Skip to content
OpenAdvisories

Archive

24 February 2022

Vulnerabilities first published on this day (UTC), newest first.

← January 2022 2022 / February /24 March 2022 →
  1. 174
  2. 229
  3. 345
  4. 4219
  5. 53
  6. 611
  7. 750
  8. 843
  9. 9276
  10. 1048
  11. 11166
  12. 1224
  13. 139
  14. 1469
  15. 1592
  16. 1695
  17. 1734
  18. 18223
  19. 1916
  20. 2013
  21. 2149
  22. 2252
  23. 2346
  24. 2492
  25. 2588
  26. 2614
  27. 272
  28. 2881
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • High 8.8
    CVE-2022-24709

    Cross site scripting in @awsui/components-react

    @awsui/components-react is the main AWS UI package which contains React components, with TypeScript definitions designed for user interface development. Multiple components in versions before 3.0.367 have been found to not properly neutralize user input and m…

    AWS awsui-documentation @awsui/components-react npm
  • High 8.8
    CVE-2020-10632

    ICSA-20-140-02 Emerson OpenEnterprise

    Inadequate folder security permissions in Emerson OpenEnterprise versions through 3.3.4 may allow modification of important configuration files, which could cause the system to fail or behave in an unpredictable manner.

    Emerson OpenEnterprise SCADA Software
  • High 7.1
    CVE-2020-14478

    IMPROPER RESTRICTION OF XML EXTERNAL ENTITY REFERENCE CWE-611

    A local, authenticated attacker could use an XML External Entity (XXE) attack to exploit weakly configured XML files to access local or remote content. A successful exploit could potentially cause a denial-of-service condition and allow the attacker to arbitr…

    Rockwell Automation FactoryTalk® Services Platform ICS / OT
  • High 7.8
    CVE-2020-14481

    The DeskLock tool provided with FactoryTalk View SE uses a weak encryption algorithm that may allow a local, authentica…

    Rockwell Automation FactoryTalk® View SE ICS / OT
  • High 7.2
    CVE-2022-25307

    WP Statistics <= 13.1.5 Unauthenticated Stored Cross-Site Scripting via platform

    The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the platform parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers to inject arbitrary web scripts o…

    WP Statistics WP Statistics Web / CMS
  • High 7.2
    CVE-2022-25305 EPSS 79%

    WP Statistics <= 13.1.5 Unauthenticated Stored Cross-Site Scripting via IP

    The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the IP parameter found in the ~/includes/class-wp-statistics-ip.php file which allows attackers to inject arbitrary web scripts onto seve…

    WP Statistics WP Statistics Web / CMS
  • High 7.2
    CVE-2022-25306

    WP Statistics <= 13.1.5 Unauthenticated Stored Cross-Site Scripting via browser

    The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the browser parameter found in the ~/includes/class-wp-statistics-visitor.php file which allows attackers to inject arbitrary web scripts…

    WP Statistics WP Statistics Web / CMS
  • High 8.1
    CVE-2022-25838

    Multi-Factor Authentication issue in Laravel Fortify

    Laravel Fortify before 1.11.1 allows reuse within a short time window, thus calling into question the "OT" part of the "TOTP" concept.

    laravel/fortify Packagist
  • High 8.8
    CVE-2022-23176 Exploited EPSS 11%

    WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged credentials to access the system with a…

    KEV Apr 11, 2022