CVE-2022-4922
published 2023-07-29CVE-2022-4922: Inappropriate implementation in Blink in Google Chrome prior to 99.0.4844.51 allowed a remote attacker to perform UI spoofing via a crafted HTML page…
PriorityP429medium6.5CVSS 3.1
AVNACLPRNUIRSUCNIHAN
EPSS
0.58%
46.5th percentile
Inappropriate implementation in Blink in Google Chrome prior to 99.0.4844.51 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| chromium | chromium | >= 0 < 99.0.4844.51-1~deb11u1 | 99.0.4844.51-1~deb11u1 |
| chromium | chromium | >= 0 < 99.0.4844.51-1 | 99.0.4844.51-1 |
| chromium | chromium | >= 0 < 99.0.4844.51-1 | 99.0.4844.51-1 |
| chromium | chromium | >= 0 < 99.0.4844.51-1 | 99.0.4844.51-1 |
| debian | chromium | < chromium 99.0.4844.51-1 (bookworm) | chromium 99.0.4844.51-1 (bookworm) |
| chrome | < 99.0.4844.51 | 99.0.4844.51 | |
| chrome | >= 99.0.4844.51 < 99.0.4844.51 | 99.0.4844.51 | |
| chrome_chrome | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
osv6.5MEDIUM
vendor_debian6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Chrome
Stable Channel Update for Desktop: CVE-2022-4922
vendor_chrome·2022-03-01·CVSS 6.5
CVE-2022-4922 [MEDIUM] Stable Channel Update for Desktop: CVE-2022-4922
Stable Channel Update for Desktop
CVE-2022-4922: Inappropriate implementation in Blink. Reported by Thomas Orlita on 2021-10-19 [$1000][ 1283434 ] Medium CVE-2022-0806: Data leak in Canvas
Reported by Paril on 2021-12-31 [$TBD][ 1287364 ] Medium CVE-2022-0807: Inappropriate implementation in Autofill
Severity: medium
Debian
CVE-2022-4922: chromium - Inappropriate implementation in Blink in Google Chrome prior to 99.0.4844.51 all...
vendor_debian·2022·CVSS 6.5
CVE-2022-4922 [MEDIUM] CVE-2022-4922: chromium - Inappropriate implementation in Blink in Google Chrome prior to 99.0.4844.51 all...
Inappropriate implementation in Blink in Google Chrome prior to 99.0.4844.51 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
Scope: local
bookworm: resolved (fixed in 99.0.4844.51-1)
bullseye: resolved (fixed in 99.0.4844.51-1~deb11u1)
forky: resolved (fixed in 99.0.4844.51-1)
sid: resolved (fixed in 99.0.4844.51-1)
trixie: resolved (fixed in 99.0.4844.51-1)
OSV
CVE-2022-4922: Inappropriate implementation in Blink in Google Chrome prior to 99
osv·2023-07-29·CVSS 6.5
CVE-2022-4922 [MEDIUM] CVE-2022-4922: Inappropriate implementation in Blink in Google Chrome prior to 99
Inappropriate implementation in Blink in Google Chrome prior to 99.0.4844.51 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
GHSA
GHSA-c6f7-f5rw-4jq8: Inappropriate implementation in Blink in Google Chrome prior to 99
ghsa_unreviewed·2023-07-29
CVE-2022-4922 [MEDIUM] GHSA-c6f7-f5rw-4jq8: Inappropriate implementation in Blink in Google Chrome prior to 99
Inappropriate implementation in Blink in Google Chrome prior to 99.0.4844.51 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2022-23913 artemis-commons: Apache ActiveMQ Artemis DoS
bugzilla·2022-03-14·CVSS 7.5
CVE-2022-23913 [HIGH] CVE-2022-23913 artemis-commons: Apache ActiveMQ Artemis DoS
CVE-2022-23913 artemis-commons: Apache ActiveMQ Artemis DoS
In Apache ActiveMQ Artemis prior to 2.20.0 or 2.19.1, an attacker could partially disrupt availability (DoS) through uncontrolled resource consumption of memory.
https://lists.apache.org/thread/fjynj57rd99s814rdn5hzvmx8lz403q2
Discussion:
This issue has been addressed in the following products:
Red Hat JBoss Enterprise Application Platform
Via RHSA-2022:4922 https://access.redhat.com/errata/RHSA-2022:4922
---
This issue has been addressed in the following products:
Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7
Via RHSA-2022:4918 https://access.redhat.com/errata/RHSA-2022:4918
---
This issue has been addressed in the following products:
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
Via RHS
Bugzilla
CVE-2022-23221 h2: Loading of custom classes from remote servers through JNDI
bugzilla·2022-01-24·CVSS 9.8
CVE-2022-23221 [CRITICAL] CVE-2022-23221 h2: Loading of custom classes from remote servers through JNDI
CVE-2022-23221 h2: Loading of custom classes from remote servers through JNDI
H2 Console before 2.1.210 allows remote attackers to execute arbitrary code via a jdbc:h2:mem JDBC URL containing the IGNORE_UNKNOWN_SETTINGS=TRUE;FORBID_CREATION=FALSE;INIT=RUNSCRIPT substring, a different vulnerability than CVE-2021-42392.
https://github.com/h2database/h2database/security/advisories
https://github.com/h2database/h2database/releases/tag/version-2.1.210
https://twitter.com/d0nkey_man/status/1483824727936450564
Discussion:
This issue has been addressed in the following products:
Red Hat JBoss Enterprise Application Platform
Via RHSA-2022:4922 https://access.redhat.com/errata/RHSA-2022:4922
---
This issue has been addressed in the following products:
Red Hat JBoss Enterprise Application Pl
https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop.htmlhttps://crbug.com/1261191https://lists.fedoraproject.org/archives/list/[email protected]/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ/https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop.htmlhttps://crbug.com/1261191https://lists.fedoraproject.org/archives/list/[email protected]/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ/
2023-07-29
Published