CVE-2022-32222

MEDIUM Year: 2022
CVSS v3 Score
5.3
Medium
Weakness Type
CWE-310
View all →

Vulnerability Description

A cryptographic vulnerability exists on Node.js on linux in versions of 18.x prior to 18.40.0 which allowed a default path for openssl.cnf that might be accessible under some circumstances to a non-admin user instead of /etc/ssl as was the case in versions prior to the upgrade to OpenSSL 3.

Related Vulnerabilities

CVE-2011-4461

MEDIUM
CVSS:5.3(Medium)

Jetty 8.1.0.RC2 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service ...

CWE-3102011

CVE-2013-5391

MEDIUM
CVSS:5.3(Medium)

IBM Worklight Consumer and Enterprise Editions 5.0.x before 5.0.6 Fix Pack 2 and 6.0.x before 6.0.0 Fix Pack 2, and Mobile Foundation Consumer and Enterprise Editions 5.0.x before 5.0.6 Fix Pack 2 and...

CWE-3102013

CVE-2016-1000339

MEDIUM
CVSS:5.3(Medium)

In the Bouncy Castle JCE Provider version 1.55 and earlier the primary engine class used for AES was AESFastEngine. Due to the highly table driven approach used in the algorithm it turns out that if t...

CWE-3102016

CVE-2016-10099

MEDIUM
CVSS:5.3(Medium)

Borg (aka BorgBackup) before 1.0.9 has a flaw in the cryptographic protocol used to authenticate the manifest (list of archives), potentially allowing an attacker to spoof the list of archives.

CWE-3102016

CVE-2016-1948

MEDIUM
CVSS:5.3(Medium)

Mozilla Firefox before 44.0 on Android does not ensure that HTTPS is used for a lightweight-theme installation, which allows man-in-the-middle attackers to replace a theme's images and colors by modif...

CWE-3102016

CVE-2016-9346

MEDIUM
CVSS:5.3(Medium)

An issue was discovered in Moxa MiiNePort E1 versions prior to 1.8, E2 versions prior to 1.4, and E3 versions prior to 1.1. Configuration data are stored in a file that is not encrypted.

CWE-3102016