Total
210374 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2022-20079 | 2 Google, Mediatek | 17 Android, Mt6781, Mt6785 and 14 more | 2022-04-18 | 2.1 LOW | 4.4 MEDIUM |
| In vow, there is a possible read of uninitialized data due to a improper input validation. This could lead to local information disclosure with System execution privileges needed. User interaction is no needed for exploitation. Patch ID: ALPS05837742; Issue ID: ALPS05857289. | |||||
| CVE-2022-1067 | 1 Lifepoint | 1 Patient Portal | 2022-04-18 | 4.0 MEDIUM | 6.5 MEDIUM |
| Navigating to a specific URL with a patient ID number will result in the server generating a PDF of a lab report without authentication and rate limiting. | |||||
| CVE-2022-0999 | 1 Myscada | 1 Mypro | 2022-04-18 | 9.0 HIGH | 8.8 HIGH |
| An authenticated user may be able to misuse parameters to inject arbitrary operating system commands into mySCADA myPRO versions 8.25.0 and prior. | |||||
| CVE-2022-0835 | 1 Aveva | 1 System Platform | 2022-04-18 | 1.9 LOW | 5.5 MEDIUM |
| AVEVA System Platform 2020 stores sensitive information in cleartext, which may allow access to an attacker or a low-privileged user. | |||||
| CVE-2021-43177 | 1 Tinfoilsecurity | 1 Devise-two-factor | 2022-04-18 | 3.5 LOW | 5.3 MEDIUM |
| As a result of an incomplete fix for CVE-2015-7225, in versions of devise-two-factor prior to 4.0.2 it is possible to reuse a One-Time-Password (OTP) for one (and only one) immediately trailing interval. CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) | |||||
| CVE-2021-38125 | 1 Microfocus | 1 Operations Bridge | 2022-04-18 | 6.8 MEDIUM | 9.8 CRITICAL |
| Unauthenticated remote code execution in Micro Focus Operations Bridge containerized, affecting versions 2021.05, 2021.08, and newer versions of Micro Focus Operations Bridge containerized if the deployment was upgraded from 2021.05 or 2021.08. The vulnerability could be exploited to unauthenticated remote code execution. | |||||
| CVE-2022-22517 | 1 Codesys | 20 Control For Beaglebone Sl, Control For Beckhoff Cx9020, Control For Empc-a\/imx6 Sl and 17 more | 2022-04-18 | 5.0 MEDIUM | 7.5 HIGH |
| An unauthenticated, remote attacker can disrupt existing communication channels between CODESYS products by guessing a valid channel ID and injecting packets. This results in the communication channel to be closed. | |||||
| CVE-2022-20077 | 2 Google, Mediatek | 17 Android, Mt6781, Mt6785 and 14 more | 2022-04-18 | 6.9 MEDIUM | 6.4 MEDIUM |
| In vow, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is no needed for exploitation. Patch ID: ALPS05837742; Issue ID: ALPS05852812. | |||||
| CVE-2022-20076 | 2 Google, Mediatek | 63 Android, Mt6580, Mt6731 and 60 more | 2022-04-18 | 2.1 LOW | 4.4 MEDIUM |
| In ged, there is a possible memory corruption due to an incorrect error handling. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05838808; Issue ID: ALPS05839556. | |||||
| CVE-2022-20075 | 2 Google, Mediatek | 63 Android, Mt6580, Mt6731 and 60 more | 2022-04-18 | 7.2 HIGH | 6.7 MEDIUM |
| In ged, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05838808; Issue ID: ALPS05838808. | |||||
| CVE-2022-27161 | 1 Cszcms | 1 Csz Cms | 2022-04-18 | 7.5 HIGH | 9.8 CRITICAL |
| Csz Cms 1.2.2 is vulnerable to SQL Injection via cszcms_admin_Members_viewUsers | |||||
| CVE-2022-27165 | 1 Cszcms | 1 Csz Cms | 2022-04-18 | 7.5 HIGH | 9.8 CRITICAL |
| CSZ CMS 1.2.2 is vulnerable to SQL Injection via cszcms_admin_Plugin_manager_setstatus | |||||
| CVE-2022-27164 | 1 Cszcms | 1 Csz Cms | 2022-04-18 | 7.5 HIGH | 9.8 CRITICAL |
| CSZ CMS 1.2.2 is vulnerable to SQL Injection via cszcms_admin_Users_viewUsers | |||||
| CVE-2022-27163 | 1 Cszcms | 1 Csz Cms | 2022-04-18 | 7.5 HIGH | 9.8 CRITICAL |
| CSZ CMS 1.2.2 is vulnerable to SQL Injection via cszcms_admin_Users_editUser | |||||
| CVE-2022-27162 | 1 Cszcms | 1 Csz Cms | 2022-04-18 | 7.5 HIGH | 9.8 CRITICAL |
| CSZ CMS 1.2.2 is vulnerable to SQL Injection via cszcms_admin_Members_editUser | |||||
| CVE-2022-28650 | 1 Jetbrains | 1 Youtrack | 2022-04-18 | 3.5 LOW | 5.4 MEDIUM |
| In JetBrains YouTrack before 2022.1.43700 it was possible to inject JavaScript into Markdown in the YouTrack Classic UI | |||||
| CVE-2022-26635 | 1 Php | 1 Memcached | 2022-04-18 | 7.5 HIGH | 9.8 CRITICAL |
| PHP-Memcached v2.2.0 and below contains an improper NULL termination which allows attackers to execute CLRF injection. | |||||
| CVE-2022-22356 | 1 Ibm | 1 Mq Appliance | 2022-04-18 | 4.0 MEDIUM | 6.5 MEDIUM |
| IBM MQ Appliance 9.2 CD and 9.2 LTS could allow an attacker to enumerate account credentials due to an observable discrepancy in valid and invalid login attempts. IBM X-Force ID: 220487. | |||||
| CVE-2022-22355 | 1 Ibm | 1 Mq Appliance | 2022-04-18 | 5.0 MEDIUM | 5.3 MEDIUM |
| IBM MQ Appliance 9.2 CD and 9.2 LTS are vulnerable to a denial of service in the Login component of the application which could allow an attacker to cause a drop in performance. | |||||
| CVE-2022-24795 | 1 Yajl-ruby Project | 1 Yajl-ruby | 2022-04-18 | 5.0 MEDIUM | 7.5 HIGH |
| yajl-ruby is a C binding to the YAJL JSON parsing and generation library. The 1.x branch and the 2.x branch of `yajl` contain an integer overflow which leads to subsequent heap memory corruption when dealing with large (~2GB) inputs. The reallocation logic at `yajl_buf.c#L64` may result in the `need` 32bit integer wrapping to 0 when `need` approaches a value of 0x80000000 (i.e. ~2GB of data), which results in a reallocation of buf->alloc into a small heap chunk. These integers are declared as `size_t` in the 2.x branch of `yajl`, which practically prevents the issue from triggering on 64bit platforms, however this does not preclude this issue triggering on 32bit builds on which `size_t` is a 32bit integer. Subsequent population of this under-allocated heap chunk is based on the original buffer size, leading to heap memory corruption. This vulnerability mostly impacts process availability. Maintainers believe exploitation for arbitrary code execution is unlikely. A patch is available and anticipated to be part of yajl-ruby version 1.4.2. As a workaround, avoid passing large inputs to YAJL. | |||||