CVEs published in April 2022
3,733 vulnerabilities, 310 critical, 15 exploited.
- osisoft pi visionOSIsoft PI Vision Incorrect Authorization4.9 Medium
- osisoft pi visionOSIsoft PI Vision Cross-site Scripting7.7 High
- cybelsoft thinvncThinVNC version 1.0b1 allows an unauthenticated user to bypass the authentication process via ...10.0 Critical
- linux kernelIn the Linux kernel through 3.1 there is an information disclosure issue via /proc/stat.5.5 Medium
- opensc, fedoraproject fedora, redhat enterprise linux +2 moreA heap double free issue was found in Opensc before version 0.22.0 in sc_pkcs15_free_tokeninfo.5.3 Medium
- wordpressA flaw exists in Wordpress related to the 'wp-admin/press-this.php 'script improperly checking...6.5 Medium
- red hat ansible, redhat ansible galaxy, ansible automation platform +2 moreA flaw was found in Ansible Galaxy Collections. When collections are built manually, any files in...5.5 Medium
- red hat wildflyMetrics exposure in Wildfly4.3 Medium
- dcraw project dcraw, debian linux +1 moreThere is an integer overflow vulnerability in dcraw. When the victim runs dcraw with a...7.8 High
- contest gallery (wordpress plugin), contest-gallery contest gallery +1 moreWordPress Contest Gallery plugin <= 13.1.0.9 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability4.8 Medium
- bwm-ng project bwm-ngAn issue was discovered in in bwm-ng v0.6.2. An arbitrary null write exists in get_cmdln_options(...7.5 High
- eaton intelligent power manager infrastructure (ipm infrastructure), intelligent power manager +1 moreSecurity issues in Eaton Intelligent Power Manager Infrastructure5.7 Medium
- eaton intelligent power manager infrastructure (ipm infrastructure), intelligent power manager infrastructure +1 moreSecurity issues in Eaton Intelligent Power Manager Infrastructure5.7 Medium
- eaton intelligent power manager infrastructure (ipm infrastructure), intelligent power manager +1 moreSecurity issues in Eaton Intelligent Power Manager Infrastructure3.1 Low
- accesspressthemes access demo importer, accesspress themes access demo importer (wordpress plugin) +1 moreWordPress Access Demo Importer plugin <= 1.0.7 - Cross-Site Request Forgery (CSRF) vulnerability leading to Data Reset (Posts / Pages / Media)8.1 High
- accesspressthemes access demo importer, accesspress themes access demo importer (wordpress plugin) +1 moreWordPress Access Demo Importer plugin <= 1.0.7 - Cross-Site Request Forgery (CSRF) vulnerability leading to Arbitrary Plugin Activation6.5 Medium
- kubernetes cri-o, mobyproject moby, fedoraproject fedora +1 more +3 moreIncorrect Default Permissions in CRI-O5.3 Medium
- autodesk autocad, advance steel, autocad architecture +7 more +9 moreA maliciously crafted TIF or PICT file in Autodesk AutoCAD 2022, 2021, 2020, 2019 can be used to...7.8 High
- autodesk autocad, advance steel, autocad architecture +7 more +9 moreA maliciously crafted PICT, BMP, PSD or TIF file in Autodesk AutoCAD 2022, 2021, 2020, 2019 may...7.8 High
- autodesk design reviewA malicious crafted TGA file when consumed through DesignReview.exe application could lead to...7.8 High
- autodesk design reviewA malicious crafted .dwf file when consumed through DesignReview.exe application could lead to...7.8 High
- graphisoft bimx desktop viewerAn exploitable code execution vulnerability exists in the file format parsing functionality of...8.8 High
- rukovoditel project management app, rukovoditel +1 moreMultiple exploitable SQL injection vulnerabilities exist in the 'entities/fields' page of the...5.4 Medium
- phpgacl, open-emr openemr +1 moreMultiple SQL injection vulnerabilities exist in phpGACL 3.3.7. A specially crafted HTTP request...8.8 High
- pixar openusd, apple macos +1 moreAn exploitable vulnerability exists in the way Pixar OpenUSD 20.05 handles file offsets in binary...4.3 Medium
- tp-link tl-wr840n firmwareTp-Link TL-WR840N (EU) v6.20 Firmware (0.9.1 4.17 v0001.0 Build 201124 Rel.64328n) is vulnerable...7.2 High
- tylertech odyssey portalAn Insecure Direct Object Reference issue exists in the Tyler Odyssey platform before 17.1.20....7.5 High
- automatic question paper generator project question paper generatorAutomatic Question Paper Generator v1.0 contains a Time-Based Blind SQL injection vulnerability...9.8 Critical
aspnetcore-runtime-5.0AlmaLinux,aspnetcore-targeting-pack-5.0AlmaLinux,dotnet-apphost-pack-5.0AlmaLinux +6 more +8 more.NET 5.0 on AlmaLinux 8 bugfix updateNo scoreaspnetcore-runtime-3.1AlmaLinux,aspnetcore-targeting-pack-3.1AlmaLinux,dotnet-apphost-pack-3.1AlmaLinux +6 more +8 more.NET Core 3.1 on AlmaLinux 8 bugfix updateNo scoreaspnetcore-runtime-6.0AlmaLinux,aspnetcore-targeting-pack-6.0AlmaLinux,dotnetAlmaLinux +8 more +10 more.NET 6.0 on AlmaLinux 8 bugfix updateNo score- zoho manageengine, zohocorp manageengine adselfservice plus +1 moreZoho ManageEngine ADSelfService Plus before 6122 allows an authenticated user to achieve remote...6.8 Medium
- zohocorp manageengine opmanagerZoho ManageEngine OpManager before 125588 (and before 125603) is vulnerable to authenticated SQL...8.8 High
- mediawikiA denial-of-service issue was discovered in MediaWiki 1.37.x before 1.37.2. Rendering of w/index...7.5 High
- mediawiki, debian linux +1 moreA denial-of-service issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1...7.5 High
- mediawiki, debian linux +1 moreAn issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37...4.4 Medium
- wso2 api manager, enterprise integrator, identity server +6 more +8 moreCertain WSO2 products allow unrestricted file upload with resultant remote code execution. This...9.8 Critical
- invisible-island ncurses, apple macos, debian linux +2 morencurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in...7.1 High
- py-pdf pypdf2, debian linux +1 moreManipulated inline images can cause Infinite Loop in PyPDF26.2 Medium
- radare radare2, radareorg radareorg/radare2 +1 moreHeap-based Buffer Overflow in radareorg/radare24.8 Medium
ghostscriptOSS-FuzzSegv on unknown address in gs_heap_free_objectNo score- vim, vim vim/vim, apple macos +1 more +3 moreglobal heap buffer overflow in skip_range in vim/vim7.8 High
- radare radare2, radareorg radareorg/radare2 +1 moreNULL Pointer Dereference in radareorg/radare25.3 Medium
- wasm3 project wasm3Wasm3 0.5.0 has a heap-based buffer overflow in NewCodePage in m3_code.c (called indirectly from...5.5 Medium
- zohocorp manageengine remote access plusZoho ManageEngine Remote Access Plus before 10.1.2137.15 allows guest users to view domain...5.3 Medium
- zohocorp manageengine remote access plusZoho ManageEngine Remote Access Plus before 10.1.2137.15 allows guest users to view license details.5.3 Medium
- snipe snipe/snipe-it, snipeitapp snipe-it +1 moreStored Cross Site Scripting vulnerability in Item name parameter in snipe/snipe-it9.1 Critical
ghostscriptOSS-FuzzUNKNOWN READ in ref_stack_counttomarkNo scorequickjsOSS-FuzzHeap-buffer-overflow in JS_CallInternalNo score- google chrome, chromium v8 +1 moreType confusion in V8 Turbofan in Google Chrome prior to 100.0.4896.127 allowed a remote attacker...8.8 High
- Show moreLoading…