Skip to content
OpenAdvisories

Archive

13 April 2022

Vulnerabilities first published on this day (UTC), newest first.

← March 2022 2022 / April /13 May 2022 →
  1. 1104
  2. 24
  3. 325
  4. 4107
  5. 5122
  6. 659
  7. 746
  8. 859
  9. 97
  10. 1039
  11. 11189
  12. 12166
  13. 1351
  14. 14110
  15. 15234
  16. 165
  17. 172
  18. 1898
  19. 19131
  20. 2044
  21. 21106
  22. 2248
  23. 231
  24. 244
  25. 2579
  26. 2636
  27. 2764
  28. 2860
  29. 2952
  30. 306
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Medium 5.9
    CVE-2022-0023

    PAN-OS: Denial-of-Service (DoS) Vulnerability in DNS Proxy

    An improper handling of exceptional conditions vulnerability exists in the DNS proxy feature of Palo Alto Networks PAN-OS software that enables a meddler-in-the-middle (MITM) to send specifically crafted traffic to the firewall that causes the service to rest…

    Palo Alto Networks PAN-OS Prisma Access Network devices
  • Medium 5.3
    CVE-2021-41119

    DoS vulnerabiliity in wire-server json parser

    Wire-server is the system server for the wire back-end services. Releases prior to v2022-03-01 are subject to a denial of service attack via a crafted object causing a hash collision. This collision causes the server to spend at least quadratic time parsing i…

    wireapp wire-server haskell-aeson Ubuntu
  • Medium 4.3
    CVE-2022-1332

    Restricted custom admin role can bypass the restrictions and view the server logs and server config.json file contents

    One of the API in Mattermost version 6.4.1 and earlier fails to properly protect the permissions, which allows the authenticated members with restricted custom admin role to bypass the restrictions and view the server logs and server config.json file contents.

    Mattermost Mattermost github.com/mattermost/mattermost-server github.com/mattermost/mattermost-server/v6 Go
  • Medium 4.3
    CVE-2022-1337

    OOM DoS in Mattermost image proxy

    The image proxy component in Mattermost version 6.4.1 and earlier allocates memory for multiple copies of a proxied image, which allows an authenticated attacker to crash the server via links to very large image files.

    Mattermost Mattermost github.com/mattermost/mattermost-server github.com/mattermost/mattermost-server/v6 Go
  • Medium 4.3
    CVE-2022-27846

    WordPress Yoo Slider plugin <= 2.0.0 - Cross-Site Request Forgery (CSRF) vulnerability leading to Slider Creation / Modification

    Cross-Site Request Forgery (CSRF) vulnerability in Yooslider Yoo Slider <= 2.0.0 on WordPress allows attackers to create or modify slider.

    Yooslider Yoo Slider – Image Slider & Video Slider (WordPress plugin) Web / CMS
  • Medium 4.3
    CVE-2022-27847

    WordPress Yoo Slider plugin <= 2.0.0 - Cross-Site Request Forgery (CSRF) vulnerability leading to Template Import

    Cross-Site Request Forgery (CSRF) vulnerability in Yooslider Yoo Slider <= 2.0.0 on WordPress allows attackers to import templates.

    Yooslider Yoo Slider – Image Slider & Video Slider (WordPress plugin) Web / CMS
  • Medium 6.1
    CVE-2022-26144

    MantisBT vulnerable to XSS due to improper escape in manage_plugin_page.php and manage_plugin_uninstall.php

    An XSS issue was discovered in MantisBT before 2.25.3. Improper escaping of a Plugin name allows execution of arbitrary code (if CSP allows it) in manage_plugin_page.php and manage_plugin_uninstall.php when a crafted plugin is installed.

    mantisbt/mantisbt Packagist
  • Medium 6.1
    CVE-2020-29653

    HTML Injection in Froxlor

    Froxlor through 0.10.22 does not perform validation on user input passed in the customermail GET parameter. The value of this parameter is reflected in the login webpage, allowing the injection of arbitrary HTML tags.

    froxlor/froxlor Packagist