Skip to content
OpenAdvisories

Archive

18 February 2022

Vulnerabilities first published on this day (UTC), newest first.

← January 2022 2022 / February /18 March 2022 →
  1. 174
  2. 229
  3. 345
  4. 4219
  5. 53
  6. 611
  7. 750
  8. 843
  9. 9276
  10. 1048
  11. 11166
  12. 1224
  13. 139
  14. 1469
  15. 1592
  16. 1695
  17. 1734
  18. 18223
  19. 1916
  20. 2013
  21. 2149
  22. 2252
  23. 2346
  24. 2492
  25. 2588
  26. 2614
  27. 272
  28. 2881
All Critical High Medium Low Exploited only Public exploit

13 results · Clear filters · Feed

  • Critical 9.8
    CVE-2022-24049

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sonos One Speaker pri…

    Sonos One Speaker
  • Critical 9.8
    CVE-2022-24046

    This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Sonos One S…

    Sonos One Speaker
  • Critical 9.1
    CVE-2021-46063

    Server Side Template Injection in MCMS

    MCMS v5.2.5 was discovered to contain a Server Side Template Injection (SSTI) vulnerability via the Template Management module.

    net.mingsoft:ms-mcms Maven
  • Critical 10.0
    CVE-2022-0543 Exploited Public exploit Scanner template EPSS 99%

    It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specifi…

    Debian redis redis redis Debian Ubuntu
    KEV Mar 28, 2022
  • Critical 9.8
    CVE-2021-46036

    File upload leading to RCE in MCMS

    An arbitrary file upload vulnerability in the component /ms/file/uploadTemplate.do of MCMS v5.2.4 allows attackers to execute arbitrary code.

    net.mingsoft:ms-mcms Maven
  • Critical 9.1
    CVE-2022-0671

    Server-Side Request Forgery and Uncontrolled Resource Consumption in LemMinX

    A flaw was found in vscode-xml in versions prior to 0.19.0. Schema download could lead to blind SSRF or DoS via a large file.

    org.eclipse.lemminx:lemminx-parent Maven
  • Critical 10.0
    CVE-2022-21141

    Airspan Networks Mimosa Incorrect Authorization

    MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 does not perform proper authorization checks on multiple API functions. An attacker may gain access to these funct…

    Airspan Networks PTP C-series MMP PTMP C-series and A5x
  • Critical 10.0
    CVE-2022-21196

    Airspan Networks Mimosa Improper Authorization

    MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 does not perform proper authorization and authentication checks on multiple API routes. An attacker may gain acces…

    Airspan Networks MMP PTMP C-series and A5x PTP C-series
  • Critical 10.0
    CVE-2022-21215

    Airspan Networks Mimosa Server-Side Request Forgery (SSRF)

    This vulnerability could allow an attacker to force the server to create and execute a web request granting access to backend APIs that are only accessible to the Mimosa MMP server, or request pages that could perform some actions themselves. The attacker cou…

    Airspan Networks MMP PTMP C-series and A5x PTP C-series
  • Critical 9.8
    CVE-2022-25337

    Code injection in ezsystems/ezpublish-kernel

    Ibexa DXP ezsystems/ezpublish-kernel 7.5.x before 7.5.26 and 1.3.x before 1.3.12 allows injection attacks via image filenames.

    ezsystems/ezpublish-kernel Packagist
  • Critical 9.8
    CVE-2022-25299

    Arbitrary File Write

    This affects the package cesanta/mongoose before 7.6. The unsafe handling of file names during upload using mg_http_upload() method may enable attackers to write files to arbitrary locations outside the designated target folder.

    phantomjs Ubuntu
  • Critical 9.4
    CVE-2022-0660 Scanner template

    Generation of Error Message Containing Sensitive Information in microweber/microweber

    Generation of Error Message Containing Sensitive Information in Packagist microweber/microweber prior to 1.2.11.

    microweber microweber/microweber microweber/microweber Packagist
  • Critical 9.8
    CVE-2022-25315 Public exploit

    In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.

    thunderbird firefox insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine