Skip to content
OpenAdvisories

Archive

23 March 2022

Vulnerabilities first published on this day (UTC), newest first.

← February 2022 2022 / March /23 April 2022 →
  1. 157
  2. 277
  3. 351
  4. 456
  5. 56
  6. 612
  7. 7128
  8. 874
  9. 9184
  10. 1042
  11. 1189
  12. 1210
  13. 138
  14. 1494
  15. 1597
  16. 16151
  17. 1753
  18. 18160
  19. 193
  20. 2013
  21. 2163
  22. 2223
  23. 23110
  24. 2431
  25. 2577
  26. 2613
  27. 279
  28. 28113
  29. 29105
  30. 30131
  31. 3145
All Critical High Medium Low Exploited only Public exploit

13 results · Clear filters · Feed

  • Critical 9.9
    CVE-2022-24768

    Improper access control allows admin privilege escalation in Argo CD

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All unpatched versions of Argo CD starting with 1.0.0 are vulnerable to an improper access control bug, allowing a malicious user to potentially escalate their privileges to admin-level…

    argoproj Argo CD
  • Critical 9.8
    CVE-2022-0888 EPSS 39%

    Ninja Forms - File Uploads Extension <= 3.3.0 - Arbitrary File Upload

    The Ninja Forms - File Uploads Extension WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the ~/includes/ajax/controllers/uploads.php file which can be bypassed making it possible for unauthentic…

    Saturday Drive Ninja Forms - File Uploads Web / CMS
  • Critical 10.0
    CVE-2021-27476

    Rockwell Automation FactoryTalk AssetCentre OS Command Injection

    A vulnerability exists in the SaveConfigFile function of the RACompare Service, which may allow for OS command injection. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary commands in Rockwell Automation FactoryTalk AssetCen…

    Rockwell Automation FactoryTalk® AssetCentre ICS / OT
  • Critical 10.0
    CVE-2021-27470

    Rockwell Automation FactoryTalk AssetCentre Deserialization of Untrusted Data

    A deserialization vulnerability exists in how the LogService.rem service in Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier verifies serialized data. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary commands …

    Rockwell Automation FactoryTalk® AssetCentre ICS / OT
  • Critical 10.0
    CVE-2021-27466

    Rockwell Automation FactoryTalk AssetCentre Deserialization of Untrusted Data

    A deserialization vulnerability exists in how the ArchiveService.rem service in Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier verifies serialized data. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary comma…

    Rockwell Automation FactoryTalk® AssetCentre ICS / OT
  • Critical 10.0
    CVE-2021-27474

    Rockwell Automation FactoryTalk AssetCentre Use of Potentially Dangerous Function

    Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier does not properly restrict all functions relating to IIS remoting services. This vulnerability may allow a remote, unauthenticated attacker to modify sensitive data in FactoryTalk AssetCentre.

    Rockwell Automation FactoryTalk® AssetCentre ICS / OT
  • Critical 10.0
    CVE-2021-27468

    Rockwell Automation FactoryTalk AssetCentre SQL Injection

    The AosService.rem service in Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier exposes functions lacking proper authentication. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary SQL statements.

    Rockwell Automation FactoryTalk® AssetCentre ICS / OT
  • Critical 10.0
    CVE-2021-27472

    Rockwell Automation FactoryTalk AssetCentre SQL Injection

    A vulnerability exists in the RunSearch function of SearchService service in Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier, which may allow for the execution of remote unauthenticated arbitrary SQL statements.

    Rockwell Automation FactoryTalk® AssetCentre ICS / OT
  • Critical 10.0
    CVE-2021-27464

    Rockwell Automation FactoryTalk AssetCentre SQL Injection

    The ArchiveService.rem service in Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier exposes functions lacking proper authentication. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary SQL statements.

    Rockwell Automation FactoryTalk® AssetCentre ICS / OT
  • Critical 10.0
    CVE-2021-27462

    Rockwell Automation FactoryTalk AssetCentre Deserialization of Untrusted Data

    A deserialization vulnerability exists in how the AosService.rem service in Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier verifies serialized data. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary commands …

    Rockwell Automation FactoryTalk® AssetCentre ICS / OT
  • Critical 10.0
    CVE-2021-27460 Public exploit

    Rockwell Automation FactoryTalk AssetCentre Deserialization of Untrusted Data

    Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier components contain .NET remoting endpoints that deserialize untrusted data without sufficiently verifying that the resulting data will be valid. This vulnerability may allow a remote, unauthentica…

    Rockwell Automation FactoryTalk® AssetCentre ICS / OT
  • Critical 9.8
    CVE-2021-27426

    GE UR family insecure default variable initialization

    GE UR IED firmware versions prior to version 8.1x with “Basic” security variant does not allow the disabling of the “Factory Mode,” which is used for servicing the IED by a “Factory” user.

    GE UR family
  • Critical 9.8
    CVE-2021-27428

    GE UR family Unrestricted Upload of File with Dangerous Type

    GE UR IED firmware versions prior to version 8.1x supports upgrading firmware using UR Setup configuration tool – Enervista UR Setup. This UR Setup tool validates the authenticity and integrity of firmware file before uploading the UR IED. An illegitimate use…

    GE UR family