CVE-2022-38176

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

An issue was discovered in YSoft SAFEQ 6 before 6.0.72. Incorrect privileges were configured as part of the installer package for the Client V3 services, allowing for local user privilege escalation by overwriting the executable file via an alternative data stream. NOTE: this is not the same as CVE-2021-31859.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published
Sep 6, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-381777.5By spoofing the target resolver with responses that have a malformed ECDSA signature, an attacker can trigger a small memory leak. It is posCVE-2022-381787.5By spoofing the target resolver with responses that have a malformed EdDSA signature, an attacker can trigger a small memory leak. It is posCVE-2022-381796.1JetBrains Ktor before 2.1.0 was vulnerable to the Reflect File Download attackCVE-2022-38185.3An uncontrolled resource consumption issue when parsing URLs in GitLab CE/EE affecting all versions prior to 15.3.5, 15.4 prior to 15.4.4, aCVE-2022-381806.5In JetBrains Ktor before 2.1.0 the wrong authentication provider could be selected in some casesCVE-2022-381818.8The Arm Mali GPU kernel driver allows unprivileged users to access freed memory because GPU memory operations are mishandled. This affects BCVE-2022-381836.5In Gitea before 1.16.9, it was possible for users to add existing issues to projects. Due to improper access controls, an attacker could assCVE-2022-381847.5There is an improper access control vulnerability in Portal for ArcGIS versions 10.8.1 and below which could allow a remote, unauthenticatedCVE-2022-381866.1There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.8.1 and below which may allow a remote attacker able to convincCVE-2022-381877.5Prior to version 10.9.0, the sharing/rest/content/features/analyze endpoint is always accessible to anonymous users, which could allow an unCVE-2022-381886.1There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1 which may allow a remote attacker able to convince a user tCVE-2022-381895.4A stored Cross Site Scripting (XSS) vulnerability in Esri Portal for ArcGIS may allow a remote, authenticated attacker to pass and store mal
CVE-2022-38176: High severity, CVSS 7.8 | Vulnix