Skip to content
OpenAdvisories

Archive

22 April 2022

Vulnerabilities first published on this day (UTC), newest first.

← March 2022 2022 / April /22 May 2022 →
  1. 1104
  2. 24
  3. 325
  4. 4107
  5. 5122
  6. 659
  7. 746
  8. 859
  9. 97
  10. 1039
  11. 11189
  12. 12166
  13. 1351
  14. 14110
  15. 15234
  16. 165
  17. 172
  18. 1898
  19. 19131
  20. 2044
  21. 21106
  22. 2248
  23. 231
  24. 244
  25. 2579
  26. 2636
  27. 2764
  28. 2860
  29. 2952
  30. 306
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • High 7.7
    CVE-2022-1427

    Out-of-bounds Read in mrb_obj_is_kind_of in in mruby/mruby

    Out-of-bounds Read in mrb_obj_is_kind_of in in GitHub repository mruby/mruby prior to 3.2. # Impact: Possible arbitrary code execution if being exploited.

    mruby mruby/mruby mruby mruby Debian Ubuntu Alpine
  • High 7.3
    CVE-2022-0354

    A vulnerability was reported in Lenovo System Update that could allow a local user with interactive system access the a…

    Lenovo System Update
  • High 7.3
    CVE-2022-0192

    A DLL search path vulnerability was reported in Lenovo PCManager prior to version 4.0.40.2175 that could allow privileg…

    Lenovo PCManager
  • High —
    GHSA-j35p-q24r-5367

    Dep Group Remote Memory Exhaustion (Denial of Service) in ckb

    ### Impact A remote attacker could exploit this vulnerability to exhaust ckb process memory of an affected node. ### Patches Upgrade to 0.43.1 or later. ### References After resolving the outpoints of one dep group, we put the corresponding content into a vec…

    ckb crates.io
  • High —
    GHSA-3227-r97m-8j95

    Relative Path Traversal in afire serve_static

    ### Impact This vulnerability effects the built-in afire serve_static extension allowing paths containing `//....` to bypass the previous path sanitation and request files in higher directories that should not be accessible. ### Patches The issue has been fix…

    afire crates.io
  • High 8.8
    CVE-2022-27340

    Cross Site Request Forgery in Mingsoft MCMS

    MCMS v5.2.7 contains a Cross-Site Request Forgery (CSRF) via /role/saveOrUpdateRole.do. This vulnerability allows attackers to escalate privileges and modify data.

    net.mingsoft:ms-mcms Maven
  • High 7.1
    CVE-2021-32927

    Uffizio GPS Tracker Cross-site Scripting

    An attacker may be able to inject client-side JavaScript code on multiple instances within all versions of Uffizio GPS Tracker.

    Uffizio GPS Tracker
  • High 7.2
    CVE-2022-1429 EPSS 64%

    SQL injection in GridHelperService.php in pimcore/pimcore

    SQL injection in GridHelperService.php in GitHub repository pimcore/pimcore prior to 10.3.6. This vulnerability is capable of steal the data

    pimcore pimcore/pimcore pimcore/pimcore Packagist
  • High 7.3
    CVE-2022-26672

    ASUS WebStorage - Use of Hard-coded Credentials

    ASUS WebStorage has a hardcoded API Token in the APP source code. An unauthenticated remote attacker can use this token to establish connections with the server and carry out login attempts to general user accounts. A successful login to a general user accoun…

    ASUS WebStorage