👾CVE SERVICE 🏷#CVE
Mumber: CVE-2022-36162
Github: https://github.com/MaherAzzouzi/CVE-2022-36162
Describe:
**

** fscan ** 🔧Tool update
Tools name：fscan
Tools url：https://github.com/shadow1ng/fscan/commit/98569648bb33d5b98783e7bddb9193eb5565d255
commitUpdate log：
增加-dns参数启用dnslog poc

👾CVE SERVICE 🏷#CVE
Mumber: CVE-2022-21789
Github: https://github.com/docfate111/CVE-2022-21789
Describe:
In audio ipi, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06478101; Issue ID: ALPS06478101.

👾CVE SERVICE 🏷#CVE
Mumber: CVE-2022-20224
Github: https://github.com/ShaikUsaf/system_bt_AOSP10_r33_CVE-2022-20224
Describe:
In AT_SKIP_REST of bta_hf_client_at.cc, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote information disclosure in the Bluetooth stack with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-220732646

👾CVE SERVICE 🏷#CVE
Mumber: CVE-2022-20229
Github: https://github.com/ShaikUsaf/system_bt_AOSP10_r33_CVE-2022-20229
Describe:
In bta_hf_client_handle_cind_list_item of bta_hf_client_at.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-224536184

👾CVE SERVICE 🏷#CVE
Mumber: CVE-2022-20223
Github: https://github.com/nidhi7598/packages_apps_Settings_AOSP_10_r33_CVE-2022-20223
Describe:
In assertSafeToStartCustomActivity of AppRestrictionsFragment.java, there is a possible way to start a phone call without permissions due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-223578534

👾CVE SERVICE 🏷#CVE
Mumber: CVE-2022-29247
Github: https://github.com/a1ise/CVE-2022-29247
Describe:
Electron is a framework for writing cross-platform desktop applications using JavaScript (JS), HTML, and CSS. A vulnerability in versions prior to 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 allows a renderer with JS execution to obtain access to a new renderer process with `nodeIntegrationInSubFrames` enabled which in turn allows effective access to `ipcRenderer`. The `nodeIntegrationInSubFrames` option does not implicitly grant Node.js access. Rather, it depends on the existing sandbox setting. If an application is sandboxed, then `nodeIntegrationInSubFrames` just gives access to the sandboxed renderer APIs, which include `ipcRenderer`. If the application then additionally exposes IPC messages without IPC `senderFrame` validation that perform privileged actions or return confidential data this access to `ipcRenderer` can in turn compromise your application / user even with the sandbox enabled. Electron versions 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 contain a fix for this issue. As a workaround, ensure that all IPC message handlers appropriately validate `senderFrame`.

👾CVE SERVICE 🏷#CVE
Mumber: CVE-2022-36271
Github: https://github.com/SaumyajeetDas/POC-of-CVE-2022-36271
Describe:
**

👾CVE SERVICE 🏷#CVE
Mumber: CVE-2022-26923
Github: https://github.com/lsecqt/CVE-2022-26923-Powershell-POC
Describe:
Active Directory Domain Services Elevation of Privilege Vulnerability.

** antSword ** 🔧Tool update
Tools name：antSword
Tools url：https://github.com/AntSwordProject/antSword/commit/3faa3beb2906c0a206a04b7053254dea6348d9c6
commitUpdate log：
Fix(Core/PHP): fix #319

👾CVE SERVICE 🏷#CVE
Mumber: CVE-2022-37042
Github: https://github.com/GreyNoise-Intelligence/Zimbra_Collaboration_CVE-2022-37042-_CVE-2022-27925
Describe:
Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing authentication (i.e., not having an authtoken), an attacker can upload arbitrary files to the system, leading to directory traversal and remote code execution. NOTE: this issue exists because of an incomplete fix for CVE-2022-27925.

👾CVE SERVICE 🏷#CVE
Mumber: CVE-2022-2414
Github: https://github.com/superhac/CVE-2022-2414-POC
Describe:
Access to external entities when parsing XML documents can lead to XML external entity (XXE) attacks. This flaw allows a remote attacker to potentially retrieve the content of arbitrary files by sending specially crafted HTTP requests.

👾CVE SERVICE 🏷#CVE
Mumber: CVE-2022-31793
Github: https://github.com/xpgdgit/CVE-2022-31793
Describe:
do_request in request.c in muhttpd before 1.1.7 allows remote attackers to read arbitrary files by constructing a URL with a single character before a desired path on the filesystem. This occurs because the code skips over the first character when serving files. Arris NVG443, NVG599, NVG589, and NVG510 devices and Arris-derived BGW210 and BGW320 devices are affected.

👾CVE SERVICE 🏷#CVE
Mumber: CVE-2022-1802
Github: https://github.com/mistymntncop/CVE-2022-1802
Describe:
**

👾CVE SERVICE 🏷#CVE
Mumber: CVE-2022-30778
Github: https://github.com/kang8/CVE-2022-30778
Describe:
**

👾CVE SERVICE 🏷#CVE
Mumber: CVE-2022-37150
Github: https://github.com/Fjowel/CVE-2022-37150-CVE-2022-37151-CVE-2022-37152
Describe:
**

👾CVE SERVICE 🏷#CVE
Mumber: CVE-2022-37153
Github: https://github.com/Fjowel/CVE-2022-37153
Describe:
**

👾CVE SERVICE 🏷#CVE
Mumber: CVE-2022-23779
Github: https://github.com/Vulnmachines/Zoho_CVE-2022-23779
Describe:
Zoho ManageEngine Desktop Central before 10.1.2137.8 exposes the installed server name to anyone. The internal hostname can be discovered by reading HTTP redirect responses.

👾CVE SERVICE 🏷#CVE
Mumber: CVE-2022-32250
Github: https://github.com/theori-io/CVE-2022-32250-exploit
Describe:
net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create user/net namespaces) to escalate privileges to root because an incorrect NFT_STATEFUL_EXPR check leads to a use-after-free.

👾CVE SERVICE 🏷#CVE
Mumber: CVE-2022-37152
Github: https://github.com/Fjowel/CVE-2022-37152
Describe:
**

👾CVE SERVICE 🏷#CVE
Mumber: CVE-2022-37151
Github: https://github.com/Fjowel/CVE-2022-37151
Describe:
**