Vulnerabilities (CVE)

Join the Common Vulnerabilities and Exposures (CVE) community and start to get notified about new vulnerabilities.

Total 210374 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2022-20057 2 Google, Mediatek 23 Android, Mt6739, Mt6758 and 20 more 2022-03-17 4.4 MEDIUM 6.5 MEDIUM
In btif, there is a possible memory corruption due to incorrect error handling. This could lead to local escalation of privilege with System execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS06271186; Issue ID: ALPS06271186.
CVE-2022-20055 2 Google, Mediatek 33 Android, Mt6761, Mt6762 and 30 more 2022-03-17 7.2 HIGH 6.8 MEDIUM
In preloader (usb), there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, for an attacker who has physical access to the device, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS06160806; Issue ID: ALPS06160830.
CVE-2022-24915 1 Ipcomm 2 Ipdio, Ipdio Firmware 2022-03-17 6.8 MEDIUM 8.8 HIGH
The absence of filters when loading some sections in the web application of the vulnerable device allows attackers to inject malicious code that will be interpreted when a legitimate user accesses the web section where the information is displayed. Injection can be done on specific parameters. The injected code is executed when a legitimate user attempts to upload, copy, download, or delete an existing configuration (Administrative Services).
CVE-2022-20054 2 Google, Mediatek 31 Android, Mt6580, Mt6739 and 28 more 2022-03-17 4.6 MEDIUM 7.8 HIGH
In ims service, there is a possible AT command injection due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06219083; Issue ID: ALPS06219083.
CVE-2021-44734 1 Lexmark 467 6500e, 6500e Firmware, B2236 and 464 more 2022-03-17 10.0 HIGH 9.8 CRITICAL
Embedded web server input sanitization vulnerability in Lexmark devices through 2021-12-07, which can which can lead to remote code execution on the device.
CVE-2022-20053 2 Google, Mediatek 60 Android, Mt6731, Mt6732 and 57 more 2022-03-17 7.2 HIGH 7.8 HIGH
In ims service, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06219097; Issue ID: ALPS06219097.
CVE-2022-20051 2 Google, Mediatek 63 Android, Mt6731, Mt6732 and 60 more 2022-03-17 2.1 LOW 5.5 MEDIUM
In ims service, there is a possible unexpected application behavior due to incorrect privilege assignment. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06219127; Issue ID: ALPS06219127.
CVE-2022-22990 1 Westerndigital 11 My Cloud, My Cloud Dl2100, My Cloud Dl4100 and 8 more 2022-03-17 8.3 HIGH 8.8 HIGH
A limited authentication bypass vulnerability was discovered that could allow an attacker to achieve remote code execution and escalate privileges on the My Cloud devices. Addressed this vulnerability by changing access token validation logic and rewriting rule logic on PHP scripts.
CVE-2022-20050 2 Google, Mediatek 49 Android, Mt6762, Mt6765 and 46 more 2022-03-17 4.6 MEDIUM 6.7 MEDIUM
In connsyslogger, there is a possible symbolic link following due to improper link resolution. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06335038; Issue ID: ALPS06335038.
CVE-2021-35244 2 Microsoft, Solarwinds 2 Windows, Orion Platform 2022-03-17 8.5 HIGH 7.2 HIGH
The "Log alert to a file" action within action management enables any Orion Platform user with Orion alert management rights to write to any file. An attacker with Orion alert management rights could use this vulnerability to perform an unrestricted file upload causing a remote code execution.
CVE-2022-20049 2 Google, Mediatek 21 Android, Mt6779, Mt6785 and 18 more 2022-03-17 4.6 MEDIUM 6.7 MEDIUM
In vpu, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05954679; Issue ID: ALPS05954679.
CVE-2022-24748 1 Shopware 1 Shopware 2022-03-17 5.0 MEDIUM 7.5 HIGH
Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In versions prior to 6.4.8.2 it is possible to modify customers and to create orders without App Permission. This issue is a result of improper api route checking. Users are advised to upgrade to version 6.4.8.2. There are no known workarounds.
CVE-2022-24747 1 Shopware 1 Shopware 2022-03-17 5.0 MEDIUM 5.3 MEDIUM
Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. Affected versions of shopware do no properly set sensitive HTTP headers to be non-cacheable. If there is an HTTP cache between the server and client then headers may be exposed via HTTP caches. This issue has been resolved in version 6.4.8.2. There are no known workarounds.
CVE-2022-20048 2 Google, Mediatek 11 Android, Mt5816, Mt5835 and 8 more 2022-03-17 7.2 HIGH 7.8 HIGH
In video decoder, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05917502; Issue ID: ALPS05917502.
CVE-2022-24607 1 Luocms Project 1 Luocms 2022-03-17 7.5 HIGH 9.8 CRITICAL
Luocms v2.0 is affected by SQL Injection in /admin/news/news_ok.php.
CVE-2022-24606 1 Luocms Project 1 Luocms 2022-03-17 7.5 HIGH 9.8 CRITICAL
Luocms v2.0 is affected by SQL Injection in /admin/news/sort_ok.php.
CVE-2022-24609 1 Luocms Project 1 Luocms 2022-03-17 10.0 HIGH 9.8 CRITICAL
Luocms v2.0 is affected by an incorrect access control vulnerability. Through /admin/templates/template_manage.php, an attacker can write an arbitrary shell file.
CVE-2022-24605 1 Luocms Project 1 Luocms 2022-03-17 7.5 HIGH 9.8 CRITICAL
Luocms v2.0 is affected by SQL Injection in /admin/link/link_ok.php.
CVE-2022-24604 1 Luocms Project 1 Luocms 2022-03-17 7.5 HIGH 9.8 CRITICAL
Luocms v2.0 is affected by SQL Injection in /admin/link/link_mod.php.
CVE-2022-21137 1 Omron 1 Cx-one 2022-03-17 6.8 MEDIUM 7.8 HIGH
Omron CX-One Versions 4.60 and prior are vulnerable to a stack-based buffer overflow while processing specific project files, which may allow an attacker to execute arbitrary code.