All CVEs — 2022 (Page 180/183)

Browse all CVEs by publication year. Use filters to refine.

CVSS ≥ 0.0

2022-01-12

Medium

CVE-2021-44649

Django CMS 3.7.3 does not validate the plugin_type parameter while generating error messages for an invalid plugin type, resulting in a Cross Site Scripting (XSS) vulnerability. The vulnerability all…

CVSS: 5.4 CWE: CWE-79

High

CVE-2021-44648

GNOME gdk-pixbuf 2.42.6 is vulnerable to a heap-buffer overflow vulnerability when decoding the lzw compressed stream of image data in GIF files with lzw minimum code size equals to 12.

CVSS: 8.8 CWE: CWE-787

High

CVE-2021-3852

growi is vulnerable to Authorization Bypass Through User-Controlled Key

CVSS: 7.5 CWE: CWE-639

Medium

CVE-2022-0179

snipe-it is vulnerable to Missing Authorization

CVSS: 5.4 CWE: CWE-862

Medium

CVE-2022-0159

orchardcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSS: 5.4 CWE: CWE-79

Medium

CVE-2022-0087

keystone is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSS: 6.1 CWE: CWE-79

2022-01-11

High

CVE-2022-21646

SpiceDB is a database system for managing security-critical application permissions. Any user making use of a wildcard relationship under the right hand branch of an `exclusion` or within an `interse…

CVSS: 8.1 CWE: CWE-20

Medium

CVE-2021-46283

nf_tables_newset in net/netfilter/nf_tables_api.c in the Linux kernel before 5.12.13 allows local users to cause a denial of service (NULL pointer dereference and general protection fault) because of…

CVSS: 5.5 CWE: CWE-665

High

CVE-2021-43999

Apache Guacamole 1.2.0 and 1.3.0 do not properly validate responses received from a SAML identity provider. If SAML support is enabled, this may allow a malicious user to assume the identity of anoth…

CVSS: 8.8 CWE: CWE-287

Medium

CVE-2021-41767

Apache Guacamole 1.3.0 and older may incorrectly include a private tunnel identifier in the non-private details of some REST responses. This may allow an authenticated user who already has permission…

CVSS: 6.5 CWE: CWE-200

Medium

CVE-2022-21970

Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability

CVSS: 6.1 CWE: CWE-269

Medium

CVE-2022-21964

Remote Desktop Licensing Diagnoser Information Disclosure Vulnerability

CVSS: 5.5 CWE: CWE-668

High

CVE-2022-21932

Microsoft Dynamics 365 Customer Engagement Cross-Site Scripting Vulnerability

CVSS: 7.6 CWE: CWE-79

High

CVE-2022-21919

Windows User Profile Service Elevation of Privilege Vulnerability

CVSS: 7.0 CWE: CWE-59

High

CVE-2022-21917

HEVC Video Extensions Remote Code Execution Vulnerability

CVSS: 7.8 CWE: CWE-787

High

CVE-2022-21902

Windows DWM Core Library Elevation of Privilege Vulnerability

CVSS: 7.8 CWE: CWE-269

High

CVE-2022-21896

Windows DWM Core Library Elevation of Privilege Vulnerability

CVSS: 7.0 CWE: CWE-362

High

CVE-2022-21895

Windows User Profile Service Elevation of Privilege Vulnerability

CVSS: 7.8 CWE: CWE-59

Medium

CVE-2022-21894

Secure Boot Security Feature Bypass Vulnerability

CVSS: 4.4 CWE: CWE-863

High

CVE-2022-21882

Win32k Elevation of Privilege Vulnerability

CVSS: 7.0 CWE: CWE-787

High

CVE-2022-21881

Windows Kernel Elevation of Privilege Vulnerability

CVSS: 7.0 CWE: CWE-362

Medium

CVE-2022-21877

Storage Spaces Controller Information Disclosure Vulnerability

CVSS: 5.5 CWE: CWE-125

Medium

CVE-2022-21876

Win32k Information Disclosure Vulnerability

CVSS: 5.5 CWE: CWE-125

High

CVE-2022-21852

Windows DWM Core Library Elevation of Privilege Vulnerability

CVSS: 7.8 CWE: CWE-119

Medium

CVE-2022-21838

Windows Cleanup Manager Elevation of Privilege Vulnerability

CVSS: 5.5 CWE: CWE-59

High

CVE-2022-21836

Windows Certificate Spoofing Vulnerability

CVSS: 7.8 CWE: CWE-295

Medium

CVE-2021-43974

An issue was discovered in SysAid ITIL 20.4.74 b10. The /enduserreg endpoint is used to register end users anonymously, but does not respect the server-side setting that determines if anonymous users…

CVSS: 5.3 CWE: CWE-306

High

CVE-2021-43973

An unrestricted file upload vulnerability in /UploadPsIcon.jsp in SysAid ITIL 20.4.74 b10 allows a remote authenticated attacker to upload an arbitrary file via the file parameter in the HTTP POST bo…

CVSS: 8.8 CWE: CWE-434

High

CVE-2021-43971

A SQL injection vulnerability in /mobile/SelectUsers.jsp in SysAid ITIL 20.4.74 b10 allows a remote authenticated attacker to execute arbitrary SQL commands via the filterText parameter.

CVSS: 8.8 CWE: CWE-89

Critical

CVE-2021-43052

The Realm Server component of TIBCO Software Inc.'s TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, and TIBCO FTL - Enterprise Edition contains an easily exploitable vulnerability that…

CVSS: 9.3 CWE: CWE-798

High

CVE-2021-34704

A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to…

CVSS: 8.6 CWE: CWE-121

High

CVE-2021-1573

CVSS: 8.6 CWE: CWE-121

Medium

CVE-2022-0173

radare2 is vulnerable to Out-of-bounds Read

CVSS: 5.5 CWE: CWE-125

High

CVE-2022-0129

Uncontrolled search path element vulnerability in McAfee TechCheck prior to 4.0.0.2 allows a local administrator to load their own Dynamic Link Library (DLL) gaining elevation of privileges to system…

CVSS: 7.4 CWE: CWE-427

Medium

CVE-2022-0170

peertube is vulnerable to Improper Access Control

CVSS: 4.3 CWE: CWE-284

Low

CVE-2021-43566

All versions of Samba prior to 4.13.16 are vulnerable to a malicious client using an SMB1 or NFS race to allow a directory to be created in an area of the server file system not exported under the sh…

CVSS: 2.5 CWE: CWE-362

Critical

CVE-2020-28103

cscms v4.1 allows for SQL injection via the "page_del" function.

CVSS: 9.8 CWE: CWE-89

Critical

CVE-2020-28102

cscms v4.1 allows for SQL injection via the "js_del" function.

CVSS: 9.8 CWE: CWE-89

High

CVE-2022-21671

@replit/crosis is a JavaScript client that speaks Replit's container protocol. A vulnerability that involves exposure of sensitive information exists in versions prior to 7.3.1. When using this libra…

CVSS: 8.1 CWE: CWE-200

Critical

CVE-2022-21669

PuddingBot is a group management bot. In version 0.0.6-b933652 and prior, the bot token is publicly exposed in main.py, making it accessible to malicious actors. The bot token has been revoked and ne…

CVSS: 9.1 CWE: CWE-798

Medium

CVE-2021-44647

Lua v5.4.3 and above are affected by SEGV by type confusion in funcnamefromcode function in ldebug.c which can cause a local denial of service.

CVSS: 5.5 CWE: CWE-843

High

CVE-2021-45460

A vulnerability has been identified in SICAM PQ Analyzer (All versions < V3.18). A service is started by an unquoted registry entry. As there are spaces in this path, attackers with write privilege t…

CVSS: 8.1 CWE: CWE-428

High

CVE-2021-45034

A vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O -25/+70°C (All versions < V16.20), CP-8000 MASTER MODULE WITH I/O -40/+70°C (All versions < V16.20), CP-8021 MASTER MODULE (All v…

CVSS: 7.5 CWE: CWE-284

High

CVE-2021-45033

CVSS: 8.8 CWE: CWE-798

High

CVE-2021-41769

A vulnerability has been identified in SIPROTEC 5 6MD85 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 6MD86 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 6MD89 devic…

CVSS: 7.5 CWE: CWE-20

High

CVE-2021-37198

A vulnerability has been identified in COMOS V10.2 (All versions only if web components are used), COMOS V10.3 (All versions < V10.3.3.3 only if web components are used), COMOS V10.4 (All versions <…

CVSS: 8.8 CWE: CWE-352

High

CVE-2021-37197

CVSS: 8.8 CWE: CWE-89

Medium

CVE-2021-37196

CVSS: 6.5 CWE: CWE-23

Medium

CVE-2021-37195

CVSS: 6.1 CWE: CWE-80

High

CVE-2022-0144

shelljs is vulnerable to Improper Privilege Management

CVSS: 7.1 CWE: CWE-269

2022-01-10

High

CVE-2021-36414

A heab-based buffer overflow vulnerability exists in MP4Box in GPAC 1.0.1 via media.c, which allows attackers to cause a denial of service or execute arbitrary code via a crafted file.

CVSS: 7.8 CWE: CWE-787

High

CVE-2021-36412

A heap-based buffer overflow vulnerability exists in MP4Box in GPAC 1.0.1 via the gp_rtp_builder_do_mpeg12_video function, which allows attackers to possibly have unspecified other impact via a craft…

CVSS: 7.8 CWE: CWE-787

Medium

CVE-2021-36411

An issue has been found in libde265 v1.0.8 due to incorrect access control. A SEGV caused by a READ memory access in function derive_boundaryStrength of deblock.cc has occurred. The vulnerability cau…

CVSS: 5.5 CWE: CWE-125

Medium

CVE-2021-36410

A stack-buffer-overflow exists in libde265 v1.0.8 via fallback-motion.cc in function put_epel_hv_fallback when running program dec265.

CVSS: 5.5 CWE: CWE-787

High

CVE-2021-36409

There is an Assertion `scaling_list_pred_matrix_id_delta==1' failed at sps.cc:925 in libde265 v1.0.8 when decoding file, which allows attackers to cause a Denial of Service (DoS) by running the appli…

CVSS: 7.8 CWE: CWE-617

Medium

CVE-2021-36408

An issue was discovered in libde265 v1.0.8.There is a Heap-use-after-free in intrapred.h when decoding file using dec265.

CVSS: 5.5 CWE: CWE-416

Medium

CVE-2021-35452

An Incorrect Access Control vulnerability exists in libde265 v1.0.8 due to a SEGV in slice.cc.

CVSS: 6.5 CWE: CWE-125

Medium

CVE-2020-25427

A Null pointer dereference vulnerability exits in MP4Box - GPAC version 0.8.0-rev177-g51a8ef874-master via the gf_isom_get_track_id function, which causes a denial of service.

CVSS: 5.5 CWE: CWE-476

Medium

CVE-2022-21672

make-ca is a utility to deliver and manage a complete PKI configuration for workstations and servers. Starting with version 0.9 and prior to version 1.10, make-ca misinterprets Mozilla certdata.txt a…

CVSS: 6.5 CWE: CWE-115

Medium

CVE-2022-21670

markdown-it is a Markdown parser. Prior to version 1.3.2, special patterns with length greater than 50 thousand characterss could slow down the parser significantly. Users should upgrade to version 1…

CVSS: 5.3 CWE: CWE-400

High

CVE-2022-21668

pipenv is a Python development workflow tool. Starting with version 2018.10.9 and prior to version 2022.1.8, a flaw in pipenv's parsing of requirements files allows an attacker to insert a specially…

CVSS: 8.0 CWE: CWE-20

High

CVE-2022-21666

Useful Simple Open-Source CMS (USOC) is a content management system (CMS) for programmers. Versions prior to Pb2.4Bfx3 allowed Sql injection in usersearch.php only for users with administrative privi…

CVSS: 7.2 CWE: CWE-89

Medium

CVE-2022-0155

follow-redirects is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor

CVSS: 6.5 CWE: CWE-359

High

CVE-2021-29454

Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to versions 3.1.42 and 4.0.2, template authors could run arbitrary PHP code b…

CVSS: 8.1 CWE: CWE-74

High

CVE-2021-21408

Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to versions 3.1.43 and 4.0.3, template authors could run restricted static ph…

CVSS: 8.8 CWE: CWE-20

Medium

CVE-2022-0174

Improper Validation of Specified Quantity in Input vulnerability in dolibarr dolibarr/dolibarr.

CVSS: 4.3 CWE: CWE-1284

High

CVE-2020-28679

A vulnerability in the showReports module of Zoho ManageEngine Applications Manager before build 14550 allows authenticated attackers to execute a SQL injection via a crafted request.

CVSS: 8.8 CWE: CWE-89

High

CVE-2022-22121

In NocoDB, versions 0.81.0 through 0.83.8 are affected by CSV Injection vulnerability (Formula Injection). A low privileged attacker can create a new table to inject payloads in the table rows. When…

CVSS: 8.0 CWE: CWE-1236

Medium

CVE-2022-22120

In NocoDB, versions 0.9 to 0.83.8 are vulnerable to Observable Discrepancy in the password-reset feature. When requesting a password reset for a given email address, the application displays an error…

CVSS: 5.3 CWE: CWE-203

Medium

CVE-2022-22117

In Directus, versions 9.0.0-alpha.4 through 9.4.1 allow unrestricted file upload of .html files in the media upload functionality, which leads to Cross-Site Scripting vulnerability. A low privileged…

CVSS: 5.4 CWE: CWE-79

Medium

CVE-2022-22116

In Directus, versions 9.0.0-alpha.4 through 9.4.1 are vulnerable to stored Cross-Site Scripting (XSS) vulnerability via SVG file upload in media upload functionality. A low privileged attacker can in…

CVSS: 5.4 CWE: CWE-79

Critical

CVE-2022-22115

In Teedy, versions v1.5 through v1.9 are vulnerable to Stored Cross-Site Scripting (XSS) in the name of a created Tag. Since the Tag name is not being sanitized properly in the edit tag page, a low p…

CVSS: 9.0 CWE: CWE-79

Critical

CVE-2022-22114

In Teedy, versions v1.5 through v1.9 are vulnerable to Reflected Cross-Site Scripting (XSS). The “search term" search functionality is not sufficiently sanitized while displaying the results of the s…

CVSS: 9.6 CWE: CWE-79

Low

CVE-2022-0158

vim is vulnerable to Heap-based Buffer Overflow

CVSS: 3.3 CWE: CWE-122

Medium

CVE-2022-0157

phoronix-test-suite is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSS: 5.4 CWE: CWE-79

Medium

CVE-2022-0156

vim is vulnerable to Use After Free

CVSS: 5.5 CWE: CWE-416

High

CVE-2021-44458

Linux users running Lens 5.2.6 and earlier could be compromised by visiting a malicious website. The malicious website could make websocket connections from the victim's browser to Lens and so operat…

CVSS: 8.3 CWE: CWE-287

Medium

CVE-2021-43951

Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view object import configuration details via an Information Disclosure vulnerabil…

CVSS: 4.3 CWE: CWE-200

Medium

CVE-2021-43949

Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view private objects via a Broken Access Control vulnerability in the Custom Fiel…

CVSS: 4.3 CWE: CWE-200

Critical

CVE-2021-43297

A deserialization vulnerability existed in dubbo hessian-lite 3.2.11 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization…

CVSS: 9.8 CWE: CWE-502

High

CVE-2021-25054

The WPcalc WordPress plugin through 2.1 does not sanitize user input into the 'did' parameter and uses it in a SQL statement, leading to an authenticated SQL Injection vulnerability.

CVSS: 8.8 CWE: CWE-89

High

CVE-2021-25053

The WP Coder WordPress plugin before 2.5.2 within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as well as with data:// or http:// protocols), thus leading to…

CVSS: 8.8 CWE: CWE-352

High

CVE-2021-25052

The Button Generator WordPress plugin before 2.3.3 within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as well as with data:// or http:// protocols), thus le…

CVSS: 8.8 CWE: CWE-352

High

CVE-2021-25051

The Modal Window WordPress plugin before 5.2.2 within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as well as with data:// or http:// protocols), thus leadin…

CVSS: 8.8 CWE: CWE-352

Medium

CVE-2021-25047

The 10Web Social Photo Feed WordPress plugin before 1.4.29 was affected by a reflected Cross-Site Scripting (XSS) vulnerability in the wdi_apply_changes admin page, allowing an attacker to perform su…

CVSS: 6.1 CWE: CWE-79

Medium

CVE-2021-25043

The WOOCS WordPress plugin before 1.3.7.3 does not sanitise and escape the custom_prices parameter before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue

CVSS: 6.1 CWE: CWE-79

Critical

CVE-2021-25032

The PublishPress Capabilities WordPress plugin before 2.3.1, PublishPress Capabilities Pro WordPress plugin before 2.3.1 does not have authorisation and CSRF checks when updating the plugin's setting…

CVSS: 9.8 CWE: CWE-352

Critical

CVE-2021-24949

The "WP Search Filters" widget of The Plus Addons for Elementor - Pro WordPress plugin before 5.0.7 does not sanitise and escape the option parameter before using it in a SQL statement, which could l…

CVSS: 9.8 CWE: CWE-89

High

CVE-2021-24948

The Plus Addons for Elementor - Pro WordPress plugin before 5.0.7 does not validate the qvquery parameter of the tp_get_dl_post_info_ajax AJAX action, which could allow unauthenticated users to retri…

CVSS: 7.5 CWE: CWE-200

High

CVE-2021-24862

The RegistrationMagic WordPress plugin before 5.0.1.6 does not escape user input in its rm_chronos_ajax AJAX action before using it in a SQL statement when duplicating tasks in batches, which could l…

CVSS: 7.2 CWE: CWE-89

Medium

CVE-2021-23218

When running with FIPS mode enabled, Mirantis Container Runtime 20.10.8 leaks memory during TLS Handshakes which could be abused to cause a denial of service.

CVSS: 5.3 CWE: CWE-401

Medium

CVE-2021-23154

In Lens prior to 5.3.4, custom helm chart configuration creates helm commands from string concatenation of provided arguments which are then executed in the user's shell. Arguments can be provided wh…

CVSS: 6.3 CWE: CWE-94

High

CVE-2021-44586

An issue was discovered in dst-admin v1.3.0. The product has an unauthorized arbitrary file download vulnerability that can expose sensitive information.

CVSS: 7.5 CWE: CWE-22

Critical

CVE-2022-22845

QXIP SIPCAPTURE homer-app before 1.4.28 for HOMER 7.x has the same 167f0db2-f83e-4baa-9736-d56064a5b415 JWT secret key across different customers' installations.

CVSS: 9.8 CWE: CWE-798

Medium

CVE-2022-22844

LibTIFF 4.3.0 has an out-of-bounds read in _TIFFmemcpy in tif_unix.c in certain situations involving a custom tag and 0x0200 as the second word of the DE field.

CVSS: 5.5 CWE: CWE-125

Medium

CVE-2022-22836

CoreFTP Server before 727 allows directory traversal (for file creation) by an authenticated attacker via ../ in an HTTP PUT request.

CVSS: 6.5 CWE: CWE-22

High

CVE-2022-22827

storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

CVSS: 8.8 CWE: CWE-190

High

CVE-2022-22826

nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

CVSS: 8.8 CWE: CWE-190

High

CVE-2022-22825

lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

CVSS: 8.8 CWE: CWE-190

Critical

CVE-2022-22824

defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

CVSS: 9.8 CWE: CWE-190

Critical

CVE-2022-22823

build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

CVSS: 9.8 CWE: CWE-190

Critical

CVE-2022-22822

addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

CVSS: 9.8 CWE: CWE-190

Low

CVE-2022-22821

NVIDIA NeMo before 1.6.0 contains a vulnerability in ASR WebApp, in which ../ Path Traversal may lead to deletion of any directory when admin privileges are available.

CVSS: 2.0 CWE: CWE-22

Medium

CVE-2022-22816

path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path.

CVSS: 6.5 CWE: CWE-125

Medium

CVE-2022-22815

path_getbbox in path.c in Pillow before 9.0.0 improperly initializes ImagePath.Path.

CVSS: 6.5 CWE: CWE-665

Medium

CVE-2022-22702

PartKeepr versions up to v1.4.0, in the functionality to upload attachments using a URL when creating a part does not validate that requests can be made to local ports, allowing an authenticated user…

CVSS: 4.3 CWE: CWE-918

Medium

CVE-2022-22701

PartKeepr versions up to v1.4.0, loads attachments using a URL while creating a part and allows the use of the 'file://' URI scheme, allowing an authenticated user to read local files.

CVSS: 6.5 CWE: CWE-200

Medium

CVE-2022-22289

Improper access control vulnerability in S Assistant prior to version 7.5 allows attacker to remotely get senstive information.

CVSS: 5.3 CWE: CWE-287

High

CVE-2022-22288

Improper authorization vulnerability in Galaxy Store prior to 4.5.36.5 allows remote app installation of the allowlist.

CVSS: 7.5 CWE: CWE-285

Low

CVE-2022-22287

Abitrary file access vulnerability in Samsung Email prior to 6.1.60.16 allows attacker to read isolated data in sandbox.

CVSS: 3.9 CWE: CWE-20

Medium

CVE-2022-22286

A vulnerability using PendingIntent in Bixby Routines prior to version 3.1.21.8 in Android R(11.0) and 2.6.30.5 in Android Q(10.0) allows attackers to execute privileged action by hijacking and modif…

CVSS: 4.4 CWE: CWE-94

Medium

CVE-2022-22285

A vulnerability using PendingIntent in Reminder prior to version 12.2.05.0 in Android R(11.0) and 12.3.02.1000 in Android S(12.0) allows attackers to execute privileged action by hijacking and modify…

CVSS: 4.4 CWE: CWE-94

Medium

CVE-2022-22284

Improper authentication vulnerability in Samsung Internet prior to 16.0.2.19 allows attackers to bypass secret mode password authentication

CVSS: 5.7 CWE: CWE-287

Low

CVE-2022-22283

Improper session management vulnerability in Samsung Health prior to 6.20.1.005 prevents logging out from Samsung Health App.

CVSS: 2.8 CWE: CWE-287

Medium

CVE-2022-22272

Improper authorization in TelephonyManager prior to SMR Jan-2022 Release 1 allows attackers to get IMSI without READ_PRIVILEGED_PHONE_STATE permission

CVSS: 4.0 CWE: CWE-285

Medium

CVE-2022-22271

A missing input validation before memory copy in TIMA trustlet prior to SMR Jan-2022 Release 1 allows attackers to copy data from arbitrary memory.

CVSS: 5.5 CWE: CWE-125

Medium

CVE-2022-22270

An implicit Intent hijacking vulnerability in Dialer prior to SMR Jan-2022 Release 1 allows unprivileged applications to access contact information.

CVSS: 4.4 CWE: CWE-94

Medium

CVE-2022-22269

Keeping sensitive data in unprotected BluetoothSettingsProvider prior to SMR Jan-2022 Release 1 allows untrusted applications to get a local Bluetooth MAC address.

CVSS: 4.0 CWE: CWE-285

Medium

CVE-2022-22268

Incorrect implementation of Knox Guard prior to SMR Jan-2022 Release 1 allows physically proximate attackers to temporary unlock the Knox Guard via Samsung DeX mode.

CVSS: 6.1 CWE: CWE-285

Medium

CVE-2022-22267

Implicit Intent hijacking vulnerability in ActivityMetricsLogger prior to SMR Jan-2022 Release 1 allows attackers to get running application information.

CVSS: 4.0 CWE: CWE-285