First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2022-41119

HighCVSS 7.8/10Last modified Aug 10, 2026

Description

Visual Studio Remote Code Execution Vulnerability

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
Microsoft	Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)	>= 15.9.0, < 15.9.51
Microsoft	Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10)	>= 16.11.0, < 16.11.21
Microsoft	Microsoft Visual Studio 2022 version 17.0	>= 17.0.0, < 17.0.16
Microsoft	Microsoft Visual Studio 2022 version 17.2	>= 17.2.0, < 17.2.10
Microsoft	Microsoft Visual Studio 2022 version 17.3	>= 17.0.0, < 17.3.7

References

Timeline

Published: Nov 9, 2022
Last modified: Aug 10, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-41124.8The Quizlord WordPress plugin through 2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as CVE-2022-411207.8Microsoft Windows System Monitor (Sysmon) Elevation of Privilege Vulnerability CVE-2022-411217.8Windows Graphics Component Elevation of Privilege Vulnerability CVE-2022-411226.5Microsoft SharePoint Server Spoofing Vulnerability CVE-2022-411237.8Microsoft Exchange Server Elevation of Privilege Vulnerability CVE-2022-411257.8Windows CNG Key Isolation Service Elevation of Privilege Vulnerability CVE-2022-411278.5Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability CVE-2022-411288.8Windows Scripting Languages Remote Code Execution Vulnerability CVE-2022-411317.8Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Hive Provider, Ap CVE-2022-411326.1Unauthenticated Plugin Settings Change Leading To Stored XSS Vulnerability in Ezoic plugin <= 2.8.8 on WordPress.CVE-2022-411338.8The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a SQL injection that exists in GetDIAE_line_message_setting CVE-2022-411348.8Cross-Site Request Forgery (CSRF) in OptinlyHQ Optinly – Exit Intent, Newsletter Popups, Gamification & Opt-in Forms plugin <= 1.0.15 versio