Skip to content
OpenAdvisories

Archive

1 February 2022

Vulnerabilities first published on this day (UTC), newest first.

← January 2022 2022 / February /1 March 2022 →
  1. 174
  2. 229
  3. 345
  4. 4219
  5. 53
  6. 611
  7. 750
  8. 843
  9. 9276
  10. 1048
  11. 11166
  12. 1224
  13. 139
  14. 1469
  15. 1592
  16. 1695
  17. 1734
  18. 18223
  19. 1916
  20. 2013
  21. 2149
  22. 2252
  23. 2346
  24. 2492
  25. 2588
  26. 2614
  27. 272
  28. 2881
All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • Medium 6.5
    CVE-2021-44451 Scanner template

    API sensitive information leak

    Apache Superset up to and including 1.3.2 allowed for registered database connections password leak for authenticated users. This information could be accessed in a non-trivial way. Users should upgrade to Apache Superset 1.4.0 or higher.

    Apache Software Foundation Apache Superset apache-superset PyPI
  • Medium —
    CVE-2021-45416 Public exploit

    RosarioSIS XSS Vulnerability

    Reflected Cross-site scripting (XSS) vulnerability in RosarioSIS 8.2.1 allows attackers to inject arbitrary HTML via the search_term parameter in the modules/Scheduling/Courses.php script.

    francoisjacquet/rosariosis Packagist
  • Medium 6.5
    CVE-2021-41571

    Pulsar Admin API allows access to data from other tenants using getMessageById API

    In Apache Pulsar it is possible to access data from BookKeeper that does not belong to the topics accessible by the authenticated user. The Admin API get-message-by-id requires the user to input a topic and a ledger id. The ledger id is a pointer to the data,…

    Apache Software Foundation Apache Pulsar org.apache.pulsar:pulsar Maven
  • Medium 6.8
    CVE-2022-21687

    Command injection in gh-ost

    gh-ost is a triggerless online schema migration solution for MySQL. Versions prior to 1.1.3 are subject to an arbitrary file read vulnerability. The attacker must have access to the target host or trick an administrator into executing a malicious gh-ost comma…

    github.com/github/gh-ost Go
  • Medium 6.5
    CVE-2022-23607

    Unsafe handling of user-specified cookies in treq

    treq is an HTTP library inspired by requests but written on top of Twisted's Agents. Treq's request methods (`treq.get`, `treq.post`, etc.) and `treq.client.HTTPClient` constructor accept cookies as a dictionary. Such cookies are not bound to a single domain,…

    twisted treq treq py3-treq Debian Ubuntu Alpine PyPI
  • Medium 5.9
    CVE-2022-0419

    NULL Pointer Dereference in radareorg/radare2

    NULL Pointer Dereference in GitHub repository radareorg/radare2 prior to 5.6.0.

    radareorg radareorg/radare2 radare2 radare2 Ubuntu Alpine
  • Medium 4.3
    GHSA-f7qw-5fgj-247x

    Cross-site Scripting and Open Redirect in plone.app.contenttypes

    ### Impact Plone is vulnerable to reflected cross site scripting and open redirect when an attacker can get a compromised version of the image_view_fullscreen page in a cache, for example in Varnish. The technique is known as cache poisoning. Any later visito…

    plone-app-contenttypes PyPI
  • Medium 6.5
    CVE-2022-24196

    Allocation of Resources Without Limits or Throttling in iText

    iText v7.1.17, up to (exluding)": 7.1.18 and 7.2.2 was discovered to contain an out-of-memory error via the component readStreamBytesRaw, which allows attackers to cause a Denial of Service (DoS) via a crafted PDF file.

    com.itextpdf:itext7-core Maven
  • Medium 6.5
    CVE-2022-24198

    Out-of-bounds Read in iText

    iText v7.1.17 was discovered to contain an out-of-bounds exception via the component ARCFOUREncryption.encryptARCFOUR, which allows attackers to cause a Denial of Service (DoS) via a crafted PDF file. NOTE: Vendor does not view this as a vulnerability and has…

    com.itextpdf:itext7-core Maven
  • Medium 6.5
    CVE-2022-24197

    Out-of-bounds Write in iText

    iText v7.1.17 was discovered to contain a stack-based buffer overflow via the component ByteBuffer.append, which allows attackers to cause a Denial of Service (DoS) via a crafted PDF file.

    com.itextpdf:itext7-core Maven