** fscan ** 🔧Tool update
Tools name：fscan
Tools url：https://github.com/shadow1ng/fscan/commit/4908720acbbb4bdd369a8bfa92c7b73b0ca893cf
commitUpdate log：
socks代理时,自动-np

👾CVE SERVICE 🏷#CVE
Mumber: CVE-2022-33174
Github: https://github.com/Henry4E36/CVE-2022-33174
Describe:
Power Distribution Units running on Powertek firmware (multiple brands) before 3.30.30 allows remote authorization bypass in the web interface. To exploit the vulnerability, an attacker must send an HTTP packet to the data retrieval interface (/cgi/get_param.cgi) with the tmpToken cookie set to an empty string followed by a semicolon. This bypasses an active session authorization check. This can be then used to fetch the values of protected sys.passwd and sys.su.name fields that contain the username and password in cleartext.

👾CVE SERVICE 🏷#CVE
Mumber: CVE-2022-24780
Github: https://github.com/Acceis/exploit-CVE-2022-24780
Describe:
Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.6 and 3.0.0, users of the iTop user portal can send TWIG code to the server by forging specific http queries, and execute arbitrary code on the server using http server user privileges. This issue is fixed in versions 2.7.6 and 3.0.0. There are currently no known workarounds.

👾CVE SERVICE 🏷#CVE
Mumber: CVE-2022-39196
Github: https://github.com/DayiliWaseem/CVE-2022-39196-
Describe:
**

** xray ** 🔧Tool update
Tools name：xray
Tools url：https://github.com/chaitin/xray/commit/a9ddda5e28119f72e391b8a0c8fb753d6c53c0d5
commitUpdate log：
Update jellyfin-cve-2021-29490.yml (#1632)

👾CVE SERVICE 🏷#CVE
Mumber: CVE-2022-36804
Github: https://github.com/cryptolakk/CVE-2022-36804-RCE
Describe:
Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 before version 7.17.10, from version 7.18.0 before version 7.21.4, from version 8.0.0 before version 8.0.3, from version 8.1.0 before version 8.1.3, and from version 8.2.0 before version 8.2.2, and from version 8.3.0 before 8.3.1 allows remote attackers with read permissions to a public or private Bitbucket repository to execute arbitrary code by sending a malicious HTTP request. This vulnerability was reported via our Bug Bounty Program by TheGrandPew.

👾CVE SERVICE 🏷#CVE
Mumber: CVE-2022-2586
Github: https://github.com/aels/CVE-2022-2586-LPE
Describe:
**

👾KEYWORD SERVICE 🏷#cnvd
Name: CNVD-2022-60632
Github: https://github.com/safe3s/CNVD-2022-60632

👾CVE SERVICE 🏷#CVE
Mumber: CVE-2022-29455
Github: https://github.com/akhilkoradiya/CVE-2022-29455
Describe:
DOM-based Reflected Cross-Site Scripting (XSS) vulnerability in Elementor's Elementor Website Builder plugin <= 3.5.5 versions.

👾CVE SERVICE 🏷#CVE
Mumber: CVE-2022-2639
Github: https://github.com/veritas501/CVE-2022-2639-PipeVersion
Describe:
An integer coercion error was found in the openvswitch kernel module. Given a sufficiently large number of actions, while copying and reserving memory for a new action of a new flow, the reserve_sfa_size() function does not return -EMSGSIZE as expected, potentially leading to an out-of-bounds write access. This flaw allows a local user to crash or potentially escalate their privileges on the system.

👾CVE SERVICE 🏷#CVE
Mumber: CVE-2022-39838
Github: https://github.com/jet-pentest/CVE-2022-39838
Describe:
**

👾CVE SERVICE 🏷#CVE
Mumber: CVE-2022-20186
Github: https://github.com/s1204-inspect/CVE-2022-20186_CTXZ
Describe:
In kbase_mem_alias of mali_kbase_mem_linux.c, there is a possible arbitrary code execution due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-215001024References: N/A

👾CVE SERVICE 🏷#CVE
Mumber: CVE-2022-24706
Github: https://github.com/trhacknon/CVE-2022-24706-CouchDB-Exploit
Describe:
In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including recommending using a firewall in front of all CouchDB installations.

👾CVE SERVICE 🏷#CVE
Mumber: CVE-2022-35405
Github: https://github.com/viniciuspereiras/CVE-2022-35405
Describe:
Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code execution. (This also affects ManageEngine Access Manager Plus before 4303 with authentication.)

👾CVE SERVICE 🏷#CVE
Mumber: CVE-2022-36539
Github: https://github.com/Fopje/CVE-2022-36539
Describe:
**

👾CVE SERVICE 🏷#CVE
Mumber: CVE-2022-20126
Github: https://github.com/Trinadh465/packages_apps_Bluetooth_AOSP10_r33_CVE-2022-20126
Describe:
In setScanMode of AdapterService.java, there is a possible way to enable Bluetooth discovery mode without user interaction due to a missing permission check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-203431023

👾CVE SERVICE 🏷#CVE
Mumber: CVE-2022-20360
Github: https://github.com/nidhi7598/packages_apps_Settings_AOSP_10_r33_CVE-2022-20360
Describe:
In setChecked of SecureNfcPreferenceController.java, there is a missing permission check. This could lead to local escalation of privilege from the guest user with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-228314987

👾CVE SERVICE 🏷#CVE
Mumber: CVE-2022-31188
Github: https://github.com/emirpolatt/CVE-2022-31188
Describe:
CVAT is an opensource interactive video and image annotation tool for computer vision. Versions prior to 2.0.0 were found to be subject to a Server-side request forgery (SSRF) vulnerability. Validation has been added to urls used in the affected code path in version 2.0.0. Users are advised to upgrade. There are no known workarounds for this issue.

👾CVE SERVICE 🏷#CVE
Mumber: CVE-2022-3168
Github: https://github.com/irsl/CVE-2022-3168-adb-unexpected-reverse-forwards
Describe:
**

👾CVE SERVICE 🏷#CVE
Mumber: CVE-2022-20128
Github: https://github.com/irsl/CVE-2022-20128
Describe:
**

👾CVE SERVICE 🏷#CVE
Mumber: CVE-2022-40317
Github: https://github.com/izdiwho/CVE-2022-40317
Describe:
OpenKM 6.3.11 allows stored XSS related to the javascript&colon; substring in an A element.