Skip to content
OpenAdvisories

Archive

20 July 2022

Vulnerabilities first published on this day (UTC), newest first.

← June 2022 2022 / July /20 August 2022 →
  1. 184
  2. 28
  3. 33
  4. 438
  5. 532
  6. 695
  7. 748
  8. 825
  9. 91
  10. 102
  11. 11205
  12. 12186
  13. 1354
  14. 1468
  15. 1581
  16. 1612
  17. 1776
  18. 18100
  19. 19136
  20. 2097
  21. 2183
  22. 2273
  23. 234
  24. 243
  25. 25102
  26. 26115
  27. 27115
  28. 2893
  29. 2941
  30. 301
  31. 3112
All Critical High Medium Low Exploited only Public exploit

97 results · Feed

  • High 8.0
    CVE-2022-2488 Scanner template EPSS 33%

    WAVLINK WN535K2/WN535K3 touchlist_sync.cgi os command injection

    A vulnerability was found in WAVLINK WN535K2 and WN535K3 and classified as critical. This issue affects some unknown processing of the file /cgi-bin/touchlist_sync.cgi. The manipulation of the argument IP leads to os command injection. The exploit has been di…

    WAVLINK WN535K3 WN535K2
  • High 8.0
    CVE-2022-2487 Scanner template EPSS 79%

    WAVLINK WN535K2/WN535K3 nightled.cgi os command injection

    A vulnerability has been found in WAVLINK WN535K2 and WN535K3 and classified as critical. This vulnerability affects unknown code of the file /cgi-bin/nightled.cgi. The manipulation of the argument start_hour leads to os command injection. The exploit has bee…

    WAVLINK WN535K2 WN535K3
  • High 8.0
    CVE-2022-2486 Scanner template EPSS 30%

    WAVLINK WN535K2/WN535K3 os command injection

    A vulnerability, which was classified as critical, was found in WAVLINK WN535K2 and WN535K3. This affects an unknown part of the file /cgi-bin/mesh.cgi?page=upgrade. The manipulation of the argument key leads to os command injection. The exploit has been disc…

    WAVLINK WN535K2 WN535K3
  • High 7.1
    CVE-2022-31250

    keylime %post scriplet allows for privilege escalation from keylime user to root

    A UNIX Symbolic Link (Symlink) Following vulnerability in keylime of openSUSE Tumbleweed allows local attackers to escalate from the keylime user to root. This issue affects: openSUSE Tumbleweed keylime versions prior to 6.4.2-1.1.

    openSUSE Tumbleweed
  • Unscored —
    CVE-2022-34866

    Passage Drive versions v1.4.0 to v1.5.1.0 and Passage Drive for Box version v1.0.0 contain an insufficient data verific…

    Yokogawa Rental & Lease Passage Drive ICS / OT
  • Unscored —
    CVE-2022-33967

    squashfs filesystem implementation of U-Boot versions from v2020.10-rc2 to v2022.07-rc5 contains a heap-based buffer ov…

    DENX Software Engineering U-Boot u-boot u-boot Debian Ubuntu
  • Medium 6.8
    CVE-2022-32962

    HiCOS’ client-side citizen digital certificate - Double Free

    HiCOS’ client-side citizen certificate component has a double free vulnerability. An unauthenticated physical attacker can exploit this vulnerability to corrupt memory and execute arbitrary code, manipulate system data or terminate service.

    HiNET HiCOS’ client-side citizen digital certificate
  • Medium 6.8
    CVE-2022-32961

    HiCOS’ client-side citizen digital certificate - Stack Buffer Overflow

    HICOS’ client-side citizen digital certificate component has a stack-based buffer overflow vulnerability when reading IC card due to insufficient parameter length validation for token information. An unauthenticated physical attacker can exploit this vulnerab…

    HiNET HiCOS’ client-side citizen digital certificate
  • Medium 6.8
    CVE-2022-32960

    HiCOS’ client-side citizen digital certificate - Stack Buffer Overflow

    HiCOS’ client-side citizen digital certificate component has a stack-based buffer overflow vulnerability when reading IC card due to insufficient parameter length validation for card number. An unauthenticated physical attacker can exploit this vulnerability …

    HiNET HiCOS’ client-side citizen digital certificate
  • Medium 6.8
    CVE-2022-32959

    HiCOS’ client-side citizen digital certificate - Stack Buffer Overflow

    HiCOS’ client-side citizen digital certificate component has a stack-based buffer overflow vulnerability when reading IC card due to insufficient parameter length validation for OS information. An unauthenticated physical attacker can exploit this vulnerabili…

    HiNET HiCOS’ client-side citizen digital certificate
  • High 7.7
    CVE-2022-32958

    TEAMPLUS TECHNOLOGY INC. Teamplus Pro - Allocation of Resources Without Limits or Throttling

    A remote attacker with general user privilege can send a message to Teamplus Pro’s chat group that exceeds message size limit, to terminate other recipients’ Teamplus Pro chat process.

    TEAMPLUS TECHNOLOGY Teamplus Pro (Private cloud)
  • High 7.5
    CVE-2022-32458

    Data Systems Consulting Co., Ltd. BPM - XML External Entity (XXE) Injection

    Digiwin BPM has a XML External Entity Injection (XXE) vulnerability due to insufficient validation for user input. An unauthenticated remote attacker can perform XML injection attack to access arbitrary system files.

    Data Systems Consulting BPM
  • Medium 5.3
    CVE-2022-32457

    Data Systems Consulting Co., Ltd. BPM - Blind Server-Side Request Forgery (SSRF)

    Digiwin BPM has inadequate filtering for URL parameter. An unauthenticated remote attacker can perform Blind SSRF attack to discover internal network topology base on URL error response.

    Data Systems Consulting BPM
  • Critical 9.8
    CVE-2022-32456

    Data Systems Consulting Co., Ltd. BPM - SQL Injection

    Digiwin BPM’s function has insufficient validation for user input. An unauthenticated remote attacker can inject arbitrary SQL command to access, modify, delete database or disrupt service.

    Data Systems Consulting BPM
  • Critical 10.0
    CVE-2016-1000273

    Java Melody vulnerable to cross-site scripting

    JavaMelody is a monitoring tool for JavaEE applications. Versions prior to 1.61.0 are vulnerable to a cross-site scripting (XSS) attack. This issue was patched in version 1.61.0, and users are recommended to upgrade to the latest version. There are no known w…

    net.bull.javamelody:javamelody-core Maven
  • Medium 6.1
    CVE-2022-31160 Public exploit

    jQuery UI contains potential XSS vulnerability when refreshing a checkboxradio with an HTML-like initial text label

    jQuery UI is a curated set of user interface interactions, effects, widgets, and themes built on top of jQuery. Versions prior to 1.13.2 are potentially vulnerable to cross-site scripting. Initializing a checkboxradio widget on an input enclosed within a labe…

    jquery jquery-ui jQuery.UI.Combined org.webjars.npm:jquery-ui Debian Ubuntu npm Maven NuGet RubyGems
  • High 7.5
    CVE-2021-46828

    In libtirpc before 1.3.3rc1, remote attackers could exhaust the file descriptors of a process that uses libtirpc becaus…

    libtirpc libtirpc ntirpc libtirpc Debian Ubuntu Alpine