CVEs published February 11, 2022
163 CVEs were published on February 11, 2022: 3 critical, 25 high. 3 are now in CISA KEV.
- Published
- 163
- Critical
- 3
- High
- 25
- Medium
- 24
- Low
- 7
- Unrated
- 104
- Now in CISA KEV
- 3
- Fix available
- 84
Most affected products
- Google Chrome
- 29
- Android
- 21
- Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- 10
- Samsung Mobile Devices
- 10
- Interactive Graphical SCADA System Data Collector (dc.exe)
- 6
- info.magnolia:magnolia-core
- 5
- Drupal Core · drupal/core +1
- 4
- Samsung Mobile Samsung Wearable Devices
- 4
- Drupal Core · drupal/core
- 3
- Modicon M340 CPUs: BMXP34 (Versions prior to V3.40), Modico…
- 3
Critical 3
- CVE-2021-23555Sandbox Bypassvm2
- CVE-2022-24112apisix/batch-requests plugin allows overwriting the X-REAL-IP headerApache Software Foundation Apache APISIX
- CVE-2021-30317Improper validation of program headers containing ELF metadata can lead to image verification bypass in Snapdragon Auto, Snapdragon Compute,Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
High 25
- CVE-2021-4102Use after free in V8 in Google Chrome prior to 96.0.4664.110 allowed a remote attacker to potentially exploit heap corruption via a crafted Google Chrome
- CVE-2022-23634Information Exposure when using Puma with Railspuma
- CVE-2022-22766BD Pyxis Products - Hardcoded CredentialsBecton Dickinson (BD) BD Pyxis Anesthesia Station ES ·… +20
- CVE-2022-0185A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functionality of the Linux kernel
- CVE-2021-22788A CWE-787: Out-of-bounds Write vulnerability exists that could cause denial of service when an attacker sends a specially crafted HTTP requeModicon M340 CPUs: BMXP34 (Versions prior to V3.40), Modico…
- CVE-2021-22787A CWE-20: Improper Input Validation vulnerability exists that could cause denial of service of the device when an attacker sends a speciallyModicon M340 CPUs: BMXP34 (Versions prior to V3.40), Modico…
- CVE-2021-22785A CWE-200: Information Exposure vulnerability exists that could cause sensitive information of files located in the web root directory to leModicon M340 CPUs: BMXP34 (Versions prior to V3.40), Modico…
- CVE-2020-14523Mitsubishi Electric Factory Automation Products Path TraversalMitsubishi Electric CW Configurator · Mitsubishi Electr… +10
- CVE-2020-14521Mitsubishi Electric Factory Automation Engineering Products Unquoted Search Path or ElementMitsubishi Electric C Controller Interface Module Utili… +43
- CVE-2022-23428An improper boundary check in eden_runtime hal service prior to SMR Feb-2022 Release 1 allows arbitrary memory write and code execution.Samsung Mobile Devices with Exynos chipsets
- CVE-2022-23425Improper input validation in Exynos baseband prior to SMR Feb-2022 Release 1 allows attackers to send arbitrary NAS signaling messages with Samsung Mobile Devices
- CVE-2022-22292Unprotected dynamic receiver in Telecom prior to SMR Feb-2022 Release 1 allows untrusted applications to launch arbitrary activity.Samsung Mobile Devices
- CVE-2021-23597Denial of Service (DoS)fastify-multipart
- CVE-2021-35077Possible use after free scenario in compute offloads to DSP while multiple calls spawn a dynamic process in Snapdragon Auto, Snapdragon CompQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2021-35075Possible null pointer dereference due to lack of WDOG structure validation during registration in Snapdragon Auto, Snapdragon Connectivity, Qualcomm Snapdragon Auto, Snapdragon Connectivity, Snapdrag…
- CVE-2021-35074Possible integer overflow due to improper fragment datatype while calculating number of fragments in a request message in Snapdragon Auto, SQualcomm Snapdragon Auto, Snapdragon Connectivity, Snapdrag…
- CVE-2021-35069Improper validation of data length received from DMA buffer can lead to memory corruption.Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2021-35068Lack of null check while freeing the device information buffer in the Bluetooth HFP protocol can lead to a NULL pointer dereference in SnapdQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2021-30326Possible assertion due to improper size validation while processing the DownlinkPreemption IE in an RRC Reconfiguration/RRC Setup message inQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2021-30323Improper validation of maximum size of data write to EFS file can lead to memory corruption in Snapdragon Auto, Snapdragon Compute, SnapdragQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2021-30322Possible out of bounds write due to improper validation of number of GPIOs configured in an internal parameters array in Snapdragon Auto, SnQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2021-30318Improper validation of input when provisioning the HDCP key can lead to memory corruption in Snapdragon Auto, Snapdragon Compute, SnapdragonQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2021-30309Improper size validation of QXDM commands can lead to memory corruption in Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon IndustriaQualcomm Snapdragon Compute, Snapdragon Consumer IOT, Snapd…
- CVE-2022-0557OS Command Injection in microweber/microwebermicroweber/microweber
- CVE-2022-23633Exposure of sensitive information in Action Packrails · actionpack
Medium, low and unrated 135
- CVE-2022-0120Inappropriate implementation in Passwords in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to potentially leak cross-origin Google Chrome
- CVE-2022-0118Inappropriate implementation in WebShare in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to potentially hide the contents oGoogle Chrome
- CVE-2022-0117Policy bypass in Blink in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to leak cross-origin data via a crafted HTML page.Google Chrome
- CVE-2022-0116Inappropriate implementation in Compositing in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to spoof the contents of the OmGoogle Chrome
- CVE-2022-0115Uninitialized use in File API in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to potentially perform out of bounds memory aGoogle Chrome
- CVE-2022-0114Out of bounds memory access in Blink Serial API in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to perform an out of boundsGoogle Chrome
- CVE-2022-0113Inappropriate implementation in Blink in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to leak cross-origin data via a craftGoogle Chrome
- CVE-2022-0112Incorrect security UI in Browser UI in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to display missing URL or incorrect URLGoogle Chrome
- CVE-2022-0111Inappropriate implementation in Navigation in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to incorrectly set origin via a Google Chrome
- CVE-2022-0110Incorrect security UI in Autofill in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to spoof the contents of the Omnibox (URLGoogle Chrome
- CVE-2022-0109Inappropriate implementation in Autofill in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to obtain potentially sensitive inGoogle Chrome
- CVE-2022-0107Use after free in File Manager API in Google Chrome on Chrome OS prior to 97.0.4692.71 allowed an attacker who convinced a user to install aGoogle Chrome
- CVE-2022-0106Use after free in Autofill in Google Chrome prior to 97.0.4692.71 allowed a remote attacker who convinced a user to perform specific user geGoogle Chrome
- CVE-2022-0105Use after free in PDF Accessibility in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to potentially exploit heap corruption Google Chrome
- CVE-2022-0104Heap buffer overflow in ANGLE in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to potentially exploit heap corruption via a Google Chrome
- CVE-2022-0103Use after free in SwiftShader in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to potentially exploit heap corruption via a Google Chrome
- CVE-2022-0102Type confusion in V8 in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HGoogle Chrome
- CVE-2022-0101Heap buffer overflow in Bookmarks in Google Chrome prior to 97.0.4692.71 allowed a remote attacker who convinced a user to perform specific Google Chrome
- CVE-2022-0100Heap buffer overflow in Media streams API in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to potentially exploit heap corruGoogle Chrome
- CVE-2022-0099Use after free in Sign-in in Google Chrome prior to 97.0.4692.71 allowed a remote attacker who convinced a user to perform specific user gesGoogle Chrome
- CVE-2022-0098Use after free in Screen Capture in Google Chrome on Chrome OS prior to 97.0.4692.71 allowed an attacker who convinced a user to perform speGoogle Chrome
- CVE-2022-0097Inappropriate implementation in DevTools in Google Chrome prior to 97.0.4692.71 allowed an attacker who convinced a user to install a maliciGoogle Chrome
- CVE-2022-0096Use after free in Storage in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to potentially exploit heap corruption via a crafGoogle Chrome
- CVE-2021-4101Heap buffer overflow in Swiftshader in Google Chrome prior to 96.0.4664.110 allowed a remote attacker to potentially exploit heap corruptionGoogle Chrome
- CVE-2021-4100Object lifecycle issue in ANGLE in Google Chrome prior to 96.0.4664.110 allowed a remote attacker to potentially exploit heap corruption viaGoogle Chrome
- CVE-2021-4099Use after free in Swiftshader in Google Chrome prior to 96.0.4664.110 allowed a remote attacker to potentially exploit heap corruption via aGoogle Chrome
- CVE-2021-4098Insufficient data validation in Mojo in Google Chrome prior to 96.0.4664.110 allowed a remote attacker who had compromised the renderer procGoogle Chrome
- CVE-2021-46366An issue in the Login page of Magnolia CMS v6.2.3 and below allows attackers to exploit both an Open Redirect vulnerability and Cross-Site Rinfo.magnolia:magnolia-core
- CVE-2021-46365An issue in the Export function of Magnolia v6.2.3 and below allows attackers to execute XML External Entity attacks via a crafted XLF file.info.magnolia:magnolia-core
- CVE-2021-46364A vulnerability in the Snake YAML parser of Magnolia CMS v6.2.3 and below allows attackers to execute arbitrary code via a crafted YAML fileinfo.magnolia:magnolia-core
- CVE-2021-46362A Server-Side Template Injection (SSTI) vulnerability in the Registration and Forgotten Password forms of Magnolia v6.2.3 and below allows a
- CVE-2021-46363An issue in the Export function of Magnolia v6.2.3 and below allows attackers to perform Formula Injection attacks via crafted CSV/XLS filesinfo.magnolia:magnolia-core
- CVE-2021-46361An issue in the Freemark Filter of Magnolia CMS v6.2.11 and below allows attackers to bypass security restrictions and execute arbitrary codinfo.magnolia:magnolia-core
- CVE-2021-20001It was discovered, that debian-edu-config, a set of configuration files used for the Debian Edu blend, before 2.12.16 configured insecure pedebian-edu-config
- CVE-2022-24968In Mellium mellium.im/xmpp through 0.21.0, an attacker capable of spoofing DNS TXT records can redirect a WebSocket connection request to a mellium.im/xmpp
- CVE-2020-26728A vulnerability was discovered in Tenda AC9 v3.0 V15.03.06.42_multi and Tenda AC9 V1.0 V15.03.05.19(6318)_CN which allows for remote code ex
- CVE-2021-34235Tokheim Profleet DiaLOG 11.005.02 is affected by SQL Injection.
- CVE-2021-39688In TBD of TBD, there is a possible out of bounds read due to TBD.Android
- CVE-2021-39677In startVideoStream() there is a possibility of an OOB Read in the heap, when the camera buffer is ‘zero’ in size.Product: AndroidVersions: Android
- CVE-2021-39687In HandleTransactionIoEvent of actuator_driver.cc, there is a possible out of bounds read due to a heap buffer overflow.Android
- CVE-2021-0524In isServiceDistractionOptimized of CarPackageManagerService.java, there is a possible disclosure of installed packages due to side channel Android
- CVE-2021-39672In fastboot, there is a possible secure boot bypass due to a configuration error.Android
- CVE-2021-39676In writeThrowable of AndroidFuture.java, there is a possible parcel serialization/deserialization mismatch due to improper input validation.Android
- CVE-2021-39675In GKI_getbuf of gki_buffer.cc, there is a possible out of bounds write due to a heap buffer overflow.Android
- CVE-2021-39674In btm_sec_connected and btm_sec_disconnected of btm_sec.cc file , there is a possible use after free.Android
- CVE-2021-39669In onCreate of InstallCaCertificateWarning.java, there is a possible way to mislead an user about CA installation circumstances due to a tapAndroid
- CVE-2021-39671In code generated by aidl_const_expressions.cpp, there is a possible out of bounds read due to uninitialized data.Android
- CVE-2021-39668In onActivityViewReady of DetailDialog.kt, there is a possible Intent Redirect due to a confused deputy.Android
- CVE-2021-39666In extract of MediaMetricsItem.h, there is a possible out of bounds read due to improper input validation.Android
- CVE-2021-39665In checkSpsUpdated of AAVCAssembler.cpp, there is a possible out of bounds read due to a heap buffer overflow.Android
- CVE-2021-39663In openFileAndEnforcePathPermissionsHelper of MediaProvider.java, there is a possible bypass of a permissions check due to a confused deputyAndroid
- CVE-2021-39664In LoadedPackage::Load of LoadedArsc.cpp, there is a possible out of bounds read due to a missing bounds check.Android
- CVE-2021-39662In checkUriPermission of MediaProvider.java , there is a possible way to gain access to the content of media provider collections due to a mAndroid
- CVE-2021-39658ismsEx service is a vendor service in unisoc equipment。ismsEx service is an extension of sms system service，but it does not check the permisAndroid
- CVE-2021-39635ims_ex is a vendor system service used to manage VoLTE in unisoc devices，But it does not verify the caller's permissions，so that normal appsAndroid
- CVE-2021-39631In clear_data_dlg_text of strings.xml, there is a possible situation when "Clear storage" functionality sets up the wrong security/privacy eAndroid
- CVE-2021-39616Summary:Product: AndroidVersions: Android SoCAndroid ID: A-204686438Android
- CVE-2021-39619In updatePackageMappingsData of UsageStatsService.java, there is a possible way to bypass security and privacy settings of app usage due to Android
- CVE-2022-0483Local privilege escalation due to insecure folder permissionsAcronis VSS Doctor
- CVE-2021-22824A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could result in denial of service, due to missing length cheInteractive Graphical SCADA System Data Collector (dc.exe)
- CVE-2021-22800A CWE-20: Improper Input Validation vulnerability exists that could cause a Denial of Service when a crafted packet is sent to the controlleModicon M218 Logic Controller
- CVE-2021-22823A CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause deletion of arbitrary files in the context of Interactive Graphical SCADA System Data Collector (dc.exe)
- CVE-2021-22805A CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause deletion of arbitrary files in the context of Interactive Graphical SCADA System Data Collector (dc.exe)
- CVE-2021-22804A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists that could cause disclosure of arbitrary files beInteractive Graphical SCADA System Data Collector (dc.exe)
- CVE-2021-22802A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could result in remote code execution due to missing length Interactive Graphical SCADA System Data Collector (dc.exe)
- CVE-2021-22803A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists that could lead to remote code execution through a number ofInteractive Graphical SCADA System Data Collector (dc.exe)
- CVE-2021-22801A CWE-269: Improper Privilege Management vulnerability exists that could cause an arbitrary command execution when the software is configureConneXium Network Manager Software
- CVE-2021-22806A CWE-669: Incorrect Resource Transfer Between Spheres vulnerability exists that could cause data exfiltration and unauthorized access when spaceLYnk (V2.6.1 and prior), Wiser for KNX (V2.6.1 and pri…
- CVE-2021-22798A CWE-522: Insufficiently Protected Credentials vulnerability exists that could cause Sensitive data such as login credentials being exposedConext� ComBox
- CVE-2021-22796A CWE-287: Improper Authentication vulnerability exists that could allow remote code execution when a malicious file is uploaded.C-Bus Toolkit (V1.15.9 and prior), C-Gate Server
- CVE-2021-22748A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could allow a remote codeC-Bus Toolkit (V1.15.9 and prior), C-Gate Server
- CVE-2022-23707An XSS vulnerability was found in Kibana index patterns.Elastic Kibana
- CVE-2022-24926Improper input validation vulnerability in SmartTagPlugin prior to version 1.2.15-6 allows privileged attackers to trigger a XSS on a victimSamsung Mobile SmartTagPlugin
- CVE-2022-24927Improper privilege management vulnerability in Samsung Video Player prior to version 7.3.15.30 allows attackers to execute video files withoSamsung Mobile Samsung Video Player
- CVE-2022-24925Improper input validation vulnerability in SettingsProvider prior to Android S(12) allows privileged attackers to trigger a permanent denialSamsung Mobile Devices
- CVE-2022-24924An improper access control in LiveWallpaperService prior to versions 3.0.9.0 allows to create a specific named system directory without a prSamsung Mobile LiveWallpaper
- CVE-2022-24003Exposure of Sensitive Information vulnerability in Bixby Vision prior to version 3.7.50.6 allows attackers to access internal data of Bixby Samsung Mobile Bixby Vision
- CVE-2022-24923Improper access control vulnerability in Samsung SearchWidget prior to versions 2.3.00.6 in China models allows untrusted applications to loSamsung Mobile SearchWidget
- CVE-2022-24002Improper Authorization vulnerability in Link Sharing prior to version 12.4.00.3 allows attackers to open protected activity via PreconditionSamsung Mobile Link sharing
- CVE-2022-24001Information disclosure vulnerability in Edge Panel prior to Android S(12) allows physical attackers to access screenshot in clipboard via EdSamsung Mobile Devices
- CVE-2022-23999PendingIntent hijacking vulnerability in CpaReceiver prior to SMR Feb-2022 Release 1 allows local attackers to access media files without peSamsung Mobile Devices
- CVE-2022-24000PendingIntent hijacking vulnerability in DataUsageReminderReceiver prior to SMR Feb-2022 Release 1 allows local attackers to access media fiSamsung Mobile Devices
- CVE-2022-23998Improper access control vulnerability in Camera prior to versions 11.1.02.16 in Android R(11), 10.5.03.77 in Android Q(10) and 9.0.6.68 in ASamsung Mobile Samsung Camera
- CVE-2022-23997Unprotected component vulnerability in StTheaterModeDurationAlarmReceiver in Wear OS 3.0 prior to Firmware update Feb-2022 Release allows unSamsung Mobile Samsung Wearable Devices
- CVE-2022-23996Unprotected component vulnerability in StTheaterModeReceiver in Wear OS 3.0 prior to Firmware update Feb-2022 Release allows untrusted appliSamsung Mobile Samsung Wearable Devices
- CVE-2022-23994An Improper access control vulnerability in StBedtimeModeReceiver in Wear OS 3.0 prior to Firmware update Feb-2022 Release allows untrusted Samsung Mobile Samsung Wearable Devices
- CVE-2022-23995Unprotected component vulnerability in StBedtimeModeAlarmReceiver in Wear OS 3.0 prior to Firmware update Feb-2022 Release allows untrusted Samsung Mobile Samsung Wearable Devices
- CVE-2022-23434A vulnerability using PendingIntent in Bixby Vision prior to versions 3.7.60.8 in Android S(12), 3.7.50.6 in Andorid R(11) and below allows Samsung Mobile Bixby Vision
- CVE-2022-23433Improper access control vulnerability in Reminder prior to versions 12.3.01.3000 in Android S(12), 12.2.05.6000 in Android R(11) and 11.6.08Samsung Mobile Reminder
- CVE-2022-23431An improper boundary check in RPMB ldfw prior to SMR Feb-2022 Release 1 allows arbitrary memory write and code execution.Samsung Mobile Devices with Exynos chipsets
- CVE-2022-23432An improper input validation in SMC_SRPMB_WSM handler of RPMB ldfw prior to SMR Feb-2022 Release 1 allows arbitrary memory write and code exSamsung Mobile Devices with Exynos chipsets
- CVE-2022-23429An improper boundary check in audio hal service prior to SMR Feb-2022 Release 1 allows attackers to read invalid memory and it leads to applSamsung Mobile Devices
- CVE-2022-23427PendingIntent hijacking vulnerability in KnoxPrivacyNoticeReceiver prior to SMR Feb-2022 Release 1 allows local attackers to access media fiSamsung Mobile Devices
- CVE-2022-23426A vulnerability using PendingIntent in DeX Home and DeX for PC prior to SMR Feb-2022 Release 1 allows attackers to access files with system Samsung Mobile Devices
- CVE-2022-22291Logging of excessive data vulnerability in telephony prior to SMR Feb-2022 Release 1 allows privileged attackers to get Cell Location InformSamsung Mobile Devices
- CVE-2021-4046TCMAN GIM Cross-Site Scripting (XSS)TCMAN GIM
- CVE-2021-4035Wocu Monitoring stored Cross-Site Scripting (XSS)A3Sec Wocu Monitoring
- CVE-2021-31932Nokia BTS TRS web console FTM_W20_FP2_2019.08.16_0010 allows Authentication Bypass.
- CVE-2021-44111A Directory Traversal vulnerability exists in S-Cart 6.7 via download in sc-admin/backup.s-cart/s-cart
- CVE-2020-13677Under some circumstances, the Drupal core JSON:API module does not properly restrict access to certain content, which may result in unintendDrupal Core · drupal/core
- CVE-2021-42940A Cross Site Scripting (XSS) vulnerability exists in Projeqtor 9.3.1 via /projeqtor/tool/saveAttachment.php, which allows an attacker to upl
- CVE-2020-13676The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclosure of field data.Drupal Core · drupal/core
- CVE-2020-13670Information Disclosure vulnerability in file module of Drupal Core allows an attacker to gain access to the file metadata of a permanent priDrupal Core · drupal/core +1
- CVE-2020-13674The QuickEdit module does not properly validate access to routes, which could allow cross-site request forgery under some circumstances and Drupal Core · drupal/core
- CVE-2020-13675Drupal's JSON:API and REST/File modules allow file uploads through their HTTP APIs.Drupal Core · drupal/graphql +1
- CVE-2020-13673The Entity Embed module provides a filter to allow embedding entities in content fields.Drupal Entity Embed · drupal/core +1
- CVE-2020-13672Cross-site Scripting (XSS) vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain circuDrupal Core · drupal/core +1
- CVE-2020-13669Cross-site Scripting (XSS) vulnerability in ckeditor of Drupal Core allows attacker to inject XSS.Drupal Core · drupal/core +1
- CVE-2021-45385A Null Pointer Dereference vulnerability exits in ffjpeg d5cfd49 (2021-12-06) in bmp_load().
- CVE-2020-13668Access bypass in Drupal Core 8/9Drupal Core · drupal/core +1
- CVE-2020-36062Dairy Farm Shop Management System v1.0 was discovered to contain hardcoded credentials in the source code which allows attackers access to t
- CVE-2021-45402The check_alu_op() function in kernel/bpf/verifier.c in the Linux kernel through v5.16-rc5 did not properly update bounds while handling the
- CVE-2021-38679Improper Authentication in Kazoo ServerQNAP Systems Kazoo Server
- CVE-2022-0560Open Redirect in microweber/microwebermicroweber/microweber
- CVE-2021-46355OCS Inventory 2.9.1 is affected by Cross Site Scripting (XSS).
- CVE-2022-24289Deserialization of untrusted data in the Hessian Component of Apache Cayenne 4.1 with older Java versionsApache Software Foundation Apache Cayenne · org.apache.caye…
- CVE-2021-44521Remote code execution for scripted UDFsApache Software Foundation Apache Cassandra · org.apache.ca…
- CVE-2021-30325Possible out of bound access of DCI resources due to lack of validation process and resource allocation in Snapdragon Auto, Snapdragon CompuQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2021-30324Possible out of bound write due to lack of boundary check for the maximum size of buffer when sending a DCI packet to remote process in SnapQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2022-24961In Portainer Agent before 2.11.1, an API server can continue running even if not associated with a Portainer instance in the past few days.
- CVE-2022-24958drivers/usb/gadget/legacy/inode.c in the Linux kernel through 5.16.8 mishandles dev->buf release.
- CVE-2022-24959An issue was discovered in the Linux kernel before 5.16.5.
- CVE-2022-24954Foxit PDF Reader before 11.2.1 and Foxit PDF Editor before 11.2.1 have a Stack-Based Buffer Overflow related to XFA, for the 'subform colSpa
- CVE-2022-24955Foxit PDF Reader before 11.2.1 and Foxit PDF Editor before 11.2.1 have an Uncontrolled Search Path Element for DLL files.
- CVE-2022-23773cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags.toolchain
- CVE-2022-23772Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7 has an overflow that can lead to Uncontrolled Memory Consumption.stdlib
- CVE-2021-45386tcpreplay 4.3.4 has a Reachable Assertion in add_tree_ipv6() at tree.c
- CVE-2021-45387tcpreplay 4.3.4 has a Reachable Assertion in add_tree_ipv4() at tree.c.
- CVE-2022-0108Inappropriate implementation in Navigation in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to leak cross-origin data via a Google Chrome
- CVE-2022-0382An information leak flaw was found due to uninitialized memory in the Linux kernel's TIPC protocol subsystem, in the way a user sends a TIPCkernel
- CVE-2022-0561Null source pointer passed as an argument to memcpy() function within TIFFFetchStripThing() in tif_dirread.c in libtiff versions from 3.9.0 libtiff
- CVE-2022-0562Null source pointer passed as an argument to memcpy() function within TIFFReadDirectory() in tif_dirread.c in libtiff versions from 4.0 to 4libtiff
- CVE-2022-23806Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x before 1.17.7 can incorrectly return true in situations with a big.Int vastdlib
- CVE-2022-23853The LSP (Language Server Protocol) plugin in KDE Kate before 21.12.2 and KTextEditor before 5.91.0 tries to execute the associated LSP serve
- CVE-2022-24975The --mirror documentation for Git through 2.35.1 does not mention the availability of deleted content, aka the "GitBleed" issue.