👾CVE SERVICE 🏷#CVE
Mumber: CVE-2022-20223
Github: https://github.com/nidhi7598/packages_apps_Settings_AOSP_10_r33_CVE-2022-20223
Describe:
In assertSafeToStartCustomActivity of AppRestrictionsFragment.java, there is a possible way to start a phone call without permissions due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-223578534

👾CVE SERVICE 🏷#CVE
Mumber: CVE-2022-29247
Github: https://github.com/a1ise/CVE-2022-29247
Describe:
Electron is a framework for writing cross-platform desktop applications using JavaScript (JS), HTML, and CSS. A vulnerability in versions prior to 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 allows a renderer with JS execution to obtain access to a new renderer process with `nodeIntegrationInSubFrames` enabled which in turn allows effective access to `ipcRenderer`. The `nodeIntegrationInSubFrames` option does not implicitly grant Node.js access. Rather, it depends on the existing sandbox setting. If an application is sandboxed, then `nodeIntegrationInSubFrames` just gives access to the sandboxed renderer APIs, which include `ipcRenderer`. If the application then additionally exposes IPC messages without IPC `senderFrame` validation that perform privileged actions or return confidential data this access to `ipcRenderer` can in turn compromise your application / user even with the sandbox enabled. Electron versions 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 contain a fix for this issue. As a workaround, ensure that all IPC message handlers appropriately validate `senderFrame`.

👾CVE SERVICE 🏷#CVE
Mumber: CVE-2022-36271
Github: https://github.com/SaumyajeetDas/POC-of-CVE-2022-36271
Describe:
**

👾CVE SERVICE 🏷#CVE
Mumber: CVE-2022-26923
Github: https://github.com/lsecqt/CVE-2022-26923-Powershell-POC
Describe:
Active Directory Domain Services Elevation of Privilege Vulnerability.

** antSword ** 🔧Tool update
Tools name：antSword
Tools url：https://github.com/AntSwordProject/antSword/commit/3faa3beb2906c0a206a04b7053254dea6348d9c6
commitUpdate log：
Fix(Core/PHP): fix #319

👾CVE SERVICE 🏷#CVE
Mumber: CVE-2022-37042
Github: https://github.com/GreyNoise-Intelligence/Zimbra_Collaboration_CVE-2022-37042-_CVE-2022-27925
Describe:
Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing authentication (i.e., not having an authtoken), an attacker can upload arbitrary files to the system, leading to directory traversal and remote code execution. NOTE: this issue exists because of an incomplete fix for CVE-2022-27925.

👾CVE SERVICE 🏷#CVE
Mumber: CVE-2022-2414
Github: https://github.com/superhac/CVE-2022-2414-POC
Describe:
Access to external entities when parsing XML documents can lead to XML external entity (XXE) attacks. This flaw allows a remote attacker to potentially retrieve the content of arbitrary files by sending specially crafted HTTP requests.

👾CVE SERVICE 🏷#CVE
Mumber: CVE-2022-31793
Github: https://github.com/xpgdgit/CVE-2022-31793
Describe:
do_request in request.c in muhttpd before 1.1.7 allows remote attackers to read arbitrary files by constructing a URL with a single character before a desired path on the filesystem. This occurs because the code skips over the first character when serving files. Arris NVG443, NVG599, NVG589, and NVG510 devices and Arris-derived BGW210 and BGW320 devices are affected.

👾CVE SERVICE 🏷#CVE
Mumber: CVE-2022-1802
Github: https://github.com/mistymntncop/CVE-2022-1802
Describe:
**

👾CVE SERVICE 🏷#CVE
Mumber: CVE-2022-30778
Github: https://github.com/kang8/CVE-2022-30778
Describe:
**

👾CVE SERVICE 🏷#CVE
Mumber: CVE-2022-37150
Github: https://github.com/Fjowel/CVE-2022-37150-CVE-2022-37151-CVE-2022-37152
Describe:
**

👾CVE SERVICE 🏷#CVE
Mumber: CVE-2022-37153
Github: https://github.com/Fjowel/CVE-2022-37153
Describe:
**

👾CVE SERVICE 🏷#CVE
Mumber: CVE-2022-23779
Github: https://github.com/Vulnmachines/Zoho_CVE-2022-23779
Describe:
Zoho ManageEngine Desktop Central before 10.1.2137.8 exposes the installed server name to anyone. The internal hostname can be discovered by reading HTTP redirect responses.

👾CVE SERVICE 🏷#CVE
Mumber: CVE-2022-32250
Github: https://github.com/theori-io/CVE-2022-32250-exploit
Describe:
net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create user/net namespaces) to escalate privileges to root because an incorrect NFT_STATEFUL_EXPR check leads to a use-after-free.

👾CVE SERVICE 🏷#CVE
Mumber: CVE-2022-37152
Github: https://github.com/Fjowel/CVE-2022-37152
Describe:
**

👾CVE SERVICE 🏷#CVE
Mumber: CVE-2022-37151
Github: https://github.com/Fjowel/CVE-2022-37151
Describe:
**

👾CVE SERVICE 🏷#CVE
Mumber: CVE-2022-21371
Github: https://github.com/Vulnmachines/Oracle-WebLogic-CVE-2022-21371
Describe:
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container). Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

👾KEYWORD SERVICE 🏷#cnvd
Name: bigger-than-bigger
Github: https://github.com/Bin4xin/bigger-than-bigger

👾CVE SERVICE 🏷#CVE
Mumber: CVE-2022-20007
Github: https://github.com/nidhi7598/frameworks_base_AOSP_10_r33_CVE-2022-20007
Describe:
In startActivityForAttachedApplicationIfNeeded of RootWindowContainer.java, there is a possible way to overlay an app that believes it's still in the foreground, when it is not, due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-211481342

👾CVE SERVICE 🏷#CVE
Mumber: CVE-2022-20142
Github: https://github.com/pazhanivel07/frameworks_base_AOSP10_r33_CVE-2022-20142
Describe:
In createFromParcel of GeofenceHardwareRequestParcelable.java, there is a possible arbitrary code execution due to parcel mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-216631962

👾CVE SERVICE 🏷#CVE
Mumber: CVE-2022-38766
Github: https://github.com/AUTOCRYPT-IVS-VnV/CVE-2022-38766
Describe:
**