Skip to content
OpenAdvisories

Archive

1 February 2022

Vulnerabilities first published on this day (UTC), newest first.

← January 2022 2022 / February /1 March 2022 →
  1. 174
  2. 229
  3. 345
  4. 4219
  5. 53
  6. 611
  7. 750
  8. 843
  9. 9276
  10. 1048
  11. 11166
  12. 1224
  13. 139
  14. 1469
  15. 1592
  16. 1695
  17. 1734
  18. 18223
  19. 1916
  20. 2013
  21. 2149
  22. 2252
  23. 2346
  24. 2492
  25. 2588
  26. 2614
  27. 272
  28. 2881
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • High 8.1
    CVE-2022-23601

    CSRF token missing in Symfony

    Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The Symfony form component provides a CSRF protection mechanism by using a random token injected in the form and using the session to store and control the token…

    symfony symfony symfony/framework-bundle Packagist
  • High 7.4
    CVE-2021-43848 Public exploit

    Unititialized memory access in h2o

    h2o is an open source http server. In code prior to the `8c0eca3` commit h2o may attempt to access uninitialized memory. When receiving QUIC frames in certain order, HTTP/3 server-side implementation of h2o can be misguided to treat uninitialized memory as HT…

    h2o h2o h2o Ubuntu
  • High 7.5
    CVE-2021-43859

    Denial of Service by injecting highly recursive collections or maps in XStream

    XStream is an open source java library to serialize objects to XML and back again. Versions prior to 1.4.19 may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a…

    x-stream xstream com.thoughtworks.xstream:xstream libxstream-java Debian Ubuntu Maven
  • High 7.5
    CVE-2022-23596

    Infinite loop in junrar

    Junrar is an open source java RAR archive library. In affected versions A carefully crafted RAR archive can trigger an infinite loop while extracting said archive. The impact depends solely on how the application uses the library, and whether files can be pro…

    com.github.junrar:junrar Maven
  • High 8.3
    CVE-2022-23597

    Remote program execution with user interaction

    Element Desktop is a Matrix client for desktop platforms with Element Web at its core. Element Desktop before 1.9.7 is vulnerable to a remote program execution bug with user interaction. The exploit is non-trivial and requires clicking on a malicious link, fo…

  • High 7.7
    CVE-2022-23602

    Nim's rst parser sandboxed mode allows include which can embed any local file

    Nimforum is a lightweight alternative to Discourse written in Nim. In versions prior to 2.2.0 any forum user can create a new thread/post with an include referencing a file local to the host operating system. Nimforum will render the file if able. This can al…

  • High 8.4
    CVE-2022-0417

    Heap-based Buffer Overflow in vim/vim

    Heap-based Buffer Overflow GitHub repository vim/vim prior to 8.2.

    vim vim/vim vim vim Debian Ubuntu Azure Linux Alpine