CVEs published in April 2022
3,733 vulnerabilities, 310 critical, 15 exploited.
- rtx project rtx, rtxteam rtxteam/rtx +1 moreSQL injection vulnerability in ARAX-UI Synonym Lookup functionality in rtxteam/rtx10.0 Critical
- livehelperchat livehelperchat/livehelperchat, live helper chat +1 moreCross-site Scripting (XSS) in livehelperchat/livehelperchat3.8 Low
- emlog, unspecified emlog pro +1 moreEmlog Pro POST Parameter cross site scripting3.5 Low
- mediawikiThe Private Domains extension for MediaWiki through 1.37.2 (before...4.3 Medium
- mediawikiThe SemanticDrilldown extension for MediaWiki through 1.37.2 (before...9.8 Critical
- mediawikiThe FanBoxes extension for MediaWiki through 1.37.2 (before...4.3 Medium
- mediawikiThe admin API module in the QuizGame extension for MediaWiki through 1.37.2 (before...9.8 Critical
- mediawikiThe Nimbus skin for MediaWiki through 1.37.2 (before 6f9c8fb868345701d9544a54d9752515aace39df)...6.1 Medium
- xwiki, xwiki xwiki-commons +1 moreArbitrary filesystem write access from Velocity7.5 High
zendframework/zend-diactorosPackagist,zendframework/zend-feedPackagist,zendframework/zend-httpPackagist +2 moreURL Rewrite vulnerability in multiple zendframework componentsNo scoreorg.keycloak:keycloak-parentMavenReflected XSS on clients-registrations endpointNo scoreorg.keycloak:keycloak-servicesMavenKeycloak is vulnerable to IDN homograph attackNo score- ghost sqlite3Denial of Service (DoS)7.5 High
- rt-solar solar appscreenerSolar appScreener through 3.10.4, when a valid license is not present, allows XXE and SSRF...9.8 Critical
- limbasLimbas 4.3.36.1319 is vulnerable to Cross Site Scripting (XSS).6.1 Medium
- northern.tech menderThe iot-manager microservice 1.0.0 in Northern.tech Mender Enterprise before 3.2.2 allows SSRF...9.8 Critical
- northern.tech menderThe Deviceconnect microservice through 1.3.0 in Northern.tech Mender Enterprise before 3.2.2....8.8 High
- wbce cmsWBCE CMS 1.5.2 is vulnerable to Cross Site Scripting (XSS).6.1 Medium
- victor cms project cmsSQL Injection vulnerability in Victor CMS v1.0, via the user_name parameter to /includes/login.php.7.5 High
- xwiki commons, xwiki-commons +1 moreArbitrary file access through XML parsing in org.xwiki.commons:xwiki-commons-xml4.9 Medium
- zohocorp manageengine access manager plus, manageengine pam360, manageengine password manager pro +2 moreZoho ManageEngine Access Manager Plus before 4302, Password Manager Pro before 12007, and PAM360...9.8 Critical
- hermit project hermit, mufeng hermit 音乐播放器 (wordpress plugin) +1 moreWordPress Hermit 音乐播放器 plugin <= 3.1.6 - Unauthenticated SQL Injection SQLi) vulnerability8.3 High
- hermit project hermit, mufeng hermit 音乐播放器 (wordpress plugin) +1 moreWordPress Hermit 音乐播放器 plugin <= 3.1.6 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities5.4 Medium
- hermit project hermit, mufeng hermit 音乐播放器 (wordpress plugin) +1 moreWordPress Hermit 音乐播放器 plugin <= 3.1.6 - Cross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS) vulnerability4.7 Medium
- hermit project hermit, mufeng hermit 音乐播放器 (wordpress plugin) +1 moreWordPress Hermit 音乐播放器 plugin <= 3.1.6 - Authenticated SQL Injection (SQLi) vulnerability7.4 High
- ibm infosphere information serverIBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability...5.4 Medium
- ibm infosphere information serverIBM InfoSphere Information Server 11.7 could allow an authenticated user to view information of...6.5 Medium
- ibm infosphere information serverIBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability...5.2 Medium
- ibm infosphere information serverIBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability...5.4 Medium
- ibm infosphere information serverIBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability...5.4 Medium
- debian linux, linux kernel, netapp h300e firmware +8 more +10 moreA vulnerability was found in the pfkey_register function in net/key/af_key.c in the Linux kernel....7.1 High
- facturascripts, neorazorx neorazorx/facturascripts +1 moreStored XSS via upload plugin functionality in zip format in neorazorx/facturascripts9.0 Critical
- ravpage project ravpage, mati skiba @ rav messer ravpage (wordpress plugin) +1 moreWordPress Ravpage plugin <= 2.16 - Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability6.1 Medium
- footer-text project footer-text, shea bunge footer text (wordpress plugin) +1 moreWordPress Footer Text plugin <= 2.0.3 - Cross-Site Request Forgery (CSRF) leading to Cross-Site Scripting (XSS) vulnerability6.1 Medium
- maharaIn Mahara before 20.10.5, 21.04.4, 21.10.2, and 22.04.0, a site using Isolated Institutions is...7.5 High
- maharaMahara before 20.10.5, 21.04.4, 21.10.2, and 22.04.0 allows stored XSS when a particular...5.4 Medium
- zoom on-premise meeting connector controller, on-premise meeting connector mmr +1 moreProcess memory exposure in Zoom on-premise Meeting services6.5 Medium
- zoom meetings, vdi windows meeting clients, zoom video communications inc client for meetings for windows +4 more +6 moreLocal privilege escalation in Windows Zoom Clients7.9 High
- zoom meetings, zoom video communications inc client for meetings for macos (standard and for it admin) +1 moreUpdate package downgrade in Zoom Client for Meetings for MacOS7.5 High
- elcomplus smartptt, smartptt scada +1 moreElcomplus SmartPtt Improper Authorization8.8 High
- elcomplus smartptt, smartptt scada +1 moreElcomplus SmartPtt Cross-site Scripting9.0 Critical
- elcomplus smartptt, smartptt scada +1 moreElcomplus SmartPtt Unrestricted Upload of File with Dangerous Type9.8 Critical
- elcomplus smartptt, smartptt scada +1 moreElcomplus SmartPtt Path Traversal4.9 Medium
- shopwareMultiple valid tokens for password reset in Shopware6.4 Medium
- shopwareMalfunction of Cross-Site Request Forgery token validation7.5 High
- naviwebs navigate cmsA Server-Side Request Forgery (SSRF) in feed_parser class of Navigate CMS v2.9.4 allows remote...4.9 Medium
- dscms project dscmsDSCMS v3.0 was discovered to contain an arbitrary file deletion vulnerability via /controller/Adv...9.1 Critical
- php mysql admin panel generator project mysql admin panel generatorA cross-site scripting (XSS) vulnerability in PHP MySQL Admin Panel Generator v1 allows attackers...5.4 Medium
- lyonbros turtlTurtlapp Turtle Note v0.7.2.6 does not filter the <meta> tag during markdown parsing, allowing...9.0 Critical
- shopwareNon-Stored Cross-site Scripting in Shopware storefront5.4 Medium
- Show moreLoading…