CVE-2022-29851

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

documentconverter in OX App Suite through 7.10.6, in a non-default configuration with ghostscript, allows OS Command Injection because file conversion may occur for an EPS document that is disguised as a PDF document.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Oct 25, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-298525.4OX App Suite through 8.2 allows XSS because BMFreehand10 and image/x-freehand are not blocked.CVE-2022-298535.4OX App Suite through 8.2 allows XSS via a certain complex hierarchy that forces use of Show Entire Message for a huge HTML e-mail message.CVE-2022-298546.8A vulnerability in Mitel 6900 Series IP (MiNet) phones excluding 6970, versions 1.8 (1.8.0.12) and earlier, could allow a unauthenticated at CVE-2022-298556.8Mitel 6800 and 6900 Series SIP phone devices through 2022-04-27 have "undocumented functionality." A vulnerability in Mitel 6800 Series and CVE-2022-298567.5A hardcoded cryptographic key in Automation360 22 allows an attacker to decrypt exported RPA packages.CVE-2022-298584.3Silverstripe silverstripe/assets through 1.10 is vulnerable to improper access control that allows protected images to be published by chang CVE-2022-298599.8component/common/network/dhcp/dhcps.c in ambiot amb1_sdk (aka SDK for Ameba1) before 2022-03-11 mishandles data structures for DHCP packet d CVE-2022-29868.8Enabling and disabling installed H5P libraries did not include the necessary token to prevent a CSRF risk.CVE-2022-298627.5An infinite loop in OPC UA .NET Standard Stack 1.04.368 allows a remote attackers to cause the application to hang via a crafted message.CVE-2022-298637.5OPC UA .NET Standard Stack 1.04.368 allows remote attacker to cause a crash via a crafted message that triggers excessive memory allocation.CVE-2022-298647.5OPC UA .NET Standard Stack 1.04.368 allows a remote attacker to cause a server to crash via a large number of messages that trigger Uncontro CVE-2022-298657.5OPC UA .NET Standard Stack allows a remote attacker to bypass the application authentication check via crafted fake credentials.