Skip to content
OpenAdvisories

Archive

31 January 2023

Vulnerabilities first published on this day (UTC), newest first.

← December 2022 2023 / January /31 February 2023 →
  1. 123
  2. 276
  3. 394
  4. 480
  5. 584
  6. 678
  7. 748
  8. 818
  9. 965
  10. 10215
  11. 11149
  12. 12103
  13. 1380
  14. 1428
  15. 1531
  16. 1667
  17. 17164
  18. 1893
  19. 1956
  20. 20103
  21. 219
  22. 227
  23. 2394
  24. 24125
  25. 2560
  26. 26174
  27. 2786
  28. 287
  29. 2912
  30. 30102
  31. 3151
All Critical High Medium Low Exploited only Public exploit

15 results · Clear filters · Feed

  • Medium 6.5
    CVE-2022-44644

    Apache Linkis (incubating): The DatasourceManager module has a Local File Read Vulnerability

    In Apache Linkis <=1.3.0 when used with the MySQL Connector/J in the data source module, an authenticated attacker could read arbitrary local files by connecting a rogue MySQL server, By adding allowLoadLocalInfile to true in the JDBC parameter. Therefore, th…

    Apache Software Foundation Apache Linkis (incubating) org.apache.linkis:linkis Maven
  • Medium 5.5
    CVE-2023-0593

    Path traversal in yaffshiv

    A path traversal vulnerability affects yaffshiv YAFFS filesystem extractor. By crafting a malicious YAFFS file, an attacker could force yaffshiv to write outside of the extraction directory. This issue affects yaffshiv up to version 0.1 included, which is the…

    devttys0 yaffshiv
  • Medium 5.5
    CVE-2023-0592

    Path traversal in jefferson

    A path traversal vulnerability affects jefferson's JFFS2 filesystem extractor. By crafting malicious JFFS2 files, attackers could force jefferson to write outside of the extraction directory.This issue affects jefferson: before 0.4.1.

    sviehb jefferson
  • Medium 5.5
    CVE-2023-0591

    Path Traversal in ubi_reader

    ubireader_extract_files is vulnerable to path traversal when run against specifically crafted UBIFS files, allowing the attacker to overwrite files outside of the extraction directory (provided the process has write access to that file or directory). This is …

    jrspruitt ubi_reader ubi-reader PyPI
  • Medium 5.4
    CVE-2022-25979

    jSuites subect to Cross-site Scripting

    Versions of the package jsuites before 5.0.1 are vulnerable to Cross-site Scripting (XSS) due to improper user-input sanitization in the Editor() function.

    jsuites npm
  • Medium 5.3
    CVE-2022-25881

    http-cache-semantics vulnerable to Regular Expression Denial of Service

    This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library.

    nodejs nodejs-nodemon http-cache-semantics org.webjars.npm:http-cache-semantics Azure Linux npm Maven
  • Medium 5.9
    CVE-2022-4041

    Privilege Escalation Vulnerability in Hitachi Storage Plug-in for VMware vCenter

    Incorrect Privilege Assignment vulnerability in Hitachi Storage Plug-in for VMware vCenter allows remote authenticated users to cause privilege escalation. This issue affects Hitachi Storage Plug-in for VMware vCenter: from 04.8.0 before 04.9.1.

    Hitachi Hitachi Storage Plug-in for VMware vCenter Virtualization
  • Medium 5.3
    CVE-2022-40258

    Weak password hashes for Redfish & API

    AMI Megarac Weak password hashes for Redfish & API

    AMI MegaRAC SPx-12 MegaRAC SPx-13
  • Medium 6.5
    CVE-2022-39061

    ChangingTec MegaServiSignAdapter - Out-of-bounds Read

    ChangingTech MegaServiSignAdapter component has a vulnerability of Out-of-bounds Read due to insufficient validation for parameter length. An unauthenticated remote attacker can exploit this vulnerability to access partial sensitive content in memory and disr…

    ChangingTec MegaServiSignAdapter
  • Medium 5.4
    CVE-2022-4898

    In affected versions of Octopus Server the help sidebar can be customized to include a Cross-Site Scripting payload in …

    Octopus Deploy Octopus Server
  • Medium 6.1
    CVE-2022-45598

    Joplin Desktop App vulnerable to Cross-site Scripting

    Cross Site Scripting vulnerability in Joplin Desktop App before v2.9.17 allows attacker to execute arbitrary code via improper santization.

    joplin npm
  • Medium 6.8
    CVE-2022-45435

    SailPoint IdentityIQ Access Control Bypass

    IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p2, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p5, IdentityIQ 8.1 and all 8.1 patch levels prior to 8.1p7, IdentityIQ 8.0 and all 8.0 patch levels prior to 8.0p6, and all prior versions allow authen…

    SailPoint IdentityIQ
  • Medium 6.1
    CVE-2022-44897

    A cross-site scripting (XSS) vulnerability in ApolloTheme AP PageBuilder component through 2.4.4 allows attackers to ex…

  • Medium 6.1
    CVE-2022-47701

    COMFAST (Shenzhen Sihai Zhonglian Network Technology Co., Ltd) CF-WR623N Router firmware V2.3.0.1 is vulnerable to Cros…

  • Medium 6.1
    CVE-2022-47698

    COMFAST (Shenzhen Sihai Zhonglian Network Technology Co., Ltd) CF-WR623N Router firmware V2.3.0.1 is vulnerable to Cros…