👾CVE SERVICE 🏷#CVE
Mumber: CVE-2022-36446
Github: https://github.com/p0dalirius/CVE-2022-36446-Webmin-Software-Package-Updates-RCE
Describe:
software/apt-lib.pl in Webmin before 1.997 lacks HTML escaping for a UI command.

👾CVE SERVICE 🏷#CVE
Mumber: CVE-2022-24654
Github: https://github.com/leonardobg/CVE-2022-24654
Describe:
**

👾CVE SERVICE 🏷#CVE
Mumber: CVE-2022-31262
Github: https://github.com/secure-77/CVE-2022-31262
Describe:
**

👾CVE SERVICE 🏷#CVE
Mumber: CVE-2022-24853
Github: https://github.com/secure-77/CVE-2022-24853
Describe:
Metabase is an open source business intelligence and analytics application. Metabase has a proxy to load arbitrary URLs for JSON maps as part of our GeoJSON support. While we do validation to not return contents of arbitrary URLs, there is a case where a particularly crafted request could result in file access on windows, which allows enabling an `NTLM relay attack`, potentially allowing an attacker to receive the system password hash. If you use Windows and are on this version of Metabase, please upgrade immediately. The following patches (or greater versions) are available: 0.42.4 and 1.42.4, 0.41.7 and 1.41.7, 0.40.8 and 1.40.8.

👾CVE SERVICE 🏷#CVE
Mumber: CVE-2022-35513
Github: https://github.com/p1ckzi/CVE-2022-35513
Describe:
**

👾CVE SERVICE 🏷#CVE
Mumber: CVE-2022-27925
Github: https://github.com/vnhacker1337/CVE-2022-27925-PoC
Describe:
Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. An authenticated user with administrator rights has the ability to upload arbitrary files to the system, leading to directory traversal.

👾CVE SERVICE 🏷#CVE
Mumber: CVE-2022-27255
Github: https://github.com/infobyte/cve-2022-27255
Describe:
In Realtek eCos RSDK 1.5.7p1 and MSDK 4.9.4p1, the SIP ALG function that rewrites SDP data has a stack-based buffer overflow. This allows an attacker to remotely execute code without authentication via a crafted SIP packet that contains malicious SDP data.

** antSword ** 🔧Tool update
Tools name：antSword
Tools url：https://github.com/AntSwordProject/antSword/commit/ed79c67eb02a5fe7f00e91f0cd14fd639a2ffaa5
commitUpdate log：
Fix #318

👾KEYWORD SERVICE 🏷#cnvd
Name: VULSEC
Github: https://github.com/TajangSec/VULSEC

👾CVE SERVICE 🏷#CVE
Mumber: CVE-2022-31269
Github: https://github.com/Henry4E36/CVE-2022-31269
Describe:
**

👾CVE SERVICE 🏷#CVE
Mumber: CVE-2022-34169
Github: https://github.com/bor8/CVE-2022-34169
Describe:
The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. The Apache Xalan Java project is dormant and in the process of being retired. No future releases of Apache Xalan Java to address this issue are expected. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.

👾CVE SERVICE 🏷#CVE
Mumber: CVE-2022-36162
Github: https://github.com/MaherAzzouzi/CVE-2022-36162
Describe:
**

** fscan ** 🔧Tool update
Tools name：fscan
Tools url：https://github.com/shadow1ng/fscan/commit/98569648bb33d5b98783e7bddb9193eb5565d255
commitUpdate log：
增加-dns参数启用dnslog poc

👾CVE SERVICE 🏷#CVE
Mumber: CVE-2022-21789
Github: https://github.com/docfate111/CVE-2022-21789
Describe:
In audio ipi, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06478101; Issue ID: ALPS06478101.

👾CVE SERVICE 🏷#CVE
Mumber: CVE-2022-20224
Github: https://github.com/ShaikUsaf/system_bt_AOSP10_r33_CVE-2022-20224
Describe:
In AT_SKIP_REST of bta_hf_client_at.cc, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote information disclosure in the Bluetooth stack with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-220732646

👾CVE SERVICE 🏷#CVE
Mumber: CVE-2022-20229
Github: https://github.com/ShaikUsaf/system_bt_AOSP10_r33_CVE-2022-20229
Describe:
In bta_hf_client_handle_cind_list_item of bta_hf_client_at.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-224536184

👾CVE SERVICE 🏷#CVE
Mumber: CVE-2022-20223
Github: https://github.com/nidhi7598/packages_apps_Settings_AOSP_10_r33_CVE-2022-20223
Describe:
In assertSafeToStartCustomActivity of AppRestrictionsFragment.java, there is a possible way to start a phone call without permissions due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-223578534

👾CVE SERVICE 🏷#CVE
Mumber: CVE-2022-29247
Github: https://github.com/a1ise/CVE-2022-29247
Describe:
Electron is a framework for writing cross-platform desktop applications using JavaScript (JS), HTML, and CSS. A vulnerability in versions prior to 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 allows a renderer with JS execution to obtain access to a new renderer process with `nodeIntegrationInSubFrames` enabled which in turn allows effective access to `ipcRenderer`. The `nodeIntegrationInSubFrames` option does not implicitly grant Node.js access. Rather, it depends on the existing sandbox setting. If an application is sandboxed, then `nodeIntegrationInSubFrames` just gives access to the sandboxed renderer APIs, which include `ipcRenderer`. If the application then additionally exposes IPC messages without IPC `senderFrame` validation that perform privileged actions or return confidential data this access to `ipcRenderer` can in turn compromise your application / user even with the sandbox enabled. Electron versions 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 contain a fix for this issue. As a workaround, ensure that all IPC message handlers appropriately validate `senderFrame`.

👾CVE SERVICE 🏷#CVE
Mumber: CVE-2022-36271
Github: https://github.com/SaumyajeetDas/POC-of-CVE-2022-36271
Describe:
**

👾CVE SERVICE 🏷#CVE
Mumber: CVE-2022-26923
Github: https://github.com/lsecqt/CVE-2022-26923-Powershell-POC
Describe:
Active Directory Domain Services Elevation of Privilege Vulnerability.

** antSword ** 🔧Tool update
Tools name：antSword
Tools url：https://github.com/AntSwordProject/antSword/commit/3faa3beb2906c0a206a04b7053254dea6348d9c6
commitUpdate log：
Fix(Core/PHP): fix #319