Skip to content
OpenAdvisories

Archive

29 April 2022

Vulnerabilities first published on this day (UTC), newest first.

← March 2022 2022 / April /29 May 2022 →
  1. 1104
  2. 24
  3. 325
  4. 4107
  5. 5122
  6. 659
  7. 746
  8. 859
  9. 97
  10. 1039
  11. 11189
  12. 12166
  13. 1351
  14. 14110
  15. 15234
  16. 165
  17. 172
  18. 1898
  19. 19131
  20. 2044
  21. 21106
  22. 2248
  23. 231
  24. 244
  25. 2579
  26. 2636
  27. 2764
  28. 2860
  29. 2952
  30. 306
All Critical High Medium Low Exploited only Public exploit

11 results · Clear filters · Feed

  • Medium 6.6
    CVE-2022-28198

    NVIDIA Omniverse Nucleus and Cache contain a vulnerability in its configuration of OpenSSL, where an attacker with phys…

    NVIDIA NVIDIA Omniverse Cache NVIDIA Omniverse Nucleus
  • Medium 6.1
    CVE-2022-29947

    Woodpecker allows cross-site scripting (XSS) via build logs

    Woodpecker before 0.15.1 allows XSS via build logs because web/src/components/repo/build/BuildLog.vue lacks escaping.

    github.com/woodpecker-ci/woodpecker Go
  • Medium 5.4
    CVE-2022-25854

    Cross-site Scripting (XSS)

    This affects the package @yaireo/tagify before 4.9.8. The package is used for rendering UI components inside the input or text fields, and an attacker can pass a malicious placeholder value to it to fire the XSS payload.

    @yaireo/tagify npm
  • Medium 4.0
    CVE-2022-29945

    DJI drone devices sold in 2017 through 2022 broadcast unencrypted information about the drone operator's physical locat…

  • Medium 5.4
    CVE-2022-29414

    WordPress Subscribe To Comments Reloaded plugin <= 211130 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities

    Multiple (13x) Cross-Site Request Forgery (CSRF) vulnerabilities in WPKube's Subscribe To Comments Reloaded plugin <= 211130 on WordPress allows attackers to clean up Log archive, download system info file, plugin system settings, plugin options settings, gen…

    WPKube Subscribe To Comments Reloaded (WordPress plugin) Web / CMS
  • Medium 4.3
    CVE-2022-0984

    Missing authorization in Moodle

    Users with the capability to configure badge criteria (teachers and managers by default) were able to configure course badges with profile field criteria, which should only be available for site badges.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 5.9
    CVE-2021-39082

    IBM UrbanCode Deploy (UCD) 7.1.1.2 uses weaker than expected cryptographic algorithms that could allow an attacker to d…

    IBM UrbanCode Deploy
  • Medium 4.3
    CVE-2022-0985

    Improper Authentication in moodle

    Insufficient capability checks could allow users with the moodle/site:uploadusers capability to delete users, without having the necessary moodle/user:delete capability.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 4.8
    CVE-2021-41948

    Subrion CMS Cross-site Scripting (XSS) vulnerability in the `contact us` plugin

    A cross-site scripting (XSS) vulnerability exists in the "contact us" plugin for Subrion CMS <= 4.2.1 version via "List of subjects".

    intelliants/subrion Packagist
  • Medium 6.6
    CVE-2022-1533

    Buffer Over-read in bfabiszewski/libmobi

    Buffer Over-read in GitHub repository bfabiszewski/libmobi prior to 0.11. This vulnerability is capable of arbitrary code execution.

    bfabiszewski bfabiszewski/libmobi libmobi libmobi Debian Ubuntu
  • Medium 6.6
    CVE-2022-1534

    Buffer Over-read at parse_rawml.c:1416 in bfabiszewski/libmobi

    Buffer Over-read at parse_rawml.c:1416 in GitHub repository bfabiszewski/libmobi prior to 0.11. The bug causes the program reads data past the end of the intented buffer. Typically, this can allow attackers to read sensitive information from other memory loca…

    bfabiszewski bfabiszewski/libmobi libmobi libmobi Debian Ubuntu