, harmonyos +1 moreThe device authentication service module has a defect vulnerability introduced in the design...7.5 High
- huawei emui, harmonyos, magic ui +2 moreThe DFX module has a vulnerability of improper validation of integrity check values.Successful...7.5 High
- huawei emui, harmonyos, magic ui +2 moreThe multi-window module has a vulnerability of unauthorized insertion and tampering of Settings...9.1 Critical
- huawei emui, harmonyos, magic ui +2 moreA permission bypass vulnerability exists when the NFC CAs access the TEE.Successful exploitation...7.5 High
- huawei emui, harmonyos +1 moreThe application framework has a common DoS vulnerability.Successful exploitation of this...7.5 High
- huawei emui, harmonyos, magic ui +2 moreThe DFX module has an access control vulnerability.Successful exploitation of this vulnerability...7.5 High
- huawei emui, harmonyos, magic ui +2 moreThe Wi-Fi module has an event notification vulnerability.Successful exploitation of this...9.8 Critical
- huawei emui, harmonyos, magic ui +2 moreThe customization framework has a vulnerability of improper permission control.Successful...7.5 High
- plausible analytics, plausiblehq plausible analytics (wordpress plugin) +1 moreWordPress Plausible Analytics plugin <= 1.2.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability4.8 Medium
- wpvivid team migration, backup, staging – wpvivid (wordpress plugin), wpvivid migration\, backup\, staging +1 moreWordPress WPvivid plugin <= 0.9.70 - Arbitrary File Read vulnerability2.7 Low
- lifepoint patient portalICSMA-22-095-01 LifePoint Informatics Patient Portal6.5 Medium
- rockwell automation 1768 compactlogix controllers, 1769 compactlogix controllers, compact guardlogix 5370 controllers +38 more +40 moreICSA-22-090-05 Rockwell Automation Logix Controllers10.0 Critical
- ivanti incapptic connectA non-admin user with user management permission can escalate his privilege to admin user via...8.8 High
- Show moreLoading…