Skip to content
OpenAdvisories

Archive

13 October 2022

Vulnerabilities first published on this day (UTC), newest first.

← September 2022 2022 / October /13 November 2022 →
  1. 11
  2. 22
  3. 350
  4. 4 
  5. 5 
  6. 669
  7. 7117
  8. 83
  9. 95
  10. 1051
  11. 11269
  12. 1271
  13. 1364
  14. 14186
  15. 154
  16. 167
  17. 17123
  18. 18160
  19. 19128
  20. 2035
  21. 2159
  22. 221
  23. 23 
  24. 2437
  25. 25123
  26. 2656
  27. 2757
  28. 2884
  29. 2910
  30. 303
  31. 3190
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Critical 9.8
    CVE-2022-24697 EPSS 85%

    Apache Kylin prior to 4.0.2 allows command injection when the configuration overwrites function overwrites system parameters

    Kylin's cube designer function has a command injection vulnerability when overwriting system parameters in the configuration overwrites menu. RCE can be implemented by closing the single quotation marks around the parameter value of “-- conf=” to inject any o…

    Apache Software Foundation Apache Kylin org.apache.kylin:kylin-core-common org.apache.kylin:kylin-server-base Maven
  • Critical 9.8
    CVE-2022-41390

    OcoMon v4.0 was discovered to contain a SQL injection vulnerability via the cod parameter at download.php.

  • Critical 9.8
    CVE-2022-41496

    iCMS v7.0.16 was discovered to contain a Server-Side Request Forgery (SSRF) via the url parameter at admincp.php.

  • Critical 9.8
    CVE-2022-41497

    ClipperCMS 1.3.3 was discovered to contain a Server-Side Request Forgery (SSRF) via the pkg_url parameter at /manager/i…

  • Critical 9.8
    CVE-2022-41391

    OcoMon v4.0 was discovered to contain a SQL injection vulnerability via the cod parameter at showImg.php.

  • Critical 9.8
    CVE-2022-41495

    ClipperCMS 1.3.3 was discovered to contain a Server-Side Request Forgery (SSRF) via the rss_url_news parameter at /mana…

  • Critical 9.8
    CVE-2022-42889 Public exploit EPSS 100%

    Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults

    Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.text.lookup.String…

    Apache Software Foundation Apache Commons Text com.guicedee.services:commons-text commons-text Debian Ubuntu Maven