| CVE-2021-3744 | MITTEL5.5 | A memory leak flaw was found in the Linux kernel in the ccp_run_aes_gcm_cmd() function in drivers/crypto/ccp/ccp-ops.c, which allows attackers to cause a denial of service (memory consumption). This vulnerability is similar with the older CVE-2019-18808. | 04/03/2022 |
| CVE-2021-3743 | HOCH7.1 | An out-of-bounds (OOB) memory read flaw was found in the Qualcomm IPC router protocol in the Linux kernel. A missing sanity check allows a local attacker to gain access to out-of-bounds memory, leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to system av | 04/03/2022 |
| CVE-2022-0839 | KRITISCH9.8 | Improper Restriction of XML External Entity Reference in GitHub repository liquibase/liquibase prior to 4.8.0. | 04/03/2022 |
| CVE-2022-22947KEV | KRITISCH10.0 | In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host. | 03/03/2022 |
| CVE-2021-4002 | MITTEL4.4 | A memory leak flaw in the Linux kernel's hugetlbfs memory usage was found in the way the user maps some regions of memory twice using shmget() which are aligned to PUD alignment with the fault of some of the memory pages. A local user could use this flaw to get unauthorized access to some data. | 03/03/2022 |
| CVE-2022-21716 | HOCH7.5 | Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 22.2.0, Twisted SSH client and server implement is able to accept an infinite amount of data for the peer's SSH version identifier. This ends up with a buffer using all the available memory. The attach is a simple as `nc -rv | 03/03/2022 |
| CVE-2021-3772 | MITTEL6.5 | A flaw was found in the Linux SCTP stack. A blind attacker may be able to kill an existing SCTP association through invalid chunks if the attacker knows the IP-addresses and port numbers being used and the attacker can send packets with spoofed IP addresses. | 02/03/2022 |
| CVE-2022-23308 | HOCH7.5 | valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes. | 26/02/2022 |
| CVE-2022-24329 | MITTEL5.3 | In JetBrains Kotlin before 1.6.0, it was not possible to lock dependencies for Multiplatform Gradle Projects. | 25/02/2022 |
| CVE-2022-21824 | HOCH8.2 | Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be "__proto__". The prototype pollution has very limited cont | 24/02/2022 |
| CVE-2021-44533 | MITTEL5.3 | Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate subjects containing a single-value Relative Distinguished Name that would be interpreted as a multi-value Relative Distinguished Name, for example, in order to injec | 24/02/2022 |
| CVE-2021-44532 | MITTEL5.3 | Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a string format. It uses this string to check peer certificates against hostnames when validating connections. The string format was subject to an injection vulnerability when name constraints were used within a certifica | 24/02/2022 |
| CVE-2021-44531 | HOCH7.4 | Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates. Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 was accepting URI SAN types, which PKIs are often not defined to use. Additionally, w | 24/02/2022 |
| CVE-2022-25636 | HOCH7.8 | net/netfilter/nf_dup_netdev.c in the Linux kernel 5.4 through 5.6.10 allows local users to gain privileges because of a heap out-of-bounds write. This is related to nf_tables_offload. | 24/02/2022 |
| CVE-2022-24407 | HOCH8.8 | In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT or UPDATE statement. | 24/02/2022 |
| CVE-2021-4115 | MITTEL5.5 | There is a flaw in polkit which can allow an unprivileged user to cause polkit to crash, due to process file descriptor exhaustion. The highest threat from this vulnerability is to availability. NOTE: Polkit process outage duration is tied to the failing process being reaped and a new one being spawned | 21/02/2022 |
| CVE-2021-20322 | HOCH7.4 | A flaw in the processing of received ICMP errors (ICMP fragment needed and ICMP redirect) in the Linux kernel functionality was found to allow the ability to quickly scan open UDP ports. This flaw allows an off-path remote user to effectively bypass the source port UDP randomization. The highest threat from this vulner | 18/02/2022 |
| CVE-2022-25315 | KRITISCH9.8 | In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames. | 18/02/2022 |
| CVE-2022-25314 | HOCH7.5 | In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString. | 18/02/2022 |
| CVE-2022-25313 | MITTEL6.5 | In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element. | 18/02/2022 |