Skip to content
OpenAdvisories

Archive

17 March 2022

Vulnerabilities first published on this day (UTC), newest first.

← February 2022 2022 / March /17 April 2022 →
  1. 157
  2. 277
  3. 351
  4. 456
  5. 56
  6. 612
  7. 7128
  8. 874
  9. 9184
  10. 1042
  11. 1189
  12. 1210
  13. 138
  14. 1494
  15. 1597
  16. 16151
  17. 1753
  18. 18160
  19. 193
  20. 2013
  21. 2163
  22. 2223
  23. 23110
  24. 2431
  25. 2577
  26. 2613
  27. 279
  28. 28113
  29. 29105
  30. 30131
  31. 3145
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Medium 5.5
    CVE-2022-0757

    Rapid7 Nexpose SQL Injection

    Rapid7 Nexpose versions 6.6.93 and earlier are susceptible to an SQL Injection vulnerability, whereby valid search operators are not defined. This lack of validation can allow a logged-in, authenticated attacker to manipulate the "ANY" and "OR" operators in t…

    Rapid7 Nexpose
  • Medium 4.0
    CVE-2022-0237

    Rapid7 Insight Agent Privilege Escalation

    Rapid7 Insight Agent versions 3.1.2.38 and earlier suffer from a privilege escalation vulnerability, whereby an attacker can hijack the flow of execution due to an unquoted argument to the runas.exe command used by the ir_agent.exe component, resulting in ele…

    Rapid7 Insight Agent
  • Medium 5.9
    CVE-2022-24302

    Race Condition in Paramiko

    In Paramiko before 2.10.1, a race condition (between creation and chmod) in the write_private_key_file function could allow unauthorized information disclosure.

    paramiko paramiko paramiko Debian Ubuntu PyPI
  • Medium 5.9
    CVE-2022-21221

    Directory Traversal

    The package github.com/valyala/fasthttp before 1.34.0 are vulnerable to Directory Traversal via the ServeFile function, due to improper sanitization. It is possible to be exploited by using a backslash %5c character in the path. **Note:** This security issue …

    github.com/valyala/fasthttp Go
  • Medium 6.4
    CVE-2021-23556

    Exposed Dangerous Method or Function

    The package guake before 3.8.5 are vulnerable to Exposed Dangerous Method or Function due to the exposure of execute_command and execute_command_by_uuid methods via the d-bus interface, which makes it possible for a malicious user to run an arbitrary command …

    guake guake guake Debian Ubuntu PyPI
  • Medium 6.5
    CVE-2021-23771

    Sandbox Bypass

    This affects all versions of package notevil; all versions of package argencoders-notevil. It is vulnerable to Sandbox Escape leading to Prototype pollution. The package fails to restrict access to the main context, allowing an attacker to add or modify an ob…

    notevil argencoders-notevil npm
  • Medium 6.6
    CVE-2021-23632

    Remote Code Execution (RCE)

    All versions of package git are vulnerable to Remote Code Execution (RCE) due to missing sanitization in the Git.git method, which allows execution of OS commands rather than just git commands. Steps to Reproduce 1. Create a file named exploit.js with the fol…

    git npm
  • Medium 6.3
    CVE-2022-25296

    Prototype Pollution

    The package bodymen from 0.0.0 are vulnerable to Prototype Pollution via the handler function which could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload. **Note:** This vulnerability derives from an incomplete fix…

    bodymen npm