Skip to content
OpenAdvisories

Archive

9 March 2022

Vulnerabilities first published on this day (UTC), newest first.

← February 2022 2022 / March /9 April 2022 →
  1. 157
  2. 277
  3. 351
  4. 456
  5. 56
  6. 612
  7. 7128
  8. 874
  9. 9184
  10. 1042
  11. 1189
  12. 1210
  13. 138
  14. 1494
  15. 1597
  16. 16151
  17. 1753
  18. 18160
  19. 193
  20. 2013
  21. 2163
  22. 2223
  23. 23110
  24. 2431
  25. 2577
  26. 2613
  27. 279
  28. 28113
  29. 29105
  30. 30131
  31. 3145
All Critical High Medium Low Exploited only Public exploit

184 results · Feed

  • Medium 5.8
    CVE-2022-0507

    Vulnerability: Authenticated SQL Injection in API

    Found a potential security vulnerability inside the Pandora API. Affected Pandora FMS version range: all versions of NG version, up to OUM 759. This vulnerability could allow an attacker with authenticated IP to inject SQL.

    Artica PFMS Pandora FMS
  • Medium 5.3
    CVE-2022-0813

    PhpMyAdmin exposure of sensitive information

    PhpMyAdmin 5.1.1 and before allows an attacker to retrieve potentially sensitive information by creating invalid requests. This affects the lang parameter, the pma_parameter, and the cookie section.

    phpMyAdmin phpMyAdmin phpmyadmin phpmyadmin Debian Ubuntu Packagist
  • Unscored —
    CVE-2022-26355

    Citrix Federated Authentication Service (FAS)

    Citrix Federated Authentication Service (FAS) 7.17 - 10.6 causes deployments that have been configured to store a registration authority certificate's private key in a Trusted Platform Module (TPM) to incorrectly store that key in the Microsoft Software Key S…

    Citrix Federated Authentication Service (FAS) Network devices
  • Medium 6.8
    CVE-2022-22795

    Signiant - Manager+Agents XML External Entity (XXE)

    Signiant - Manager+Agents XML External Entity (XXE) - Extract internal files of the affected machine An attacker can read all the system files, the product is running with root on Linux systems and nt/authority on windows systems, which allows him to access a…

    Signiant Signiant
  • Unscored —
    CVE-2022-24609

    Luocms v2.0 is affected by an incorrect access control vulnerability. Through /admin/templates/template_manage.php, an …

  • Unscored —
    CVE-2022-24608

    Luocms v2.0 is affected by Cross Site Scripting (XSS) in /admin/news/sort_add.php and /inc/function.php.

  • Unscored —
    CVE-2022-24607

    Luocms v2.0 is affected by SQL Injection in /admin/news/news_ok.php.

  • Unscored —
    CVE-2022-24606

    Luocms v2.0 is affected by SQL Injection in /admin/news/sort_ok.php.

  • Unscored —
    CVE-2022-24605

    Luocms v2.0 is affected by SQL Injection in /admin/link/link_ok.php.

  • Unscored —
    CVE-2022-24604

    Luocms v2.0 is affected by SQL Injection in /admin/link/link_mod.php.

  • Unscored —
    CVE-2022-24603

    Luocms v2.0 is affected by SQL Injection in /admin/news/sort_mod.php.

  • Unscored —
    CVE-2022-24602

    Luocms v2.0 is affected by SQL Injection in /admin/news/news_mod.php.

  • Unscored —
    CVE-2022-24601

    Luocms v2.0 is affected by SQL Injection in /admin/manager/admin_mod.php. An attacker can obtain sensitive information …

  • Unscored —
    CVE-2022-24600

    Luocms v2.0 is affected by SQL Injection through /admin/login.php. An attacker can log in to the background through SQL…

  • Unscored —
    CVE-2022-24618

    Heimdal.Wizard.exe installer in Heimdal Premium Security 2.5.395 and earlier has insecure permissions, which allows unp…

  • Medium 6.4
    CVE-2021-44750

    Arbitrary Code Execution

    An arbitrary code execution vulnerability was found in the F-Secure Support Tool. A standard user can craft a special configuration file, which when run by administrator can execute any commands.

    F-Secure F-Secure Elements Agent, F-Secure MDR, F-Secure Client Security, F-Secure Server Security, F-Secure Email and Server Security, F-Secure Freedome VPN, F-Secure SAFE, F-Secure KEY, and F-Secur
  • High 7.1
    CVE-2022-0896

    Improper Neutralization of Special Elements Used in a Template Engine in microweber/microweber

    Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository microweber/microweber prior to 1.3.

    microweber microweber/microweber microweber/microweber Packagist
  • Critical 9.1
    CVE-2022-0482 Public exploit Scanner template EPSS 44%

    Exposure of Private Personal Information to an Unauthorized Actor in alextselegidis/easyappointments

    Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository alextselegidis/easyappointments prior to 1.4.3.

    Alex Tselegidis alextselegidis/easyappointments alextselegidis/easyappointments Packagist
  • High 7.6
    CVE-2022-0881

    Insecure Storage of Sensitive Information in chocobozzz/peertube

    Insecure Storage of Sensitive Information in GitHub repository chocobozzz/peertube prior to 4.1.1.

    Chocobozzz chocobozzz/peertube
  • Medium 5.3
    CVE-2022-26778

    Veritas System Recovery (VSR) 18 and 21 stores a network destination password in the Windows registry during configurat…

  • Medium 6.5
    CVE-2022-24960

    Use after free vulnerability in PDFTron SDK

    A use after free vulnerability was discovered in PDFTron SDK version 9.2.0. A crafted PDF can overwrite RIP with data previously allocated on the heap. This issue affects: PDFTron PDFTron SDK 9.2.0 on OSX; 9.2.0 on Linux; 9.2.0 on Windows.

  • Unscored —
    CVE-2022-25943 Public exploit

    The installer of WPS Office for Windows versions prior to v11.2.0.10258 fails to configure properly the ACL for the dir…

    WPS Office Software WPS Office for Windows Windows
  • High 8.8
    CVE-2022-0204

    A heap overflow vulnerability was found in bluez in versions prior to 5.63. An attacker with local network access could…

    bluez bluez Debian Ubuntu
  • Medium 6.1
    CVE-2022-0891 Public exploit

    A heap buffer overflow in ExtractImageSection function in tiffcrop.c in libtiff library Version 4.3.0 allows attacker t…

    LibTIFF LibTIFF tiff tiff Debian Ubuntu Azure Linux Alpine