Total
424021 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2022-24351 | 1 Insyde | 1 Insydeh2o | 2026-06-17 | N/A | 4.7 MEDIUM |
| TOCTOU race-condition vulnerability in Insyde InsydeH2O with Kernel 5.2 before version 05.27.29, Kernel 5.3 before version 05.36.29, Kernel 5.4 version before 05.44.13, and Kernel 5.5 before version 05.52.13 allows an attacker to alter data and code used by the remainder of the boot process. | |||||
| CVE-2022-24350 | 1 Insyde | 1 Insydeh2o | 2026-06-17 | N/A | 5.5 MEDIUM |
| An issue was discovered in IhisiSmm in Insyde InsydeH2O with kernel 5.0 through 5.5. IHISI function 0x17 verifies that the output buffer lies within the command buffer but does not verify that output data does not go beyond the end of the command buffer. In particular, the GetFlashTable function is called directly on the Command Buffer before the DataSize is check, leading to possible circumstances where the data immediately following the command buffer could be destroyed before returning a buffer size error. | |||||
| CVE-2022-24349 | 3 Debian, Fedoraproject, Zabbix | 3 Debian Linux, Fedora, Frontend | 2026-06-17 | 2.1 LOW | 4.6 MEDIUM |
| An authenticated user can create a link with reflected XSS payload for actions’ pages, and send it to other users. Malicious code has access to all the same objects as the rest of the web page and can make arbitrary modifications to the contents of the page being displayed to a victim. This attack can be implemented with the help of social engineering and expiration of a number of factors - an attacker should have authorized access to the Zabbix Frontend and allowed network connection between a malicious server and victim’s computer, understand attacked infrastructure, be recognized by the victim as a trustee and use trusted communication channel. | |||||
| CVE-2022-24348 | 1 Argoproj | 1 Argo Cd | 2026-06-17 | 4.0 MEDIUM | 7.7 HIGH |
| Argo CD before 2.1.9 and 2.2.x before 2.2.4 allows directory traversal related to Helm charts because of an error in helmTemplate in repository.go. For example, an attacker may be able to discover credentials stored in a YAML file. | |||||
| CVE-2022-24347 | 1 Jetbrains | 1 Youtrack | 2026-06-17 | 3.5 LOW | 5.4 MEDIUM |
| JetBrains YouTrack before 2021.4.36872 was vulnerable to stored XSS via a project icon. | |||||
| CVE-2022-24346 | 1 Jetbrains | 1 Intellij Idea | 2026-06-17 | 4.6 MEDIUM | 7.8 HIGH |
| In JetBrains IntelliJ IDEA before 2021.3.1, local code execution via RLO (Right-to-Left Override) characters was possible. | |||||
| CVE-2022-24345 | 1 Jetbrains | 1 Intellij Idea | 2026-06-17 | 4.6 MEDIUM | 7.8 HIGH |
| In JetBrains IntelliJ IDEA before 2021.2.4, local code execution (without permission from a user) upon opening a project was possible. | |||||
| CVE-2022-24344 | 1 Jetbrains | 1 Youtrack | 2026-06-17 | 3.5 LOW | 5.4 MEDIUM |
| JetBrains YouTrack before 2021.4.31698 was vulnerable to stored XSS on the Notification templates page. | |||||
| CVE-2022-24343 | 1 Jetbrains | 1 Youtrack | 2026-06-17 | 4.0 MEDIUM | 4.3 MEDIUM |
| In JetBrains YouTrack before 2021.4.31698, a custom logo could be set by a user who has read-only permissions. | |||||
| CVE-2022-24342 | 1 Jetbrains | 1 Teamcity | 2026-06-17 | 6.8 MEDIUM | 8.8 HIGH |
| In JetBrains TeamCity before 2021.2.1, URL injection leading to CSRF was possible. | |||||
| CVE-2022-24341 | 1 Jetbrains | 1 Teamcity | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| In JetBrains TeamCity before 2021.2.1, editing a user account to change its password didn't terminate sessions of the edited user. | |||||
| CVE-2022-24340 | 1 Jetbrains | 1 Teamcity | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| In JetBrains TeamCity before 2021.2.1, XXE during the parsing of the configuration file was possible. | |||||
| CVE-2022-24339 | 1 Jetbrains | 1 Teamcity | 2026-06-17 | 3.5 LOW | 5.4 MEDIUM |
| JetBrains TeamCity before 2021.2.1 was vulnerable to stored XSS. | |||||
| CVE-2022-24338 | 1 Jetbrains | 1 Teamcity | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| JetBrains TeamCity before 2021.2.1 was vulnerable to reflected XSS. | |||||
| CVE-2022-24337 | 1 Jetbrains | 1 Teamcity | 2026-06-17 | 4.0 MEDIUM | 6.5 MEDIUM |
| In JetBrains TeamCity before 2021.2, health items of pull requests were shown to users who lacked appropriate permissions. | |||||
| CVE-2022-24336 | 1 Jetbrains | 1 Teamcity | 2026-06-17 | 5.0 MEDIUM | 5.3 MEDIUM |
| In JetBrains TeamCity before 2021.2.1, an unauthenticated attacker can cancel running builds via an XML-RPC request to the TeamCity server. | |||||
| CVE-2022-24335 | 1 Jetbrains | 1 Teamcity | 2026-06-17 | 6.8 MEDIUM | 8.1 HIGH |
| JetBrains TeamCity before 2021.2 was vulnerable to a Time-of-check/Time-of-use (TOCTOU) race-condition attack in agent registration via XML-RPC. | |||||
| CVE-2022-24334 | 1 Jetbrains | 1 Teamcity | 2026-06-17 | 5.0 MEDIUM | 5.3 MEDIUM |
| In JetBrains TeamCity before 2021.2.1, the Agent Push feature allowed selection of any private key on the server. | |||||
| CVE-2022-24333 | 1 Jetbrains | 1 Teamcity | 2026-06-17 | 4.0 MEDIUM | 6.5 MEDIUM |
| In JetBrains TeamCity before 2021.2, blind SSRF via an XML-RPC call was possible. | |||||
| CVE-2022-24332 | 1 Jetbrains | 1 Teamcity | 2026-06-17 | 5.0 MEDIUM | 5.3 MEDIUM |
| In JetBrains TeamCity before 2021.2, a logout action didn't remove a Remember Me cookie. | |||||