CVE-2022-42979

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Information disclosure due to an insecure hostname validation in the RYDE application 5.8.43 for Android and iOS allows attackers to take over an account via a deep link.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-295 CWE-200

Affected software

No affected versions have been published.

Timeline

Published: Jan 6, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-42989.8The Wholesale Market WordPress plugin before 2.2.1 does not have authorisation check, as well as does not validate user input used to genera CVE-2022-429809.8go-admin (aka GO Admin) 2.0.12 uses the string go-admin as a production JWT key.CVE-2022-429827.5BKG Professional NtripCaster 2.0.39 allows querying information over the UDP protocol without authentication. The NTRIP sourcetable is typic CVE-2022-429838.8anji-plus AJ-Report 0.9.8.6 allows remote attackers to bypass login authentication by spoofing JWT Tokens.CVE-2022-429849.8WoWonder Social Network Platform 4.1.4 was discovered to contain a SQL injection vulnerability via the offset parameter at requests.php?f=se CVE-2022-429854.8The ScratchLogin extension through 1.1 for MediaWiki does not escape verification failure messages, which allows users with administrator pr CVE-2022-429899.0ERP Sankhya before v4.11b81 was discovered to contain a cross-site scripting (XSS) vulnerability via the component Caixa de Entrada.CVE-2022-42994.8The Metricool WordPress plugin before 1.18 does not sanitise and escape some of its settings, which could allow high privilege users such as CVE-2022-429907.2Food Ordering Management System v1.0 was discovered to contain a SQL injection vulnerability via the component /foms/all-orders.php?status=C CVE-2022-429915.4A stored cross-site scripting (XSS) vulnerability in Simple Online Public Access Catalog v1.0 allows attackers to execute arbitrary web scri CVE-2022-429925.4Multiple stored cross-site scripting (XSS) vulnerabilities in Train Scheduler App v1.0 allow attackers to execute arbitrary web scripts or H CVE-2022-429935.4Password Storage Application v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Setup page.