Skip to content
OpenAdvisories

Archive

28 July 2022

Vulnerabilities first published on this day (UTC), newest first.

← June 2022 2022 / July /28 August 2022 →
  1. 184
  2. 28
  3. 33
  4. 438
  5. 532
  6. 695
  7. 748
  8. 825
  9. 91
  10. 102
  11. 11205
  12. 12186
  13. 1354
  14. 1468
  15. 1581
  16. 1612
  17. 1776
  18. 18100
  19. 19136
  20. 2097
  21. 2183
  22. 2273
  23. 234
  24. 243
  25. 25102
  26. 26115
  27. 27115
  28. 2893
  29. 2941
  30. 301
  31. 3112
All Critical High Medium Low Exploited only Public exploit

26 results · Clear filters · Feed

  • High 7.4
    CVE-2021-39088

    IBM QRadar SIEM 7.3, 7.4, and 7.5 is vulnerable to local privilege escalation if this could be combined with other unkn…

    IBM QRadar SIEM
  • High 7.0
    CVE-2022-2564 EPSS 31%

    Prototype Pollution in automattic/mongoose

    Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6.

    Automattic automattic/mongoose mongoose npm
  • High 8.7
    CVE-2022-1948

    An issue has been discovered in GitLab affecting all versions starting from 15.0 before 15.0.1. Missing validation of i…

    GitLab GitLab Web / CMS
  • High 8.8
    CVE-2021-22646

    Ovarro TBox Code Injection

    The “ipk” package containing the configuration created by TWinSoft can be uploaded, extracted, and executed in Ovarro TBox, allowing malicious code execution.

    Ovarro TBox
  • High 7.5
    CVE-2021-22644

    Ovarro TBox Use of Hard-coded Cryptographic Key

    Ovarro TBox TWinSoft uses the custom hardcoded user “TWinSoft” with a hardcoded key.

    Ovarro TBox
  • High 8.8
    CVE-2021-22648

    Ovarro TBox Incorrect Permission Assignment for Critical Resource

    Ovarro TBox proprietary Modbus file access functions allow attackers to read, alter, or delete the configuration file.

    Ovarro TBox
  • High 7.5
    CVE-2021-22650

    Ovarro TBox Relative Path Traversal

    An attacker may use TWinSoft and a malicious source project file (TPG) to extract files on machine executing Ovarro TWinSoft, which could lead to code execution.

    Ovarro TBox
  • High 7.5
    CVE-2021-22640

    Ovarro TBox Insufficiently Protected Credentials

    An attacker can decrypt the Ovarro TBox login password by communication capture and brute force attacks.

    Ovarro TBox
  • High 7.5
    CVE-2021-22642

    Ovarro TBox Uncontrolled Resource Consumption

    An attacker could use specially crafted invalid Modbus frames to crash the Ovarro TBox system.

    Ovarro TBox
  • High 8.8
    CVE-2022-36364

    Apache Calcite Avatica JDBC driver `httpclient_impl` connection property can be used as an RCE vector

    Apache Calcite Avatica JDBC driver creates HTTP client instances based on class names provided via `httpclient_impl` connection property; however, the driver does not verify if the class implements the expected interface before instantiating it, which can lea…

    Apache Software Foundation Apache Calcite Avatica trino trino-plugin-opensearch Wolfi Maven
  • High 7.3
    CVE-2022-27612

    Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in cgi component in Synology Audio…

    Synology Audio Station
  • High 8.7
    CVE-2022-22685

    Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Syn…

    Synology WebDAV Server
  • High 8.3
    CVE-2022-27613

    Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in webapi component …

    Synology CardDAV Server
  • High 7.2
    CVE-2022-22684

    Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in task manage…

    Synology DiskStation Manager (DSM)
  • High 7.7
    CVE-2022-31627

    Heap buffer overflow in finfo_buffer

    In PHP versions 8.1.x below 8.1.8, when fileinfo functions, such as finfo_buffer, due to incorrect patch applied to the third party code from libmagic, incorrect function may be used to free allocated memory, which may lead to heap corruption.

    PHP Group PHP php8.1 Ubuntu
  • High 7.7
    CVE-2022-27615

    Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in cgi component in Synolo…

    Synology DNS Server
  • High 7.7
    CVE-2022-36984

    An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and …

  • High 7.8
    CVE-2022-36985

    An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and …

  • High 8.6
    CVE-2022-36986

    An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and …

  • High 8.5
    CVE-2022-36987

    An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and …

  • High 8.0
    CVE-2022-36988

    An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and …

  • High 8.8
    CVE-2022-36989

    An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and …

  • High 8.1
    CVE-2022-36991

    An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and …

  • High 8.8
    CVE-2022-36993

    An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and …

  • High 7.1
    CVE-2022-36997

    An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and …

  • High 8.8
    CVE-2022-2294 Exploited · Ransomware EPSS 71%

    Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploi…

    Google Chrome chromium chromium-browser Browsers Debian Ubuntu Alpine
    KEV Aug 25, 2022