Filtered by vendor Microsoft Subscriptions
Filtered by product Windows Subscriptions
Total 8892 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2022-23774 2 Docker, Microsoft 2 Docker Desktop, Windows 2024-11-21 5.3 Medium
Docker Desktop before 4.4.4 on Windows allows attackers to move arbitrary files.
CVE-2022-23764 2 Microsoft, Teruten 2 Windows, Webcube 2024-11-21 8.8 High
The vulnerability causing from insufficient verification procedures for downloaded files during WebCube update. Remote attackers can bypass this verification logic to update both digitally signed and unauthorized files, enabling remote code execution.
CVE-2022-23763 2 Douzone, Microsoft 2 Neors, Windows 2024-11-21 7.8 High
Origin validation error vulnerability in NeoRS’s ActiveX moudle allows attackers to download and execute arbitrary files. Remote attackers can use this vulerability to encourage users to access crafted web pages, causing damage such as malicious code infections.
CVE-2022-23742 2 Checkpoint, Microsoft 2 Endpoint Security, Windows 2024-11-21 7.8 High
Check Point Endpoint Security Client for Windows versions earlier than E86.40 copy files for forensics reports from a directory with low privileges. An attacker can replace those files with malicious or linked content, such as exploiting CVE-2020-0896 on unpatched systems or using symbolic links.
CVE-2022-23714 2 Elastic, Microsoft 2 Endpoint Security, Windows 2024-11-21 7.8 High
A local privilege escalation (LPE) issue was discovered in the ransomware canaries features of Elastic Endpoint Security for Windows, which could allow unprivileged users to elevate their privileges to those of the LocalSystem account.
CVE-2022-23678 2 Hp, Microsoft 2 Aruba Virtual Intranet Access, Windows 2024-11-21 5.9 Medium
A vulnerability in the Aruba Virtual Intranet Access (VIA) client for Microsoft Windows operating system client communications that could allow for an attacker in a privileged network position to intercept sensitive information in Aruba Virtual Intranet Access (VIA) client for Microsoft Windows operating system versions: 4.3.0 build 2208101 and below. Aruba has released upgrades for Virtual Intranet Access (VIA) Client that address this security vulnerability.
CVE-2022-23171 2 Atlasvpn, Microsoft 2 Atlasvpn, Windows 2024-11-21 5.9 Medium
AtlasVPN - Privilege Escalation Lack of proper security controls on named pipe messages can allow an attacker with low privileges to send a malicious payload and gain SYSTEM permissions on a windows computer where the AtlasVPN client is installed.
CVE-2022-22977 2 Microsoft, Vmware 2 Windows, Tools 2024-11-21 7.1 High
VMware Tools for Windows(12.0.0, 11.x.y and 10.x.y) contains an XML External Entity (XXE) vulnerability. A malicious actor with non-administrative local user privileges in the Windows guest OS, where VMware Tools is installed, may exploit this issue leading to a denial-of-service condition or unintended information disclosure.
CVE-2022-22952 2 Microsoft, Vmware 2 Windows, Carbon Black App Control 2024-11-21 9.1 Critical
VMware Carbon Black App Control (8.5.x prior to 8.5.14, 8.6.x prior to 8.6.6, 8.7.x prior to 8.7.4 and 8.8.x prior to 8.8.2) contains a file upload vulnerability. A malicious actor with administrative access to the VMware App Control administration interface may be able to execute code on the Windows instance where AppC Server is installed by uploading a specially crafted file.
CVE-2022-22951 2 Microsoft, Vmware 2 Windows, Carbon Black App Control 2024-11-21 9.1 Critical
VMware Carbon Black App Control (8.5.x prior to 8.5.14, 8.6.x prior to 8.6.6, 8.7.x prior to 8.7.4 and 8.8.x prior to 8.8.2) contains an OS command injection vulnerability. An authenticated, high privileged malicious actor with network access to the VMware App Control administration interface may be able to execute commands on the server due to improper input validation leading to remote code execution.
CVE-2022-22938 2 Microsoft, Vmware 3 Windows, Horizon, Workstation 2024-11-21 6.5 Medium
VMware Workstation (16.x prior to 16.2.2) and Horizon Client for Windows (5.x prior to 5.5.3) contains a denial-of-service vulnerability in the Cortado ThinPrint component. The issue exists in TrueType font parser. A malicious actor with access to a virtual machine or remote desktop may exploit this issue to trigger a denial-of-service condition in the Thinprint service running on the host machine where VMware Workstation or Horizon Client for Windows is installed.
CVE-2022-22779 3 Apple, Keybase, Microsoft 3 Macos, Keybase, Windows 2024-11-21 3.7 Low
The Keybase Clients for macOS and Windows before version 5.9.0 fails to properly remove exploded messages initiated by a user. This can occur if the receiving user switches to a non-chat feature and places the host in a sleep state before the sending user explodes the messages. This could lead to disclosure of sensitive information which was meant to be deleted from a user’s filesystem.
CVE-2022-22703 2 Microsoft, Stormshield 2 Windows, Network Security 2024-11-21 5.5 Medium
In Stormshield SSO Agent 2.x before 2.1.1 and 3.x before 3.0.2, the cleartext user password and PSK are contained in the log file of the .exe installer.
CVE-2022-22528 2 Microsoft, Sap 2 Windows, Adaptive Server Enterprise 2024-11-21 7.8 High
SAP Adaptive Server Enterprise (ASE) - version 16.0, installation makes an entry in the system PATH environment variable in Windows platform which, under certain conditions, allows a Standard User to execute malicious Windows binaries which may lead to privilege escalation on the local system. The issue is with the ASE installer and does not impact other ASE binaries.
CVE-2022-22516 2 Codesys, Microsoft 5 Control Rte Sl, Control Rte Sl \(for Beckhoff Cx\), Control Win Sl and 2 more 2024-11-21 7.8 High
The SysDrv3S driver in the CODESYS Control runtime system on Microsoft Windows allows any system user to read and write within restricted memory space.
CVE-2022-22496 3 Ibm, Linux, Microsoft 4 Aix, Spectrum Protect Server, Linux Kernel and 1 more 2024-11-21 6.5 Medium
While a user account for the IBM Spectrum Protect Server 8.1.0.000 through 8.1.14 is being established, it may be configured to use SESSIONSECURITY=TRANSITIONAL. While in this mode, it may be susceptible to an offline dictionary attack. IBM X-Force ID: 226942.
CVE-2022-22494 3 Ibm, Linux, Microsoft 4 Aix, Spectrum Protect Operations Center, Linux Kernel and 1 more 2024-11-21 5.3 Medium
IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.14 could allow a remote attacker to gain details of the database, such as type and version, by sending a specially-crafted HTTP request. This information could then be used in future attacks. IBM X-Force ID: 226940.
CVE-2022-22490 2 Ibm, Microsoft 4 Robotic Process Automation, Robotic Process Automation As A Service, Robotic Process Automation For Cloud Pak and 1 more 2024-11-21 4.9 Medium
IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could allow a privileged user to obtain sensitive Azure bot credential information. IBM X-Force ID: 226342.
CVE-2022-22489 3 Ibm, Linux, Microsoft 3 Mq, Linux Kernel, Windows 2024-11-21 9.1 Critical
IBM MQ 8.0, (9.0, 9.1, 9.2 LTS), and (9.1 and 9.2 CD) are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 226339.
CVE-2022-22487 3 Ibm, Linux, Microsoft 4 Aix, Spectrum Protect Server, Linux Kernel and 1 more 2024-11-21 9.8 Critical
An IBM Spectrum Protect storage agent could allow a remote attacker to perform a brute force attack by allowing unlimited attempts to login to the storage agent without locking the administrative ID. A remote attacker could exploit this vulnerability using brute force techniques to gain unauthorized administrative access to both the IBM Spectrum Protect storage agent and the IBM Spectrum Protect Server 8.1.0.000 through 8.1.14 with which it communicates. IBM X-Force ID: 226326.