CVE-2022-0675

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

In certain situations it is possible for an unmanaged rule to exist on the target system that has the same comment as the rule specified in the manifest. This could allow for unmanaged rules to exist on the target system and leave the system in an unsafe state.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1289 CWE-20

Affected software

No affected versions have been published.

Timeline

Published: Mar 2, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-06767.8Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.6.4.CVE-2022-06777.5Improper Handling of Length Parameter Inconsistency vulnerability in the Update Server component of Bitdefender Endpoint Security Tools (in CVE-2022-06786.1Cross-site Scripting (XSS) - Reflected in Packagist microweber/microweber prior to 1.2.11.CVE-2022-06799.8The Narnoo Distributor WordPress plugin through 2.5.1 fails to validate and sanitize the lib_path parameter before it is passed into a call CVE-2022-06806.1The Plezi WordPress plugin before 1.0.3 has a REST endpoint allowing unauthenticated users to update the plz_configuration_tracker_enable op CVE-2022-06816.5The Simple Membership WordPress plugin before 4.1.0 does not have CSRF check in place when deleting Transactions, which could allow attacker CVE-2022-06836.1The Essential Addons for Elementor Lite WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization CVE-2022-06844.8The WP Home Page Menu WordPress plugin before 3.1 does not sanitise and escape its settings, allowing high privilege users such as admin to CVE-2022-06857.8Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4418.CVE-2022-06869.1Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.8.CVE-2022-06878.8The Amelia WordPress plugin before 1.0.47 stores image blobs into actual files whose extension is controlled by the user, which may lead to CVE-2022-06884.9Business Logic Errors in Packagist microweber/microweber prior to 1.2.11.