Skip to content
OpenAdvisories

Archive

1 March 2022

Vulnerabilities first published on this day (UTC), newest first.

← February 2022 2022 / March /1 April 2022 →
  1. 157
  2. 277
  3. 351
  4. 456
  5. 56
  6. 612
  7. 7128
  8. 874
  9. 9184
  10. 1042
  11. 1189
  12. 1210
  13. 138
  14. 1494
  15. 1597
  16. 16151
  17. 1753
  18. 18160
  19. 193
  20. 2013
  21. 2163
  22. 2223
  23. 23110
  24. 2431
  25. 2577
  26. 2613
  27. 279
  28. 28113
  29. 29105
  30. 30131
  31. 3145
All Critical High Medium Low Exploited only Public exploit

14 results · Clear filters · Feed

  • Medium —
    GHSA-mfjm-vh54-3f96

    Scrapy cookie-setting is not restricted based on the public suffix list

    ### Impact Responses from domain names whose public domain name suffix contains 1 or more periods (e.g. responses from `example.co.uk`, given its public domain name suffix is `co.uk`) are able to set cookies that are included in requests to any other domain s…

    scrapy PyPI
  • Medium —
    GHSA-j34v-3552-5r7j

    Multiple security issues in Pomerium's embedded envoy

    Envoy, which Pomerium is based on, has issued multiple CVEs impacting stability and security. Though Pomerium may not be vulnerable to all of the issues, it is recommended that all users upgrade to Pomerium v0.16.4 as soon as possible to minimize risk. ### Im…

    github.com/pomerium/pomerium Go
  • Medium —
    GHSA-w4f8-fxq2-j35v

    Possible privilege escalation via bash completion script

    The bash completion script for `fscrypt` through v0.3.2 allows injection of commands via crafted mountpoint paths, allowing privilege escalation under a specific set of circumstances. A local user who has control over mountpoint paths could potentially escala…

    github.com/google/fscrypt Go
  • Medium —
    GHSA-gv9j-4w24-q7vx

    Improper random number generation in github.com/coredns/coredns

    ### Impact CoreDNS before 1.6.6 (using go DNS package < 1.1.25) improperly generates random numbers because math/rand is used. The TXID becomes predictable, leading to response forgeries. ### Patches The problem has been fixed in 1.6.6+. ### References - [CVE…

    github.com/coredns/coredns Go
  • Medium 6.1
    CVE-2022-24717

    Cross Site Scripting (XSS) in ssr-pages

    ssr-pages is an HTML page builder for the purpose of server-side rendering (SSR). In versions prior to 0.1.5, a cross site scripting (XSS) issue can occur when providing untrusted input to the `redirect.link` property as an argument to the `build(MessagePageO…

    Finastra ssr-pages @finastra/ssr-pages npm
  • Medium 4.3
    CVE-2022-22300

    A improper handling of insufficient permissions or privileges in Fortinet FortiAnalyzer version 5.6.0 through 5.6.11, F…

    Fortinet Fortinet FortiManager, FortiAnalyzer Network devices
  • Medium 5.1
    CVE-2022-22321

    IBM MQ Appliance 9.2 CD and 9.2 LTS local messaging users stored with a password hash that provides insufficient protec…

    IBM MQ Appliance
  • Medium 5.6
    CVE-2021-38986

    IBM MQ Appliance 9.2 CD and 9.2 LTS does not invalidate session after logout which could allow an authenticated user to…

    IBM MQ Appliance
  • Medium 4.4
    CVE-2021-38955

    IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a local user with elevated privileges to cause a denial of service due …

    IBM AIX VIOS
  • Medium 6.2
    CVE-2020-4925

    A security vulnerability in the Spectrum Scale 5.0 and 5.1 allows a non-root user to overflow the mmfsd daemon with req…

    IBM Spectrum Scale
  • Medium 4.6
    CVE-2021-44747

    Denial-of-Service (DoS) Vulnerability

    A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Linux Security whereby the Fmlib component used in certain F-Secure products can crash while scanning fuzzed files. The exploit can be triggered remotely by an attacker. A successful attack wi…

    F-Secure F-Secure endpoint protection products on Mac, F-Secure Linux Security (32-bit), F-Secure Linux Security 64, F-Secure Atlant, F-Secure Internet Gatekeeper & F-Secure Security Cloud Linux
  • Medium 5.3
    CVE-2022-0776 Scanner template

    Cross-site Scripting (XSS) - DOM in hakimel/reveal.js

    Cross-site Scripting (XSS) - DOM in GitHub repository hakimel/reveal.js prior to 4.3.0.

    hakimel hakimel/reveal.js reveal.js npm
  • Medium 6.5
    CVE-2021-35036 Public exploit

    A cleartext storage of information vulnerability in the Zyxel VMG3625-T50B firmware version V5.50(ABTL.0)b2k could allo…

    Zyxel VMG3625-T50B firmware Network devices
  • Medium 5.4
    CVE-2022-26332

    Cross-site Scripting in Cipi

    Cipi 3.1.15 allows Add Server stored XSS via the /api/servers name field.

    andreapollastri/cipi Packagist