CVE-2022-42446

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Starting with Sametime 12, anonymous users are enabled by default. After logging in as an anonymous user, one has the ability to browse the User Directory and potentially create chats with internal users.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-276

Affected software

No affected versions have been published.

Timeline

Published: Dec 12, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-424478.8HCL Compass is vulnerable to Cross-Origin Resource Sharing (CORS). This vulnerability can allow an unprivileged remote attacker to trick a l CVE-2022-424495.4Unsafe default file type filter policy in HCL Domino Volt allows upload of .html file and execution of unsafe JavaScript in deployed applica CVE-2022-42454.3A flaw was found in codehaus-plexus. The org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment fails to sanitize comments for a --> sequen CVE-2022-424505.4Improper sanitization of SVG files in HCL Domino Volt allows client-side script injection in deployed applications.CVE-2022-424514.4Certain credentials within the BigFix Patch Management Download Plug-ins are stored insecurely and could be exposed to a local privileged us CVE-2022-424525.4HCL Launch is vulnerable to HTML injection. HTML code is stored and included without being sanitized. This can lead to further attacks such CVE-2022-424536.5There are insufficient warnings when a Fixlet is imported by a user. The warning message currently assumes the owner of the script is the lo CVE-2022-424545.3Insights for Vulnerability Remediation (IVR) is vulnerable to man-in-the-middle attacks that may lead to information disclosure.  This requi CVE-2022-424557.8ASUS EC Tool driver (aka d.sys) 1beb15c90dcf7a5234ed077833a0a3e900969b60be1d04fcebce0a9f8994bdbb, as signed by ASUS and shipped with multipl CVE-2022-424577.2Generex CS141 through 2.10 allows remote command execution by administrators via a web interface that reaches run_update in /usr/bin/gxserve CVE-2022-424589.8Authentication bypass using an alternate path or channel vulnerability in bingo!CMS version1.7.4.1 and earlier allows a remote unauthenticat CVE-2022-424597.2Auth. WordPress Options Change vulnerability in Image Hover Effects Ultimate plugin <= 9.7.1 on WordPress.