Skip to content
OpenAdvisories

Archive

January 2022

Vulnerabilities first published in this month (UTC), newest first.

← December 2021 2022 / January February 2022 →
  1. 110
  2. 22
  3. 3104
  4. 456
  5. 535
  6. 658
  7. 7102
  8. 817
  9. 910
  10. 1048
  11. 11135
  12. 1267
  13. 13158
  14. 14148
  15. 1515
  16. 163
  17. 1737
  18. 1885
  19. 19233
  20. 2072
  21. 2183
  22. 224
  23. 234
  24. 2478
  25. 25114
  26. 2652
  27. 2787
  28. 28167
  29. 297
  30. 307
  31. 3128
All Critical High Medium Low Exploited only Public exploit

464 results · Clear filters · Feed

  • Medium 6.5
    CVE-2021-23207

    Fresenius Kabi Agilia Connect Infusion System plaintext storage of a password

    An attacker with physical access to the host can extract the secrets from the registry and create valid JWT tokens for the Fresenius Kabi Vigilant MasterMed version 2.0.1.3 application and impersonate arbitrary users. An attacker could manipulate RabbitMQ que…

    Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard) Agilia Partner
  • Medium 5.3
    CVE-2021-23195

    Fresenius Kabi Agilia Connect Infusion System exposure of information through directory listing

    Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard) version 2.0.1.3 has the option for automated indexing (directory listing) activated. When accessing a directory, a web server delivers its entire content in HTML form. If an index file does not exis…

    Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard)
  • Medium 5.9
    CVE-2021-33846

    Fresenius Kabi Agilia Connect Infusion System use of a broken or risky cryptographic algorithm

    Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard) version 2.0.1.3 issues authentication tokens to authenticated users that are signed with a symmetric encryption key. An attacker in possession of the key can issue valid JWTs and impersonate arbitra…

    Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard)
  • Medium 4.9
    CVE-2021-40694

    Moodle Improper Encoding or Escaping of Output

    Insufficient escaping of the LaTeX preamble made it possible for site administrators to read files available to the HTTP server system account.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 5.9
    CVE-2022-23130

    Buffer Over-read vulnerability in Mitsubishi Electric MC Works64 versions 4.00A to 4.04E, Mitsubishi Electric GENESIS64…

    Mitsubishi Electric Mitsubishi Electric Iconics Digital Solutions MC Works64 GENESIS64 ICS / OT
  • Medium 5.3
    CVE-2022-0323

    Improper Neutralization of Special Elements Used in a Template Engine in bobthecow/mustache.php

    Improper Neutralization of Special Elements Used in a Template Engine in Packagist mustache/mustache prior to 2.14.1.

    bobthecow bobthecow/mustache.php moodle mustache/mustache Ubuntu Packagist
  • Medium 4.0
    CVE-2021-4016

    Rapid7 Insight Agent Improper Access Control

    Rapid7 Insight Agent, versions prior to 3.1.3, suffer from an improper access control vulnerability whereby, the user has access to the snapshot directory. An attacker can access, read and copy any of the files in this directory e.g. asset_info.json or file_i…

    Rapid7 Insight Agent
  • Medium 6.7
    CVE-2022-21933

    ASUS VivoMini/Mini PC - improper input validation

    ASUS VivoMini/Mini PC device has an improper input validation vulnerability. A local attacker with system privilege can use system management interrupt (SMI) to modify memory, resulting in arbitrary code execution for controlling the system or disrupting serv…

    ASUS VC65-C1 PN40 PB60G
  • Medium 5.5
    CVE-2022-0326

    NULL Pointer Dereference in mruby/mruby

    NULL Pointer Dereference in Homebrew mruby prior to 3.2.

    mruby mruby/mruby rust mruby Ubuntu Azure Linux Alpine
  • Medium 5.5
    CVE-2022-0319

    Out-of-bounds Read in vim/vim

    Out-of-bounds Read in vim/vim prior to 8.2.

    vim vim/vim vim vim Debian Ubuntu
  • Medium 6.6
    CVE-2022-0318

    Heap-based Buffer Overflow in vim/vim

    Heap-based Buffer Overflow in vim/vim prior to 8.2.

    vim vim/vim vim vim Debian Ubuntu Azure Linux
  • Medium 5.9
    CVE-2021-29785

    IBM Security SOAR V42 and V43could allow a remote attacker to obtain sensitive information, caused by the failure to pr…

    IBM Security SOAR
  • Medium 5.5
    CVE-2022-0219 Public exploit

    Improper Restriction of XML External Entity Reference in skylot/jadx

    Improper Restriction of XML External Entity Reference in GitHub repository skylot/jadx prior to 1.3.2.

    skylot skylot/jadx io.github.skylot:jadx-core Maven
  • Medium 6.6
    CVE-2022-0285

    Cross-site Scripting (XSS) - Stored in pimcore/pimcore

    Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.2.9.

    pimcore pimcore/pimcore pimcore/pimcore Packagist
  • Medium 5.5
    CVE-2021-32039

    MongoDB Extension for VS Code may unexpectedly store credentials locally in clear text

    Users with appropriate file access may be able to access unencrypted user credentials saved by MongoDB Extension for VS Code in a binary file. These credentials may be used by malicious attackers to perform unauthorized actions. This vulnerability affects all…

    MongoDB MongoDB for VS Code
  • Medium 5.5
    CVE-2021-34600 Public exploit

    Telenot complex: Insecure AES Key Generation

    Telenot CompasX versions prior to 32.0 use a weak seed for random number generation leading to predictable AES keys used in the NFC tags used for local authorization of users. This may lead to total loss of trustworthiness of the installation.

    Telenot Electronic CompasX
  • Medium 4.3
    CVE-2022-0282

    Cross-site Scripting in microweber/microweber

    Cross-site Scripting in Packagist microweber/microweber prior to 1.2.11.

    microweber microweber/microweber microweber/microweber Packagist
  • Medium 6.8
    CVE-2021-3866

    Cross-site Scripting (XSS) - Stored in zulip/zulip

    Cross-site Scripting (XSS) - Stored in GitHub repository zulip/zulip more than and including 44f935695d452cc3fb16845a0c6af710438b153d and prior to 3eb2791c3e9695f7d37ffe84e0c2184fae665cb6.

    zulip zulip/zulip
  • Medium 6.5
    CVE-2021-45230

    Apache Airflow: Creating DagRuns didn't respect Dag-level permissions in the Webserver

    In Apache Airflow prior to 2.2.0. This CVE applies to a specific case where a User who has "can_create" permissions on DAG Runs can create Dag Runs for dags that they don't have "edit" permissions for.

    Apache Software Foundation Apache Airflow apache-airflow PyPI
  • Medium 6.5
    CVE-2022-0277

    Incorrect Permission Assignment for Critical Resource in microweber/microweber

    Incorrect Permission Assignment for Critical Resource in Packagist microweber/microweber prior to 1.2.11.

    microweber microweber/microweber microweber/microweber Packagist
  • Medium 5.0
    CVE-2022-21701

    Privileged Escalation in Istio

    Istio is an open platform to connect, manage, and secure microservices. In versions 1.12.0 and 1.12.1 Istio is vulnerable to a privilege escalation attack. Users who have `CREATE` permission for `gateways.gateway.networking.k8s.io` objects can escalate this p…

    istio istio
  • Medium 6.8
    CVE-2022-21679

    Authorization Policy bypass in Istio

    Istio is an open platform to connect, manage, and secure microservices. In Istio 1.12.0 and 1.12.1 The authorization policy with hosts and notHosts might be accidentally bypassed for ALLOW action or rejected unexpectedly for DENY action during the upgrade fro…

    istio istio
  • Medium 5.4
    CVE-2021-44777

    WordPress Email Tracker plugin <= 5.2.6 - Cross-Site Request Forgery (CSRF) vulnerabilities leading to single or bulk e-mail entries deletion

    Cross-Site Request Forgery (CSRF) vulnerabilities leading to single or bulk e-mail entries deletion discovered in Email Tracker WordPress plugin (versions <= 5.2.6).

    Prashant Baldha Email Tracker (WordPress plugin) Web / CMS
  • Medium 5.7
    CVE-2021-23842

    Use of Hard-coded Cryptographic Key

    Communication to the AMC2 uses a state-of-the-art cryptographic algorithm for symmetric encryption called Blowfish. An attacker could retrieve the key from the firmware to decrypt network traffic between the AMC2 and the host system. Thus, an attacker can exp…

    Bosch BIS APE AMS
  • Medium 6.8
    CVE-2022-0274

    Cross-site Scripting (XSS) - Stored in orchardcms/orchardcore

    Cross-site Scripting (XSS) - Stored in NuGet OrchardCore.Application.Cms.Targets prior to 1.2.2.

    OrchardCMS orchardcms/orchardcore OrchardCore.Application.Cms.Targets NuGet
  • Medium 4.8
    CVE-2022-22310

    IBM WebSphere Application Server Liberty 21.0.0.10 through 21.0.0.12 could provide weaker than expected security. A rem…

    IBM WebSphere Application Server - Liberty
  • Medium 6.6
    CVE-2022-21403

    Vulnerability in the Oracle Communications Operations Monitor product of Oracle Communications (component: Mediation En…

    Oracle Communications Operations Monitor
  • Medium 4.8
    CVE-2022-21402

    Vulnerability in the Oracle Communications Operations Monitor product of Oracle Communications (component: Mediation En…

    Oracle Communications Operations Monitor
  • Medium 6.6
    CVE-2022-21401

    Vulnerability in the Oracle Communications Operations Monitor product of Oracle Communications (component: Mediation En…

    Oracle Communications Operations Monitor
  • Medium 5.4
    CVE-2022-21400

    Vulnerability in the Oracle Communications Operations Monitor product of Oracle Communications (component: Mediation En…

    Oracle Communications Operations Monitor
  • Medium 6.6
    CVE-2022-21399

    Vulnerability in the Oracle Communications Operations Monitor product of Oracle Communications (component: Mediation En…

    Oracle Communications Operations Monitor
  • Medium 5.4
    CVE-2022-21398

    Vulnerability in the Oracle Communications Operations Monitor product of Oracle Communications (component: Mediation En…

    Oracle Communications Operations Monitor
  • Medium 5.4
    CVE-2022-21397

    Vulnerability in the Oracle Communications Operations Monitor product of Oracle Communications (component: Mediation En…

    Oracle Communications Operations Monitor
  • Medium 5.4
    CVE-2022-21396

    Vulnerability in the Oracle Communications Operations Monitor product of Oracle Communications (component: Mediation En…

    Oracle Communications Operations Monitor
  • Medium 6.5
    CVE-2022-21394

    Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version tha…

    Oracle VM VirtualBox virtualbox Virtualization Ubuntu
  • Medium 4.3
    CVE-2022-21393

    Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12…

    Oracle Database - Enterprise Edition
  • Medium 5.3
    CVE-2022-21387

    Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework). Sup…

    Oracle Commerce Platform
  • Medium 6.1
    CVE-2022-21386

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container). Supported v…

    Oracle WebLogic Server
  • Medium 4.3
    CVE-2022-21383

    Vulnerability in the Oracle Enterprise Session Border Controller product of Oracle Communications (component: Log). Sup…

    Oracle Enterprise Session Border Controller
  • Medium 6.4
    CVE-2022-21381

    Vulnerability in the Oracle Enterprise Session Border Controller product of Oracle Communications (component: WebUI). S…

    Oracle Enterprise Session Border Controller