Skip to content
OpenAdvisories

Archive

26 April 2022

Vulnerabilities first published on this day (UTC), newest first.

← March 2022 2022 / April /26 May 2022 →
  1. 1104
  2. 24
  3. 325
  4. 4107
  5. 5122
  6. 659
  7. 746
  8. 859
  9. 97
  10. 1039
  11. 11189
  12. 12166
  13. 1351
  14. 14110
  15. 15234
  16. 165
  17. 172
  18. 1898
  19. 19131
  20. 2044
  21. 21106
  22. 2248
  23. 231
  24. 244
  25. 2579
  26. 2636
  27. 2764
  28. 2860
  29. 2952
  30. 306
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Medium 5.5
    CVE-2022-27888

    The Foundry Issues service was found to be logging in a manner that captured session tokens.

    Foundry Issues service versions 2.244.0 to 2.249.0 was found to be logging in a manner that captured sensitive information (session tokens). This issue was fixed in 2.249.1.

    Palantir Foundry Issues
  • Medium 4.3
    CVE-2022-24866

    Exposure of Sensitive Information to an Unauthorized Actor in Discourse Assign

    Discourse Assign is a plugin for assigning users to a topic in Discourse, an open-source messaging platform. Prior to version 1.0.1, the UserBookmarkSerializer serialized the whole User / Group object, which leaked some private information. The data was only …

    Discourse discourse-assign
  • Medium 5.4
    CVE-2022-27854

    WordPress Psychological tests & quizzes plugin <= 0.21.19 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

    Stored Cross-Site Scripting (XSS) vulnerability in Alexander Ustimenko's Psychological tests & quizzes plugin <= 0.21.19 on WordPress possible for users with contributor or higher role via &wpt_test_page_submit_button_caption parameter.

    Alexander Ustimenko Psychological tests & quizzes (WordPress plugin) Web / CMS
  • Medium 6.5
    CVE-2022-1466

    Improper authorization in Keycloak

    Due to improper authorization, Red Hat Single Sign-On is vulnerable to users performing actions that they should not be allowed to perform. It was possible to add users to the master realm even though no respective permission was granted.

    org.keycloak:keycloak-core Maven
  • Medium 4.7
    CVE-2021-36895

    WordPress Tripetto plugin <= 5.1.4 - Unauthenticated Cross-Site Scripting (XSS) vulnerability via SVG image upload

    Unauthenticated Cross-Site Scripting (XSS) vulnerability in Tripetto's Tripetto plugin <= 5.1.4 on WordPress via SVG image upload.

    Tripetto Tripetto (WordPress plugin) Web / CMS
  • Medium 5.4
    CVE-2021-36867

    WordPress Psychological tests & quizzes plugin <= 0.21.19 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

    Stored Cross-Site Scripting (XSS) vulnerability in Alexander Ustimenko's Psychological tests & quizzes plugin <= 0.21.19 on WordPress possible for users with contributor or higher user rights.

    Alexander Ustimenko Psychological tests & quizzes (WordPress plugin) Web / CMS