Skip to content
OpenAdvisories

Archive

26 December 2022

Vulnerabilities first published on this day (UTC), newest first.

← November 2022 2022 / December /26 January 2023 →
  1. 147
  2. 294
  3. 311
  4. 412
  5. 5107
  6. 695
  7. 779
  8. 8101
  9. 935
  10. 106
  11. 119
  12. 1288
  13. 13222
  14. 1488
  15. 15109
  16. 16189
  17. 1723
  18. 1836
  19. 19104
  20. 2085
  21. 2189
  22. 22218
  23. 23106
  24. 2414
  25. 2545
  26. 2688
  27. 2781
  28. 2855
  29. 2920
  30. 30102
  31. 3113
All Critical High Medium Low Exploited only Public exploit

57 results · Clear filters · Feed

  • Medium 6.1
    CVE-2022-37310

    OX App Suite through 7.10.6 allows XSS via a malicious capability to the metrics or help module, as demonstrated by a /…

  • Medium 6.1
    CVE-2022-37308

    OX App Suite through 7.10.6 allows XSS via HTML in text/plain e-mail messages.

  • Medium 6.1
    CVE-2022-37307

    OX App Suite through 7.10.6 allows XSS via XHTML CDATA for a snippet, as demonstrated by the onerror attribute of an IM…

  • Medium 5.3
    CVE-2022-37312

    OX App Suite through 7.10.6 has Uncontrolled Resource Consumption via a large request body containing a redirect URL to…

  • Medium 5.3
    CVE-2022-37313

    OX App Suite through 7.10.6 allows SSRF because the anti-SSRF protection mechanism only checks the first DNS AA or AAAA…

  • Medium 5.3
    CVE-2021-35952

    fastrack Reflex 2.0 W307S_REFLEX_v90.89 Activity Tracker allows a Remote attacker to change the time, date, and month v…

  • Medium 6.5
    CVE-2021-39369

    In Philips (formerly Carestream) Vue MyVue PACS through 12.2.x.x, the VideoStream function allows Path Traversal by aut…

  • Medium 6.1
    CVE-2021-30134 Scanner template

    php-mod/curl allows Cross-site Scripting

    php-mod/curl (a wrapper of the PHP cURL extension) before 2.3.2 allows XSS via the post_file_path_upload.php key parameter and the POST data to post_multidimensional.php.

    php-mod/curl Packagist
  • Medium 5.3
    CVE-2021-44856

    An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. A title blocked by …

    mediawiki mediawiki Debian Ubuntu
  • Medium 5.4
    CVE-2021-44855

    An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. There is Blind Stor…

    mediawiki mediawiki Debian Ubuntu
  • Medium 5.3
    CVE-2021-44854

    An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. The REST API public…

    mediawiki mediawiki Debian Ubuntu
  • Medium 5.5
    CVE-2021-43395

    An issue was discovered in illumos before f859e7171bb5db34321e45585839c6c3200ebb90, OmniOS Community Edition r151038, O…

  • Medium 6.5
    CVE-2019-18177

    In certain Citrix products, information disclosure can be achieved by an authenticated VPN user when there is a configu…

  • Medium 6.5
    CVE-2019-13988

    Sierra Wireless MGOS before 3.15.2 and 4.x before 4.3 allows attackers to read log files via a Direct Request (aka Forc…

  • Medium 5.3
    CVE-2019-19030 Public exploit

    Unauthenticated users can exploit an enumeration vulnerability in Harbor (CVE-2019-19030)

    Cloud Native Computing Foundation Harbor before 1.10.3 and 2.x before 2.0.1 allows resource enumeration because unauthenticated API calls reveal (via the HTTP status code) whether a resource exists.

    github.com/goharbor/harbor Go
  • Medium 5.3
    CVE-2019-9011

    In Pilz PMC programming tool 3.x before 3.5.17 (based on CODESYS Development System), an attacker can identify valid us…

  • Medium 5.3
    CVE-2019-14802

    Hashicorp Nomad Information Exposure Through Environmental Variables

    HashiCorp Nomad 0.5.0 through 0.9.4 (fixed in 0.9.5) reveals unintended environment variables to the rendering task during template rendering, aka GHSA-6hv3-7c34-4hx8. This applies to nomad/client/allocrunner/taskrunner/template.

    nomad github.com/hashicorp/nomad nomad Ubuntu Alpine Go