Skip to content
OpenAdvisories

Archive

7 January 2022

Vulnerabilities first published on this day (UTC), newest first.

← December 2021 2022 / January /7 February 2022 →
  1. 110
  2. 22
  3. 3104
  4. 456
  5. 535
  6. 658
  7. 7102
  8. 817
  9. 910
  10. 1048
  11. 11135
  12. 1267
  13. 13158
  14. 14148
  15. 1515
  16. 163
  17. 1737
  18. 1885
  19. 19233
  20. 2072
  21. 2183
  22. 224
  23. 234
  24. 2478
  25. 25114
  26. 2652
  27. 2787
  28. 28167
  29. 297
  30. 307
  31. 3128
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Critical 9.8
    CVE-2021-23543

    Sandbox Bypass

    All versions of package realms-shim are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector.

    realms-shim npm
  • Critical 9.8
    CVE-2021-23594

    Sandbox Bypass

    All versions of package realms-shim are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector.

    realms-shim npm
  • Critical 9.8
    CVE-2022-22817

    Arbitrary expression injection in Pillow

    PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method. A lambda expression could also be used.

    pillow pillow pillow pillow-python2 Debian Ubuntu Alpine PyPI
  • Critical 9.8
    CVE-2021-42392 Public exploit Scanner template EPSS 83%

    RCE in H2 Console

    The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database. An attacker may pass a JNDI driver name and a URL leading to a LDAP or RMI servers, causing remote code execution. This…

    h2database h2 com.h2database:h2 h2database Debian Ubuntu Maven