CVE-2022-4291

CriticalCVSS 10.0/10Last modified Jun 17, 2026

Description

The aswjsflt.dll library from Avast Antivirus windows contained a potentially exploitable heap corruption vulnerability that could enable an attacker to bypass the sandbox of the application it was loaded into, if applicable. This issue was fixed in version 18.0.1478 of the Script Shield Component.

Metrics

CVSS 3.1 10.0/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-119CWE-787

Affected software

No affected versions have been published.

Timeline

Published
Dec 8, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-429158.1curl before 7.86.0 has a double free. If curl is told to use an HTTP proxy for a transfer with a non-HTTP(S) URL, it sets up the connection CVE-2022-429167.5In curl before 7.86.0, the HSTS check could be bypassed to trick it into staying with HTTP. Using its HSTS support, curl can be instructed tCVE-2022-429176.7In FRRouting FRR before 8.5, the service user (usually frr) can escalate its privileges to root by monitoring the configuration directory (/CVE-2022-429197.8Python 3.9.x before 3.9.16 and 3.10.x before 3.10.9 on Linux allows local privilege escalation in a non-default configuration. The Python muCVE-2022-42927.8Use After Free in GitHub repository vim/vim prior to 9.0.0882.CVE-2022-429209.8Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an out-of-bCVE-2022-429238.8Forma LMS on its 3.1.0 version and earlier is vulnerable to a SQL injection vulnerability. The exploitation of this vulnerability could alloCVE-2022-429246.5Forma LMS on its 3.1.0 version and earlier is vulnerable to a SQL injection vulnerability. The exploitation of this vulnerability could alloCVE-2022-429258.8There is a vulnerability on Forma LMS version 3.1.0 and earlier that could allow an authenticated attacker (with the role of student) to priCVE-2022-429278.1A same-origin policy violation could have allowed the theft of cross-origin URL entries, leaking the result of a redirect, via `performance.CVE-2022-429288.8Certain types of allocations were missing annotations that, if the Garbage Collector was in a specific state, could have lead to memory corrCVE-2022-429296.5If a website called `window.print()` in a particular way, it could cause a denial of service of the browser, which may persist beyond browse