Skip to content
OpenAdvisories

Archive

1 March 2022

Vulnerabilities first published on this day (UTC), newest first.

← February 2022 2022 / March /1 April 2022 →
  1. 157
  2. 277
  3. 351
  4. 456
  5. 56
  6. 612
  7. 7128
  8. 874
  9. 9184
  10. 1042
  11. 1189
  12. 1210
  13. 138
  14. 1494
  15. 1597
  16. 16151
  17. 1753
  18. 18160
  19. 193
  20. 2013
  21. 2163
  22. 2223
  23. 23110
  24. 2431
  25. 2577
  26. 2613
  27. 279
  28. 28113
  29. 29105
  30. 30131
  31. 3145
All Critical High Medium Low Exploited only Public exploit

57 results · Feed

  • High 7.3
    CVE-2022-0777

    Weak Password Recovery Mechanism for Forgotten Password in microweber/microweber

    Weak Password Recovery Mechanism for Forgotten Password in GitHub repository microweber/microweber prior to 1.3.

    microweber microweber/microweber microweber/microweber Packagist
  • Medium 5.3
    CVE-2022-0776 Scanner template

    Cross-site Scripting (XSS) - DOM in hakimel/reveal.js

    Cross-site Scripting (XSS) - DOM in GitHub repository hakimel/reveal.js prior to 4.3.0.

    hakimel hakimel/reveal.js reveal.js npm
  • Critical 9.8
    CVE-2021-4039 Public exploit EPSS 71%

    A command injection vulnerability in the web interface of the Zyxel NWA-1100-NH firmware could allow an attacker to exe…

    Zyxel NWA1100-NH firmware Network devices
  • Medium 6.5
    CVE-2021-35036 Public exploit

    A cleartext storage of information vulnerability in the Zyxel VMG3625-T50B firmware version V5.50(ABTL.0)b2k could allo…

    Zyxel VMG3625-T50B firmware Network devices
  • Unscored —
    CVE-2021-43619

    Trusted Firmware M 1.4.x through 1.4.1 has a buffer overflow issue in the Firmware Update partition. In the IPC model, …

  • Unscored —
    CVE-2022-24446

    An issue was discovered in Zoho ManageEngine Key Manager Plus 6.1.6. A user, with the level Operator, can see all SSH s…

  • High 7.7
    CVE-2022-22262

    ASUS Armoury Crate & Aura Creator Installer之ROG Live Service - Improper Link Resolution Before File Access

    ROG Live Service’s function for deleting temp files created by installation has an improper link resolution before file access vulnerability. Since this function does not validate the path before deletion, an unauthenticated local attacker can create an unexp…

    ASUS Armoury Crate & Aura Creator Installer (ROG Live Service)
  • Critical 9.8
    CVE-2020-12775

    Hicos citizen certificate client-side component - Command Injection

    Hicos citizen certificate client-side component does not filter special characters for command parameters in specific web URLs. An unauthenticated remote attacker can exploit this vulnerability to perform command injection attack to execute arbitrary system c…

    Hicos citizen certificate client-side component
  • Unscored —
    CVE-2021-44962

    An out-of-bounds read vulnerability exists in the GCode::extrude() functionality of Slic3r libslic3r 1.3.0 and Master C…

    slic3r slic3r Debian Ubuntu
  • Unscored —
    CVE-2021-44961

    A memory leakage flaw exists in the class PerimeterGenerator of Slic3r libslic3r 1.3.0 and Master Commit b1a5500. Speci…

    slic3r slic3r Debian Ubuntu
  • Unscored —
    CVE-2021-42951

    A Remote Code Execution (RCE) vulnerability exists in Algorithmia MSOL all versions before October 10 2021 of SaaS. Use…

  • Critical 9.1
    CVE-2021-42767

    Neo4j Graph Database vulnerable to Path Traversal

    A directory traversal vulnerability in the apoc plugins in Neo4J Graph database before 4.4.0.1 allows attackers to read local files, and sometimes create local files. This is fixed in 3.5.17, 4.2.10, 4.3.0.4, and 4.4.0.1.

    org.neo4j.procedure:apoc Maven
  • Unscored —
    CVE-2022-25022 Public exploit

    A cross-site scripting (XSS) vulnerability in Htmly v2.8.1 allows attackers to excute arbitrary web scripts HTML via a …

  • Unscored —
    CVE-2022-25020 Public exploit

    A cross-site scripting (XSS) vulnerability in Pluxml v5.8.7 allows attackers to execute arbitrary web scripts or HTML v…

    pluxml Ubuntu
  • Unscored —
    CVE-2022-25018 Public exploit

    Pluxml v5.8.7 was discovered to allow attackers to execute arbitrary code via crafted PHP code inserted into static pag…

    pluxml Ubuntu
  • Medium 5.4
    CVE-2022-26332

    Cross-site Scripting in Cipi

    Cipi 3.1.15 allows Add Server stored XSS via the /api/servers name field.

    andreapollastri/cipi Packagist
  • Critical 9.8
    CVE-2022-24720

    Improper Input Validation in image_processing

    image_processing is an image processing wrapper for libvips and ImageMagick/GraphicsMagick. Prior to version 1.12.2, using the `#apply` method from image_processing to apply a series of operations that are coming from unsanitized user input allows the attacke…

    janko image_processing image_processing ruby-image-processing Debian Ubuntu RubyGems