Skip to content
OpenAdvisories

Archive

22 March 2022

Vulnerabilities first published on this day (UTC), newest first.

← February 2022 2022 / March /22 April 2022 →
  1. 157
  2. 277
  3. 351
  4. 456
  5. 56
  6. 612
  7. 7128
  8. 874
  9. 9184
  10. 1042
  11. 1189
  12. 1210
  13. 138
  14. 1494
  15. 1597
  16. 16151
  17. 1753
  18. 18160
  19. 193
  20. 2013
  21. 2163
  22. 2223
  23. 23110
  24. 2431
  25. 2577
  26. 2613
  27. 279
  28. 28113
  29. 29105
  30. 30131
  31. 3145
All Critical High Medium Low Exploited only Public exploit

23 results · Feed

  • Unscored —
    CVE-2022-25518

    In CMDBuild from version 3.0 to 3.3.2 payload requests are saved in a temporary log table, which allows attackers with …

  • Unscored —
    CVE-2021-33961

    A Cross Site Scripting (XSS) vulnerabililty exists in enhanced-github v5.0.11 via the file name parameter.

  • Unscored —
    CVE-2022-26189

    TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via the langType par…

  • Unscored —
    CVE-2022-26188

    TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via /setting/NTPSync…

  • Unscored —
    CVE-2022-26187 EPSS 20%

    TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via the pingCheck fu…

  • Unscored —
    CVE-2022-26186

    TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via the exportOvpn i…

  • High 7.3
    CVE-2022-1031

    Use After Free in op_is_set_bp in radareorg/radare2

    Use After Free in op_is_set_bp in GitHub repository radareorg/radare2 prior to 5.6.6.

    radareorg radareorg/radare2 radare2 radare2 Ubuntu Alpine
  • High —
    GHSA-5w9c-rv96-fr7g

    Removal of functional code in faker.js

    Faker.js helps users create large amounts of data for testing and development. The maintainer deliberately removed the functional code from this package. This appears to be a purposeful and successful attempt to make the package unusable. This is related to t…

    faker npm
  • Critical 9.8
    CVE-2022-26260

    Prototype Pollution in simple-plist

    Simple-Plist v1.3.0 was discovered to contain a prototype pollution vulnerability via .parse().

    simple-plist npm
  • Unscored —
    CVE-2022-27228 Scanner template EPSS 21%

    In the vote (aka "Polls, Votes") module before 21.0.100 of Bitrix Site Manager, a remote unauthenticated attacker can e…

  • Unscored —
    CVE-2021-41736

    Faust v2.35.0 was discovered to contain a heap-buffer overflow in the function realPropagate() at propagate.cpp.

    faust faust Debian Ubuntu
  • Unscored —
    CVE-2022-25484

    tcpprep v4.4.1 has a reachable assertion (assert(l2len > 0)) in packet2tree() at tree.c in tcpprep v4.4.1.

    tcpreplay Debian
  • High 7.1
    CVE-2022-24774

    Improper Input Validation leading to Path Traversal in CycloneDX BOM Repository Server

    CycloneDX BOM Repository Server is a bill of materials (BOM) repository server for distributing CycloneDX BOMs. CycloneDX BOM Repository Server before version 2.0.1 has an improper input validation vulnerability leading to path traversal. A malicious user may…

    CycloneDX cyclonedx-bom-repo-server
  • Low 3.4
    CVE-2022-21718

    Renderers can obtain access to random bluetooth device without permission in Electron

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. A vulnerability in versions prior to `17.0.0-alpha.6`, `16.0.6`, `15.3.5`, `14.2.4`, and `13.6.6` allows renderers to obtain access to a bluetooth device v…

    electron electron electron npm
  • Unscored —
    CVE-2021-43650 Public exploit

    WebRun 3.6.0.42 is vulnerable to SQL Injection via the P_0 parameter used to set the username during the login process.

  • Medium 5.3
    CVE-2022-1036

    Able to create an account with long password leads to memory corruption / Integer Overflow in microweber/microweber

    Able to create an account with long password leads to memory corruption / Integer Overflow in GitHub repository microweber/microweber prior to 1.2.12.

    microweber microweber/microweber microweber/microweber Packagist
  • Unscored —
    RUSTSEC-2022-0015

    pty is unmaintained

    The repository hasn't received any updates since Jun 25, 2017 and the author is unresponsive. Maintained alternatives include: * [`tokio-pty-process`](https://crates.io/crates/tokio-pty-process) * [`pty-process`](https://crates.io/crates/pty-process)

    pty crates.io
  • High 7.5
    CVE-2022-0667

    Assertion failure on delayed DS lookup

    When the vulnerability is triggered the BIND process will exit. BIND 9.18.0

    ISC BIND bind9 bind9 Debian Ubuntu
  • Unscored —
    CVE-2021-45809

    GlobalProtect-openconnect versions prior to 1.4.3 are affected by incorrect access control in GPService through DBUS, G…

  • Critical 9.1
    CVE-2022-1034

    There is a Unrestricted Upload of File vulnerability in ShowDoc v2.10.3 in star7th/showdoc

    There is a Unrestricted Upload of File vulnerability in ShowDoc v2.10.3 in GitHub repository star7th/showdoc prior to 2.10.4.

    star7th star7th/showdoc showdoc/showdoc Packagist
  • High 7.5
    CVE-2022-24764

    Stack buffer overflow in pjproject

    PJSIP is a free and open source multimedia communication library written in C. Versions 2.12 and prior contain a stack buffer overflow vulnerability that affects PJSUA2 users or users that call the API `pjmedia_sdp_print(), pjmedia_sdp_media_print()`. Applica…

    pjsip pjproject asterisk pjproject Debian Ubuntu Alpine
  • Unscored —
    CVE-2022-25517

    MyBatis plus v3.4.3 was discovered to contain a SQL injection vulnerability via the Column parameter in /core/condition…

  • Unscored —
    CVE-2021-45810

    GlobalProtect-openconnect versions prior to 2.0.0 (exclusive) are affected by incorrect access control in GPService thr…