Skip to content
OpenAdvisories

Archive

21 July 2022

Vulnerabilities first published on this day (UTC), newest first.

← June 2022 2022 / July /21 August 2022 →
  1. 184
  2. 28
  3. 33
  4. 438
  5. 532
  6. 695
  7. 748
  8. 825
  9. 91
  10. 102
  11. 11205
  12. 12186
  13. 1354
  14. 1468
  15. 1581
  16. 1612
  17. 1776
  18. 18100
  19. 19136
  20. 2097
  21. 2183
  22. 2273
  23. 234
  24. 243
  25. 25102
  26. 26115
  27. 27115
  28. 2893
  29. 2941
  30. 301
  31. 3112
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • High 7.5
    CVE-2022-32430 Scanner template

    Hardcoded JWT Token in Lin CMS Spring Boot

    An access control issue in Lin CMS Spring Boot v0.2.1 allows attackers to access the backend information and functions within the application.

    io.github.talelin:lin-cms-core Maven
  • High 8.1
    CVE-2022-0902 EPSS 17%

    ABB Flow Computer and Remote Controllers Path Traversal Vulnerability in Totalflow TCP protocol can lead to root access

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in flow computer and remote controller products of ABB ( RMC-100 (Standard), RMC-…

    ABB RMC-100 LITE RMC-100 (Standard) XFCG5 ICS / OT
  • High 7.5
    CVE-2022-31170

    OpenZeppelin Contracts's ERC165Checker may revert instead of returning false

    OpenZeppelin Contracts is a library for smart contract development. Versions 4.0.0 until 4.7.1 are vulnerable to ERC165Checker reverting instead of returning `false`. `ERC165Checker.supportsInterface` is designed to always successfully return a boolean, and u…

    OpenZeppelin openzeppelin-contracts @openzeppelin/contracts-upgradeable @openzeppelin/contracts npm
  • High 7.5
    CVE-2022-31172

    OpenZeppelin Contracts's SignatureChecker may revert on invalid EIP-1271 signers

    OpenZeppelin Contracts is a library for smart contract development. Versions 4.1.0 until 4.7.1 are vulnerable to the SignatureChecker reverting. `SignatureChecker.isValidSignatureNow` is not expected to revert. However, an incorrect assumption about Solidity …

    OpenZeppelin openzeppelin-contracts @openzeppelin/contracts-upgradeable @openzeppelin/contracts npm
  • High 7.5
    CVE-2022-31164

    Tovy before v0.7.51 vulnerable to users logging in as and impersonating other users

    Tovy is a a staff management system for Roblox groups. A vulnerability in versions prior to 0.7.51 allows users to log in as other users, including privileged users such as the other of the instance. The problem has been patched in version 0.7.51.

    tovyblox tovy
  • High 7.5
    CVE-2022-31163

    TZInfo relative path traversal vulnerability allows loading of arbitrary files

    TZInfo is a Ruby library that provides access to time zone data and allows times to be converted using time zone rules. Versions prior to 0.36.1, as well as those prior to 1.2.10 when used with the Ruby data source tzinfo-data, are vulnerable to relative path…

    tzinfo tzinfo tzinfo ruby-tzinfo Debian Ubuntu RubyGems
  • High 7.5
    CVE-2022-31162

    Slack Morphism for Rust before 0.41.0 can accidentally leak Slack OAuth client information in application debug logs

    Slack Morphism is an async client library for Rust. Prior to 0.41.0, it was possible for Slack OAuth client information to leak in application debug logs. Stricter and more secure debug formatting was introduced in v0.41.0 for OAuth secret types to reduce the…

    abdolence slack-morphism-rust slack-morphism crates.io
  • High 7.4
    CVE-2022-20860

    Cisco Nexus Dashboard SSL Certificate Validation Vulnerability

    A vulnerability in the SSL/TLS implementation of Cisco Nexus Dashboard could allow an unauthenticated, remote attacker to alter communications with associated controllers or view sensitive information. This vulnerability exists because SSL server certificates…

    Cisco Cisco Nexus Dashboard Network devices