Skip to content
OpenAdvisories

Archive

5 January 2022

Vulnerabilities first published on this day (UTC), newest first.

← December 2021 2022 / January /5 February 2022 →
  1. 110
  2. 22
  3. 3104
  4. 456
  5. 535
  6. 658
  7. 7102
  8. 817
  9. 910
  10. 1048
  11. 11135
  12. 1267
  13. 13158
  14. 14148
  15. 1515
  16. 163
  17. 1737
  18. 1885
  19. 19233
  20. 2072
  21. 2183
  22. 224
  23. 234
  24. 2478
  25. 25114
  26. 2652
  27. 2787
  28. 28167
  29. 297
  30. 307
  31. 3128
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Medium —
    CVE-2020-27428

    Cross-site Scripting in Scratch-Svg-Renderer

    A DOM-based cross-site scripting (XSS) vulnerability in Scratch-Svg-Renderer v0.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted sb3 file.

    scratch-svg-renderer npm
  • Medium 5.9
    CVE-2022-21653

    Hash collision in typelevel jawn

    Jawn is an open source JSON parser. Extenders of the `org.typelevel.jawn.SimpleFacade` and `org.typelevel.jawn.MutableFacade` who don't override `objectContext()` are vulnerable to a hash collision attack which may result in a denial of service. Most applicat…

    typelevel jawn org.typelevel:jawn-parser_2.13 jawn Ubuntu Maven
  • Medium 6.8
    CVE-2022-21651

    Open redirect in shopware

    Shopware is an open source e-commerce software platform. An open redirect vulnerability has been discovered. Users may be arbitrary redirected due to incomplete URL handling in the shopware router. This issue has been resolved in version 5.7.7. There is no wo…

    shopware shopware shopware/shopware Packagist
  • Medium 4.3
    CVE-2022-21642

    Exposure of whisper participants in discourse

    Discourse is an open source platform for community discussion. In affected versions when composing a message from topic the composer user suggestions reveals whisper participants. The issue has been patched in stable version 2.7.13 and beta version 2.8.0.beta…

    Discourse Discourse
  • Medium 5.4
    CVE-2022-22109

    DayByDay CRM - Stored Cross-Site Scripting (XSS) in Task Title

    In Daybyday CRM, version 2.2.0 is vulnerable to Stored Cross-Site Scripting (XSS) vulnerability that allows low privileged application users to store malicious scripts in the title field of new tasks. These scripts are executed in a victim’s browser when they…

    Bottelet DaybydayCRM flarepoint bottelet/flarepoint Packagist
  • Medium 4.3
    CVE-2022-22108

    DayByDay CRM - Missing Authorization when Viewing Absences

    In Daybyday CRM, versions 2.0.0 through 2.2.0 are vulnerable to Missing Authorization. An attacker that has the lowest privileges account (employee type user), can view the absences of all users in the system including administrators. This type of user is not…

    Bottelet DaybydayCRM flarepoint bottelet/flarepoint Packagist
  • Medium 4.3
    CVE-2022-22107

    DayByDay CRM - Missing Authorization when Viewing Appointments

    In Daybyday CRM, versions 2.0.0 through 2.2.0 are vulnerable to Missing Authorization. An attacker that has the lowest privileges account (employee type user), can view the appointments of all users in the system including administrators. However, this type o…

    Bottelet DaybydayCRM flarepoint bottelet/flarepoint Packagist
  • Medium 5.3
    CVE-2020-15933

    A exposure of sensitive information to an unauthorized actor in Fortinet FortiMail versions 6.0.9 and below, FortiMail …

    Fortinet Fortinet FortiMail Network devices
  • Medium 4.6
    CVE-2021-22567

    Bidirectional Override in Dart SDK

    Bidirectional Unicode text can be interpreted and compiled differently than how it appears in editors which can be exploited to get nefarious code passed a code review by appearing benign. An attacker could embed a source that is invisible to a code reviewer …

    Google Dart SDK