Lista CVE - 2022 / Aprile
Visualizzazione 1701 - 1800 di 2039 CVE per Aprile 2022 (Pagina 18 di 21)
| ID CVE | Data | Titolo |
|---|---|---|
| CVE-2022-27406 | 2022-04-22 | FreeType commit 22a0cccb4d9d002f33c1ba7a4b36812c7d4f46b5 was discovered to contain a segmentation violation via the function FT_Request_Size. |
| CVE-2022-29582 | 2022-04-22 | In the Linux kernel before 5.17.3, fs/io_uring.c has a use-after-free due to a race condition in io_uring timeouts. This can be triggered by a local user who has no access... |
| CVE-2022-29583 | 2022-04-22 | service_windows.go in the kardianos service package for Go omits quoting that is sometimes needed for execution of a Windows service executable from the intended directory. NOTE: this finding could not... |
| CVE-2022-26672 | 2022-04-22 | ASUS WebStorage - Use of Hard-coded Credentials |
| CVE-2022-26673 | 2022-04-22 | ASUS RT-AX88U - Stored XSS |
| CVE-2022-26674 | 2022-04-22 | ASUS RT-AX88U - Format String |
| CVE-2022-1429 | 2022-04-22 | SQL injection in GridHelperService.php in pimcore/pimcore |
| CVE-2022-28074 | 2022-04-22 | Halo-1.5.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via \admin\index.html#/system/tools. |
| CVE-2022-1437 | 2022-04-22 | Heap-based Buffer Overflow in radareorg/radare2 |
| CVE-2021-36203 | 2022-04-22 | Johnson Controls Metasys SCT Pro |
| CVE-2021-32929 | 2022-04-22 | Uffizio GPS Tracker Cross-site Request Forgery |
| CVE-2021-32927 | 2022-04-22 | Uffizio GPS Tracker Cross-site Scripting |
| CVE-2020-14123 | 2022-04-22 | There is a pointer double free vulnerability in Some MIUI Services. When a function is called, the memory pointer is copied to two function modules, and an attacker can cause... |
| CVE-2022-29589 | 2022-04-22 | Crypt Server before 3.3.0 allows XSS in the index view. This is related to serial, computername, and username. |
| CVE-2022-1439 | 2022-04-22 | Reflected XSS on demo.microweber.org/demo/module/ in microweber/microweber |
| CVE-2021-20464 | 2022-04-22 | IBM Cognos Analytics PowerPlay (IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7) could be vulnerable to an XML Bomb attack by a malicious authenticated user. IBM X-Force ID: 196813. |
| CVE-2021-29824 | 2022-04-22 | IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to priviledge escalation where a lower level user could have read access to to the 'Data Connections' page to which they... |
| CVE-2021-38886 | 2022-04-22 | IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the... |
| CVE-2021-38903 | 2022-04-22 | IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to inject malicious script... |
| CVE-2021-38904 | 2022-04-22 | IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 could allow a remote attacker to obtain credentials from a user's browser via incorrect autocomplete settings. IBM X-Force ID: 209693. |
| CVE-2021-38905 | 2022-04-22 | IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 could allow an authenticated user to view report pages that they should not have access to. IBM X-Force ID: 209697. |
| CVE-2021-38946 | 2022-04-22 | IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality... |
| CVE-2022-1440 | 2022-04-22 | Command Injection vulnerability in [email protected] in yarkeev/git-interface |
| CVE-2022-27340 | 2022-04-22 | MCMS v5.2.7 contains a Cross-Site Request Forgery (CSRF) via /role/saveOrUpdateRole.do. This vulnerability allows attackers to escalate privileges and modify data. |
| CVE-2022-27341 | 2022-04-22 | JFinalCMS v2.0 was discovered to contain a SQL injection vulnerability via the Article Management function. |
| CVE-2022-27342 | 2022-04-22 | Link-Admin v0.0.1 was discovered to contain a SQL injection vulnerability via DictRest.ResponseResult(). |
| CVE-2021-3721 | 2022-04-22 | A denial of service vulnerability was reported in Lenovo PCManager prior to version 4.0.20.10282 that could allow an attacker with local access to trigger a blue screen error. |
| CVE-2021-3722 | 2022-04-22 | A denial of service vulnerability was reported in Lenovo PCManager prior to version 4.0.40.2175 that could allow configuration files to be written to non-standard locations during installation. |
| CVE-2021-3898 | 2022-04-22 | Versions of Motorola Ready For and Motorola Device Help Android applications prior to 2021-04-08 do not properly verify the server certificate which could lead to the communication channel being accessible... |
| CVE-2021-3970 | 2022-04-22 | A potential vulnerability in LenovoVariable SMI Handler due to insufficient validation in some Lenovo Notebook models BIOS may allow an attacker with local access and elevated privileges to execute arbitrary... |
| CVE-2021-3971 | 2022-04-22 | A potential vulnerability by a driver used during older manufacturing processes on some consumer Lenovo Notebook devices that was mistakenly included in the BIOS image could allow an attacker with... |
| CVE-2021-3972 | 2022-04-22 | A potential vulnerability by a driver used during manufacturing process on some consumer Lenovo Notebook devices' BIOS that was mistakenly not deactivated may allow an attacker with elevated privileges to... |
| CVE-2021-4210 | 2022-04-22 | A potential vulnerability in the SMI callback function used in the NVME driver in some Lenovo Desktop, ThinkStation, and ThinkEdge models may allow an attacker with local access and elevated... |
| CVE-2021-4211 | 2022-04-22 | A potential vulnerability in the SMI callback function used in the SMBIOS event log driver in some Lenovo Desktop, ThinkStation, and ThinkEdge models may allow an attacker with local access... |
| CVE-2021-4212 | 2022-04-22 | A potential vulnerability in the SMI callback function used in the Legacy BIOS mode driver in some Lenovo Notebook models may allow an attacker with local access and elevated privileges... |
| CVE-2022-0192 | 2022-04-22 | A DLL search path vulnerability was reported in Lenovo PCManager prior to version 4.0.40.2175 that could allow privilege escalation. |
| CVE-2022-0354 | 2022-04-22 | A vulnerability was reported in Lenovo System Update that could allow a local user with interactive system access the ability to execute code with elevated privileges only during the installation... |
| CVE-2022-0636 | 2022-04-22 | A denial of service vulnerability was reported in Lenovo Thin Installer prior to version 1.3.0039 that could trigger a system crash. |
| CVE-2022-1107 | 2022-04-22 | During an internal product security audit a potential vulnerability due to use of Boot Services in the SmmOEMInt15 SMI handler was discovered in some ThinkPad models could be exploited by... |
| CVE-2022-1108 | 2022-04-22 | A potential vulnerability due to improper buffer validation in the SMI handler LenovoFlashDeviceInterface in Thinkpad X1 Fold Gen 1 could be exploited by an attacker with local access and elevated... |
| CVE-2021-3849 | 2022-04-22 | An authentication bypass vulnerability was discovered in the web interface of the Lenovo Fan Power Controller2 (FPC2) and Lenovo System Management Module (SMM) firmware that could allow an unauthenticated attacker... |
| CVE-2021-3897 | 2022-04-22 | An authentication bypass vulnerability was discovered in an internal service of the Lenovo Fan Power Controller2 (FPC2) and Lenovo System Management Module (SMM) firmware during an that could allow an... |
| CVE-2022-1427 | 2022-04-22 | Out-of-bounds Read in mrb_obj_is_kind_of in in mruby/mruby |
| CVE-2022-1444 | 2022-04-23 | heap-use-after-free in radareorg/radare2 |
| CVE-2022-1445 | 2022-04-24 | Stored Cross Site Scripting vulnerability in the checked_out_to parameter in snipe/snipe-it |
| CVE-2022-1452 | 2022-04-24 | Out-of-bounds Read in r_bin_java_bootstrap_methods_attr_new function in radareorg/radare2 |
| CVE-2022-1451 | 2022-04-24 | Out-of-bounds Read in r_bin_java_constant_value_attr_new function in radareorg/radare2 |
| CVE-2021-45837 | 2022-04-25 | It is possible to execute arbitrary commands as root in Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517) by sending a specifically crafted input to /tos/index.php?app/del. |
| CVE-2021-45839 | 2022-04-25 | It is possible to obtain the first administrator's hash set up on the system in Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517) as well as other information such as MAC address,... |
| CVE-2021-45841 | 2022-04-25 | In Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517), an attacker can self-sign session cookies by knowing the target's MAC address and the user's password hash. Guest users (disabled by default) can... |
| CVE-2022-1441 | 2022-04-25 | MP4Box is a component of GPAC-2.0.0, which is a widely-used third-party package on RPM Fusion. When MP4Box tries to parse a MP4 file, it calls the function `diST_box_read()` to read... |
| CVE-2022-23457 | 2022-04-25 | Path Traversal in ESAPI |
| CVE-2022-24792 | 2022-04-25 | Potential infinite loop when parsing WAV format file in PJSIP |
| CVE-2022-29546 | 2022-04-25 | HtmlUnit NekoHtml Parser before 2.61.0 suffers from a denial of service vulnerability. Crafted input associated with the parsing of Processing Instruction (PI) data leads to heap memory consumption. This is... |
| CVE-2022-29077 | 2022-04-25 | A heap-based buffer overflow exists in rippled before 1.8.5. The vulnerability allows attackers to cause a crash or execute commands remotely on a rippled node, which may lead to XRPL... |
| CVE-2019-25059 | 2022-04-25 | Artifex Ghostscript through 9.26 mishandles .completefont. NOTE: this issue exists because of an incomplete fix for CVE-2019-3839. |
| CVE-2022-29603 | 2022-04-25 | A SQL Injection vulnerability exists in UniverSIS UniverSIS-API through 1.2.1 via the $select parameter to multiple API endpoints. A remote authenticated attacker could send crafted SQL statements to a vulnerable... |
| CVE-2021-40680 | 2022-04-25 | There is a Directory Traversal vulnerability in Artica Proxy (4.30.000000 SP206 through SP255, and VMware appliance 4.30.000000 through SP273) via the filename parameter to /cgi-bin/main.cgi. |
| CVE-2022-29264 | 2022-04-25 | An issue was discovered in coreboot 4.13 through 4.16. On APs, arbitrary code execution in SMM may occur. |
| CVE-2022-1457 | 2022-04-25 | Store XSS in title parameter executing at EditUser Page & EditProducto page in neorazorx/facturascripts |
| CVE-2022-1458 | 2022-04-25 | Stored XSS Leads To Session Hijacking in openemr/openemr |
| CVE-2022-1459 | 2022-04-25 | Non-Privilege User Can View Patient’s Disclosures in openemr/openemr |
| CVE-2022-28871 | 2022-04-25 | Denial-of-Service (DoS) Vulnerability |
| CVE-2022-1461 | 2022-04-25 | Non Privilege User can Enable or Disable Registered in openemr/openemr |
| CVE-2021-45842 | 2022-04-25 | It is possible to obtain the first administrator's hash set up in Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517) on the system as well as other information such as MAC address,... |
| CVE-2021-45840 | 2022-04-25 | It is possible to execute arbitrary commands as root in Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517) by sending specifically crafted input to /tos/index.php?app/app_start_stop. |
| CVE-2021-45836 | 2022-04-25 | An authenticated attacker can execute arbitrary commands as root in Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517) by injecting a maliciously crafted input in the request through /tos/index.php?app/hand_app. |
| CVE-2021-36460 | 2022-04-25 | VeryFitPro (com.veryfit2hr.second) 3.2.8 hashes the account's password locally on the device and uses the hash to authenticate in all communication with the backend API, including login, registration and changing of... |
| CVE-2022-27103 | 2022-04-25 | element-plus 2.0.5 is vulnerable to Cross Site Scripting (XSS) via el-table-column. |
| CVE-2022-28586 | 2022-04-25 | XSS in edit page of Hoosk 1.8.0 allows attacker to execute javascript code in user browser via edit page with XSS payload bypass filter some special chars. |
| CVE-2022-27428 | 2022-04-25 | A stored cross-site scripting (XSS) vulnerability in /index.php/album/add of GalleryCMS v2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the album_name parameter. |
| CVE-2022-27429 | 2022-04-25 | Jizhicms v1.9.5 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via /admin.php/Plugins/update.html. |
| CVE-2022-28053 | 2022-04-25 | Typemill v1.5.3 was discovered to contain an arbitrary file upload vulnerability via the upload function. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file. |
| CVE-2022-27135 | 2022-04-25 | xpdf 4.03 has heap buffer overflow in the function readXRefTable located in XRef.cc. An attacker can exploit this bug to cause a Denial of Service (Segmentation fault) or other unspecified... |
| CVE-2022-28506 | 2022-04-25 | There is a heap-buffer-overflow in GIFLIB 5.2.1 function DumpScreen2RGB() in gif2rgb.c:298:45. |
| CVE-2022-27311 | 2022-04-25 | Gibbon v3.4.4 and below allows attackers to execute a Server-Side Request Forgery (SSRF) via a crafted URL. |
| CVE-2022-28093 | 2022-04-25 | SCBS Online Sports Venue Reservation System v1.0 was discovered to contain a local file inclusion vulnerability which allow attackers to execute arbitrary code via a crafted PHP file. |
| CVE-2022-28094 | 2022-04-25 | SCBS Online Sports Venue Reservation System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the fid parameter at booking.php. |
| CVE-2022-29078 | 2022-04-25 | The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with... |
| CVE-2022-26111 | 2022-04-25 | The BeanShell components of IRISNext through 9.8.28 allow execution of arbitrary commands on the target server by creating a custom search (or editing an existing/predefined search) of the documents. The... |
| CVE-2022-26597 | 2022-04-25 | Cross-site scripting (XSS) vulnerability in the Layout module's Open Graph integration in Liferay Portal 7.3.0 through 7.4.0, and Liferay DXP 7.3 before service pack 3 allows remote attackers to inject... |
| CVE-2021-39040 | 2022-04-25 | IBM Planning Analytics Workspace 2.0 could be vulnerable to malicious file upload by not validating the file types or sizes. Attackers can make use of this weakness and upload malicious... |
| CVE-2022-22392 | 2022-04-25 | IBM Planning Analytics Local 2.0 could allow an attacker to upload arbitrary executable files which, when executed by an unsuspecting victim could result in code execution. IBM X-Force ID: 222066. |
| CVE-2022-26596 | 2022-04-25 | Cross-site scripting (XSS) vulnerability in Journal module's web content display configuration page in Liferay Portal 7.1.0 through 7.3.3, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack... |
| CVE-2022-27375 | 2022-04-25 | Tenda AX12 V22.03.01.21_CN was discovered to contain a Cross-Site Request Forgery (CSRF) via the function sub_422168 at /goform/WifiExtraSet. |
| CVE-2022-27374 | 2022-04-25 | Tenda AX12 V22.03.01.21_CN was discovered to contain a Cross-Site Request Forgery (CSRF) via the function sub_42E328 at /goform/SysToolReboot. |
| CVE-2021-24800 | 2022-04-25 | DW Question & Answer Pro <= 1.3.4 - Arbitrary Comment Edition via IDOR |
| CVE-2021-24805 | 2022-04-25 | DW Question & Answer Pro <= 1.3.4 - Multiple CSRF |
| CVE-2021-24957 | 2022-04-25 | Advanced Page Visit Counter < 6.1.6 - Subscriber+ Blind SQL injection |
| CVE-2021-25094 | 2022-04-25 | Tatsu < 3.3.12 - Unauthenticated RCE |
| CVE-2021-25111 | 2022-04-25 | English WordPress Admin < 1.5.2 - Unauthenticated Open Redirect |
| CVE-2021-46780 | 2022-04-25 | Easy Google Maps < 1.9.32 - Reflected Cross-Site Scripting |
| CVE-2021-46781 | 2022-04-25 | Coming Soon by Supsystic < 1.7.6 - Reflected Cross-Site Scripting |
| CVE-2021-46782 | 2022-04-25 | Pricing Table by Supsystic < 1.9.5 - Reflected Cross-Site Scripting |
| CVE-2021-4225 | 2022-04-25 | SP Project & Document Manager < 4.24 - Subscriber+ Shell Upload |
| CVE-2022-0287 | 2022-04-25 | Mycred < 2.4.4.1 - Subscriber+ User E-mail Addresses Disclosure |
| CVE-2022-0363 | 2022-04-25 | myCred < 2.4.4 - Subscriber+ Arbitrary Post Creation |
| CVE-2022-0398 | 2022-04-25 | ThirstyAffiliates Affiliate Link Manager < 3.10.5 - Subscriber+ Arbitrary Affiliate Links Creation |
| CVE-2022-0541 | 2022-04-25 | Flo Launch < 2.4.1 - Missing Authentication Allow Full Site Takeover |
| CVE-2022-0634 | 2022-04-25 | ThirstyAffiliates < 3.10.5 - Subscriber+ unauthorized image upload + CSRF |