CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2022-42292
https://notcve.org/view.php?id=CVE-2022-42292
NVIDIA GeForce Experience contains a vulnerability in the NVContainer component, where a user without administrator privileges can create a symbolic link to a file that requires elevated privileges to write to or modify, which may lead to denial of service, escalation of privilege or limited data tampering. • https://nvidia.custhelp.com/app/answers/detail/a_id/5384 • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 7.3EPSS: 0%CPEs: 2EXPL: 0CVE-2022-31611
https://notcve.org/view.php?id=CVE-2022-31611
NVIDIA GeForce Experience contains an uncontrolled search path vulnerability in all its client installers, where an attacker with user level privileges may cause the installer to load an arbitrary DLL when the installer is launched. A successful exploit of this vulnerability could lead to escalation of privileges and code execution. • https://nvidia.custhelp.com/app/answers/detail/a_id/5384 • CWE-427: Uncontrolled Search Path Element •
CVSS: 8.2EPSS: 0%CPEs: 2EXPL: 0CVE-2022-42291
https://notcve.org/view.php?id=CVE-2022-42291
NVIDIA GeForce Experience contains a vulnerability in the installer, where a user installing the NVIDIA GeForce Experience software may inadvertently delete data from a linked location, which may lead to data tampering. An attacker does not have explicit control over the exploitation of this vulnerability, which requires the user to explicitly launch the installer from the compromised directory. • https://nvidia.custhelp.com/app/answers/detail/a_id/5384 • CWE-59: Improper Link Resolution Before File Access ('Link Following') CWE-1386: Insecure Operation on Windows Junction / Mount Point •
CVSS: 8.2EPSS: 0%CPEs: 2EXPL: 0CVE-2021-23175
https://notcve.org/view.php?id=CVE-2021-23175
NVIDIA GeForce Experience contains a vulnerability in user authorization, where GameStream does not correctly apply individual user access controls for users on the same device, which, with user intervention, may lead to escalation of privileges, information disclosure, data tampering, and denial of service, affecting other resources beyond the intended security authority of GameStream. NVIDIA GeForce Experience contiene una vulnerabilidad en la autorización de usuarios, en la que GameStream no aplica correctamente los controles de acceso individuales para los usuarios del mismo dispositivo, lo que, con la intervención del usuario, puede conllevar a una escalada de privilegios, divulgación de información, manipulación de datos y denegación de servicio, afectando a otros recursos más allá de la autoridad de seguridad prevista de GameStream • https://nvidia.custhelp.com/app/answers/detail/a_id/5295 • CWE-863: Incorrect Authorization •
CVSS: 8.3EPSS: 0%CPEs: 2EXPL: 0CVE-2021-1073
https://notcve.org/view.php?id=CVE-2021-1073
NVIDIA GeForce Experience, all versions prior to 3.23, contains a vulnerability in the login flow when a user tries to log in by using a browser, while, at the same time, any other web page is loaded in other tabs of the same browser. In this situation, the web page can get access to the token of the user login session, leading to the possibility that the user’s account is compromised. This may lead to the targeted user’s data being accessed, altered, or lost. NVIDIA GeForce Experience, en todas las versiones anteriores a la 3.23, contiene una vulnerabilidad en el flujo de inicio de sesión cuando un usuario intenta iniciar la sesión utilizando un navegador, mientras, al mismo tiempo, se carga cualquier otra página web en otras pestañas del mismo navegador. En esta situación, la página web puede obtener acceso al token de la sesión de inicio de sesión del usuario, lo que conlleva la posibilidad de que la cuenta del usuario se vea comprometida. • https://nvidia.custhelp.com/app/answers/detail/a_id/5199 •