CVE-2022-24xxx records
Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.
841 records · Page 5 of 9
Remote Desktop Protocol Remote Code Execution Vulnerability
UpdatedHEVC Video Extensions Remote Code Execution Vulnerability
UpdatedWindows Installer Elevation of Privilege Vulnerability
UpdatedRemote Procedure Call Runtime Remote Code Execution Vulnerability
Updated- CVE-2022-24527: Microsoft Endpoint Configuration Manager Elevation of Privilege Vulnerability 7.8 High
Microsoft Endpoint Configuration Manager Elevation of Privilege Vulnerability
Updated Visual Studio Code Spoofing Vulnerability
UpdatedWindows Update Stack Elevation of Privilege Vulnerability
UpdatedMicrosoft Edge (Chromium-based) Spoofing Vulnerability
UpdatedSkype Extension for Chrome Information Disclosure Vulnerability
UpdatedWindows Common Log File System Driver Elevation of Privilege Vulnerability
UpdatedAzure Site Recovery Remote Code Execution Vulnerability
UpdatedAzure Site Recovery Elevation of Privilege Vulnerability
UpdatedAzure Site Recovery Elevation of Privilege Vulnerability
UpdatedAzure Site Recovery Remote Code Execution Vulnerability
UpdatedMicrosoft Exchange Server Elevation of Privilege Vulnerability
UpdatedAzure Site Recovery Elevation of Privilege Vulnerability
UpdatedVisual Studio Elevation of Privilege Vulnerability
Updated.NET and Visual Studio Remote Code Execution Vulnerability
UpdatedMicrosoft Office Word Tampering Vulnerability
UpdatedMicrosoft Office Visio Remote Code Execution Vulnerability
UpdatedMicrosoft Office Visio Remote Code Execution Vulnerability
UpdatedWin32 File Enumeration Remote Code Execution Vulnerability
Updated- CVE-2022-24507: Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability 7.8 High
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
Updated Azure Site Recovery Elevation of Privilege Vulnerability
UpdatedWindows ALPC Elevation of Privilege Vulnerability
Updated- CVE-2022-24504: Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability 8.1 High
Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability
Updated Remote Desktop Protocol Client Information Disclosure Vulnerability
UpdatedWindows HTML Platforms Security Feature Bypass Vulnerability
UpdatedVP9 Video Extensions Remote Code Execution Vulnerability
UpdatedWindows SMB Remote Code Execution Vulnerability
UpdatedWindows Installer Elevation of Privilege Vulnerability
UpdatedWindows iSCSI Target Service Information Disclosure Vulnerability
UpdatedWindows Network File System Remote Code Execution Vulnerability
Updated- CVE-2022-24496: Windows Local Security Authority (LSA) Elevation of Privilege Vulnerability 7.8 High
Windows Local Security Authority (LSA) Elevation of Privilege Vulnerability
Updated Windows Direct Show Remote Code Execution Vulnerability
Updated- CVE-2022-24494: Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability 7.8 High
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
Updated - CVE-2022-24493: Microsoft Local Security Authority (LSA) Server Information Disclosure Vulnerability 5.5 Medium
Microsoft Local Security Authority (LSA) Server Information Disclosure Vulnerability
Updated Remote Procedure Call Runtime Remote Code Execution Vulnerability
UpdatedWindows Network File System Remote Code Execution Vulnerability
Updated- CVE-2022-24490: Windows Hyper-V Shared Virtual Hard Disks Information Disclosure Vulnerability 8.1 High
Windows Hyper-V Shared Virtual Hard Disks Information Disclosure Vulnerability
Updated Cluster Client Failover (CCF) Elevation of Privilege Vulnerability
UpdatedWindows Desktop Bridge Elevation of Privilege Vulnerability
UpdatedWindows Local Security Authority Subsystem Service (LSASS) Remote Code Execution Vulnerability
UpdatedWindows Kerberos Elevation of Privilege Vulnerability
UpdatedWin32 File Enumeration Remote Code Execution Vulnerability
UpdatedWindows Cluster Shared Volume (CSV) Denial of Service Vulnerability
UpdatedWindows Kernel Information Disclosure Vulnerability
UpdatedWindows ALPC Elevation of Privilege Vulnerability
UpdatedWindows Common Log File System Driver Elevation of Privilege Vulnerability
UpdatedOutlook for Android Elevation of Privilege Vulnerability
Updated- CVE-2022-24479: Connected User Experiences and Telemetry Elevation of Privilege Vulnerability 7.8 High
Connected User Experiences and Telemetry Elevation of Privilege Vulnerability
Updated Microsoft Exchange Server Elevation of Privilege Vulnerability
UpdatedMicrosoft Edge (Chromium-based) Elevation of Privilege Vulnerability
UpdatedWindows Win32k Elevation of Privilege Vulnerability
UpdatedMicrosoft Excel Remote Code Execution Vulnerability
UpdatedMicrosoft SharePoint Server Spoofing Vulnerability
UpdatedAzure Site Recovery Remote Code Execution Vulnerability
UpdatedAzure Site Recovery Remote Code Execution Vulnerability
UpdatedAzure Site Recovery Elevation of Privilege Vulnerability
UpdatedAzure Site Recovery Remote Code Execution Vulnerability
UpdatedAzure Site Recovery Remote Code Execution Vulnerability
UpdatedWindows Hyper-V Security Feature Bypass Vulnerability
UpdatedMicrosoft Intune Portal for iOS Security Feature Bypass Vulnerability
Updated.NET and Visual Studio Denial of Service Vulnerability
UpdatedMicrosoft Exchange Server Spoofing Vulnerability
UpdatedMicrosoft Word Security Feature Bypass Vulnerability
UpdatedMicrosoft Office Visio Remote Code Execution Vulnerability
Updated- CVE-2022-24460: Tablet Windows User Interface Application Elevation of Privilege Vulnerability 7.0 High
Tablet Windows User Interface Application Elevation of Privilege Vulnerability
Updated Windows Fax and Scan Service Elevation of Privilege Vulnerability
UpdatedHEIF Image Extensions Remote Code Execution Vulnerability
UpdatedHEVC Video Extensions Remote Code Execution Vulnerability
UpdatedWindows CD-ROM Driver Elevation of Privilege Vulnerability
Updated- CVE-2022-24454: Windows Security Support Provider Interface Elevation of Privilege Vulnerability 7.8 High
Windows Security Support Provider Interface Elevation of Privilege Vulnerability
Updated HEVC Video Extensions Remote Code Execution Vulnerability
UpdatedHEVC Video Extensions Remote Code Execution Vulnerability
UpdatedVP9 Video Extensions Remote Code Execution Vulnerability
UpdatedNATS nats-server before 2.7.2 has Incorrect Access Control. Any authenticated user can obtain the privileges of the System account by misusing the "dynamically provisioned sandbox accounts" feature.
UpdatedSolar appScreener through 3.10.4, when a valid license is not present, allows XXE and SSRF attacks via a crafted XML document.
UpdatedAn issue was discovered in fs/nfs/dir.c in the Linux kernel before 5.16.5. If an application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a regular file is found, ENOTDIR should occur, but the server instead returns uninitialized data in the file descriptor.
UpdatedAn issue was discovered in Zoho ManageEngine Key Manager Plus before 6200. A service exposed by the application allows a user, with the level Operator, to access stored SSL certificates and associated key pairs during export.
UpdatedAn issue was discovered in Zoho ManageEngine Key Manager Plus 6.1.6. A user, with the level Operator, can see all SSH servers (and user information) even if no SSH server or user is associated to the operator.
UpdatedDO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
Updated · Rejected recordSilverstripe silverstripe/framework through 4.10 allows Session Fixation.
UpdatedJetBrains YouTrack before 2021.4.40426 was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates.
Updated- CVE-2022-24441: Code Injection 5.8 Medium
The package snyk before 1.1064.0 are vulnerable to Code Injection when analyzing a project. An attacker who can convince a user to scan a malicious project can include commands in a build file such as build.gradle or gradle-wrapper.jar, which will be executed with the privileges of the application. This vulnerability may be triggered when running the the CLI tool directly, or when running a scan w
Updated - CVE-2022-24440: Command Injection 8.1 High
The package cocoapods-downloader before 1.6.0, from 1.6.2 and before 1.6.3 are vulnerable to Command Injection via git argument injection. When calling the Pod::Downloader.preprocess_options function and using git, both the git and branch parameters are passed to the git ls-remote subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection.
Updated All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to git without sufficient sanitization of input arguments.
Updated- CVE-2022-24437: Command Injection 9.8 Critical
The package git-pull-or-clone before 2.0.2 are vulnerable to Command Injection due to the use of the --upload-pack feature of git which is also supported for git clone. The source includes the use of the secure child process API spawn(). However, the outpath parameter passed to it may be a command-line argument to the git clone command and result in arbitrary command injection.
Updated Observable behavioral in power management throttling for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via network access.
UpdatedCross-site scripting vulnerability in phpUploader v1.2 and earlier allows a remote unauthenticated attacker to inject an arbitrary script via unspecified vectors.
UpdatedThis affects all versions of package dicer. A malicious attacker can send a modified form to server, and crash the nodejs service. An attacker could sent the payload again and again so that the service continuously crashes.
Updated- CVE-2022-24433: Command Injection 8.1 High
The package simple-git before 3.3.0 are vulnerable to Command Injection via argument injection. When calling the .fetch(remote, branch, handlerFn) function, both the remote and branch parameters are passed to the git fetch subcommand. By injecting some git options it was possible to get arbitrary command execution.
Updated - CVE-2022-24432: ICSA-22-062-01 IPCOMM ipDIO 5.5 Medium
Persistent cross-site scripting (XSS) in the web interface of ipDIO allows an authenticated remote attacker to introduce arbitrary JavaScript by injecting an XSS payload into specific fields. The XSS payload will be executed when a legitimate user attempts to upload, copy, download, or delete an existing configuration (Administrative Services).
Updated - CVE-2022-24431: Command Injection 7.4 High
All versions of package abacus-ext-cmdline are vulnerable to Command Injection via the execute function due to improper user-input sanitization.
Updated The package convert-svg-core before 0.6.3 are vulnerable to Arbitrary Code Injection when using a specially crafted SVG file. An attacker can read arbitrary files from the file system and then show the file content as a converted PNG file.
UpdatedDell PowerScale OneFS, versions 8.2.x, 9.0.0.x, 9.1.0.x, 9.2.0.x, 9.2.1.x, and 9.3.0.x, contain an improper preservation of privileges. A remote filesystem user with a local account could potentially exploit this vulnerability, leading to an escalation of file privileges and information disclosure.
UpdatedDO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none.
Updated · Rejected recordDell Command | Update, Dell Update, and Alienware Update version 4.4.0 contains a Local Privilege Escalation Vulnerability in the Advanced Driver Restore component. A local malicious user could potentially exploit this vulnerability, leading to privilege escalation.
UpdatedDO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none.
Updated · Rejected recordDell EMC AppSync versions from 3.9 to 4.3 contain a path traversal vulnerability in AppSync server. A remote unauthenticated attacker may potentially exploit this vulnerability to gain unauthorized read access to the files stored on the server filesystem, with the privileges of the running web application.
Updated