Skip to content
OpenAdvisories

Archive

17 March 2022

Vulnerabilities first published on this day (UTC), newest first.

← February 2022 2022 / March /17 April 2022 →
  1. 157
  2. 277
  3. 351
  4. 456
  5. 56
  6. 612
  7. 7128
  8. 874
  9. 9184
  10. 1042
  11. 1189
  12. 1210
  13. 138
  14. 1494
  15. 1597
  16. 16151
  17. 1753
  18. 18160
  19. 193
  20. 2013
  21. 2163
  22. 2223
  23. 23110
  24. 2431
  25. 2577
  26. 2613
  27. 279
  28. 28113
  29. 29105
  30. 30131
  31. 3145
All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • High 8.8
    CVE-2022-26500 Exploited · Ransomware

    Improper limitation of path names in Veeam Backup & Replication 9.5U3, 9.5U4,10.x, and 11.x allows remote authenticated…

    KEV Dec 13, 2022
  • High 8.8
    CVE-2022-24770

    Improper Neutralization of Formula Elements in a CSV File in Gradio Flagging

    `gradio` is an open source framework for building interactive machine learning models and demos. Prior to version 2.8.11, `gradio` suffers from Improper Neutralization of Formula Elements in a CSV File. The `gradio` library has a flagging functionality which …

    gradio-app gradio gradio PyPI
  • High 7.5
    CVE-2022-21822

    Allocation of Resources Without Limits or Throttling in nvflare

    NVIDIA FLARE contains a vulnerability in the admin interface, where an un-authorized attacker can cause Allocation of Resources Without Limits or Throttling, which may lead to cause system unavailable.

    NVIDIA NVIDIA FLARE nvflare PyPI
  • High 8.1
    CVE-2022-24759

    Failure to validate signature during handshake in @chainsafe/libp2p-noise

    `@chainsafe/libp2p-noise` contains TypeScript implementation of noise protocol, an encryption protocol used in libp2p. `@chainsafe/libp2p-noise` before 4.1.2 and 5.0.3 does not correctly validate signatures during the handshake process. This may allow a man-i…

    ChainSafe js-libp2p-noise @chainsafe/libp2p-noise npm
  • High 7.5
    CVE-2022-24761

    HTTP Request Smuggling in waitress

    Waitress is a Web Server Gateway Interface server for Python 2 and 3. When using Waitress versions 2.1.0 and prior behind a proxy that does not properly validate the incoming HTTP request matches the RFC7230 standard, Waitress and the frontend proxy may disag…

    Pylons Waitress waitress waitress Debian Ubuntu Azure Linux PyPI
  • High 8.6
    CVE-2022-25354

    Prototype Pollution

    The package set-in before 2.0.3 are vulnerable to Prototype Pollution via the setIn method, as it allows an attacker to merge object prototypes into it. **Note:** This vulnerability derives from an incomplete fix of [CVE-2020-28273](https://security.snyk.io/v…

    set-in npm
  • High 7.5
    CVE-2022-25352

    Prototype Pollution

    The package libnested before 1.5.2 are vulnerable to Prototype Pollution via the set function in index.js. **Note:** This vulnerability derives from an incomplete fix for [CVE-2020-28283](https://security.snyk.io/vuln/SNYK-JS-LIBNESTED-1054930)

    libnested npm
  • High 7.1
    CVE-2022-25760

    Arbitrary Code Injection

    All versions of package accesslog are vulnerable to Arbitrary Code Injection due to the usage of the Function constructor without input sanitization. If (attacker-controlled) user input is given to the format option of the package's exported constructor funct…

    accesslog npm
  • High 7.4
    CVE-2022-0749

    Deserialization of Untrusted Data

    This affects all versions of package SinGooCMS.Utility. The socket client in the package can pass in the payload via the user-controllable input after it has been established, because this socket client transmission does not have the appropriate restrictions …

    SinGooCMS.Utility NuGet
  • High 8.8
    CVE-2022-1000

    Path Traversal in prasathmani/tinyfilemanager

    Path Traversal in GitHub repository prasathmani/tinyfilemanager prior to 2.4.7.

    prasathmani prasathmani/tinyfilemanager