Skip to content
OpenAdvisories

Archive

14 March 2022

Vulnerabilities first published on this day (UTC), newest first.

← February 2022 2022 / March /14 April 2022 →
  1. 157
  2. 277
  3. 351
  4. 456
  5. 56
  6. 612
  7. 7128
  8. 874
  9. 9184
  10. 1042
  11. 1189
  12. 1210
  13. 138
  14. 1494
  15. 1597
  16. 16151
  17. 1753
  18. 18160
  19. 193
  20. 2013
  21. 2163
  22. 2223
  23. 23110
  24. 2431
  25. 2577
  26. 2613
  27. 279
  28. 28113
  29. 29105
  30. 30131
  31. 3145
All Critical High Medium Low Exploited only Public exploit

19 results · Clear filters · Feed

  • Medium 5.0
    GHSA-q347-cg56-pcq4

    SSRF in repository migration

    ### Impact The malicious user is able to discover services in the internal network through repository migration functionality. All installations accepting public traffic are affected. ### Patches Internal network CIDRs are prohibited to be used as repository …

    gogs.io/gogs Go
  • Medium 6.5
    CVE-2022-24762

    Exposure of Sensitive Information to an Unauthorized Actor in sysend.js

    sysend.js is a library that allows a user to send messages between pages that are open in the same browser. Users that use cross-origin communication may have their communications intercepted. Impact is limited by the communication occurring in the same brows…

    jcubic sysend.js sysend npm
  • Medium 5.0
    CVE-2022-24740

    Improper Authentication in Volto

    Volto is a ReactJS-based frontend for the Plone Content Management System. Between versions 14.0.0-alpha.5 and 15.0.0-alpha.0, a user could have their authentication cookie replaced with an authentication cookie from another user, effectively giving them cont…

    plone volto @plone/volto npm
  • Medium 6.1
    CVE-2022-24749

    Basic Cross-site Scripting and Unrestricted Upload of File with Dangerous Type in Sylius

    Sylius is an open source eCommerce platform. In versions prior to 1.9.10, 1.10.11, and 1.11.2, it is possible to upload an SVG file containing cross-site scripting (XSS) code in the admin panel. In order to perform a XSS attack, the file itself has to be open…

    Sylius Sylius sylius/sylius Packagist
  • Medium 5.0
    CVE-2022-24742

    Exposure of Sensitive Information Due to Incompatible Policies in Sylius

    Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, any other user can view the data if browser tab remains unclosed after log out. The issue is fixed in versions 1.9.10, 1.10.11, and 1.11.2. A workaround is available. …

    Sylius Sylius sylius/sylius Packagist
  • Medium 6.1
    CVE-2022-24733

    Improper Restriction of Rendered UI Layers or Frames in Sylius

    Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, it is possible for a page controlled by an attacker to load the website within an iframe. This will enable a clickjacking attack, in which the attacker's page overlays…

    Sylius Sylius sylius/sylius Packagist
  • Medium 5.3
    CVE-2022-22353

    IBM Big SQL on IBM Cloud Pak for Data 7.1.0, 7.1.1, 7.2.0, and 7.2.3 could allow an authenticated user with appropriate…

    IBM Big SQL on Cloud Pak for Data
  • Medium 4.0
    CVE-2022-22348

    IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.13.xxx is vulnerable to reverse tabnabbing where it could …

    IBM Spectrum Protect Operations Center
  • Medium 4.3
    CVE-2022-22346

    IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.13.xxx is vulnerable to cross-site request forgery which c…

    IBM Spectrum Protect Operations Center
  • Medium 4.9
    CVE-2021-38971

    IBM Data Virtualization on Cloud Pak for Data 1.3.0, 1.4.1, 1.5.0, 1.7.1 and 1.7.3 could allow an authorized user to by…

    IBM Data Virtualization on Cloud Pak for Data
  • Medium 6.2
    CVE-2022-22354

    IBM Spectrum Protect Plus 10.1.0.0 through 10.1.9.2 and IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 do n…

    IBM Spectrum Protect Plus Spectrum Copy Data Management
  • Medium 4.8
    CVE-2022-22344

    IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 is vulnerable to HTTP header injection, caused by improper v…

    IBM Spectrum Copy Data Management
  • Medium 5.4
    CVE-2021-39055

    IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 is vulnerable to cross-site scripting. This vulnerability al…

    IBM Spectrum Copy Data Management
  • Medium 4.8
    CVE-2021-39051

    IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 is vulnerable to server-side request forgery, caused by impr…

    IBM Spectrum Copy Data Management
  • Medium 4.8
    CVE-2021-41952

    Cross-site Scripting in Zenario CMS

    Zenario CMS 9.0.54156 is vulnerable to Cross Site Scripting (XSS) via upload file to *.SVG. An attacker can send malicious files to victims and steals victim's cookie leads to account takeover. The person viewing the image of a contact can be victim of XSS.

    tribalsystems/zenario Packagist
  • Medium 6.3
    CVE-2022-0940

    Stored XSS due to Unrestricted File Upload in star7th/showdoc

    Stored XSS due to Unrestricted File Upload in GitHub repository star7th/showdoc prior to v2.10.4.

    star7th star7th/showdoc showdoc/showdoc Packagist
  • Medium 6.6
    CVE-2022-0341

    Cross-site Scripting (XSS) - Stored in vanessa219/vditor

    Cross-site Scripting (XSS) - Stored in GitHub repository vanessa219/vditor prior to 3.8.12.

    vanessa219 vanessa219/vditor vditor npm
  • Medium 6.3
    CVE-2022-0937

    Stored xss in showdoc through file upload in star7th/showdoc

    Stored xss in showdoc through file upload in GitHub repository star7th/showdoc prior to 2.10.4.

    star7th star7th/showdoc showdoc/showdoc Packagist
  • Medium 6.5
    CVE-2022-24385

    Information disclosure via direct object access on SmarterTrack v100.0.8019.14010

    A Direct Object Access vulnerability in SmarterTools SmarterTrack leads to information disclosure This issue affects: SmarterTools SmarterTrack 100.0.8019.14010.

    SmarterTools SmarterTrack