CVE-2022-21220

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Improper restriction of XML external entity for Intel(R) Quartus(R) Prime Pro Edition before version 21.3 may allow an authenticated user to potentially enable escalation of privilege via local access.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-611

Affected software

No affected versions have been published.

Timeline

Published
Feb 9, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-212217.5The package github.com/valyala/fasthttp before 1.34.0 are vulnerable to Directory Traversal via the ServeFile function, due to improper saniCVE-2022-212227.5The package css-what before 2.1.3 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of insecure regular expresCVE-2022-212239.8The package cocoapods-downloader before 1.6.2 are vulnerable to Command Injection via hg argument injection. When calling the download functCVE-2022-212258.0Improper neutralization in the Intel(R) Data Center Manager software before version 4.1 may allow an authenticated user to potentially enablCVE-2022-212265.5Out-of-bounds read in the Intel(R) Trace Analyzer and Collector before version 2021.5 may allow an authenticated user to potentially enable CVE-2022-212277.5The package sqlite3 before 5.0.3 are vulnerable to Denial of Service (DoS) which will invoke the toString function of the passed parameter. CVE-2022-212287.8The affected product is vulnerable to a stack-based buffer overflow, which may allow an attacker to execute arbitrary code.CVE-2022-212297.8Improper buffer restrictions for some Intel(R) NUC 9 Extreme Laptop Kit drivers before version 2.2.0.22 may allow an authenticated user to pCVE-2022-21234.3The WP Opt-in WordPress plugin through 1.4.1 is vulnerable to CSRF which allows changed plugin settings and can be used for sending spam emaCVE-2022-212305.5This affects all versions of package org.nanohttpd:nanohttpd. Whenever an HTTP Session is parsing the body of an HTTP request, the body of tCVE-2022-212319.8All versions of package deep-get-set are vulnerable to Prototype Pollution via the 'deep' function. **Note:** This vulnerability derives froCVE-2022-212335.5Improper isolation of shared resources in some Intel(R) Processors may allow a privileged user to potentially enable information disclosure