Skip to content
OpenAdvisories

Archive

18 April 2022

Vulnerabilities first published on this day (UTC), newest first.

← March 2022 2022 / April /18 May 2022 →
  1. 1104
  2. 24
  3. 325
  4. 4107
  5. 5122
  6. 659
  7. 746
  8. 859
  9. 97
  10. 1039
  11. 11189
  12. 12166
  13. 1351
  14. 14110
  15. 15234
  16. 165
  17. 172
  18. 1898
  19. 19131
  20. 2044
  21. 21106
  22. 2248
  23. 231
  24. 244
  25. 2579
  26. 2636
  27. 2764
  28. 2860
  29. 2952
  30. 306
All Critical High Medium Low Exploited only Public exploit

13 results · Clear filters · Feed

  • Medium 6.5
    CVE-2022-24841

    Improper Authorization in github.com/fleetdm/fleet

    fleetdm/fleet is an open source device management, built on osquery. All versions of fleet making use of the teams feature are affected by this authorization bypass issue. Fleet instances without teams, or with teams but without restricted team accounts are n…

    fleetdm fleet fleet Ubuntu
  • Medium 6.1
    CVE-2022-1091

    Safe SVG < 1.9.10 - SVG Sanitisation Bypass

    The sanitisation step of the Safe SVG WordPress plugin before 1.9.10 can be bypassed by spoofing the content-type in the POST request to upload a file. Exploiting this vulnerability, an attacker will be able to perform the kinds of attacks that this plugin sh…

    darylldoyle/safe-svg Web / CMS Packagist
  • Medium 4.9
    CVE-2020-25167

    OSIsoft PI Vision Incorrect Authorization

    OSIsoft PI Vision 2020 versions prior to 3.5.0 could disclose information to a user with insufficient privileges for an AF attribute.

    OSIsoft PI Vision
  • Medium 4.3
    CVE-2021-3503

    Metrics exposure in Wildfly

    A flaw was found in Wildfly where insufficient RBAC restrictions may lead to expose metrics data. The highest threat from this vulnerability is to the confidentiality.

    org.wildfly:wildfly-metrics Maven
  • Medium 4.8
    CVE-2022-27853

    WordPress Contest Gallery plugin <= 13.1.0.9 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

    Authenticated (author or higher role) Stored Cross-Site Scripting (XSS) in Contest Gallery (WordPress plugin) <= 13.1.0.9

    contest-gallery Contest Gallery (WordPress plugin) Web / CMS
  • Medium 5.7
    CVE-2021-23286

    Security issues in Eaton Intelligent Power Manager Infrastructure

    Eaton Intelligent Power Manager Infrastructure (IPM Infrastructure) version 1.5.0plus205 and all prior versions are vulnerable to CSV Formula Injection. This issue affects: Eaton Intelligent Power Manager Infrastructure (IPM Infrastructure) all version 1.5.0p…

    Eaton Intelligent Power Manager Infrastructure (IPM Infrastructure)
  • Medium 5.7
    CVE-2021-23284

    Security issues in Eaton Intelligent Power Manager Infrastructure

    Eaton Intelligent Power Manager Infrastructure (IPM Infrastructure) version 1.5.0plus205 and all prior versions are vulnerable to Stored Cross-site Scripting vulnerability. This issue affects: Eaton Intelligent Power Manager Infrastructure (IPM Infrastructure…

    Eaton Intelligent Power Manager Infrastructure (IPM Infrastructure)
  • Medium 6.5
    CVE-2022-23975

    WordPress Access Demo Importer plugin <= 1.0.7 - Cross-Site Request Forgery (CSRF) vulnerability leading to Arbitrary Plugin Activation

    Cross-Site Request Forgery (CSRF) in Access Demo Importer <= 1.0.7 on WordPress allows an attacker to activate any installed plugin.

    AccessPress Themes Access Demo Importer (WordPress plugin) Web / CMS
  • Medium 4.8
    CVE-2022-27652

    Incorrect Default Permissions in CRI-O

    A flaw was found in cri-o, where containers were incorrectly started with non-empty default permissions. A vulnerability was found in Moby (Docker Engine) where containers started incorrectly with non-empty inheritable Linux process capabilities. This flaw al…

    github.com/cri-o/cri-o Go
  • Medium 5.4
    CVE-2020-13590

    Multiple exploitable SQL injection vulnerabilities exist in the 'entities/fields' page of the Rukovoditel Project Manag…

    Rukovoditel Project Management App
  • Medium 4.3
    CVE-2020-13495

    An exploitable vulnerability exists in the way Pixar OpenUSD 20.05 handles file offsets in binary USD files. A speciall…

    Apple Pixar macOS OpenUSD macOS
  • Medium 6.8
    CVE-2022-28810 Exploited Public exploit EPSS 71%

    Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary…

    KEV Mar 7, 2023
  • Medium 6.2
    CVE-2022-24859

    Manipulated inline images can cause Infinite Loop in PyPDF2

    PyPDF2 is an open source python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. In versions prior to 1.27.5 an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop if the PyPDF2 if …

    py-pdf PyPDF2 pypdf2 pypdf2 Debian Ubuntu PyPI