Do Son Ghannam released the technical details for CVE-2022-32898 and explained how to find a flaw in the Apple Neural Engine component
Vulnerability
Tracked as CVE-2022-4135, Google described the high-severity flaw as a heap buffer overflow in GPU and credited Clement Lecigne.
CVE-2021-33621 (CVSS score: 8.8) allows a remote authenticated attacker to inject an arbitrary HTTP/1.1 response header in some form
Redhat issued a risk notice for the Linux Kernel local privilege escalation vulnerability, the vulnerability tracked as CVE-2022-3910.
The security vulnerability has been assigned the identifier CVE-2022-40602 and is rated 9.8 out of 10 for severity.
CVE-2022-43707 exists in the visual MyCode editor (SCEditor), thus enabling remote attackers to inject HTML via user input or stored data
Apache Solr developers informed users that the product is affected by an XML external entity injection (XXE) attack (CVE-2022-39135)
CVE-2022-45461 is a high OS command injection vulnerability that affects NetBackup versions 8,9, and 10 and Appliance versions 3,4, and 5
The analyst has published extensive technical details, including a PoC exploit for CVE-2022-20868, it is important to fix the vulnerabilities
A local low-privileged user could exploit CVE-2022-36924 during the install process to escalate their privileges to the SYSTEM user
CVE-2022-43781 is a command injection vulnerability using environment variables that could be exploited via specially crafted requests.
Attacker may leverage CVE-2022-2601 to cause a buffer overflow and a heap-based out-of-bounds write, further bypassing Secure Boot protection
Track as CVE-2022-45047, an attacker could exploit this vulnerability to deserialize and thus achieve remote code execution.
Redhat issued a risk notice for the Linux Kernel local privilege escalation vulnerability, the vulnerability number is CVE-2022-3977.
By persuading a victim to open a specially-crafted file, an attacker could exploit CVE-2022-40303 to execute arbitrary code on the system.
CVE-2022-20465 could be exploited to bypass the lock screen protections (fingerprint, PIN) and gain complete access to the user’s device.
The vulnerability numbered CVE-2022-21198 is more harmful because it affects multiple Intel CPUs except for the latest 13th Gen core series
CVE-2022-39328 (CVSS: 9.8) is unauthorized access to arbitrary endpoints which allows attackers to query protected endpoints
David Hoyt of Hoyt LLC conducted an in-depth analysis of the vulnerability and publicly disclosed CVE-2022-26730 PoC code.
CVE-2022-33684 can be exploited to launch a MITM attack and gain access to the communication channel between endpoints
CVE-2022-32287 allows attacker to traverse directories on the system, caused by improper validation of user-supplied input in a FileUtil class
CVE-2022-20961 (CVSS score: 8.8) was caused by insufficient CSRF protections for the web-based management interface of an affected device