Skip to content
OpenAdvisories

Archive

March 2022

Vulnerabilities first published in this month (UTC), newest first.

← February 2022 2022 / March April 2022 →
  1. 157
  2. 277
  3. 351
  4. 456
  5. 56
  6. 612
  7. 7128
  8. 874
  9. 9184
  10. 1042
  11. 1189
  12. 1210
  13. 138
  14. 1494
  15. 1597
  16. 16151
  17. 1753
  18. 18160
  19. 193
  20. 2013
  21. 2163
  22. 2223
  23. 23110
  24. 2431
  25. 2577
  26. 2613
  27. 279
  28. 28113
  29. 29105
  30. 30131
  31. 3145
All Critical High Medium Low Exploited only Public exploit

381 results · Clear filters · Feed

  • Medium 6.2
    CVE-2021-38988

    IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX kerne…

    IBM AIX VIOS
  • Medium 6.1
    CVE-2022-25922

    ICSA-22-063-01 Missing Authentication for Critical Function in Trailer Power Line Communications (PLC) J2497

    Power Line Communications PLC4TRUCKS J2497 trailer brake controllers implement diagnostic functions which can be invoked by replaying J2497 messages. There is no authentication or authorization for these functions.

    Power Line Communications PLC4TRUCKS
  • Medium 6.5
    CVE-2021-32005

    SiteManager Log View XSS Issue

    Cross-site Scripting (XSS) vulnerability in log view of Secomea SiteManager allows a logged in user to store javascript for later execution. This issue affects: Secomea SiteManager Version 9.6.621421014 and all prior versions.

    Secomea SiteManager
  • Medium 5.0
    CVE-2021-32006

    GateManager information leak for LinkManager Users

    This issue affects: Secomea GateManager Version 9.6.621421014 and all prior versions. Permission Issues vulnerability in LinkManager web portal of Secomea GateManager allows logged in LinkManager user to access stored SiteManager backup files.

    Secomea GateManager
  • Medium 6.1
    CVE-2021-4198

    messaging_ipc.dll NULL Pointer Dereference in multiple Bitdefender products (VA-10016)

    A NULL Pointer Dereference vulnerability in the messaging_ipc.dll component as used in Bitdefender Total Security, Internet Security, Antivirus Plus, Endpoint Security Tools, VPN Standalone allows an attacker to arbitrarily crash product processes and generat…

    Bitdefender Total Security Antivirus Plus Internet Security
  • Medium 6.5
    CVE-2022-0766

    Server-Side Request Forgery (SSRF) in janeczku/calibre-web

    Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.17.

    janeczku janeczku/calibre-web calibreweb PyPI
  • Medium 5.5
    CVE-2022-0865

    Reachable Assertion in tiffcp in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. F…

    LibTIFF LibTIFF tiff tiff Debian Ubuntu Azure Linux Alpine
  • Medium 5.4
    CVE-2022-0756

    Missing Authorization in salesagility/suitecrm

    Missing Authorization in GitHub repository salesagility/suitecrm prior to 7.12.5.

    salesagility salesagility/suitecrm
  • Medium 5.5
    CVE-2021-44749

    Universal Cross-Site Scripting Vulnerability in F-Secure SAFE Browser Protection for Android

    A vulnerability affecting F-Secure SAFE browser protection was discovered improper URL handling can be triggered to cause universal cross-site scripting through browsing protection in a SAFE web browser. User interaction is required prior to exploitation. A s…

    F-Secure F-Secure SAFE Browser for Android Version 18.5 Android
  • Medium 5.5
    CVE-2021-44748

    Universal Cross-Site Scripting Vulnerability in F-Secure SAFE Browser for Android

    A vulnerability affecting F-Secure SAFE browser was discovered whereby browsers loads images automatically this vulnerability can be exploited remotely by an attacker to execute the JavaScript can be used to trigger universal cross-site scripting through the …

    F-Secure F-Secure SAFE Browser for Android Version 18.5 Android
  • Medium 4.3
    CVE-2022-0869 Scanner template

    Multiple Open Redirect in nitely/spirit

    Multiple Open Redirect in GitHub repository nitely/spirit prior to 0.12.3.

    nitely nitely/spirit django-spirit PyPI
  • Medium 6.0
    CVE-2021-43590

    Dell EMC Enterprise Storage Analytics for vRealize Operations, versions 4.0.1 to 6.2.1, contain a Plain-text password s…

    Dell Dell EMC Enterprise Storage Analytics for vRealize Operations
  • Medium 4.9
    CVE-2022-26484

    An issue was discovered in Veritas InfoScale Operations Manager (VIOM) before 7.4.2 Patch 600 and 8.x before 8.0.0 Patc…

  • Medium 4.8
    CVE-2022-26483

    An issue was discovered in Veritas InfoScale Operations Manager (VIOM) before 7.4.2 Patch 600 and 8.x before 8.0.0 Patc…

  • Medium 6.1
    CVE-2020-18325 Public exploit

    Cross-site Scripting in intelliants/subrion

    Multilple Cross Site Scripting (XSS) vulnerability exists in Intelliants Subrion CMS v4.2.1 in the Configuration panel.

    intelliants/subrion Packagist
  • Medium 6.1
    CVE-2020-18324 Public exploit

    Cross-site Scripting in Subrion CMS

    Cross Site Scripting (XSS) vulnerability exists in Subrion CMS 4.2.1 via the q parameter in the Kickstart template.

    intelliants/subrion Packagist
  • Medium 4.6
    CVE-2022-0832 EPSS 67%

    Cross-site Scripting (XSS) - Stored in pimcore/pimcore

    Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.3.3.

    pimcore pimcore/pimcore pimcore/pimcore Packagist
  • Medium 4.6
    CVE-2022-0831

    Cross-site Scripting (XSS) - Stored in pimcore/pimcore

    Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.3.3.

    pimcore pimcore/pimcore pimcore/pimcore Packagist
  • Medium 6.6
    CVE-2022-0838

    Cross-site Scripting (XSS) - Reflected in hestiacp/hestiacp

    Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.5.10.

    hestiacp hestiacp/hestiacp
  • Medium 6.1
    CVE-2022-23397 Scanner template

    The Cedar Gate EZ-NET portal 6.5.5 6.8.0 Internet portal has a call to display messages to users which does not properl…

  • Medium 5.5
    CVE-2022-26336

    A carefully crafted TNEF file can cause an out of memory exception

    A shortcoming in the HMEF package of poi-scratchpad (Apache POI) allows an attacker to cause an Out of Memory exception. This package is used to read TNEF files (Microsoft Outlook and Microsoft Exchange Server). If an application uses poi-scratchpad to parse …

    Apache Software Foundation poi-scratchpad lucene-solr libapache-poi-java Ubuntu Maven
  • Medium 4.3
    CVE-2022-23708

    Elasticsearch privilege escalation

    A flaw was discovered in Elasticsearch 7.17.0’s upgrade assistant, in which upgrading from version 6.x to 7.x would disable the in-built protections on the security index, allowing authenticated users with “*” index permissions access to this index.

    Elastic Elasticsearch elasticsearch org.elasticsearch:elasticsearch Ubuntu Maven
  • Medium 6.2
    CVE-2022-24725

    Exposure of home directory through shescape on Unix with Bash

    Shescape is a shell escape package for JavaScript. An issue in versions 1.4.0 to 1.5.1 allows for exposure of the home directory on Unix systems when using Bash with the `escape` or `escapeAll` functions from the _shescape_ API with the `interpolation` option…

    ericcornelissen shescape shescape npm
  • Medium 5.3
    CVE-2022-24723

    Improper Input Validation in URI.js

    URI.js is a Javascript URL mutation library. Before version 1.19.9, whitespace characters are not removed from the beginning of the protocol, so URLs are not parsed properly. This issue has been patched in version 1.19.9. Removing leading whitespace from valu…

    medialize URI.js urijs node-uri-js Ubuntu npm
  • Medium 5.5
    CVE-2021-3602

    Buildah processes using chroot isolation may leak environment values to intermediate processes

    An information disclosure flaw was found in Buildah, when building containers using chroot isolation. Running processes in container builds (e.g. Dockerfile RUN commands) can access environment variables from parent and grandparent processes. When run in a co…

    cri-o buildah podman buildah Debian Ubuntu Azure Linux Alpine Go
  • Medium 5.5
    CVE-2021-3620

    Ansible discloses sensitive information in traceback error message

    A flaw was found in Ansible Engine's ansible-connection module, where sensitive information such as the Ansible user credentials is disclosed by default in the traceback error message. The highest threat from this vulnerability is to confidentiality.

    ansible ansible ansible ansible-core Debian Ubuntu PyPI
  • Medium 6.4
    CVE-2021-45819

    Wordline HIDCCEMonitorSVC before v5.2.4.3 contains an unquoted service path which allows attackers to escalate privileg…

  • Medium 6.5
    CVE-2022-0528

    Server-Side Request Forgery (SSRF) in transloadit/uppy

    Server-Side Request Forgery (SSRF) in GitHub repository transloadit/uppy prior to 3.3.1.

    transloadit transloadit/uppy @uppy/companion npm
  • Medium 5.4
    CVE-2022-24563

    Cross-site Scripting in GeniXCMS

    In Genixcms v1.1.11, a stored Cross-Site Scripting (XSS) vulnerability exists in /gxadmin/index.php?page=themes&view=options" via the intro_title and intro_image parameters.

    genix/cms Packagist
  • Medium 5.3
    CVE-2022-25146

    Liferay Portal and Liferay DXP fails to check origin of event messages

    The Remote App module in Liferay Portal Liferay Portal v7.4.3.4 through v7.4.3.8 and Liferay DXP 7.4 before update 5 does not check if the origin of event messages it receives matches the origin of the Remote App, allowing attackers to exfiltrate the CSRF tok…

    com.liferay.portal:release.dxp.bom com.liferay:com.liferay.remote.app.web Maven
  • Medium 5.4
    CVE-2021-38269

    Liferay Portal and Liferay DXP vulnerable to cross-site scripting (XSS) in the Gogo Shell module

    Cross-site scripting (XSS) vulnerability in the Gogo Shell module in Liferay Portal 7.1.0 through 7.3.6 and 7.4.0, and Liferay DXP 7.1 before fix pack 23, 7.2 before fix pack 13, and 7.3 before fix pack 2 allows remote attackers to inject arbitrary web script…

    com.liferay.portal:release.dxp.bom com.liferay:com.liferay.gogo.shell.web Maven
  • Medium 5.4
    CVE-2021-38267

    Liferay Portal and Liferay DXP vulnerable to cross-site scripting (XSS) in edit blog entry page

    Cross-site scripting (XSS) vulnerability in the Blogs module's edit blog entry page in Liferay Portal 7.3.2 through 7.3.6, and Liferay DXP 7.3 before fix pack 2 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_blogs_web_port…

    com.liferay.portal:release.portal.bom com.liferay.portal:release.dxp.bom com.liferay:com.liferay.frontend.js.web Maven
  • Medium 6.1
    CVE-2021-38263

    Liferay Portal and Liferay DXP cross-site scripting (XSS) vulnerability via the script console

    Cross-site scripting (XSS) vulnerability in the Server module's script console in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 101, 7.1 before fix pack 20 and 7.2 before fix pack 10 allows remote attackers to inject arbitrary web scri…

    com.liferay.portal:release.dxp.bom com.liferay:com.liferay.server.admin.web Maven
  • Medium 6.1
    CVE-2021-38264

    Liferay Portal vulnerable to cross-site scripting (XSS) via the keywords parameter

    Cross-site scripting (XSS) vulnerability in the Frontend Taglib module in Liferay Portal 7.4.0 and 7.4.1 allows remote attackers to inject arbitrary web script or HTML into the management toolbar search via the `keywords` parameter. This issue is caused by an…

    com.liferay:com.liferay.frontend.taglib.clay Maven
  • Medium 5.4
    CVE-2021-38265

    Liferay Portal and Liferay DXP vulnerable to cross-site scripting (XSS)

    Cross-site scripting (XSS) vulnerability in the Asset module in Liferay Portal 7.3.4 through 7.3.6 allow remote attackers to inject arbitrary web script or HTML when creating a collection page via the _com_liferay_asset_list_web_portlet_AssetListPortlet_title…

    com.liferay.portal:release.dxp.bom com.liferay:com.liferay.layout.admin.web Maven
  • Medium 6.5
    CVE-2021-3658

    bluetoothd from bluez incorrectly saves adapters' Discoverable status when a device is powered down, and restores it wh…

    bluez bluez Debian Ubuntu
  • Medium 4.3
    CVE-2021-45074

    JFrog Artifactory before 7.29.3 and 6.23.38, is vulnerable to Broken Access Control, a low-privileged user is able to d…

    jfrog JFrog Artifactory
  • Medium 5.6
    CVE-2022-0675

    Puppet Firewall Module May Leave Unmanaged Rules

    In certain situations it is possible for an unmanaged rule to exist on the target system that has the same comment as the rule specified in the manifest. This could allow for unmanaged rules to exist on the target system and leave the system in an unsafe stat…

    Puppet Firewall Module puppet-module-puppetlabs-firewall puppet-module-puppetlabs-firewall Debian Ubuntu
  • Medium 4.6
    CVE-2022-23656

    Cross-site scripting vulnerability in Zulip Server

    Zulip is an open source team chat app. The `main` development branch of Zulip Server from June 2021 and later is vulnerable to a cross-site scripting vulnerability on the recent topics page. An attacker could maliciously craft a full name for their account an…

    zulip zulip
  • Medium 6.5
    CVE-2021-38268

    Liferay Portal and Liferay DXP has incorrect default permissions for site members

    The Dynamic Data Mapping module in Liferay Portal 7.0.0 through 7.3.6, and Liferay DXP 7.0 before fix pack 101, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 2 incorrectly sets default permissions for site members, which allows remote…

    com.liferay.portal:release.dxp.bom com.liferay:com.liferay.dynamic.data.mapping.service Maven