Vulnetix
Try Vulnetix Request Demo
Apple Security Advisories · April 2022 — Apple Security Advisories
12 advisories 12 CVEs 3 EXPLOITED

Apple-vendor CVEs for 2022-04. Mirrored into Vulnetix VDB.

Every advisory below is enriched with the Vulnetix VDB exploit-intelligence chip (hover a CVE ID in the interactive page to see CVSS, EPSS, KEV status, and PoC maturity). 3 are already weaponised in the wild — see the Exploited section.

Back to archive Open Console

What would you fix first?

The advisories below are ordered by the Vulnetix risk prioritization strategy: exploitation evidence first, scores second. On the interactive page you can switch to three other lenses.

How Vulnetix ranks risk Get a free API key

Advisories

CVE-2022-22675

iPadOSExploitedCISA KEV listedHIGH2022-04-01

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in tvOS 15.5, watchOS 8.6, macOS Big Sur 11.6.6, macOS Monterey 12.3.1, iOS 15.4.1 and iPadOS 15.4.1. An application may be able to execute arbitrary code wit...

CVEs:CVE-2022-22675

Affected products

ProductStatusVendorPackageEcosystem
ipados affected apple — —
iphone_os affected apple — —
macos affected apple — —
tvos affected apple — —
watchos affected apple — —
Upstream advisory

CVE-2022-29048

OtherExploitedCISA KEV listedMEDIUM2022-04-12

A cross-site request forgery (CSRF) vulnerability in Jenkins Subversion Plugin 2.15.3 and earlier allows attackers to connect to an attacker-specified URL.

CVEs:CVE-2022-29048

Affected products

ProductStatusVendorPackageEcosystem
macos affected apple — —
Upstream advisory

CVE-2022-22674

macOSExploitedCISA KEV listedMEDIUM2022-04-01

An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed with improved input validation. This issue is fixed in macOS Monterey 12.3.1, Security Update 2022-004 Catalina, macOS Big Sur 11.6.6. A local user may ...

CVEs:CVE-2022-22674

Affected products

ProductStatusVendorPackageEcosystem
macos affected apple — —
mac_os_x affected apple — —
Upstream advisory

CVE-2022-1381

OtherActive exploitation (sightings)CRITICAL2022-04-17

global heap buffer overflow in skip_range in GitHub repository vim/vim prior to 8.2.4763. This vulnerability is capable of crashing software, Bypass Protection Mechanism, Modify Memory, and possible remote execution

CVEs:CVE-2022-1381

Affected products

ProductStatusVendorPackageEcosystem
macos affected apple — —
Upstream advisory

CVE-2022-24070

OtherPoC exploitCRITICAL2022-04-12

Subversion's mod_dav_svn is vulnerable to memory corruption. While looking up path-based authorization rules, mod_dav_svn servers may attempt to use memory which has already been freed. Affected Subversion mod_dav_svn servers 1.10.0 through 1.14.1 (inc...

CVEs:CVE-2022-24070

Affected products

ProductStatusVendorPackageEcosystem
macos affected apple — —
Upstream advisory

CVE-2022-28739

OtherPoC exploitHIGH2022-04-12

There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x before 3.1.2. It occurs in String-to-Float conversion, including Kernel#Float and String#to_f.

CVEs:CVE-2022-28739

Affected products

ProductStatusVendorPackageEcosystem
macos affected apple — —
Upstream advisory

CVE-2022-24836

OtherPoC exploitCRITICAL2022-04-11

Nokogiri is an open source XML and HTML library for Ruby. Nokogiri `< v1.13.4` contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to detect encoding in HTML documents. Users are advised to upgrade t...

CVEs:CVE-2022-24836

Affected products

ProductStatusVendorPackageEcosystem
macos affected apple — —
Upstream advisory

CVE-2021-28544

OtherPoC exploitMEDIUM2022-04-12

Apache Subversion SVN authz protected copyfrom paths regression Subversion servers reveal 'copyfrom' paths that should be hidden according to configured path-based authorization (authz) rules. When a node has been copied from a protected location, user...

CVEs:CVE-2021-28544

Affected products

ProductStatusVendorPackageEcosystem
macos affected apple — —
Upstream advisory

CVE-2022-29046

OtherPoC exploitCRITICAL2022-04-12

Jenkins Subversion Plugin 2.15.3 and earlier does not escape the name and description of List Subversion tags (and more) parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers ...

CVEs:CVE-2022-29046

Affected products

ProductStatusVendorPackageEcosystem
macos affected apple — —
Upstream advisory

CVE-2022-1420

OtherPoC exploitMEDIUM2022-04-21

Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4774.

CVEs:CVE-2022-1420

Affected products

ProductStatusVendorPackageEcosystem
macos affected apple — —
Upstream advisory

CVE-2022-29458

OtherPoC exploitHIGH2022-04-18

ncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings in tinfo/read_entry.c in the terminfo library.

CVEs:CVE-2022-29458

Affected products

ProductStatusVendorPackageEcosystem
macos affected apple — —
Upstream advisory

CVE-2022-24765

OtherCoalition ESS < 30%HIGH2022-04-12

Git for Windows is a fork of Git containing Windows-specific patches. This vulnerability affects users working on multi-user machines, where untrusted parties have write access to the same hard disk. Those untrusted parties could create the folder `C:\...

CVEs:CVE-2022-24765

Affected products

ProductStatusVendorPackageEcosystem
xcode affected apple — —
Upstream advisory

Need live exploit intelligence?

Every CVE above is indexed in the Vulnetix VDB with KEV, EPSS, and PoC maturity. The interactive page surfaces that on hover.

All months Open Console