Skip to content
OpenAdvisories

Archive

25 April 2022

Vulnerabilities first published on this day (UTC), newest first.

← March 2022 2022 / April /25 May 2022 →
  1. 1104
  2. 24
  3. 325
  4. 4107
  5. 5122
  6. 659
  7. 746
  8. 859
  9. 97
  10. 1039
  11. 11189
  12. 12166
  13. 1351
  14. 14110
  15. 15234
  16. 165
  17. 172
  18. 1898
  19. 19131
  20. 2044
  21. 21106
  22. 2248
  23. 231
  24. 244
  25. 2579
  26. 2636
  27. 2764
  28. 2860
  29. 2952
  30. 306
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • High 7.5
    CVE-2021-35250 Public exploit Scanner template EPSS 13%

    Directory Transversal Vulnerability in Serv-U 15.3

    A researcher reported a Directory Transversal Vulnerability in Serv-U 15.3. This may allow access to files relating to the Serv-U installation and server files. This issue has been resolved in Serv-U 15.3 Hotfix 1.

    SolarWinds Serv-U
  • Unscored —
    CVE-2021-25094 Public exploit Scanner template EPSS 83%

    Tatsu < 3.3.12 - Unauthenticated RCE

    The Tatsu WordPress plugin before 3.3.12 add_custom_font action can be used without prior authentication to upload a rogue zip file which is uncompressed under the WordPress's upload directory. By adding a PHP shell with a filename starting with a dot ".", th…

    Web / CMS
  • Critical 9.8
    CVE-2022-29078 Public exploit Scanner template EPSS 33%

    ejs template injection vulnerability

    The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS …

    node-ejs ejs node-ejs Debian Ubuntu npm
  • Unscored —
    CVE-2021-36460 Public exploit

    VeryFitPro (com.veryfit2hr.second) 3.2.8 hashes the account's password locally on the device and uses the hash to authe…

  • High 7.5
    CVE-2022-23457 Public exploit

    Path Traversal in ESAPI

    ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Prior to version 2.3.0.0, the default implementation of `Validator.getValidDirectoryPath(String, String, File, boolean)` may incorrectly treat the test…

    OWASP ESAPI org.owasp.esapi:esapi org.owasp.esapi:esapi libowasp-esapi-java Debian Ubuntu Maven
  • Unscored —
    CVE-2021-45837 Public exploit EPSS 16%

    It is possible to execute arbitrary commands as root in Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517) by sen…

  • Unscored —
    CVE-2021-45841 Public exploit

    In Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517), an attacker can self-sign session cookies by knowing the t…

  • Unscored —
    CVE-2021-45839 Public exploit

    It is possible to obtain the first administrator's hash set up on the system in Terramaster F4-210, F2-210 TOS 4.2.X (4…