CVE-2022-41704

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A vulnerability in Batik of Apache XML Graphics allows an attacker to run untrusted Java code from an SVG. This issue affects Apache XML Graphics prior to 1.16. It is recommended to update to version 1.16.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published
Oct 25, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-417059.8Badaso version 2.6.3 allows an unauthenticated remote attacker to execute arbitrary code remotely on the server. This is possible because thCVE-2022-417068.2Browsershot version 3.57.2 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application doCVE-2022-417076.5Relatedcode's Messenger version 7bcd20b allows an authenticated external attacker to access sensitive data of any user of the application. TCVE-2022-417084.3Relatedcode's Messenger version 7bcd20b allows an authenticated external attacker to access existing chats in the workspaces of any user of CVE-2022-417097.8Markdownify version 1.4.1 allows an external attacker to execute arbitrary code remotely on any client attempting to view a malicious markdoCVE-2022-41717.5The demon image annotation plugin for WordPress is vulnerable to improper input validation in versions up to, and including 5.0. This is dueCVE-2022-417105.5Markdownify version 1.4.1 allows an external attacker to remotely obtain arbitrary local files on any client that attempts to view a malicioCVE-2022-417119.8Badaso version 2.6.0 allows an unauthenticated remote attacker to execute arbitrary code remotely on the server. This is possible because thCVE-2022-417126.5Frappe version 14.10.0 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does nCVE-2022-417135.3deep-object-diff version 1.1.0 allows an external attacker to edit or add new properties to an object. This is possible because the applicatCVE-2022-417145.3fastest-json-copy version 1.0.1 allows an external attacker to edit or add new properties to an object. This is possible because the applicaCVE-2022-417157.5Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed re