Do Son Netgear has released patches to remediate a high-severity pre-authentication buffer overflow (CVE-2022-48196) affecting multiple routers
Vulnerability
The denial of service vulnerability, assigned CVE-2022-41966, affects all versions of the XStream version prior to 1.4.20
CVE-2022-46689 could allow an authenticated attacker to gain elevated privileges on the system, caused by a race condition in the iOS kernel
CVE-2022-47949 could allow an attacker to execute code remotely in the victim's console by just having an online game with them
Plugin is estimated to have 50,000 active installations, with the flaw (CVE-2022-45359, CVSS score: 9.8) affecting versions prior to 3.20.0
NF20, NF20MESH, and NL1902 routers have been confirmed by Netcomm to be vulnerable to the remote code execution vulnerability
ZyXEL LTE3301-M209 LTE router is allegedly vulnerable to a critical vulnerability (CVE-2022-40602) which is backdoor accounts.
An attacker could exploit the CVE-2022-46175 flaw to execute arbitrary code or cause a denial of service condition on the system.
A security researcher has published PoC code for the CVE-2022-43571 flaw on his blog that will execute code on Splunk Enterprise
Linux kernel developers issued a patch for the remote code execution issue and fixed the flaw in the Linux kernel 5.15.61 version.
CVE-2022-40145 is about a potential code injection when an attacker has control of the target LDAP server using in the JDBC JNDI URL.
Security researchers shared the PoC exploit code for CVE-2022-2602 and published a write-up with details on the methods used by the exploit.
By sending a specially-crafted request, an authenticated attacker could exploit CVE-2022-38065 in OpenStack to gain elevated privileges
The most severe of these issues is CVE-2021-28655 (CVSS: 8.2), an arbitrary file deletion vulnerability in the "Move folder to Trash" feature
The PoC exploit targets CVE-2022-46689, a bug that could allow a local authenticated attacker to gain elevated privileges on the system
Researchers Krishnakant Patil and Ashfaq Ansari conducted an in-depth analysis of the vulnerability and disclosed CVE-2022-28672 PoC code
CVE-2022-44698 could allow a remote attacker to bypass security restrictions, caused by a flaw in the SmartScreen component
The flaw, tracked as CVE-2022-42856, may allow a remote attacker to execute arbitrary code that is actively exploited in the wild in attacks
The flaw is tracked as CVE-2022-31702 and it has a CVSS score of 9.8. VMware described it as a command injection vulnerability
Tracked as CVE-2022-31705 (CVSS score of 9.3), an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVE-2022-27518 could allow unauthenticated remote attackers to execute arbitrary code on several versions of Citrix ADC and Gateway products
CVE-2022-42475 affects FortiOS SSL-VPN and allows an attacker could overflow a buffer and execute arbitrary code on the system