CVE-2022-0673

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A flaw was found in LemMinX in versions prior to 0.19.0. Cache poisoning of external schema files due to directory traversal.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
Feb 18, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-06744.8The Kunze Law WordPress plugin before 2.1 does not escape its 'E-Mail Error "From" Address' settings, allowing high privilege users such as CVE-2022-06759.8In certain situations it is possible for an unmanaged rule to exist on the target system that has the same comment as the rule specified in CVE-2022-06767.8Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.6.4.CVE-2022-06777.5Improper Handling of Length Parameter Inconsistency vulnerability in the Update Server component of Bitdefender Endpoint Security Tools (in CVE-2022-06786.1Cross-site Scripting (XSS) - Reflected in Packagist microweber/microweber prior to 1.2.11.CVE-2022-06799.8The Narnoo Distributor WordPress plugin through 2.5.1 fails to validate and sanitize the lib_path parameter before it is passed into a call CVE-2022-06806.1The Plezi WordPress plugin before 1.0.3 has a REST endpoint allowing unauthenticated users to update the plz_configuration_tracker_enable opCVE-2022-06816.5The Simple Membership WordPress plugin before 4.1.0 does not have CSRF check in place when deleting Transactions, which could allow attackerCVE-2022-06836.1The Essential Addons for Elementor Lite WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitizationCVE-2022-06844.8The WP Home Page Menu WordPress plugin before 3.1 does not sanitise and escape its settings, allowing high privilege users such as admin to CVE-2022-06857.8Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4418.CVE-2022-06869.1Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.8.