Skip to content
OpenAdvisories

Archive

January 2022

Vulnerabilities first published in this month (UTC), newest first.

← December 2021 2022 / January February 2022 →
  1. 110
  2. 22
  3. 3104
  4. 456
  5. 535
  6. 658
  7. 7102
  8. 817
  9. 910
  10. 1048
  11. 11135
  12. 1267
  13. 13158
  14. 14148
  15. 1515
  16. 163
  17. 1737
  18. 1885
  19. 19233
  20. 2072
  21. 2183
  22. 224
  23. 234
  24. 2478
  25. 25114
  26. 2652
  27. 2787
  28. 28167
  29. 297
  30. 307
  31. 3128
All Critical High Medium Low Exploited only Public exploit

12 results · Clear filters · Feed

  • Critical 9.8
    CVE-2022-0332 Public exploit EPSS 32%

    SQL injection in Moodle

    A flaw was found in Moodle in versions 3.11 to 3.11.4. An SQL injection risk was identified in the h5p activity web service responsible for fetching user attempt data.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Critical 9.8
    CVE-2022-23852 Public exploit

    Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML…

    thunderbird firefox qt5-qtwebengine insighttoolkit4 Debian Ubuntu Azure Linux Alpine
  • Critical 9.8
    CVE-2022-21306 Public exploit

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t…

    Oracle WebLogic Server
  • Critical 9.8
    CVE-2021-35587 Exploited Public exploit Scanner template EPSS 96%

    Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: OpenSSO Agent). Supported ve…

    Oracle Access Manager
    KEV Nov 28, 2022
  • Critical 9.8
    CVE-2022-23221 Public exploit EPSS 65%

    Arbitrary code execution in H2 Console

    H2 Console before 2.1.210 allows remote attackers to execute arbitrary code via a jdbc:h2:mem JDBC URL containing the IGNORE_UNKNOWN_SETTINGS=TRUE;FORBID_CREATION=FALSE;INIT=RUNSCRIPT substring, a different vulnerability than CVE-2021-42392.

    com.h2database:h2 h2database h2database Debian Ubuntu Maven
  • Critical 9.8
    CVE-2022-23305 Public exploit EPSS 67%

    SQL injection in JDBC Appender in Apache Log4j V1

    By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is likely to always be included. This allows attackers to manipulate…

    Apache Software Foundation Apache Log4j 1.x druid apache-log4j1.2 Debian Ubuntu Wolfi Maven
  • Critical 9.1
    CVE-2022-23131 Exploited Public exploit Scanner template EPSS 96%

    Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML

    In the case of instances where the SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor, because a user login stored in the session was not verified. Malicious unauthenticated actor may exploit this issue to esca…

    Zabbix Frontend
    KEV Feb 22, 2022
  • Critical 9.9
    CVE-2022-21675 Public exploit

    Bytecode Viewer v2.10.x Zip Slip

    Bytecode Viewer (BCV) is a Java/Android reverse engineering suite. Versions of the package prior to 2.11.0 are vulnerable to Arbitrary File Write via Archive Extraction (AKA "Zip Slip"). The vulnerability is exploited using a specially crafted archive that ho…

    Konloch bytecode-viewer
  • Critical 9.8
    CVE-2022-21907 Public exploit EPSS 93%

    HTTP Protocol Stack Remote Code Execution Vulnerability

    HTTP Protocol Stack Remote Code Execution Vulnerability

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
  • Critical 9.8
    CVE-2021-43297 Public exploit EPSS 17%

    Dubbo Hessian cause RCE when parse error

    A deserialization vulnerability existed in dubbo hessian-lite 3.2.11 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protocol, during Hessian catch unexpected e…

    Apache Software Foundation Apache Dubbo org.apache.dubbo:dubbo Maven
  • Critical 9.8
    CVE-2022-22822 Public exploit

    addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

    thunderbird firefox insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine
  • Critical 9.8
    CVE-2021-42392 Public exploit Scanner template EPSS 83%

    RCE in H2 Console

    The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database. An attacker may pass a JNDI driver name and a URL leading to a LDAP or RMI servers, causing remote code execution. This…

    h2database h2 com.h2database:h2 h2database Debian Ubuntu Maven