Severity Rating: MEDIUM

Software Affected

Adobe Experience Manager (AEM) Cloud Service (CS)

Adobe Experience Manager (AEM) versions 6.5.14.0 and earlier

Overview

Multiple vulnerabilities have been reported in Adobe Experience Manager (AEM) which could be exploited by an attacker to execute arbitrary code or bypass security restrictions on the target system.

Description

These vulnerabilities exist in Adobe Experience Manager (AEM) due to an error while neutralizing user-controllable input (cross-site scripting), improper access control or an error while redirecting a URL to an untrusted site.

Successful exploitation of these vulnerabilities could allow the attacker to execute arbitrary code or bypass security restrictions on the target system.

Solution

Apply appropriate patches as mentioned in Adobe Security Update

Vendor Information

Adobe

References

Adobe

CVE Name

CVE-2022-42345

CVE-2022-42346

CVE-2022-30679

CVE-2022-42348

CVE-2022-42349

CVE-2022-42350

CVE-2022-42351

CVE-2022-42352

CVE-2022-35693

CVE-2022-42354

CVE-2022-35694

CVE-2022-42356

CVE-2022-42357

CVE-2022-35695

CVE-2022-35696

CVE-2022-42360

CVE-2022-42362

CVE-2022-42364

CVE-2022-42365

CVE-2022-42366

CVE-2022-42367

CVE-2022-44462

CVE-2022-44463

CVE-2022-44465

CVE-2022-44466

CVE-2022-44467

CVE-2022-44468

CVE-2022-44469

CVE-2022-44470

CVE-2022-44471

CVE-2022-44473

CVE-2022-44474

CVE-2022-44488

Severity Rating: HIGH

Software Affected

Google Chrome Stable channel versions prior to 108.0.5359.124 for Mac and Linux

Google Chrome Stable channel versions prior to 108.0.5359.124/125 for Windows

Overview

Multiple Vulnerabilities have been reported in Google Chrome for Desktop which could be exploited by a remote attacker to execute arbitrary code or cause denial of service condition on the targeted system.

Description

These vulnerabilities exist in Google Chrome for Desktop due to Use-after-free in Blink Media, Mojo IPC, Blink Frames, Aura and in Profiles. An attacker could exploit these vulnerabilities by persuading a victim to visit a specially crafted website.

Successful exploitation of these vulnerabilities could allow a remote attacker to execute arbitrary code or cause denial of service condition on the targeted system.

Solution

Apply appropriate updates as mentioned

Vendor Information

Google Chrome

References

Google Chrome

CVE Name

CVE-2022-4436

CVE-2022-4437

CVE-2022-4438

CVE-2022-4439

CVE-2022-4440

Severity Rating: HIGH

Software Affected

Apple iCloud for Windows versions prior to 14.1

Overview

Multiple vulnerabilities have been reported in Apple iCloud for Windows which could allow an attacker to disclose sensitive information, execute arbitrary code or bypass security restrictions on the targeted system.

Description

These vulnerabilities exist in Apple iCloud for Windows due to an out-of-bound write issue in ImageIO and logic issue in the WebKit component. An attacker could exploit these vulnerabilities by executing a specially crafted application.

Successful exploitation of these vulnerabilities could allow the attacker to disclose sensitive information, execute arbitrary code or bypass security restrictions on the target system.

Solution

Apply appropriate patches as mentioned in the Apple Security Updates

Vendor Information

Apple

References

Apple

CVE Name

CVE-2022-46693

CVE-2022-46692

CVE-2022-46698

Severity Rating: CRITICAL

Software Affected

H5P module version prior 7.1.51.

File (Field) Paths module version prior 7.1.2.

Overview

Multiple vulnerabilities have been reported in Drupal which could allow an unauthenticated remote attacker to execute arbitrary code and bypass security restrictions on the targeted system.

Description

1. Access Bypass

This vulnerability exists in the File (Field) Paths module due to extends the default functionality of Drupals core File module. A remote attacker could exploit this vulnerability by guessing the temporary path used for file upload.

Successful exploitation of this vulnerability could allow an attacker to bypass and manage security restrictions.

2. Remote Code Execution

This vulnerability exists in the H5P module due to insufficient stop path traversal. An attacker could exploit this vulnerability with "update h5p libraries" permission to gain unauthorized access.

Successful exploitation of this vulnerability could allow an attacker to perform remote code execution on the targeted system.

Solution

Apply appropriate updates as mentioned:

Vendor Information

Drupal

References

Drupal

Severity Rating: HIGH

Software Affected

Google ChromeOS LTS Channel versions prior to 102.0.5005.193 (Platform Version: 14695.166.0)

Overview

Multiple vulnerabilities have been reported in Google Chrome OS which could be exploited by a remote attacker to execute arbitrary code or cause a denial-of-service condition on the targeted system.

Description

Multiple vulnerabilities exist in Google Chrome OS due to Use after free in Mojo, Audio and Forms; Heap buffer overflow in GPU. An attacker could exploit these vulnerabilities by persuading a victim to visit a specially crafted Web site.

Successful exploitation of these vulnerabilities could allow a remote attacker to execute arbitrary code or cause a denial-of-service condition on the targeted system.

Solution

Apply appropriate updates as mentioned by the vendor:

Vendor Information

Google Chrome

References

Google Chrome

CVE Name

CVE-2022-4178

CVE-2022-4179

CVE-2022-4181

CVE-2022-4135

Severity Rating: High

Software Affected

macOS Ventura 13.1

macOS Big Sur 11.7.2

macOS Monterey 12.6.2

Overview

Multiple vulnerabilities have been reported in Apple products which could allow an attacker to gain elevated privileges, execute arbitrary code, disclose sensitive information and bypass security restriction on the targeted system.

Description

Multiple vulnerabilities exist in various components of Apple macOS Ventura, Big Sur and Monterey products.

Successful exploitation of these vulnerabilities could allow the attacker to gain elevated privileges, execute arbitrary code, disclose sensitive information and bypass security restriction on the targeted system.

Solution

Apply appropriate security updates as mentioned in the .   Apple Security Update

Vendor Information

Apple

References

Apple

CVE Name

CVE-2022-42843

CVE-2022-42847

CVE-2022-42865

CVE-2022-42854

CVE-2022-42853

CVE-2022-42859

CVE-2022-32942

CVE-2022-46693

CVE-2022-42864

CVE-2022-46690

CVE-2022-46697

CVE-2022-42837

CVE-2022-46689

CVE-2022-46701

CVE-2022-42842

CVE-2022-42861

CVE-2022-42845

CVE-2022-32943

CVE-2022-42840

CVE-2022-42855

CVE-2022-42862

CVE-2022-24836

CVE-2022-29181

CVE-2022-46695

CVE-2022-42866

CVE-2022-42867

CVE-2022-46691

CVE-2022-46692

CVE-2022-42852

CVE-2022-46696

CVE-2022-46700

CVE-2022-46698

CVE-2022-46699

CVE-2022-42863

CVE-2022-42856

CVE-2022-42841

CVE-2022-42821

CVE-2022-40303

CVE-2022-40304

Severity Rating: HIGH

Software Affected

Apple Safari versions prior to 16.2

Apple iOS version prior to 15.1

Overview

Multiple vulnerabilities have been reported in Apple Safari which could be exploited by an attacker to execute arbitrary code, bypass implemented security restrictions, disclosure of process memory, gain access to potentially sensitive information and bypass Same Origin Policy on the targeted system.

Description

These vulnerabilities are due to boundary error, logic issue, use after free issue excessive, type confusion error in WebKit while processing maliciously crafted web content.

Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code, bypass implemented security restrictions, disclosure of process memory, gain access to potentially sensitive information and bypass Same Origin Policy on the targeted system.

Solution

Apply appropriate upgrade as mentioned in advisory:

Vendor Information

Apple

References

Apple

CVE Name

CVE-2022-42852

CVE-2022-42856

CVE-2022-42863

CVE-2022-42867

CVE-2022-46691

CVE-2022-46692

CVE-2022-46696

CVE-2022-46698

CVE-2022-46699

CVE-2022-46700