Skip to content
OpenAdvisories

Archive

25 February 2022

Vulnerabilities first published on this day (UTC), newest first.

← January 2022 2022 / February /25 March 2022 →
  1. 174
  2. 229
  3. 345
  4. 4219
  5. 53
  6. 611
  7. 750
  8. 843
  9. 9276
  10. 1048
  11. 11166
  12. 1224
  13. 139
  14. 1469
  15. 1592
  16. 1695
  17. 1734
  18. 18223
  19. 1916
  20. 2013
  21. 2149
  22. 2252
  23. 2346
  24. 2492
  25. 2588
  26. 2614
  27. 272
  28. 2881
All Critical High Medium Low Exploited only Public exploit

88 results · Feed

  • Medium 6.1
    CVE-2022-24948

    Apache JSPWiki Cross-site scripting vulnerability on User Preferences screen

    A carefully crafted user preferences for submission could trigger an XSS vulnerability on Apache JSPWiki, related to the user preferences screen, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information a…

    Apache Software Foundation Apache JSPWiki org.apache.jspwiki:jspwiki-main Maven
  • High 8.8
    CVE-2022-24947

    Apache JSPWiki CSRF Account Takeover

    Apache JSPWiki user preferences form is vulnerable to CSRF attacks, which can lead to account takeover. Apache JSPWiki users should upgrade to 2.11.2 or later.

    Apache Software Foundation Apache JSPWiki org.apache.jspwiki:jspwiki-main Maven
  • High 8.8
    CVE-2022-24288 Scanner template EPSS 78%

    Apache Airflow: RCE in example DAGs

    In Apache Airflow, prior to version 2.2.4, some example DAGs did not properly sanitize user-provided params, making them susceptible to OS Command Injection from the web UI.

    Apache Software Foundation Apache Airflow apache-airflow PyPI
  • Medium 6.1
    CVE-2021-45229

    Apache Airflow: Reflected XSS via Origin Query Argument in URL

    It was discovered that the "Trigger DAG with config" screen was susceptible to XSS attacks via the `origin` query argument. This issue affects Apache Airflow versions 2.2.3 and below.

    Apache Software Foundation Apache Airflow apache-airflow PyPI
  • Medium 5.3
    CVE-2021-34361

    Reflected XSS Vulnerability in Proxy Server

    A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running Proxy Server. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of P…

    QNAP Systems Proxy Server
  • Medium 6.9
    CVE-2021-34359

    Stored XSS Vulnerability in Proxy Server

    A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running Proxy Server. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of P…

    QNAP Systems Proxy Server
  • Unscored —
    CVE-2022-23835

    The Visual Voice Mail (VVM) application through 2022-02-24 for Android allows persistent access if an attacker temporar…

  • Unscored —
    OSV-2021-1809

    Heap-buffer-overflow in ujson.cpython-38-x86_64-linux-gnu.so

    OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44973 ``` Crash type: Heap-buffer-overflow WRITE 1 Crash state: ujson.cpython-38-x86_64-linux-gnu.so ujson.cpython-38-x86_64-linux-gnu.so ujson.cpython-38-x86_64-linux-gnu.so ```

    ujson PyPI