Skip to content
OpenAdvisories

Archive

April 2022

Vulnerabilities first published in this month (UTC), newest first.

← March 2022 2022 / April May 2022 →
  1. 1104
  2. 24
  3. 325
  4. 4107
  5. 5122
  6. 659
  7. 746
  8. 859
  9. 97
  10. 1039
  11. 11189
  12. 12166
  13. 1351
  14. 14110
  15. 15234
  16. 165
  17. 172
  18. 1898
  19. 19131
  20. 2044
  21. 21106
  22. 2248
  23. 231
  24. 244
  25. 2579
  26. 2636
  27. 2764
  28. 2860
  29. 2952
  30. 306
All Critical High Medium Low Exploited only Public exploit

105 results · Clear filters · Feed

  • Unscored —
    CVE-2021-46419 Public exploit Scanner template EPSS 71%

    An unauthorized file deletion vulnerability in Telesquare TLR-2855KS6 via DELETE method can allow deletion of system fi…

  • Unscored —
    CVE-2021-46418 Public exploit Scanner template EPSS 24%

    An unauthorized file creation vulnerability in Telesquare TLR-2855KS6 via PUT method can allow creation of CGI scripts.

  • Unscored —
    CVE-2021-46417 Public exploit Scanner template EPSS 60%

    Insecure handling of a download function leads to disclosure of internal files due to path traversal with root privileg…

  • Medium 5.4
    CVE-2021-46416 Public exploit

    Insecure direct object reference in SUNNY TRIPOWER 5.0 Firmware version 3.10.16.R leads to unauthorized user groups acc…

  • Unscored —
    CVE-2021-40375 Public exploit

    Apperta Foundation OpenEyes 3.5.1 allows remote attackers to view the sensitive information of patients without having …

  • Unscored —
    CVE-2021-40374 Public exploit

    A stored cross-site scripting (XSS) vulnerability was identified in Apperta Foundation OpenEyes 3.5.1. Updating a patie…

  • Unscored —
    CVE-2022-28219 Public exploit Scanner template EPSS 97%

    Cewolf in Zoho ManageEngine ADAudit Plus before 7060 is vulnerable to an unauthenticated XXE attack that leads to Remot…

  • High 8.8
    CVE-2022-24780 Public exploit

    Code Injection in Combodo iTop

    Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.6 and 3.0.0, users of the iTop user portal can send TWIG code to the server by forging specific http queries, and execute arbitrary code on the server using http server user priv…

    Combodo iTop
  • Unscored —
    CVE-2020-23349 Public exploit

    An intent redirection issue was doscovered in Sina Weibo Android SDK 4.2.7 (com.sina.weibo.sdk.share.WbShareTransActivi…

  • Unscored —
    CVE-2022-23909 Public exploit

    There is an unquoted service path in Sherpa Connector Service (SherpaConnectorService.exe) 2020.2.20328.2050. This migh…

  • High 7.5
    CVE-2021-43008 Public exploit EPSS 14%

    Files or Directories Accessible to External Parties in Adminer

    Improper Access Control in Adminer versions 1.12.0 to 4.6.2 (fixed in version 4.6.3) allows an attacker to achieve Arbitrary File Read on the remote server by requesting the Adminer to connect to a remote MySQL database.

    adminer adminer vrana/adminer Debian Ubuntu Packagist
  • Unscored —
    CVE-2022-25584 Public exploit

    Seyeon Tech Co., Ltd FlexWATCH FW3170-PS-E Network Video System 4.23-3000_GY allows attackers to access sensitive infor…

  • Unscored —
    CVE-2022-26982 Public exploit

    SimpleMachinesForum 2.1.1 and earlier allows remote authenticated administrators to execute arbitrary code by inserting…

  • High 7.2
    CVE-2022-26986 Public exploit

    SQL injection in ImpressCMS

    SQL Injection in ImpressCMS 1.4.3 and earlier allows remote attackers to inject into the code in unintended way, this allows an attacker to read and modify the sensitive information from the database used by the application. If misconfigured, an attacker can …

    impresscms/impresscms Packagist
  • High 8.7
    CVE-2022-1175 Public exploit EPSS 82%

    Improper neutralization of user input in GitLab CE/EE versions 14.4 before 14.7.7, all versions starting from 14.8 befo…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Critical 9.1
    CVE-2022-1162 Public exploit Scanner template EPSS 76%

    A hardcoded password was set for accounts registered using an OmniAuth provider (e.g. OAuth, LDAP, SAML) in GitLab CE/E…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • High 8.6
    CVE-2022-1026 Public exploit Scanner template EPSS 15%

    Kyocera Net View Address Book Exposure

    Kyocera multifunction printers running vulnerable versions of Net View unintentionally expose sensitive user information, including usernames and passwords, through an insufficiently protected address book export function.

    KYOCERA Multifunction Printer Net Viewer
  • High 7.5
    CVE-2022-24785 Public exploit EPSS 14%

    Path Traversal in Moment.js

    Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is direct…

    moment moment node-moment node-moment Debian Ubuntu npm NuGet
  • Unscored —
    CVE-2022-28381 Public exploit EPSS 70%

    Mediaserver.exe in ALLMediaServer 1.6 has a stack-based buffer overflow that allows remote attackers to execute arbitra…

  • Low 3.5
    CVE-2022-0088 Public exploit

    Cross-Site Request Forgery (CSRF) in yourls/yourls

    Cross-Site Request Forgery (CSRF) in GitHub repository yourls/yourls prior to 1.8.3.

    YOURLS yourls/yourls yourls/yourls Packagist
  • Critical 9.8
    CVE-2022-28368 Public exploit EPSS 84%

    Remote code injection in dompdf/dompdf

    Dompdf 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets (CSS) statement (within an HTML input file).

    dompdf/dompdf Packagist
  • Medium 5.5
    CVE-2022-1068 Public exploit

    Modbus Tools Modbus Slave Stack-Based Buffer Overflow

    Modbus Tools Modbus Slave (versions 7.4.2 and prior) is vulnerable to a stack-based buffer overflow in the registration field. This may cause the program to crash when a long character string is used.

    Modbus Tools Modbus Slave
  • Critical 9.8
    CVE-2022-22965 Exploited Public exploit Scanner template EPSS 100%

    Remote Code Execution in Spring Framework

    A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot…

    libspring-java libspring-java org.springframework:spring-webmvc org.springframework:spring-webflux Debian Ubuntu Maven
    KEV Apr 4, 2022
  • Unscored —
    CVE-2022-24181 Public exploit Scanner template

    Cross-site scripting (XSS) via Host Header injection in PKP Open Journals System 2.4.8 >= 3.3 allows remote attackers t…

  • Critical 9.8
    CVE-2022-22963 Exploited Public exploit Scanner template EPSS 100%

    Spring Cloud Function Code Injection with a specially crafted SpEL as a routing expression

    In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local …

    org.springframework.cloud:spring-cloud-function-context Maven
    KEV Aug 25, 2022