Skip to content
OpenAdvisories

Archive

March 2022

Vulnerabilities first published in this month (UTC), newest first.

← February 2022 2022 / March April 2022 →
  1. 157
  2. 277
  3. 351
  4. 456
  5. 56
  6. 612
  7. 7128
  8. 874
  9. 9184
  10. 1042
  11. 1189
  12. 1210
  13. 138
  14. 1494
  15. 1597
  16. 16151
  17. 1753
  18. 18160
  19. 193
  20. 2013
  21. 2163
  22. 2223
  23. 23110
  24. 2431
  25. 2577
  26. 2613
  27. 279
  28. 28113
  29. 29105
  30. 30131
  31. 3145
All Critical High Medium Low Exploited only Public exploit

2,085 results · Feed

  • High 7.3
    CVE-2022-1031

    Use After Free in op_is_set_bp in radareorg/radare2

    Use After Free in op_is_set_bp in GitHub repository radareorg/radare2 prior to 5.6.6.

    radareorg radareorg/radare2 radare2 radare2 Ubuntu Alpine
  • High —
    GHSA-5w9c-rv96-fr7g

    Removal of functional code in faker.js

    Faker.js helps users create large amounts of data for testing and development. The maintainer deliberately removed the functional code from this package. This appears to be a purposeful and successful attempt to make the package unusable. This is related to t…

    faker npm
  • Critical 9.8
    CVE-2022-26260

    Prototype Pollution in simple-plist

    Simple-Plist v1.3.0 was discovered to contain a prototype pollution vulnerability via .parse().

    simple-plist npm
  • Unscored —
    CVE-2022-27228 Scanner template EPSS 21%

    In the vote (aka "Polls, Votes") module before 21.0.100 of Bitrix Site Manager, a remote unauthenticated attacker can e…

  • Unscored —
    CVE-2021-41736

    Faust v2.35.0 was discovered to contain a heap-buffer overflow in the function realPropagate() at propagate.cpp.

    faust faust Debian Ubuntu
  • Unscored —
    CVE-2022-25484

    tcpprep v4.4.1 has a reachable assertion (assert(l2len > 0)) in packet2tree() at tree.c in tcpprep v4.4.1.

    tcpreplay Debian
  • High 7.1
    CVE-2022-24774

    Improper Input Validation leading to Path Traversal in CycloneDX BOM Repository Server

    CycloneDX BOM Repository Server is a bill of materials (BOM) repository server for distributing CycloneDX BOMs. CycloneDX BOM Repository Server before version 2.0.1 has an improper input validation vulnerability leading to path traversal. A malicious user may…

    CycloneDX cyclonedx-bom-repo-server
  • Low 3.4
    CVE-2022-21718

    Renderers can obtain access to random bluetooth device without permission in Electron

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. A vulnerability in versions prior to `17.0.0-alpha.6`, `16.0.6`, `15.3.5`, `14.2.4`, and `13.6.6` allows renderers to obtain access to a bluetooth device v…

    electron electron electron npm
  • Unscored —
    CVE-2021-43650 Public exploit

    WebRun 3.6.0.42 is vulnerable to SQL Injection via the P_0 parameter used to set the username during the login process.

  • Medium 5.3
    CVE-2022-1036

    Able to create an account with long password leads to memory corruption / Integer Overflow in microweber/microweber

    Able to create an account with long password leads to memory corruption / Integer Overflow in GitHub repository microweber/microweber prior to 1.2.12.

    microweber microweber/microweber microweber/microweber Packagist
  • Unscored —
    RUSTSEC-2022-0015

    pty is unmaintained

    The repository hasn't received any updates since Jun 25, 2017 and the author is unresponsive. Maintained alternatives include: * [`tokio-pty-process`](https://crates.io/crates/tokio-pty-process) * [`pty-process`](https://crates.io/crates/pty-process)

    pty crates.io
  • High 7.5
    CVE-2022-0667

    Assertion failure on delayed DS lookup

    When the vulnerability is triggered the BIND process will exit. BIND 9.18.0

    ISC BIND bind9 bind9 Debian Ubuntu
  • Unscored —
    CVE-2021-45809

    GlobalProtect-openconnect versions prior to 1.4.3 are affected by incorrect access control in GPService through DBUS, G…

  • Critical 9.1
    CVE-2022-1034

    There is a Unrestricted Upload of File vulnerability in ShowDoc v2.10.3 in star7th/showdoc

    There is a Unrestricted Upload of File vulnerability in ShowDoc v2.10.3 in GitHub repository star7th/showdoc prior to 2.10.4.

    star7th star7th/showdoc showdoc/showdoc Packagist
  • High 7.5
    CVE-2022-24764

    Stack buffer overflow in pjproject

    PJSIP is a free and open source multimedia communication library written in C. Versions 2.12 and prior contain a stack buffer overflow vulnerability that affects PJSUA2 users or users that call the API `pjmedia_sdp_print(), pjmedia_sdp_media_print()`. Applica…

    pjsip pjproject asterisk pjproject Debian Ubuntu Alpine
  • Unscored —
    CVE-2022-25517

    MyBatis plus v3.4.3 was discovered to contain a SQL injection vulnerability via the Column parameter in /core/condition…

  • Unscored —
    CVE-2021-45810

    GlobalProtect-openconnect versions prior to 2.0.0 (exclusive) are affected by incorrect access control in GPService thr…

  • Low 3.3
    CVE-2022-0652

    Confd log files contain local users', including root’s, SHA512crypt password hashes with insecure access permissions. T…

    Sophos Sophos UTM Network devices
  • High 8.8
    CVE-2022-0386

    A post-auth SQL injection vulnerability in the Mail Manager potentially allows an authenticated attacker to execute cod…

    Sophos Sophos UTM Network devices
  • Unscored —
    CVE-2022-26285

    Simple Subscription Website v1.0 was discovered to contain a SQL injection vulnerability via the id parameter in the ap…

  • Unscored —
    CVE-2022-26284

    Simple Client Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter in th…

  • Unscored —
    CVE-2022-26283

    Simple Subscription Website v1.0 was discovered to contain a SQL injection vulnerability via the id parameter in the vi…

  • Unscored —
    CVE-2022-27607

    Bento4 1.6.0-639 has a heap-based buffer over-read in the AP4_HvccAtom class, a different issue than CVE-2018-14531.

    kodi-inputstream-adaptive Ubuntu
  • Unscored —
    CVE-2022-26174

    A remote code execution (RCE) vulnerability in Beekeeper Studio v3.2.0 allows attackers to execute arbitrary code via a…

  • Unscored —
    CVE-2022-27333

    idcCMS v1.10 was discovered to contain an issue which allows attackers to arbitrarily delete the install.lock file, res…

  • Unscored —
    CVE-2022-27090

    Cscms Music Portal System v4.2 was discovered to contain a redirection vulnerability via the backurl parameter.

  • Unscored —
    CVE-2021-40662

    A Cross-Site Request Forgery (CSRF) in Chamilo LMS 1.11.14 allows attackers to execute arbitrary commands on victim hos…

  • Unscored —
    CVE-2021-38745

    Chamilo LMS v1.11.14 was discovered to contain a zero click code injection vulnerability which allows attackers to exec…

  • Unscored —
    CVE-2021-46390

    An access control issue in the authentication module of Lexar_F35 v1.0.34 allows attackers to access sensitive data and…

  • Unscored —
    CVE-2022-26148 Scanner template EPSS 53%

    An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix. The Zabbix password can be found in the …

    grafana Ubuntu
  • Unscored —
    CVE-2022-23345

    BigAnt Software BigAnt Server v5.6.06 was discovered to contain incorrect access control.

  • Unscored —
    CVE-2022-23346

    BigAnt Software BigAnt Server v5.6.06 was discovered to contain incorrect access control issues.

  • Unscored —
    CVE-2022-23352

    An issue in BigAnt Software BigAnt Server v5.6.06 can lead to a Denial of Service (DoS).

  • Unscored —
    CVE-2022-23348 Scanner template

    BigAnt Software BigAnt Server v5.6.06 was discovered to utilize weak password hashes.

  • Unscored —
    CVE-2022-23350

    BigAnt Software BigAnt Server v5.6.06 was discovered to contain a cross-site scripting (XSS) vulnerability.

  • Unscored —
    CVE-2022-23349

    BigAnt Software BigAnt Server v5.6.06 was discovered to contain a Cross-Site Request Forgery (CSRF).

  • Unscored —
    CVE-2022-23347 Scanner template EPSS 13%

    BigAnt Software BigAnt Server v5.6.06 was discovered to be vulnerable to directory traversal attacks.

  • High 7.5
    CVE-2022-24775

    Improper Input Validation in guzzlehttp/psr7

    guzzlehttp/psr7 is a PSR-7 HTTP message library. Versions prior to 1.8.4 and 2.1.1 are vulnerable to improper header parsing. An attacker could sneak in a new line character and pass untrusted values. The issue is patched in 1.8.4 and 2.1.1. There are current…

    guzzle psr7 drupal/core guzzlehttp/psr7 Debian Ubuntu Packagist
  • Unscored —
    CVE-2022-0760 Scanner template EPSS 11%

    Simple Link Directory < 7.7.2 - Unauthenticated SQL injection

    The Simple Link Directory WordPress plugin before 7.7.2 does not validate and escape the post_id parameter before using it in a SQL statement via the qcopd_upvote_action AJAX action (available to unauthenticated and authenticated users), leading to an unauthe…

    Web / CMS
  • Unscored —
    CVE-2022-0747 Scanner template EPSS 15%

    Infographic Maker - iList < 4.3.8 - Unauthenticated SQL Injection

    The Infographic Maker WordPress plugin before 4.3.8 does not validate and escape the post_id parameter before using it in a SQL statement via the qcld_upvote_action AJAX action (available to unauthenticated and authenticated users), leading to an unauthentica…

    Web / CMS