Skip to content
OpenAdvisories

Archive

28 October 2022

Vulnerabilities first published on this day (UTC), newest first.

← September 2022 2022 / October /28 November 2022 →
  1. 11
  2. 22
  3. 350
  4. 4 
  5. 5 
  6. 669
  7. 7117
  8. 83
  9. 95
  10. 1051
  11. 11269
  12. 1271
  13. 1364
  14. 14186
  15. 154
  16. 167
  17. 17123
  18. 18160
  19. 19128
  20. 2035
  21. 2159
  22. 221
  23. 23 
  24. 2437
  25. 25123
  26. 2656
  27. 2757
  28. 2884
  29. 2910
  30. 303
  31. 3190
All Critical High Medium Low Exploited only Public exploit

20 results · Clear filters · Feed

  • High 8.8
    CVE-2022-3401

    The Bricks theme for WordPress is vulnerable to remote code execution due to the theme allowing site editors to include…

    Bricks Builder Bricks Web / CMS
  • High 7.5
    CVE-2021-36898

    WordPress Quiz And Survey Master plugin <= 7.3.4 - Auth. SQL Injection (SQLi) vulnerability

    Auth. SQL Injection (SQLi) vulnerability in Quiz And Survey Master plugin <= 7.3.4 on WordPress.

    ExpressTech Systems Quiz And Survey Master (WordPress plugin) Web / CMS
  • High 8.8
    CVE-2022-2864

    The demon image annotation plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and incl…

    demonisblack demon image annotation Web / CMS
  • High 7.5
    CVE-2021-38399

    Honeywell Experion PKS and ACE Controllers Relative Path Traversal

    Honeywell Experion PKS C200, C200E, C300, and ACE controllers are vulnerable to relative path traversal, which may allow an attacker access to unauthorized files and directories.

    Honeywell Experion PKS ICS / OT
  • High 8.1
    CVE-2022-33859

    Unrestricted file upload in Eaton Foreseer EPMS

    A security vulnerability was discovered in the Eaton Foreseer EPMS software. Foreseer EPMS connects an operation’s vast array of devices to assist in the reduction of energy consumption and avoid unplanned downtime caused by the failures of critical systems. …

    Eaton Foreseer EPMS
  • High 8.6
    CVE-2022-39367

    Vulnerability in handling of uploaded QTI ZIP files

    QTIWorks is a software suite for standards-based assessment delivery. Prior to version 1.0-beta15, the QTIWorks Engine allows users to upload QTI content packages as ZIP files. The ZIP handling code does not sufficiently check the paths of files contained wit…

    davemckain qtiworks
  • High 7.5
    CVE-2022-3697

    Ansible leaks password to logs

    A flaw was found in Ansible in the amazon.aws collection when using the tower_callback parameter from the amazon.aws.ec2_instance module. This flaw allows an attacker to take advantage of this issue as the module is handling the parameter insecurely, leading …

    ansible ansible ansible ansible-core Debian Ubuntu PyPI
  • High 7.2
    CVE-2022-43276

    Canteen Management System v1.0 was discovered to contain a SQL injection vulnerability via the productId parameter at /…

  • High 7.2
    CVE-2022-43229

    Simple Cold Storage Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter…

  • High 7.1
    CVE-2022-43280

    wasm-interp v1.0.29 was discovered to contain an out-of-bounds read via the component OnReturnCallExpr->GetReturnCallDr…

    wabt wabt Debian Ubuntu
  • High 7.2
    CVE-2022-43230

    Simple Cold Storage Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter…

  • High 7.2
    CVE-2022-43231

    Canteen Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via /youthappam/manage_…

  • High 7.2
    CVE-2022-43228

    Barangay Management System v1.0 was discovered to contain a SQL injection vulnerability via the hidden_id parameter at …

  • High 7.2
    CVE-2022-43232

    Canteen Management System v1.0 was discovered to contain a SQL injection vulnerability via the userid parameter at /php…

  • High 7.2
    CVE-2022-43275

    Canteen Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via /youthappam/php_act…

  • High 7.2
    CVE-2022-43233

    Canteen Management System v1.0 was discovered to contain a SQL injection vulnerability via the userid parameter at /php…

  • High 7.5
    CVE-2022-43285

    Nginx NJS v0.7.4 was discovered to contain a segmentation violation in njs_promise_reaction_job. NOTE: the vendor dispu…

  • High 7.8
    CVE-2022-43281

    wasm-interp v1.0.29 was discovered to contain a heap overflow via the component std::vector<wabt::Type, std::allocator<…

    wabt wabt wabt Debian Ubuntu PyPI
  • High 7.1
    CVE-2022-43282

    wasm-interp v1.0.29 was discovered to contain an out-of-bounds read via the component OnReturnCallIndirectExpr->GetRetu…

    wabt wabt Debian Ubuntu
  • High 8.8
    CVE-2021-35387

    Hospital Management System v 4.0 is vulnerable to SQL Injection via file:hospital/hms/admin/view-patient.php.