CVEs published December 13, 2022
222 CVEs were published on December 13, 2022: 15 critical, 121 high. 2 are now in CISA KEV.
- Published
- 222
- Critical
- 15
- High
- 121
- Medium
- 75
- Low
- 11
- Unrated
- 0
- Now in CISA KEV
- 2
- Fix available
- 70
Most affected products
- Android
- 36
- Microsoft Windows
- 26
- Siemens JT2Go · Siemens Teamcenter Visualization
- 12
- Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- 10
- Microsoft 365 Apps for Enterprise
- 6
- Siemens SCALANCE X204RNA
- 6
- Siemens Parasolid · Siemens Solid Edge SE2022 +1
- 5
- Altair HyperView Player
- 4
- Qualcomm Snapdragon Mobile
- 4
- Siemens SIMATIC Drive Controller CPU 1504D TF · Siemens… +60
- 4
Critical 15
- CVE-2022-2660Delta Industrial Automation DIALink versions 1.4.0.0 and prior are vulnerable to the use of a hard-coded cryptographic key which could allowDelta Electronics Industrial Automation DIALink
- CVE-2022-2757 Due to the lack of adequately implemented access-control rules, all versions Kingspan TMS300 CS are vulnerable to an attacker viewing andKingspan TMS300 CS
- CVE-2022-41653Daikin SVMPC1 version 2.1.22 and prior and SVMPC2 version 1.2.3 and prior are vulnerable to an attacker obtaining user login credentials andDaikin SVMPC1 · Daikin SVMPC2
- CVE-2022-46364Apache CXF SSRF VulnerabilityApache Software Foundation Apache CXF · org.apache.cxf:cxf-…
- CVE-2022-41272An unauthenticated attacker over the network can attach to an open interface exposed through JNDI by the User Defined Search (UDS) of SAP NeSAP NetWeaver Process Integration
- CVE-2022-41271An unauthenticated user can attach to an open interface exposed through JNDI by the Messaging System of SAP NetWeaver Process Integration (PSAP NetWeaver Process Integration
- CVE-2022-41267SAP Business Objects Platform - versions 420, and 430, allows an attacker with normal BI user privileges to upload/replace any file on BusinSAP BusinessObjects Business Intelligence Platform
- CVE-2022-20472In toLanguageTag of LocaleListCache.cpp, there is a possible out of bounds read due to an incorrect bounds check.Android
- CVE-2022-20473In toLanguageTag of LocaleListCache.cpp, there is a possible out of bounds read due to an incorrect bounds check.Android
- CVE-2022-27518Unauthenticated remote arbitrary code executionCitrix Gateway, Citrix ADC
- CVE-2022-43724A vulnerability has been identified in SICAM PAS/PQS (All versions < V7.0).Siemens SICAM PAS/PQS
- CVE-2022-4446PHP Remote File Inclusion in tsolucio/corebostsolucio/corebos
- CVE-2022-45005IP-COM EW9 V15.11.0.14(9732) was discovered to contain a command injection vulnerability in the cmd_get_ping_output function.
- CVE-2022-46353A vulnerability has been identified in SCALANCE X204RNA (HSR) (All versions < V3.2.7), SCALANCE X204RNA (PRP) (All versions < V3.2.7), SCALASiemens SCALANCE X204RNA
- CVE-2022-46404A command injection vulnerability has been identified in Atos Unify OpenScape 4000 Assistant and Unify OpenScape 4000 Manager (8 before R2.2
High 121
- CVE-2022-38355Daikin SVMPC1 version 2.1.22 and prior and SVMPC2 version 1.2.3 and prior are vulnerable to attackers with access to the local area networDaikin SVMPC1 · Daikin SVMPC2
- CVE-2022-2947 Altair HyperView Player versions 2021.1.0.27 and prior perform operations on a memory buffer but can read from or write to a memory locatAltair HyperView Player
- CVE-2022-2949 Altair HyperView Player versions 2021.1.0.27 and prior are vulnerable to the use of uninitialized memory vulnerability during parsing of Altair HyperView Player
- CVE-2022-2950 Altair HyperView Player versions 2021.1.0.27 and prior are vulnerable to the use of uninitialized memory vulnerability during parsing of Altair HyperView Player
- CVE-2022-2951 Altair HyperView Player versions 2021.1.0.27 and prior are vulnerable to improper validation of array index vulnerability during processiAltair HyperView Player
- CVE-2022-3996X.509 Policy Constraints Double LockingOpenSSL · openssl-src
- CVE-2022-46363Apache CXF directory listing / code exfiltrationApache Software Foundation Apache CXF · org.apache.cxf:cxf-…
- CVE-2022-29580Path Traversal in Android Google Search AppAndroid Google Search App
- CVE-2022-4098Wiesemann & Theis: Multiple products prone to missing authentication through spoofingWiesemann & Theis Com-Server ++ · Wiesemann & Theis Com… +14
- CVE-2022-41268In some SAP standard roles in SAP Business Planning and Consolidation - versions - SAP_BW 750, 751, 752, 753, 754, 755, 756, 757, DWCORE 200SAP Business Planning and Consolidation
- CVE-2022-41266Due to a lack of proper input validation, SAP Commerce Webservices 2.0 (Swagger UI) - versions 1905, 2005, 2105, 2011, 2205, allows maliciouSAP Commerce Webservices
- CVE-2022-41264Due to the unrestricted scope of the RFC function module, SAP BASIS - versions 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790, 7SAP BASIS
- CVE-2021-32415EXEMSI MSI Wrapper Versions prior to 10.0.50 and at least since version 6.0.91 will introduce a local privilege escalation vulnerability in
- CVE-2021-39660In TBD of TBD, there is a possible way to archive arbitrary code execution in kernel due to a race condition.Android
- CVE-2021-40365Affected devices don't process correctly certain special crafted packets sent to port 102/tcp, which could allow an attacker to cause a deniSiemens SIMATIC Drive Controller CPU 1504D TF · Siemens… +60
- CVE-2022-20411In avdt_msg_asmbl of avdt_msg.cc, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2022-20442In onCreate of ReviewPermissionsActivity.java, there is a possible way to grant permissions for a separate app with API level < 23 due to a Android
- CVE-2022-20469In avct_lcb_msg_asmbl of avct_lcb_act.cc, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2022-20470In bindRemoteViewsService of AppWidgetServiceImpl.java, there is a possible way to bypass background activity launch due to improper input vAndroid
- CVE-2022-20474In readLazyValue of Parcel.java, there is a possible loading of arbitrary code into the System Settings app due to a confused deputy.Android
- CVE-2022-20475In test of ResetTargetTaskHelper.java, there is a possible hijacking of any app which sets allowTaskReparenting="true" due to a confused depAndroid
- CVE-2022-20477In shouldHideNotification of KeyguardNotificationVisibilityProvider.kt, there is a possible way to show hidden notifications due to a logic Android
- CVE-2022-20478In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion.Android
- CVE-2022-20479In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion.Android
- CVE-2022-20480In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion.Android
- CVE-2022-20483In several functions that parse avrc response in avrc_pars_ct.cc and related files, there are possible out of bounds reads due to integer ovAndroid
- CVE-2022-20484In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion.Android
- CVE-2022-20485In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion.Android
- CVE-2022-20486In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion.Android
- CVE-2022-20487In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion.Android
- CVE-2022-20488In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion.Android
- CVE-2022-20491In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion.Android
- CVE-2022-20495In getEnabledAccessibilityServiceList of AccessibilityManager.java, there is a possible way to hide an accessibility service due to a logic Android
- CVE-2022-20501In onCreate of EnableAccountPreferenceActivity.java, there is a possible way to mislead the user into enabling a malicious phone account dueAndroid
- CVE-2022-20611In deletePackageVersionedInternal of DeletePackageHelper.java, there is a possible way to bypass carrier restrictions due to a permissions bAndroid
- CVE-2022-25672Denial of service in MODEM due to reachable assertion while processing SIB1 with invalid Bandwidth in Snapdragon MobileQualcomm Snapdragon Mobile
- CVE-2022-25673Denial of service in MODEM due to reachable assertion while processing configuration from network in Snapdragon MobileQualcomm Snapdragon Mobile
- CVE-2022-25681Possible memory corruption in kernel while performing memory access due to hypervisor not correctly invalidated the processor translation caQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2022-25682Memory corruption in MODEM UIM due to usage of out of range pointer offset while decoding command from card in Snapdragon Auto, Snapdragon CQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2022-25685Denial of service in Modem module due to improper authorization while error handling in Snapdragon Auto, Snapdragon Compute, Snapdragon ConsQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2022-25689Denial of service in Modem due to reachable assertion in Snapdragon MobileQualcomm Snapdragon Mobile
- CVE-2022-25691Denial of service in Modem due to reachable assertion while processing SIB1 with invalid SCS and bandwidth settings in Snapdragon MobileQualcomm Snapdragon Mobile
- CVE-2022-25692Denial of service in Modem due to reachable assertion while processing the common config procedure in Snapdragon Auto, Snapdragon Compute, SQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon In…
- CVE-2022-25695Memory corruption in MODEM due to Improper Validation of Array Index while processing GSTK Proactive commands in Snapdragon Auto, SnapdragonQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2022-25697Memory corruption in i2c buses due to improper input validation while reading address configuration from i2c driver in Snapdragon Mobile, SnQualcomm Snapdragon Mobile, Snapdragon Wearables
- CVE-2022-25698Memory corruption in SPI buses due to improper input validation while reading address configuration from spi buses in Snapdragon Mobile, SnaQualcomm Snapdragon Mobile, Snapdragon Wearables
- CVE-2022-25702Denial of service in modem due to reachable assertion while processing reconfiguration message in Snapdragon Auto, Snapdragon Compute, SnapdQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon In…
- CVE-2022-26804Microsoft Office Graphics Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise
- CVE-2022-26805Microsoft Office Graphics Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise
- CVE-2022-26806Microsoft Office Graphics Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise
- CVE-2022-31696VMware ESXi contains a memory corruption vulnerability that exists in the way it handles a network socket.VMware ESXi, VMware Cloud Foundation
- CVE-2022-33235Information disclosure due to buffer over-read in WLAN firmware while parsing security context info attributes.Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2022-33238Transient DOS due to loop with unreachable exit condition in WLAN while processing an incoming FTM frames.Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2022-33268Information disclosure due to buffer over-read in Bluetooth HOST while pairing and connecting A2DP.Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2022-37155RCE in SPIP 3.1.13 through 4.1.2 allows remote authenticated users to execute arbitrary code via the _oups parameter.
- CVE-2022-41076PowerShell Remote Code Execution VulnerabilityMicrosoft PowerShell · Microsoft Windows
- CVE-2022-41077Windows Fax Compose Form Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-41089.NET Framework Remote Code Execution VulnerabilityMicrosoft Visual Studio · Microsoft .NET +4
- CVE-2022-41094Windows Hyper-V Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-41121Windows Graphics Component Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-41127Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution VulnerabilityMicrosoft Dynamics NAV · Microsoft Dynamics 365 Business… +4
- CVE-2022-41281A vulnerability has been identified in JT2Go (All versions < V14.1.0.6), Teamcenter Visualization V13.2 (All versions < V13.2.0.12), TeamcenSiemens JT2Go · Siemens Teamcenter Visualization
- CVE-2022-41282A vulnerability has been identified in JT2Go (All versions < V14.1.0.6), Teamcenter Visualization V13.2 (All versions < V13.2.0.12), TeamcenSiemens JT2Go · Siemens Teamcenter Visualization
- CVE-2022-41283A vulnerability has been identified in JT2Go (All versions < V14.1.0.6), Teamcenter Visualization V13.2 (All versions < V13.2.0.12), TeamcenSiemens JT2Go · Siemens Teamcenter Visualization
- CVE-2022-41284A vulnerability has been identified in JT2Go (All versions < V14.1.0.6), Teamcenter Visualization V13.2 (All versions < V13.2.0.12), TeamcenSiemens JT2Go · Siemens Teamcenter Visualization
- CVE-2022-41285A vulnerability has been identified in JT2Go (All versions < V14.1.0.6), Teamcenter Visualization V13.2 (All versions < V13.2.0.12), TeamcenSiemens JT2Go · Siemens Teamcenter Visualization
- CVE-2022-41286A vulnerability has been identified in JT2Go (All versions < V14.1.0.6), Teamcenter Visualization V13.2 (All versions < V13.2.0.12), TeamcenSiemens JT2Go · Siemens Teamcenter Visualization
- CVE-2022-42139Delta Electronics DVW-W02W2-E2 1.5.0.10 is vulnerable to Command Injection via Crafted URL.
- CVE-2022-42140Delta Electronics DX-2100-L1-CN 2.42 is vulnerable to Command Injection via lform/net_diagnose.
- CVE-2022-4223The pgAdmin server includes an HTTP API that is intended to be used to validate the path a user selects to external PostgreSQL utilities sucpgadmin4
- CVE-2022-43517A vulnerability has been identified in Simcenter STAR-CCM+ (All versions < V2306).Siemens Simcenter STAR-CCM+
- CVE-2022-43722A vulnerability has been identified in SICAM PAS/PQS (All versions < V7.0).Siemens SICAM PAS/PQS
- CVE-2022-43723A vulnerability has been identified in SICAM PAS/PQS (All versions < V7.0), SICAM PAS/PQS (All versions >= 7.0 < V8.06).Siemens SICAM PAS/PQS
- CVE-2022-44666Windows Contacts Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2022-44667Windows Media Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2022-44668Windows Media Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2022-44669Windows Error Reporting Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-44670Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2022-44671Windows Graphics Component Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-44673Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-44675Windows Bluetooth Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-44676Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2022-44677Windows Projected File System Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-44678Windows Print Spooler Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-44680Windows Graphics Component Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-44681Windows Print Spooler Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-44683Windows Kernel Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-44687Raw Image Extension Remote Code Execution VulnerabilityMicrosoft Raw Image Extension
- CVE-2022-44689Windows Subsystem for Linux (WSL2) Kernel Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-44690Microsoft SharePoint Server Remote Code Execution VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft Share… +1
- CVE-2022-44691Microsoft Office OneNote Remote Code Execution VulnerabilityMicrosoft Office LTSC · Microsoft 365 Apps for Enterprise +1
- CVE-2022-44692Microsoft Office Graphics Remote Code Execution VulnerabilityMicrosoft Office 2019 for Mac · Microsoft 365 Apps for E… +2
- CVE-2022-44693Microsoft SharePoint Server Remote Code Execution VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft Share… +1
- CVE-2022-44694Microsoft Office Visio Remote Code Execution VulnerabilityMicrosoft Office · Microsoft 365 Apps for Enterprise
- CVE-2022-44695Microsoft Office Visio Remote Code Execution VulnerabilityMicrosoft Office · Microsoft 365 Apps for Enterprise +2
- CVE-2022-44696Microsoft Office Visio Remote Code Execution VulnerabilityMicrosoft Office · Microsoft 365 Apps for Enterprise
- CVE-2022-44697Windows Graphics Component Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-44702Windows Terminal Remote Code Execution VulnerabilityMicrosoft Windows Terminal for Windows
- CVE-2022-44704Microsoft Windows System Monitor (Sysmon) Elevation of Privilege VulnerabilityMicrosoft Windows Sysmon
- CVE-2022-44708Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityMicrosoft Edge for iOS · Microsoft Edge
- CVE-2022-44710DirectX Graphics Kernel Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-44713Microsoft Outlook for Mac Spoofing VulnerabilityMicrosoft Office LTSC for Mac · Microsoft Office 2019 for M…
- CVE-2022-45685A stack overflow in Jettison before v1.5.2 allows attackers to cause a Denial of Service (DoS) via crafted JSON data.org.codehaus.jettison:jettison
- CVE-2022-45688A stack overflow in the XML.toJSONObject component of hutool-json v5.8.10 allows attackers to cause a Denial of Service (DoS) via crafted JScn.hutool:hutool-json · org.json:json
- CVE-2022-45689hutool-json v5.8.10 was discovered to contain an out of memory error.cn.hutool:hutool-json
- CVE-2022-45690A stack overflow in the org.json.JSONTokener.nextValue::JSONTokener.java component of hutool-json v5.8.10 allows attackers to cause a Denialcn.hutool:hutool-json
- CVE-2022-45693Jettison before v1.5.2 was discovered to contain a stack overflow via the map parameter.org.codehaus.jettison:jettison
- CVE-2022-45936A vulnerability has been identified in Mendix Email Connector (All versions < V2.0.0).Siemens Mendix Email Connector
- CVE-2022-45937A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions <Siemens APOGEE PXC Compact · Siemens APOGEE PXC Modular +2
- CVE-2022-46051The approve parameter from the AeroCMS-v0.0.1 CMS system is vulnerable to SQL injection attacks.
- CVE-2022-46345A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.264), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34Siemens Parasolid · Siemens Solid Edge SE2022 +1
- CVE-2022-46346A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.264), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34Siemens Parasolid · Siemens Solid Edge SE2022 +1
- CVE-2022-46347A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.264), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34Siemens Parasolid · Siemens Solid Edge SE2022 +1
- CVE-2022-46348A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.264), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34Siemens Parasolid · Siemens Solid Edge SE2022 +1
- CVE-2022-46349A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.264), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34Siemens Parasolid · Siemens Solid Edge SE2022 +1
- CVE-2022-46352A vulnerability has been identified in SCALANCE X204RNA (HSR) (All versions < V3.2.7), SCALANCE X204RNA (PRP) (All versions < V3.2.7), SCALASiemens SCALANCE X204RNA
- CVE-2022-46355A vulnerability has been identified in SCALANCE X204RNA (HSR) (All versions < V3.2.7), SCALANCE X204RNA (PRP) (All versions < V3.2.7), SCALASiemens SCALANCE X204RNA
- CVE-2022-46664A vulnerability has been identified in Mendix Workflow Commons (All versions < V2.4.0), Mendix Workflow Commons V2.1 (All versions < V2.1.4)Siemens Mendix Workflow Commons
- CVE-2022-47211Microsoft Office Graphics Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise
- CVE-2022-47212Microsoft Office Graphics Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise
- CVE-2022-47213Microsoft Office Graphics Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise
Medium, low and unrated 86
- CVE-2022-40264Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ICONICS/Mitsubishi Electric GENESIS64 versioICONICS and Mitsubishi Electric GENESIS64
- CVE-2022-23499Cross-Site Scripting Protection bypass in HTML SanitizerTYPO3 html-sanitizer · typo3/html-sanitizer +1
- CVE-2022-4207The Image Hover Effects Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several values that can be added to abiplob018 Image Hover Effects Ultimate
- CVE-2022-4171demon image annotation <= 5.0 - Improper Input Restriction Validationdemonisblack demon image annotation
- CVE-2022-38124Unwanted debug toolSecomea SiteManager
- CVE-2022-23523rust-vmm linux-loader vulnerable to Out-of-bounds Readrust-vmm linux-loader · linux-loader
- CVE-2022-23505Passport-wsfed-saml2 vulnerable to Authentication Bypass for WSFed authenticationauth0 passport-wsfed-saml2 · passport-wsfed-saml2
- CVE-2022-23473Tuleap MediaWiki standalone "readers" can also edit pagesEnalean tuleap
- CVE-2022-46160Tuleap dashboards vulnerable to Incorrect AuthorizationEnalean tuleap
- CVE-2022-41275In SAP Solution Manager (Enterprise Search) - versions 740, and 750, an unauthenticated attacker can generate a link that, if clicked by a lSAP Solution Manager
- CVE-2022-41274SAP Disclosure Management - version 10.1, allows an authenticated attacker to exploit certain misconfigured application endpoints to read seSAP Disclosure Management
- CVE-2022-41273Due to improper input sanitization in SAP Sourcing and SAP Contract Lifecycle Management - version 1100, an attacker can redirect a user to Sourcing and SAP Contract Lifecycle Management
- CVE-2019-25078pacparser pacparser.c pacparser_find_proxy buffer overflowpacparser
- CVE-2021-0934In findAllDeAccounts of AccountsDb.java, there is a possible denial of service due to resource exhaustion.Android
- CVE-2021-44693Affected devices don't process correctly certain special crafted packets sent to port 102/tcp, which could allow an attacker to cause a deniSiemens SIMATIC Drive Controller CPU 1504D TF · Siemens… +60
- CVE-2021-44694Affected devices don't process correctly certain special crafted packets sent to port 102/tcp, which could allow an attacker to cause a deniSiemens SIMATIC Drive Controller CPU 1504D TF · Siemens… +60
- CVE-2021-44695Affected devices don't process correctly certain special crafted packets sent to port 102/tcp, which could allow an attacker to cause a deniSiemens SIMATIC Drive Controller CPU 1504D TF · Siemens… +60
- CVE-2022-20240In sOpAllowSystemRestrictionBypass of AppOpsManager.java, there is a possible leak of location information due to a missing permission checkAndroid
- CVE-2022-20449In writeApplicationRestrictionsLAr of UserManagerService.java, there is a possible overwrite of system files due to a path traversal error.Android
- CVE-2022-20466In applyKeyguardFlags of NotificationShadeWindowControllerImpl.java, there is a possible way to observe the user's password on a secondary dAndroid
- CVE-2022-20468In BNEP_ConnectResp of bnep_api.cc, there is a possible out of bounds read due to an incorrect bounds check.Android
- CVE-2022-20471In SendIncDecRestoreCmdPart2 of NxpMfcReader.cc, there is a possible out of bounds read due to a missing bounds check.Android
- CVE-2022-20476In setEnabledSetting of PackageManager.java, there is a possible way to get the device into an infinite reboot loop due to resource exhaustiAndroid
- CVE-2022-20482In createNotificationChannel of NotificationManager.java, there is a possible way to make the device unusable and require factory reset due Android
- CVE-2022-20496In setDataSource of initMediaExtractor.cpp, there is a possibility of arbitrary code execution due to a use after free.Android
- CVE-2022-20497In updatePublicMode of NotificationLockscreenUserManagerImpl.java, there is a possible way to reveal sensitive notifications on the lockscreAndroid
- CVE-2022-20498In fdt_path_offset_namelen of fdt_ro.c, there is a possible out of bounds read due to an incorrect bounds check.Android
- CVE-2022-20500In loadFromXml of ShortcutPackage.java, there is a possible crash on boot due to an uncaught exception.Android
- CVE-2022-20502In GetResolvedMethod of entrypoint_utils-inl.h, there is a possible use after free due to a stale cache.Android
- CVE-2022-24480Outlook for Android Elevation of Privilege VulnerabilityMicrosoft Outlook for Android
- CVE-2022-25675Denial of service due to reachable assertion in modem while processing filter rule from application client in Snapdragon Compute, SnapdragonQualcomm Snapdragon Compute, Snapdragon Industrial IOT, Sna…
- CVE-2022-25677Memory corruption in diag due to use after free while processing dci packet in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT,Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2022-25711Memory corruption in camera due to improper validation of array index in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, SnapdQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2022-25712Memory corruption in camera due to buffer copy without checking size of input in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2022-27581Use of a Broken or Risky Cryptographic Algorithm in SICK RFU61x firmware version <v2.25 allows a low-privileged remote attacker to decrypt tSICK RFU61x Firmware
- CVE-2022-31697The vCenter Server contains an information disclosure vulnerability due to the logging of credentials in plaintext.VMware vCenter Server, VMware Cloud Foundation
- CVE-2022-31698The vCenter Server contains a denial-of-service vulnerability in the content library service.VMware vCenter Server, VMware Cloud Foundation
- CVE-2022-31699VMware ESXi contains a heap-overflow vulnerability.VMware ESXi, VMware Cloud Foundation
- CVE-2022-38628Nortek Linear eMerge E3-Series 0.32-08f, 0.32-07p, 0.32-07e, 0.32-09c, 0.32-09b, 0.32-09a, and 0.32-08e were discovered to contain a cross-s
- CVE-2022-41074Windows Graphics Component Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2022-41115Microsoft Edge (Chromium-based) Update Elevation of Privilege VulnerabilityMicrosoft Edge (Chromium-based) Updater
- CVE-2022-41278A vulnerability has been identified in JT2Go (All versions < V14.1.0.6), Teamcenter Visualization V13.2 (All versions < V13.2.0.12), TeamcenSiemens JT2Go · Siemens Teamcenter Visualization
- CVE-2022-41279A vulnerability has been identified in JT2Go (All versions < V14.1.0.6), Teamcenter Visualization V13.2 (All versions < V13.2.0.12), TeamcenSiemens JT2Go · Siemens Teamcenter Visualization
- CVE-2022-41280A vulnerability has been identified in JT2Go (All versions < V14.1.0.6), Teamcenter Visualization V13.2 (All versions < V13.2.0.12), TeamcenSiemens JT2Go · Siemens Teamcenter Visualization
- CVE-2022-41287A vulnerability has been identified in JT2Go (All versions < V14.1.0.6), Teamcenter Visualization V13.2 (All versions < V13.2.0.12), TeamcenSiemens JT2Go · Siemens Teamcenter Visualization
- CVE-2022-41288A vulnerability has been identified in JT2Go (All versions < V14.1.0.6), Teamcenter Visualization V13.2 (All versions < V13.2.0.12), TeamcenSiemens JT2Go · Siemens Teamcenter Visualization
- CVE-2022-41915Netty project is an event-driven asynchronous network application framework.netty · io.netty:netty-codec-http
- CVE-2022-42141Delta Electronics DX-2100-L1-CN 2.42 is vulnerable to Cross Site Scripting (XSS) via lform/urlfilter.
- CVE-2022-43996The csaf_provider package before 0.8.2 allows XSS via a crafted CSAF document uploaded as text/html.github.com/csaf-poc/csaf_distribution
- CVE-2022-44303Resque Scheduler version 1.27.4 is vulnerable to Cross-site scripting (XSS).resque-scheduler
- CVE-2022-4444ipti br.tag cross site scriptingipti br.tag
- CVE-2022-4454m0ver bible-online Search search.java query sql injectionm0ver bible-online
- CVE-2022-4455sproctor php-calendar index.php cross site scriptingsproctor php-calendar
- CVE-2022-4456falling-fruit cross site scriptingfalling-fruit
- CVE-2022-44575A vulnerability has been identified in PLM Help Server V4.2 (All versions).Siemens PLM Help Server
- CVE-2022-44636The Samsung TV (2021 and 2022 model) smart remote control allows attackers to enable microphone access via Bluetooth spoofing when a user is
- CVE-2022-44674Windows Bluetooth Driver Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2022-44679Windows Graphics Component Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2022-44682Windows Hyper-V Denial of Service VulnerabilityMicrosoft Windows
- CVE-2022-44688Microsoft Edge (Chromium-based) Spoofing VulnerabilityMicrosoft Edge
- CVE-2022-44698Windows SmartScreen Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2022-44699Azure Network Watcher Agent Security Feature Bypass VulnerabilityMicrosoft Azure Network Watcher VM Extension
- CVE-2022-44707Windows Kernel Denial of Service VulnerabilityMicrosoft Windows
- CVE-2022-44731A vulnerability has been identified in SIMATIC WinCC OA V3.15 (All versions < V3.15 P038), SIMATIC WinCC OA V3.16 (All versions < V3.16 P035Siemens SIMATIC WinCC OA
- CVE-2022-44874wasm3 commit 7890a2097569fde845881e0b352d813573e371f9 was discovered to contain a segmentation fault via the component op_CallIndirect at /m
- CVE-2022-45028A cross-site scripting (XSS) vulnerability in Arris NVG443B 9.3.0h3d36 allows attackers to execute arbitrary web scripts or HTML via a craft
- CVE-2022-45044A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions < V9.50), SIPROTEC 5 6MD85 (CP200) (All versions), SIPROTEC 5 Siemens SIPROTEC 5 6MD84 · Siemens SIPROTEC 5 6MD85 +38
- CVE-2022-45484A vulnerability has been identified in JT2Go (All versions < V14.1.0.6), Teamcenter Visualization V13.2 (All versions < V13.2.0.12), TeamcenSiemens JT2Go · Siemens Teamcenter Visualization
- CVE-2022-45871Denial-of-Service (DoS) Vulnerability
- CVE-2022-46047AeroCMS v0.0.1 is vulnerable to SQL Injection via the delete parameter.
- CVE-2022-46058AeroCMS v0.0.1 was discovered to contain a cross-site scripting (XSS) vulnerability via add_post.php.
- CVE-2022-46059AeroCMS v0.0.1 is vulnerable to Cross Site Request Forgery (CSRF).
- CVE-2022-46061AeroCMS v0.0.1 is vulnerable to ClickJacking.
- CVE-2022-46062Gym Management System v0.0.1 is vulnerable to Cross Site Request Forgery (CSRF).
- CVE-2022-46140Affected devices use a weak encryption scheme to encrypt the debug zip file.Siemens RUGGEDCOM RM1224 LTE(4G) EU · Siemens RUGGEDCOM… +87
- CVE-2022-46142Affected devices store the CLI user passwords encrypted in flash memory.Siemens RUGGEDCOM RM1224 LTE(4G) EU · Siemens RUGGEDCOM… +87
- CVE-2022-46143Affected devices do not check the TFTP blocksize correctly.Siemens RUGGEDCOM RM1224 LTE(4G) EU · Siemens RUGGEDCOM… +89
- CVE-2022-46144A vulnerability has been identified in SCALANCE SC622-2C (6GK5622-2GS00-2AC2) (All versions < V2.3), SCALANCE SC622-2C (6GK5622-2GS00-2AC2) Siemens SCALANCE SC622-2C · Siemens SCALANCE SC626-2C +8
- CVE-2022-46265A vulnerability has been identified in Polarion ALM (All versions < V2304.0).Siemens Polarion ALM
- CVE-2022-46350A vulnerability has been identified in SCALANCE X204RNA (HSR) (All versions < V3.2.7), SCALANCE X204RNA (PRP) (All versions < V3.2.7), SCALASiemens SCALANCE X204RNA
- CVE-2022-46351A vulnerability has been identified in SCALANCE X204RNA (HSR) (All versions < V3.2.7), SCALANCE X204RNA (PRP) (All versions < V3.2.7), SCALASiemens SCALANCE X204RNA
- CVE-2022-46354A vulnerability has been identified in SCALANCE X204RNA (HSR) (All versions < V3.2.7), SCALANCE X204RNA (PRP) (All versions < V3.2.7), SCALASiemens SCALANCE X204RNA
- CVE-2022-46381Certain Linear eMerge E3-Series devices are vulnerable to XSS via the type parameter (e.g., to the badging/badge_template_v0.php component).
- CVE-2022-46832Use of a Broken or Risky Cryptographic Algorithm in SICK RFU62x firmware version < 2.21 allows a low-privileged remote attacker to decrypt tSICK RFU62x Firmware
- CVE-2022-46833Use of a Broken or Risky Cryptographic Algorithm in SICK RFU63x firmware version < v2.21 allows a low-privileged remote attacker to decrypt SICK RFU63x Firmware
- CVE-2022-46834Use of a Broken or Risky Cryptographic Algorithm in SICK RFU65x firmware version < v2.21 allows a low-privileged remote attacker to decrypt SICK RFU65x Firmware