Filtered by CWE-20
Filtered by vendor Subscriptions
Total 12661 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2022-24051 3 Fedoraproject, Mariadb, Redhat 4 Fedora, Mariadb, Enterprise Linux and 1 more 2024-11-21 7.8 High
MariaDB CONNECT Storage Engine Format String Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL queries. The issue results from the lack of proper validation of a user-supplied string before using it as a format specifier. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-16193.
CVE-2022-24037 1 Karmasis 1 Infraskope Siem\+ 2024-11-21 8.2 High
Karmasis Informatics Infraskope SIEM+ has an unauthenticated access vulnerability which could allow an unauthenticated attacker to obtain critical information.
CVE-2022-24000 1 Google 1 Android 2024-11-21 3.9 Low
PendingIntent hijacking vulnerability in DataUsageReminderReceiver prior to SMR Feb-2022 Release 1 allows local attackers to access media files without permission in KnoxPrivacyNoticeReceiver via implicit Intent.
CVE-2022-23999 1 Google 1 Android 2024-11-21 3.9 Low
PendingIntent hijacking vulnerability in CpaReceiver prior to SMR Feb-2022 Release 1 allows local attackers to access media files without permission in KnoxPrivacyNoticeReceiver via implicit Intent.
CVE-2022-23998 2 Google, Samsung 2 Android, Camera 2024-11-21 6.2 Medium
Improper access control vulnerability in Camera prior to versions 11.1.02.16 in Android R(11), 10.5.03.77 in Android Q(10) and 9.0.6.68 in Android P(9) allows untrusted applications to take a picture in screenlock status.
CVE-2022-23992 1 Broadcom 1 Xcom Data Transport 2024-11-21 9.8 Critical
XCOM Data Transport for Windows, Linux, and UNIX 11.6 releases contain a vulnerability due to insufficient input validation that could potentially allow remote attackers to execute arbitrary commands with elevated privileges.
CVE-2022-23820 1 Amd 208 Athlon 3015ce, Athlon 3015ce Firmware, Athlon 3015e and 205 more 2024-11-21 7.5 High
Failure to validate the AMD SMM communication buffer may allow an attacker to corrupt the SMRAM potentially leading to arbitrary code execution.
CVE-2022-23432 2 Google, Samsung 2 Android, Exynos 2024-11-21 6.4 Medium
An improper input validation in SMC_SRPMB_WSM handler of RPMB ldfw prior to SMR Feb-2022 Release 1 allows arbitrary memory write and code execution.
CVE-2022-23427 1 Google 1 Android 2024-11-21 3.9 Low
PendingIntent hijacking vulnerability in KnoxPrivacyNoticeReceiver prior to SMR Feb-2022 Release 1 allows local attackers to access media files without permission via implicit Intent.
CVE-2022-23425 2 Google, Samsung 2 Android, Exynos 2024-11-21 8.6 High
Improper input validation in Exynos baseband prior to SMR Feb-2022 Release 1 allows attackers to send arbitrary NAS signaling messages with fake base station.
CVE-2022-23019 1 F5 11 Big-ip Access Policy Manager, Big-ip Advanced Firewall Manager, Big-ip Analytics and 8 more 2024-11-21 7.5 High
On BIG-IP version 16.1.x before 16.1.2, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.4, and all versions of 13.1.x and 12.1.x, when a message routing type virtual server is configured with both Diameter Session and Router Profiles, undisclosed traffic can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2022-23014 1 F5 1 Big-ip Access Policy Manager 2024-11-21 6.5 Medium
On versions 16.1.x before 16.1.2 and 15.1.x before 15.1.4.1, when BIG-IP APM portal access is configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2022-22968 4 Netapp, Oracle, Redhat and 1 more 9 Active Iq Unified Manager, Cloud Secure Agent, Metrocluster Tiebreaker and 6 more 2024-11-21 5.3 Medium
In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is listed with both upper and lower case for the first character of the field, including upper and lower case for the first character of all nested fields within the property path.
CVE-2022-22820 1 Linecorp 1 Line 2024-11-21 5.5 Medium
Due to the lack of media file checks before rendering, it was possible for an attacker to cause abnormal CPU consumption for message recipient by sending specially crafted gif image in LINE for Windows before 7.4.
CVE-2022-22727 1 Schneider-electric 1 Ecostruxure Power Monitoring Expert 2024-11-21 8.8 High
A CWE-20: Improper Input Validation vulnerability exists that could allow an unauthenticated attacker to view data, change settings, impact availability of the software, or potentially impact a user�s local machine when the user clicks a specially crafted link. Affected Product: EcoStruxure Power Monitoring Expert (Versions 2020 and prior)
CVE-2022-22726 1 Schneider-electric 1 Ecostruxure Power Monitoring Expert 2024-11-21 6.5 Medium
A CWE-20: Improper Input Validation vulnerability exists that could allow arbitrary files on the server to be read by authenticated users through a limited operating system service account. Affected Product: EcoStruxure Power Monitoring Expert (Versions 2020 and prior)
CVE-2022-22588 1 Apple 2 Ipados, Iphone Os 2024-11-21 5.5 Medium
A resource exhaustion issue was addressed with improved input validation. This issue is fixed in iOS 15.2.1 and iPadOS 15.2.1. Processing a maliciously crafted HomeKit accessory name may cause a denial of service.
CVE-2022-22539 1 Sap 1 3d Visual Enterprise Viewer 2024-11-21 6.5 Medium
When a user opens a manipulated JPEG file format (.jpg, 2d.x3d) received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the application crashes and becomes temporarily unavailable to the user until restart of the application. The file format details along with their CVE relevant information can be found below.
CVE-2022-22538 1 Sap 1 3d Visual Enterprise Viewer 2024-11-21 6.5 Medium
When a user opens a manipulated Adobe Illustrator file format (.ai, ai.x3d) received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the application crashes and becomes temporarily unavailable to the user until restart of the application. The file format details along with their CVE relevant information can be found below.
CVE-2022-22537 1 Sap 1 3d Visual Enterprise Viewer 2024-11-21 6.5 Medium
When a user opens a manipulated Tagged Image File Format (.tiff, 2d.x3d)) received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the application crashes and becomes temporarily unavailable to the user until restart of the application. The file format details along with their CVE relevant information can be found below.