Skip to content
OpenAdvisories

Archive

21 March 2022

Vulnerabilities first published on this day (UTC), newest first.

← February 2022 2022 / March /21 April 2022 →
  1. 157
  2. 277
  3. 351
  4. 456
  5. 56
  6. 612
  7. 7128
  8. 874
  9. 9184
  10. 1042
  11. 1189
  12. 1210
  13. 138
  14. 1494
  15. 1597
  16. 16151
  17. 1753
  18. 18160
  19. 193
  20. 2013
  21. 2163
  22. 2223
  23. 23110
  24. 2431
  25. 2577
  26. 2613
  27. 279
  28. 28113
  29. 29105
  30. 30131
  31. 3145
All Critical High Medium Low Exploited only Public exploit

63 results · Feed

  • Critical 9.8
    CVE-2022-24766

    Insufficient Protection against HTTP Request Smuggling in mitmproxy

    mitmproxy is an interactive, SSL/TLS-capable intercepting proxy. In mitmproxy 7.0.4 and below, a malicious client or server is able to perform HTTP request smuggling attacks through mitmproxy. This means that a malicious client/server could smuggle a request/…

    mitmproxy mitmproxy mitmproxy mitmproxy Debian Ubuntu PyPI
  • Unscored —
    CVE-2022-24235

    A Cross-Site Request Forgery (CSRF) in the management portal of Snapt Aria v12.8 allows attackers to escalate privilege…

  • Unscored —
    CVE-2022-24236

    An insecure permissions vulnerability in Snapt Aria v12.8 allows unauthenticated attackers to send e-mails from spoofed…

  • Unscored —
    CVE-2022-24237 EPSS 25%

    The snaptPowered2 component of Snapt Aria v12.8 was discovered to contain a command injection vulnerability. This vulne…

  • High 8.8
    CVE-2022-25766 EPSS 35%

    Remote Code Execution (RCE)

    The package ungit before 1.5.20 are vulnerable to Remote Code Execution (RCE) via argument injection. The issue occurs when calling the /api/fetch endpoint. User controlled values (remote and ref) are passed to the git fetch command. By injecting some git opt…

    ungit npm
  • Critical 9.1
    CVE-2022-26960 Scanner template EPSS 51%

    Path Traversal in Studio-42 elFinder through 2.1.60

    connector.minimal.php in std42 elFinder through 2.1.60 is affected by path traversal. This allows unauthenticated remote attackers to read, write, and browse files outside the configured document root. This is due to improper handling of absolute file paths.

    studio-42/elfinder Packagist
  • High 7.5
    CVE-2022-22394

    The IBM Spectrum Protect 8.1.14.000 server could allow a remote attacker to bypass security restrictions, caused by imp…

    IBM Spectrum Protect Server
  • Unscored —
    CVE-2020-24772

    In Dreamacro Clash for Windows v0.11.4, an attacker could embed a malicious iframe in a website with a crafted URL that…

  • Unscored —
    CVE-2022-26494

    An XSS was identified in the Admin Web interface of PrimeKey SignServer before 5.8.1. JavaScript code must be used in a…

  • Unscored —
    CVE-2021-45117

    The OPC autogenerated ANSI C stack stubs (in the NodeSets) do not handle all error cases. This can lead to a NULL point…

  • Unscored —
    CVE-2022-25570

    In Click Studios (SA) Pty Ltd Passwordstate 9435, users with access to a passwordlist can gain access to additional pas…

  • Unscored —
    CVE-2022-24656

    HexoEditor 1.1.8 is affected by Cross Site Scripting (XSS). By putting a common XSS payload in a markdown file, if open…

  • Unscored —
    CVE-2021-45878

    Multiple versions of GARO Wallbox GLB/GTB/GTC are affected by incorrect access control. Lack of access control on the w…

  • Critical 9.9
    CVE-2022-0415 Scanner template EPSS 66%

    Remote Command Execution in uploading repository file in gogs/gogs

    Remote Command Execution in uploading repository file in GitHub repository gogs/gogs prior to 0.12.6.

    Gogs gogs/gogs gogs.io/gogs golang-github-gogits-go-gogs-client Ubuntu Go
  • Unscored —
    CVE-2021-45877

    Multiple versions of GARO Wallbox GLB/GTB/GTC are affected by hard coded credentials. A hardcoded credential exist in /…

  • Unscored —
    CVE-2021-45876

    Multiple versions of GARO Wallbox GLB/GTB/GTC are affected by unauthenticated command injection. The url parameter of t…

  • Medium 4.3
    CVE-2022-1004

    Information disclosure in the External Interface

    Accounted time is shown in the Ticket Detail View (External Interface), even if ExternalFrontend::TicketDetailView###AccountedTimeDisplay is disabled.

    OTRS OTRS
  • Low 3.5
    CVE-2022-0475

    Possible XSS attack via translation

    Malicious translator is able to inject JavaScript code in few translatable strings (where HTML is allowed). The code could be executed in the Package manager. This issue affects: OTRS AG OTRS 7.0.x version: 7.0.32 and prior versions, 8.0.x version: 8.0.19 and…

    OTRS OTRS
  • Medium 6.4
    CVE-2021-36100

    Authenticated remote code execution

    Specially crafted string in OTRS system configuration can allow the execution of any system command.

    OTRS OTRS ((OTRS)) Community Edition OTRSSTORM Debian Ubuntu
  • Unscored —
    CVE-2022-25505

    Taocms v3.0.2 was discovered to contain a SQL injection vulnerability via the id parameter in \include\Model\Category.p…

  • Low 2.9
    CVE-2022-1035

    Segmentation Fault caused by MP4Box -lsr in gpac/gpac

    Segmentation Fault caused by MP4Box -lsr in GitHub repository gpac/gpac prior to 2.1.0-DEV.

    gpac gpac/gpac gpac gpac Debian Ubuntu
  • Critical 9.8
    CVE-2022-26184

    Poetry before v1.1.9 contains Untrusted Search Path

    Poetry v1.1.9 and below was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when users execute Poetry commands in a directory containing malicious content. This vulnerability occurs when the application…

    poetry poetry poetry-core Ubuntu PyPI
  • High 8.8
    CVE-2022-26183

    Untrusted Search Path in PNPM

    PNPM v6.15.1 and below was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when users execute PNPM commands in a directory containing malicious content. This vulnerability occurs when the application is…

    pnpm npm