Skip to content
OpenAdvisories

Archive

28 January 2022

Vulnerabilities first published on this day (UTC), newest first.

← December 2021 2022 / January /28 February 2022 →
  1. 110
  2. 22
  3. 3104
  4. 456
  5. 535
  6. 658
  7. 7102
  8. 817
  9. 910
  10. 1048
  11. 11135
  12. 1267
  13. 13158
  14. 14148
  15. 1515
  16. 163
  17. 1737
  18. 1885
  19. 19233
  20. 2072
  21. 2183
  22. 224
  23. 234
  24. 2478
  25. 25114
  26. 2652
  27. 2787
  28. 28167
  29. 297
  30. 307
  31. 3128
All Critical High Medium Low Exploited only Public exploit

17 results · Clear filters · Feed

  • Medium 4.3
    GHSA-8w54-22w9-3g8f

    Cross-site Scripting and Open Redirect in Products.CMFPlone

    ### Impact Plone is vulnerable to reflected cross site scripting and open redirect when an attacker can get a compromised version of the image_view_fullscreen page in a cache, for example in Varnish. The technique is known as cache poisoning. Any later visito…

    products-cmfplone PyPI
  • Medium 5.9
    CVE-2022-21721

    DOS Vulnerability in next.js

    Next.js is a React framework. Starting with version 12.0.0 and prior to version 12.0.9, vulnerable code could allow a bad actor to trigger a denial of service attack for anyone using i18n functionality. In order to be affected by this CVE, one must use next s…

    next npm
  • Medium 6.1
    CVE-2022-23598

    Reflected XSS vulnerability when rendering error messages in laminas-form

    laminas-form is a package for validating and displaying simple and complex forms. When rendering validation error messages via the `formElementErrors()` view helper shipped with laminas-form, many messages will contain the submitted value. However, in laminas…

    laminas laminas-form laminas/laminas-form Packagist
  • Medium 4.3
    CVE-2022-23599

    Cross-site Scripting and Open Redirect in Products.ATContentTypes

    Products.ATContentTypes are the core content types for Plone 2.1 - 4.3. Versions of Plone that are dependent on Products.ATContentTypes prior to version 3.0.6 are vulnerable to reflected cross site scripting and open redirect when an attacker can get a compro…

    products-atcontenttypes PyPI
  • Medium 6.5
    CVE-2022-0395

    Cross-site Scripting (XSS) - Stored in livehelperchat/livehelperchat

    Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.

    LiveHelperChat livehelperchat/livehelperchat remdex/livehelperchat Packagist
  • Medium 5.6
    CVE-2021-23760

    Prototype Pollution

    The package keyget from 0.0.0 are vulnerable to Prototype Pollution via the methods set, push, and at which could allow an attacker to cause a denial of service and may lead to remote code execution. **Note:** This vulnerability derives from an incomplete fix…

    keyget npm
  • Medium 5.3
    CVE-2021-40404

    An authentication bypass vulnerability exists in the cgiserver.cgi Login functionality of reolink RLC-410W v3.0.0.136_2…

  • Medium 4.8
    CVE-2022-23979

    WordPress Ultimate Reviews plugin <= 3.0.15 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

    Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability discovered in Ultimate Reviews WordPress plugin (versions <= 3.0.15).

    Web / CMS
  • Medium 6.8
    CVE-2021-31567

    WordPress Download Monitor plugin <= 4.4.6 - Authenticated Arbitrary File Download vulnerability

    Authenticated (admin+) Arbitrary File Download vulnerability discovered in Download Monitor WordPress plugin (versions <= 4.4.6). The plugin allows arbitrary files, including sensitive configuration files such as wp-config.php, to be downloaded via the &downl…

    Web / CMS
  • Medium 6.1
    CVE-2021-23863

    HTML code injection vulnerability in Android Application, Bosch Video Security, version 3.2.3. or earlier, when success…

  • Medium 6.6
    CVE-2022-22791

    SYNEL - eharmony Authenticated Blind & Stored XSS

    SYNEL - eharmony Authenticated Blind & Stored XSS. Inject JS code into the "comments" field could lead to potential stealing of cookies, loading of HTML tags and JS code onto the system.

  • Medium 5.6
    CVE-2022-22790

    SYNEL - eharmony Directory Traversal

    SYNEL - eharmony Directory Traversal. Directory Traversal - is an attack against a server or a Web application aimed at unauthorized access to the file system. on the "Name" parameter the attacker can return to the root directory and open the host file. The p…

  • Medium 6.1
    CVE-2021-26264

    Emerson DeltaV Missing Authentication for Critical Function

    A specially crafted script could cause the DeltaV Distributed Control System Controllers (All Versions) to restart and cause a denial-of-service condition.

  • Medium 5.3
    CVE-2022-0394

    Cross-site Scripting (XSS) - Stored in livehelperchat/livehelperchat

    Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.

    LiveHelperChat livehelperchat/livehelperchat remdex/livehelperchat Packagist
  • Medium 4.9
    CVE-2022-21720

    SQL injection using custom CSS administration form in GLPI

    GLPI is a free asset and IT management software package. Prior to version 9.5.7, an entity administrator is capable of retrieving normally inaccessible data via SQL injection. Version 9.5.7 contains a patch for this issue. As a workaround, disabling the `Enti…

    glpi Ubuntu
  • Medium 6.1
    CVE-2022-21719

    Reflected XSS using reload button in GLPI

    GLPI is a free asset and IT management software package. All GLPI versions prior to 9.5.7 are vulnerable to reflected cross-site scripting. Version 9.5.7 contains a patch for this issue. There are no known workarounds.

    glpi Ubuntu
  • Medium 6.1
    CVE-2022-0392

    Heap-based Buffer Overflow in vim/vim

    Heap-based Buffer Overflow in GitHub repository vim prior to 8.2.

    vim vim/vim vim vim Debian Ubuntu Azure Linux Alpine