Skip to content
OpenAdvisories

Archive

2 March 2022

Vulnerabilities first published on this day (UTC), newest first.

← February 2022 2022 / March /2 April 2022 →
  1. 157
  2. 277
  3. 351
  4. 456
  5. 56
  6. 612
  7. 7128
  8. 874
  9. 9184
  10. 1042
  11. 1189
  12. 1210
  13. 138
  14. 1494
  15. 1597
  16. 16151
  17. 1753
  18. 18160
  19. 193
  20. 2013
  21. 2163
  22. 2223
  23. 23110
  24. 2431
  25. 2577
  26. 2613
  27. 279
  28. 28113
  29. 29105
  30. 30131
  31. 3145
All Critical High Medium Low Exploited only Public exploit

18 results · Clear filters · Feed

  • Medium 5.3
    CVE-2022-25146

    Liferay Portal and Liferay DXP fails to check origin of event messages

    The Remote App module in Liferay Portal Liferay Portal v7.4.3.4 through v7.4.3.8 and Liferay DXP 7.4 before update 5 does not check if the origin of event messages it receives matches the origin of the Remote App, allowing attackers to exfiltrate the CSRF tok…

    com.liferay.portal:release.dxp.bom com.liferay:com.liferay.remote.app.web Maven
  • Medium 5.4
    CVE-2021-38269

    Liferay Portal and Liferay DXP vulnerable to cross-site scripting (XSS) in the Gogo Shell module

    Cross-site scripting (XSS) vulnerability in the Gogo Shell module in Liferay Portal 7.1.0 through 7.3.6 and 7.4.0, and Liferay DXP 7.1 before fix pack 23, 7.2 before fix pack 13, and 7.3 before fix pack 2 allows remote attackers to inject arbitrary web script…

    com.liferay.portal:release.dxp.bom com.liferay:com.liferay.gogo.shell.web Maven
  • Medium 5.4
    CVE-2021-38267

    Liferay Portal and Liferay DXP vulnerable to cross-site scripting (XSS) in edit blog entry page

    Cross-site scripting (XSS) vulnerability in the Blogs module's edit blog entry page in Liferay Portal 7.3.2 through 7.3.6, and Liferay DXP 7.3 before fix pack 2 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_blogs_web_port…

    com.liferay.portal:release.portal.bom com.liferay.portal:release.dxp.bom com.liferay:com.liferay.frontend.js.web Maven
  • Medium 6.1
    CVE-2021-38263

    Liferay Portal and Liferay DXP cross-site scripting (XSS) vulnerability via the script console

    Cross-site scripting (XSS) vulnerability in the Server module's script console in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 101, 7.1 before fix pack 20 and 7.2 before fix pack 10 allows remote attackers to inject arbitrary web scri…

    com.liferay.portal:release.dxp.bom com.liferay:com.liferay.server.admin.web Maven
  • Medium 6.1
    CVE-2021-38264

    Liferay Portal vulnerable to cross-site scripting (XSS) via the keywords parameter

    Cross-site scripting (XSS) vulnerability in the Frontend Taglib module in Liferay Portal 7.4.0 and 7.4.1 allows remote attackers to inject arbitrary web script or HTML into the management toolbar search via the `keywords` parameter. This issue is caused by an…

    com.liferay:com.liferay.frontend.taglib.clay Maven
  • Medium 5.4
    CVE-2021-38265

    Liferay Portal and Liferay DXP vulnerable to cross-site scripting (XSS)

    Cross-site scripting (XSS) vulnerability in the Asset module in Liferay Portal 7.3.4 through 7.3.6 allow remote attackers to inject arbitrary web script or HTML when creating a collection page via the _com_liferay_asset_list_web_portlet_AssetListPortlet_title…

    com.liferay.portal:release.dxp.bom com.liferay:com.liferay.layout.admin.web Maven
  • Medium 6.5
    CVE-2021-3658

    bluetoothd from bluez incorrectly saves adapters' Discoverable status when a device is powered down, and restores it wh…

    bluez bluez Debian Ubuntu
  • Medium 4.3
    CVE-2021-45074

    JFrog Artifactory before 7.29.3 and 6.23.38, is vulnerable to Broken Access Control, a low-privileged user is able to d…

    jfrog JFrog Artifactory
  • Medium 5.6
    CVE-2022-0675

    Puppet Firewall Module May Leave Unmanaged Rules

    In certain situations it is possible for an unmanaged rule to exist on the target system that has the same comment as the rule specified in the manifest. This could allow for unmanaged rules to exist on the target system and leave the system in an unsafe stat…

    Puppet Firewall Module puppet-module-puppetlabs-firewall puppet-module-puppetlabs-firewall Debian Ubuntu
  • Medium 4.6
    CVE-2022-23656

    Cross-site scripting vulnerability in Zulip Server

    Zulip is an open source team chat app. The `main` development branch of Zulip Server from June 2021 and later is vulnerable to a cross-site scripting vulnerability on the recent topics page. An attacker could maliciously craft a full name for their account an…

    zulip zulip
  • Medium 6.5
    CVE-2021-38268

    Liferay Portal and Liferay DXP has incorrect default permissions for site members

    The Dynamic Data Mapping module in Liferay Portal 7.0.0 through 7.3.6, and Liferay DXP 7.0 before fix pack 101, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 2 incorrectly sets default permissions for site members, which allows remote…

    com.liferay.portal:release.dxp.bom com.liferay:com.liferay.dynamic.data.mapping.service Maven
  • Medium 5.4
    CVE-2021-43070

    Multiple relative path traversal vulnerabilities [CWE-23] in FortiWLM management interface 8.6.2 and below, 8.5.2 and b…

    Fortinet Fortinet FortiWLM Network devices
  • Medium 6.2
    CVE-2022-22350

    IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in CAA to cause …

    IBM AIX VIOS
  • Medium 6.2
    CVE-2021-38996

    IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX kerne…

    IBM AIX VIOS
  • Medium 5.4
    CVE-2022-0829

    Improper Authorization in webmin/webmin

    Improper Authorization in GitHub repository webmin/webmin prior to 1.990.

    Webmin webmin/webmin
  • Medium 6.1
    CVE-2022-23395

    Prototype Pollution in jquery.cookie

    jQuery Cookie 1.4.1 is affected by prototype pollution, which can lead to DOM cross-site scripting (XSS).

    jquery.cookie jquery-goodies Debian NuGet
  • Medium 4.1
    CVE-2021-44166

    An improper access control vulnerability [CWE-284 ] in FortiToken Mobile (Android) external push notification 5.1.0 and…

    Fortinet Fortinet FortiTokenAndroid Network devices
  • Medium 6.1
    CVE-2021-3654 Scanner template EPSS 27%

    Open Redirect in CPython that affects users of OpenStack Nova

    A vulnerability was found in openstack-nova's console proxy, noVNC. By crafting a malicious URL, noVNC could be made to redirect to any desired URL.

    nova nova nova Debian Ubuntu PyPI