Skip to content
OpenAdvisories

Archive

3 March 2022

Vulnerabilities first published on this day (UTC), newest first.

← February 2022 2022 / March /3 April 2022 →
  1. 157
  2. 277
  3. 351
  4. 456
  5. 56
  6. 612
  7. 7128
  8. 874
  9. 9184
  10. 1042
  11. 1189
  12. 1210
  13. 138
  14. 1494
  15. 1597
  16. 16151
  17. 1753
  18. 18160
  19. 193
  20. 2013
  21. 2163
  22. 2223
  23. 23110
  24. 2431
  25. 2577
  26. 2613
  27. 279
  28. 28113
  29. 29105
  30. 30131
  31. 3145
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Medium 4.3
    CVE-2022-23708

    Elasticsearch privilege escalation

    A flaw was discovered in Elasticsearch 7.17.0’s upgrade assistant, in which upgrading from version 6.x to 7.x would disable the in-built protections on the security index, allowing authenticated users with “*” index permissions access to this index.

    Elastic Elasticsearch elasticsearch org.elasticsearch:elasticsearch Ubuntu Maven
  • Medium 6.2
    CVE-2022-24725

    Exposure of home directory through shescape on Unix with Bash

    Shescape is a shell escape package for JavaScript. An issue in versions 1.4.0 to 1.5.1 allows for exposure of the home directory on Unix systems when using Bash with the `escape` or `escapeAll` functions from the _shescape_ API with the `interpolation` option…

    ericcornelissen shescape shescape npm
  • Medium 5.3
    CVE-2022-24723

    Improper Input Validation in URI.js

    URI.js is a Javascript URL mutation library. Before version 1.19.9, whitespace characters are not removed from the beginning of the protocol, so URLs are not parsed properly. This issue has been patched in version 1.19.9. Removing leading whitespace from valu…

    medialize URI.js urijs node-uri-js Ubuntu npm
  • Medium 5.5
    CVE-2021-3602

    Buildah processes using chroot isolation may leak environment values to intermediate processes

    An information disclosure flaw was found in Buildah, when building containers using chroot isolation. Running processes in container builds (e.g. Dockerfile RUN commands) can access environment variables from parent and grandparent processes. When run in a co…

    cri-o buildah podman buildah Debian Ubuntu Azure Linux Alpine Go
  • Medium 5.5
    CVE-2021-3620

    Ansible discloses sensitive information in traceback error message

    A flaw was found in Ansible Engine's ansible-connection module, where sensitive information such as the Ansible user credentials is disclosed by default in the traceback error message. The highest threat from this vulnerability is to confidentiality.

    ansible ansible ansible ansible-core Debian Ubuntu PyPI
  • Medium 6.4
    CVE-2021-45819

    Wordline HIDCCEMonitorSVC before v5.2.4.3 contains an unquoted service path which allows attackers to escalate privileg…

  • Medium 6.5
    CVE-2022-0528

    Server-Side Request Forgery (SSRF) in transloadit/uppy

    Server-Side Request Forgery (SSRF) in GitHub repository transloadit/uppy prior to 3.3.1.

    transloadit transloadit/uppy @uppy/companion npm
  • Medium 5.4
    CVE-2022-24563

    Cross-site Scripting in GeniXCMS

    In Genixcms v1.1.11, a stored Cross-Site Scripting (XSS) vulnerability exists in /gxadmin/index.php?page=themes&view=options" via the intro_title and intro_image parameters.

    genix/cms Packagist