alirezaaminzadeh/cve-riskrank huggingface dataset:
CVE-2022-42753 (published 2022-11-03)
SalonERP version 3.0.2 allows an external attacker to steal the cookie of arbitrary users. This is possible because the application does not correctly validate the page parameter against XSS attacks.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: salonerp_project
Affected products: salonerp
CVE-2022-42754 (published 2022-12-06)
In npu driver, there is a memory corruption due to a use after free. This could lead to local denial of service in kernel.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-416
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-42755 (published 2022-12-06)
In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-787
Affected vendors: google, unisoc
Affected products: android, s8023, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-42756 (published 2022-12-06)
In sensor driver, there is a possible buffer overflow due to a missing bounds check. This could lead to local denial of service in kernel.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-120
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-42757 (published 2022-12-06)
In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services.
Severity: LOW (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Weakness: CWE-126
Affected vendors: google, unisoc
Affected products: android, s8015, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-42758 (published 2022-12-06)
In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services.
Severity: LOW (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Weakness: CWE-126
Affected vendors: google, unisoc
Affected products: android, s8016, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-42759 (published 2022-12-06)
In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-126
Affected vendors: google, unisoc
Affected products: android, s8017, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-4276 (published 2022-12-03)
A vulnerability was found in House Rental System and classified as critical. Affected by this issue is some unknown functionality of the file tenant-engine.php of the component POST Request Handler. The manipulation of the argument id_photo leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-214772.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-266
Affected vendors: house_rental_system_project
Affected products: house_rental_system
CVE-2022-42760 (published 2022-12-06)
In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-120
Affected vendors: google, unisoc
Affected products: android, s8018, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-42761 (published 2022-12-06)
In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-125
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-42762 (published 2022-12-06)
In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-126
Affected vendors: google, unisoc
Affected products: android, s8007, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-42763 (published 2022-12-06)
In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-190
Affected vendors: google, unisoc
Affected products: android, s8008, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-42764 (published 2022-12-06)
In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-190
Affected vendors: google, unisoc
Affected products: android, s8009, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-42765 (published 2022-12-06)
In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-190
Affected vendors: google, unisoc
Affected products: android, s8000, s8010, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-42766 (published 2022-12-06)
In wlan driver, there is a possible missing permission check, This could lead to local information disclosure.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: google, unisoc
Affected products: android, s8011, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-42767 (published 2022-12-06)
In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services.
Severity: LOW (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Weakness: CWE-190
Affected vendors: google, unisoc
Affected products: android, s8012, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-42768 (published 2022-12-06)
In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Weakness: CWE-126
Affected vendors: google, unisoc
Affected products: android, s8013, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-42769 (published 2022-12-06)
In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services.
Severity: LOW (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Weakness: CWE-125
Affected vendors: google, unisoc
Affected products: android, s8014, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-4277 (published 2022-12-03)
A vulnerability was found in Shaoxing Background Management System. It has been declared as critical. This vulnerability affects unknown code of the file /Default/Bd. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-214774 is the identifier assigned to this vulnerability.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-707
Affected vendors: xsjczx
Affected products: background_management_system
CVE-2022-42770 (published 2022-12-06)
In wlan driver, there is a race condition, This could lead to local denial of service in wlan services.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-362
Affected vendors: google, unisoc
Affected products: android, s8019, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-42771 (published 2022-12-06)
In wlan driver, there is a race condition, This could lead to local denial of service in wlan services.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-362
Affected vendors: google, unisoc
Affected products: android, s8020, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-42772 (published 2022-12-06)
In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-787
Affected vendors: google, unisoc
Affected products: android, s8021, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-42773 (published 2022-12-06)
In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-125
Affected vendors: google, unisoc
Affected products: android, s8001, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-42774 (published 2022-12-06)
In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-126
Affected vendors: google, unisoc
Affected products: android, s8002, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-42775 (published 2022-12-06)
In camera driver, there is a possible memory corruption due to improper locking. This could lead to local denial of service in kernel.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-119
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-42776 (published 2022-12-06)
In UscAIEngine service, there is a missing permission check. This could lead to set up UscAIEngine service with no additional execution privileges needed.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-42777 (published 2022-12-06)
In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges needed.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-42778 (published 2022-12-06)
In windows manager service, there is a missing permission check. This could lead to set up windows manager service with no additional execution privileges needed.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-42779 (published 2022-12-06)
In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-126
Affected vendors: google, unisoc
Affected products: android, s8003, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-4278 (published 2022-12-03)
A vulnerability was found in SourceCodester Human Resource Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /hrm/employeeadd.php. The manipulation of the argument empid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-214775.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-707
Affected vendors: oretnom23
Affected products: human_resource_management_system
CVE-2022-42780 (published 2022-12-06)
In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-126
Affected vendors: google, unisoc
Affected products: android, s8005, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-42781 (published 2022-12-06)
In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-126
Affected vendors: google, unisoc
Affected products: android, s8006, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-42782 (published 2022-12-06)
In wlan driver, there is a possible missing permission check, This could lead to local information disclosure.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-42783 (published 2023-02-12)
In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-787
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-42784 (published 2023-12-12)
A vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA1) (All versions >= V8.3), LOGO! 12/24RCEo (6ED1052-2MD08-0BA1) (All versions >= V8.3), LOGO! 230RCE (6ED1052-1FB08-0BA1) (All versions >= V8.3), LOGO! 230RCEo (6ED1052-2FB08-0BA1) (All versions >= V8.3), LOGO! 24CE (6ED1052-1CC08-0BA1) (All versions >= V8.3), LOGO! 24CEo (6ED1052-2CC08-0BA1) (All versions >= V8.3), LOGO! 24RCE (6ED1052-1HB08-0BA1) (All versions >= V8.3), LOGO! 24RCEo (6ED1052-2HB08-0BA1) (All versions >= V8.3), SIPLUS LOGO! 12/24RCE (6AG1052-1MD08-7BA1) (All versions >= V8.3), SIPLUS LOGO! 12/24RCEo (6AG1052-2MD08-7BA1) (All versions >= V8.3), SIPLUS LOGO! 230RCE (6AG1052-1FB08-7BA1) (All versions >= V8.3), SIPLUS LOGO! 230RCEo (6AG1052-2FB08-7BA1) (All versions >= V8.3), SIPLUS LOGO! 24CE (6AG1052-1CC08-7BA1) (All versions >= V8.3), SIPLUS LOGO! 24CEo (6AG1052-2CC08-7BA1) (All versions >= V8.3), SIPLUS LOGO! 24RCE (6AG1052-1HB08-7BA1) (All versions >= V8.3), SIPLUS LOGO! 24RCEo (6AG1052-2HB08-7BA1) (All versions >= V8.3). Affected devices are vulnerable to an electromagnetic fault injection. This could allow an attacker to dump and debug the firmware, including the manipulation of memory. Further actions could allow to inject public keys of custom created key pairs which are then signed by the product CA. The generation of a custom certificate allows communication with, and impersonation of, any device of the same version.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-1319
Affected vendors: siemens
Affected products: 6ag1052-1cc08-7ba1, 6ag1052-1cc08-7ba1_firmware, 6ag1052-1fb08-7ba1, 6ag1052-1fb08-7ba1_firmware, 6ag1052-1hb08-7ba1, 6ag1052-1hb08-7ba1_firmware, 6ag1052-1md08-7ba1, 6ag1052-1md08-7ba1_firmware, 6ag1052-2cc08-7ba1, 6ag1052-2cc08-7ba1_firmware, 6ag1052-2fb08-7ba1, 6ag1052-2fb08-7ba1_firmware, 6ag1052-2hb08-7ba1, 6ag1052-2hb08-7ba1_firmware, 6ag1052-2md08-7ba1, 6ag1052-2md08-7ba1_firmware, 6ed1052-1cc08-0ba1, 6ed1052-1cc08-0ba1_firmware, 6ed1052-1fb08-0ba1, 6ed1052-1fb08-0ba1_firmware, 6ed1052-1hb08-0ba1, 6ed1052-1hb08-0ba1_firmware, 6ed1052-1md08-0ba1, 6ed1052-1md08-0ba1_firmware, 6ed1052-2cc08-0ba1
CVE-2022-42785 (published 2022-11-15)
Multiple W&T products of the ComServer Series are prone to an authentication bypass. An unathenticated remote attacker, can log in without knowledge of the password by crafting a modified HTTP GET Request.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-306
Affected vendors: wut
Affected products: at-modem-emulator, at-modem-emulator_firmware, com-server_20ma, com-server_20ma_firmware, com-server_\+\+, com-server_\+\+_firmware, com-server_highspeed_100basefx, com-server_highspeed_100basefx_firmware, com-server_highspeed_100baselx, com-server_highspeed_100baselx_firmware, com-server_highspeed_19\"_1port, com-server_highspeed_19\"_1port_firmware, com-server_highspeed_19\"_4port, com-server_highspeed_19\"_4port_firmware, com-server_highspeed_compact, com-server_highspeed_compact_firmware, com-server_highspeed_industry, com-server_highspeed_industry_firmware, com-server_highspeed_isolated, com-server_highspeed_isolated_firmware, com-server_highspeed_lc, com-server_highspeed_lc_firmware, com-server_highspeed_oem, com-server_highspeed_oem_firmware, com-server_highspeed_office_1port
CVE-2022-42786 (published 2022-11-10)
Multiple W&T Products of the ComServer Series are prone to an XSS attack. An authenticated remote Attacker can execute arbitrary web scripts or HTML via a crafted payload injected into the title of the configuration webpage
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: wut
Affected products: at-modem-emulator, at-modem-emulator_firmware, com-server_20ma, com-server_20ma_firmware, com-server_\+\+, com-server_\+\+_firmware, com-server_highspeed_100basefx, com-server_highspeed_100basefx_firmware, com-server_highspeed_100baselx, com-server_highspeed_100baselx_firmware, com-server_highspeed_19\"_1port, com-server_highspeed_19\"_1port_firmware, com-server_highspeed_19\"_4port, com-server_highspeed_19\"_4port_firmware, com-server_highspeed_compact, com-server_highspeed_compact_firmware, com-server_highspeed_industry, com-server_highspeed_industry_firmware, com-server_highspeed_isolated, com-server_highspeed_isolated_firmware, com-server_highspeed_lc, com-server_highspeed_lc_firmware, com-server_highspeed_oem, com-server_highspeed_oem_firmware, com-server_highspeed_office_1port
CVE-2022-42787 (published 2022-11-10)
Multiple W&T products of the Comserver Series use a small number space for allocating sessions ids. After login of an user an unathenticated remote attacker can brute force the users session id and get access to his account on the the device. As the user needs to log in for the attack to be successful a user interaction is required.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-330
Affected vendors: wut
Affected products: at-modem-emulator, at-modem-emulator_firmware, com-server_20ma, com-server_20ma_firmware, com-server_\+\+, com-server_\+\+_firmware, com-server_highspeed_100basefx, com-server_highspeed_100basefx_firmware, com-server_highspeed_100baselx, com-server_highspeed_100baselx_firmware, com-server_highspeed_19\"_1port, com-server_highspeed_19\"_1port_firmware, com-server_highspeed_19\"_4port, com-server_highspeed_19\"_4port_firmware, com-server_highspeed_compact, com-server_highspeed_compact_firmware, com-server_highspeed_industry, com-server_highspeed_industry_firmware, com-server_highspeed_isolated, com-server_highspeed_isolated_firmware, com-server_highspeed_lc, com-server_highspeed_lc_firmware, com-server_highspeed_oem, com-server_highspeed_oem_firmware, com-server_highspeed_office_1port
CVE-2022-42788 (published 2022-11-01)
A permissions issue existed. This issue was addressed with improved permission validation. This issue is fixed in macOS Ventura 13. A malicious application may be able to read sensitive location information.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Weakness: CWE-863
Affected vendors: apple
Affected products: macos
CVE-2022-42789 (published 2022-11-01)
An issue in code signature validation was addressed with improved checks. This issue is fixed in macOS Big Sur 11.7, macOS Ventura 13, macOS Monterey 12.6. An app may be able to access user-sensitive data.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Affected vendors: apple
Affected products: macos
CVE-2022-4279 (published 2022-12-03)
A vulnerability classified as problematic has been found in SourceCodester Human Resource Management System 1.0. Affected is an unknown function of the file /hrm/employeeview.php. The manipulation of the argument search leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-214776.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-707
Affected vendors: oretnom23
Affected products: human_resource_management_system
CVE-2022-42790 (published 2022-11-01)
A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.7, macOS Ventura 13, iOS 16, iOS 15.7 and iPadOS 15.7, macOS Monterey 12.6. A user may be able to view restricted content from the lock screen.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Affected vendors: apple
Affected products: ipados, iphone_os, macos
CVE-2022-42791 (published 2022-11-01)
A race condition was addressed with improved state handling. This issue is fixed in macOS Ventura 13. An app may be able to execute arbitrary code with kernel privileges.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-362
Affected vendors: apple
Affected products: iphone_os, macos
CVE-2022-42792 (published 2023-06-23)
This issue was addressed with improved data protection. This issue is fixed in iOS 16.1 and iPadOS 16. An app may be able to read sensitive location information
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Weakness: CWE-203
Affected vendors: apple
Affected products: ipados, iphone_os
CVE-2022-42793 (published 2022-11-01)
An issue in code signature validation was addressed with improved checks. This issue is fixed in macOS Big Sur 11.7, macOS Ventura 13, iOS 16, iOS 15.7 and iPadOS 15.7, macOS Monterey 12.6. An app may be able to bypass code signing checks.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Weakness: CWE-347
Affected vendors: apple
Affected products: ipados, iphone_os, macos
CVE-2022-42795 (published 2022-11-01)
A memory consumption issue was addressed with improved memory handling. This issue is fixed in tvOS 16, iOS 16, macOS Ventura 13, watchOS 9. Processing a maliciously crafted image may lead to arbitrary code execution.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: apple
Affected products: iphone_os, macos, tvos, watchos
CVE-2022-42796 (published 2022-11-01)
This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 15.7 and iPadOS 15.7, macOS Ventura 13. An app may be able to gain elevated privileges.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-269
Affected vendors: apple
Affected products: ipados, iphone_os, macos
CVE-2022-42797 (published 2023-02-27)
An injection issue was addressed with improved input validation. This issue is fixed in Xcode 14.1. An app may be able to gain root privileges.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-74
Affected vendors: apple
Affected products: xcode
CVE-2022-42798 (published 2022-11-01)
The issue was addressed with improved memory handling. This issue is fixed in tvOS 16.1, iOS 15.7.1 and iPadOS 15.7.1, macOS Ventura 13, watchOS 9.1, iOS 16.1 and iPadOS 16, macOS Monterey 12.6.1, macOS Big Sur 11.7.1. Parsing a maliciously crafted audio file may lead to disclosure of user information.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Weakness: CWE-119
Affected vendors: apple
Affected products: ipados, iphone_os, macos, tvos, watchos
CVE-2022-42799 (published 2022-11-01)
The issue was addressed with improved UI handling. This issue is fixed in tvOS 16.1, macOS Ventura 13, watchOS 9.1, Safari 16.1, iOS 16.1 and iPadOS 16. Visiting a malicious website may lead to user interface spoofing.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-1021
Affected vendors: apple, debian, fedoraproject
Affected products: debian_linux, fedora, ipados, iphone_os, macos, safari, tvos, watchos
CVE-2022-4280 (published 2022-12-03)
A vulnerability, which was classified as problematic, has been found in Dot Tech Smart Campus System. Affected by this issue is some unknown functionality of the file /services/Card/findUser. The manipulation leads to information disclosure. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-214778 is the identifier assigned to this vulnerability.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-266
Affected vendors: dottech
Affected products: smart_campus_system
CVE-2022-42800 (published 2022-11-01)
This issue was addressed with improved checks. This issue is fixed in iOS 15.7.1 and iPadOS 15.7.1, macOS Ventura 13, watchOS 9.1, iOS 16.1 and iPadOS 16, macOS Monterey 12.6.1, macOS Big Sur 11.7.1. A user may be able to cause unexpected app termination or arbitrary code execution.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: apple
Affected products: ipados, iphone_os, macos, watchos
CVE-2022-42801 (published 2022-11-01)
A logic issue was addressed with improved checks. This issue is fixed in tvOS 16.1, iOS 15.7.1 and iPadOS 15.7.1, macOS Ventura 13, watchOS 9.1, iOS 16.1 and iPadOS 16, macOS Monterey 12.6.1. An app may be able to execute arbitrary code with kernel privileges.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-693
Affected vendors: apple
Affected products: ipados, iphone_os, macos, tvos, watchos
CVE-2022-42803 (published 2022-11-01)
A race condition was addressed with improved locking. This issue is fixed in tvOS 16.1, iOS 15.7.1 and iPadOS 15.7.1, macOS Ventura 13, watchOS 9.1, iOS 16.1 and iPadOS 16, macOS Monterey 12.6.1. An app may be able to execute arbitrary code with kernel privileges.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-362
Affected vendors: apple
Affected products: ipados, iphone_os, macos, tvos, watchos
CVE-2022-42805 (published 2022-12-15)
An integer overflow was addressed with improved input validation. This issue is fixed in iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5. An app may be able to execute arbitrary code with kernel privileges.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-190
Affected vendors: apple
Affected products: ipados, iphone_os, macos
CVE-2022-42806 (published 2022-11-01)
A race condition was addressed with improved locking. This issue is fixed in iOS 16.1 and iPadOS 16, macOS Ventura 13. An app may be able to execute arbitrary code with kernel privileges.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-362
Affected vendors: apple
Affected products: ipados, iphone_os, macos
CVE-2022-42807 (published 2023-06-23)
A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13. A user may accidentally add a participant to a Shared Album by pressing the Delete key
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
Weakness: CWE-640
Affected vendors: apple
Affected products: macos
CVE-2022-42808 (published 2022-11-01)
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in tvOS 16.1, iOS 16.1 and iPadOS 16, macOS Ventura 13, watchOS 9.1. A remote user may be able to cause kernel code execution.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: apple
Affected products: ipados, iphone_os, macos, tvos, watchos
CVE-2022-42809 (published 2022-11-01)
The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13. Processing a maliciously crafted gcx file may lead to unexpected app termination or arbitrary code execution.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: apple
Affected products: macos
CVE-2022-4281 (published 2022-12-05)
A vulnerability has been found in Facepay 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /face-recognition-php/facepay-master/camera.php. The manipulation of the argument userId leads to authorization bypass. The attack can be launched remotely. The identifier VDB-214789 was assigned to this vulnerability.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-266
Affected vendors: facepay_project
Affected products: facepay
CVE-2022-42810 (published 2022-11-01)
The issue was addressed with improved memory handling. This issue is fixed in iOS 15.7.1 and iPadOS 15.7.1, tvOS 16.1, iOS 16.1 and iPadOS 16, macOS Ventura 13. Processing a maliciously crafted USD file may disclose memory contents.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: apple
Affected products: ipados, iphone_os, macos, tvos
CVE-2022-42811 (published 2022-11-01)
An access issue was addressed with additional sandbox restrictions. This issue is fixed in tvOS 16.1, iOS 16.1 and iPadOS 16, macOS Ventura 13, watchOS 9.1. An app may be able to access user-sensitive data.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Weakness: CWE-284
Affected vendors: apple
Affected products: ipados, iphone_os, macos, tvos, watchos
CVE-2022-42813 (published 2022-11-01)
A certificate validation issue existed in the handling of WKWebView. This issue was addressed with improved validation. This issue is fixed in tvOS 16.1, iOS 16.1 and iPadOS 16, macOS Ventura 13, watchOS 9.1. Processing a maliciously crafted certificate may lead to arbitrary code execution.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-295
Affected vendors: apple
Affected products: ipados, iphone_os, macos, tvos, watchos
CVE-2022-42814 (published 2022-11-01)
A logic issue was addressed with improved checks. This issue is fixed in macOS Ventura 13. An app may be able to access user-sensitive data.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Weakness: CWE-284
Affected vendors: apple
Affected products: macos
CVE-2022-42815 (published 2022-11-01)
This issue was addressed with improved data protection. This issue is fixed in macOS Ventura 13. An app may be able to access user-sensitive data.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: apple
Affected products: macos
CVE-2022-42816 (published 2024-01-10)
A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13. An app may be able to modify protected parts of the file system.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Weakness: CWE-284
Affected vendors: apple
Affected products: macos
CVE-2022-42817 (published 2022-11-01)
A logic issue was addressed with improved state management. This issue is fixed in iOS 15.7.1 and iPadOS 15.7.1, iOS 16.1 and iPadOS 16, watchOS 9.1. Visiting a maliciously crafted website may leak sensitive data.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: apple
Affected products: ipados, iphone_os, watchos
CVE-2022-42818 (published 2022-11-01)
This issue was addressed with improved data protection. This issue is fixed in macOS Ventura 13. A user in a privileged network position may be able to track user activity.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: apple
Affected products: macos
CVE-2022-42819 (published 2022-11-01)
An access issue was addressed with improved access restrictions. This issue is fixed in macOS Big Sur 11.7, macOS Ventura 13, macOS Monterey 12.6. An app may be able to read sensitive location information.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: apple
Affected products: macos
CVE-2022-4282 (published 2022-12-05)
A vulnerability was found in SpringBootCMS and classified as critical. Affected by this issue is some unknown functionality of the component Template Management. The manipulation leads to injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-214790 is the identifier assigned to this vulnerability.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-707
Affected vendors: jrecms
Affected products: springbootcms
CVE-2022-42820 (published 2022-11-01)
A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 16.1 and iPadOS 16, macOS Ventura 13. An app may cause unexpected app termination or arbitrary code execution.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: apple
Affected products: ipados, iphone_os, macos
CVE-2022-42821 (published 2022-12-15)
A logic issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.6.2, macOS Big Sur 11.7.2, macOS Ventura 13. An app may bypass Gatekeeper checks.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Weakness: CWE-693
Affected vendors: apple
Affected products: macos
CVE-2022-42823 (published 2022-11-01)
A type confusion issue was addressed with improved memory handling. This issue is fixed in tvOS 16.1, macOS Ventura 13, watchOS 9.1, Safari 16.1, iOS 16.1 and iPadOS 16. Processing maliciously crafted web content may lead to arbitrary code execution.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-843
Affected vendors: apple, debian, fedoraproject
Affected products: debian_linux, fedora, ipados, iphone_os, macos, safari, tvos, watchos
CVE-2022-42824 (published 2022-11-01)
A logic issue was addressed with improved state management. This issue is fixed in tvOS 16.1, macOS Ventura 13, watchOS 9.1, Safari 16.1, iOS 16.1 and iPadOS 16. Processing maliciously crafted web content may disclose sensitive user information.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Affected vendors: apple, debian, fedoraproject
Affected products: debian_linux, fedora, ipados, iphone_os, macos, safari, tvos, watchos
CVE-2022-42825 (published 2022-11-01)
This issue was addressed by removing additional entitlements. This issue is fixed in tvOS 16.1, macOS Ventura 13, watchOS 9.1, iOS 16.1 and iPadOS 16, macOS Monterey 12.6.1, macOS Big Sur 11.7.1. An app may be able to modify protected parts of the file system.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Weakness: CWE-266
Affected vendors: apple
Affected products: ipados, iphone_os, macos, tvos, watchos
CVE-2022-42826 (published 2023-02-27)
A use after free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13, iOS 16.1 and iPadOS 16, Safari 16.1. Processing maliciously crafted web content may lead to arbitrary code execution.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: apple, webkitgtk
Affected products: ipados, iphone_os, macos, safari, webkitgtk\+
CVE-2022-42827 (published 2022-11-01)
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.7.1 and iPadOS 15.7.1, iOS 16.1 and iPadOS 16. An application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited..
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: apple
Affected products: ipados, iphone_os
Added to CISA KEV catalog: 2022-10-25
KEV required action: Apply updates per vendor instructions.
CVE-2022-42828 (published 2023-08-14)
The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13. An app may be able to execute arbitrary code with kernel privileges.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Affected vendors: apple
Affected products: macos
CVE-2022-42829 (published 2022-11-01)
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 16.1 and iPadOS 16, macOS Ventura 13. An app with root privileges may be able to execute arbitrary code with kernel privileges.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: apple
Affected products: ipados, iphone_os, macos
CVE-2022-4283 (published 2022-12-14)
A vulnerability was found in X.Org. This security flaw occurs because the XkbCopyNames function left a dangling pointer to freed memory, resulting in out-of-bounds memory access on subsequent XkbGetKbdByName requests.. This issue can lead to local privileges elevation on systems where the X server is running privileged and remote code execution for ssh X forwarding sessions.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: debian, fedoraproject, redhat, x.org
Affected products: debian_linux, enterprise_linux, fedora, x_server
CVE-2022-42830 (published 2022-11-01)
The issue was addressed with improved memory handling. This issue is fixed in iOS 16.1 and iPadOS 16, macOS Ventura 13. An app with root privileges may be able to execute arbitrary code with kernel privileges.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: apple
Affected products: ipados, iphone_os, macos
CVE-2022-42831 (published 2022-11-01)
A race condition was addressed with improved locking. This issue is fixed in iOS 16.1 and iPadOS 16, macOS Ventura 13. An app with root privileges may be able to execute arbitrary code with kernel privileges.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-362
Affected vendors: apple
Affected products: ipados, iphone_os, macos
CVE-2022-42832 (published 2022-11-01)
A race condition was addressed with improved locking. This issue is fixed in iOS 16.1 and iPadOS 16, macOS Ventura 13. An app with root privileges may be able to execute arbitrary code with kernel privileges.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-362
Affected vendors: apple
Affected products: ipados, iphone_os, macos
CVE-2022-42833 (published 2023-02-27)
An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Ventura 13. An app may be able to execute arbitrary code with kernel privileges.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-125
Affected vendors: apple
Affected products: macos
CVE-2022-42834 (published 2023-06-23)
An access issue was addressed with improved access restrictions. This issue is fixed in macOS Monterey 12.6.3, macOS Ventura 13, macOS Big Sur 11.7.3. An app may be able to access mail folder attachments through a temporary directory used during compression
Severity: LOW (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)
Weakness: CWE-552
Affected vendors: apple
Affected products: macos
CVE-2022-42837 (published 2022-12-15)
An issue existed in the parsing of URLs. This issue was addressed with improved input validation. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, watchOS 9.2. A remote user may be able to cause unexpected app termination or arbitrary code execution.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: apple
Affected products: ipados, iphone_os, macos, watchos
CVE-2022-42838 (published 2023-02-27)
An issue with app access to camera data was addressed with improved logic. This issue is fixed in macOS Ventura 13. A camera extension may be able to continue receiving video after the app which activated was closed.
Severity: LOW (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-672
Affected vendors: apple
Affected products: macos
CVE-2022-42839 (published 2024-01-10)
This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1. An app may be able to read sensitive location information.
Severity: LOW (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)
Weakness: CWE-200
Affected vendors: apple
Affected products: ipados, iphone_os, macos
CVE-2022-42840 (published 2022-12-15)
The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.6.2, macOS Ventura 13.1, macOS Big Sur 11.7.2, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2. An app may be able to execute arbitrary code with kernel privileges.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: apple
Affected products: ipados, iphone_os, macos
CVE-2022-42841 (published 2022-12-15)
A type confusion issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.6.2, macOS Ventura 13.1, macOS Big Sur 11.7.2. Processing a maliciously crafted package may lead to arbitrary code execution.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-843
Affected vendors: apple
Affected products: macos
CVE-2022-42842 (published 2022-12-15)
The issue was addressed with improved memory handling. This issue is fixed in tvOS 16.2, macOS Monterey 12.6.2, macOS Ventura 13.1, macOS Big Sur 11.7.2, iOS 16.2 and iPadOS 16.2, watchOS 9.2. A remote user may be able to cause kernel code execution.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: apple
Affected products: ipados, iphone_os, macos, tvos, watchos
CVE-2022-42843 (published 2022-12-15)
This issue was addressed with improved data protection. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1, tvOS 16.2, watchOS 9.2. A user may be able to view sensitive user information.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: apple
Affected products: ipados, iphone_os, macos, tvos, watchos
CVE-2022-42844 (published 2022-12-15)
The issue was addressed with improved memory handling. This issue is fixed in iOS 16.2 and iPadOS 16.2. An app may be able to break out of its sandbox.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: apple
Affected products: ipados, iphone_os
CVE-2022-42845 (published 2022-12-15)
The issue was addressed with improved memory handling. This issue is fixed in tvOS 16.2, macOS Monterey 12.6.2, macOS Ventura 13.1, macOS Big Sur 11.7.2, iOS 16.2 and iPadOS 16.2, watchOS 9.2. An app with root privileges may be able to execute arbitrary code with kernel privileges.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: apple
Affected products: ipados, iphone_os, macos, tvos, watchos
CVE-2022-42846 (published 2022-12-15)
The issue was addressed with improved memory handling. This issue is fixed in iOS 16.2 and iPadOS 16.2, iOS 15.7.2 and iPadOS 15.7.2. Parsing a maliciously crafted video file may lead to unexpected system termination.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-119
Affected vendors: apple
Affected products: ipados, iphone_os
CVE-2022-42847 (published 2022-12-15)
An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in macOS Ventura 13.1. An app may be able to execute arbitrary code with kernel privileges.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: apple
Affected products: macos
CVE-2022-42848 (published 2022-12-15)
A logic issue was addressed with improved checks. This issue is fixed in iOS 16.2 and iPadOS 16.2, iOS 15.7.2 and iPadOS 15.7.2, tvOS 16.2. An app may be able to execute arbitrary code with kernel privileges.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-693
Affected vendors: apple
Affected products: ipados, iphone_os, tvos
CVE-2022-42849 (published 2022-12-15)
An access issue existed with privileged API calls. This issue was addressed with additional restrictions. This issue is fixed in iOS 16.2 and iPadOS 16.2, tvOS 16.2, watchOS 9.2. A user may be able to elevate privileges.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-269
Affected vendors: apple
Affected products: ipados, iphone_os, tvos, watchos
CVE-2022-4285 (published 2023-01-27)
An illegal memory access flaw was found in the binutils package. Parsing an ELF file containing corrupt symbol version information may result in a denial of service. This issue is the result of an incomplete fix for CVE-2020-16599.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-476
Affected vendors: fedoraproject, gnu, redhat
Affected products: binutils, enterprise_linux, fedora
CVE-2022-42850 (published 2022-12-15)
The issue was addressed with improved memory handling. This issue is fixed in iOS 16.2 and iPadOS 16.2. An app may be able to execute arbitrary code with kernel privileges.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: apple
Affected products: ipados, iphone_os
CVE-2022-42851 (published 2022-12-15)
The issue was addressed with improved memory handling. This issue is fixed in iOS 16.2 and iPadOS 16.2, tvOS 16.2. Parsing a maliciously crafted TIFF file may lead to disclosure of user information.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Weakness: CWE-125
Affected vendors: apple
Affected products: ipados, iphone_os, tvos
CVE-2022-42852 (published 2022-12-15)
The issue was addressed with improved memory handling. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may result in the disclosure of process memory.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: apple
Affected products: ipados, iphone_os, macos, safari, tvos, watchos
CVE-2022-42853 (published 2022-12-15)
An access issue was addressed with improved access restrictions. This issue is fixed in macOS Ventura 13.1. An app may be able to modify protected parts of the file system.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Weakness: CWE-284
Affected vendors: apple
Affected products: macos