alirezaaminzadeh/cve-riskrank huggingface dataset:
CVE-2022-24402 (published 2023-10-19)
The TETRA TEA1 keystream generator implements a key register initialization function that compresses the 80-bit key to only 32 bits for usage during the keystream generation phase, which is insufficient to safeguard against exhaustive search attacks.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-334
Affected vendors: midnightblue
Affected products: tetra\
CVE-2022-24403 (published 2023-12-05)
The TETRA TA61 identity encryption function internally uses a 64-bit value derived exclusively from the SCK (Class 2 networks) or CCK (Class 3 networks). The structure of TA61 allows for efficient recovery of this 64-bit value, allowing an adversary to encrypt or decrypt arbitrary identities given only three known encrypted/unencrypted identity pairs.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-327
Affected vendors: midnightblue
Affected products: tetra\
CVE-2022-24404 (published 2023-10-19)
Lack of cryptographic integrity check on TETRA air-interface encrypted traffic. Since a stream cipher is employed, this allows an active adversary to manipulate cleartext data in a bit-by-bit fashion.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-353
Affected vendors: midnightblue
Affected products: tetra\
CVE-2022-24405 (published 2022-07-27)
OX App Suite through 7.10.6 allows OS Command Injection via a serialized Java class to the Documentconverter API.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: open-xchange
Affected products: ox_app_suite
CVE-2022-24406 (published 2022-07-27)
OX App Suite through 7.10.6 allows SSRF because multipart/form-data boundaries are predictable, and this can lead to injection into internal Documentconverter API calls.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-330
Affected vendors: open-xchange
Affected products: ox_app_suite
CVE-2022-24407 (published 2022-02-24)
In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT or UPDATE statement.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: cyrusimap, debian, fedoraproject, netapp, oracle
Affected products: active_iq_unified_manager, communications_cloud_native_core_console, communications_cloud_native_core_network_function_cloud_native_environment, communications_cloud_native_core_security_edge_protection_proxy, cyrus-sasl, debian_linux, fedora, ontap_select_deploy_administration_utility
CVE-2022-24408 (published 2022-03-08)
A vulnerability has been identified in SINUMERIK MC (All versions < V1.15 SP1), SINUMERIK ONE (All versions < V6.15 SP1). The sc SUID binary on affected devices provides several commands that are used to execute system commands or modify system files. A specific set of operations using sc could allow local attackers to escalate their privileges to root.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-269
Affected vendors: siemens
Affected products: sinumerik_mc, sinumerik_mc_firmware, sinumerik_one, sinumerik_one_firmware
CVE-2022-24409 (published 2022-02-23)
Dell BSAFE SSL-J contains remediation for a covert timing channel vulnerability that may be exploited by malicious users to compromise the affected system. Only customers with active BSAFE maintenance contracts can receive details about this vulnerability. Public disclosure of the vulnerability details will be shared at a later date.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-385
Affected vendors: dell
Affected products: bsafe_ssl-j
CVE-2022-2441 (published 2023-10-20)
The ImageMagick Engine plugin for WordPress is vulnerable to remote code execution via the 'cli_path' parameter in versions up to, and including 1.7.5. This makes it possible for unauthenticated users to run arbitrary commands leading to remote command execution, granted they can trick a site administrator into performing an action such as clicking on a link. This makes it possible for an attacker to create and or modify files hosted on the server which can easily grant attackers backdoor access to the affected server.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: orangelab
Affected products: imagemagick_engine
CVE-2022-24410 (published 2023-02-10)

Dell BIOS contains an information exposure vulnerability. An unauthenticated local attacker with physical access to the system and knowledge of the system configuration could potentially exploit this vulnerability to read system information via debug interfaces.


Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: dell
Affected products: alienware_13_r2, alienware_13_r2_firmware, alienware_13_r3, alienware_13_r3_firmware, alienware_15_r2, alienware_15_r2_firmware, alienware_15_r3, alienware_15_r3_firmware, alienware_15_r4, alienware_15_r4_firmware, alienware_17_r3, alienware_17_r3_firmware, alienware_17_r4, alienware_17_r4_firmware, alienware_17_r5, alienware_17_r5_firmware, alienware_area_51m_r1, alienware_area_51m_r1_firmware, alienware_area_51m_r2, alienware_area_51m_r2_firmware, alienware_aurora_r11, alienware_aurora_r11_firmware, alienware_aurora_r7, alienware_aurora_r7_firmware, alienware_aurora_r8
CVE-2022-24411 (published 2022-04-12)
Dell PowerScale OneFS 8.2.2 and above contain an elevation of privilege vulnerability. A local attacker with ISI_PRIV_LOGIN_SSH and/or ISI_PRIV_LOGIN_CONSOLE could potentially exploit this vulnerability, leading to elevation of privilege. This could potentially allow users to circumvent PowerScale Compliance Mode guarantees.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-378
Affected vendors: dell
Affected products: emc_powerscale_onefs
CVE-2022-24412 (published 2022-04-12)
Dell EMC PowerScale OneFS 8.2.x - 9.3.0.x contain an improper handling of value vulnerability. An unprivileged network attacker could potentially exploit this vulnerability, leading to denial-of-service.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-229
Affected vendors: dell
Affected products: emc_powerscale_onefs
CVE-2022-24413 (published 2022-04-12)
Dell PowerScale OneFS, versions 8.2.2-9.3.x, contain a time-of-check-to-time-of-use vulnerability. A local user with access to the filesystem could potentially exploit this vulnerability, leading to data loss.
Severity: LOW (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L)
Weakness: CWE-367
Affected vendors: dell
Affected products: emc_powerscale_onefs
CVE-2022-24414 (published 2022-05-26)
Dell EMC CloudLink 7.1.3 and all earlier versions, Auth Token is exposed in GET requests. These request parameters can get logged in reverse proxies and server logs. Attackers may potentially use these tokens to access CloudLink server. Tokens should not be used in request URL to avoid such attacks.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-598
Affected vendors: dell
Affected products: cloudlink
CVE-2022-24415 (published 2022-03-11)
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution during SMM.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: dell
Affected products: alienware_13_r3, alienware_13_r3_firmware, alienware_15_r3, alienware_15_r3_firmware, alienware_15_r4, alienware_15_r4_firmware, alienware_17_r4, alienware_17_r4_firmware, alienware_17_r5, alienware_17_r5_firmware, alienware_area_51m_r1, alienware_area_51m_r1_firmware, alienware_area_51m_r2, alienware_area_51m_r2_firmware, alienware_aurora_r8, alienware_aurora_r8_firmware, alienware_m15_r2, alienware_m15_r2_firmware, alienware_m15_r3, alienware_m15_r3_firmware, alienware_m15_r4, alienware_m15_r4_firmware, alienware_m17_r2, alienware_m17_r2_firmware, alienware_m17_r3
CVE-2022-24416 (published 2022-03-11)
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution during SMM.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: dell
Affected products: alienware_13_r3, alienware_13_r3_firmware, alienware_15_r3, alienware_15_r3_firmware, alienware_15_r4, alienware_15_r4_firmware, alienware_17_r4, alienware_17_r4_firmware, alienware_17_r5, alienware_17_r5_firmware, alienware_area_51m_r1, alienware_area_51m_r1_firmware, alienware_area_51m_r2, alienware_area_51m_r2_firmware, alienware_aurora_r8, alienware_aurora_r8_firmware, alienware_m15_r2, alienware_m15_r2_firmware, alienware_m15_r3, alienware_m15_r3_firmware, alienware_m15_r4, alienware_m15_r4_firmware, alienware_m17_r2, alienware_m17_r2_firmware, alienware_m17_r3
CVE-2022-24417 (published 2022-05-26)
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution during SMM.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: dell
Affected products: dell_g5_5505, dell_g5_5505_firmware, inspiron_22-3275, inspiron_22-3275_firmware, inspiron_24-3475, inspiron_24-3475_firmware, inspiron_27_7775, inspiron_27_7775_firmware, inspiron_3180, inspiron_3180_firmware, inspiron_3185, inspiron_3185_firmware, inspiron_3195, inspiron_3195_firmware, inspiron_3505, inspiron_3505_firmware, inspiron_3515, inspiron_3515_firmware, inspiron_3585, inspiron_3585_firmware, inspiron_3595, inspiron_3595_firmware, inspiron_3785, inspiron_3785_firmware, inspiron_5405
CVE-2022-24418 (published 2022-05-26)
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution during SMM.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: dell
Affected products: dell_g5_5505, dell_g5_5505_firmware, inspiron_22-3275, inspiron_22-3275_firmware, inspiron_24-3475, inspiron_24-3475_firmware, inspiron_27_7775, inspiron_27_7775_firmware, inspiron_3180, inspiron_3180_firmware, inspiron_3185, inspiron_3185_firmware, inspiron_3195, inspiron_3195_firmware, inspiron_3505, inspiron_3505_firmware, inspiron_3515, inspiron_3515_firmware, inspiron_3585, inspiron_3585_firmware, inspiron_3595, inspiron_3595_firmware, inspiron_3785, inspiron_3785_firmware, inspiron_5405
CVE-2022-24419 (published 2022-03-11)
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution during SMM.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: dell
Affected products: alienware_13_r3, alienware_13_r3_firmware, alienware_15_r3, alienware_15_r3_firmware, alienware_15_r4, alienware_15_r4_firmware, alienware_17_r4, alienware_17_r4_firmware, alienware_17_r5, alienware_17_r5_firmware, alienware_area_51m_r1, alienware_area_51m_r1_firmware, alienware_area_51m_r2, alienware_area_51m_r2_firmware, alienware_aurora_r8, alienware_aurora_r8_firmware, alienware_m15_r2, alienware_m15_r2_firmware, alienware_m15_r3, alienware_m15_r3_firmware, alienware_m15_r4, alienware_m15_r4_firmware, alienware_m17_r2, alienware_m17_r2_firmware, alienware_m17_r3
CVE-2022-2442 (published 2022-09-06)
The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to deserialization of untrusted input via the   'path' parameter in versions up to, and including 0.9.74. This makes it possible for authenticated attackers with administrative privileges to call files using a PHAR wrapper that will deserialize and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacker is successful in uploading a file with the serialized payload.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-502
Affected vendors: wpvivid
Affected products: migration\,_backup\,_staging
CVE-2022-24420 (published 2022-03-11)
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution during SMM.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: dell
Affected products: alienware_13_r3, alienware_13_r3_firmware, alienware_15_r3, alienware_15_r3_firmware, alienware_15_r4, alienware_15_r4_firmware, alienware_17_r4, alienware_17_r4_firmware, alienware_17_r5, alienware_17_r5_firmware, alienware_area_51m_r1, alienware_area_51m_r1_firmware, alienware_area_51m_r2, alienware_area_51m_r2_firmware, alienware_aurora_r8, alienware_aurora_r8_firmware, alienware_m15_r2, alienware_m15_r2_firmware, alienware_m15_r3, alienware_m15_r3_firmware, alienware_m15_r4, alienware_m15_r4_firmware, alienware_m17_r2, alienware_m17_r2_firmware, alienware_m17_r3
CVE-2022-24421 (published 2022-03-11)
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution during SMM.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: dell
Affected products: alienware_13_r3, alienware_13_r3_firmware, alienware_15_r3, alienware_15_r3_firmware, alienware_15_r4, alienware_15_r4_firmware, alienware_17_r4, alienware_17_r4_firmware, alienware_17_r5, alienware_17_r5_firmware, alienware_area_51m_r1, alienware_area_51m_r1_firmware, alienware_area_51m_r2, alienware_area_51m_r2_firmware, alienware_aurora_r8, alienware_aurora_r8_firmware, alienware_m15_r2, alienware_m15_r2_firmware, alienware_m15_r3, alienware_m15_r3_firmware, alienware_m15_r4, alienware_m15_r4_firmware, alienware_m17_r2, alienware_m17_r2_firmware, alienware_m17_r3
CVE-2022-24422 (published 2022-05-26)
Dell iDRAC9 versions 5.00.00.00 and later but prior to 5.10.10.00, contain an improper authentication vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability to gain access to the VNC Console.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-287
Affected vendors: dell
Affected products: idrac9
CVE-2022-24423 (published 2022-04-21)
Dell iDRAC8 versions prior to 2.83.83.83 contain a denial of service vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to cause resource exhaustion in the webserver, resulting in a denial of service condition.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-20
Affected vendors: dell
Affected products: integrated_dell_remote_access_controller_8, integrated_dell_remote_access_controller_8_firmware
CVE-2022-24424 (published 2022-04-21)
Dell EMC AppSync versions from 3.9 to 4.3 contain a path traversal vulnerability in AppSync server. A remote unauthenticated attacker may potentially exploit this vulnerability to gain unauthorized read access to the files stored on the server filesystem, with the privileges of the running web application.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-22
Affected vendors: dell
Affected products: emc_appsync
CVE-2022-24426 (published 2022-04-01)
Dell Command | Update, Dell Update, and Alienware Update version 4.4.0 contains a Local Privilege Escalation Vulnerability in the Advanced Driver Restore component. A local malicious user could potentially exploit this vulnerability, leading to privilege escalation.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-427
Affected vendors: dell
Affected products: alienware_update, command_update, update
CVE-2022-24428 (published 2022-04-08)
Dell PowerScale OneFS, versions 8.2.x, 9.0.0.x, 9.1.0.x, 9.2.0.x, 9.2.1.x, and 9.3.0.x, contain an improper preservation of privileges. A remote filesystem user with a local account could potentially exploit this vulnerability, leading to an escalation of file privileges and information disclosure.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-281
Affected vendors: dell
Affected products: emc_powerscale_onefs
CVE-2022-24429 (published 2022-06-10)
The package convert-svg-core before 0.6.3 are vulnerable to Arbitrary Code Injection when using a specially crafted SVG file. An attacker can read arbitrary files from the file system and then show the file content as a converted PNG file.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-94
Affected vendors: convert-svg-core_project
Affected products: convert-svg-core
CVE-2022-2443 (published 2022-07-18)
The FreeMind WP Browser plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.2. This is due to missing nonce protection on the FreemindOptions() function found in the ~/freemind-wp-browser.php file. This makes it possible for unauthenticated attackers to inject malicious web scripts into the page, granted they can trick a site's administrator into performing an action such as clicking on a link.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: freemind_wp_browser_project
Affected products: freemind_wp_browser
CVE-2022-24431 (published 2022-12-21)
All versions of package abacus-ext-cmdline are vulnerable to Command Injection via the execute function due to improper user-input sanitization.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: abacus-ext-cmdline_project
Affected products: abacus-ext-cmdline
CVE-2022-24432 (published 2022-03-10)
Persistent cross-site scripting (XSS) in the web interface of ipDIO allows an authenticated remote attacker to introduce arbitrary JavaScript by injecting an XSS payload into specific fields. The XSS payload will be executed when a legitimate user attempts to upload, copy, download, or delete an existing configuration (Administrative Services).
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: ipcomm
Affected products: ipdio, ipdio_firmware
CVE-2022-24433 (published 2022-03-11)
The package simple-git before 3.3.0 are vulnerable to Command Injection via argument injection. When calling the .fetch(remote, branch, handlerFn) function, both the remote and branch parameters are passed to the git fetch subcommand. By injecting some git options it was possible to get arbitrary command execution.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-88
Affected vendors: simple-git_project
Affected products: simple-git
CVE-2022-24434 (published 2022-05-20)
This affects all versions of package dicer. A malicious attacker can send a modified form to server, and crash the nodejs service. An attacker could sent the payload again and again so that the service continuously crashes.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Affected vendors: dicer_project
Affected products: dicer
CVE-2022-24435 (published 2022-02-24)
Cross-site scripting vulnerability in phpUploader v1.2 and earlier allows a remote unauthenticated attacker to inject an arbitrary script via unspecified vectors.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: phpuploader_project
Affected products: phpuploader
CVE-2022-24436 (published 2022-06-15)
Observable behavioral in power management throttling for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via network access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-203
Affected vendors: intel
Affected products: *
CVE-2022-24437 (published 2022-05-01)
The package git-pull-or-clone before 2.0.2 are vulnerable to Command Injection due to the use of the --upload-pack feature of git which is also supported for git clone. The source includes the use of the secure child process API spawn(). However, the outpath parameter passed to it may be a command-line argument to the git clone command and result in arbitrary command injection.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-88
Affected vendors: git-pull-or-clone_project
Affected products: git-pull-or-clone
CVE-2022-24439 (published 2022-12-06)
All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to git without sufficient sanitization of input arguments.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: debian, fedoraproject, gitpython_project
Affected products: debian_linux, fedora, gitpython
CVE-2022-2444 (published 2022-07-18)
The Visualizer: Tables and Charts Manager for WordPress plugin for WordPress is vulnerable to deserialization of untrusted input via the 'remote_data' parameter in versions up to, and including 3.7.9. This makes it possible for authenticated attackers with contributor privileges and above to call files using a PHAR wrapper that will deserialize the data and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacker is successful in uploading a file with the serialized payload.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-502
Affected vendors: themeisle
Affected products: visualizer
CVE-2022-24440 (published 2022-04-01)
The package cocoapods-downloader before 1.6.0, from 1.6.2 and before 1.6.3 are vulnerable to Command Injection via git argument injection. When calling the Pod::Downloader.preprocess_options function and using git, both the git and branch parameters are passed to the git ls-remote subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-88
Affected vendors: cocoapods
Affected products: cocoapods-downloader
CVE-2022-24441 (published 2022-11-30)
The package snyk before 1.1064.0 are vulnerable to Code Injection when analyzing a project. An attacker who can convince a user to scan a malicious project can include commands in a build file such as build.gradle or gradle-wrapper.jar, which will be executed with the privileges of the application. This vulnerability may be triggered when running the the CLI tool directly, or when running a scan with one of the IDE plugins that invoke the Snyk CLI. Successful exploitation of this issue would likely require some level of social engineering - to coerce an untrusted project to be downloaded and analyzed via the Snyk CLI or opened in an IDE where a Snyk IDE plugin is installed and enabled. Additionally, if the IDE has a Trust feature then the target folder must be marked as ‘trusted’ in order to be vulnerable. **NOTE:** This issue is independent of the one reported in [CVE-2022-40764](https://security.snyk.io/vuln/SNYK-JS-SNYK-3037342), and upgrading to a fixed version for this addresses that issue as well. The affected IDE plugins and versions are: - VS Code - Affected: <=1.8.0, Fixed: 1.9.0 - IntelliJ - Affected: <=2.4.47, Fixed: 2.4.48 - Visual Studio - Affected: <=1.1.30, Fixed: 1.1.31 - Eclipse - Affected: <=v20221115.132308, Fixed: All subsequent versions - Language Server - Affected: <=v20221109.114426, Fixed: All subsequent versions
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: snyk
Affected products: snyk_cli, snyk_language_server, snyk_security
CVE-2022-24442 (published 2022-02-25)
JetBrains YouTrack before 2021.4.40426 was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-94
Affected vendors: jetbrains
Affected products: youtrack
CVE-2022-24444 (published 2022-06-28)
Silverstripe silverstripe/framework through 4.10 allows Session Fixation.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
Weakness: CWE-384
Affected vendors: silverstripe
Affected products: silverstripe
CVE-2022-24446 (published 2022-03-01)
An issue was discovered in Zoho ManageEngine Key Manager Plus 6.1.6. A user, with the level Operator, can see all SSH servers (and user information) even if no SSH server or user is associated to the operator.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Affected vendors: zohocorp
Affected products: manageengine_key_manager_plus
CVE-2022-24447 (published 2022-03-02)
An issue was discovered in Zoho ManageEngine Key Manager Plus before 6200. A service exposed by the application allows a user, with the level Operator, to access stored SSL certificates and associated key pairs during export.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Affected vendors: zohocorp
Affected products: manageengine_key_manager_plus
CVE-2022-24448 (published 2022-02-04)
An issue was discovered in fs/nfs/dir.c in the Linux kernel before 5.16.5. If an application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a regular file is found, ENOTDIR should occur, but the server instead returns uninitialized data in the file descriptor.
Severity: LOW (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-755
Affected vendors: debian, linux
Affected products: debian_linux, linux_kernel
CVE-2022-24449 (published 2022-04-28)
Solar appScreener through 3.10.4, when a valid license is not present, allows XXE and SSRF attacks via a crafted XML document.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-611
Affected vendors: rt-solar
Affected products: solar_appscreener
CVE-2022-24450 (published 2022-02-08)
NATS nats-server before 2.7.2 has Incorrect Access Control. Any authenticated user can obtain the privileges of the System account by misusing the "dynamically provisioned sandbox accounts" feature.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-862
Affected vendors: linuxfoundation, nats
Affected products: nats-server, nats_streaming_server
CVE-2022-24451 (published 2022-03-09)
VP9 Video Extensions Remote Code Execution Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: microsoft
Affected products: vp9_video_extensions
CVE-2022-24452 (published 2022-03-09)
HEVC Video Extensions Remote Code Execution Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: hevc_video_extensions
CVE-2022-24453 (published 2022-03-09)
HEVC Video Extensions Remote Code Execution Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: microsoft
Affected products: hevc_video_extensions
CVE-2022-24454 (published 2022-03-09)
Windows Security Support Provider Interface Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_7, windows_8.1, windows_rt_8.1, windows_server, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019
CVE-2022-24455 (published 2022-03-09)
Windows CD-ROM Driver Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_8.1, windows_rt_8.1, windows_server_2012, windows_server_2016, windows_server_2019
CVE-2022-24456 (published 2022-03-09)
HEVC Video Extensions Remote Code Execution Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: microsoft
Affected products: hevc_video_extensions
CVE-2022-24457 (published 2022-03-09)
HEIF Image Extensions Remote Code Execution Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: microsoft
Affected products: heif_image_extension
CVE-2022-24459 (published 2022-03-09)
Windows Fax and Scan Service Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_7, windows_8.1, windows_rt_8.1, windows_server, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019
CVE-2022-2446 (published 2024-09-13)
The WP Editor plugin for WordPress is vulnerable to deserialization of untrusted input via the 'current_theme_root' parameter in versions up to, and including 1.2.9. This makes it possible for authenticated attackers with administrative privileges to call files using a PHAR wrapper that will deserialize and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacker is successful in uploading a file with the serialized payload.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-502
Affected vendors: benjaminrojas
Affected products: wp_editor
CVE-2022-24460 (published 2022-03-09)
Tablet Windows User Interface Application Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_server, windows_server_2016, windows_server_2019
CVE-2022-24461 (published 2022-03-09)
Microsoft Office Visio Remote Code Execution Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: 365_apps, office, office_long_term_servicing_channel
CVE-2022-24462 (published 2022-03-09)
Microsoft Word Security Feature Bypass Vulnerability
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Affected vendors: microsoft
Affected products: 365_apps, office, office_long_term_servicing_channel
CVE-2022-24463 (published 2022-03-09)
Microsoft Exchange Server Spoofing Vulnerability
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Affected vendors: microsoft
Affected products: exchange_server
CVE-2022-24464 (published 2022-03-09)
.NET and Visual Studio Denial of Service Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-400
Affected vendors: fedoraproject, microsoft
Affected products: .net, .net_core, fedora, visual_studio_2019, visual_studio_2022
CVE-2022-24465 (published 2022-03-09)
Microsoft Intune Portal for iOS Security Feature Bypass Vulnerability
Severity: LOW (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Affected vendors: microsoft
Affected products: intune_company_portal
CVE-2022-24466 (published 2022-05-10)
Windows Hyper-V Security Feature Bypass Vulnerability
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-24467 (published 2022-03-09)
Azure Site Recovery Remote Code Execution Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: azure_site_recovery
CVE-2022-24468 (published 2022-03-09)
Azure Site Recovery Remote Code Execution Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: azure_site_recovery
CVE-2022-24469 (published 2022-03-09)
Azure Site Recovery Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)
Affected vendors: microsoft
Affected products: azure_site_recovery
CVE-2022-2447 (published 2022-09-01)
A flaw was found in Keystone. There is a time lag (up to one hour in a default configuration) between when security policy says a token should be revoked from when it is actually revoked. This could allow a remote administrator to secretly maintain access for longer than expected.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-324
Affected vendors: openstack, redhat
Affected products: keystone, openstack, openstack_platform, quay, storage
CVE-2022-24470 (published 2022-03-09)
Azure Site Recovery Remote Code Execution Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: azure_site_recovery
CVE-2022-24471 (published 2022-03-09)
Azure Site Recovery Remote Code Execution Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: azure_site_recovery
CVE-2022-24472 (published 2022-04-15)
Microsoft SharePoint Server Spoofing Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: sharepoint_foundation, sharepoint_server
CVE-2022-24473 (published 2022-04-15)
Microsoft Excel Remote Code Execution Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: 365_apps, office, office_long_term_servicing_channel
CVE-2022-24474 (published 2022-04-15)
Windows Win32k Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_7, windows_8.1, windows_rt_8.1, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-24475 (published 2022-04-05)
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: edge_chromium
CVE-2022-24477 (published 2022-08-09)
Microsoft Exchange Server Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: exchange_server
CVE-2022-24479 (published 2022-04-15)
Connected User Experiences and Telemetry Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-2448 (published 2022-10-10)
The reSmush.it WordPress plugin before 0.4.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when unfiltered_html is disallowed.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: resmush.it
Affected products: resmush.it_image_optimizer
CVE-2022-24480 (published 2022-12-13)
Outlook for Android Elevation of Privilege Vulnerability
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:P/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: outlook
CVE-2022-24481 (published 2022-04-15)
Windows Common Log File System Driver Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_7, windows_8.1, windows_rt_8.1, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-24482 (published 2022-04-15)
Windows ALPC Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-362
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-24483 (published 2022-04-15)
Windows Kernel Information Disclosure Vulnerability
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_8.1, windows_rt_8.1, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-24484 (published 2022-04-15)
Windows Cluster Shared Volume (CSV) Denial of Service Vulnerability
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Affected vendors: microsoft
Affected products: windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-24485 (published 2022-04-15)
Win32 File Enumeration Remote Code Execution Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_7, windows_8.1, windows_rt_8.1, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-24486 (published 2022-04-15)
Windows Kerberos Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-24487 (published 2022-04-15)
Windows Local Security Authority Subsystem Service (LSASS) Remote Code Execution Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-24488 (published 2022-04-15)
Windows Desktop Bridge Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_server_2016, windows_server_2022
CVE-2022-24489 (published 2022-04-15)
Cluster Client Failover (CCF) Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-2449 (published 2022-11-14)
The reSmush.it : the only free Image Optimizer & compress plugin WordPress plugin before 0.4.4 does not perform CSRF checks for any of its AJAX actions, allowing an attackers to trick logged in users to perform various actions on their behalf on the site.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Weakness: CWE-352
Affected vendors: resmush.it
Affected products: resmush.it_image_optimizer
CVE-2022-24490 (published 2022-04-15)
Windows Hyper-V Shared Virtual Hard Disks Information Disclosure Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Affected vendors: microsoft
Affected products: windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-24491 (published 2022-04-15)
Windows Network File System Remote Code Execution Vulnerability
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_8.1, windows_rt_8.1, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-24492 (published 2022-04-15)
Remote Procedure Call Runtime Remote Code Execution Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_7, windows_8.1, windows_rt_8.1, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-24493 (published 2022-04-15)
Microsoft Local Security Authority (LSA) Server Information Disclosure Vulnerability
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_7, windows_8.1, windows_rt_8.1, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-24494 (published 2022-04-15)
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_7, windows_8.1, windows_rt_8.1, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-24495 (published 2022-04-15)
Windows Direct Show Remote Code Execution Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-24496 (published 2022-04-15)
Windows Local Security Authority (LSA) Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-24497 (published 2022-04-15)
Windows Network File System Remote Code Execution Vulnerability
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_8.1, windows_rt_8.1, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-24498 (published 2022-04-15)
Windows iSCSI Target Service Information Disclosure Vulnerability
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_7, windows_8.1, windows_rt_8.1, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-24499 (published 2022-04-15)
Windows Installer Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_7, windows_8.1, windows_rt_8.1, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-2450 (published 2022-11-14)
The reSmush.it : the only free Image Optimizer & compress plugin WordPress plugin before 0.4.4 lacks authorization in various AJAX actions, allowing any logged-in users, such as subscribers to call them.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
Weakness: CWE-862
Affected vendors: resmush.it
Affected products: resmush.it_image_optimizer
CVE-2022-24500 (published 2022-04-15)
Windows SMB Remote Code Execution Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_7, windows_8.1, windows_rt_8.1, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-24501 (published 2022-03-09)
VP9 Video Extensions Remote Code Execution Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: microsoft
Affected products: vp9_video_extensions
CVE-2022-24502 (published 2022-03-09)
Windows HTML Platforms Security Feature Bypass Vulnerability
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_7, windows_8.1, windows_rt_8.1, windows_server, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-24503 (published 2022-03-09)
Remote Desktop Protocol Client Information Disclosure Vulnerability
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L)
Affected vendors: microsoft
Affected products: remote_desktop_client, windows_10, windows_11, windows_7, windows_8.1, windows_rt_8.1, windows_server, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-24504 (published 2022-10-11)
Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-362
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_7, windows_8.1, windows_rt_8.1, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-24505 (published 2022-03-09)
Windows ALPC Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-362
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_server, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-24506 (published 2022-03-09)
Azure Site Recovery Elevation of Privilege Vulnerability
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H)
Affected vendors: microsoft
Affected products: azure_site_recovery
CVE-2022-24507 (published 2022-03-09)
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_server, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-24508 (published 2022-03-09)
Win32 File Enumeration Remote Code Execution Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_server, windows_server_2022
CVE-2022-24509 (published 2022-03-09)
Microsoft Office Visio Remote Code Execution Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: 365_apps, office, office_long_term_servicing_channel
CVE-2022-24510 (published 2022-03-09)
Microsoft Office Visio Remote Code Execution Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: 365_apps, office, office_long_term_servicing_channel
CVE-2022-24511 (published 2022-03-09)
Microsoft Office Word Tampering Vulnerability
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Affected vendors: microsoft
Affected products: 365_apps, office, office_long_term_servicing_channel, word
CVE-2022-24512 (published 2022-03-09)
.NET and Visual Studio Remote Code Execution Vulnerability
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L)
Weakness: CWE-94
Affected vendors: fedoraproject, microsoft
Affected products: .net, .net_core, fedora, powershell, visual_studio_2019, visual_studio_2022