CVE-2022-37xxx records
Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.
541 records · Page 1 of 6
- CVE-2022-37999: Windows Group Policy Preference Client Elevation of Privilege Vulnerability 7.8 High
Windows Group Policy Preference Client Elevation of Privilege Vulnerability
Updated Windows Local Session Manager (LSM) Denial of Service Vulnerability
UpdatedWindows Graphics Component Elevation of Privilege Vulnerability
UpdatedWindows Kernel Memory Information Disclosure Vulnerability
UpdatedWindows Kernel Elevation of Privilege Vulnerability
Updated- CVE-2022-37994: Windows Group Policy Preference Client Elevation of Privilege Vulnerability 7.8 High
Windows Group Policy Preference Client Elevation of Privilege Vulnerability
Updated - CVE-2022-37993: Windows Group Policy Preference Client Elevation of Privilege Vulnerability 7.8 High
Windows Group Policy Preference Client Elevation of Privilege Vulnerability
Updated Windows Group Policy Elevation of Privilege Vulnerability
UpdatedWindows Kernel Elevation of Privilege Vulnerability
UpdatedWindows Kernel Elevation of Privilege Vulnerability
UpdatedWindows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege Vulnerability
UpdatedWindows Kernel Elevation of Privilege Vulnerability
UpdatedWindows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege Vulnerability
UpdatedWindows Win32k Elevation of Privilege Vulnerability
UpdatedWindows Graphics Component Information Disclosure Vulnerability
UpdatedWindows WLAN Service Elevation of Privilege Vulnerability
UpdatedMicrosoft DWM Core Library Elevation of Privilege Vulnerability
Updated- CVE-2022-37982: Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability 8.8 High
Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
Updated Windows Event Logging Service Denial of Service Vulnerability
UpdatedWindows DHCP Client Elevation of Privilege Vulnerability
UpdatedWindows Hyper-V Elevation of Privilege Vulnerability
UpdatedWindows Active Directory Certificate Services Security Feature Bypass
Updated- CVE-2022-37977: Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability 6.5 Medium
Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability
Updated Active Directory Certificate Services Elevation of Privilege Vulnerability
UpdatedWindows Group Policy Elevation of Privilege Vulnerability
Updated- CVE-2022-37974: Windows Mixed Reality Developer Tools Information Disclosure Vulnerability 6.5 Medium
Windows Mixed Reality Developer Tools Information Disclosure Vulnerability
Updated Windows Local Session Manager (LSM) Denial of Service Vulnerability
UpdatedMicrosoft Endpoint Configuration Manager Spoofing Vulnerability
UpdatedMicrosoft Windows Defender Elevation of Privilege Vulnerability
UpdatedWindows DWM Core Library Elevation of Privilege Vulnerability
UpdatedWindows Common Log File System Driver Elevation of Privilege Vulnerability
Updated- CVE-2022-37968: Azure Arc-enabled Kubernetes cluster Connect Elevation of Privilege Vulnerability 10.0 Critical
Microsoft has identified a vulnerability affecting the cluster connect feature of Azure Arc-enabled Kubernetes clusters. This vulnerability could allow an unauthenticated user to elevate their privileges and potentially gain administrative control over the Kubernetes cluster. Additionally, because Azure Stack Edge allows customers to deploy Kubernetes workloads on their devices via Azure Arc, Azur
Updated Windows Kerberos Elevation of Privilege Vulnerability
UpdatedWindows Kerberos RC4-HMAC Elevation of Privilege Vulnerability
Updated- CVE-2022-37965: Windows Point-to-Point Tunneling Protocol Denial of Service Vulnerability 5.9 Medium
Windows Point-to-Point Tunneling Protocol Denial of Service Vulnerability
Updated Windows Kernel Elevation of Privilege Vulnerability
UpdatedMicrosoft Office Visio Remote Code Execution Vulnerability
UpdatedMicrosoft PowerPoint Remote Code Execution Vulnerability
UpdatedMicrosoft SharePoint Server Remote Code Execution Vulnerability
Updated- CVE-2022-37959: Network Device Enrollment Service (NDES) Security Feature Bypass Vulnerability 6.5 Medium
Network Device Enrollment Service (NDES) Security Feature Bypass Vulnerability
Updated SPNEGO Extended Negotiation (NEGOEX) Security Mechanism Remote Code Execution Vulnerability
UpdatedWindows Kernel Elevation of Privilege Vulnerability
UpdatedWindows Kernel Elevation of Privilege Vulnerability
UpdatedWindows Group Policy Elevation of Privilege Vulnerability
UpdatedDirectX Graphics Kernel Elevation of Privilege Vulnerability
UpdatedAn HTTP response splitting vulnerability exists in the AM Gateway Challenge-Response dialog of WorkstationST (<v07.09.15) and could allow an attacker to compromise a victim's browser/session. WorkstationST is only deployed in specific, controlled environments rendering attack complexity significantly higher than if the attack were conducted on the software in isolation. WorkstationST v07.09.15 can
UpdatedA reflected cross-site scripting (XSS) vulnerability exists in the iHistorian Data Display of WorkstationST (<v07.09.15) could allow an attacker to compromise a victim's browser. WorkstationST is only deployed in specific, controlled environments rendering attack complexity significantly higher than if the attack were conducted on the software in isolation. WorkstationST v07.09.15 can be found in
Updated- CVE-2022-37951: Not used in 2022 Rejected
Not used in 2022
Updated · Rejected record - CVE-2022-37950: Not used in 2022 Rejected
Not used in 2022
Updated · Rejected record - CVE-2022-37949: Not used in 2022 Rejected
Not used in 2022
Updated · Rejected record - CVE-2022-37948: Not used in 2022 Rejected
Not used in 2022
Updated · Rejected record - CVE-2022-37947: Not used in 2022 Rejected
Not used in 2022
Updated · Rejected record - CVE-2022-37946: Not used in 2022 Rejected
Not used in 2022
Updated · Rejected record - CVE-2022-37945: Not used in 2022 Rejected
Not used in 2022
Updated · Rejected record - CVE-2022-37944: Not used in 2022 Rejected
Not used in 2022
Updated · Rejected record - CVE-2022-37943: Not used in 2022 Rejected
Not used in 2022
Updated · Rejected record - CVE-2022-37942: Not used in 2022 Rejected
Not used in 2022
Updated · Rejected record - CVE-2022-37941: Not used in 2022 Rejected
Not used in 2022
Updated · Rejected record Potential security vulnerabilities have been identified in the HPE FlexFabric 5700 Switch Series. These vulnerabilities could be remotely exploited to allow host header injection and URL redirection. HPE has made the following software to resolve the vulnerability in HPE FlexFabric 5700 Switch Series version R2432P61 or later.
UpdatedA potential security vulnerability has been identified in HPE Superdome Flex and Superdome Flex 280 servers. The vulnerability could be locally exploited to allow disclosure of information. HPE has made the following software to resolve the vulnerability in HPE Superdome Flex Servers v3.65.8 and Superdome Flex 280 Servers v1.45.8.
Updated- CVE-2022-37938: Unauthenticated server side request forgery in HPE Serviceguard Manager 9.8 Critical
Unauthenticated server side request forgery in HPE Serviceguard Manager
Updated Pre-auth memory corruption in HPE Serviceguard
Updated- CVE-2022-37936: Unauthenticated Java deserialization vulnerability in Serviceguard Manager 9.8 Critical
Unauthenticated Java deserialization vulnerability in Serviceguard Manager
Updated HPE OneView for VMware vCenter, in certain circumstances, may disclose the “HPE OneView” Username and Password.
UpdatedA potential security vulnerability has been identified in HPE OfficeConnect 1820, and 1850 switch series. The vulnerability could be remotely exploited to allow remote directory traversal in HPE OfficeConnect 1820 switch series version PT.02.17 and below, HPE OfficeConnect 1850 switch series version PC.01.23 and below, and HPE OfficeConnect 1850 (10G aggregator) switch version PO.01.22 and below.
UpdatedA potential security vulnerability has been identified in HPE Superdome Flex and Superdome Flex 280 servers. The vulnerability could be exploited to allow local unauthorized data injection. HPE has made the following software updates to resolve the vulnerability in HPE Superdome Flex firmware 3.60.50 and below and Superdome Flex 280 servers firmware 1.40.60 and below.
UpdatedA potential security vulnerability has been identified in Hewlett Packard Enterprise OfficeConnect 1820, 1850, and 1920S Network switches. The vulnerability could be remotely exploited to allow authentication bypass. HPE has made the following software updates to resolve the vulnerability in Hewlett Packard Enterprise OfficeConnect 1820, 1850 and 1920S Network switches versions: Prior to PT.02.14;
UpdatedA vulnerability in NetBatch-Plus software allows unauthorized access to the application. HPE has provided a workaround and fix. Please refer to HPE Security Bulletin HPESBNS04388 for details.
UpdatedA security vulnerability has been identified in HPE Nimble Storage Hybrid Flash Arrays and HPE Nimble Storage Secondary Flash Arrays which could potentially allow local disclosure of sensitive information.
UpdatedImproper Privilege Management vulnerability in Hewlett Packard Enterprise Nimble Storage Hybrid Flash Arrays and Nimble Storage Secondary Flash Arrays.
UpdatedInsufficient Verification of Data Authenticity vulnerability in Hewlett Packard Enterprise HPE Nimble Storage Hybrid Flash Arrays and Nimble Storage Secondary Flash Arrays.
UpdatedURL Redirection to Untrusted Site ('Open Redirect') vulnerability in Hewlett Packard Enterprise HPE OneView Global Dashboard (OVGD).
UpdatedA vulnerability within the web-based management interface of EdgeConnect Enterprise could allow a remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface by uploading a specially crafted file. A successful exploit could allow an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface in Aruba EdgeConnect
UpdatedA vulnerability within the web-based management interface of Aruba EdgeConnect Enterprise could allow a remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface in Aruba EdgeConnect Enterprise Software version(
UpdatedVulnerabilities in the Aruba EdgeConnect Enterprise command line interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise in Aruba EdgeConnect Enterprise Software version(s): ECOS 9.2.1.0 and below; ECOS 9.1.
UpdatedVulnerabilities in the Aruba EdgeConnect Enterprise command line interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise in Aruba EdgeConnect Enterprise Software version(s): ECOS 9.2.1.0 and below; ECOS 9.1.
UpdatedVulnerabilities in the Aruba EdgeConnect Enterprise command line interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise in Aruba EdgeConnect Enterprise Software version(s): ECOS 9.2.1.0 and below; ECOS 9.1.
UpdatedVulnerabilities in the Aruba EdgeConnect Enterprise command line interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise in Aruba EdgeConnect Enterprise Software version(s): ECOS 9.2.1.0 and below; ECOS 9.1.
UpdatedVulnerabilities in the Aruba EdgeConnect Enterprise command line interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise in Aruba EdgeConnect Enterprise Software version(s): ECOS 9.2.1.0 and below; ECOS 9.1.
UpdatedA vulnerability exists in the API of Aruba EdgeConnect Enterprise. An unauthenticated attacker can exploit this condition via the web-based management interface to create a denial-of-service condition which prevents the appliance from properly responding to API requests in Aruba EdgeConnect Enterprise Software version(s): ECOS 9.2.1.0 and below; ECOS 9.1.3.0 and below; ECOS 9.0.7.0 and below; ECOS
UpdatedVulnerabilities in the AirWave Management Platform web-based management interface exist which expose some URLs to a lack of proper access controls. These vulnerabilities could allow a remote attacker with limited privileges to gain access to sensitive information and/or change network configurations with privileges at a higher effective level in Aruba AirWave Management Platform version(s): 8.2.15
UpdatedVulnerabilities in the AirWave Management Platform web-based management interface exist which expose some URLs to a lack of proper access controls. These vulnerabilities could allow a remote attacker with limited privileges to gain access to sensitive information and/or change network configurations with privileges at a higher effective level in Aruba AirWave Management Platform version(s): 8.2.15
UpdatedVulnerabilities in the AirWave Management Platform web-based management interface exist which expose some URLs to a lack of proper access controls. These vulnerabilities could allow a remote attacker with limited privileges to gain access to sensitive information and/or change network configurations with privileges at a higher effective level in Aruba AirWave Management Platform version(s): 8.2.15
UpdatedA vulnerability in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the underlying operating system leading to a complete system compromise of Aruba EdgeConnect Enterpri
UpdatedVulnerabilities in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an unauthenticated remote attacker to bypass authentication. Successful exploitation of these vulnerabilities could allow an attacker to gain administrative privileges leading to a complete compromise of the Aruba EdgeConnect Enterprise Orchestrator with versions 9.1.2.40051 and below, 9.
UpdatedVulnerabilities in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an unauthenticated remote attacker to bypass authentication. Successful exploitation of these vulnerabilities could allow an attacker to gain administrative privileges leading to a complete compromise of the Aruba EdgeConnect Enterprise Orchestrator with versions 9.1.2.40051 and below, 9.
UpdatedAuthenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities results in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
UpdatedDue to improper restrictions on XML entities multiple vulnerabilities exist in the command line interface of ArubaOS. A successful exploit could allow an authenticated attacker to retrieve files from the local system or cause the application to consume system resources, resulting in a denial of service condition.
UpdatedA buffer overflow vulnerability exists in the ArubaOS command line interface. Successful exploitation of this vulnerability results in a denial of service on the affected system.
UpdatedAruba has identified certain configurations of ArubaOS that can lead to sensitive information disclosure from the configured ESSIDs. The scenarios in which disclosure of potentially sensitive information can occur are complex, and depend on factors beyond the control of attackers.
UpdatedAn authenticated attacker can impact the integrity of the ArubaOS bootloader on 7xxx series controllers. Successful exploitation can compromise the hardware chain of trust on the impacted controller.
UpdatedA vulnerability exists in the ArubaOS bootloader on 7xxx series controllers which can result in a denial of service (DoS) condition on an impacted system. A successful attacker can cause a system hang which can only be resolved via a power cycle of the impacted controller.
UpdatedAn authenticated path traversal vulnerability exists in the ArubaOS command line interface. Successful exploitation of the vulnerability results in the ability to delete arbitrary files on the underlying operating system.
UpdatedVulnerabilities in ArubaOS running on 7xxx series controllers exist that allows an attacker to execute arbitrary code during the boot sequence. Successful exploitation could allow an attacker to achieve permanent modification of the underlying operating system.
UpdatedVulnerabilities in ArubaOS running on 7xxx series controllers exist that allows an attacker to execute arbitrary code during the boot sequence. Successful exploitation could allow an attacker to achieve permanent modification of the underlying operating system.
UpdatedA vulnerability exists that allows an authenticated attacker to overwrite an arbitrary file with attacker-controlled content via the web interface. Successful exploitation of this vulnerability could lead to full compromise the underlying host operating system.
UpdatedAuthenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities results in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
UpdatedAuthenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities results in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
UpdatedAuthenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities results in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
UpdatedAuthenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities results in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
Updated