CVE-2022-33898

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Insecure inherited permissions in some Intel(R) NUC Watchdog Timer installation software before version 2.0.21.0 may allow an authenticated user to potentially enable escalation of privilege via local access.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-277 CWE-732

Affected software

No affected versions have been published.

Timeline

Published: Nov 14, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-339007.2PHP Object Injection vulnerability in Easy Digital Downloads plugin <= 3.0.1 at WordPress.CVE-2022-339017.5Unauthenticated Arbitrary File Read vulnerability in MultiSafepay plugin for WooCommerce plugin <= 4.13.1 at WordPress.CVE-2022-339027.8Insufficient control flow management in the Intel(R) Quartus Prime Pro and Standard edition software may allow an authenticated user to pote CVE-2022-339037.5Tor 0.4.7.x before 0.4.7.8 allows a denial of service via the wedging of RTT estimation.CVE-2022-339057.0DMA transactions which are targeted at input buffers used for the AhciBusDxe software SMI handler could cause SMRAM corruption (a TOCTOU att CVE-2022-339066.4DMA transactions which are targeted at input buffers used for the FwBlockServiceSmm software SMI handler could cause SMRAM corruption throug CVE-2022-339076.4DMA transactions which are targeted at input buffers used for the software SMI handler used by the IdeBusDxe driver could cause SMRAM corrup CVE-2022-339087.0DMA transactions which are targeted at input buffers used for the SdHostDriver software SMI handler could cause SMRAM corruption through a T CVE-2022-339097.0DMA transactions which are targeted at input buffers used for the HddPassword software SMI handler could cause SMRAM corruption through a TO CVE-2022-33914.8The Retain Live Chat WordPress plugin through 0.1 does not sanitise and escape some of its settings, which could allow high privilege users CVE-2022-339105.4An XSS vulnerability in MantisBT before 2.25.5 allows remote attackers to attach crafted SVG documents to issue reports or bugnotes. When a CVE-2022-339115.3An issue was discovered in Couchbase Server 7.x before 7.0.4. Field names are not redacted in logged validation messages for Analytics Servi