Total
210374 CVE
CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
---|---|---|---|---|---|
CVE-2022-20057 | 2 Google, Mediatek | 23 Android, Mt6739, Mt6758 and 20 more | 2022-03-17 | 4.4 MEDIUM | 6.5 MEDIUM |
In btif, there is a possible memory corruption due to incorrect error handling. This could lead to local escalation of privilege with System execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS06271186; Issue ID: ALPS06271186. | |||||
CVE-2022-20055 | 2 Google, Mediatek | 33 Android, Mt6761, Mt6762 and 30 more | 2022-03-17 | 7.2 HIGH | 6.8 MEDIUM |
In preloader (usb), there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, for an attacker who has physical access to the device, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS06160806; Issue ID: ALPS06160830. | |||||
CVE-2022-24915 | 1 Ipcomm | 2 Ipdio, Ipdio Firmware | 2022-03-17 | 6.8 MEDIUM | 8.8 HIGH |
The absence of filters when loading some sections in the web application of the vulnerable device allows attackers to inject malicious code that will be interpreted when a legitimate user accesses the web section where the information is displayed. Injection can be done on specific parameters. The injected code is executed when a legitimate user attempts to upload, copy, download, or delete an existing configuration (Administrative Services). | |||||
CVE-2022-20054 | 2 Google, Mediatek | 31 Android, Mt6580, Mt6739 and 28 more | 2022-03-17 | 4.6 MEDIUM | 7.8 HIGH |
In ims service, there is a possible AT command injection due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06219083; Issue ID: ALPS06219083. | |||||
CVE-2021-44734 | 1 Lexmark | 467 6500e, 6500e Firmware, B2236 and 464 more | 2022-03-17 | 10.0 HIGH | 9.8 CRITICAL |
Embedded web server input sanitization vulnerability in Lexmark devices through 2021-12-07, which can which can lead to remote code execution on the device. | |||||
CVE-2022-20053 | 2 Google, Mediatek | 60 Android, Mt6731, Mt6732 and 57 more | 2022-03-17 | 7.2 HIGH | 7.8 HIGH |
In ims service, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06219097; Issue ID: ALPS06219097. | |||||
CVE-2022-20051 | 2 Google, Mediatek | 63 Android, Mt6731, Mt6732 and 60 more | 2022-03-17 | 2.1 LOW | 5.5 MEDIUM |
In ims service, there is a possible unexpected application behavior due to incorrect privilege assignment. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06219127; Issue ID: ALPS06219127. | |||||
CVE-2022-22990 | 1 Westerndigital | 11 My Cloud, My Cloud Dl2100, My Cloud Dl4100 and 8 more | 2022-03-17 | 8.3 HIGH | 8.8 HIGH |
A limited authentication bypass vulnerability was discovered that could allow an attacker to achieve remote code execution and escalate privileges on the My Cloud devices. Addressed this vulnerability by changing access token validation logic and rewriting rule logic on PHP scripts. | |||||
CVE-2022-20050 | 2 Google, Mediatek | 49 Android, Mt6762, Mt6765 and 46 more | 2022-03-17 | 4.6 MEDIUM | 6.7 MEDIUM |
In connsyslogger, there is a possible symbolic link following due to improper link resolution. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06335038; Issue ID: ALPS06335038. | |||||
CVE-2021-35244 | 2 Microsoft, Solarwinds | 2 Windows, Orion Platform | 2022-03-17 | 8.5 HIGH | 7.2 HIGH |
The "Log alert to a file" action within action management enables any Orion Platform user with Orion alert management rights to write to any file. An attacker with Orion alert management rights could use this vulnerability to perform an unrestricted file upload causing a remote code execution. | |||||
CVE-2022-20049 | 2 Google, Mediatek | 21 Android, Mt6779, Mt6785 and 18 more | 2022-03-17 | 4.6 MEDIUM | 6.7 MEDIUM |
In vpu, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05954679; Issue ID: ALPS05954679. | |||||
CVE-2022-24748 | 1 Shopware | 1 Shopware | 2022-03-17 | 5.0 MEDIUM | 7.5 HIGH |
Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In versions prior to 6.4.8.2 it is possible to modify customers and to create orders without App Permission. This issue is a result of improper api route checking. Users are advised to upgrade to version 6.4.8.2. There are no known workarounds. | |||||
CVE-2022-24747 | 1 Shopware | 1 Shopware | 2022-03-17 | 5.0 MEDIUM | 5.3 MEDIUM |
Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. Affected versions of shopware do no properly set sensitive HTTP headers to be non-cacheable. If there is an HTTP cache between the server and client then headers may be exposed via HTTP caches. This issue has been resolved in version 6.4.8.2. There are no known workarounds. | |||||
CVE-2022-20048 | 2 Google, Mediatek | 11 Android, Mt5816, Mt5835 and 8 more | 2022-03-17 | 7.2 HIGH | 7.8 HIGH |
In video decoder, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05917502; Issue ID: ALPS05917502. | |||||
CVE-2022-24607 | 1 Luocms Project | 1 Luocms | 2022-03-17 | 7.5 HIGH | 9.8 CRITICAL |
Luocms v2.0 is affected by SQL Injection in /admin/news/news_ok.php. | |||||
CVE-2022-24606 | 1 Luocms Project | 1 Luocms | 2022-03-17 | 7.5 HIGH | 9.8 CRITICAL |
Luocms v2.0 is affected by SQL Injection in /admin/news/sort_ok.php. | |||||
CVE-2022-24609 | 1 Luocms Project | 1 Luocms | 2022-03-17 | 10.0 HIGH | 9.8 CRITICAL |
Luocms v2.0 is affected by an incorrect access control vulnerability. Through /admin/templates/template_manage.php, an attacker can write an arbitrary shell file. | |||||
CVE-2022-24605 | 1 Luocms Project | 1 Luocms | 2022-03-17 | 7.5 HIGH | 9.8 CRITICAL |
Luocms v2.0 is affected by SQL Injection in /admin/link/link_ok.php. | |||||
CVE-2022-24604 | 1 Luocms Project | 1 Luocms | 2022-03-17 | 7.5 HIGH | 9.8 CRITICAL |
Luocms v2.0 is affected by SQL Injection in /admin/link/link_mod.php. | |||||
CVE-2022-21137 | 1 Omron | 1 Cx-one | 2022-03-17 | 6.8 MEDIUM | 7.8 HIGH |
Omron CX-One Versions 4.60 and prior are vulnerable to a stack-based buffer overflow while processing specific project files, which may allow an attacker to execute arbitrary code. |