# |
CVE ID
|
CWE ID
|
# of Exploits
|
Vulnerability Type(s)
|
Publish Date
|
Update Date
|
Score
|
Gained Access Level
|
Access
|
Complexity
|
Authentication
|
Conf.
|
Integ.
|
Avail.
|
1 |
CVE-2022-32208 |
787 |
|
|
2022-07-07 |
2023-01-05 |
4.3 |
None |
Remote |
Medium |
Not required |
Partial |
None |
None |
When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client. |
2 |
CVE-2022-32205 |
770 |
|
DoS |
2022-07-07 |
2023-01-05 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
None |
Partial |
A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 stores all of them. A sufficiently large amount of (big) cookies make subsequent HTTP requests to this, or other servers to which the cookies match, create requests that become larger than the threshold that curl uses internally to avoid sending crazy large requests (1048576 bytes) and instead returns an error.This denial state might remain for as long as the same cookies are kept, match and haven't expired. Due to cookie matching rules, a server on `foo.example.com` can set cookies that also would match for `bar.example.com`, making it it possible for a "sister server" to effectively cause a denial of service for a sibling site on the same second level domain using this method. |
3 |
CVE-2022-29048 |
352 |
|
CSRF |
2022-04-12 |
2022-10-27 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
A cross-site request forgery (CSRF) vulnerability in Jenkins Subversion Plugin 2.15.3 and earlier allows attackers to connect to an attacker-specified URL. |
4 |
CVE-2022-28739 |
125 |
|
|
2022-05-09 |
2022-11-08 |
4.3 |
None |
Remote |
Medium |
Not required |
Partial |
None |
None |
There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x before 3.1.2. It occurs in String-to-Float conversion, including Kernel#Float and String#to_f. |
5 |
CVE-2022-26774 |
269 |
|
|
2022-05-26 |
2022-06-07 |
4.6 |
None |
Local |
Low |
Not required |
Partial |
Partial |
Partial |
A logic issue was addressed with improved state management. This issue is fixed in iTunes 12.12.4 for Windows. A local attacker may be able to elevate their privileges. |
6 |
CVE-2022-26767 |
863 |
|
Bypass |
2022-05-26 |
2022-06-08 |
4.3 |
None |
Remote |
Medium |
Not required |
Partial |
None |
None |
The issue was addressed with additional permissions checks. This issue is fixed in macOS Monterey 12.4, macOS Big Sur 11.6.6. A malicious application may be able to bypass Privacy preferences. |
7 |
CVE-2022-26766 |
295 |
|
Bypass |
2022-05-26 |
2022-06-08 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
A certificate parsing issue was addressed with improved checks. This issue is fixed in tvOS 15.5, iOS 15.5 and iPadOS 15.5, Security Update 2022-004 Catalina, watchOS 8.6, macOS Big Sur 11.6.6, macOS Monterey 12.4. A malicious app may be able to bypass signature validation. |
8 |
CVE-2022-26755 |
|
|
|
2022-05-26 |
2022-06-07 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
This issue was addressed with improved environment sanitization. This issue is fixed in Security Update 2022-004 Catalina, macOS Monterey 12.4, macOS Big Sur 11.6.6. A malicious application may be able to break out of its sandbox. |
9 |
CVE-2022-26746 |
|
|
Bypass |
2022-05-26 |
2022-06-07 |
4.3 |
None |
Remote |
Medium |
Not required |
Partial |
None |
None |
This issue was addressed by removing the vulnerable code. This issue is fixed in Security Update 2022-004 Catalina, macOS Monterey 12.4, macOS Big Sur 11.6.6. A malicious application may be able to bypass Privacy preferences. |
10 |
CVE-2022-26745 |
787 |
|
Mem. Corr. |
2022-05-26 |
2022-06-07 |
4.3 |
None |
Remote |
Medium |
Not required |
Partial |
None |
None |
A memory corruption issue was addressed with improved validation. This issue is fixed in macOS Big Sur 11.6.6. A malicious application may disclose restricted memory. |
11 |
CVE-2022-26731 |
|
|
|
2022-05-26 |
2023-01-09 |
4.3 |
None |
Remote |
Medium |
Not required |
Partial |
None |
None |
A logic issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.4, iOS 15.5 and iPadOS 15.5. A malicious website may be able to track users in Safari private browsing mode. |
12 |
CVE-2022-26728 |
|
|
|
2022-05-26 |
2022-06-07 |
4.3 |
None |
Remote |
Medium |
Not required |
Partial |
None |
None |
This issue was addressed with improved entitlements. This issue is fixed in Security Update 2022-004 Catalina, macOS Monterey 12.4, macOS Big Sur 11.6.6. A malicious application may be able to access restricted files. |
13 |
CVE-2022-26727 |
|
|
|
2022-05-26 |
2022-06-07 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
This issue was addressed with improved entitlements. This issue is fixed in Security Update 2022-004 Catalina, macOS Monterey 12.4. A malicious application may be able to modify protected parts of the file system. |
14 |
CVE-2022-26726 |
|
|
|
2022-05-26 |
2022-06-07 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
This issue was addressed with improved checks. This issue is fixed in Security Update 2022-004 Catalina, watchOS 8.6, macOS Monterey 12.4, macOS Big Sur 11.6.6. An app may be able to capture a user's screen. |
15 |
CVE-2022-26712 |
|
|
|
2022-05-26 |
2022-06-07 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Monterey 12.4, macOS Big Sur 11.6.6. A malicious application may be able to modify protected parts of the file system. |
16 |
CVE-2022-26706 |
|
|
|
2022-05-26 |
2022-06-07 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
An access issue was addressed with additional sandbox restrictions on third-party applications. This issue is fixed in tvOS 15.5, iOS 15.5 and iPadOS 15.5, watchOS 8.6, macOS Big Sur 11.6.6, macOS Monterey 12.4. A sandboxed process may be able to circumvent sandbox restrictions. |
17 |
CVE-2022-26688 |
59 |
|
|
2022-05-26 |
2022-06-08 |
4.9 |
None |
Local |
Low |
Not required |
None |
Complete |
None |
An issue in the handling of symlinks was addressed with improved validation. This issue is fixed in Security Update 2022-003 Catalina, macOS Monterey 12.3, macOS Big Sur 11.6.5. A malicious app with root privileges may be able to modify the contents of system files. |
18 |
CVE-2022-23308 |
416 |
|
|
2022-02-26 |
2022-11-02 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
None |
Partial |
valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes. |
19 |
CVE-2022-22676 |
20 |
|
|
2022-05-26 |
2022-06-08 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
An event handler validation issue in the XPC Services API was addressed by removing the service. This issue is fixed in macOS Monterey 12.2. An application may be able to delete files for which it does not have permission. |
20 |
CVE-2022-22674 |
125 |
|
|
2022-05-26 |
2022-06-08 |
4.9 |
None |
Local |
Low |
Not required |
Complete |
None |
None |
An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed with improved input validation. This issue is fixed in macOS Monterey 12.3.1, Security Update 2022-004 Catalina, macOS Big Sur 11.6.6. A local user may be able to read kernel memory. |
21 |
CVE-2022-22670 |
|
|
|
2022-03-18 |
2022-03-24 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
An access issue was addressed with improved access restrictions. This issue is fixed in tvOS 15.4, iOS 15.4 and iPadOS 15.4, watchOS 8.5. A malicious application may be able to identify what other applications a user has installed. |
22 |
CVE-2022-22663 |
863 |
|
Bypass |
2022-05-26 |
2022-06-08 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
This issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in iOS 15.4 and iPadOS 15.4, Security Update 2022-004 Catalina, macOS Monterey 12.3, macOS Big Sur 11.6.6. A malicious application may bypass Gatekeeper checks. |
23 |
CVE-2022-22662 |
668 |
|
|
2022-05-26 |
2022-09-04 |
4.3 |
None |
Remote |
Medium |
Not required |
Partial |
None |
None |
A cookie management issue was addressed with improved state management. This issue is fixed in Security Update 2022-003 Catalina, macOS Big Sur 11.6.5. Processing maliciously crafted web content may disclose sensitive user information. |
24 |
CVE-2022-22660 |
20 |
|
|
2022-03-18 |
2022-03-24 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
This issue was addressed with a new entitlement. This issue is fixed in macOS Monterey 12.3. An app may be able to spoof system notifications and UI. |
25 |
CVE-2022-22659 |
|
|
+Info |
2022-03-18 |
2022-03-24 |
4.0 |
None |
Remote |
Low |
??? |
Partial |
None |
None |
A logic issue was addressed with improved state management. This issue is fixed in iOS 15.4 and iPadOS 15.4. An attacker in a privileged network position may be able to leak sensitive user information. |
26 |
CVE-2022-22654 |
20 |
|
|
2022-03-18 |
2022-03-24 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
A user interface issue was addressed. This issue is fixed in watchOS 8.5, Safari 15.4. Visiting a malicious website may lead to address bar spoofing. |
27 |
CVE-2022-22644 |
|
|
|
2022-03-18 |
2022-03-24 |
4.3 |
None |
Remote |
Medium |
Not required |
Partial |
None |
None |
A privacy issue existed in the handling of Contact cards. This was addressed with improved state management. This issue is fixed in macOS Monterey 12.3. A malicious application may be able to access information about a user's contacts. |
28 |
CVE-2022-22638 |
476 |
|
DoS |
2022-03-18 |
2022-11-02 |
4.0 |
None |
Remote |
Low |
??? |
None |
None |
Partial |
A null pointer dereference was addressed with improved validation. This issue is fixed in tvOS 15.4, iOS 15.4 and iPadOS 15.4, macOS Big Sur 11.6.5, Security Update 2022-003 Catalina, watchOS 8.5, macOS Monterey 12.3. An attacker in a privileged position may be able to perform a denial of service attack. |
29 |
CVE-2022-22631 |
787 |
|
+Priv |
2022-03-18 |
2022-11-02 |
4.6 |
None |
Local |
Low |
Not required |
Partial |
Partial |
Partial |
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.6.5, macOS Monterey 12.3, Security Update 2022-003 Catalina. An application may be able to gain elevated privileges. |
30 |
CVE-2022-22618 |
863 |
|
Bypass |
2022-03-18 |
2022-03-28 |
4.6 |
None |
Local |
Low |
Not required |
Partial |
Partial |
Partial |
This issue was addressed with improved checks. This issue is fixed in watchOS 8.5, iOS 15.4 and iPadOS 15.4. A user may be able to bypass the Emergency SOS passcode prompt. |
31 |
CVE-2022-22617 |
269 |
|
+Priv |
2022-03-18 |
2022-11-02 |
4.6 |
None |
Local |
Low |
Not required |
Partial |
Partial |
Partial |
A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.6.5, macOS Monterey 12.3, Security Update 2022-003 Catalina. An application may be able to gain elevated privileges. |
32 |
CVE-2022-22616 |
863 |
|
Bypass |
2022-05-26 |
2022-06-08 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
This issue was addressed with improved checks. This issue is fixed in Security Update 2022-003 Catalina, macOS Monterey 12.3, macOS Big Sur 11.6.5. A maliciously crafted ZIP archive may bypass Gatekeeper checks. |
33 |
CVE-2022-22600 |
|
|
Bypass |
2022-03-18 |
2022-03-23 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
The issue was addressed with improved permissions logic. This issue is fixed in tvOS 15.4, iOS 15.4 and iPadOS 15.4, macOS Monterey 12.3, watchOS 8.5. A malicious application may be able to bypass certain Privacy preferences. |
34 |
CVE-2022-22594 |
346 |
|
|
2022-03-18 |
2022-03-28 |
4.3 |
None |
Remote |
Medium |
Not required |
Partial |
None |
None |
A cross-origin issue in the IndexDB API was addressed with improved input validation. This issue is fixed in iOS 15.3 and iPadOS 15.3, watchOS 8.4, tvOS 15.3, Safari 15.3, macOS Monterey 12.2. A website may be able to track sensitive user information. |
35 |
CVE-2022-22592 |
|
|
|
2022-03-18 |
2022-09-09 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
A logic issue was addressed with improved state management. This issue is fixed in iOS 15.3 and iPadOS 15.3, watchOS 8.4, tvOS 15.3, Safari 15.3, macOS Monterey 12.2. Processing maliciously crafted web content may prevent Content Security Policy from being enforced. |
36 |
CVE-2022-22589 |
20 |
|
|
2022-03-18 |
2022-10-06 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
A validation issue was addressed with improved input sanitization. This issue is fixed in iOS 15.3 and iPadOS 15.3, watchOS 8.4, tvOS 15.3, Safari 15.3, macOS Monterey 12.2. Processing a maliciously crafted mail message may lead to running arbitrary javascript. |
37 |
CVE-2022-22588 |
400 |
|
DoS |
2022-03-18 |
2022-03-24 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
None |
Partial |
A resource exhaustion issue was addressed with improved input validation. This issue is fixed in iOS 15.2.1 and iPadOS 15.2.1. Processing a maliciously crafted HomeKit accessory name may cause a denial of service. |
38 |
CVE-2022-1769 |
126 |
|
|
2022-05-17 |
2022-10-31 |
4.6 |
None |
Local |
Low |
Not required |
Partial |
Partial |
Partial |
Buffer Over-read in GitHub repository vim/vim prior to 8.2.4974. |
39 |
CVE-2022-1733 |
787 |
|
Overflow |
2022-05-17 |
2022-10-31 |
4.6 |
None |
Local |
Low |
Not required |
Partial |
Partial |
Partial |
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.4968. |
40 |
CVE-2022-1674 |
476 |
|
DoS |
2022-05-12 |
2022-12-02 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
None |
Partial |
NULL Pointer Dereference in function vim_regexec_string at regexp.c:2733 in GitHub repository vim/vim prior to 8.2.4938. NULL Pointer Dereference in function vim_regexec_string at regexp.c:2733 allows attackers to cause a denial of service (application crash) via a crafted input. |
41 |
CVE-2022-1622 |
125 |
|
|
2022-05-11 |
2022-11-07 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
None |
Partial |
LibTIFF master branch has an out-of-bounds read in LZWDecode in libtiff/tif_lzw.c:619, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit b4e79bfa. |
42 |
CVE-2022-1420 |
823 |
|
|
2022-04-21 |
2022-11-04 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
None |
Partial |
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4774. |
43 |
CVE-2022-0943 |
122 |
|
Overflow |
2022-03-14 |
2022-12-14 |
4.6 |
None |
Local |
Low |
Not required |
Partial |
Partial |
Partial |
Heap-based Buffer Overflow occurs in vim in GitHub repository vim/vim prior to 8.2.4563. |
44 |
CVE-2022-0714 |
122 |
|
Overflow |
2022-02-22 |
2022-12-02 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
None |
Partial |
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.4436. |
45 |
CVE-2022-0696 |
476 |
|
|
2022-02-21 |
2022-11-29 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
None |
Partial |
NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.4428. |
46 |
CVE-2022-0530 |
|
|
Exec Code |
2022-02-09 |
2022-09-30 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
None |
Partial |
A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads to a heap of out-of-bound write. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution. |
47 |
CVE-2022-0351 |
119 |
|
Overflow |
2022-01-25 |
2022-11-09 |
4.6 |
None |
Local |
Low |
Not required |
Partial |
Partial |
Partial |
Access of Memory Location Before Start of Buffer in GitHub repository vim/vim prior to 8.2. |
48 |
CVE-2022-0319 |
125 |
|
|
2022-01-21 |
2022-11-09 |
4.3 |
None |
Remote |
Medium |
Not required |
Partial |
None |
None |
Out-of-bounds Read in vim/vim prior to 8.2. |
49 |
CVE-2022-0158 |
122 |
|
Overflow |
2022-01-10 |
2022-08-26 |
4.3 |
None |
Remote |
Medium |
Not required |
Partial |
None |
None |
vim is vulnerable to Heap-based Buffer Overflow |
50 |
CVE-2022-0156 |
416 |
|
|
2022-01-10 |
2022-08-26 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
None |
Partial |
vim is vulnerable to Use After Free |