Skip to content
OpenAdvisories

Archive

23 March 2022

Vulnerabilities first published on this day (UTC), newest first.

← February 2022 2022 / March /23 April 2022 →
  1. 157
  2. 277
  3. 351
  4. 456
  5. 56
  6. 612
  7. 7128
  8. 874
  9. 9184
  10. 1042
  11. 1189
  12. 1210
  13. 138
  14. 1494
  15. 1597
  16. 16151
  17. 1753
  18. 18160
  19. 193
  20. 2013
  21. 2163
  22. 2223
  23. 23110
  24. 2431
  25. 2577
  26. 2613
  27. 279
  28. 28113
  29. 29105
  30. 30131
  31. 3145
All Critical High Medium Low Exploited only Public exploit

11 results · Clear filters · Feed

  • High 7.7
    CVE-2022-24730

    Path traversal and improper access control allows leaking out-of-bound files from Argo CD repo-server

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 1.3.0 but before versions 2.1.11, 2.2.6, and 2.3.0 is vulnerable to a path traversal bug, compounded by an improper access control bug, allowing a maliciou…

    argoproj Argo CD github.com/argoproj/argo-cd github.com/argoproj/argo-cd/v2 Go
  • High 7.5
    CVE-2022-24757

    Sensitive Auth & Cookie data stored in Jupyter server logs

    The Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications. Prior to version 1.15.4, unauthorized actors can access sensitive information from server logs. Anytime a 5xx error is triggered, the auth…

    jupyter-server jupyter_server jupyter-server jupyter-server Debian Ubuntu PyPI
  • High 7.2
    CVE-2022-0889

    Ninja Forms - File Uploads Extension <= 3.3.12 - Reflected Cross-Site Scripting

    The Ninja Forms - File Uploads Extension WordPress plugin is vulnerable to reflected cross-site scripting due to missing sanitization of the files filename parameter found in the ~/includes/ajax/controllers/uploads.php file which can be used by unauthenticate…

    Saturday Drive Ninja Forms - File Uploads Web / CMS
  • High 7.2
    CVE-2022-0834

    Amelia <= 1.0.46 - Stored Cross Site Scripting via lastName

    The Amelia WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the lastName parameter found in the ~/src/Application/Controller/User/Customer/AddCustomerController.php file which allows attackers to inject a…

    ameliabooking Booking for Appointments and Events Calendar – Amelia Web / CMS
  • High 8.6
    CVE-2021-27475

    Rockwell Automation Connected Components Workbench Deserialization of Untrusted Data

    Rockwell Automation Connected Components Workbench v12.00.00 and prior does not limit the objects that can be deserialized. This vulnerability allows attackers to craft a malicious serialized object that, if opened by a local user in Connected Components Work…

    Rockwell Automation Connected Components Workbench ICS / OT
  • High 7.7
    CVE-2021-27471

    Rockwell Automation Connected Components Workbench Path Traversal

    The parsing mechanism that processes certain file types does not provide input sanitization for file paths. This may allow an attacker to craft malicious files that, when opened by Rockwell Automation Connected Components Workbench v12.00.00 and prior, can tr…

    Rockwell Automation Connected Components Workbench ICS / OT
  • High 7.5
    CVE-2021-27422

    GE UR family exposure of sensitive information to an unauthorized actor

    GE UR firmware versions prior to version 8.1x web server interface is supported on UR over HTTP protocol. It allows sensitive information exposure without authentication.

    GE UR family
  • High 8.4
    CVE-2021-27430

    GE UR family hardcoded credentials

    GE UR bootloader binary Version 7.00, 7.01 and 7.02 included unused hardcoded credentials. Additionally, a user with physical access to the UR IED can interrupt the boot sequence by rebooting the UR.

    GE UR bootloader binary
  • High 8.0
    CVE-2021-3589

    Missing Authentication for Critical Function in Foreman Ansible

    An authorization flaw was found in Foreman Ansible. An authenticated attacker with certain permissions to create and run Ansible jobs can access hosts through job templates. The highest threat from this vulnerability is to data confidentiality and integrity a…

    foreman_ansible RubyGems
  • High 7.5
    CVE-2022-0635

    Versions affected: BIND 9.18.0 When a vulnerable version of named receives a series of specific queries, the named proc…

    ISC BIND bind9 bind9 Debian Ubuntu
  • High 7.2
    CVE-2022-1033

    Unrestricted Upload of File with Dangerous Type in crater-invoice/crater

    Unrestricted Upload of File with Dangerous Type in GitHub repository crater-invoice/crater prior to 6.0.6.

    crater-invoice crater-invoice/crater