CVE-2022-21817

CriticalCVSS 9.3/10Last modified Jun 17, 2026

Description

NVIDIA Omniverse Launcher contains a Cross-Origin Resource Sharing (CORS) vulnerability which can allow an unprivileged remote attacker, if they can get user to browse malicious site, to acquire access tokens allowing them to access resources in other security domains, which may lead to code execution, escalation of privileges, and impact to confidentiality and integrity.

Metrics

CVSS 3.1 9.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://nvidia.custhelp.com/app/answers/detail/a_id/5318Vendor Advisory
https://nvidia.custhelp.com/app/answers/detail/a_id/5318Vendor Advisory

Timeline

Published: Feb 2, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-218185.4NVIDIA License System contains a vulnerability in the installation scripts for the DLS virtual appliance, where a user on a network after si CVE-2022-218197.6NVIDIA distributions of Jetson Linux contain a vulnerability where an error in the IOMMU configuration may allow an unprivileged attacker wi CVE-2022-21827.8Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.CVE-2022-218206.3NVIDIA DCGM contains a vulnerability in nvhostengine, where a network user can cause detection of error conditions without action, which may CVE-2022-218217.8NVIDIA CUDA Toolkit SDK contains an integer overflow vulnerability in cuobjdump.To exploit this vulnerability, a remote attacker would requi CVE-2022-218227.5NVIDIA FLARE contains a vulnerability in the admin interface, where an un-authorized attacker can cause Allocation of Resources Without Limi CVE-2022-218235.5A insecure storage of sensitive information vulnerability exists in Ivanti Workspace Control <2021.2 (10.7.30.0) that could allow an attacke CVE-2022-218248.2Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties CVE-2022-218257.8An Improper Access Control vulnerability exists in Citrix Workspace App for Linux 2012 - 2111 with App Protection installed that can allow a CVE-2022-218265.4Pulse Secure version 9.115 and below may be susceptible to client-side http request smuggling, When the application receives a POST request,CVE-2022-218277.1An improper privilege vulnerability has been discovered in Citrix Gateway Plug-in for Windows (Citrix Secure Access for Windows) <21.9.1.2 w CVE-2022-218287.2A user with high privilege access to the Incapptic Connect web console can remotely execute code on the Incapptic Connect server using a uns