CVE-2022-1824

HighCVSS 8.2/10Last modified Jun 17, 2026

Description

An uncontrolled search path vulnerability in McAfee Consumer Product Removal Tool prior to version 10.4.128 could allow a local attacker to perform a sideloading attack by using a specific file name. This could result in the user gaining elevated permissions and being able to execute arbitrary code as there were insufficient checks on the executable being signed by McAfee.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-427

Affected software

No affected versions have been published.

Timeline

Published: Jun 20, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-18255.4Cross-site Scripting (XSS) - Reflected in GitHub repository collectiveaccess/providence prior to 1.8.CVE-2022-18266.5The Cross-Linker WordPress plugin through 3.0.1.9 does not have CSRF check in place when creating Cross-Links, which could allow attackers t CVE-2022-18276.5The PDF24 Article To PDF WordPress plugin through 4.2.2 does not have CSRF check in place when updating its settings, which could allow atta CVE-2022-18286.5The PDF24 Articles To PDF WordPress plugin through 4.2.2 does not have CSRF check in place when updating its settings, which could allow att CVE-2022-18296.5The Inline Google Maps WordPress plugin through 5.11 does not have CSRF check in place when updating its settings, which could allow attacke CVE-2022-18306.5The Amazon Einzeltitellinks WordPress plugin through 1.3.3 does not have CSRF check in place when updating its settings, which could allow a CVE-2022-18316.5The WPlite WordPress plugin through 1.3.1 does not have CSRF check in place when updating its settings, which could allow attackers to make CVE-2022-18326.5The CaPa Protect WordPress plugin through 0.5.8.2 does not have CSRF check in place when updating its settings, which could allow attackers CVE-2022-18338.8A flaw was found in AMQ Broker Operator 7.9.4 installed via UI using OperatorHub where a low-privilege user that has access to the namespace CVE-2022-18346.5When displaying the sender of an email, and the sender name contained the Braille Pattern Blank space character multiple times, Thunderbird CVE-2022-18377.2A vulnerability was found in Home Clean Services Management System 1.0. It has been rated as critical. Affected by this issue is register.ph CVE-2022-18387.2A vulnerability classified as critical has been found in Home Clean Services Management System 1.0. This affects an unknown part of admin/lo