CVE-2022-21xxx records
Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.
845 records · Page 2 of 9
- CVE-2022-21890: Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability 7.5 High
Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability
Updated - CVE-2022-21889: Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability 7.5 High
Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability
Updated Windows Modern Execution Server Remote Code Execution Vulnerability
UpdatedWin32k Elevation of Privilege Vulnerability
Updated- CVE-2022-21885: Windows Remote Access Connection Manager Elevation of Privilege Vulnerability 7.8 High
Windows Remote Access Connection Manager Elevation of Privilege Vulnerability
Updated - CVE-2022-21884: Local Security Authority Subsystem Service Elevation of Privilege Vulnerability 7.8 High
Local Security Authority Subsystem Service Elevation of Privilege Vulnerability
Updated - CVE-2022-21883: Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability 7.5 High
Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability
Updated Win32k Elevation of Privilege Vulnerability
UpdatedWindows Kernel Elevation of Privilege Vulnerability
UpdatedWindows GDI+ Information Disclosure Vulnerability
UpdatedWindows Kernel Elevation of Privilege Vulnerability
UpdatedWindows Geolocation Service Remote Code Execution Vulnerability
UpdatedStorage Spaces Controller Information Disclosure Vulnerability
UpdatedWin32k Information Disclosure Vulnerability
UpdatedWindows Storage Elevation of Privilege Vulnerability
UpdatedWindows Security Center API Remote Code Execution Vulnerability
UpdatedTile Data Repository Elevation of Privilege Vulnerability
UpdatedWindows Event Tracing Elevation of Privilege Vulnerability
UpdatedMicrosoft Diagnostics Hub Standard Collector Runtime Elevation of Privilege Vulnerability
Updated- CVE-2022-21870: Tablet Windows User Interface Application Core Elevation of Privilege Vulnerability 7.0 High
Tablet Windows User Interface Application Core Elevation of Privilege Vulnerability
Updated Clipboard User Service Elevation of Privilege Vulnerability
UpdatedWindows Devices Human Interface Elevation of Privilege Vulnerability
UpdatedWindows Push Notifications Apps Elevation of Privilege Vulnerability
UpdatedWindows System Launcher Elevation of Privilege Vulnerability
UpdatedConnected Devices Platform Service Elevation of Privilege Vulnerability
UpdatedWindows UI Immersive Server API Elevation of Privilege Vulnerability
Updated- CVE-2022-21863: Windows StateRepository API Server file Elevation of Privilege Vulnerability 7.0 High
Windows StateRepository API Server file Elevation of Privilege Vulnerability
Updated Windows Application Model Core API Elevation of Privilege Vulnerability
UpdatedTask Flow Data Engine Elevation of Privilege Vulnerability
UpdatedWindows AppContracts API Server Elevation of Privilege Vulnerability
UpdatedWindows Accounts Control Elevation of Privilege Vulnerability
UpdatedWindows Bind Filter Driver Elevation of Privilege Vulnerability
UpdatedActive Directory Domain Services Elevation of Privilege Vulnerability
UpdatedMicrosoft Exchange Server Remote Code Execution Vulnerability
UpdatedWindows DWM Core Library Elevation of Privilege Vulnerability
UpdatedRemote Desktop Client Remote Code Execution Vulnerability
UpdatedRemote Desktop Client Remote Code Execution Vulnerability
Updated- CVE-2022-21849: Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability 9.8 Critical
Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability
Updated - CVE-2022-21848: Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability 7.5 High
Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability
Updated Windows Hyper-V Denial of Service Vulnerability
UpdatedMicrosoft Exchange Server Remote Code Execution Vulnerability
UpdatedWindows Kernel Information Disclosure Vulnerability
UpdatedHEVC Video Extensions Remote Code Execution Vulnerability
UpdatedWindows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability
UpdatedMicrosoft Word Remote Code Execution Vulnerability
UpdatedMicrosoft Excel Remote Code Execution Vulnerability
UpdatedMicrosoft Office Remote Code Execution Vulnerability
UpdatedWindows Event Tracing Discretionary Access Control List Denial of Service Vulnerability
UpdatedWindows Cleanup Manager Elevation of Privilege Vulnerability
UpdatedMicrosoft SharePoint Server Remote Code Execution Vulnerability
UpdatedWindows Certificate Spoofing Vulnerability
UpdatedMicrosoft Cryptographic Services Elevation of Privilege Vulnerability
UpdatedWindows User-mode Driver Framework Reflector Driver Elevation of Privilege Vulnerability
UpdatedVirtual Machine IDE Drive Elevation of Privilege Vulnerability
UpdatedA code injection vulnerability exists in the Active Storage >= v5.2.0 that could allow an attacker to execute code via image_processing arguments.
UpdatedA blind self XSS vulnerability exists in RocketChat LiveChat <v1.9 that could allow an attacker to trick a victim pasting malicious code in their chat instance.
UpdatedConcrete CMS Versions 9.0.0 through 9.0.2 and 8.5.7 and below can download zip files over HTTP and execute code from those zip files which could lead to an RCE. Fixed by enforcing ‘concrete_secure’ instead of ‘concrete’. Concrete now only makes requests over https even a request comes in via http. Concrete CMS security team ranked this 8 with CVSS v3.1 vector: AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H C
UpdatedA user with high privilege access to the Incapptic Connect web console can remotely execute code on the Incapptic Connect server using a unspecified attack vector in Incapptic Connect version 1.40.0, 1.39.1, 1.39.0, 1.38.1, 1.38.0, 1.37.1, 1.37.0, 1.36.0, 1.35.5, 1.35.4 and 1.35.3.
UpdatedAn improper privilege vulnerability has been discovered in Citrix Gateway Plug-in for Windows (Citrix Secure Access for Windows) <21.9.1.2 what could allow an attacker who has gained local access to a computer with Citrix Gateway Plug-in installed, to corrupt or delete files as SYSTEM.
UpdatedPulse Secure version 9.115 and below may be susceptible to client-side http request smuggling, When the application receives a POST request, it ignores the request's Content-Length header and leaves the POST body on the TCP/TLS socket. This body ends up prefixing the next HTTP request sent down that connection, this means when someone loads website attacker may be able to make browser issue a POST
UpdatedAn Improper Access Control vulnerability exists in Citrix Workspace App for Linux 2012 - 2111 with App Protection installed that can allow an attacker to perform local privilege escalation.
UpdatedDue to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be "__proto__". The prototype pollution has very limited control, in that it only allows an empty string to be assigned to numerical keys of
UpdatedA insecure storage of sensitive information vulnerability exists in Ivanti Workspace Control <2021.2 (10.7.30.0) that could allow an attacker with locally authenticated low privileges to obtain key information due to an unspecified attack vector.
UpdatedNVIDIA FLARE contains a vulnerability in the admin interface, where an un-authorized attacker can cause Allocation of Resources Without Limits or Throttling, which may lead to cause system unavailable.
UpdatedNVIDIA CUDA Toolkit SDK contains an integer overflow vulnerability in cuobjdump.To exploit this vulnerability, a remote attacker would require a local user to download a specially crafted, corrupted file and locally execute cuobjdump against the file. Such an attack may lead to remote code execution that causes complete denial of service and an impact on data confidentiality and integrity.
UpdatedNVIDIA DCGM contains a vulnerability in nvhostengine, where a network user can cause detection of error conditions without action, which may lead to limited code execution, some denial of service, escalation of privileges, and limited impacts to both data confidentiality and integrity.
UpdatedNVIDIA distributions of Jetson Linux contain a vulnerability where an error in the IOMMU configuration may allow an unprivileged attacker with physical access to the board direct read/write access to the entire system address space through the PCI bus. Such an attack could result in denial of service, code execution, escalation of privileges, and impact to data integrity and confidentiality. The s
UpdatedNVIDIA License System contains a vulnerability in the installation scripts for the DLS virtual appliance, where a user on a network after signing in to the portal can access other users’ credentials, allowing them to gain escalated privileges, resulting in limited impact to both confidentiality and integrity.
UpdatedNVIDIA Omniverse Launcher contains a Cross-Origin Resource Sharing (CORS) vulnerability which can allow an unprivileged remote attacker, if they can get user to browse malicious site, to acquire access tokens allowing them to access resources in other security domains, which may lead to code execution, escalation of privileges, and impact to confidentiality and integrity.
UpdatedNVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (nvidia.ko), where a user in the guest OS can cause a GPU interrupt storm on the hypervisor host, leading to a denial of service.
UpdatedNVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for private IOCTLs where a NULL pointer dereference in the kernel, created within user mode code, may lead to a denial of service in the form of a system crash.
UpdatedNVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel driver package, where improper handling of insufficient permissions or privileges may allow an unprivileged local user limited write access to protected memory, which can lead to denial of service.
UpdatedNVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel driver, where improper handling of insufficient permissions or privileges may allow an unprivileged local user limited write access to protected memory, which can lead to denial of service.
UpdatedImproper access control in the Intel(R) HAXM software before version 7.7.1 may allow an authenticated user to potentially enable escalation of privilege via local access.
UpdatedAll versions of the package smartctl are vulnerable to Command Injection via the info method due to improper input sanitization.
UpdatedA file write vulnerability exists in the httpd upload.cgi functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted HTTP request can lead to arbitrary file upload. An attacker can upload a malicious file to trigger this vulnerability.
UpdatedPath traversal vulnerability exists in CAMS for HIS Server contained in the following Yokogawa Electric products: CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20, and from R6.01.00 to R6.08.00, Exaopc versions from R3.72.00 to R3.79.00.
UpdatedUncontrolled search path elements in the Intel(R) VTune(TM) Profiler software before version 2022.2.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
UpdatedA use-after-free vulnerability exists in the mips_collector appsrv_server functionality of Anker Eufy Homebase 2 2.1.8.5h. A specially-crafted set of network packets can lead to remote code execution. The device is exposed to attacks from the network.
UpdatedReflected cross-site scripting vulnerability in the attached file name of php_mailform versions prior to Version 1.40 allows a remote unauthenticated attacker to inject an arbitrary script via unspecified vectors.
UpdatedOut-of-bounds write in software for the Intel QAT Driver for Windows before version 1.9.0-0008 may allow an authenticated user to potentially enable escalation of privilege via local access.
Updated- CVE-2022-21803: Prototype Pollution 7.3 High
This affects the package nconf before 0.11.4. When using the memory engine, it is possible to store a nested JSON representation of the configuration. The .set() function, that is responsible for setting the configuration properties, is vulnerable to Prototype Pollution. By providing a crafted property, it is possible to modify the properties on the Object.prototype.
Updated - CVE-2022-21802: Cross-site Scripting (XSS) 5.4 Medium
The package grapesjs before 0.19.5 are vulnerable to Cross-site Scripting (XSS) due to an improper sanitization of the class name in Selector Manager.
Updated A denial of service vulnerability exists in the netserver recv_command functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted network request can lead to a reboot. An attacker can send a malicious packet to trigger this vulnerability.
UpdatedMMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 uses the MD5 algorithm to hash the passwords before storing them but does not salt the hash. As a result, attackers may be able to crack the hashed passwords.
UpdatedCross-site scripting vulnerability in ELECOM LAN router WRC-300FEBK-R firmware v1.13 and earlier allows an attacker on the adjacent network to inject an arbitrary script via unspecified vectors.
UpdatedThe affected product is vulnerable due to cleartext transmission of credentials seen in the CIMPLICITY network, which can be easily spoofed and used to log in to make operational changes to the system.
UpdatedThe package joblib from 0 and before 1.2.0 are vulnerable to Arbitrary Code Execution via the pre_dispatch flag in Parallel() class due to the eval() statement.
UpdatedA memory corruption vulnerability exists in the netserver parse_command_list functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to an out-of-bounds write. An attacker can send an HTTP request to trigger this vulnerability.
UpdatedThis CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused
Updated · Rejected recordImproper authentication in BIOS firmware for some Intel(R) NUC Boards, Intel(R) NUC Business, Intel(R) NUC Enthusiast, Intel(R) NUC Kits before version HN0067 may allow a privileged user to potentially enable escalation of privilege via local access.
UpdatedInsufficient control flow management in the Intel(R) Ethernet 500 Series Controller drivers for VMWare before version 1.11.4.0 and in the Intel(R) Ethernet 700 Series Controller drivers for VMWare before version 2.1.5.0 may allow an authenticated user to potentially enable a denial of service via local access.
UpdatedIn camera isp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07085410; Issue ID: ALPS07085410.
UpdatedIn camera isp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06478059; Issue ID: ALPS06478059.
UpdatedIn camera isp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06479306; Issue ID: ALPS06479306.
UpdatedIn audio ipi, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06478101; Issue ID: ALPS06478101.
UpdatedIn scp, there is a possible undefined behavior due to incorrect error handling. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06988728; Issue ID: ALPS06988728.
UpdatedIn audio DSP, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06558844; Issue ID: ALPS06558844.
UpdatedIn audio DSP, there is a possible memory corruption due to improper casting. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06558822; Issue ID: ALPS06558822.
UpdatedIn WLAN driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06807363; Issue ID: ALPS06807363.
Updated