Skip to content
OpenAdvisories

Archive

February 2022

Vulnerabilities first published in this month (UTC), newest first.

← January 2022 2022 / February March 2022 →
  1. 174
  2. 229
  3. 345
  4. 4219
  5. 53
  6. 611
  7. 750
  8. 843
  9. 9276
  10. 1048
  11. 11166
  12. 1224
  13. 139
  14. 1469
  15. 1592
  16. 1695
  17. 1734
  18. 18223
  19. 1916
  20. 2013
  21. 2149
  22. 2252
  23. 2346
  24. 2492
  25. 2588
  26. 2614
  27. 272
  28. 2881
All Critical High Medium Low Exploited only Public exploit

1,963 results · Feed

  • Unscored —
    CVE-2021-43945

    Affected versions of Atlassian Jira Server and Data Center allow remote attackers with Roadmaps Administrator permissio…

    Atlassian Jira Server Jira Data Center Web / CMS
  • Medium 4.7
    CVE-2022-0772

    Cross-site Scripting (XSS) - Stored in librenms/librenms

    Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 22.2.2.

    librenms librenms/librenms librenms/librenms Packagist
  • High 8.2
    CVE-2021-21708

    UAF due to php_filter_float() failing

    In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below 8.1.3, when using filter functions with FILTER_VALIDATE_FLOAT filter and min/max limits, if the filter fails, there is a possibility to trigger use of allocated memory after free, which c…

    PHP Group PHP php7 php7.4 Debian Ubuntu Alpine
  • Medium 4.1
    CVE-2021-3967

    Improper Access Control in zulip/zulip

    Improper Access Control in GitHub repository zulip/zulip prior to 4.10.

    zulip zulip/zulip
  • Unscored —
    CVE-2022-22908

    SangforCSClient.exe in Sangfor VDI Client 5.4.2.1006 allows attackers, when they are able to read process memory, to di…

  • Unscored —
    CVE-2022-26146

    Tricentis qTest before 10.4 allows stored XSS by an authenticated attacker.

  • Unscored —
    CVE-2020-27958

    The Job Composer app in Ohio Supercomputer Center Open OnDemand before 1.7.19 and 1.8.x before 1.8.18 allows remote aut…

  • Medium 6.1
    CVE-2022-0764

    Arbitrary Command Injection in strapi/strapi

    Arbitrary Command Injection in GitHub repository strapi/strapi prior to 4.1.0.

    strapi strapi/strapi strapi npm
  • High 8.0
    CVE-2022-0723

    Cross-site Scripting (XSS) - Reflected in microweber/microweber

    Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.2.11.

    microweber microweber/microweber microweber/microweber Packagist
  • Medium 4.3
    CVE-2022-0763

    Cross-site Scripting (XSS) - Stored in microweber/microweber

    Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.

    microweber microweber/microweber microweber/microweber Packagist
  • Medium 5.5
    CVE-2022-0762

    Incorrect Authorization in microweber/microweber

    Incorrect Authorization in GitHub repository microweber/microweber prior to 1.3.

    microweber microweber/microweber microweber/microweber Packagist
  • Unscored —
    CVE-2022-25359 Public exploit EPSS 37%

    On ICL ScadaFlex II SCADA Controller SC-1 and SC-2 1.03.07 devices, unauthenticated remote attackers can overwrite, del…

  • Unscored —
    CVE-2022-24986

    KDE KCron through 21.12.2 uses a temporary file in /tmp when saving, but reuses the filename during an editing session.…

    kcron kcron Debian Ubuntu
  • Unscored —
    CVE-2020-36516

    An issue was discovered in the Linux kernel through 5.16.11. The mixed IPID assignment method with the hash-based IPID …

    linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  • Unscored —
    CVE-2021-46702 Public exploit

    Tor Browser 9.0.7 on Windows 10 build 10586 is vulnerable to information disclosure. This could allow local attackers t…

  • High 7.5
    CVE-2022-23308

    valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.

    qt5-qtwebengine libxml2 libxml2 libxml2 Debian Ubuntu Azure Linux Alpine
  • High 7.2
    CVE-2022-26149 Public exploit

    Unrestricted Upload of File with Dangerous Type in MODX Revolution

    MODX Revolution through 2.8.3-pl allows remote authenticated administrators to execute arbitrary code by uploading an executable file, because the Uploadable File Types setting can be changed by an administrator.

    modx/revolution Packagist
  • High 7.2
    CVE-2022-21706

    Multi-use invitations can grant access to other organizations in Zulip

    Zulip is an open-source team collaboration tool with topic-based threading. Zulip Server version 2.0.0 and above are vulnerable to insufficient access control with multi-use invitations. A Zulip Server deployment which hosts multiple organizations is vulnerab…

    zulip zulip
  • Unscored —
    CVE-2022-25096

    Home Owners Collection Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parame…

  • Unscored —
    CVE-2022-25095

    Home Owners Collection Management System v1.0 allows unauthenticated attackers to compromise user accounts via a crafte…

  • Unscored —
    CVE-2022-25094 EPSS 23%

    Home Owners Collection Management System v1.0 was discovered to contain a remote code execution (RCE) vulnerability via…

  • Medium 5.4
    CVE-2022-24710

    Cross-site Scripting in Weblate

    Weblate is a copyleft software web-based continuous localization system. Versions prior to 4.11 do not properly neutralize user input used in user name and language fields. Due to this improper neutralization it is possible to perform cross-site scripting via…

    WeblateOrg weblate weblate PyPI
  • Unscored —
    CVE-2022-24442 Public exploit

    JetBrains YouTrack before 2021.4.40426 was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates.

  • Unscored —
    CVE-2022-25259

    JetBrains Hub before 2021.1.14276 was vulnerable to reflected XSS.

  • Unscored —
    CVE-2022-25260 Public exploit

    JetBrains Hub before 2021.1.14276 was vulnerable to blind Server-Side Request Forgery (SSRF).

  • Medium 5.4
    CVE-2021-23495

    Open Redirect

    The package karma before 6.3.16 are vulnerable to Open Redirect due to missing validation of the return_url query parameter.

    karma npm
  • Unscored —
    CVE-2022-25261

    JetBrains TeamCity before 2021.2.2 was vulnerable to reflected XSS.

  • Unscored —
    CVE-2022-25262 Public exploit

    In JetBrains Hub before 2022.1.14434, SAML request takeover was possible.

  • Unscored —
    CVE-2022-25263

    JetBrains TeamCity before 2021.2.3 was vulnerable to OS command injection in the Agent Push feature configuration.

  • Unscored —
    CVE-2022-25264

    In JetBrains TeamCity before 2021.2.3, environment variables of the "password" type could be logged in some cases.

  • Unscored —
    CVE-2021-42952

    Zepl Notebooks before 2021-10-25 are affected by a sandbox escape vulnerability. Upon launching Remote Code Execution f…

  • Unscored —
    CVE-2022-25061 Public exploit Scanner template EPSS 59%

    TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain a command injection vulnerability via the component oal_se…

  • Unscored —
    CVE-2022-25064 Public exploit EPSS 36%

    TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain a remote code execution (RCE) vulnerability via the functi…

  • Unscored —
    CVE-2022-25062 Public exploit

    TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain an integer overflow via the function dm_checkString. This …

  • Unscored —
    CVE-2022-25060 Public exploit EPSS 40%

    TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain a command injection vulnerability via the component oal_st…

  • Unscored —
    CVE-2021-44132 Public exploit

    A command injection vulnerability in the function formImportOMCIShell of C-DATA ONU4FERW V2.1.13_X139 allows attackers …

  • Unscored —
    CVE-2021-42244

    A cross-site scripting (XSS) vulnerability in PaquitoSoftware Notimoo v1.2 allows attackers to execute arbitrary web sc…

  • Medium 6.1
    CVE-2021-37504

    jQuery-Upload-File XSS in fileNameStr

    A cross-site scripting (XSS) vulnerability in the fileNameStr parameter of jQuery-Upload-File v4.0.11 allows attackers to execute arbitrary web scripts or HTML via a crafted file with a Javascript payload in the file name.

    jquery-file-upload npm
  • Unscored —
    CVE-2021-40046

    PCManager versions 11.1.1.95 has a privilege escalation vulnerability. Successful exploit could allow the attacker to a…

  • Unscored —
    CVE-2021-40043

    The laser command injection vulnerability exists on AIS-BW80H-00 versions earlier than AIS-BW80H-00 9.0.3.4(H100SP13C00…