Skip to content
OpenAdvisories

Archive

3 November 2022

Vulnerabilities first published on this day (UTC), newest first.

← October 2022 2022 / November /3 December 2022 →
  1. 1211
  2. 273
  3. 3120
  4. 437
  5. 52
  6. 66
  7. 763
  8. 8120
  9. 9179
  10. 1092
  11. 1191
  12. 1211
  13. 1315
  14. 1497
  15. 15108
  16. 1644
  17. 1788
  18. 18105
  19. 195
  20. 208
  21. 2190
  22. 2284
  23. 2398
  24. 2421
  25. 2559
  26. 264
  27. 278
  28. 2867
  29. 2986
  30. 3057
All Critical High Medium Low Exploited only Public exploit

60 results · Clear filters · Feed

  • Medium 5.5
    CVE-2022-40276

    Zettlr version 2.3.0 allows an external attacker to remotely obtain arbitrary local files on any client that attempts t…

  • Medium 6.5
    CVE-2022-40230

    "IBM MQ Appliance 9.2 CD, 9.2 LTS, 9.3 CD, and LTS 9.3 does not invalidate session after logout which could allow an au…

  • Medium 6.5
    CVE-2022-40235

    "IBM InfoSphere Information Server 11.7 could allow a user to cause a denial of service by removing the ability to run …

  • Medium 6.5
    CVE-2022-44624

    In JetBrains TeamCity version before 2022.10, Password parameters could be exposed in the build log if they contained s…

    JetBrains TeamCity
  • Medium 6.5
    CVE-2022-44623

    In JetBrains TeamCity version before 2022.10, Project Viewer could see scrambled secure values in the MetaRunner settin…

    JetBrains TeamCity
  • Medium 5.5
    CVE-2022-41710

    Markdownify has Files or Directories Accessible to External Parties

    Markdownify version 1.4.1 allows an external attacker to remotely obtain arbitrary local files on any client that attempts to view a malicious markdown file through Markdownify. This is possible because the application does not have a CSP policy (or at least …

    electron-markdownify npm
  • Medium 5.3
    CVE-2022-41713

    deep-object-diff 1.1.0 - Prototype Pollution

    deep-object-diff version 1.1.0 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the '__proto__' property to be edited.

    deep-object-diff npm
  • Medium 5.3
    CVE-2022-41714

    fastest-json-copy 1.0.1 - Prototype Pollution

    fastest-json-copy version 1.0.1 allows an external attacker to edit or add new properties to an object. This is possible because the application does not correctly validate the incoming JSON keys, thus allowing the '__proto__' property to be edited.

    fastest-json-copy npm
  • Medium 5.4
    CVE-2022-41435

    OpenWRT LuCI version git-22.140.66206-02913be was discovered to contain a stored cross-site scripting (XSS) vulnerabili…

  • Medium 6.1
    CVE-2022-42753

    SalonERP version 3.0.2 allows an external attacker to steal the cookie of arbitrary users. This is possible because the…

  • Medium 6.1
    CVE-2022-42747 Scanner template

    CandidATS version 3.0.0 on 'sortBy' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbi…

  • Medium 5.3
    CVE-2022-42743

    deep-parse-json 1.0.2 - Prototype Pollution

    deep-parse-json version 1.0.2 allows an external attacker to edit or add new properties to an object. This is possible because the application does not correctly validate the incoming JSON keys, thus allowing the '__proto__' property to be edited.

    deep-parse-json npm
  • Medium 6.1
    CVE-2022-42748 Scanner template

    CandidATS version 3.0.0 on 'sortDirection' of the 'ajax.php' resource, allows an external attacker to steal the cookie …

  • Medium 6.1
    CVE-2022-42749 Scanner template

    CandidATS version 3.0.0 on 'page' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitr…

  • Medium 6.1
    CVE-2022-42746 Scanner template

    CandidATS version 3.0.0 on 'indexFile' of the 'ajax.php' resource, allows an external attacker to steal the cookie of a…

  • Medium 6.5
    CVE-2022-22442

    "IBM InfoSphere Information Server 11.7 could allow an authenticated user to access information restricted to users wit…

  • Medium 4.8
    CVE-2022-43372

    Emlog Pro v1.7.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability at /admin/store.php.

  • Medium 4.4
    CVE-2021-39077

    IBM Security Guardium information disclosure

    IBM Security Guardium 10.5, 10.6, 11.0, 11.1, 11.2, 11.3, and 11.4 stores user credentials in plain clear text which can be read by a local privileged user. IBM X-Force ID: 215587.

    IBM Security Guardium
  • Medium 5.9
    CVE-2021-46853

    Alpine before 2.25 allows remote attackers to cause a denial of service (application crash) when LIST or LSUB is sent b…

    alpine alpine Debian Ubuntu
  • Medium 4.9
    CVE-2021-37823

    OpenCart SQL injection vulnerability

    OpenCart 3.0.3.7 allows users to obtain database information or read server files through SQL injection in the background.

    opencart/opencart Packagist