Export limit exceeded: 363299 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (3176 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2022-35741 | 1 Apache | 1 Cloudstack | 2024-11-21 | 9.8 Critical |
| Apache CloudStack version 4.5.0 and later has a SAML 2.0 authentication Service Provider plugin which is found to be vulnerable to XML external entity (XXE) injection. This plugin is not enabled by default and the attacker would require that this plugin be enabled to exploit the vulnerability. When the SAML 2.0 plugin is enabled in affected versions of Apache CloudStack could potentially allow the exploitation of XXE vulnerabilities. The SAML 2.0 messages constructed during the authentication flow in Apache CloudStack are XML-based and the XML data is parsed by various standard libraries that are now understood to be vulnerable to XXE injection attacks such as arbitrary file reading, possible denial of service, server-side request forgery (SSRF) on the CloudStack management server. | ||||
| CVE-2022-35728 | 1 F5 | 12 Big-ip Access Policy Manager, Big-ip Advanced Firewall Manager, Big-ip Analytics and 9 more | 2024-11-21 | 8.1 High |
| In BIG-IP Versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and all versions of 13.1.x, and BIG-IQ version 8.x before 8.2.0 and all versions of 7.x, an authenticated user's iControl REST token may remain valid for a limited time after logging out from the Configuration utility. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. | ||||
| CVE-2022-35205 | 1 Gnu | 1 Binutils | 2024-11-21 | 5.5 Medium |
| An issue was discovered in Binutils readelf 2.38.50, reachable assertion failure in function display_debug_names allows attackers to cause a denial of service. | ||||
| CVE-2022-35168 | 1 Sap | 1 Business One | 2024-11-21 | 7.5 High |
| Due to improper input sanitization of XML input in SAP Business One - version 10.0, an attacker can perform a denial-of-service attack rendering the system temporarily inoperative. | ||||
| CVE-2022-34967 | 1 Monetdb | 1 Monetdb | 2024-11-21 | 7.5 High |
| The assertion `stmt->Dbc->FirstStmt' failed in MonetDB Database Server v11.43.13. | ||||
| CVE-2022-34832 | 1 Vermeg | 1 Agile Reporter | 2024-11-21 | 6.5 Medium |
| An issue was discovered in VERMEG AgileReporter 21.3. XXE can occur via an XML document to the Analysis component. | ||||
| CVE-2022-34793 | 1 Jenkins | 1 Recipe | 2024-11-21 | 8.8 High |
| Jenkins Recipe Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. | ||||
| CVE-2022-34624 | 1 Mealie | 1 Mealie | 2024-11-21 | 5.9 Medium |
| Mealie1.0.0beta3 does not terminate download tokens after a user logs out, allowing attackers to perform a man-in-the-middle attack via a crafted GET request. | ||||
| CVE-2022-34144 | 1 Qualcomm | 136 315 5g Iot Modem, 315 5g Iot Modem Firmware, Ar8035 and 133 more | 2024-11-21 | 7.5 High |
| Transient DOS due to reachable assertion in Modem during OSI decode scheduling. | ||||
| CVE-2022-34001 | 1 Unit4 | 1 Enterprise Resource Planning | 2024-11-21 | 6.5 Medium |
| Unit4 ERP through 7.9 allows XXE via ExecuteServerProcessAsynchronously. | ||||
| CVE-2022-34000 | 1 Libjxl Project | 1 Libjxl | 2024-11-21 | 6.5 Medium |
| libjxl 0.6.1 has an assertion failure in LowMemoryRenderPipeline::Init() in render_pipeline/low_memory_render_pipeline.cc. | ||||
| CVE-2022-33272 | 1 Qualcomm | 98 Ar8035, Ar8035 Firmware, Qca6390 and 95 more | 2024-11-21 | 7.5 High |
| Transient DOS in modem due to reachable assertion. | ||||
| CVE-2022-33254 | 1 Qualcomm | 128 Aqt1000, Aqt1000 Firmware, Ar8035 and 125 more | 2024-11-21 | 7.5 High |
| Transient DOS due to reachable assertion in Modem while processing SIB1 Message. | ||||
| CVE-2022-33251 | 1 Qualcomm | 148 315 5g Iot Modem, 315 5g Iot Modem Firmware, Ar8035 and 145 more | 2024-11-21 | 7.5 High |
| Transient DOS due to reachable assertion in Modem because of invalid network configuration. | ||||
| CVE-2022-33250 | 1 Qualcomm | 130 Ar8035, Ar8035 Firmware, Qca6390 and 127 more | 2024-11-21 | 7.5 High |
| Transient DOS due to reachable assertion in modem when network repeatedly sent invalid message container for NR to LTE handover. | ||||
| CVE-2022-33244 | 1 Qualcomm | 78 Ar8035, Ar8035 Firmware, Qca6391 and 75 more | 2024-11-21 | 7.5 High |
| Transient DOS due to reachable assertion in modem during MIB reception and SIB timeout | ||||
| CVE-2022-33137 | 1 Siemens | 12 Simatic Mv540 H, Simatic Mv540 H Firmware, Simatic Mv540 S and 9 more | 2024-11-21 | 8.0 High |
| A vulnerability has been identified in SIMATIC MV540 H (All versions < V3.3), SIMATIC MV540 S (All versions < V3.3), SIMATIC MV550 H (All versions < V3.3), SIMATIC MV550 S (All versions < V3.3), SIMATIC MV560 U (All versions < V3.3), SIMATIC MV560 X (All versions < V3.3). The web session management of affected devices does not invalidate session ids in certain logout scenarios. This could allow an authenticated remote attacker to hijack other users' sessions. | ||||
| CVE-2022-33069 | 1 Soliditylang | 1 Solidity | 2024-11-21 | 5.5 Medium |
| Ethereum Solidity v0.8.14 contains an assertion failure via SMTEncoder::indexOrMemberAssignment() at SMTEncoder.cpp. | ||||
| CVE-2022-33024 | 1 Gnu | 1 Libredwg | 2024-11-21 | 7.5 High |
| There is an Assertion `int decode_preR13_entities(BITCODE_RL, BITCODE_RL, unsigned int, BITCODE_RL, BITCODE_RL, Bit_Chain *, Dwg_Data *' failed at dwg2dxf: decode.c:5801 in libredwg v0.12.4.4608. | ||||
| CVE-2022-32978 | 1 Jpeg | 1 Libjpeg | 2024-11-21 | 6.5 Medium |
| There is an assertion failure in SingleComponentLSScan::ParseMCU in singlecomponentlsscan.cpp in libjpeg before 1.64 via an empty JPEG-LS scan. | ||||