deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-24281
Published: 2022-03-08
Description: A vulnerability has been identified in SINEC NMS (All versions < V1.0.3), SINEMA Server V14 (All versions). A privileged authenticated attacker could execute arbitrary commands in the local database by sending specially crafted requests to the webserver of the affected application.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://cert-portal.siemens.com/productcert/pdf/ssa-250085.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-250085.pdf
CVE: CVE-2022-24282
Published: 2022-03-08
Description: A vulnerability has been identified in SINEC NMS (All versions >= V1.0.3 < V2.0), SINEC NMS (All versions < V1.0.3), SINEMA Server V14 (All versions). The affected system allows to upload JSON objects that are deserialized to Java objects. Due to insecure deserialization of user-supplied content by the affected software, a privileged attacker could exploit this vulnerability by sending a maliciously crafted serialized Java object. This could allow the attacker to execute arbitrary code on the device with root privileges.
CVSS Score: 7.2 (HIGH)
CWE: CWE-502, CWE-502
References: https://cert-portal.siemens.com/productcert/pdf/ssa-250085.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-250085.pdf
CVE: CVE-2022-24309
Published: 2022-03-08
Description: A vulnerability has been identified in Mendix Runtime V7 (All versions < V7.23.29), Mendix Runtime V8 (All versions < V8.18.16), Mendix Runtime V9 (All versions < V9.13 only with Runtime Custom Setting *DataStorage.UseNewQueryHandler* set to False). If an entity has an association readable by the user, then in some cases, Mendix Runtime may not apply checks for XPath constraints that parse said associations, within apps running on affected versions. A malicious user could use this to dump and manipulate sensitive data.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-284
References: https://cert-portal.siemens.com/productcert/html/ssa-148641.html; https://cert-portal.siemens.com/productcert/pdf/ssa-148641.pdf; https://cert-portal.siemens.com/productcert/html/ssa-148641.html
CVE: CVE-2022-24408
Published: 2022-03-08
Description: A vulnerability has been identified in SINUMERIK MC (All versions < V1.15 SP1), SINUMERIK ONE (All versions < V6.15 SP1). The sc SUID binary on affected devices provides several commands that are used to execute system commands or modify system files. A specific set of operations using sc could allow local attackers to escalate their privileges to root.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269, CWE-269
References: https://cert-portal.siemens.com/productcert/pdf/ssa-337210.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-337210.pdf
CVE: CVE-2022-24661
Published: 2022-03-08
Description: A vulnerability has been identified in Simcenter STAR-CCM+ Viewer (All versions < V2022.1). The starview+.exe contains a memory corruption vulnerability while parsing specially crafted .SCE files. This could allow an attacker to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-166747.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-166747.pdf
CVE: CVE-2022-25311
Published: 2022-03-08
Description: A vulnerability has been identified in SINEC NMS (All versions >= V1.0.3 < V2.0), SINEC NMS (All versions < V1.0.3), SINEMA Server V14 (All versions). The affected software do not properly check privileges between users during the same web browser session, creating an unintended sphere of control. This could allow an authenticated low privileged user to achieve privilege escalation.
CVSS Score: 7.3 (HIGH)
CWE: CWE-269
References: https://cert-portal.siemens.com/productcert/pdf/ssa-250085.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-250085.pdf
CVE: CVE-2022-26313
Published: 2022-03-08
Description: A vulnerability has been identified in Mendix Forgot Password Appstore module (All versions >= V3.3.0 < V3.5.1). In certain configurations of the affected product, a threat actor could use the sign up flow to hijack arbitrary user accounts.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://cert-portal.siemens.com/productcert/pdf/ssa-134279.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-134279.pdf
CVE: CVE-2022-26314
Published: 2022-03-08
Description: A vulnerability has been identified in Mendix Forgot Password Appstore module (All versions >= V3.3.0 < V3.5.1), Mendix Forgot Password Appstore module (Mendix 7 compatible) (All versions < V3.2.2). Initial passwords are generated in an insecure manner. This could allow an unauthenticated remote attacker to efficiently brute force passwords in specific situations.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-307, CWE-307
References: https://cert-portal.siemens.com/productcert/pdf/ssa-134279.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-134279.pdf
CVE: CVE-2022-26317
Published: 2022-03-08
Description: A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.29). When returning the result of a completed Microflow execution call the affected framework does not correctly verify, if the request was initially made by the user requesting the result. Together with predictable identifiers for Microflow execution calls, this could allow a malicious attacker to retrieve information about arbitrary Microflow execution calls made by users within the affected system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284, CWE-330
References: https://cert-portal.siemens.com/productcert/pdf/ssa-415938.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-415938.pdf
CVE: CVE-2022-0877
Published: 2022-03-08
Description: Cross-site Scripting (XSS) - Stored in GitHub repository bookstackapp/bookstack prior to v22.02.3.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/bookstackapp/bookstack/commit/856fca8289b7370cafa033ea21c408e7d4303fd6; https://huntr.dev/bounties/b04df4e3-ae5a-4dc6-81ec-496248b15f3c; https://github.com/bookstackapp/bookstack/commit/856fca8289b7370cafa033ea21c408e7d4303fd6
CVE: CVE-2021-41180
Published: 2022-03-08
Description: Nextcloud talk is a self hosting messaging service. In versions prior 12.1.2 an attacker is able to control the link of a geolocation preview in the Nextcloud Talk application due to a lack of validation on the link. This could result in an open-redirect, but required user interaction. This only affected users of the Android Talk client. It is recommended that the Nextcloud Talk App is upgraded to 12.1.2. There are no known workarounds.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-601
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-4fxr-mrw2-cq92; https://github.com/nextcloud/spreed/pull/6239; https://hackerone.com/reports/1337178
CVE: CVE-2021-41181
Published: 2022-03-08
Description: Nextcloud talk is a self hosting messaging service. In versions prior to 12.3.0 the Nextcloud Android Talk application did not properly detect the lockscreen state when a call was incoming. If an attacker got physical access to the locked phone, and the victim received a phone call the attacker could gain access to the chat messages and files of the user. It is recommended that the Nextcloud Android Talk App is upgraded to 12.3.0. There are no known workarounds.
CVSS Score: 2.4 (LOW)
CWE: CWE-200, CWE-287
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-497c-c8hx-6qcf; https://github.com/nextcloud/talk-android/pull/1585; https://github.com/nextcloud/security-advisories/security/advisories/GHSA-497c-c8hx-6qcf
CVE: CVE-2021-41239
Published: 2022-03-08
Description: Nextcloud server is a self hosted system designed to provide cloud style services. In affected versions the User Status API did not consider the user enumeration settings by the administrator. This allowed a user to enumerate other users on the instance, even when user listings where disabled. It is recommended that the Nextcloud Server is upgraded to 20.0.14, 21.0.6 or 22.2.1. There are no known workarounds.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-862
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-g722-cm3h-8wrx; https://github.com/nextcloud/server/issues/27122; https://github.com/nextcloud/server/pull/29260
CVE: CVE-2021-41241
Published: 2022-03-08
Description: Nextcloud server is a self hosted system designed to provide cloud style services. The groupfolders application for Nextcloud allows sharing a folder with a group of people. In addition, it allows setting "advanced permissions" on subfolders, for example, a user could be granted access to the groupfolder but not specific subfolders. Due to a lacking permission check in affected versions, a user could still access these subfolders by copying the groupfolder to another location. It is recommended that the Nextcloud Server is upgraded to 20.0.14, 21.0.6 or 22.2.1. Users unable to upgrade should disable the "groupfolders" application in the admin settings.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863, CWE-862
References: https://github.com/nextcloud/groupfolders/issues/1692; https://github.com/nextcloud/security-advisories/security/advisories/GHSA-m4wp-r357-4q94; https://github.com/nextcloud/server/pull/29362
CVE: CVE-2022-24713
Published: 2022-03-08
Description: regex is an implementation of regular expressions for the Rust language. The regex crate features built-in mitigations to prevent denial of service attacks caused by untrusted regexes, or untrusted input matched by trusted regexes. Those (tunable) mitigations already provide sane defaults to prevent attacks. This guarantee is documented and it's considered part of the crate's API. Unfortunately a bug was discovered in the mitigations designed to prevent untrusted regexes to take an arbitrary amount of time during parsing, and it's possible to craft regexes that bypass such mitigations. This makes it possible to perform denial of service attacks by sending specially crafted regexes to services accepting user-controlled, untrusted regexes. All versions of the regex crate before or equal to 1.5.4 are affected by this issue. The fix is include starting from regex 1.5.5. All users accepting user-controlled regexes are recommended to upgrade immediately to the latest version of the regex crate. Unfortunately there is no fixed set of problematic regexes, as there are practically infinite regexes that could be crafted to exploit this vulnerability. Because of this, it us not recommend to deny known problematic regexes.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-1333
References: https://github.com/rust-lang/regex/commit/ae70b41d4f46641dbc45c7a4f87954aea356283e; https://github.com/rust-lang/regex/security/advisories/GHSA-m5pq-gvj9-9vr8; https://groups.google.com/g/rustlang-security-announcements/c/NcNNL1Jq7Yw
CVE: CVE-2022-24714
Published: 2022-03-08
Description: Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Installations of Icinga 2 with the IDO writer enabled are affected. If you use service custom variables in role restrictions, and you regularly decommission service objects, users with said roles may still have access to a collection of content. Note that this only applies if a role has implicitly permitted access to hosts, due to permitted access to at least one of their services. If access to a host is permitted by other means, no sensible information has been disclosed to unauthorized users. This issue has been resolved in versions 2.8.6, 2.9.6 and 2.10 of Icinga Web 2.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-863
References: https://github.com/Icinga/icingaweb2/commit/6e989d05a1568a6733a3d912001251acc51d9293; https://github.com/Icinga/icingaweb2/security/advisories/GHSA-qcmg-vr56-x9wf; https://security.gentoo.org/glsa/202208-05
CVE: CVE-2022-24715
Published: 2022-03-08
Description: Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Authenticated users, with access to the configuration, can create SSH resource files in unintended directories, leading to the execution of arbitrary code. This issue has been resolved in versions 2.8.6, 2.9.6 and 2.10 of Icinga Web 2. Users unable to upgrade should limit access to the Icinga Web 2 configuration.
CVSS Score: 8.5 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.com/files/173516/Icinga-Web-2.10-Remote-Code-Execution.html; https://github.com/Icinga/icingaweb2/commit/a06d915467ca943a4b406eb9587764b8ec34cafb; https://github.com/Icinga/icingaweb2/security/advisories/GHSA-v9mv-h52f-7g63
CVE: CVE-2022-24716
Published: 2022-03-08
Description: Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Unauthenticated users can leak the contents of files of the local system accessible to the web-server user, including `icingaweb2` configuration files with database credentials. This issue has been resolved in versions 2.9.6 and 2.10 of Icinga Web 2. Database credentials should be rotated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: http://packetstormsecurity.com/files/171774/Icinga-Web-2.10-Arbitrary-File-Disclosure.html; https://github.com/Icinga/icingaweb2/commit/9931ed799650f5b8d5e1dc58ea3415a4cdc5773d; https://github.com/Icinga/icingaweb2/security/advisories/GHSA-5p3f-rh28-8frw
CVE: CVE-2022-24739
Published: 2022-03-08
Description: alltube is an html front end for youtube-dl. On releases prior to 3.0.3, an attacker could craft a special HTML page to trigger either an open redirect attack or a Server-Side Request Forgery attack (depending on how AllTube is configured). The impact is mitigated by the fact the SSRF attack is only possible when the `stream` option is enabled in the configuration. (This option is disabled by default.) 3.0.3 contains a fix for this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-601, CWE-918
References: https://github.com/Rudloff/alltube/commit/3a4f09dda0a466662a4e52cde674749e0c668e8d; https://github.com/Rudloff/alltube/commit/8913f27716400dabf4906a5ad690a5238f73496a; https://github.com/Rudloff/alltube/commit/bc14b6e45c766c05757fb607ef8d444cbbfba71a
CVE: CVE-2022-26319
Published: 2022-03-08
Description: An installer search patch element vulnerability in Trend Micro Portable Security 3.0 Pro, 3.0 and 2.0 could allow a local attacker to place an arbitrarily generated DLL file in an installer folder to elevate local privileges. Please note: an attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-427
References: https://success.trendmicro.com/solution/000290531; https://success.trendmicro.com/solution/000290531
CVE: CVE-2022-26337
Published: 2022-03-08
Description: Trend Micro Password Manager (Consumer) installer version 5.0.0.1262 and below is vulnerable to an Uncontrolled Search Path Element vulnerability that could allow an attacker to use a specially crafted file to exploit the vulnerability and escalate local privileges on the affected machine.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://helpcenter.trendmicro.com/en-us/article/tmka-10954; https://helpcenter.trendmicro.com/en-us/article/tmka-10954
CVE: CVE-2022-25943
Published: 2022-03-09
Description: The installer of WPS Office for Windows versions prior to v11.2.0.10258 fails to configure properly the ACL for the directory where the service program is installed.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276, CWE-276
References: https://github.com/HadiMed/KINGSOFT-WPS-Office-LPE; https://jvn.jp/en/vu/JVNVU90673830/; https://www.wps.com/whatsnew/pc/20210806/
CVE: CVE-2022-0881
Published: 2022-03-09
Description: Insecure Storage of Sensitive Information in GitHub repository chocobozzz/peertube prior to 4.1.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-922, CWE-922
References: https://github.com/chocobozzz/peertube/commit/0c058f256a195b92f124be10109c95d1fbe93ad8; https://huntr.dev/bounties/2628431e-6a98-4063-a0e3-a8b1d9ebaa9c; https://github.com/chocobozzz/peertube/commit/0c058f256a195b92f124be10109c95d1fbe93ad8
CVE: CVE-2022-0482
Published: 2022-03-09
Description: Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository alextselegidis/easyappointments prior to 1.4.3.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-359, CWE-863
References: http://packetstormsecurity.com/files/166701/Easy-Appointments-Information-Disclosure.html; https://github.com/alextselegidis/easyappointments/commit/44af526a6fc5e898bc1e0132b2af9eb3a9b2c466; https://huntr.dev/bounties/2fe771ef-b615-45ef-9b4d-625978042e26
CVE: CVE-2022-0896
Published: 2022-03-09
Description: Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository microweber/microweber prior to 1.3.
CVSS Score: 8.8 (HIGH)
CWE: CWE-1336, CWE-94
References: https://github.com/microweber/microweber/commit/e0224462b3dd6b1f7c6ec1197413afc6019bc3b5; https://huntr.dev/bounties/113056f1-7a78-4205-9f42-940ad41d8df0; https://github.com/microweber/microweber/commit/e0224462b3dd6b1f7c6ec1197413afc6019bc3b5
CVE: CVE-2021-36777
Published: 2022-03-09
Description: A Reliance on Untrusted Inputs in a Security Decision vulnerability in the login proxy of the openSUSE Build service allowed attackers to present users with a expected login form that then sends the clear text credentials to an attacker specified server. This issue affects: openSUSE Build service login-proxy-scripts versions prior to dc000cdfe9b9b715fb92195b1a57559362f689ef.
CVSS Score: 8.1 (HIGH)
CWE: CWE-807
References: https://bugzilla.suse.com/show_bug.cgi?id=1191209; https://bugzilla.suse.com/show_bug.cgi?id=1191209
CVE: CVE-2022-21967
Published: 2022-03-09
Description: Xbox Live Auth Manager for Windows Elevation of Privilege Vulnerability
CVSS Score: 7.0 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21967; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21967
CVE: CVE-2022-21973
Published: 2022-03-09
Description: Windows Media Center Update Denial of Service Vulnerability
CVSS Score: 5.5 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21973; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21973
CVE: CVE-2022-21975
Published: 2022-03-09
Description: Windows Hyper-V Denial of Service Vulnerability
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-362
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21975; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21975
CVE: CVE-2022-21977
Published: 2022-03-09
Description: Media Foundation Information Disclosure Vulnerability
CVSS Score: 3.3 (LOW)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21977; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21977
CVE: CVE-2022-21990
Published: 2022-03-09
Description: Remote Desktop Client Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21990; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21990
CVE: CVE-2022-22006
Published: 2022-03-09
Description: HEVC Video Extensions Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22006; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22006
CVE: CVE-2022-22007
Published: 2022-03-09
Description: HEVC Video Extensions Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22007; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22007
CVE: CVE-2022-22010
Published: 2022-03-09
Description: Media Foundation Information Disclosure Vulnerability
CVSS Score: 4.4 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22010; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22010
CVE: CVE-2022-23253
Published: 2022-03-09
Description: Windows Point-to-Point Tunneling Protocol Denial of Service Vulnerability
CVSS Score: 6.5 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23253; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23253
CVE: CVE-2022-23265
Published: 2022-03-09
Description: Microsoft Defender for IoT Remote Code Execution Vulnerability
CVSS Score: 7.2 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23265; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23265
CVE: CVE-2022-23266
Published: 2022-03-09
Description: Microsoft Defender for IoT Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23266; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23266
CVE: CVE-2022-23277
Published: 2022-03-09
Description: Microsoft Exchange Server Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23277; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23277
CVE: CVE-2022-23278
Published: 2022-03-09
Description: Microsoft Defender for Endpoint Spoofing Vulnerability
CVSS Score: 5.9 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23278; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23278
CVE: CVE-2022-23281
Published: 2022-03-09
Description: Windows Common Log File System Driver Information Disclosure Vulnerability
CVSS Score: 5.5 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23281; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23281
CVE: CVE-2022-23282
Published: 2022-03-09
Description: Paint 3D Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23282; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23282
CVE: CVE-2022-23283
Published: 2022-03-09
Description: Windows ALPC Elevation of Privilege Vulnerability
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23283; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23283
CVE: CVE-2022-23284
Published: 2022-03-09
Description: Windows Print Spooler Elevation of Privilege Vulnerability
CVSS Score: 7.2 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23284; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23284
CVE: CVE-2022-23285
Published: 2022-03-09
Description: Remote Desktop Client Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23285; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23285
CVE: CVE-2022-23286
Published: 2022-03-09
Description: Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
CVSS Score: 7.0 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23286; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23286
CVE: CVE-2022-23287
Published: 2022-03-09
Description: Windows ALPC Elevation of Privilege Vulnerability
CVSS Score: 7.0 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23287; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23287
CVE: CVE-2022-23288
Published: 2022-03-09
Description: Windows DWM Core Library Elevation of Privilege Vulnerability
CVSS Score: 7.0 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23288; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23288
CVE: CVE-2022-23290
Published: 2022-03-09
Description: Windows Inking COM Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23290; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23290
CVE: CVE-2022-23291
Published: 2022-03-09
Description: Windows DWM Core Library Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23291; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23291