Skip to content
OpenAdvisories

Archive

27 October 2022

Vulnerabilities first published on this day (UTC), newest first.

← September 2022 2022 / October /27 November 2022 →
  1. 11
  2. 22
  3. 350
  4. 4 
  5. 5 
  6. 669
  7. 7117
  8. 83
  9. 95
  10. 1051
  11. 11269
  12. 1271
  13. 1364
  14. 14186
  15. 154
  16. 167
  17. 17123
  18. 18160
  19. 19128
  20. 2035
  21. 2159
  22. 221
  23. 23 
  24. 2437
  25. 25123
  26. 2656
  27. 2757
  28. 2884
  29. 2910
  30. 303
  31. 3190
All Critical High Medium Low Exploited only Public exploit

22 results · Clear filters · Feed

  • Medium 6.5
    CVE-2022-3387 EPSS 14%

    Advantech R-SeeNet Versions 2.4.19 and prior are vulnerable to path traversal attacks. An unauthorized attacker could r…

    Advantech R-SeeNet
  • Medium 4.8
    CVE-2022-41627

    The physical IoT device of the AliveCor's KardiaMobile, a smartphone-based personal electrocardiogram (EKG) has no encr…

    AliveCor KardiaMobile
  • Medium 5.8
    CVE-2022-0072

    Directory Traversal in OpenLiteSpeed Web Server

    Directory Traversal vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server and LiteSpeed Web Server dashboards allows Path Traversal. This affects versions from 1.5.11 through 1.5.12, from 1.6.5 through 1.6.20.1, from 1.7.0 before 1.7.16.1

    LiteSpeed Technologies LiteSpeed Web Server OpenLiteSpeed Web Server
  • Medium 6.5
    CVE-2022-24669

    Anonymous users can register / de-register for configuration change notifications

    It may be possible to gain some details of the deployment through a well-crafted attack. This may allow that data to be used to probe internal network services.

    ForgeRock Access Management
  • Medium 4.7
    CVE-2021-45476

    Information disclosure in Yordam Library Information Document Automation Program

    Yordam Library Information Document Automation product before version 19.02 has an unauthenticated reflected XSS vulnerability.

    Yordam Informatics Yordam Library Information Document Automation Program
  • Medium 5.3
    CVE-2021-45475

    Information disclosure in Yordam Library Information Document Automation Program

    Yordam Library Information Document Automation product before version 19.02 has an unauthenticated Information disclosure vulnerability.

    Yordam Informatics Yordam Library Information Document Automation Program
  • Medium 5.3
    CVE-2022-25918

    Regular Expression Denial of Service (ReDoS)

    The package shescape from 1.5.10 and before 1.6.1 are vulnerable to Regular Expression Denial of Service (ReDoS) via the escape function in index.js, due to the usage of insecure regex in the escapeArgBash function.

    shescape npm
  • Medium 4.0
    CVE-2022-39364

    Exception logging in Sharepoint app reveals clear-text connection details

    Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. In Nextcloud Server prior to versions 23.0.9 and 24.0.5 and Nextcloud Enterprise Server prior to versions 22.2.10.5, 23.0.9, and 24.0.5 an attacker reading `nextc…

    Nextcloud security-advisories
  • Medium 4.8
    CVE-2022-39330

    Database resource exhaustion for logged-in users via sharee recommendations with circles

    Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server prior to versions 23.0.10 and 24.0.6 and Nextcloud Enterprise Server prior to versions 22.2.10, 23.0.10, and 24.0.6 are vulnerable to a logged-in…

    Nextcloud security-advisories
  • Medium 6.1
    CVE-2022-32407

    Softr v2.0 was discovered to contain a Cross-Site Scripting (XSS) vulnerability via the First Name parameter under the …

  • Medium 6.1
    CVE-2022-36182

    Hashicorp Boundary vulnerable to clickjacking

    Hashicorp Boundary v0.8.0 is vulnerable to Clickjacking which allow for the interception of login credentials, re-direction of users to malicious sites, or causing users to perform malicious actions on the site.

    github.com/hashicorp/boundary Go
  • Medium 6.8
    CVE-2022-31898 Public exploit EPSS 16%

    gl-inet GL-MT300N-V2 Mango v3.212 and GL-AX1800 Flint v3.214 were discovered to contain multiple command injection vuln…

  • Medium 6.3
    CVE-2022-3725

    Crash in the OPUS protocol dissector in Wireshark 3.6.0 to 3.6.8 allows denial of service via packet injection or craft…

    Wireshark Foundation Wireshark wireshark wireshark Debian Ubuntu
  • Medium 5.0
    CVE-2022-3714

    SourceCodester Online Medicine Ordering System sql injection

    A vulnerability classified as critical has been found in SourceCodester Online Medicine Ordering System 1.0. Affected is an unknown function of the file admin/?page=orders/view_order. The manipulation of the argument id leads to sql injection. It is possible …

    SourceCodester Online Medicine Ordering System
  • Medium 5.3
    CVE-2022-2508

    In affected versions of Octopus Server it is possible to reveal the existence of resources in a space that the user doe…

    Octopus Deploy Octopus Server
  • Medium 5.1
    CVE-2022-40184

    Stored Cross Site Scripting (XSS) in VIDEOJET multi 4000

    Incomplete filtering of JavaScript code in different configuration fields of the web based interface of the VIDEOJET multi 4000 allows an attacker with administrative credentials to store JavaScript code which will be executed for all administrators accessing…

    Bosch VIDEOJET multi 4000
  • Medium 5.8
    CVE-2022-40183

    Reflected Cross Site Scripting (XSS) in VIDEOJET multi 4000

    An error in the URL handler of the VIDEOJET multi 4000 may lead to a reflected cross site scripting (XSS) in the web-based interface. An attacker with knowledge of the encoder address can send a crafted link to a user, which will execute JavaScript code in th…

    Bosch VIDEOJET multi 4000
  • Medium 5.4
    CVE-2022-42991

    A stored cross-site scripting (XSS) vulnerability in Simple Online Public Access Catalog v1.0 allows attackers to execu…

  • Medium 5.4
    CVE-2022-42054

    Multiple stored cross-site scripting (XSS) vulnerabilities in GL.iNet GoodCloud IoT Device Management System Version 1.…

  • Medium 5.4
    CVE-2022-42992

    Multiple stored cross-site scripting (XSS) vulnerabilities in Train Scheduler App v1.0 allow attackers to execute arbit…

  • Medium 5.4
    CVE-2022-42993

    Password Storage Application v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Setup pa…

  • Medium 6.5
    CVE-2022-42055

    Multiple command injection vulnerabilities in GL.iNet GoodCloud IoT Device Management System Version 1.00.220412.00 via…