CVE-2022-36174

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

FreshService Windows Agent < 2.11.0 and FreshService macOS Agent < 4.2.0 and FreshService Linux Agent < 3.3.0. are vulnerable to Broken integrity checking via the FreshAgent client and scheduled update service.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-354

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://community.freshworks.com/product-updates/freshservice-release-notes-april-2022-23982#Security+updates:+Discovery+Probe+and+Discovery+AgentRelease Notes, Vendor Advisory
https://public-exposure.inform.social/post/integrity-checking/Exploit, Third Party Advisory
https://community.freshworks.com/product-updates/freshservice-release-notes-april-2022-23982#Security+updates:+Discovery+Probe+and+Discovery+AgentRelease Notes, Vendor Advisory
https://public-exposure.inform.social/post/integrity-checking/Exploit, Third Party Advisory

Timeline

Published: Sep 12, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-361799.8Fusiondirectory 1.3 suffers from Improper Session Handling.CVE-2022-36184.8The Spacer WordPress plugin before 3.0.7 does not sanitize and escapes some of its settings, which could allow high-privilege users such as CVE-2022-361809.6Fusiondirectory 1.3 is vulnerable to Cross Site Scripting (XSS) via /fusiondirectory/index.php?message=[injection], /fusiondirectory/index.p CVE-2022-361826.1Hashicorp Boundary v0.8.0 is vulnerable to Clickjacking which allow for the interception of login credentials, re-direction of users to mali CVE-2022-361867.5A Null Pointer dereference vulnerability exists in GPAC 2.1-DEV-revUNKNOWN-master via the function gf_filter_pid_set_property_full () at fil CVE-2022-36194.3A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects the function l2cap_recv_acldata of CVE-2022-361909.8GPAC mp4box 2.1-DEV-revUNKNOWN-master has a use-after-free vulnerability in function gf_isom_dovi_config_get. This vulnerability was fixed i CVE-2022-361915.5A heap-buffer-overflow had occurred in function gf_isom_dovi_config_get of isomedia/avc_ext.c:2490, as demonstrated by MP4Box. This vulnerab CVE-2022-361939.8SQL injection in School Management System 1.0 allows remote attackers to modify or delete data, causing persistent changes to the applicatio CVE-2022-361945.4Centreon 22.04.0 is vulnerable to Cross Site Scripting (XSS) from the function Pollers > Broker Configuration by adding a crafted payload in CVE-2022-361975.4BigTree CMS 4.4.16 was discovered to contain an arbitrary file upload vulnerability which allows attackers to execute arbitrary code via a c CVE-2022-361989.8Multiple SQL injections detected in Bus Pass Management System 1.0 via buspassms/admin/view-enquiry.php, buspassms/admin/pass-bwdates-report