Skip to content
OpenAdvisories

Archive

14 November 2022

Vulnerabilities first published on this day (UTC), newest first.

← October 2022 2022 / November /14 December 2022 →
  1. 1211
  2. 273
  3. 3120
  4. 437
  5. 52
  6. 66
  7. 763
  8. 8120
  9. 9179
  10. 1092
  11. 1191
  12. 1211
  13. 1315
  14. 1497
  15. 15108
  16. 1644
  17. 1788
  18. 18105
  19. 195
  20. 208
  21. 2190
  22. 2284
  23. 2398
  24. 2421
  25. 2559
  26. 264
  27. 278
  28. 2867
  29. 2986
  30. 3057
All Critical High Medium Low Exploited only Public exploit

58 results · Clear filters · Feed

  • Medium 4.3
    CVE-2022-41913

    Discourse-calendar exposes members of hidden groups

    Discourse-calendar is a plugin for the Discourse messaging platform which adds the ability to create a dynamic calendar in the first post of a topic. Members of private groups or public groups with private members can be listed by users, who can create and ed…

    Discourse discourse-calendar
  • Medium 6.1
    CVE-2022-42110

    Liferay Portal and Liferay DXP Vulnerable to XSS via the Announcements Module

    A Cross-site scripting (XSS) vulnerability in the Announcements module in Liferay Portal 7.1.0 through 7.4.2, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script …

    com.liferay.portal:release.dxp.bom com.liferay:com.liferay.announcements.web Maven
  • Medium 5.5
    CVE-2022-37290

    GNOME Nautilus 42.2 allows a NULL pointer dereference and get_basename application crash via a pasted ZIP archive.

    nautilus nautilus caja nemo Debian Ubuntu
  • Medium 6.5
    CVE-2022-43686

    Concrete CMS vulnerable to Uncontrolled Resource Consumption leading to DoS

    In Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2, the authTypeConcreteCookieMap table can be filled up causing a denial of service (high load).

    concrete5/concrete5 Packagist
  • Medium 5.4
    CVE-2022-43342

    A stored cross-site scripting (XSS) vulnerability in the Add function of Eramba GRC Software c2.8.1 allows attackers to…

  • Medium 6.1
    CVE-2022-43967

    Concrete CMS vulnerable to Cross-site Scripting via multilingual report

    Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Reflected XSS in the multilingual report due to un-sanitized output. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+.

    concrete5/concrete5 Packagist
  • Medium 6.1
    CVE-2022-43692

    Concrete CMS vulnerable to Reflected Cross-site Scripting

    Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Reflected XSS - user can cause an administrator to trigger reflected XSS with a url if the targeted administrator is using an old browser that lacks XSS protection. Re…

    concrete5/concrete5 Packagist
  • Medium 4.8
    CVE-2022-43688

    Concrete CMS vulnerable to Cross-site Scripting

    Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Stored Cross-Site Scripting (XSS) in icons since the Microsoft application tile color is not sanitized. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+.

    concrete5/concrete5 Packagist
  • Medium 6.1
    CVE-2022-43694

    Concrete CMS vulnerable to Reflected Cross-site Scripting via image manipulation library

    Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Reflected XSS in the image manipulation library due to un-sanitized output.

    concrete5/concrete5 Packagist
  • Medium 5.3
    CVE-2022-43689

    Concrete CMS vulnerable to XML External Entity

    Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to XXE based DNS requests leading to IP disclosure.

    concrete5/concrete5 Packagist
  • Medium 4.8
    CVE-2022-43695

    Concrete CMS Cross-site Scripting vulnerability

    Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Stored Cross-Site Scripting (XSS) in dashboard/system/express/entities/associations because Concrete CMS allows association with an entity name that doesn’t exist or, …

    concrete5/concrete5 Packagist
  • Medium 6.1
    CVE-2022-43968

    Concrete CMS vulnerable to Reflected Cross-Site Scripting via dashboard icons

    Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Reflected XSS in the dashboard icons due to un-sanitized output. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+.

    concrete5/concrete5 Packagist
  • Medium 5.3
    CVE-2022-43691

    Concrete CMS vulnerable to Cleartext Transmission of Sensitive Information

    Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 inadvertently disclose server-side sensitive information (secrets in environment variables and server information) when Debug Mode is left on in production.

    concrete5/concrete5 Packagist
  • Medium 6.3
    CVE-2022-43690

    Concrete CMS vulnerable to Improper Authentication

    Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 did not use strict comparison for the legacy_salt so that limited authentication bypass could occur if using this functionality. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+.

    concrete5/concrete5 Packagist
  • Medium 5.5
    CVE-2022-43295

    XPDF v4.04 was discovered to contain a stack overflow via the function FileStream::copy() at xpdf/Stream.cc:795.

    ipe xpdf Ubuntu Alpine
  • Medium 5.4
    CVE-2022-43687

    Concrete CMS vulnerable to Session Fixation

    Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 does not issue a new session ID upon successful OAuth authentication. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+.

    concrete5/concrete5 Packagist
  • Medium 5.3
    CVE-2021-38828

    Xiongmai Camera XM-JPR2-LX V4.02.R12.A6420987.10002.147502.00000 is vulnerable to plain-text traffic sniffing.

  • Medium 6.1
    CVE-2021-40272 Scanner template

    OP5 Monitor 8.3.1, 8.3.2, and OP5 8.3.3 are vulnerable to Cross Site Scripting (XSS).