CVE-2022-0671

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

A flaw was found in vscode-xml in versions prior to 0.19.0. Schema download could lead to blind SSRF or DoS via a large file.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-918CWE-400

Affected software

No affected versions have been published.

Timeline

Published
Feb 18, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-06725.5A flaw was found in LemMinX in versions prior to 0.19.0. Insecure redirect could allow unauthorized access to sensitive information locally CVE-2022-06736.5A flaw was found in LemMinX in versions prior to 0.19.0. Cache poisoning of external schema files due to directory traversal.CVE-2022-06744.8The Kunze Law WordPress plugin before 2.1 does not escape its 'E-Mail Error "From" Address' settings, allowing high privilege users such as CVE-2022-06759.8In certain situations it is possible for an unmanaged rule to exist on the target system that has the same comment as the rule specified in CVE-2022-06767.8Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.6.4.CVE-2022-06777.5Improper Handling of Length Parameter Inconsistency vulnerability in the Update Server component of Bitdefender Endpoint Security Tools (in CVE-2022-06786.1Cross-site Scripting (XSS) - Reflected in Packagist microweber/microweber prior to 1.2.11.CVE-2022-06799.8The Narnoo Distributor WordPress plugin through 2.5.1 fails to validate and sanitize the lib_path parameter before it is passed into a call CVE-2022-06806.1The Plezi WordPress plugin before 1.0.3 has a REST endpoint allowing unauthenticated users to update the plz_configuration_tracker_enable opCVE-2022-06816.5The Simple Membership WordPress plugin before 4.1.0 does not have CSRF check in place when deleting Transactions, which could allow attackerCVE-2022-06836.1The Essential Addons for Elementor Lite WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitizationCVE-2022-06844.8The WP Home Page Menu WordPress plugin before 3.1 does not sanitise and escape its settings, allowing high privilege users such as admin to
CVE-2022-0671: Critical severity, CVSS 9.1 | Vulnix