Skip to content
OpenAdvisories

Archive

25 January 2022

Vulnerabilities first published on this day (UTC), newest first.

← December 2021 2022 / January /25 February 2022 →
  1. 110
  2. 22
  3. 3104
  4. 456
  5. 535
  6. 658
  7. 7102
  8. 817
  9. 910
  10. 1048
  11. 11135
  12. 1267
  13. 13158
  14. 14148
  15. 1515
  16. 163
  17. 1737
  18. 1885
  19. 19233
  20. 2072
  21. 2183
  22. 224
  23. 234
  24. 2478
  25. 25114
  26. 2652
  27. 2787
  28. 28167
  29. 297
  30. 307
  31. 3128
All Critical High Medium Low Exploited only Public exploit

17 results · Clear filters · Feed

  • High 7.2
    CVE-2021-36296

    Dell VNX2 OE for File versions 8.1.21.266 and earlier, contain an authenticated remote code execution vulnerability. A …

    Dell VNX Control Station
  • High 7.2
    CVE-2021-36295

    Dell VNX2 OE for File versions 8.1.21.266 and earlier, contain an authenticated remote code execution vulnerability. A …

    Dell VNX Control Station
  • High 7.8
    CVE-2021-36289

    Dell VNX2 OE for File versions 8.1.21.266 and earlier, contain a sensitive information disclosure vulnerability. A loca…

    Dell VNX Control Station
  • High 8.6
    CVE-2021-43799 Public exploit

    RabbitMQ exposes ports with weak default secrets in Zulip Server

    Zulip is an open-source team collaboration tool. Zulip Server installs RabbitMQ for internal message passing. In versions of Zulip Server prior to 4.9, the initial installation (until first reboot, or restart of RabbitMQ) does not successfully limit the defau…

    zulip zulip
  • High 8.8
    CVE-2021-4133

    Improper Authorization in Keycloak

    A flaw was found in Keycloak in versions from 12.0.0 and before 15.1.1 which allows an attacker with any existing user account to create new default user accounts via the administrative REST API even when new user registration is disabled.

    org.keycloak:keycloak-services Maven
  • High 8.8
    CVE-2022-0335

    Cross Site Request Forgery in Moodle

    A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. The "delete badge alignment" functionality did not include the necessary token check to prevent a CSRF risk.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • High 8.8
    CVE-2022-0270

    Improper header sanitization in bored-agent causes escalation of privilege

    Prior to v0.6.1, bored-agent failed to sanitize incoming kubernetes impersonation headers allowing a user to override assigned user name and groups.

    Mirantis bored-agent
  • High 7.5
    CVE-2021-39031

    IBM WebSphere Application Server - Liberty 17.0.0.3 through 22.0.0.1 could allow a remote authenticated attacker to con…

    IBM WebSphere Application Server - Liberty
  • High 7.8
    CVE-2021-34869

    This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3-…

    Parallels Desktop
  • High 7.8
    CVE-2021-34868

    This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3-…

    Parallels Desktop
  • High 7.5
    CVE-2021-34867

    This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3-…

    Parallels Desktop
  • High 8.8
    CVE-2021-34866

    This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel 5.14-rc3. An…

    Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2021-34865

    This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of multiple NET…

    NETGEAR Multiple Routers Network devices
  • High 7.5
    CVE-2021-43863

    SQL Injection in FileContentProvider (GHSL-2021-1007)

    The Nextcloud Android app is the Android client for Nextcloud, a self-hosted productivity platform. The Nextcloud Android app uses content providers to manage its data. Prior to version 3.18.1, the providers `FileContentProvider` and `DiskLruImageCacheFilePro…

    Nextcloud android Android
  • High 7.5
    CVE-2022-23945

    Apache ShenYu missing authentication allows gateway registration

    Missing authentication on ShenYu Admin when register by HTTP. This issue affected Apache ShenYu 2.4.0 and 2.4.1.

    Apache Software Foundation Apache ShenYu (incubating) org.apache.shenyu:shenyu-common Maven
  • High 7.5
    CVE-2022-23223

    Apache ShenYu Password leakage

    On Apache ShenYu versions 2.4.0 and 2.4.1, and endpoint existed that disclosed the passwords of all users. Users are recommended to upgrade to version 2.4.2 or later.

    Apache Software Foundation Apache ShenYu (incubating) org.apache.shenyu:shenyu-common Maven
  • High 8.4
    CVE-2022-0351

    Access of Memory Location Before Start of Buffer in vim/vim

    Access of Memory Location Before Start of Buffer in GitHub repository vim/vim prior to 8.2.

    vim vim/vim vim vim Debian Ubuntu