Skip to content
OpenAdvisories

Archive

20 January 2022

Vulnerabilities first published on this day (UTC), newest first.

← December 2021 2022 / January /20 February 2022 →
  1. 110
  2. 22
  3. 3104
  4. 456
  5. 535
  6. 658
  7. 7102
  8. 817
  9. 910
  10. 1048
  11. 11135
  12. 1267
  13. 13158
  14. 14148
  15. 1515
  16. 163
  17. 1737
  18. 1885
  19. 19233
  20. 2072
  21. 2183
  22. 224
  23. 234
  24. 2478
  25. 25114
  26. 2652
  27. 2787
  28. 28167
  29. 297
  30. 307
  31. 3128
All Critical High Medium Low Exploited only Public exploit

72 results · Feed

  • Unscored —
    CVE-2021-46323

    Espruino 2v11.251 was discovered to contain a SEGV vulnerability via src/jsinteractive.c in jsiGetDeviceFromClass.

  • Medium 5.9
    CVE-2021-29785

    IBM Security SOAR V42 and V43could allow a remote attacker to obtain sensitive information, caused by the failure to pr…

    IBM Security SOAR
  • Unscored —
    CVE-2021-46061

    An SQL Injection vulnerability exists in Sourcecodester Computer and Mobile Repair Shop Management system (RSMS) 1.0 vi…

  • Unscored —
    CVE-2021-44090

    An SQL Injection vulnerability exists in Sourcecodester Online Reviewer System 1.0 via the password parameter.

  • Unscored —
    CVE-2021-44245

    An SQL Injection vulnerability exists in Courcecodester COVID 19 Testing Management System (CTMS) 1.0 via the (1) usern…

  • Unscored —
    CVE-2021-44244

    An SQL Injection vulnerabiity exists in Sourcecodester Logistic Hub Parcel's Management System 1.0 via the username par…

  • Unscored —
    CVE-2022-23120

    A code injection vulnerability in Trend Micro Deep Security and Cloud One - Workload Security Agent for Linux version 2…

    Trend Micro Trend Micro Deep Security Agent for Linux Linux
  • Unscored —
    CVE-2022-23119 EPSS 21%

    A directory traversal vulnerability in Trend Micro Deep Security and Cloud One - Workload Security Agent for Linux vers…

    Trend Micro Trend Micro Deep Security Agent for Linux Linux
  • Unscored —
    CVE-2021-44092

    An SQL Injection vulnerability exists in code-projects Pharmacy Management 1.0 via the username parameter in the admini…

  • Unscored —
    CVE-2021-44091

    A Cross-Site Scripting (XSS) vulnerability exists in Courcecodester Multi Restaurant Table Reservation System 1.0 in re…

  • Medium 5.5
    CVE-2022-0219 Public exploit

    Improper Restriction of XML External Entity Reference in skylot/jadx

    Improper Restriction of XML External Entity Reference in GitHub repository skylot/jadx prior to 1.3.2.

    skylot skylot/jadx io.github.skylot:jadx-core Maven
  • Unscored —
    CVE-2021-44829

    Cross Site Scripting (XSS) vulnerability exists in index.html in AFI WebACMS through 2.1.0 via the the ID parameter.

  • Unscored —
    CVE-2021-44734

    Embedded web server input sanitization vulnerability in Lexmark devices through 2021-12-07, which can which can lead to…

  • Unscored —
    CVE-2021-44736

    The initial admin account setup wizard on Lexmark devices allow unauthenticated access to the “out of service erase” fe…

  • Unscored —
    CVE-2021-44735

    Embedded web server command injection vulnerability in Lexmark devices through 2021-12-07.

  • Unscored —
    CVE-2021-44737

    PJL directory traversal vulnerability in Lexmark devices through 2021-12-07 that can be leveraged to overwrite internal…

  • Unscored —
    CVE-2021-44738

    Buffer overflow vulnerability has been identified in Lexmark devices through 2021-12-07 in postscript interpreter.

  • Medium 6.6
    CVE-2022-0285

    Cross-site Scripting (XSS) - Stored in pimcore/pimcore

    Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.2.9.

    pimcore pimcore/pimcore pimcore/pimcore Packagist
  • Medium 5.5
    CVE-2021-32039

    MongoDB Extension for VS Code may unexpectedly store credentials locally in clear text

    Users with appropriate file access may be able to access unencrypted user credentials saved by MongoDB Extension for VS Code in a binary file. These credentials may be used by malicious attackers to perform unauthorized actions. This vulnerability affects all…

    MongoDB MongoDB for VS Code
  • Unscored —
    CVE-2022-22820

    Due to the lack of media file checks before rendering, it was possible for an attacker to cause abnormal CPU consumptio…

    LINE LINE for Windows Windows
  • Medium 5.5
    CVE-2021-34600 Public exploit

    Telenot complex: Insecure AES Key Generation

    Telenot CompasX versions prior to 32.0 use a weak seed for random number generation leading to predictable AES keys used in the NFC tags used for local authorization of users. This may lead to total loss of trustworthiness of the installation.

    Telenot Electronic CompasX
  • Medium 4.3
    CVE-2022-0282

    Cross-site Scripting in microweber/microweber

    Cross-site Scripting in Packagist microweber/microweber prior to 1.2.11.

    microweber microweber/microweber microweber/microweber Packagist
  • High 7.5
    CVE-2022-0281 Scanner template EPSS 11%

    Exposure of Sensitive Information to an Unauthorized Actor in microweber/microweber

    Exposure of Sensitive Information to an Unauthorized Actor in Packagist microweber/microweber prior to 1.2.11.

    microweber microweber/microweber microweber/microweber Packagist
  • Medium 6.8
    CVE-2021-3866

    Cross-site Scripting (XSS) - Stored in zulip/zulip

    Cross-site Scripting (XSS) - Stored in GitHub repository zulip/zulip more than and including 44f935695d452cc3fb16845a0c6af710438b153d and prior to 3eb2791c3e9695f7d37ffe84e0c2184fae665cb6.

    zulip zulip/zulip
  • Unscored —
    CVE-2022-22733 Public exploit Scanner template EPSS 42%

    Access-Token in ElasticJob UI causes password disclosure

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache ShardingSphere ElasticJob-UI allows an attacker who has guest account to do privilege escalation. This issue affects Apache ShardingSphere ElasticJob-UI Apache ShardingSphere E…

    Apache Software Foundation Apache ShardingSphere ElasticJob-UI
  • Medium 6.5
    CVE-2021-45230

    Apache Airflow: Creating DagRuns didn't respect Dag-level permissions in the Webserver

    In Apache Airflow prior to 2.2.0. This CVE applies to a specific case where a User who has "can_create" permissions on DAG Runs can create Dag Runs for dags that they don't have "edit" permissions for.

    Apache Software Foundation Apache Airflow apache-airflow PyPI
  • High 7.2
    CVE-2022-0278

    Cross-site Scripting (XSS) - Stored in microweber/microweber

    Cross-site Scripting (XSS) - Stored in Packagist microweber/microweber prior to 1.2.11.

    microweber microweber/microweber microweber/microweber Packagist
  • Unscored —
    CVE-2021-43269

    In Code42 app before 8.8.0, eval injection allows an attacker to change a device’s proxy configuration to use a malicio…

  • Medium 6.5
    CVE-2022-0277

    Incorrect Permission Assignment for Critical Resource in microweber/microweber

    Incorrect Permission Assignment for Critical Resource in Packagist microweber/microweber prior to 1.2.11.

    microweber microweber/microweber microweber/microweber Packagist
  • High 7.3
    CVE-2022-21658 Public exploit

    Race condition in std::fs::remove_dir_all in rustlang

    Rust is a multi-paradigm, general-purpose programming language designed for performance and safety, especially safe concurrency. The Rust Security Response WG was notified that the `std::fs::remove_dir_all` standard library function is vulnerable a race condi…

    rust-lang rust rust rustc Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2021-46322

    Duktape v2.99.99 was discovered to contain a SEGV vulnerability via the component duk_push_tval in duktape/duk_api_stac…

    percona-server-5.6 percona-xtradb-cluster-5.6 mysql-5.5 mariadb-10.3 Debian Ubuntu
  • Unscored —
    CVE-2021-45417

    AIDE before 0.17.4 allows local users to obtain root privileges via crafted file metadata (such as XFS extended attribu…

    aide aide Debian Ubuntu