Skip to content
OpenAdvisories

Archive

7 September 2022

Vulnerabilities first published on this day (UTC), newest first.

← August 2022 2022 / September /7 October 2022 →
  1. 170
  2. 277
  3. 31
  4. 42
  5. 539
  6. 6157
  7. 764
  8. 858
  9. 9130
  10. 10 
  11. 119
  12. 1249
  13. 13201
  14. 1449
  15. 1589
  16. 16266
  17. 175
  18. 187
  19. 19122
  20. 2096
  21. 2196
  22. 2258
  23. 23203
  24. 247
  25. 253
  26. 26105
  27. 2733
  28. 2874
  29. 2935
  30. 3069
All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • Medium 5.0
    CVE-2022-36088

    GoCD Windows installations outside default location inadequately restrict installation file permissions

    GoCD is a continuous delivery server. Windows installations via either the server or agent installers for GoCD prior to 22.2.0 do not adequately restrict permissions when installing outside of the default location. This could allow a malicious user with local…

    gocd gocd
  • Medium 5.3
    CVE-2022-36083

    JOSE vulnerable to resource exhaustion via specifically crafted JWE

    JOSE is "JSON Web Almost Everything" - JWA, JWS, JWE, JWT, JWK, JWKS with no dependencies using runtime's native crypto in Node.js, Browser, Cloudflare Workers, Electron, and Deno. The PBKDF2-based JWE key management algorithms expect a JOSE Header Parameter …

    panva jose jose jose Debian Ubuntu npm
  • Medium 5.3
    CVE-2022-36082

    mangadex-downloader vulnerable to unauthorized file reading

    mangadex-downloader is a command-line tool to download manga from MangaDex. When using `file:<location>` command and `<location>` is a web URL location (http, https), mangadex-downloader between versions 1.3.0 and 1.7.2 will try to open and read a file in loc…

    mansuf mangadex-downloader mangadex-downloader PyPI
  • Medium 6.1
    CVE-2022-36080

    Wikmd Cross-site Scripting vulnerability

    Wikmd is a file based wiki that uses markdown. Prior to version 1.7.1, an attacker could capture user's session cookies or execute malicious Javascript when a victim edits a markdown file. Version 1.7.1 fixes this issue.

    Linbreux wikmd
  • Medium 6.3
    CVE-2022-3129

    codeprojects Online Driving School registration.php unrestricted upload

    A vulnerability was found in codeprojects Online Driving School. It has been rated as critical. Affected by this issue is some unknown functionality of the file /registration.php. The manipulation leads to unrestricted upload. The attack may be launched remot…

    code-projects Online Driving School
  • Medium 6.5
    CVE-2022-30312

    The Trend Controls IC protocol through 2022-05-06 allows Cleartext Transmission of Sensitive Information. According to …

  • Medium 6.5
    CVE-2022-36661

    xhyve commit dfbe09b was discovered to contain a NULL pointer dereference via the component vi_pci_read(). This vulnera…

  • Medium 6.5
    CVE-2022-36659

    xhyve commit dfbe09b was discovered to contain a NULL pointer dereference via the component vi_pci_write(). This vulner…

  • Medium 6.5
    CVE-2022-31251

    slurm: %post for slurm-testsuite operates as root in user owned directory

    A Incorrect Default Permissions vulnerability in the packaging of the slurm testsuite of openSUSE Factory allows local attackers with control over the slurm user to escalate to root. This issue affects: openSUSE Factory slurm versions prior to 22.05.2-3.3.

    SUSE openSUSE Factory
  • Medium 5.3
    CVE-2022-21950

    canna: unsafe handling of /tmp/.iroha_unix directory

    A Improper Access Control vulnerability in the systemd service of cana in openSUSE Backports SLE-15-SP3, openSUSE Backports SLE-15-SP4 allows local users to hijack the UNIX domain socket This issue affects: openSUSE Backports SLE-15-SP3 canna versions prior t…

    openSUSE openSUSE Backports SLE-15-SP3 openSUSE Backports SLE-15-SP4