Skip to content
OpenAdvisories

Archive

28 October 2022

Vulnerabilities first published on this day (UTC), newest first.

← September 2022 2022 / October /28 November 2022 →
  1. 11
  2. 22
  3. 350
  4. 4 
  5. 5 
  6. 669
  7. 7117
  8. 83
  9. 95
  10. 1051
  11. 11269
  12. 1271
  13. 1364
  14. 14186
  15. 154
  16. 167
  17. 17123
  18. 18160
  19. 19128
  20. 2035
  21. 2159
  22. 221
  23. 23 
  24. 2437
  25. 25123
  26. 2656
  27. 2757
  28. 2884
  29. 2910
  30. 303
  31. 3190
All Critical High Medium Low Exploited only Public exploit

84 results · Feed

  • Medium 6.3
    CVE-2022-3731

    seccome Ehoney token sql injection

    A vulnerability has been found in seccome Ehoney and classified as critical. Affected by this vulnerability is an unknown functionality of the file /api/v1/attack/token. The manipulation of the argument Payload leads to sql injection. The attack can be launch…

    seccome Ehoney
  • Medium 5.5
    CVE-2022-2882

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.6 before 15.2.5, all versions star…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Low 2.7
    CVE-2022-2826

    An issue has been discovered in GitLab affecting all versions starting from 10.0 before 12.9.8, all versions starting f…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Critical 9.8
    CVE-2022-37621

    thlorenz browserify-shim vulnerable to prototype pollution

    Prototype pollution vulnerability in function resolveShims in resolve-shims.js in thlorenz browserify-shim 3.8.15 via the fullPath variable in resolve-shims.js.

    browserify-shim npm
  • Critical 9.8
    CVE-2022-37915

    A vulnerability in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an unaut…

  • Critical 9.8
    CVE-2022-37914

    Vulnerabilities in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an unaut…

  • Critical 9.8
    CVE-2022-37913

    Vulnerabilities in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an unaut…

  • Medium 6.5
    CVE-2022-26884 Public exploit

    Apache DolphinScheduler exposes files without authentication

    Users can read any files by log server, Apache DolphinScheduler users should upgrade to version 2.0.6 or higher.

    Apache Software Foundation Apache DolphinScheduler org.apache.dolphinscheduler:dolphinscheduler Maven
  • High 7.2
    CVE-2022-43276

    Canteen Management System v1.0 was discovered to contain a SQL injection vulnerability via the productId parameter at /…

  • High 7.2
    CVE-2022-43229

    Simple Cold Storage Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter…

  • Medium 5.4
    CVE-2022-43166 Scanner template

    A stored cross-site scripting (XSS) vulnerability in the Global Entities feature (/index.php?module=entities/entities) …

  • High 7.1
    CVE-2022-43280

    wasm-interp v1.0.29 was discovered to contain an out-of-bounds read via the component OnReturnCallExpr->GetReturnCallDr…

    wabt wabt Debian Ubuntu
  • High 7.2
    CVE-2022-43230

    Simple Cold Storage Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter…

  • Medium 5.4
    CVE-2022-43167 Scanner template

    A stored cross-site scripting (XSS) vulnerability in the Users Alerts feature (/index.php?module=users_alerts/users_ale…

  • Medium 5.4
    CVE-2022-43164 Scanner template

    A stored cross-site scripting (XSS) vulnerability in the Global Lists feature (/index.php?module=global_lists/lists) of…

  • High 7.2
    CVE-2022-43231

    Canteen Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via /youthappam/manage_…

  • Unscored —
    CVE-2022-43284

    Nginx NJS v0.7.2 to v0.7.4 was discovered to contain a segmentation violation via njs_scope_valid_value at njs_scope.h.…

  • Critical 9.8
    CVE-2022-43168

    Rukovoditel v3.2.1 was discovered to contain a SQL injection vulnerability via the reports_id parameter.

  • High 7.2
    CVE-2022-43228

    Barangay Management System v1.0 was discovered to contain a SQL injection vulnerability via the hidden_id parameter at …

  • High 7.2
    CVE-2022-43232

    Canteen Management System v1.0 was discovered to contain a SQL injection vulnerability via the userid parameter at /php…

  • High 7.2
    CVE-2022-43275

    Canteen Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via /youthappam/php_act…

  • Medium 5.4
    CVE-2022-43169 Scanner template

    A stored cross-site scripting (XSS) vulnerability in the Users Access Groups feature (/index.php?module=users_groups/us…

  • High 7.2
    CVE-2022-43233

    Canteen Management System v1.0 was discovered to contain a SQL injection vulnerability via the userid parameter at /php…

  • Medium 5.4
    CVE-2022-43170 Scanner template

    A stored cross-site scripting (XSS) vulnerability in the Dashboard Configuration feature (index.php?module=dashboard_co…

  • High 7.5
    CVE-2022-43285

    Nginx NJS v0.7.4 was discovered to contain a segmentation violation in njs_promise_reaction_job. NOTE: the vendor dispu…

  • Medium 5.4
    CVE-2022-43165 Scanner template

    A stored cross-site scripting (XSS) vulnerability in the Global Variables feature (/index.php?module=global_vars/vars) …

  • High 7.8
    CVE-2022-43281

    wasm-interp v1.0.29 was discovered to contain a heap overflow via the component std::vector<wabt::Type, std::allocator<…

    wabt wabt wabt Debian Ubuntu PyPI
  • High 7.1
    CVE-2022-43282

    wasm-interp v1.0.29 was discovered to contain an out-of-bounds read via the component OnReturnCallIndirectExpr->GetRetu…

    wabt wabt Debian Ubuntu
  • Critical 9.8
    CVE-2022-43286

    Nginx NJS v0.7.2 was discovered to contain a heap-use-after-free bug caused by illegal memory copy in the function njs_…

  • Medium 5.5
    CVE-2022-43283

    wasm2c v1.0.29 was discovered to contain an abort in CWriter::Write.

    wabt wabt Debian Ubuntu
  • High 8.8
    CVE-2021-35387

    Hospital Management System v 4.0 is vulnerable to SQL Injection via file:hospital/hms/admin/view-patient.php.

  • Medium 5.4
    CVE-2021-35388

    Hospital Management System v 4.0 is vulnerable to Cross Site Scripting (XSS) via /hospital/hms/admin/patient-search.php.

  • Critical 9.8
    CVE-2021-38217

    SEMCMS v 1.2 is vulnerable to SQL Injection via SEMCMS_User.php.

  • Critical 9.8
    CVE-2021-38737

    SEMCMS v 1.1 is vulnerable to SQL Injection via Ant_Pro.php.

  • Critical 9.8
    CVE-2021-38730

    SEMCMS SHOP v 1.1 is vulnerable to SQL Injection via Ant_Info.php.

  • Critical 9.8
    CVE-2021-38734

    SEMCMS SHOP v 1.1 is vulnerable to SQL Injection via Ant_Menu.php.

  • Critical 9.8
    CVE-2021-38729

    SEMCMS SHOP v 1.1 is vulnerable to SQL Injection via Ant_Plist.php.

  • Critical 9.8
    CVE-2021-38736

    SEMCMS Shop V 1.1 is vulnerable to SQL Injection via Ant_Global.php.

  • Critical 9.8
    CVE-2021-38733

    SEMCMS SHOP v 1.1 is vulnerable to SQL Injection via Ant_BlogCat.php.

  • Medium 6.1
    CVE-2021-38728

    SEMCMS SHOP v 1.1 is vulnerable to Cross Site Scripting (XSS) via Ant_M_Coup.php.