Skip to content
OpenAdvisories

Archive

29 December 2022

Vulnerabilities first published on this day (UTC), newest first.

← November 2022 2022 / December /29 January 2023 →
  1. 147
  2. 294
  3. 311
  4. 412
  5. 5107
  6. 695
  7. 779
  8. 8101
  9. 935
  10. 106
  11. 119
  12. 1288
  13. 13222
  14. 1488
  15. 15109
  16. 16189
  17. 1723
  18. 1836
  19. 19104
  20. 2085
  21. 2189
  22. 22218
  23. 23106
  24. 2414
  25. 2545
  26. 2688
  27. 2781
  28. 2855
  29. 2920
  30. 30102
  31. 3113
All Critical High Medium Low Exploited only Public exploit

20 results · Feed

  • Medium 6.1
    CVE-2022-46181

    Gotify server XSS vulnerability in the application image file upload

    Gotify server is a simple server for sending and receiving messages in real-time per WebSocket. Versions prior to 2.2.2 contain an XSS vulnerability that allows authenticated users to upload .html files. An attacker could execute client side scripts **if** an…

    gotify server github.com/gotify/server github.com/gotify/server/v2 Go
  • High 7.4
    CVE-2022-46178

    Path Traversal In MeterSpere allows file upload to any path

    MeterSphere is a one-stop open source continuous testing platform, covering test management, interface testing, UI testing and performance testing. Versions prior to 2.5.1 allow users to upload a file, but do not validate the file name, which may lead to uplo…

    metersphere metersphere io.metersphere:metersphere Maven
  • Low 3.5
    CVE-2021-4296

    w3c Unicorn ValidatorNuMessage.java ValidatorNuMessage cross site scripting

    A vulnerability, which was classified as problematic, has been found in w3c Unicorn. This issue affects the function ValidatorNuMessage of the file src/org/w3c/unicorn/response/impl/ValidatorNuMessage.java. The manipulation of the argument message leads to cr…

    w3c Unicorn
  • Medium 5.5
    CVE-2021-4295

    ONC code-validator-api XML CodeValidatorApiConfiguration.java vocabularyValidationConfigurations xml external entity reference

    A vulnerability classified as problematic was found in ONC code-validator-api up to 1.0.30. This vulnerability affects the function vocabularyValidationConfigurations of the file src/main/java/org/sitenv/vocabularies/configuration/CodeValidatorApiConfiguratio…

    ONC code-validator-api
  • Medium 4.2
    CVE-2018-25058

    Twitter-Post-Fetcher Link Target twitterFetcher.js reverse tabnabbing

    A vulnerability classified as problematic has been found in Twitter-Post-Fetcher up to 17.x. This affects an unknown part of the file js/twitterFetcher.js of the component Link Target Handler. The manipulation leads to use of web link to untrusted target with…

    twitter-fetcher-js npm
  • High 7.5
    GHSA-9h6h-9g78-86f7

    Yapscan's report receiver server vulnerable to path traversal and log injection

    ### Impact If you make use of the **report receiver server** (experimental), a client may be able to forge requests such that arbitrary files on the host can be overwritten (subject to permissions of the yapscan server), leading to loss of data. This is parti…

    github.com/fkie-cad/yapscan Go
  • High 8.3
    CVE-2022-4847

    Incorrectly Specified Destination in a Communication Channel in usememos/memos

    Incorrectly Specified Destination in a Communication Channel in GitHub repository usememos/memos prior to 0.9.1.

    usememos usememos/memos github.com/usememos/memos Go
  • Medium 6.5
    CVE-2022-4850

    Cross-Site Request Forgery (CSRF) in usememos/memos

    Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.

    usememos usememos/memos github.com/usememos/memos Go
  • High 8.6
    CVE-2022-4848

    Improper Verification of Source of a Communication Channel in usememos/memos

    Improper Verification of Source of a Communication Channel in GitHub repository usememos/memos prior to 0.9.1.

    usememos usememos/memos github.com/usememos/memos Go
  • High 8.0
    CVE-2022-4839

    Cross-site Scripting (XSS) - Stored in usememos/memos

    Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1.

    usememos usememos/memos github.com/usememos/memos Go
  • High 7.6
    CVE-2022-4840

    Cross-site Scripting (XSS) - Stored in usememos/memos

    Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1.

    usememos usememos/memos github.com/usememos/memos Go
  • Medium 6.3
    CVE-2022-4846

    Cross-Site Request Forgery (CSRF) in usememos/memos

    Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.

    usememos usememos/memos github.com/usememos/memos Go
  • Medium 6.7
    CVE-2022-4845

    Cross-Site Request Forgery (CSRF) in usememos/memos

    Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.

    usememos usememos/memos github.com/usememos/memos Go
  • Critical 9.8
    CVE-2022-4851

    Improper Handling of Values in usememos/memos

    Improper Handling of Values in GitHub repository usememos/memos prior to 0.9.1.

    usememos usememos/memos github.com/usememos/memos Go
  • Medium 4.4
    CVE-2022-4843

    NULL Pointer Dereference in radareorg/radare2

    NULL Pointer Dereference in GitHub repository radareorg/radare2 prior to 5.8.2.

    radareorg radareorg/radare2 radare2 Ubuntu
  • High 8.3
    CVE-2022-4849

    Cross-Site Request Forgery (CSRF) in usememos/memos

    Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.

    usememos usememos/memos github.com/usememos/memos Go
  • Medium 6.5
    CVE-2022-4844

    Cross-Site Request Forgery (CSRF) in usememos/memos

    Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.

    usememos usememos/memos github.com/usememos/memos Go
  • High 8.6
    CVE-2022-4841

    Cross-site Scripting (XSS) - Stored in usememos/memos

    Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1.

    usememos usememos/memos github.com/usememos/memos Go
  • Critical 9.1
    CVE-2022-36437

    Hazelcast connection caching

    The Connection handler in Hazelcast and Hazelcast Jet allows a remote unauthenticated attacker to access and manipulate data in the cluster with the identity of another already authenticated connection. The affected Hazelcast versions are through 4.0.6, 4.1.9…

    com.hazelcast:hazelcast com.hazelcast:hazelcast-enterprise com.hazelcast.jet:hazelcast-jet com.hazelcast.jet:hazelcast-jet-enterprise Maven
  • Medium 6.1
    CVE-2022-30519 Public exploit

    XSS in signing form in Reprise Software RLM License Administration v14.2BL4 allows remote attacker to inject arbitrary …