2022 CVEs (page 253)
Page 253 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-0114 | High | 8.1 | 2022-02-12 | Out of bounds memory access in Blink Serial API in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to perform an out of bounds memory read via a… |
CVE-2022-0113 | Medium | 6.5 | 2022-02-12 | Inappropriate implementation in Blink in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2022-0112 | Medium | 4.3 | 2022-02-12 | Incorrect security UI in Browser UI in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to display missing URL or incorrect URL via a crafted URL. |
CVE-2022-0111 | Medium | 6.5 | 2022-02-12 | Inappropriate implementation in Navigation in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to incorrectly set origin via a crafted HTML page. |
CVE-2022-0110 | Medium | 4.3 | 2022-02-12 | Incorrect security UI in Autofill in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted… |
CVE-2022-0109 | Medium | 6.5 | 2022-02-12 | Inappropriate implementation in Autofill in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to obtain potentially sensitive information via a cra… |
CVE-2022-0108 | Medium | 6.5 | 2022-02-12 | Inappropriate implementation in Navigation in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2022-0107 | High | 8.8 | 2022-02-12 | Use after free in File Manager API in Google Chrome on Chrome OS prior to 97.0.4692.71 allowed an attacker who convinced a user to install a malicious extensio… |
CVE-2022-0106 | High | 8.8 | 2022-02-12 | Use after free in Autofill in Google Chrome prior to 97.0.4692.71 allowed a remote attacker who convinced a user to perform specific user gesture to potentiall… |
CVE-2022-0105 | High | 8.8 | 2022-02-12 | Use after free in PDF Accessibility in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
CVE-2022-0104 | High | 8.8 | 2022-02-12 | Heap buffer overflow in ANGLE in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2022-0103 | High | 8.8 | 2022-02-12 | Use after free in SwiftShader in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2022-0102 | High | 8.8 | 2022-02-12 | Type confusion in V8 in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2022-0101 | High | 8.8 | 2022-02-12 | Heap buffer overflow in Bookmarks in Google Chrome prior to 97.0.4692.71 allowed a remote attacker who convinced a user to perform specific user gesture to pot… |
CVE-2022-0100 | High | 8.8 | 2022-02-12 | Heap buffer overflow in Media streams API in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to potentially exploit heap corruption via a crafted… |
CVE-2022-0099 | High | 8.8 | 2022-02-12 | Use after free in Sign-in in Google Chrome prior to 97.0.4692.71 allowed a remote attacker who convinced a user to perform specific user gestures to potentiall… |
CVE-2022-0098 | High | 8.8 | 2022-02-12 | Use after free in Screen Capture in Google Chrome on Chrome OS prior to 97.0.4692.71 allowed an attacker who convinced a user to perform specific user gestures… |
CVE-2022-0097 | Critical | 9.6 | 2022-02-12 | Inappropriate implementation in DevTools in Google Chrome prior to 97.0.4692.71 allowed an attacker who convinced a user to install a malicious extension to to… |
CVE-2022-0096 | High | 8.8 | 2022-02-12 | Use after free in Storage in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2022-24968 | Medium | 5.9 | 2022-02-11 | In Mellium mellium.im/xmpp through 0.21.0, an attacker capable of spoofing DNS TXT records can redirect a WebSocket connection request to a server under their… |
CVE-2022-23634 | High | 8.0 | 2022-02-11 | Puma is a Ruby/Rack web server built for parallelism. Prior to `puma` version `5.6.2`, `puma` may not always call `close` on the response body. Rails, prior to… |
CVE-2022-23633 | High | 7.4 | 2022-02-11 | Action Pack is a framework for handling and responding to web requests. Under certain circumstances response bodies will not be closed. In the event a response… |
CVE-2022-24975 | High | 7.5 | 2022-02-11 | The --mirror documentation for Git through 2.35.1 does not mention the availability of deleted content, aka the "GitBleed" issue. This could present a security… |
CVE-2022-22766 | High | 7.0 | 2022-02-11 | Hardcoded credentials are used in specific BD Pyxis products. If exploited, threat actors may be able to gain access to the underlying file system and could po… |
CVE-2022-24927 | Medium | 4.2 | 2022-02-11 | Improper privilege management vulnerability in Samsung Video Player prior to version 7.3.15.30 allows attackers to execute video files without permission. |
CVE-2022-24926 | Medium | 5.7 | 2022-02-11 | Improper input validation vulnerability in SmartTagPlugin prior to version 1.2.15-6 allows privileged attackers to trigger a XSS on a victim's devices. |
CVE-2022-24925 | Medium | 4.4 | 2022-02-11 | Improper input validation vulnerability in SettingsProvider prior to Android S(12) allows privileged attackers to trigger a permanent denial of service attack… |
CVE-2022-24924 | Low | 2.2 | 2022-02-11 | An improper access control in LiveWallpaperService prior to versions 3.0.9.0 allows to create a specific named system directory without a proper permission. |
CVE-2022-24923 | Medium | 4.0 | 2022-02-11 | Improper access control vulnerability in Samsung SearchWidget prior to versions 2.3.00.6 in China models allows untrusted applications to load arbitrary URL an… |
CVE-2022-24003 | Medium | 4.0 | 2022-02-11 | Exposure of Sensitive Information vulnerability in Bixby Vision prior to version 3.7.50.6 allows attackers to access internal data of Bixby Vision via unprotec… |
CVE-2022-24002 | Medium | 4.0 | 2022-02-11 | Improper Authorization vulnerability in Link Sharing prior to version 12.4.00.3 allows attackers to open protected activity via PreconditionActivity. |
CVE-2022-24001 | Low | 3.8 | 2022-02-11 | Information disclosure vulnerability in Edge Panel prior to Android S(12) allows physical attackers to access screenshot in clipboard via Edge Panel. |
CVE-2022-24000 | Low | 3.9 | 2022-02-11 | PendingIntent hijacking vulnerability in DataUsageReminderReceiver prior to SMR Feb-2022 Release 1 allows local attackers to access media files without permiss… |
CVE-2022-23999 | Low | 3.9 | 2022-02-11 | PendingIntent hijacking vulnerability in CpaReceiver prior to SMR Feb-2022 Release 1 allows local attackers to access media files without permission in KnoxPri… |
CVE-2022-23998 | Medium | 6.2 | 2022-02-11 | Improper access control vulnerability in Camera prior to versions 11.1.02.16 in Android R(11), 10.5.03.77 in Android Q(10) and 9.0.6.68 in Android P(9) allows… |
CVE-2022-23997 | Medium | 4.0 | 2022-02-11 | Unprotected component vulnerability in StTheaterModeDurationAlarmReceiver in Wear OS 3.0 prior to Firmware update Feb-2022 Release allows untrusted application… |
CVE-2022-23996 | Medium | 4.0 | 2022-02-11 | Unprotected component vulnerability in StTheaterModeReceiver in Wear OS 3.0 prior to Firmware update Feb-2022 Release allows untrusted applications to enable b… |
CVE-2022-23995 | Medium | 4.0 | 2022-02-11 | Unprotected component vulnerability in StBedtimeModeAlarmReceiver in Wear OS 3.0 prior to Firmware update Feb-2022 Release allows untrusted applications to cha… |
CVE-2022-23994 | Low | 3.3 | 2022-02-11 | An Improper access control vulnerability in StBedtimeModeReceiver in Wear OS 3.0 prior to Firmware update Feb-2022 Release allows untrusted applications to cha… |
CVE-2022-23853 | High | 7.8 | 2022-02-11 | The LSP (Language Server Protocol) plugin in KDE Kate before 21.12.2 and KTextEditor before 5.91.0 tries to execute the associated LSP server binary when openi… |
CVE-2022-23707 | Medium | 5.4 | 2022-02-11 | An XSS vulnerability was found in Kibana index patterns. Using this vulnerability, an authenticated user with permissions to create index patterns can inject m… |
CVE-2022-23434 | Medium | 4.4 | 2022-02-11 | A vulnerability using PendingIntent in Bixby Vision prior to versions 3.7.60.8 in Android S(12), 3.7.50.6 in Andorid R(11) and below allows attackers to execut… |
CVE-2022-23433 | Medium | 4.3 | 2022-02-11 | Improper access control vulnerability in Reminder prior to versions 12.3.01.3000 in Android S(12), 12.2.05.6000 in Android R(11) and 11.6.08.6000 in Andoid Q(1… |
CVE-2022-23432 | Medium | 6.4 | 2022-02-11 | An improper input validation in SMC_SRPMB_WSM handler of RPMB ldfw prior to SMR Feb-2022 Release 1 allows arbitrary memory write and code execution. |
CVE-2022-23431 | Medium | 6.4 | 2022-02-11 | An improper boundary check in RPMB ldfw prior to SMR Feb-2022 Release 1 allows arbitrary memory write and code execution. |
CVE-2022-23429 | Medium | 5.3 | 2022-02-11 | An improper boundary check in audio hal service prior to SMR Feb-2022 Release 1 allows attackers to read invalid memory and it leads to application crash. |
CVE-2022-23428 | High | 8.4 | 2022-02-11 | An improper boundary check in eden_runtime hal service prior to SMR Feb-2022 Release 1 allows arbitrary memory write and code execution. |
CVE-2022-23427 | Low | 3.9 | 2022-02-11 | PendingIntent hijacking vulnerability in KnoxPrivacyNoticeReceiver prior to SMR Feb-2022 Release 1 allows local attackers to access media files without permiss… |
CVE-2022-23426 | Medium | 4.4 | 2022-02-11 | A vulnerability using PendingIntent in DeX Home and DeX for PC prior to SMR Feb-2022 Release 1 allows attackers to access files with system privilege. |
CVE-2022-23425 | High | 8.6 | 2022-02-11 | Improper input validation in Exynos baseband prior to SMR Feb-2022 Release 1 allows attackers to send arbitrary NAS signaling messages with fake base station. |
CVE-2022-22292 | High | 7.1 | 2022-02-11 | Unprotected dynamic receiver in Telecom prior to SMR Feb-2022 Release 1 allows untrusted applications to launch arbitrary activity. |
CVE-2022-22291 | Medium | 5.5 | 2022-02-11 | Logging of excessive data vulnerability in telephony prior to SMR Feb-2022 Release 1 allows privileged attackers to get Cell Location Information through log o… |
CVE-2022-0562 | Medium | 5.5 | 2022-02-11 | Null source pointer passed as an argument to memcpy() function within TIFFReadDirectory() in tif_dirread.c in libtiff versions from 4.0 to 4.3.0 could lead to… |
CVE-2022-0561 | Medium | 5.5 | 2022-02-11 | Null source pointer passed as an argument to memcpy() function within TIFFFetchStripThing() in tif_dirread.c in libtiff versions from 3.9.0 to 4.3.0 could lead… |
CVE-2022-0483 | High | 7.8 | 2022-02-11 | Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis VSS Doctor (Windows) before build 53 |
CVE-2022-0382 | Medium | 5.5 | 2022-02-11 | An information leak flaw was found due to uninitialized memory in the Linux kernel's TIPC protocol subsystem, in the way a user sends a TIPC datagram to one or… |
CVE-2022-0185 | High | 8.4 | 2022-02-11 | A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functionality of the Linux kernel verified the… |
CVE-2022-24289 | High | 8.8 | 2022-02-11 | Hessian serialization is a network protocol that supports object-based transmission. Apache Cayenne's optional Remote Object Persistence (ROP) feature is a web… |
CVE-2022-24112 | Critical | 9.8 | 2022-02-11 | An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with defa… |
CVE-2022-0560 | Medium | 6.1 | 2022-02-11 | Open Redirect in Packagist microweber/microweber prior to 1.2.11. |
CVE-2022-0557 | High | 7.2 | 2022-02-11 | OS Command Injection in Packagist microweber/microweber prior to 1.2.11. |
CVE-2022-24961 | Critical | 9.8 | 2022-02-11 | In Portainer Agent before 2.11.1, an API server can continue running even if not associated with a Portainer instance in the past few days. |
CVE-2022-24959 | Medium | 5.5 | 2022-02-11 | An issue was discovered in the Linux kernel before 5.16.5. There is a memory leak in yam_siocdevprivate in drivers/net/hamradio/yam.c. |
CVE-2022-24958 | High | 7.8 | 2022-02-11 | drivers/usb/gadget/legacy/inode.c in the Linux kernel through 5.16.8 mishandles dev->buf release. |
CVE-2022-24955 | Critical | 9.8 | 2022-02-11 | Foxit PDF Reader before 11.2.1 and Foxit PDF Editor before 11.2.1 have an Uncontrolled Search Path Element for DLL files. |
CVE-2022-24954 | Critical | 9.8 | 2022-02-11 | Foxit PDF Reader before 11.2.1 and Foxit PDF Editor before 11.2.1 have a Stack-Based Buffer Overflow related to XFA, for the 'subform colSpan="-2"' and 'draw c… |
CVE-2022-23806 | Critical | 9.1 | 2022-02-11 | Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x before 1.17.7 can incorrectly return true in situations with a big.Int value that is not a v… |
CVE-2022-23773 | High | 7.5 | 2022-02-11 | cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. This can lead to incorrect access co… |
CVE-2022-23772 | High | 7.5 | 2022-02-11 | Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7 has an overflow that can lead to Uncontrolled Memory Consumption. |
CVE-2022-24647 | High | 8.1 | 2022-02-10 | Cuppa CMS v1.0 was discovered to contain an arbitrary file deletion vulnerability via the unlink() function. |
CVE-2022-24646 | High | 7.5 | 2022-02-10 | Hospital Management System v4.0 was discovered to contain a SQL injection vulnerability in /Hospital-Management-System-master/contact.php via the txtMsg parame… |
CVE-2022-0554 | High | 7.8 | 2022-02-10 | Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2. |
CVE-2022-24916 | High | 7.5 | 2022-02-10 | Optimism before @eth-optimism/l2geth@0.5.11 allows economic griefing because a balance is duplicated upon contract self-destruction. |
CVE-2022-23630 | High | 7.5 | 2022-02-10 | Gradle is a build tool with a focus on build automation and support for multi-language development. In some cases, Gradle may skip that verification and accept… |
CVE-2022-24568 | Critical | 9.8 | 2022-02-10 | Novel-plus v3.6.0 was discovered to be vulnerable to Server-Side Request Forgery (SSRF) via user-supplied crafted input. |
CVE-2022-23321 | Medium | 4.8 | 2022-02-10 | A persistent cross-site scripting (XSS) vulnerability exists on two input fields within the administrative panel when editing users in the XMPie UStore applica… |
CVE-2022-20749 | Critical | 10.0 | 2022-02-10 | Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbi… |
CVE-2022-20738 | Medium | 5.8 | 2022-02-10 | A vulnerability in the Cisco Umbrella Secure Web Gateway service could allow an unauthenticated, remote attacker to bypass the file inspection feature. This vu… |
CVE-2022-20712 | Critical | 10.0 | 2022-02-10 | Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbi… |
CVE-2022-20711 | Critical | 10.0 | 2022-02-10 | Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbi… |
CVE-2022-20710 | Critical | 10.0 | 2022-02-10 | Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbi… |
CVE-2022-20709 | Critical | 10.0 | 2022-02-10 | Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbi… |
CVE-2022-20708 | Critical | 10.0 | 2022-02-10 | Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbi… |
CVE-2022-20707 | Critical | 10.0 | 2022-02-10 | Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbi… |
CVE-2022-20706 | Critical | 10.0 | 2022-02-10 | Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbi… |
CVE-2022-20705 | Critical | 10.0 | 2022-02-10 | Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbi… |
CVE-2022-20704 | Critical | 10.0 | 2022-02-10 | Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbi… |
CVE-2022-20703 | Critical | 10.0 | 2022-02-10 | Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbi… |
CVE-2022-20702 | Critical | 10.0 | 2022-02-10 | Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbi… |
CVE-2022-20701 | Critical | 10.0 | 2022-02-10 | Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbi… |
CVE-2022-20700 | Critical | 10.0 | 2022-02-10 | Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbi… |
CVE-2022-20699 | Critical | 10.0 | 2022-02-10 | Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbi… |
CVE-2022-20680 | Medium | 4.3 | 2022-02-10 | A vulnerability in the web-based management interface of Cisco Prime Service Catalog could allow an authenticated, remote attacker to access sensitive informat… |
CVE-2022-20630 | Medium | 4.4 | 2022-02-10 | A vulnerability in the audit log of Cisco DNA Center could allow an authenticated, local attacker to view sensitive information in clear text. This vulnerabili… |
CVE-2022-0021 | Low | 3.3 | 2022-02-10 | An information exposure through log file vulnerability exists in the Palo Alto Networks GlobalProtect app on Windows that logs the cleartext credentials of the… |
CVE-2022-0020 | Medium | 6.8 | 2022-02-10 | A stored cross-site scripting (XSS) vulnerability in Palo Alto Network Cortex XSOAR web interface enables an authenticated network-based attacker to store a pe… |
CVE-2022-0019 | Medium | 4.7 | 2022-02-10 | An insufficiently protected credentials vulnerability exists in the Palo Alto Networks GlobalProtect app on Linux that exposes the hashed credentials of Global… |
CVE-2022-0018 | Medium | 6.1 | 2022-02-10 | An information exposure vulnerability exists in the Palo Alto Networks GlobalProtect app on Windows and MacOS where the credentials of the local user account a… |
CVE-2022-0017 | High | 7.0 | 2022-02-10 | An improper link resolution before file access ('link following') vulnerability exists in the Palo Alto Networks GlobalProtect app on Windows that enables a lo… |
CVE-2022-0016 | High | 7.4 | 2022-02-10 | An improper handling of exceptional conditions vulnerability exists within the Connect Before Logon feature of the Palo Alto Networks GlobalProtect app that en… |