Total
4422 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2022-41261 | 2 Microsoft, Sap | 2 Windows, Solution Manager | 2024-11-21 | N/A | 6.0 MEDIUM |
|
SAP Solution Manager (Diagnostic Agent) - version 7.20, allows an authenticated attacker on Windows system to access a file containing sensitive data which can be used to access a configuration file which contains credentials to access other system files. Successful exploitation can make the attacker access files and systems for which he/she is not authorized.
|
|||||
| CVE-2022-41135 | 1 Wpchill | 1 Customizable Wordpress Gallery Plugin - Modula Image Gallery | 2024-11-21 | N/A | 6.5 MEDIUM |
|
Unauth. Plugin Settings Change vulnerability in Modula plugin <= 2.6.9 on WordPress.
|
|||||
| CVE-2022-40972 | 1 Intel | 1 Quickassist Technology | 2024-11-21 | N/A | 6.7 MEDIUM |
|
Improper access control in some Intel(R) QAT drivers for Windows before version 1.9.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
|
|||||
| CVE-2022-40964 | 3 Debian, Fedoraproject, Intel | 17 Debian Linux, Fedora, Killer and 14 more | 2024-11-21 | N/A | 7.9 HIGH |
|
Improper access control for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software may allow a privileged user to potentially enable escalation of privilege via local access.
|
|||||
| CVE-2022-40539 | 1 Qualcomm | 50 Qam8295p, Qam8295p Firmware, Qca6574au and 47 more | 2024-11-21 | N/A | 8.4 HIGH |
|
Memory corruption in Automotive Android OS due to improper validation of array index.
|
|||||
| CVE-2022-40529 | 1 Qualcomm | 392 Aqt1000, Aqt1000 Firmware, Ar8031 and 389 more | 2024-11-21 | N/A | 7.1 HIGH |
|
Memory corruption due to improper access control in kernel while processing a mapping request from root process.
|
|||||
| CVE-2022-40207 | 1 Intel | 1 System Usage Report | 2024-11-21 | N/A | 8.2 HIGH |
|
Improper access control in the Intel(R) SUR software before version 2.4.8989 may allow an authenticated user to potentially enable escalation of privilege via local access.
|
|||||
| CVE-2022-3746 | 1 Lenovo | 174 Ideapad 1-14ijl7, Ideapad 1-14ijl7 Firmware, Ideapad 1-15ijl7 and 171 more | 2024-11-21 | N/A | 6.7 MEDIUM |
|
A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevated privileges to cause some peripherals to work abnormally due to an exposed Embedded Controller (EC) interface.
|
|||||
| CVE-2022-3382 | 1 Hiwin | 1 Robot System Software | 2024-11-21 | N/A | 7.5 HIGH |
|
HIWIN Robot System Software version 3.3.21.9869 does not properly address the terminated command source. As a result, an attacker could craft code to disconnect HRSS and the controller and cause a denial-of-service condition.
|
|||||
| CVE-2022-3263 | 1 Measuresoft | 1 Scadapro Server | 2024-11-21 | N/A | 7.8 HIGH |
|
The security descriptor of Measuresoft ScadaPro Server version 6.7 has inconsistent permissions, which could allow a local user with limited privileges to modify the service binary path and start malicious commands with SYSTEM privileges.
|
|||||
| CVE-2022-3186 | 1 Dataprobe | 24 Iboot-pdu4-n20, Iboot-pdu4-n20 Firmware, Iboot-pdu4a-n15 and 21 more | 2024-11-21 | N/A | 8.6 HIGH |
|
Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where the affected product allows an attacker to access the device’s main management page from the cloud. This feature enables users to remotely connect devices, however, the current implementation permits users to access other device's information.
|
|||||
| CVE-2022-3182 | 1 Devolutions | 1 Remote Desktop Manager | 2024-11-21 | N/A | 7.0 HIGH |
|
Improper Access Control vulnerability in the Duo SMS two-factor of Devolutions Remote Desktop Manager 2022.2.14 and earlier allows attackers to bypass the application lock. This issue affects: Devolutions Remote Desktop Manager version 2022.2.14 and prior versions.
|
|||||
| CVE-2022-3065 | 1 Diagrams | 1 Drawio | 2024-11-21 | N/A | 7.5 HIGH |
|
Improper Access Control in GitHub repository jgraph/drawio prior to 20.2.8.
|
|||||
| CVE-2022-3027 | 1 Contechealth | 2 Cms8000, Cms8000 Firmware | 2024-11-21 | N/A | 5.7 MEDIUM |
|
The CMS8000 device does not properly control or sanitize the SSID name of a new Wi-Fi access point. A threat actor could create an SSID with a malicious name, including non-standard characters that, when the device attempts connecting to the malicious SSID, the device can be exploited to write arbitrary files or display incorrect information.
|
|||||
| CVE-2022-3019 | 1 Tooljet | 1 Tooljet | 2024-11-21 | N/A | 8.8 HIGH |
|
The forgot password token basically just makes us capable of taking over the account of whoever comment in an app that we can see (bruteforcing comment id's might also be an option but I wouldn't count on it, since it would take a long time to find a valid one).
|
|||||
| CVE-2022-39946 | 1 Fortinet | 1 Fortinac | 2024-11-21 | N/A | 7.6 HIGH |
|
An access control vulnerability [CWE-284] in FortiNAC version 9.4.2 and below, version 9.2.7 and below, 9.1 all versions, 8.8 all versions, 8.7 all versions, 8.6 all versions, 8.5 all versions may allow a remote attacker authenticated on the administrative interface to perform unauthorized jsp calls via crafted HTTP requests.
|
|||||
| CVE-2022-39915 | 2 Google, Samsung | 2 Android, Calendar | 2024-11-21 | N/A | 3.3 LOW |
|
Improper access control vulnerability in Calendar prior to versions 11.6.08.0 in Android Q(10), 12.2.11.3000 in Android R(11), 12.3.07.2000 in Android S(12), and 12.4.02.0 in Android T(13) allows attackers to access sensitive information via implicit intent.
|
|||||
| CVE-2022-39910 | 1 Samsung | 1 Pass | 2024-11-21 | N/A | 3.9 LOW |
|
Improper access control vulnerability in Samsung Pass prior to version 4.0.06.7 allow physical attackers to access data of Samsung Pass on a certain state of an unlocked device using pop-up view.
|
|||||
| CVE-2022-39906 | 1 Google | 1 Android | 2024-11-21 | N/A | 2.3 LOW |
|
Improper access control vulnerability in SecTelephonyProvider prior to SMR Dec-2022 Release 1 allows attackers to access message information.
|
|||||
| CVE-2022-39900 | 1 Google | 1 Android | 2024-11-21 | N/A | 4.6 MEDIUM |
|
Improper access control vulnerability in Nice Catch prior to SMR Dec-2022 Release 1 allows physical attackers to access contents of all toast generated in the application installed in Secure Folder through Nice Catch.
|
|||||
| CVE-2022-39898 | 1 Google | 1 Android | 2024-11-21 | N/A | 4.0 MEDIUM |
|
Improper access control vulnerability in IIccPhoneBook prior to SMR Dec-2022 Release 1 allows attackers to access some information of usim.
|
|||||
| CVE-2022-39896 | 1 Google | 1 Android | 2024-11-21 | N/A | 4.0 MEDIUM |
|
Improper access control vulnerabilities in Contacts prior to SMR Dec-2022 Release 1 allows to access sensitive information via implicit intent.
|
|||||
| CVE-2022-39895 | 1 Google | 1 Android | 2024-11-21 | N/A | 4.0 MEDIUM |
|
Improper access control vulnerability in ContactListUtils in Phone prior to SMR Dec-2022 Release 1 allows to access contact group information via implicit intent.
|
|||||
| CVE-2022-39894 | 1 Google | 1 Android | 2024-11-21 | N/A | 4.0 MEDIUM |
|
Improper access control vulnerability in ContactListStartActivityHelper in Phone prior to SMR Dec-2022 Release 1 allows to access sensitive information via implicit intent.
|
|||||
| CVE-2022-39889 | 1 Samsung | 1 Galaxywatch4plugin | 2024-11-21 | N/A | 4.0 MEDIUM |
|
Improper access control vulnerability in GalaxyWatch4Plugin prior to versions 2.2.11.22101351 and 2.2.12.22101351 allows attackers to access wearable device information.
|
|||||
| CVE-2022-39887 | 1 Google | 1 Android | 2024-11-21 | N/A | 4.3 MEDIUM |
|
Improper access control vulnerability in clearAllGlobalProxy in MiscPolicy prior to SMR Nov-2022 Release 1 allows local attacker to configure EDM setting.
|
|||||
| CVE-2022-39884 | 1 Google | 1 Android | 2024-11-21 | N/A | 4.3 MEDIUM |
|
Improper access control vulnerability in IImsService prior to SMR Nov-2022 Release 1 allows local attacker to access to Call information.
|
|||||
| CVE-2022-39878 | 1 Samsung | 1 Checkout | 2024-11-21 | N/A | 4.0 MEDIUM |
|
Improper access control vulnerability in Samsung Checkout prior to version 5.0.55.3 allows attackers to access sensitive information via implicit intent broadcast.
|
|||||
| CVE-2022-39877 | 2 Google, Samsung | 2 Android, Group Sharing | 2024-11-21 | N/A | 4.0 MEDIUM |
|
Improper access control vulnerability in ProfileSharingAccount in Group Sharing prior to versions 13.0.6.15 in Android S(12), 13.0.6.14 in Android R(11) and below allows attackers to identify the device.
|
|||||
| CVE-2022-39875 | 1 Samsung | 1 Account | 2024-11-21 | N/A | 5.1 MEDIUM |
|
Improper component protection vulnerability in Samsung Account prior to version 13.5.0 allows attackers to unauthorized logout.
|
|||||
| CVE-2022-39871 | 1 Samsung | 1 Smartthings | 2024-11-21 | N/A | 4.0 MEDIUM |
|
Improper access control vulnerability cloudNotificationManager.java in SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information via implicit broadcasts.
|
|||||
| CVE-2022-39870 | 1 Samsung | 1 Smartthings | 2024-11-21 | N/A | 4.0 MEDIUM |
|
Improper access control vulnerability in cloudNotificationManager.java SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information via PUSH_MESSAGE_RECEIVED broadcast.
|
|||||
| CVE-2022-39869 | 1 Samsung | 1 Smartthings | 2024-11-21 | N/A | 4.0 MEDIUM |
|
Improper access control vulnerability in cloudNotificationManager.java SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information via REMOVE_PERSISTENT_BANNER broadcast.
|
|||||
| CVE-2022-39868 | 1 Samsung | 1 Smartthings | 2024-11-21 | N/A | 4.0 MEDIUM |
|
Improper access control vulnerability in GedSamsungAccount.kt SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information via implicit broadcast.
|
|||||
| CVE-2022-39867 | 1 Samsung | 1 Smartthings | 2024-11-21 | N/A | 4.0 MEDIUM |
|
Improper access control vulnerability in cloudNotificationManager.java SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information via SHOW_PERSISTENT_BANNER broadcast.
|
|||||
| CVE-2022-39866 | 1 Samsung | 1 Smartthings | 2024-11-21 | N/A | 4.0 MEDIUM |
|
Improper access control vulnerability in RegisteredEventMediator.kt SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information via implicit broadcast.
|
|||||
| CVE-2022-39865 | 1 Samsung | 1 Smartthings | 2024-11-21 | N/A | 4.0 MEDIUM |
|
Improper access control vulnerability in ContentsSharingActivity.java SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information via implicit broadcast.
|
|||||
| CVE-2022-39864 | 1 Samsung | 1 Smartthings | 2024-11-21 | N/A | 3.3 LOW |
|
Improper access control vulnerability in WifiSetupLaunchHelper in SmartThings prior to version 1.7.89.25 allows attackers to access sensitive information via implicit intent.
|
|||||
| CVE-2022-39860 | 1 Samsung | 1 Quick Share | 2024-11-21 | N/A | 4.4 MEDIUM |
|
Improper access control vulnerability in QuickShare prior to version 13.2.3.5 allows attackers to access sensitive information via implicit broadcast.
|
|||||
| CVE-2022-39857 | 1 Samsung | 1 Factorycamerafb | 2024-11-21 | N/A | 7.3 HIGH |
|
Improper access control vulnerability in CameraTestActivity in FactoryCameraFB prior to version 3.5.51 allows attackers to access broadcasting Intent as system uid privilege.
|
|||||