CVE-2022-4135 is a heap buffer overflow vulnerability in the Google Chromium GPU component. It allows a remote attacker who has compromised the renderer process to potentially escape the sandbox by using a crafted HTML page. This vulnerability affects multiple Chromium-based browsers such as Google Chrome, Microsoft Edge, and Opera. Exploitation in the wild has been observed. No specific affected versions or patch information is provided.
CVE-2022-41049 is a security feature bypass vulnerability in Microsoft Windows Mark of the Web (MOTW) that results in a limited loss of integrity and availability of security features. It has been exploited in the wild. No specific affected versions or patch information is provided.
Samsung mobile devices have an improper access control vulnerability in the clipboard service that allows untrusted applications to read or write arbitrary files. This vulnerability has been exploited in the wild and was chained with other vulnerabilities (CVE-2021-25369 and CVE-2021-25370). No specific affected versions or patch information is provided.
CVE-2021-25369 is an improper access control vulnerability in Samsung mobile devices using Mali GPUs. It involves the sec_log file, where exploitation allows exposure of sensitive kernel information to userspace. This vulnerability has been exploited in the wild and was chained with CVE-2021-25337 and CVE-2021-25370. No specific affected versions or patch information is provided.
CVE-2021-25370 is a memory corruption vulnerability in Samsung mobile devices using the Mali GPU. It arises from an incorrect handling of file descriptors in the dpu driver, which can cause memory corruption and lead to a kernel panic. This vulnerability has been exploited in the wild and was chained with other vulnerabilities (CVE-2021-25337 and CVE-2021-25369).
CVE-2022-41091 is a security feature bypass vulnerability in Microsoft Windows Mark of the Web (MOTW) that results in a limited loss of integrity and availability of security features. It has been exploited in the wild and is known to be used in ransomware campaigns. No specific affected versions or patch information is provided in the available data.
CVE-2022-41125 is a high-severity privilege escalation vulnerability in the Microsoft Windows Cryptographic Next Generation (CNG) Key Isolation Service. It allows an attacker to gain SYSTEM-level privileges. The vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.
CVE-2022-41128 is a high-severity remote code execution vulnerability in the Microsoft Windows JScript9 scripting language. It allows an attacker to execute arbitrary code remotely, potentially leading to full system compromise. The vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.
CVE-2022-41073 is a high-severity privilege escalation vulnerability in the Microsoft Windows Print Spooler service. It allows an attacker to gain SYSTEM-level privileges. The vulnerability has been exploited in the wild and is known to have been used in ransomware campaigns. No specific affected versions or patch information is provided in the available data.
CVE-2022-3723 is a high-severity type confusion vulnerability in the Google Chromium V8 JavaScript engine. It allows a remote attacker to potentially cause heap corruption by crafting a malicious HTML page. This vulnerability affects multiple Chromium-based web browsers, including Google Chrome, Microsoft Edge, and Opera. Exploits for this vulnerability have been observed in the wild. No specific affected versions or patch information is provided in the available data.
CVE-2022-42827 is an out-of-bounds write vulnerability in the Apple iOS and iPadOS kernel that allows an application to execute code with kernel privileges. This vulnerability has been exploited in the wild. It affects Apple iOS and iPadOS but specific affected versions are not provided. The severity is high due to the potential for privilege escalation to kernel level.
Multiple GIGABYTE products including GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU contain low-level driver vulnerabilities that allow local attackers to read and write arbitrary physical memory. This flaw enables privilege escalation on affected systems. The vulnerability is known to be exploited in the wild and has been used in ransomware campaigns.
CVE-2018-19320 is a high-severity vulnerability affecting multiple GIGABYTE products including GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU II. The vulnerability arises from the GDrv low-level driver exposing ring0 memcpy-like functionality, which could allow a local attacker to gain complete control over the affected system. This vulnerability has been exploited in the wild and is known to have been used in ransomware campaigns. No specific affected versions or patch information is provided in the available data.
CVE-2020-3433 is a DLL hijacking vulnerability in Cisco AnyConnect Secure Mobility Client for Windows. The vulnerability arises from insufficient validation of resources loaded at runtime via the interprocess communication channel. An attacker with valid Windows credentials could exploit this flaw to execute code with SYSTEM privileges on the affected machine. This vulnerability has been exploited in the wild and is associated with known ransomware campaigns.
Multiple GIGABYTE products including GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU II contain low-level driver vulnerabilities that allow local attackers to read and write arbitrary physical memory, enabling privilege escalation. This vulnerability has been exploited in the wild and is associated with known ransomware campaigns.
Multiple GIGABYTE products including GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU II contain low-level driver vulnerabilities (GPCIDrv and GDrv) that allow reading and writing to IO ports. This flaw can be exploited to execute code with elevated privileges. The vulnerability has been exploited in the wild and is associated with known ransomware campaigns.
CVE-2020-3153 is a vulnerability in Cisco AnyConnect Secure Mobility Client for Windows involving improper handling of directory paths. An attacker with valid Windows credentials can exploit this flaw to copy malicious files to arbitrary locations with system-level privileges, enabling attacks such as DLL pre-loading and DLL hijacking. This vulnerability has been exploited in the wild and is known to be used in ransomware campaigns.
CVE-2021-3493 is a privilege escalation vulnerability in the Linux kernel's overlayfs stacking file system. It arises because the kernel does not properly validate file capabilities in relation to user namespaces, potentially allowing an attacker to escalate privileges. This vulnerability has been exploited in the wild and is considered high severity.
CVE-2022-41352 is a high-severity vulnerability in Synacor Zimbra Collaboration Suite (ZCS) that allows attackers to upload arbitrary files via a cpio package. This flaw enables unauthorized access to other user accounts. The vulnerability has been exploited in the wild and is associated with known ransomware campaigns. No specific affected versions or patch information is provided.
CVE-2022-40684 is an authentication bypass vulnerability affecting multiple Fortinet products including FortiOS, FortiProxy, and FortiSwitchManager. This flaw allows unauthenticated attackers to perform administrative operations via specially crafted HTTP or HTTPS requests. The vulnerability has been exploited in the wild and is known to be used in ransomware campaigns. No specific affected versions or patch information is provided in the available data.