VulnCheck KEV: CVE-2022-44698

Microsoft Defender SmartScreen contains a security feature bypass vulnerability that could allow an attacker to evade Mark of the Web MOTW defenses via a specially crafted malicious file...

CVE-2022-44699

CVE-2022-44699 affects the Azure Network Watcher Agent (VM extension). The connected docs describe a Security Feature Bypass caused by authorization errors in the Azure Network Watcher Agent service, enabling bypass of security controls and potentially missing logs from packet captures. Adjacent ...

Adobe Experience Manager 6.5.0.0 < 6.5.15.0 Multiple Vulnerabilities (APSB22-59)

The version of Adobe Experience Manager installed on the remote host is prior to 6.5.15.0. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB22-59 advisory. - Adobe Experience Manager version 6.5.14 and earlier is affected by a reflected Cross-Site Scripting XSS...

CVE-2022-44698

CVE-2022-44698 is a Windows SmartScreen security feature bypass that enables bypass of Mark-of-the-Web protections via specially crafted files. The public data confirms exploitation in the wild and active exploitation historically cited by multiple sources (CISA KEV, KrebsOnSecurity). The underly...

CVE-2022-44698 Windows SmartScreen Security Feature Bypass Vulnerability

...

Microsoft Defender SmartScreen Security Feature Bypass Vulnerability

Microsoft Defender SmartScreen contains a security feature bypass vulnerability that could allow an attacker to evade Mark of the Web MOTW defenses via a specially crafted malicious file...

PT-2022-25309 · Mitsubishi · Genesis64

Name of the Vulnerable Software and Affected Versions: ICONICS/Mitsubishi Electric GENESIS64 versions 10.96 to 10.97.2 Description: The issue allows an unauthenticated attacker to create, tamper with, or destroy arbitrary files by getting a legitimate user to import a project package file crafted...

CVE-2022-29838 Authentication issue with the encrypted volumes and auto mount feature in My Cloud devices

Improper Authentication vulnerability in the encrypted volumes and auto mount features of Western Digital My Cloud devices allows insecure direct access to the drive information in the case of a device reset. This issue affects: Western Digital My Cloud My Cloud versions prior to 5.25.124 on Linu...

The vulnerability of the RealVNC remote access software relates to insecure management of privileges, allowing a hacker to elevate their own privileges.

The vulnerability of the RealVNC remote access software is related to insecure management of privileges. Exploiting this vulnerability can allow an attacker to enhance their privileges by using the MSI installer Repair feature...

PT-2022-26868 · Unknown · Baota Linux Panel

Name of the Vulnerable Software and Affected Versions: BAOTA linux panel affected versions not specified Description: The issue is related to a stored XSS vulnerability in the BAOTA linux panel. Attackers can exploit this to obtain sensitive information through the log analysis feature...

CVE-2022-4336

In BAOTA linux panel there exists a stored xss vulnerability attackers can use to obtain sensitive information via the log analysis feature...

USN-5768-1 glibc vulnerabilities

Jan Engelhardt, Tavis Ormandy, and others discovered that the GNU C Library iconv feature incorrectly handled certain input sequences. An attacker could possibly use this issue to cause the GNU C Library to hang or crash, resulting in a denial of service. CVE-2016-10228, CVE-2019-25013,...

USN-5768-1: GNU C Library vulnerabilities

Jan Engelhardt, Tavis Ormandy, and others discovered that the GNU C Library iconv feature incorrectly handled certain input sequences. An attacker could possibly use this issue to cause the GNU C Library to hang or crash, resulting in a denial of service. CVE-2016-10228, CVE-2019-25013,...

PT-2022-36178 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.79 Description: The issue is related to the initialization of device zone info for seeding in the btrfs zoned feature. The actual impact and attack plausibility have not yet been proven. Recommendations: F...

FortiADC - Improper input validation in download features

Multiple improper input validation vulnerabilities CWE-20 may allow an authenticated attacker to retrieve files with specific extensions from the underlying Linux system via crafted HTTP requests...

CVE-2022-35508

Proxmox Virtual Environment PVE and Proxmox Mail Gateway PMG are vulnerable to SSRF when proxying HTTP requests between pvepmgproxy and pvepmgdaemon. An attacker with an unprivileged account can craft an HTTP request to achieve SSRF and file disclosure of any files on the server. Also, in Proxmox...

CVE-2022-35508

Proxmox Virtual Environment PVE and Proxmox Mail Gateway PMG are vulnerable to SSRF when proxying HTTP requests between pvepmgproxy and pvepmgdaemon. An attacker with an unprivileged account can craft an HTTP request to achieve SSRF and file disclosure of any files on the server. Also, in Proxmox...

PT-2022-27347 · Unknown · Rukovoditel

Name of the Vulnerable Software and Affected Versions: Rukovoditel version 3.2.1 Description: The issue is related to a stored cross-site scripting XSS vulnerability in the Entities Group feature at "/index.php?module=entities/entities groups". This allows attackers to execute arbitrary web scrip...

CVE-2022-44947

Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting XSS vulnerability in the Highlight Row feature at /index.php?module=entities/listingtypes&entitiesid=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the...

PT-2022-27346 · Unknown · Rukovoditel

Name of the Vulnerable Software and Affected Versions: Rukovoditel version 3.2.1 Description: A stored cross-site scripting XSS issue was found in the Highlight Row feature at "/index.php?module=entities/listing types&entities id=24". This allows attackers to execute arbitrary web scripts or HTML...