The Common Vulnerabilities and Exposures (CVE) project, maintained by the MITRE Corporation, is a list of all standardized names for vulnerabilities and security exposures.
| ID | Description | Priority | Modified date | Fixed Release |
|---|---|---|---|---|
| CVE-2022-24407 | In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT or UPDATE statement. | MEDIUM | Feb 24, 2022 | 10.19.45.22 (Wind River Linux LTS 19) |
| CVE-2022-0729 | Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. | MEDIUM | Feb 25, 2022 | 10.19.45.23 (Wind River Linux LTS 19) |
| CVE-2022-0714 | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.4436. | MEDIUM | Feb 25, 2022 | 10.19.45.23 (Wind River Linux LTS 19) |
| CVE-2022-0696 | NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.4428. | MEDIUM | Feb 25, 2022 | 10.19.45.23 (Wind River Linux LTS 19) |
| CVE-2020-36516 | An issue was discovered in the Linux kernel through 5.16.11. The mixed IPID assignment method with the hash-based IPID assignment policy allows an off-path attacker to inject data into a victim\'s TCP session or terminate that session. | MEDIUM | Feb 26, 2022 | 10.19.45.27 (Wind River Linux LTS 19) |
| CVE-2022-25314 | In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString. | MEDIUM | Feb 19, 2022 | 10.19.45.22 (Wind River Linux LTS 19) |
| CVE-2022-25313 | In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element. | MEDIUM | Feb 19, 2022 | 10.19.45.22 (Wind River Linux LTS 19) |
| CVE-2022-25258 | An issue was discovered in drivers/usb/gadget/composite.c in the Linux kernel before 5.16.10. The USB Gadget subsystem lacks certain validation of interface OS descriptor requests (ones with a large array index and ones associated with NULL function pointer retrieval). Memory corruption might occur. | MEDIUM | Feb 20, 2022 | 10.19.45.23 (Wind River Linux LTS 19) |
| CVE-2022-23308 | valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes. | MEDIUM | Feb 21, 2022 | 10.19.45.22 (Wind River Linux LTS 19) |
| CVE-2022-0685 | Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4418. | MEDIUM | Feb 20, 2022 | 10.19.45.23 (Wind River Linux LTS 19) |
| CVE-2022-0629 | Stack-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. | MEDIUM | Feb 17, 2022 | 10.19.45.23 (Wind River Linux LTS 19) |
| CVE-2022-0617 | A flaw null pointer dereference in the Linux kernel UDF file system functionality was found in the way user triggers udf_file_write_iter function for the malicious UDF image. A local user could use this flaw to crash the system. Actual from Linux kernel 4.2-rc1 till 5.17-rc2. | MEDIUM | Feb 16, 2022 | 10.19.45.23 (Wind River Linux LTS 19) |
| CVE-2022-0572 | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. | MEDIUM | Feb 17, 2022 | 10.19.45.22 (Wind River Linux LTS 19) |
| CVE-2022-0571 | Cross-site Scripting (XSS) - Reflected in GitHub repository phoronix-test-suite/phoronix-test-suite prior to 10.8.2. | MEDIUM | Feb 14, 2022 | 10.19.45.22 (Wind River Linux LTS 19) |
| CVE-2022-24958 | drivers/usb/gadget/legacy/inode.c in the Linux kernel through 5.16.8 mishandles dev->buf release. | MEDIUM | Feb 11, 2022 | 10.19.45.23 (Wind River Linux LTS 19) |
| CVE-2022-24052 | MariaDB CONNECT Storage Engine Heap-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL queries. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-16190. | MEDIUM | Feb 10, 2022 | 10.19.45.22 (Wind River Linux LTS 19) |
| CVE-2022-24051 | MariaDB CONNECT Storage Engine Format String Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL queries. The issue results from the lack of proper validation of a user-supplied string before using it as a format specifier. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-16193. | MEDIUM | Feb 10, 2022 | 10.19.45.22 (Wind River Linux LTS 19) |
| CVE-2022-24050 | MariaDB CONNECT Storage Engine Use-After-Free Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL queries. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-16207. | MEDIUM | Feb 10, 2022 | 10.19.45.22 (Wind River Linux LTS 19) |
| CVE-2022-24048 | MariaDB CONNECT Storage Engine Stack-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL queries. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-16191. | MEDIUM | Feb 10, 2022 | 10.19.45.22 (Wind River Linux LTS 19) |
| CVE-2022-23833 | An issue was discovered in MultiPartParser in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2. Passing certain inputs to multipart forms could result in an infinite loop when parsing files. | MEDIUM | Feb 11, 2022 | 10.19.45.22 (Wind River Linux LTS 19) |
| CVE-2022-23806 | Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x before 1.17.7 can incorrectly return true in situations with a big.Int value that is not a valid field element. | MEDIUM | Feb 11, 2022 | 10.19.45.22 (Wind River Linux LTS 19) |
| CVE-2022-23098 | An issue was discovered in the DNS proxy in Connman through 1.40. The TCP server reply implementation has an infinite loop if no data is received. | MEDIUM | Feb 9, 2022 | 10.19.45.22 (Wind River Linux LTS 19) |
| CVE-2022-23097 | An issue was discovered in the DNS proxy in Connman through 1.40. forward_dns_reply mishandles a strnlen call, leading to an out-of-bounds read. | MEDIUM | Feb 9, 2022 | 10.19.45.22 (Wind River Linux LTS 19) |
| CVE-2022-23096 | An issue was discovered in the DNS proxy in Connman through 1.40. The TCP server reply implementation lacks a check for the presence of sufficient Header Data, leading to an out-of-bounds read. | MEDIUM | Feb 9, 2022 | 10.19.45.22 (Wind River Linux LTS 19) |
| CVE-2022-22818 | The {% debug %} template tag in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2 does not properly encode the current context. This may lead to XSS. | MEDIUM | Feb 11, 2022 | 10.19.45.22 (Wind River Linux LTS 19) |
| CVE-2022-0562 | Null source pointer passed as an argument to memcpy() function within TIFFReadDirectory() in tif_dirread.c in libtiff versions from 4.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users that compile libtiff from sources, a fix is available with commit 561599c. | MEDIUM | Feb 11, 2022 | 10.19.45.22 (Wind River Linux LTS 19) |
| CVE-2022-0561 | Null source pointer passed as an argument to memcpy() function within TIFFFetchStripThing() in tif_dirread.c in libtiff versions from 3.9.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users that compile libtiff from sources, the fix is available with commit eecb0712. | MEDIUM | Feb 11, 2022 | 10.19.45.22 (Wind River Linux LTS 19) |
| CVE-2022-0554 | Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2. | MEDIUM | Feb 11, 2022 | 10.19.45.22 (Wind River Linux LTS 19) |
| CVE-2022-0530 | A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads to a heap of out-of-bound write. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution. | MEDIUM | Feb 10, 2022 | 10.19.45.26 (Wind River Linux LTS 19) |
| CVE-2022-0529 | A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads to a heap of out-of-bound write. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution. | MEDIUM | Feb 10, 2022 | 10.19.45.26 (Wind River Linux LTS 19) |
| CVE-2022-0492 | A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly. | MEDIUM | Feb 9, 2022 | 10.19.45.22 (Wind River Linux LTS 19) |
| CVE-2022-0443 | Use After Free in GitHub repository vim/vim prior to 8.2. | MEDIUM | Feb 11, 2022 | 10.19.45.22 (Wind River Linux LTS 19) |
| CVE-2022-0417 | Heap-based Buffer Overflow GitHub repository vim/vim prior to 8.2. | MEDIUM | Feb 11, 2022 | 10.19.45.22 (Wind River Linux LTS 19) |
| CVE-2022-0413 | Use After Free in GitHub repository vim/vim prior to 8.2. | MEDIUM | Feb 11, 2022 | 10.19.45.22 (Wind River Linux LTS 19) |
| CVE-2022-0408 | Stack-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. | MEDIUM | Feb 11, 2022 | 10.19.45.22 (Wind River Linux LTS 19) |
| CVE-2022-0392 | Heap-based Buffer Overflow in GitHub repository vim prior to 8.2. | MEDIUM | Feb 3, 2022 | 10.19.45.22 (Wind River Linux LTS 19) |
| CVE-2022-0391 | A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like \'\\r\' and \'\\n\' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1, 3.9.5, 3.8.11, 3.7.11 and 3.6.14. | MEDIUM | Feb 10, 2022 | 10.19.45.22 (Wind River Linux LTS 19) |
| CVE-2022-0368 | Out-of-bounds Read in GitHub repository vim/vim prior to 8.2. | MEDIUM | Feb 2, 2022 | 10.19.45.22 (Wind River Linux LTS 19) |
| CVE-2022-0361 | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. | MEDIUM | Feb 2, 2022 | 10.19.45.22 (Wind River Linux LTS 19) |
| CVE-2022-0359 | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. | MEDIUM | Feb 2, 2022 | 10.19.45.22 (Wind River Linux LTS 19) |
| CVE-2022-0351 | Access of Memory Location Before Start of Buffer in GitHub repository vim/vim prior to 8.2. | MEDIUM | Jan 31, 2022 | 10.19.45.25 (Wind River Linux LTS 19) |
| CVE-2021-46669 | MariaDB through 10.5.9 allows attackers to trigger a convert_const_to_int use-after-free when the BIGINT data type is used. | MEDIUM | Feb 3, 2022 | 10.19.45.24 (Wind River Linux LTS 19) |
| CVE-2021-46668 | MariaDB through 10.5.9 allows an application crash via certain long SELECT DISTINCT statements that improperly interact with storage-engine resource limitations for temporary data structures. | MEDIUM | Feb 3, 2022 | 10.19.45.22 (Wind River Linux LTS 19) |
| CVE-2021-46667 | MariaDB before 10.6.5 has a sql_lex.cc integer overflow, leading to an application crash. | MEDIUM | Feb 3, 2022 | 10.19.45.22 (Wind River Linux LTS 19) |
| CVE-2021-46665 | MariaDB through 10.5.9 allows a sql_parse.cc application crash because of incorrect used_tables expectations. | MEDIUM | Feb 3, 2022 | 10.19.45.22 (Wind River Linux LTS 19) |
| CVE-2021-46664 | MariaDB through 10.5.9 allows an application crash in sub_select_postjoin_aggr for a NULL value of aggr. | MEDIUM | Feb 3, 2022 | 10.19.45.22 (Wind River Linux LTS 19) |
| CVE-2021-46663 | MariaDB through 10.5.13 allows a ha_maria::extra application crash via certain SELECT statements. | MEDIUM | Feb 3, 2022 | 10.19.45.22 (Wind River Linux LTS 19) |
| CVE-2021-46662 | MariaDB through 10.5.9 allows a set_var.cc application crash via certain uses of an UPDATE statement in conjunction with a nested subquery. | MEDIUM | Feb 3, 2022 | 10.19.45.22 (Wind River Linux LTS 19) |
| CVE-2021-46661 | MariaDB through 10.5.9 allows an application crash in find_field_in_tables and find_order_in_list via an unused common table expression (CTE). | MEDIUM | Feb 3, 2022 | 10.19.45.22 (Wind River Linux LTS 19) |
| CVE-2021-44879 | In gc_data_segment in fs/f2fs/gc.c in the Linux kernel before 5.16.3, special files are not considered, leading to a move_data_page NULL pointer dereference. | MEDIUM | Feb 14, 2022 | 10.19.45.23 (Wind River Linux LTS 19) |
