CVEs published in April 2022
3,733 vulnerabilities, 310 critical, 15 exploited.
- tobesoft xplatformtobesoft XPLATFORM Arbitrary file execution Vulnerability8.1 High
- tobesoft nexacro, tobesoft co.,ltd nexacro 17 +1 moretobesoft Nexacro arbitrary file download vulnerability8.8 High
- edrhyme co.,ltd qcp 200w, qcp qcp200w firmware +1 moreEDrhyme QCP 200W Information Exposure Vulnerability7.5 High
- mattermost, mattermost server +1 moreAuthorized users are allowed to install old plugin versions from the Marketplace4.7 Medium
- mattermost, mattermost server +1 moreInvitation Email is resent as a Reminder after invalidating pending email invites3.7 Low
- e4j s.r.l. vikbooking hotel booking engine & pms (wordpress plugin), vikwp vikbooking hotel booking engine \& property management system plugin +1 moreWordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.5.3 - Sensitive Data Exposure vulnerability5.3 Medium
- e4j s.r.l. vikbooking hotel booking engine & pms (wordpress plugin), vikwp vikbooking hotel booking engine \& property management system plugin +1 moreWordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.5.3 - Arbitrary File Upload leading to RCE9.8 Critical
- formalmsAn Unauthenticated time-based blind SQL injection vulnerability exists in Forma LMS prior to v.1...9.8 Critical
- ecjia daojia** DISPUTED ** ecjia-daojia 1.38.1-20210202629 is vulnerable to information leakage via content...7.5 High
- git, debian linux, fedoraproject extra packages for enterprise linux +1 more +3 moreCommand Injection8.1 High
- ibm security guardiumIBM Security Guardium 10.5 stores user credentials in plain clear text which can be read by a...4.1 Medium
- ibm security guardiumIBM Security Guardium 10.5 and 11.3 uses weaker than expected cryptographic algorithms that could...3.7 Low
- ibm security guardiumIBM Security Guardium 11.3 could allow a remote attacker to obtain sensitive information, caused...5.9 Medium
- ibm sterling b2b integratorIBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.5 and 6.1.0.0 through 6.1.1.0...4.3 Medium
- citrix xenmobile serverIn Citrix XenMobile Server through 10.12 RP9, there is an Authenticated Directory Traversal...8.8 High
- invicti acunetixInvicti Acunetix before 14 allows CSV injection via the Description field on the Add Targets page...8.8 High
microcode_ctlTuxCareUpdate of microcode_ctlNo score- liferay portal, digital experience platform +1 moreLiferay Portal and Liferay DXP fails to check permissions to view sites/groups4.3 Medium
- liferay portal, digital experience platform +1 moreLiferay Portal and Liferay DXP allows arbitrary injection via the name of an asset category5.4 Medium
- veritas netbackupVeritas NetBackup OpsCenter Analytics 9.1 allows XSS via the NetBackup Master Server Name,...5.4 Medium
- microfinance management system project management systemA SQL injection vulnerability exists in Microfinance Management System 1.0 when MySQL is being...9.8 Critical
- d2l brightspaceAn Access Control vulnerability exists in Desire2Learn/D2L Learning Management System (LMS) 20.21...6.5 Medium
- posthog, posthog posthog/posthog +1 moreOpen redirect vulnerability via endpoint authorize_and_redirect/?redirect= in posthog/posthog6.1 Medium
- abacus research ag erp, abacus erp 2018, erp 2019 +3 more +5 moreMulti Factor Authentication Bypass in various versions of Abacus ERP8.1 High
- selenium gridSelenium Server (Grid) CSRF8.8 High
- hashicorp consul, fedoraproject fedora +1 moreHashicorp Consul HTTP health check endpoints returning an HTTP redirect may be abused as SSRF vector7.5 High
- elementor website builder, elemntor elementor website builder +1 moreElementor Website Builder 3.6.0 - 3.6.2 - Missing Authorization to Remote Code Execution8.8 High
- fleetdm fleetImproper Authorization in github.com/fleetdm/fleet6.5 Medium
- zohocorp manageengine adselfservice plus, manageengine adaudit plus, manageengine admanager plus +1 more +3 moreZoho ManageEngine ADSelfService Plus before 6121, ADAuditPlus 7060, Exchange Reporter Plus 5701,...8.8 High
- http-swagger project http-swaggerhttp-swagger XSS via PUT requests6.1 Medium
- http-swagger project http-swaggerDenial of service in http-swagger7.5 High
- autolinks project autolinksAutolinks <= 1.0.1 - Stored Cross-Site Scripting via CSRF5.4 Medium
- 10up safe svgSafe SVG < 1.9.10 - SVG Sanitisation Bypass6.1 Medium
- unknown good & bad comments, good-bad-comments project good-bad-comments +1 moreGood & Bad Comments <= 1.0.0 - Admin+ Stored Cross-Site Scripting4.8 Medium
- unknown page security & membership, contextureintl page security \& membership +1 morePage Security & Membership <= 1.5.15 - Admin+ Stored Cross-Site Scripting4.8 Medium
- thank me later project me later, unknown thank me later +1 moreThank Me Later <= 3.3.4 - Admin+ Stored Cross-Site Scripting4.8 Medium
- unknown rsvp and event management plugin, wpchill rsvp and event management +1 moreRSVP and Event Management < 2.7.8 - Unauthenticated Entries Export5.3 Medium
- villatheme exmage, unknown exmage – wordpress image links +1 moreEXMAGE < 1.0.7 - Admin+ Blind SSRF7.2 High
- codeastrology woo product table, unknown product table for woocommerce (wooproducttable) +1 moreWoo Product Table < 3.1.2 - Unauthenticated Arbitrary Function Call9.8 Critical
- wp downgrade project downgrade, unknown wp downgrade | specific core version +1 moreWP Downgrade < 1.2.3 - Admin+ Stored Cross-Site Scripting4.8 Medium
- incsub hummingbird, unknown hummingbird – optimize speed, enable cache, minify css & defer critical js +1 moreHummingbird < 3.3.2 - Admin+ Stored Cross-Site Scripting4.8 Medium
- calderaforms caldera forms, unknown caldera forms – more than contact forms +1 moreCaldera Forms < 1.9.7 - Reflected Cross-Site Scripting6.1 Medium
- daily prayer time project prayer time, mmrs151 daily prayer time +1 moreDaily Prayer Time < 2022.03.01 - Unauthenticated SQLi9.8 Critical
- searchiq, searchiq – the search solution, unknown searchiq – the search solution +2 moreSearchIQ < 3.9 - Unauthenticated Stored XSS6.1 Medium
- loco translate project translate, timwhitlock loco translate +1 moreLoco Translate < 2.6.1 - Authenticated Stored Cross-Site Scripting5.4 Medium
- text hover project hover, unknown text hover +1 moreText Hover < 4.2 - Admin+ Stored Cross-Site Scripting4.8 Medium
- awesomemotive easy digital downloads, unknown easy digital downloads – simple ecommerce for selling digital files +1 moreEasy Digital Downloads < 2.11.6 - Arbitrary Payment Note Insertion via CSRF4.3 Medium
- awesomemotive easy digital downloads, unknown easy digital downloads – simple ecommerce for selling digital files +1 moreEasy Digital Downloads < 2.11.6 - Admin+ Stored Cross-Site Scripting4.8 Medium
- ad injection project injection, unknown ad injection +1 moreAd Injection <= 1.2.0.19 - Admin+ Stored Cross-Site Scripting & RCE7.2 High
- easysocialfeed easy social feed, sjaved easy social feed – social photos gallery – post feed – like box, unknown easy social feed pro +2 moreEasy Social Feed < 6.2.7 - Reflected Cross-Site Scripting6.1 Medium
- Show moreLoading…