CVEs from 2022
Total
5,249
critical
critical 92
high
high 1,233
medium
medium 961
low
low 24
% Critical
1.8%
% with KEV
2.5%
% with exploit
3.4%
Top vendors
- oracle 616
- netapp 438
- microsoft 165
- omron 109
- azul 82
- schneider-electric 33
- mitsubishielectric 32
- siemens 10
Top products
- jdk 116
- jre 109
- openjdk 100
- zulu 82
- graalvm 74
- cloud_secure_agent 35
- oncommand_insight 34
- cloud_insights_acquisition_unit 34
| CVE | Severity | CVSS | Risk | Flags | OS | Vendor | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2022-42826 | high | — | 8.0 | 3y ago | A use after free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13, iOS 16.1 and iPadOS 16, Safari 16.1. Processing maliciously crafted web content may lead… | |||
| CVE-2022-32923 | high | — | 8.0 | 3y ago | A correctness issue in the JIT was addressed with improved checks. This issue is fixed in tvOS 16.1, iOS 15.7.1 and iPadOS 15.7.1, macOS Ventura 13, watchOS 9.1, Safari 16.1, iOS 16.1 and iPadOS 16. … | |||
| CVE-2022-50418 | high | — | 8.0 | 3y ago | In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: mhi: fix potential memory leak in ath11k_mhi_register() mhi_alloc_controller() allocates a memory space for mhi_ctr… | |||
| CVE-2022-32886 | high | — | 8.0 | 3y ago | A buffer overflow issue was addressed with improved memory handling. This issue is fixed in Safari 16, iOS 16, iOS 15.7 and iPadOS 15.7. Processing maliciously crafted web content may lead to arbitra… | |||
| CVE-2022-50839 | high | — | 8.0 | 3y ago | In the Linux kernel, the following vulnerability has been resolved: jbd2: fix potential buffer head reference count leak As in 'jbd2_fc_wait_bufs' if buffer isn't uptodate, will return -EIO without… | |||
| CVE-2022-49936 | high | — | 8.0 | 3y ago | In the Linux kernel, the following vulnerability has been resolved: USB: core: Prevent nested device-reset calls Automatic kernel fuzzing revealed a recursive locking violation in usb-storage: ===… | |||
| CVE-2022-42824 | high | — | 8.0 | 3y ago | A logic issue was addressed with improved state management. This issue is fixed in tvOS 16.1, macOS Ventura 13, watchOS 9.1, Safari 16.1, iOS 16.1 and iPadOS 16. Processing maliciously crafted web co… | |||
| CVE-2022-32888 | high | — | 8.0 | 3y ago | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.7, macOS Ventura 13, iOS 16, iOS 15.7 and iPadOS 15.7, watchOS 9, macOS Monterey 12.6… | |||
| CVE-2022-49647 | high | — | 8.0 | 3y ago | In the Linux kernel, the following vulnerability has been resolved: cgroup: Use separate src/dst nodes when preloading css_sets for migration Each cset (css_set) is pinned by its tasks. When we're … | |||
| CVE-2022-50778 | high | — | 8.0 | 3y ago | In the Linux kernel, the following vulnerability has been resolved: fortify: Fix __compiletime_strlen() under UBSAN_BOUNDS_LOCAL With CONFIG_FORTIFY=y and CONFIG_UBSAN_LOCAL_BOUNDS=y enabled, we ob… | |||
| CVE-2022-49590 | high | — | 8.0 | 3y ago | In the Linux kernel, the following vulnerability has been resolved: igmp: Fix data-races around sysctl_igmp_llm_reports. While reading sysctl_igmp_llm_reports, it can be changed concurrently. Thus,… | |||
| CVE-2022-50583 | high | — | 8.0 | 3y ago | In the Linux kernel, the following vulnerability has been resolved: md/raid0, raid10: Don't set discard sectors for request queue It should use disk_stack_limits to get a proper max_discard_sectors… | |||
| CVE-2022-50445 | high | — | 8.0 | 3y ago | In the Linux kernel, the following vulnerability has been resolved: xfrm: Reinject transport-mode packets through workqueue The following warning is displayed when the tcp6-multi-diffip11 stress te… | |||
| CVE-2022-49097 | high | — | 8.0 | 3y ago | In the Linux kernel, the following vulnerability has been resolved: NFS: Avoid writeback threads getting stuck in mempool_alloc() In a low memory situation, allow the NFS writeback code to fail wit… | |||
| CVE-2022-50726 | high | — | 8.0 | 3y ago | In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix possible use-after-free in async command interface mlx5_cmd_cleanup_async_ctx should return only after all its call… | |||
| CVE-2022-49070 | high | — | 8.0 | 3y ago | In the Linux kernel, the following vulnerability has been resolved: fbdev: Fix unregistering of framebuffers without device OF framebuffers do not have an underlying device in the Linux device hier… | |||
| CVE-2022-49902 | high | — | 8.0 | 3y ago | In the Linux kernel, the following vulnerability has been resolved: block: Fix possible memory leak for rq_wb on add_disk failure kmemleak reported memory leaks in device_add_disk(): kmemleak: 3 n… | |||
| CVE-2022-49022 | high | — | 8.0 | 3y ago | In the Linux kernel, the following vulnerability has been resolved: wifi: mac8021: fix possible oob access in ieee80211_get_rate_duration Fix possible out-of-bound access in ieee80211_get_rate_dura… | |||
| CVE-2022-50402 | high | — | 8.0 | 3y ago | In the Linux kernel, the following vulnerability has been resolved: drivers/md/md-bitmap: check the return value of md_bitmap_get_counter() Check the return value of md_bitmap_get_counter() in case… | |||
| CVE-2022-48992 | high | — | 8.0 | 3y ago | In the Linux kernel, the following vulnerability has been resolved: ASoC: soc-pcm: Add NULL check in BE reparenting Add NULL check in dpcm_be_reparent API, to handle kernel NULL pointer dereference… | |||
| CVE-2022-49236 | high | — | 8.0 | 3y ago | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix UAF due to race between btf_try_get_module and load_module While working on code to populate kfunc BTF ID sets for modul… | |||
| CVE-2022-48974 | high | — | 8.0 | 3y ago | In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: fix using __this_cpu_add in preemptible Currently in nf_conntrack_hash_check_insert(), when it fails in nf_… | |||
| CVE-2022-48939 | high | — | 8.0 | 3y ago | In the Linux kernel, the following vulnerability has been resolved: bpf: Add schedule points in batch ops syzbot reported various soft lockups caused by bpf batch operations. INFO: task kworker/1… | |||
| CVE-2022-49753 | high | — | 8.0 | 3y ago | In the Linux kernel, the following vulnerability has been resolved: dmaengine: Fix double increment of client_count in dma_chan_get() The first time dma_chan_get() is called for a channel the chann… | |||
| CVE-2022-38023 | high | — | 8.0 | 3y ago | RHSA-2023:0838: samba security update (Important) | |||
| CVE-2022-50425 | high | — | 8.0 | 3y ago | In the Linux kernel, the following vulnerability has been resolved: x86/fpu: Fix copy_xstate_to_uabi() to copy init states correctly When an extended state component is not present in fpstate, but … | |||
| CVE-2022-4269 | high | — | 8.0 | 3y ago | A flaw was found in the Linux kernel Traffic Control (TC) subsystem. Using a specific networking configuration (redirecting egress packets to ingress using TC action "mirred") a local unprivileged us… | |||
| CVE-2022-4744 | high | — | 8.0 | 3y ago | A double-free flaw was found in the Linux kernel’s TUN/TAP device driver functionality in how a user registers the device when the register_netdevice function fails (NETDEV_REGISTER notifier). This f… | |||
| CVE-2022-3560 | high | — | 8.0 | 3y ago | RHSA-2023:1572: pesign security update (Important) | |||
| CVE-2022-3564 | high | — | 8.0 | 3y ago | A vulnerability classified as critical was found in Linux Kernel. Affected by this vulnerability is the function l2cap_reassemble_sdu of the file net/bluetooth/l2cap_core.c of the component Bluetooth… | |||
| CVE-2022-4379 | high | — | 8.0 | 3y ago | A use-after-free vulnerability was found in __nfs42_ssc_open() in fs/nfs/nfs4file.c in the Linux kernel. This flaw allows an attacker to conduct a remote denial | |||
| CVE-2022-2873 | high | — | 8.0 | 3y ago | An out-of-bounds memory access flaw was found in the Linux kernel Intel’s iSMT SMBus host controller driver in the way a user triggers the I2C_SMBUS_BLOCK_DATA (with the ioctl I2C_SMBUS) with malicio… | |||
| CVE-2022-49944 | high | — | 8.0 | 3y ago | In the Linux kernel, the following vulnerability has been resolved: Revert "usb: typec: ucsi: add a common function ucsi_unregister_connectors()" The recent commit 87d0e2f41b8c ("usb: typec: ucsi: … | |||
| CVE-2022-4378 | high | — | 8.0 | 3y ago | A stack overflow flaw was found in the Linux kernel's SYSCTL subsystem in how a user changes certain kernel parameters and variables. This flaw allows a local user to crash or potentially escalate th… | |||
| CVE-2022-41222 | high | — | 8.0 | 3y ago | mm/mremap.c in the Linux kernel before 5.13.3 has a use-after-free via a stale TLB because an rmap lock is not held during a PUD move. | |||
| CVE-2022-47629 | high | — | 8.0 | 3y ago | Libksba before 1.6.3 is prone to an integer overflow vulnerability in the CRL signature parser. | |||
| CVE-2022-4450 | high | — | 8.0 | 3y ago | RHSA-2023:2932: edk2 security update (Important) | |||
| CVE-2022-4304 | high | — | 8.0 | 3y ago | RHSA-2023:2932: edk2 security update (Important) | |||
| CVE-2022-41903 | high | — | 8.0 | 3y ago | RHSA-2023:0610: git security update (Important) | |||
| CVE-2022-23521 | high | — | 8.0 | 3y ago | RHSA-2023:0610: git security update (Important) | |||
| CVE-2022-46877 | high | — | 8.0 | 3y ago | By confusing the browser, the fullscreen notification could have been delayed or suppressed, resulting in potential user confusion or spoofing attacks. This vulnerability affects Firefox < 108. | |||
| CVE-2022-46871 | high | — | 8.0 | 3y ago | An out of date library (libusrsctp) contained vulnerabilities that could potentially be exploited. This vulnerability affects Firefox < 108. | |||
| CVE-2022-44617 | high | — | 8.0 | 3y ago | RHSA-2023:0379: libXpm security update (Important) | |||
| CVE-2022-2964 | high | — | 8.0 | 3y ago | A flaw was found in the Linux kernel’s driver for the ASIX AX88179_178A-based USB 2.0/3.0 Gigabit Ethernet Devices. The vulnerability contains multiple out-of-bounds reads and possible out-of-bounds … | |||
| CVE-2022-3077 | high | — | 8.0 | 3y ago | A buffer overflow vulnerability was found in the Linux kernel Intel’s iSMT SMBus host controller driver in the way it handled the I2C_SMBUS_BLOCK_PROC_CALL case (via the ioctl I2C_SMBUS) with malicio… | |||
| CVE-2022-4139 | high | — | 8.0 | 3y ago | An incorrect TLB flush issue was found in the Linux kernel’s GPU i915 kernel driver, potentially leading to random memory corruption or data leaks. This flaw could allow a local user to crash the sys… | |||
| CVE-2022-2959 | high | — | 8.0 | 3y ago | A race condition was found in the Linux kernel's watch queue due to a missing lock in pipe_resize_ring(). The specific flaw exists within the handling of pipe buffers. The issue results from the lack… | |||
| CVE-2022-46285 | high | — | 8.0 | 3y ago | RHSA-2023:0379: libXpm security update (Important) | |||
| CVE-2022-4883 | high | — | 8.0 | 3y ago | RHSA-2023:0379: libXpm security update (Important) | |||
| CVE-2022-44572 | high | — | 8.0 | 3y ago | A denial of service vulnerability in the multipart parsing component of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1 and 3.0.0.1 could allow an attacker tocraft input that can cause RFC2183 multipart boun… | |||
| CVE-2022-44570 | high | — | 8.0 | 3y ago | A denial of service vulnerability in the Range header parsing component of Rack >= 1.5.0. A Carefully crafted input can cause the Range header parsing component in Rack to take an unexpected amount o… | |||
| CVE-2022-44566 | high | — | 8.0 | 3y ago | A denial of service vulnerability present in ActiveRecord's PostgreSQL adapter <7.0.4.1 and <6.1.7.1. When a value outside the range for a 64bit signed integer is provided to the PostgreSQL connectio… | |||
| CVE-2022-44571 | high | — | 8.0 | 3y ago | There is a denial of service vulnerability in the Content-Disposition parsingcomponent of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1, 3.0.0.1. This could allow an attacker to craft an input that can cau… | |||
| CVE-2022-47318 | high | — | 8.0 | 3y ago | ruby-git versions prior to v1.13.0 allows a remote authenticated attacker to execute an arbitrary ruby code by having a user to load a repository containing a specially crafted filename to the produc… | |||
| CVE-2022-46648 | high | — | 8.0 | 4y ago | ruby-git versions prior to v1.13.0 allows a remote authenticated attacker to execute an arbitrary ruby code by having a user to load a repository containing a specially crafted filename to the produc… | |||
| CVE-2022-42920 | high | — | 8.0 | 4y ago | Apache Commons BCEL vulnerable to out-of-bounds write | |||
| CVE-2022-40899 | high | — | 8.0 | 4y ago | An issue discovered in Python Charmers Future 0.18.2 and earlier allows remote attackers to cause a denial of service via crafted Set-Cookie header from malicious web server. | |||
| CVE-2022-45414 | high | — | 8.0 | 4y ago | RHSA-2022:9074: thunderbird security update (Important) | |||
| CVE-2022-46874 | high | — | 8.0 | 4y ago | A file with a long filename could have had its filename truncated to remove the valid extension, leaving a malicious extension in its place. This could potentially led to user confusion and the execu… | |||
| CVE-2022-46881 | high | — | 8.0 | 4y ago | An optimization in WebGL was incorrect in some cases, and could have led to memory corruption and a potentially exploitable crash. *Note*: This advisory was added on December 13th, 2022 after we bett… | |||
| CVE-2022-46882 | high | — | 8.0 | 4y ago | A use-after-free in WebGL extensions could have led to a potentially exploitable crash. This vulnerability affects Firefox < 107, Firefox ESR < 102.6, and Thunderbird < 102.6. | |||
| CVE-2022-46878 | high | — | 8.0 | 4y ago | Mozilla developers Randell Jesup, Valentin Gosu, Olli Pettay, and the Mozilla Fuzzing Team reported memory safety bugs present in Thunderbird 102.5. Some of these bugs showed evidence of memory corru… | |||
| CVE-2022-46872 | high | — | 8.0 | 4y ago | An attacker who compromised a content process could have partially escaped the sandbox to read arbitrary files via clipboard-related IPC messages.<br>*This bug only affects Thunderbird for Linux. Oth… | |||
| CVE-2022-46880 | high | — | 8.0 | 4y ago | A missing check related to tex units could have led to a use-after-free and potentially exploitable crash.<br />*Note*: This advisory was added on December 13th, 2022 after we better understood the i… | |||
| CVE-2022-23519 | high | — | 8.0 | 4y ago | rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Prior to version 1.4.4, a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer may… | |||
| CVE-2022-23516 | high | — | 8.0 | 4y ago | Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah >= 2.2.0, < 2.19.1 uses recursion for sanitizing CDATA sections, makin… | |||
| CVE-2022-23514 | high | — | 8.0 | 4y ago | Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah < 2.19.1 contains an inefficient regular expression that is susceptibl… | |||
| CVE-2022-23515 | high | — | 8.0 | 4y ago | Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah >= 2.1.0, < 2.19.1 is vulnerable to cross-site scripting via the image… | |||
| CVE-2022-23517 | high | — | 8.0 | 4y ago | rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Certain configurations of rails-html-sanitizer < 1.4.4 use an inefficient regular expression that is susceptib… | |||
| CVE-2022-23518 | high | — | 8.0 | 4y ago | rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Versions >= 1.0.3, < 1.4.4 are vulnerable to cross-site scripting via data URIs when used in combination with … | |||
| CVE-2022-23520 | high | — | 8.0 | 4y ago | rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Prior to version 1.4.4, there is a possible XSS vulnerability with certain configurations of Rails::Html::Sani… | |||
| CVE-2022-42898 | high | — | 8.0 | 4y ago | RHSA-2022:8638: krb5 security update (Important) | |||
| CVE-2022-45060 | high | — | 8.0 | 4y ago | An HTTP Request Forgery issue was discovered in Varnish Cache 5.x and 6.x before 6.0.11, 7.x before 7.1.2, and 7.2.x before 7.2.1. An attacker may introduce characters through HTTP/2 pseudo-headers t… | |||
| CVE-2022-45405 | high | — | 8.0 | 4y ago | Freeing arbitrary <code>nsIInputStream</code>'s on a different thread than creation could have led to a use-after-free and potentially exploitable crash. This vulnerability affects Firefox ESR < 102.… | |||
| CVE-2022-45421 | high | — | 8.0 | 4y ago | Mozilla developers Andrew McCreight and Gabriele Svelto reported memory safety bugs present in Thunderbird 102.4. Some of these bugs showed evidence of memory corruption and we presume that with enou… | |||
| CVE-2022-45420 | high | — | 8.0 | 4y ago | Use tables inside of an iframe, an attacker could have caused iframe contents to be rendered outside the boundaries of the iframe, resulting in potential user confusion or spoofing attacks. This vuln… | |||
| CVE-2022-45418 | high | — | 8.0 | 4y ago | If a custom mouse cursor is specified in CSS, under certain circumstances the cursor could have been drawn over the browser UI, resulting in potential user confusion or spoofing attacks. This vulnera… | |||
| CVE-2022-45416 | high | — | 8.0 | 4y ago | Keyboard events reference strings like "KeyA" that were at fixed, known, and widely-spread addresses. Cache-based timing attacks such as Prime+Probe could have possibly figured out which keys were be… | |||
| CVE-2022-45412 | high | — | 8.0 | 4y ago | When resolving a symlink such as <code>file:///proc/self/fd/1</code>, an error message may be produced where the symlink was resolved to a string containing unitialized memory in the buffer. <br>*Thi… | |||
| CVE-2022-45411 | high | — | 8.0 | 4y ago | Cross-Site Tracing occurs when a server will echo a request back via the Trace method, allowing an XSS attack to access to authorization headers and cookies inaccessible to JavaScript (such as cookie… | |||
| CVE-2022-45408 | high | — | 8.0 | 4y ago | Through a series of popups that reuse windowName, an attacker can cause a window to go fullscreen without the user seeing the notification prompt, resulting in potential user confusion or spoofing at… | |||
| CVE-2022-45410 | high | — | 8.0 | 4y ago | When a ServiceWorker intercepted a request with <code>FetchEvent</code>, the origin of the request was lost after the ServiceWorker took ownership of it. This had the effect of negating SameSite cook… | |||
| CVE-2022-45406 | high | — | 8.0 | 4y ago | If an out-of-memory condition occurred when creating a JavaScript global, a JavaScript realm may be deleted while references to it lived on in a BaseShape. This could lead to a use-after-free causing… | |||
| CVE-2022-45404 | high | — | 8.0 | 4y ago | Through a series of popup and <code>window.print()</code> calls, an attacker can cause a window to go fullscreen without the user seeing the notification prompt, resulting in potential user confusion… | |||
| CVE-2022-45403 | high | — | 8.0 | 4y ago | Service Workers should not be able to infer information about opaque cross-origin responses; but timing information for cross-origin media combined with Range requests might have allowed them to dete… | |||
| CVE-2022-45409 | high | — | 8.0 | 4y ago | The garbage collector could have been aborted in several states and zones and <code>GCRuntime::finishCollection</code> may not have been called, leading to a use-after-free and potentially exploitabl… | |||
| CVE-2022-42919 | high | — | 8.0 | 4y ago | Important: python3.9 security update | |||
| CVE-2022-49691 | high | — | 8.0 | 4y ago | In the Linux kernel, the following vulnerability has been resolved: erspan: do not assume transport header is always set Rewrite tests in ip6erspan_tunnel_xmit() and erspan_fb_xmit() to not assume … | |||
| CVE-2022-28199 | high | — | 8.0 | 4y ago | Important: dpdk security and bug fix update | |||
| CVE-2022-49545 | high | — | 8.0 | 4y ago | In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Cancel pending work at closing a MIDI substream At closing a USB MIDI output substream, there might be still a p… | |||
| CVE-2022-49227 | high | — | 8.0 | 4y ago | In the Linux kernel, the following vulnerability has been resolved: igc: avoid kernel warning when changing RX ring parameters Calling ethtool changing the RX ring parameters like this: $ ethtoo… | |||
| CVE-2022-50000 | high | — | 8.0 | 4y ago | In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: fix stuck flows on cleanup due to pending work To clear the flow table on flow table free, the following se… | |||
| CVE-2022-49663 | high | — | 8.0 | 4y ago | In the Linux kernel, the following vulnerability has been resolved: tunnels: do not assume mac header is set in skb_tunnel_check_pmtu() Recently added debug in commit f9aefd6b2aa3 ("net: warn if ma… | |||
| CVE-2022-50536 | high | — | 8.0 | 4y ago | In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix repeated calls to sock_put() when msg has more_data In tcp_bpf_send_verdict() redirection, the eval variable is… | |||
| CVE-2022-50506 | high | — | 8.0 | 4y ago | In the Linux kernel, the following vulnerability has been resolved: drbd: only clone bio if we have a backing device Commit c347a787e34cb (drbd: set ->bi_bdev in drbd_req_new) moved a bio_set_dev c… | |||
| CVE-2022-48866 | high | — | 8.0 | 4y ago | In the Linux kernel, the following vulnerability has been resolved: HID: hid-thrustmaster: fix OOB read in thrustmaster_interrupts Syzbot reported an slab-out-of-bounds Read in thrustmaster_probe()… | |||
| CVE-2022-50048 | high | — | 8.0 | 4y ago | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: possible module reference underflow in error path dst->ops is set on when nft_expr_clone() fails, but modul… | |||
| CVE-2022-50001 | high | — | 8.0 | 4y ago | In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tproxy: restrict to prerouting hook TPROXY is only allowed from prerouting, but nft_tproxy doesn't check this. Thi… | |||
| CVE-2022-49732 | high | — | 8.0 | 4y ago | In the Linux kernel, the following vulnerability has been resolved: sock: redo the psock vs ULP protection check Commit 8a59f9d1e3d4 ("sock: Introduce sk->sk_prot->psock_update_sk_prot()") has move… | |||
| CVE-2022-3787 | high | — | 8.0 | 4y ago | RHSA-2022:7928: device-mapper-multipath security update (Important) |