Skip to content
OpenAdvisories

Archive

February 2022

Vulnerabilities first published in this month (UTC), newest first.

← January 2022 2022 / February March 2022 →
  1. 174
  2. 229
  3. 345
  4. 4219
  5. 53
  6. 611
  7. 750
  8. 843
  9. 9276
  10. 1048
  11. 11166
  12. 1224
  13. 139
  14. 1469
  15. 1592
  16. 1695
  17. 1734
  18. 18223
  19. 1916
  20. 2013
  21. 2149
  22. 2252
  23. 2346
  24. 2492
  25. 2588
  26. 2614
  27. 272
  28. 2881
All Critical High Medium Low Exploited only Public exploit

1,963 results · Feed

  • Medium 6.1
    CVE-2022-0527

    Cross-site Scripting (XSS) - Stored in chatwoot/chatwoot

    Cross-site Scripting (XSS) - Stored in GitHub repository chatwoot/chatwoot prior to 2.2.0.

    chatwoot chatwoot/chatwoot
  • High 7.3
    CVE-2022-0526

    Cross-site Scripting (XSS) - Stored in chatwoot/chatwoot

    Cross-site Scripting (XSS) - Stored in GitHub repository chatwoot/chatwoot prior to 2.2.0.

    chatwoot chatwoot/chatwoot
  • High 8.4
    CVE-2022-0525

    Out-of-bounds Read in mruby/mruby

    Out-of-bounds Read in Homebrew mruby prior to 3.2.

    mruby mruby/mruby mruby Ubuntu
  • Medium 6.1
    CVE-2022-24682 Exploited · Ransomware Scanner template EPSS 31%

    An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), …

    KEV Feb 25, 2022
  • High 7.5
    CVE-2022-0391

    A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locat…

    python3.4 python3.5 python2.7 python3.6 Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2022-22809

    A CWE-306: Missing Authentication for Critical Function vulnerability exists that could allow modifications of the touc…

  • Unscored —
    CVE-2022-22808

    A CWE-352: Cross-Site Request Forgery (CSRF) exists that could cause a remote attacker to gain unauthorized access to t…

  • Unscored —
    CVE-2022-22807

    A CWE-1021 Improper Restriction of Rendered UI Layers or Frames vulnerability exists that could cause unintended modifi…

  • Unscored —
    CVE-2021-46360 Public exploit

    Authenticated remote code execution (RCE) in Composr-CMS 10.0.39 and earlier allows remote attackers to execute arbitra…

  • Unscored —
    CVE-2022-24676

    update_code in Admin.php in HYBBS2 through 2.3.2 allows arbitrary file upload via a crafted ZIP archive.

  • Unscored —
    CVE-2022-24677

    Admin.php in HYBBS2 through 2.3.2 allows remote code execution because it writes plugin-related configuration informati…

  • Medium 5.0
    CVE-2022-23627

    Inadequate access verification when using proxy commands in ArchiSteamFarm

    ArchiSteamFarm (ASF) is a C# application with primary purpose of idling Steam cards from multiple accounts simultaneously. Due to a bug in ASF code, introduced in version V5.2.2.2, the program didn't adequately verify effective access of the user sending prox…

    JustArchiNET ArchiSteamFarm
  • Medium 5.4
    CVE-2021-45919

    Studio 42 elFinder allows stored XSS

    Studio 42 elFinder through 2.1.31 allows XSS via an SVG document.

    studio-42/elfinder Packagist
  • Medium 6.1
    CVE-2021-45329

    Cross-site Scripting in Gitea

    Cross Site Scripting (XSS) vulnerability exists in Gitea before 1.5.1 via the repository settings inside the external wiki/issue tracker URL field.

    github.com/go-gitea/gitea gitea golang-code.gitea-git golang-code.gitea-sdk Ubuntu Alpine Go
  • Medium 6.5
    CVE-2022-0524

    Business Logic Errors in publify/publify

    Business Logic Errors in GitHub repository publify/publify prior to 9.2.7.

    publify publify/publify publify_core RubyGems
  • High 8.5
    CVE-2022-23626 Public exploit

    Insufficient file checks in m1k1o/blog

    m1k1o/blog is a lightweight self-hosted facebook-styled PHP blog. Errors from functions `imagecreatefrom*` and `image*` have not been checked properly. Although PHP issued warnings and the upload function returned `false`, the original file (that could contai…

    m1k1o blog
  • Medium 6.3
    CVE-2022-0522

    Access of Memory Location Before Start of Buffer in radareorg/radare2

    Access of Memory Location Before Start of Buffer in NPM radare2.js prior to 5.6.2.

    radareorg radareorg/radare2 radare2 radare2 Ubuntu Alpine
  • Medium 4.3
    CVE-2022-21713

    Exposure of Sensitive Information in Grafana

    Grafana is an open-source platform for monitoring and observability. Affected versions of Grafana expose multiple API endpoints which do not properly handle user authorization. `/teams/:teamId` will allow an authenticated attacker to view unintended data by q…

    Grafana Grafana grafana github.com/grafana/grafana Web / CMS Ubuntu Alpine Go
  • Medium 6.3
    CVE-2022-0521

    Access of Memory Location After End of Buffer in radareorg/radare2

    Access of Memory Location After End of Buffer in GitHub repository radareorg/radare2 prior to 5.6.2.

    radareorg radareorg/radare2 radare2 radare2 Ubuntu Alpine
  • High 8.8
    CVE-2022-0520

    Use After Free in radareorg/radare2

    Use After Free in NPM radare2.js prior to 5.6.2.

    radareorg radareorg/radare2 radare2 radare2 Ubuntu Alpine
  • Medium 6.3
    CVE-2022-21703

    Cross Site Request Forgery in Grafana

    Grafana is an open-source platform for monitoring and observability. Affected versions are subject to a cross site request forgery vulnerability which allows attackers to elevate their privileges by mounting cross-origin attacks against authenticated high-pri…

    Grafana Grafana grafana grafana Web / CMS Ubuntu Alpine Go
  • Medium 6.3
    CVE-2022-0519

    Buffer Access with Incorrect Length Value in radareorg/radare2

    Buffer Access with Incorrect Length Value in GitHub repository radareorg/radare2 prior to 5.6.2.

    radareorg radareorg/radare2 radare2 radare2 Ubuntu Alpine
  • Medium 6.3
    CVE-2022-0518

    Heap-based Buffer Overflow in radareorg/radare2

    Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.6.2.

    radareorg radareorg/radare2 radare2 radare2 Ubuntu Alpine
  • Medium 6.5
    CVE-2022-21702

    Cross site scripting in Grafana proxy

    Grafana is an open-source platform for monitoring and observability. In affected versions an attacker could serve HTML content thru the Grafana datasource or plugin proxy and trick a user to visit this HTML page using a specially crafted link and execute a Cr…

    Grafana Grafana grafana github.com/grafana/grafana Web / CMS Ubuntu Alpine Go
  • Low 3.0
    GHSA-qq97-vm5h-rrhg

    OCI Manifest Type Confusion Issue

    ### Impact Systems that rely on digest equivalence for image attestations may be vulnerable to type confusion. ### Patches Upgrade to at least `v2.8.0-beta.1` if you are running `v2.x` release. If you use the code from the `main` branch, update at least to th…

    github.com/docker/distribution Go
  • High 7.1
    CVE-2022-0139

    Use After Free in radareorg/radare2

    Use After Free in GitHub repository radareorg/radare2 prior to 5.6.0.

    radareorg radareorg/radare2 radare2 radare2 Ubuntu Alpine
  • Medium 6.1
    CVE-2021-45328 Scanner template

    Open redirect in Gitea

    Gitea before 1.4.3 is affected by URL Redirection to Untrusted Site ('Open Redirect') via internal URLs.

    github.com/go-gitea/gitea golang-code.gitea-git golang-code.gitea-sdk Ubuntu Go
  • Critical 9.8
    CVE-2021-45327

    Capture-replay in Gitea

    Gitea before 1.11.2 is affected by Trusting HTTP Permission Methods on the Server Side when referencing the vulnerable admin or user API. which could let a remote malisious user execute arbitrary code.

    code.gitea.io/gitea github.com/go-gitea/gitea gitea golang-code.gitea-git Ubuntu Alpine Go
  • High 8.8
    CVE-2021-45326

    Cross Site Request Forgery in Gitea

    Cross Site Request Forgery (CSRF) vulnerability exists in Gitea before 1.5.2 via API routes.This can be dangerous especially with state altering POST requests.

    github.com/go-gitea/gitea gitea golang-code.gitea-git golang-code.gitea-sdk Ubuntu Alpine Go
  • Medium 5.3
    CVE-2021-45325

    Gitea displaying raw OpenID error in UI

    Server Side Request Forgery (SSRF) vulneraility exists in Gitea before 1.7.0 using the OpenID URL.

    github.com/go-gitea/gitea golang-code.gitea-git golang-code.gitea-sdk Ubuntu Go
  • Unscored —
    CVE-2021-44864 EPSS 10%

    TP-Link WR886N 3.0 1.0.1 Build 150127 Rel.34123n is vulnerable to Buffer Overflow. Authenticated attackers can crash ro…

  • Medium 4.3
    CVE-2022-0510

    Cross-site Scripting (XSS) - Reflected in pimcore/pimcore

    Cross-site Scripting (XSS) - Reflected in Packagist pimcore/pimcore prior to 10.3.1.

    pimcore pimcore/pimcore pimcore/pimcore Packagist
  • Unscored —
    CVE-2021-44956

    Two Heap based buffer overflow vulnerabilities exist in ffjpeg through 01.01.2021. It is similar to CVE-2020-23852. Iss…

  • Unscored —
    CVE-2021-44957

    Global buffer overflow vulnerability exist in ffjpeg through 01.01.2021. It is similar to CVE-2020-23705. Issue is in t…

  • Critical 9.8
    CVE-2022-23340

    Joplin Vulnerable to Code Injection

    Joplin 2.6.10 allows remote attackers to execute system commands through malicious code in user search results.

    joplin npm
  • Unscored —
    CVE-2022-23331

    In DataEase v1.6.1, an authenticated user can gain unauthorized access to all user information and can change the admin…

  • Unscored —
    RUSTSEC-2022-0104

    `structopt` is in maintenance mode

    `structopt` has been in maintenance mode, with no new development planned, since at least February of 2022. The status of `structopt` is discussed in a [pinned issue](https://github.com/TeXitoi/structopt/issues/525). ## Recommended alternative The `structopt`…

    structopt crates.io
  • Medium 6.6
    CVE-2022-0509

    Cross-site Scripting (XSS) - Stored in pimcore/pimcore

    Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.3.1.

    pimcore pimcore/pimcore pimcore/pimcore Packagist
  • Medium 6.5
    CVE-2022-0508

    Server-Side Request Forgery (SSRF) in chocobozzz/peertube

    Server-Side Request Forgery (SSRF) in GitHub repository chocobozzz/peertube prior to f33e515991a32885622b217bf2ed1d1b0d9d6832

    Chocobozzz chocobozzz/peertube @peertube/embed-api npm
  • Unscored —
    CVE-2022-22146

    Cross-site scripting vulnerability in TransmitMail 2.5.0 to 2.6.1 allows a remote unauthenticated attacker to inject an…

    TAGAWA Takao TransmitMail