Total
22706 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2022-23704 | 2 Hp, Hpe | 59 Integrated Lights-out 4, Apollo 4200 Gen9 Server, Proliant Bl420c Gen8 Server and 56 more | 2022-05-19 | 5.0 MEDIUM | 7.5 HIGH |
| A potential security vulnerability has been identified in Integrated Lights-Out 4 (iLO 4). The vulnerability could allow remote Denial of Service. The vulnerability is resolved in Integrated Lights-Out 4 (iLO 4) 2.80 and later. | |||||
| CVE-2021-26348 | 1 Amd | 46 Epyc 72f3, Epyc 72f3 Firmware, Epyc 7313 and 43 more | 2022-05-19 | 2.1 LOW | 5.5 MEDIUM |
| Failure to flush the Translation Lookaside Buffer (TLB) of the I/O memory management unit (IOMMU) may lead an IO device to write to memory it should not be able to access, resulting in a potential loss of integrity. | |||||
| CVE-2022-22019 | 1 Microsoft | 10 Windows 10, Windows 11, Windows 7 and 7 more | 2022-05-18 | 6.8 MEDIUM | 8.8 HIGH |
| Remote Procedure Call Runtime Remote Code Execution Vulnerability. | |||||
| CVE-2022-26923 | 1 Microsoft | 7 Windows 10, Windows 11, Windows 8.1 and 4 more | 2022-05-18 | 9.0 HIGH | 8.8 HIGH |
| Active Directory Domain Services Elevation of Privilege Vulnerability. | |||||
| CVE-2022-23279 | 1 Microsoft | 3 Windows 10, Windows 11, Windows Server 2022 | 2022-05-18 | 4.4 MEDIUM | 7.0 HIGH |
| Windows ALPC Elevation of Privilege Vulnerability. | |||||
| CVE-2022-23270 | 1 Microsoft | 9 Windows 10, Windows 11, Windows 7 and 6 more | 2022-05-18 | 9.3 HIGH | 8.1 HIGH |
| Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-21972. | |||||
| CVE-2022-22017 | 1 Microsoft | 3 Remote Desktop, Windows 11, Windows Server 2022 | 2022-05-18 | 9.3 HIGH | 8.8 HIGH |
| Remote Desktop Client Remote Code Execution Vulnerability. | |||||
| CVE-2022-21978 | 1 Microsoft | 1 Exchange Server | 2022-05-18 | 7.2 HIGH | 8.2 HIGH |
| Microsoft Exchange Server Elevation of Privilege Vulnerability. | |||||
| CVE-2021-27762 | 1 Hcltech | 1 Bigfix Platform | 2022-05-18 | 7.5 HIGH | 9.8 CRITICAL |
| Misconfigured security-related HTTP headers: Several security-related headers were missing or mis-configured on the web responses | |||||
| CVE-2022-22012 | 1 Microsoft | 9 Windows 10, Windows 11, Windows 7 and 6 more | 2022-05-17 | 9.3 HIGH | 9.8 CRITICAL |
| Windows LDAP Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-22013, CVE-2022-22014, CVE-2022-29128, CVE-2022-29129, CVE-2022-29130, CVE-2022-29131, CVE-2022-29137, CVE-2022-29139, CVE-2022-29141. | |||||
| CVE-2022-22013 | 1 Microsoft | 9 Windows 10, Windows 11, Windows 7 and 6 more | 2022-05-17 | 6.5 MEDIUM | 8.8 HIGH |
| Windows LDAP Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-22012, CVE-2022-22014, CVE-2022-29128, CVE-2022-29129, CVE-2022-29130, CVE-2022-29131, CVE-2022-29137, CVE-2022-29139, CVE-2022-29141. | |||||
| CVE-2022-22014 | 1 Microsoft | 9 Windows 10, Windows 11, Windows 7 and 6 more | 2022-05-17 | 6.5 MEDIUM | 8.8 HIGH |
| Windows LDAP Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-22012, CVE-2022-22013, CVE-2022-29128, CVE-2022-29129, CVE-2022-29130, CVE-2022-29131, CVE-2022-29137, CVE-2022-29139, CVE-2022-29141. | |||||
| CVE-2021-26408 | 1 Amd | 76 Epyc 7001, Epyc 7001 Firmware, Epyc 7002 and 73 more | 2022-05-17 | 6.6 MEDIUM | 7.1 HIGH |
| Insufficient validation of elliptic curve points in SEV-legacy firmware may compromise SEV-legacy guest migration potentially resulting in loss of guest's integrity or confidentiality. | |||||
| CVE-2022-28470 | 1 Python | 1 Pypi | 2022-05-17 | 7.5 HIGH | 9.8 CRITICAL |
| marcador package in PyPI 0.1 through 0.13 included a code-execution backdoor. | |||||
| CVE-2022-29164 | 1 Argo Workflows Project | 1 Argo Workflows | 2022-05-17 | 4.6 MEDIUM | 7.1 HIGH |
| Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. In affected versions an attacker can create a workflow which produces a HTML artifact containing an HTML file that contains a script which uses XHR calls to interact with the Argo Server API. The attacker emails the deep-link to the artifact to their victim. The victim opens the link, the script starts running. As the script has access to the Argo Server API (as the victim), so may read information about the victim’s workflows, or create and delete workflows. Note the attacker must be an insider: they must have access to the same cluster as the victim and must already be able to run their own workflows. The attacker must have an understanding of the victim’s system. We have seen no evidence of this in the wild. We urge all users to upgrade to the fixed versions. | |||||
| CVE-2022-20120 | 1 Google | 1 Android | 2022-05-17 | 10.0 HIGH | 9.8 CRITICAL |
| Product: AndroidVersions: Android kernelAndroid ID: A-203213034References: N/A | |||||
| CVE-2021-28090 | 2 Fedoraproject, Torproject | 2 Fedora, Tor | 2022-05-16 | 5.0 MEDIUM | 5.3 MEDIUM |
| Tor before 0.4.5.7 allows a remote attacker to cause Tor directory authorities to exit with an assertion failure, aka TROVE-2021-002. | |||||
| CVE-2021-29650 | 3 Debian, Fedoraproject, Linux | 3 Debian Linux, Fedora, Linux Kernel | 2022-05-16 | 4.9 MEDIUM | 5.5 MEDIUM |
| An issue was discovered in the Linux kernel before 5.11.11. The netfilter subsystem allows attackers to cause a denial of service (panic) because net/netfilter/x_tables.c and include/linux/netfilter/x_tables.h lack a full memory barrier upon the assignment of a new table value, aka CID-175e476b8cdf. | |||||
| CVE-2022-30286 | 1 Pyscript | 1 Pyscript | 2022-05-16 | 5.0 MEDIUM | 7.5 HIGH |
| pyscriptjs (aka PyScript Demonstrator) in PyScript through 2022-05-04 allows a remote user to read Python source code. | |||||
| CVE-2022-20758 | 1 Cisco | 1 Ios Xr | 2022-05-16 | 7.1 HIGH | 6.8 MEDIUM |
| A vulnerability in the implementation of the Border Gateway Protocol (BGP) Ethernet VPN (EVPN) functionality in Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. This vulnerability is due to the incorrect processing of a BGP update message that contains specific EVPN attributes. An attacker could exploit this vulnerability by sending a BGP update message that contains specific EVPN attributes. To exploit this vulnerability, an attacker must control a BGP speaker that has an established trusted peer connection to an affected device that is configured with the address family L2VPN EVPN to receive and process the update message. This vulnerability cannot be exploited by any data that is initiated by clients on the Layer 2 network or by peers that are not configured to accept the L2VPN EVPN address family. A successful exploit could allow the attacker to cause the BGP process to restart unexpectedly, resulting in a DoS condition. The Cisco implementation of BGP accepts incoming BGP updates only from explicitly defined peers. For this vulnerability to be exploited, the malicious BGP update message must either come from a configured, valid BGP peer or be injected by the attacker into the affected BGP network on an existing, valid TCP connection to a BGP peer. | |||||