Skip to content
OpenAdvisories

Archive

21 April 2022

Vulnerabilities first published on this day (UTC), newest first.

← March 2022 2022 / April /21 May 2022 →
  1. 1104
  2. 24
  3. 325
  4. 4107
  5. 5122
  6. 659
  7. 746
  8. 859
  9. 97
  10. 1039
  11. 11189
  12. 12166
  13. 1351
  14. 14110
  15. 15234
  16. 165
  17. 172
  18. 1898
  19. 19131
  20. 2044
  21. 21106
  22. 2248
  23. 231
  24. 244
  25. 2579
  26. 2636
  27. 2764
  28. 2860
  29. 2952
  30. 306
All Critical High Medium Low Exploited only Public exploit

12 results · Clear filters · Feed

  • High 7.5
    CVE-2022-28366

    Denial of service in HtmlUnit-Neko

    Certain Neko-related HTML parsers allow a denial of service via crafted Processing Instruction (PI) input that causes excessive heap memory consumption. In particular, this issue exists in HtmlUnit-Neko through 2.26, and is fixed in 2.27. This issue also exis…

    libowasp-antisamy-java libowasp-antisamy-java net.sourceforge.htmlunit:neko-htmlunit Debian Ubuntu Maven
  • High 8.2
    CVE-2022-26856

    Dell EMC Repository Manager version 3.4.0 contains a plain-text password storage vulnerability. A local attacker could …

    Dell Dell Repository Manager (DRM)
  • High 7.5
    CVE-2022-24424

    Dell EMC AppSync versions from 3.9 to 4.3 contain a path traversal vulnerability in AppSync server. A remote unauthenti…

    Dell AppSync
  • High 7.5
    CVE-2022-20773

    Cisco Umbrella Virtual Appliance Static SSH Host Key Vulnerability

    A vulnerability in the key-based SSH authentication mechanism of Cisco Umbrella Virtual Appliance (VA) could allow an unauthenticated, remote attacker to impersonate a VA. This vulnerability is due to the presence of a static SSH host key. An attacker could e…

    Cisco Cisco Umbrella Insights Virtual Appliance Network devices
  • High 7.8
    CVE-2022-20732

    Cisco Virtualized Infrastructure Manager Privilege Escalation Vulnerability

    A vulnerability in the configuration file protections of Cisco Virtualized Infrastructure Manager (VIM) could allow an authenticated, local attacker to access confidential information and elevate privileges on an affected device. This vulnerability is due to …

    Cisco Cisco Virtualized Infrastructure Manager Network devices
  • High 7.5
    CVE-2022-20783

    Cisco TelePresence Collaboration Endpoint and RoomOS Software H.323 Denial of Service Vulnerability

    A vulnerability in the packet processing functionality of Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. Thi…

    Cisco Cisco RoomOS Software Network devices
  • High 7.3
    CVE-2022-24868

    Cross site scripting via SVG file upload in GLPI

    GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions prior to 10.0.0 one can exploit a lack of sanitization on SVG file uploads and inject javascript into their…

    GLPI glpi
  • High 7.5
    CVE-2022-24867

    LDAP password exposure in glpi

    GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. When you pass the config to the javascript, some entries are filtered out. The variable ldap_pass is not filtered and w…

    GLPI glpi
  • High 8.7
    CVE-2022-24870

    Stored Cross-site Scripting in Combodo iTop

    Combodo iTop is a web based IT Service Management tool. In 3.0.0 beta releases prior to 3.0.0 beta3 a malicious script can be injected in tooltips using iTop customization mechanism. This provides a stored cross site scripting attack vector to authorized user…

    Combodo iTop
  • High 7.3
    CVE-2022-0272

    Improper Restriction of XML External Entity Reference in detekt/detekt

    Improper Restriction of XML External Entity Reference in GitHub repository detekt/detekt prior to 1.20.0.

    detekt detekt/detekt io.gitlab.arturbosch.detekt:detekt-core Maven
  • High 8.1
    CVE-2022-1022

    Cross-site Scripting (XSS) - Stored in chatwoot/chatwoot

    Cross-site Scripting (XSS) - Stored in GitHub repository chatwoot/chatwoot prior to 2.5.0.

    chatwoot chatwoot/chatwoot
  • High 7.5
    CVE-2022-29498

    SQL injection in blazer

    Blazer before 2.6.0 allows SQL Injection. In certain circumstances, an attacker could get a user to run a query they would not have normally run.

    blazer RubyGems