Skip to content
OpenAdvisories

Archive

March 2022

Vulnerabilities first published in this month (UTC), newest first.

← February 2022 2022 / March April 2022 →
  1. 157
  2. 277
  3. 351
  4. 456
  5. 56
  6. 612
  7. 7128
  8. 874
  9. 9184
  10. 1042
  11. 1189
  12. 1210
  13. 138
  14. 1494
  15. 1597
  16. 16151
  17. 1753
  18. 18160
  19. 193
  20. 2013
  21. 2163
  22. 2223
  23. 23110
  24. 2431
  25. 2577
  26. 2613
  27. 279
  28. 28113
  29. 29105
  30. 30131
  31. 3145
All Critical High Medium Low Exploited only Public exploit

18 results · Clear filters · Feed

  • Critical 9.8
    CVE-2021-26599 Public exploit Scanner template EPSS 21%

    SQL Injection in ImpressCMS

    ImpressCMS before 1.4.3 allows include/findusers.php groups SQL Injection.

    impresscms/impresscms Packagist
  • Critical 9.8
    CVE-2022-1040 Exploited Public exploit Scanner template EPSS 100%

    An authentication bypass vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Soph…

    Sophos Sophos Firewall Network devices
    KEV Mar 31, 2022
  • Critical 10.0
    CVE-2021-27460 Public exploit

    Rockwell Automation FactoryTalk AssetCentre Deserialization of Untrusted Data

    Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier components contain .NET remoting endpoints that deserialize untrusted data without sufficiently verifying that the resulting data will be valid. This vulnerability may allow a remote, unauthentica…

    Rockwell Automation FactoryTalk® AssetCentre ICS / OT
  • Critical 9.8
    CVE-2022-26265 Public exploit EPSS 30%

    Remote Code Execution in Contao Managed Edition

    Contao Managed Edition v1.5.0 was discovered to contain a remote command execution (RCE) vulnerability via the component php_cli parameter.

    contao/managed-edition Packagist
  • Critical 9.8
    CVE-2022-24637 Public exploit Scanner template EPSS 99%

    Improper Privilege Management in Open Web Analytics

    Open Web Analytics (OWA) before 1.7.4 allows an unauthenticated remote attacker to obtain sensitive user information, which can be used to gain admin privileges by leveraging cache hashes. This occurs because files generated with '<?php (instead of the intend…

    open-web-analytics/open-web-analytics Packagist
  • Critical 9.8
    CVE-2021-44906 Public exploit

    Prototype Pollution in minimist

    Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).

    js-jquery node-minimist node-minimist minimist Debian Ubuntu Azure Linux npm
  • Critical 9.8
    CVE-2022-23812 Public exploit

    Malicious Package

    This affects the package node-ipc from 10.1.1 and before 10.1.3. This package contains malicious code, that targets users with IP located in Russia or Belarus, and overwrites their files with a heart emoji. **Note**: from versions 11.0.0 onwards, instead of h…

    node-ipc npm
  • Critical 9.1
    CVE-2022-0944 Public exploit

    Template injection in connection test endpoint leads to RCE in sqlpad/sqlpad

    Template injection in connection test endpoint leads to RCE in GitHub repository sqlpad/sqlpad prior to 6.10.1.

    sqlpad sqlpad/sqlpad
  • Critical 9.8
    CVE-2021-42171 Public exploit

    Unrestricted Upload of File with Dangerous Type in Zenario CMS

    Zenario CMS 9.0.54156 is vulnerable to File Upload. The web server can be compromised by uploading and executing a web-shell which can run commands, browse system files, browse local resources, attack other servers, and exploit the local vulnerabilities, and …

    tribalsystems/zenario Packagist
  • Critical 10.0
    CVE-2022-24760 Public exploit EPSS 49%

    Command Injection in Parse server

    Parse Server is an open source http web server backend. In versions prior to 4.10.7 there is a Remote Code Execution (RCE) vulnerability in Parse Server. This vulnerability affects Parse Server in the default configuration with MongoDB. The main weakness that…

    parse-community parse-server parse-server npm
  • Critical 9.1
    CVE-2022-0482 Public exploit Scanner template EPSS 44%

    Exposure of Private Personal Information to an Unauthorized Actor in alextselegidis/easyappointments

    Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository alextselegidis/easyappointments prior to 1.4.3.

    Alex Tselegidis alextselegidis/easyappointments alextselegidis/easyappointments Packagist
  • Critical 9.8
    CVE-2021-4045 Public exploit EPSS 72%

    TP-LINK Tapo C200 remote code execution vulnerability

    TP-Link Tapo C200 IP camera, on its 1.1.15 firmware version and below, is affected by an unauthenticated RCE vulnerability, present in the uhttpd binary running by default as root. The exploitation of this vulnerability allows an attacker to take full control…

    TP-Link Systems Tapo C200 Network devices
  • Critical 9.8
    CVE-2021-46704 Public exploit Scanner template EPSS 22%

    OS Command Injection in GenieACS

    In GenieACS 1.2.x before 1.2.8, the UI interface API is vulnerable to unauthenticated OS command injection via the ping host argument (lib/ui/api.ts and lib/ping.ts). The vulnerability arises from insufficient input validation combined with a missing authoriz…

    genieacs npm
  • Critical 9.8
    CVE-2021-46703 Public exploit

    Code injection in RazorEngine

    In the IsolatedRazorEngine component of Antaris RazorEngine through 4.5.1-alpha001, an attacker can execute arbitrary .NET code in a sandboxed environment (if users can externally control template contents). NOTE: This vulnerability only affects products that…

    RazorEngine NuGet
  • Critical 9.8
    CVE-2022-26318 Exploited Public exploit EPSS 78%

    On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code, aka FBX-22786. This vulne…

    KEV Mar 25, 2022
  • Critical 10.0
    CVE-2022-0848 Public exploit EPSS 35%

    OS Command Injection in part-db/part-db

    OS Command Injection in GitHub repository part-db/part-db prior to 0.5.11.

    Part-DB part-db/part-db
  • Critical 10.0
    CVE-2022-22947 Exploited Public exploit Scanner template EPSS 98%

    Spring Cloud Gateway vulnerable to Code Injection when Gateway Actuator endpoint enabled, exposed, unsecured

    In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could al…

    org.springframework.cloud:spring-cloud-gateway Maven
    KEV May 16, 2022
  • Critical 9.8
    CVE-2021-4039 Public exploit EPSS 71%

    A command injection vulnerability in the web interface of the Zyxel NWA-1100-NH firmware could allow an attacker to exe…

    Zyxel NWA1100-NH firmware Network devices