CVE-2022-31688

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

VMware Workspace ONE Assist prior to 22.10 contains a Reflected cross-site scripting (XSS) vulnerability. Due to improper user input sanitization, a malicious actor with some user interaction may be able to inject javascript code in the target user's window.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Nov 9, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-316899.8VMware Workspace ONE Assist prior to 22.10 contains a Session fixation vulnerability. A malicious actor who obtains a valid session token maCVE-2022-31695.5A flaw was found in the Linux kernel. A denial of service flaw may occur if there is a consecutive request of the NVME_IOCTL_RESET and the NCVE-2022-316908.1Spring Security, versions 5.7 prior to 5.7.5, and 5.6 prior to 5.6.9, and older unsupported versions could be susceptible to a privilege escCVE-2022-316919.8Spring Tools 4 for Eclipse version 4.16.0 and below as well as VSCode extensions such as Spring Boot Tools, Concourse CI Pipeline Editor, BoCVE-2022-316929.8Spring Security, versions 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9 could be susceptible to authorization rules bypass via forward or includCVE-2022-316935.5VMware Tools for Windows (12.x.y prior to 12.1.5, 11.x.y and 10.x.y) contains a denial-of-service vulnerability in the VM3DMP driver. A maliCVE-2022-316947.3InstallBuilder Qt installers built with versions previous to 22.10 try to load DLLs from the installer binary parent directory when displayiCVE-2022-316968.8VMware ESXi contains a memory corruption vulnerability that exists in the way it handles a network socket. A malicious actor with local acceCVE-2022-316975.5The vCenter Server contains an information disclosure vulnerability due to the logging of credentials in plaintext. A malicious actor with aCVE-2022-316985.3The vCenter Server contains a denial-of-service vulnerability in the content library service. A malicious actor with network access to port CVE-2022-316993.3VMware ESXi contains a heap-overflow vulnerability. A malicious local actor with restricted privileges within a sandbox process may exploit CVE-2022-31707.8An out-of-bounds access issue was found in the Linux kernel sound subsystem. It could occur when the 'id->name' provided by the user did not