Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
n (Administrative Services). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-062-01
CVE ID: CVE-2022-24433 State: PUBLISHED Published: 2022-03-11T16:15:14.245517Z Last Updated: 2024-09-16T21:57:22.111Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: simple-git Problem Types: Command Injection Description: The package simple-git before 3.3.0 are vulnerable to Command Injection via argument injection. When calling the .fetch(remote, branch, handlerFn) function, both the remote and branch parameters are passed to the git fetch subcommand. By injecting some git options it was possible to get arbitrary command execution. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-SIMPLEGIT-2421199 -
tion. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-SIMPLEGIT-2421199 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2421245 - https://github.com/steveukx/git-js/pull/767 - https://github.com/steveukx/git-js/releases/tag/simple-git%403.3.0
CVE ID: CVE-2022-24434 State: PUBLISHED Published: 2022-05-20T20:05:13.484157Z Last Updated: 2024-09-16T19:10:28.087Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:F/RL:O/RC:C) Vendors: n/a Products: dicer Problem Types: Denial of Service (DoS) Description: This affects all versions of package dicer. A malicious attacker can send a modified form to server, and crash the nodejs service. An attacker could sent the payload again and again so that the service continuously crashes. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-DICER-2311764 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2838865 - https://github.com/mscdex/d
/snyk.io/vuln/SNYK-JS-DICER-2311764 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2838865 - https://github.com/mscdex/dicer/pull/22 - https://github.com/mscdex/busboy/issues/250 - https://github.com/mscdex/dicer/pull/22/commits/b7fca2e93e8e9d4439d8acc5c02f5e54a0112dac
CVE ID: CVE-2022-24435 State: PUBLISHED Published: 2022-02-24T09:50:34 Last Updated: 2024-08-03T04:13:55.567Z Vendors: Dojin Club MICMNIS Products: phpUploader Problem Types: Cross-site scripting Description: Cross-site scripting vulnerability in phpUploader v1.2 and earlier allows a remote unauthenticated attacker to inject an arbitrary script via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/shimosyan/phpUploader/releases/tag/v1.2.1 - https://jvn.jp/en/jp/JVN00095004/index.html
CVE ID: CVE-2022-24436 State: PUBLISHED Published: 2022-06-15T20:08:51.000Z Last Updated: 2025-05-05T16:24:02.814Z Vendors: n/a Products: Intel(R) Processors Problem Types: information disclosure Description: Observable behavioral in power management throttling for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via network access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00698.html - https://security.netapp.com/advisory/ntap-20220624-0007/
CVE ID: CVE-2022-24437 State: PUBLISHED Published: 2022-05-01T15:20:15.509368Z Last Updated: 2024-09-16T19:15:08.649Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: git-pull-or-clone Problem Types: Command Injection Description: The package git-pull-or-clone before 2.0.2 are vulnerable to Command Injection due to the use of the --upload-pack feature of git which is also supported for git clone. The source includes the use of the secure child process API spawn(). However, the outpath parameter passed to it may be a command-line argument to the git clone command and result in arbitrary command injection. Additional Analyst Notes: - CVE Program
ine argument to the git clone command and result in arbitrary command injection. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-GITPULLORCLONE-2434307 - https://gist.github.com/lirantal/327e9dd32686991b5a1fa6341aac2e7b - https://github.com/feross/git-pull-or-clone/commit/f9ce092be13cc32e685dfa26e7705e9c6e3108a3
CVE ID: CVE-2022-24439 State: PUBLISHED Published: 2022-12-12T01:49:10.008Z Last Updated: 2025-11-03T21:46:05.215Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: GitPython Problem Types: Remote Code Execution (RCE) Description: All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to git without sufficient sanitization of input arguments. Additional Analyst Notes: - CVE Program Container: References: - https://
ut sufficient sanitization of input arguments. Additional Analyst Notes: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-PYTHON-GITPYTHON-3113858 - https://github.com/gitpython-developers/GitPython/blob/bec61576ae75803bc4e60d8de7a629c194313d1c/git/repo/base.py%23L1249 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IKMVYKLWX62UEYKAN64RUZMOIAMZM5JN/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SJHN3QUXPJIMM6SULIR3PR34UFWRAE7X/ - https://lists.debian.org/debian-lts-announce/2023/07/msg00024.html - https://lists.fedoraproject.org/archives/list/package-announce%40lis
ian.org/debian-lts-announce/2023/07/msg00024.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PF6AXUTC5BO7L2SBJMCVKJSPKWY52I5R/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AV5DV7GBLMOZT7U3Q4TDOJO5R6G3V6GH/ - https://security.gentoo.org/glsa/202311-01
CVE ID: CVE-2022-24440 State: PUBLISHED Published: 2022-04-01T17:35:13.314022Z Last Updated: 2024-09-17T03:22:48.708Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: cocoapods-downloader Problem Types: Command Injection Description: The package cocoapods-downloader before 1.6.0, from 1.6.2 and before 1.6.3 are vulnerable to Command Injection via git argument injection. When calling the Pod::Downloader.preprocess_options function and using git, both the git and branch parameters are passed to the git ls-remote subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection. Additional Analyst N
that additional flags can be set. The additional flags can be used to perform a command injection. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-RUBY-COCOAPODSDOWNLOADER-2414278 - https://github.com/CocoaPods/cocoapods-downloader/pull/124 - https://github.com/CocoaPods/cocoapods-downloader/pull/128
CVE ID: CVE-2022-24441 State: PUBLISHED Published: 2022-11-30T00:00:00.000Z Last Updated: 2025-04-24T19:54:51.898Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: n/a Products: snyk Problem Types: Code Injection Description: The package snyk before 1.1064.0 are vulnerable to Code Injection when analyzing a project. An attacker who can convince a user to scan a malicious project can include commands in a build file such as build.gradle or gradle-wrapper.jar, which will be executed with the privileges of the application. This vulnerability may be triggered when running the the CLI tool directly, or when running a scan with one of the IDE plugins that invoke th
y be triggered when running the the CLI tool directly, or when running a scan with one of the IDE plugins that invoke the Snyk CLI. Successful exploitation of this issue would likely require some level of social engineering - to coerce an untrusted project to be downloaded and analyzed via the Snyk CLI or opened in an IDE where a Snyk IDE plugin is installed and enabled. Additionally, if the IDE has a Trust feature then the target folder must be marked as ‘trusted’ in order to be vulnerable. **NOTE:** This issue is independent of the one reported in [CVE-2022-40764](https://security.snyk.io/vuln/SNYK-JS-SNYK-3037342), and upgrading to a fixed version for this addresses that issue as well. Th
/security.snyk.io/vuln/SNYK-JS-SNYK-3037342), and upgrading to a fixed version for this addresses that issue as well. The affected IDE plugins and versions are: - VS Code - Affected: <=1.8.0, Fixed: 1.9.0 - IntelliJ - Affected: <=2.4.47, Fixed: 2.4.48 - Visual Studio - Affected: <=1.1.30, Fixed: 1.1.31 - Eclipse - Affected: <=v20221115.132308, Fixed: All subsequent versions - Language Server - Affected: <=v20221109.114426, Fixed: All subsequent versions Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-SNYK-3111871 - https://www.imperva.com/blog/how-scanning-your-projects-for-security-issues-can-lead-to-remote-code
YK-JS-SNYK-3111871 - https://www.imperva.com/blog/how-scanning-your-projects-for-security-issues-can-lead-to-remote-code-execution/ - https://github.com/snyk/vscode-extension/commit/0db3b4240be0db6a0a5c6d02c0d4231a2c4ba708 - https://github.com/snyk/snyk-intellij-plugin/commit/56682f4ba6081ce1d95cb980cbfacd3809a826f4 - https://github.com/snyk/snyk-visual-studio-plugin/commit/0b53dbbd4a3153c3ef9aaf797af3b5caad0f731a - https://github.com/snyk/snyk-eclipse-plugin/commit/b5a8bce25a359ced75f83a729fc6b2393fc9a495 - https://github.com/snyk/snyk-ls/commit/b3229f0142f782871aa72d1a7dcf417546d568ed
CVE ID: CVE-2022-24442 State: PUBLISHED Published: 2022-02-25T20:01:35 Last Updated: 2024-08-03T04:13:55.649Z Vendors: n/a Products: n/a Problem Types: n/a Description: JetBrains YouTrack before 2021.4.40426 was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2022-24444 State: PUBLISHED Published: 2022-06-28T21:30:54 Last Updated: 2024-08-03T04:13:55.612Z Vendors: n/a Products: n/a Problem Types: n/a Description: Silverstripe silverstripe/framework through 4.10 allows Session Fixation. Additional Analyst Notes: - CVE Program Container: References: - https://www.silverstripe.org/download/security-releases/ - https://www.silverstripe.org/blog/tag/release - https://forum.silverstripe.org/c/releases - https://docs.silverstripe.org/en/4/changelogs/4.10.1/ - https://www.silverstripe.org/download/security-releases/cve-2022-24444
CVE ID: CVE-2022-24445 State: REJECTED Published: 2022-02-18T17:50:56 Last Updated: 2022-02-18T17:50:56 Description: No description available.
CVE ID: CVE-2022-24446 State: PUBLISHED Published: 2022-03-01T02:01:27.000Z Last Updated: 2025-05-30T16:01:59.319Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zoho ManageEngine Key Manager Plus 6.1.6. A user, with the level Operator, can see all SSH servers (and user information) even if no SSH server or user is associated to the operator. Additional Analyst Notes: - CVE Program Container: References: - https://excellium-services.com/cert-xlm-advisory/cve-2022-24446/ - https://www.manageengine.com/key-manager/release-notes.html#6200 - https://cds.thalesgroup.com/en/tcs-cert/CVE-2022-24446
CVE ID: CVE-2022-24447 State: PUBLISHED Published: 2022-03-02T14:41:59.000Z Last Updated: 2025-05-30T16:01:50.063Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zoho ManageEngine Key Manager Plus before 6200. A service exposed by the application allows a user, with the level Operator, to access stored SSL certificates and associated key pairs during export. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/key-manager/release-notes.html#6200 - https://excellium-services.com/cert-xlm-advisory/cve-2022-24447/ - https://cds.thalesgroup.com/en/tcs-cert/CVE-2022-24447
CVE ID: CVE-2022-24448 State: PUBLISHED Published: 2022-02-04T19:45:48 Last Updated: 2024-08-03T04:13:56.018Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in fs/nfs/dir.c in the Linux kernel before 5.16.5. If an application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a regular file is found, ENOTDIR should occur, but the server instead returns uninitialized data in the file descriptor. Additional Analyst Notes: - CVE Program Container: References: - https://www.spinics.net/lists/stable/msg531976.html - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.5 - https://github.com/torval
/lists/stable/msg531976.html - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.5 - https://github.com/torvalds/linux/commit/ac795161c93699d600db16c1a8cc23a65a1eceaf - https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ac795161c93699d600db16c1a8cc23a65a1eceaf - https://www.debian.org/security/2022/dsa-5092 - https://lists.debian.org/debian-lts-announce/2022/03/msg00011.html - https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html - https://www.debian.org/security/2022/dsa-5096 - https://lore.kernel.org/all/67d6a536-9027-1928-99b6-af512a36cd1a%40huawei.com/T/ - https://github.com/torvalds/linux/commit/ab0fc21bc7105b54bafd85bd8b82742f9e68898a
CVE ID: CVE-2022-24449 State: PUBLISHED Published: 2022-04-28T20:06:13 Last Updated: 2024-08-03T04:13:55.474Z Vendors: n/a Products: n/a Problem Types: n/a Description: Solar appScreener through 3.10.4, when a valid license is not present, allows XXE and SSRF attacks via a crafted XML document. Additional Analyst Notes: - CVE Program Container: References: - https://en.rt-solar.ru/products/solarAPPscreener/ - https://github.com/jet-pentest/CVE-2022-24449
CVE ID: CVE-2022-24450 State: PUBLISHED Published: 2022-02-08T01:14:48 Last Updated: 2024-08-03T04:13:55.583Z Vendors: n/a Products: n/a Problem Types: n/a Description: NATS nats-server before 2.7.2 has Incorrect Access Control. Any authenticated user can obtain the privileges of the System account by misusing the "dynamically provisioned sandbox accounts" feature. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nats-io/nats-server/releases/tag/v2.7.2 - https://advisories.nats.io/CVE/CVE-2022-24450.txt
CVE ID: CVE-2022-24451 State: PUBLISHED Published: 2022-03-09T17:07:28 Last Updated: 2025-07-08T15:31:24.512Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: VP9 Video Extensions Problem Types: Remote Code Execution Description: VP9 Video Extensions Remote Code Execution Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24451
CVE ID: CVE-2022-24452 State: PUBLISHED Published: 2022-03-09T17:07:29 Last Updated: 2025-07-08T15:31:25.109Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: HEVC Video Extension, HEVC Video Extensions Problem Types: Remote Code Execution Description: HEVC Video Extensions Remote Code Execution Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24452
CVE ID: CVE-2022-24453 State: PUBLISHED Published: 2022-03-09T17:07:31 Last Updated: 2025-07-08T15:31:25.636Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: HEVC Video Extension, HEVC Video Extensions Problem Types: Remote Code Execution Description: HEVC Video Extensions Remote Code Execution Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24453
CVE ID: CVE-2022-24454 State: PUBLISHED Published: 2022-03-09T17:07:32 Last Updated: 2025-07-08T15:31:27.678Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows 10 Version 1909, Windows 10 Version 21H1, Windows Server 2022, Windows 10 Version 20H2, Windows Server version 20H2, Windows 11 version 21H2, Windows 10 Version 21H2, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows 7, Windows 7 Service Pack 1, Windows 8.1, Windows Server 2008 R2 Service Pack 1,
016 (Server Core installation), Windows 7, Windows 7 Service Pack 1, Windows 8.1, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: Elevation of Privilege Description: Windows Security Support Provider Interface Elevation of Privilege Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24454
CVE ID: CVE-2022-24455 State: PUBLISHED Published: 2022-03-09T17:07:34 Last Updated: 2025-07-08T15:31:28.878Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows 10 Version 1909, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows 8.1, Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: Elevation of Privilege Description: Windows CD-ROM Driver Elevation
er 2012 R2 (Server Core installation) Problem Types: Elevation of Privilege Description: Windows CD-ROM Driver Elevation of Privilege Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24455
CVE ID: CVE-2022-24456 State: PUBLISHED Published: 2022-03-09T17:07:35 Last Updated: 2025-07-08T15:31:29.440Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: HEVC Video Extension, HEVC Video Extensions Problem Types: Remote Code Execution Description: HEVC Video Extensions Remote Code Execution Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24456
CVE ID: CVE-2022-24457 State: PUBLISHED Published: 2022-03-09T17:07:36 Last Updated: 2025-07-08T15:31:30.024Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: HEIF Image Extension Problem Types: Remote Code Execution Description: HEIF Image Extensions Remote Code Execution Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24457
CVE ID: CVE-2022-24459 State: PUBLISHED Published: 2022-03-09T17:07:38 Last Updated: 2025-07-08T15:31:31.765Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows 10 Version 1909, Windows 10 Version 21H1, Windows Server 2022, Windows 10 Version 20H2, Windows Server version 20H2, Windows 11 version 21H2, Windows 10 Version 21H2, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows 7, Windows 7 Service Pack 1, Windows 8.1, Windows Server 2008 Service Pack 2, Wi
016 (Server Core installation), Windows 7, Windows 7 Service Pack 1, Windows 8.1, Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: Elevation of Privilege Description: Windows Fax and Scan Service Elevation of Privilege Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability
y Additional Analyst Notes: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24459
CVE ID: CVE-2022-24460 State: PUBLISHED Published: 2022-03-09T17:07:39 Last Updated: 2025-07-08T15:31:38.908Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows 10 Version 1909, Windows 10 Version 21H1, Windows Server 2022, Windows 10 Version 20H2, Windows Server version 20H2, Windows 11 version 21H2, Windows 10 Version 21H2, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation) Problem Types: Elevation of Privilege Description: Tablet Windows User Interface Applicatio
6 (Server Core installation) Problem Types: Elevation of Privilege Description: Tablet Windows User Interface Application Elevation of Privilege Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24460
CVE ID: CVE-2022-24461 State: PUBLISHED Published: 2022-03-09T17:07:41 Last Updated: 2025-07-08T15:31:50.565Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft Office 2019, Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021 Problem Types: Remote Code Execution Description: Microsoft Office Visio Remote Code Execution Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24461
CVE ID: CVE-2022-24462 State: PUBLISHED Published: 2022-03-09T17:07:42 Last Updated: 2025-07-08T15:31:51.823Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft Office 2019, Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021 Problem Types: Security Feature Bypass Description: Microsoft Word Security Feature Bypass Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24462
CVE ID: CVE-2022-24463 State: PUBLISHED Published: 2022-03-09T17:07:44 Last Updated: 2025-07-08T15:31:32.346Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft Exchange Server 2016 Cumulative Update 21, Microsoft Exchange Server 2019 Cumulative Update 10, Microsoft Exchange Server 2016 Cumulative Update 22, Microsoft Exchange Server 2019 Cumulative Update 11 Problem Types: Spoofing Description: Microsoft Exchange Server Spoofing Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24463