{"vulnerability": "CVE-2022-22955", "sightings": [{"uuid": "8a3d78fa-ed18-4218-b6ae-3086963e641d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2022-22955", "type": "seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=775", "content": "", "creation_timestamp": "2022-04-07T04:00:00.000000Z"}, {"uuid": "baaa4f9e-ec9b-4bf5-bca8-de3ae12692f8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-22955", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/2076", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2022\n\u63cf\u8ff0\uff1a CVE-2022-22954, CVE-2022-22955,CVE-2022-22956, CVE-2022-22957, CVE-2022-22958, CVE-2022-22959, CVE-2022-22960, CVE-2022-22961 all in one!\nURL\uff1ahttps://github.com/kaanymz/2022-04-06-critical-vmware-fix\n\n\u6807\u7b7e\uff1a#CVE-2022", "creation_timestamp": "2022-05-01T21:40:40.000000Z"}, {"uuid": "9287c988-b648-45d2-8dae-10cac6fabf77", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-22955", "type": "seen", "source": "https://t.me/hacking_Attack/49022", "content": "Black Hat Ethical Hacking\nVMware warns of critical vulnerabilities in multiple products\n\nVMware warns of critical vulnerabilities in multiple productsPost Views: 27 \nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/patreon-300x61.png Advanced Enumeration techniques with NMAP, Zenmap and Hydra\n\nSubscribe to Patreon to watch this episode.\nReading Time: 2 Minutes\nVMware has warned customers to immediately patch critical vulnerabilities in multiple products that threat actors could use to launch remote code execution attacks.\n\u201cThis critical vulnerability should be patched or mitigated immediately per the instructions in VMSA-2021-0011. The ramifications of this vulnerability are serious,\u201d VMware warned\u00a0on Wednesday.\n\n\u201cAll environments are different, have different tolerance for risk, and have different security controls and defense-in-depth to mitigate risk, so customers must make their own decisions on how to proceed. However, given the severity of the vulnerability, we strongly recommend immediate action.\u201d Patches for five critical vulnerabilitiesThe list of critical security flaws patched today includes a server-side template injection remote code execution vulnerability (CVE-2022-22954), two OAuth2 ACS authentication bypass vulnerabilities (CVE-2022-22955, CVE-2022-22956), and two JDBC injection remote code execution vulnerabilities (CVE-2022-22957, CVE-2022-22958).\n\nVMware also patched high and medium severity bugs that could be exploited for Cross-Site Request Forgery (CSRF) attacks (CVE-2022-22959), escalate privileges (CVE-2022-22960), and gain access to information without authorization (CVE-2022-22961).\nSee Also: Complete Offensive Security and Ethical Hacking Course\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png \nThe complete list of VMware products impacted by these security vulnerabilities includes:\n\n* VMware Workspace ONE Access (Access)\n* VMware Identity Manager (vIDM)\n* VMware vRealize Automation (vRA)\n* VMware Cloud Foundation\n* vRealize Suite Lifecycle Manager\n\nThe company added that it found no evidence of these bugs being exploited in the wild before today\u2019s security advisory\u00a0was published. VMware\u2019s knowledgebase website\u00a0also has a complete list of fixed versions and download links to hotfix installers.\nSee Also: Kali Linux 2022.1 Release with Visual Updates, New Tools, Legacy SSH Workaround also availableVMware also provides workarounds for those who cannot immediately patch their appliances as a temporary solution. The steps detailed here\u00a0require admins to run a VMware-provided Python-based script on affected virtual appliances.\n\nHowever, the company says that the only way to remove the vulnerabilities entirely is to apply the patches.\n\n\u201cWorkarounds, while convenient, do not remove the vulnerabilities, and may introduce additional complexities that patching would not,\u201d VMware added.\n\n\u201cWhile the decision to patch or use the workaround is yours, VMware always strongly recommends patching as the simplest and most reliable way to resolve this issue.\u201d\n\nA document with additional questions and answers regarding the critical vulnerabilities patched today is available here.\n\nOn Monday, VMware also released security updates to address the critical Spring4Shell RCE flaw in VMware Tanzu Application Service for VMs, VMware Tanzu Operations Manager, and VMware Tanzu Kubernetes Grid Integrated Edition (TKGI). See Also: Offensive Security Tool: Scapy Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:47.305743Z"}, {"uuid": "11e7c357-1d27-4e82-a86e-080d55d56e24", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-22955", "type": "seen", "source": "https://t.me/hacking_Attack/49022", "content": "Black Hat Ethical Hacking\nVMware warns of critical vulnerabilities in multiple products\n\nVMware warns of critical vulnerabilities in multiple productsPost Views: 27 \nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/patreon-300x61.png Advanced Enumeration techniques with NMAP, Zenmap and Hydra\n\nSubscribe to Patreon to watch this episode.\nReading Time: 2 Minutes\nVMware has warned customers to immediately patch critical vulnerabilities in multiple products that threat actors could use to launch remote code execution attacks.\n\u201cThis critical vulnerability should be patched or mitigated immediately per the instructions in VMSA-2021-0011. The ramifications of this vulnerability are serious,\u201d VMware warned\u00a0on Wednesday.\n\n\u201cAll environments are different, have different tolerance for risk, and have different security controls and defense-in-depth to mitigate risk, so customers must make their own decisions on how to proceed. However, given the severity of the vulnerability, we strongly recommend immediate action.\u201d Patches for five critical vulnerabilitiesThe list of critical security flaws patched today includes a server-side template injection remote code execution vulnerability (CVE-2022-22954), two OAuth2 ACS authentication bypass vulnerabilities (CVE-2022-22955, CVE-2022-22956), and two JDBC injection remote code execution vulnerabilities (CVE-2022-22957, CVE-2022-22958).\n\nVMware also patched high and medium severity bugs that could be exploited for Cross-Site Request Forgery (CSRF) attacks (CVE-2022-22959), escalate privileges (CVE-2022-22960), and gain access to information without authorization (CVE-2022-22961).\nSee Also: Complete Offensive Security and Ethical Hacking Course\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png \nThe complete list of VMware products impacted by these security vulnerabilities includes:\n\n* VMware Workspace ONE Access (Access)\n* VMware Identity Manager (vIDM)\n* VMware vRealize Automation (vRA)\n* VMware Cloud Foundation\n* vRealize Suite Lifecycle Manager\n\nThe company added that it found no evidence of these bugs being exploited in the wild before today\u2019s security advisory\u00a0was published. VMware\u2019s knowledgebase website\u00a0also has a complete list of fixed versions and download links to hotfix installers.\nSee Also: Kali Linux 2022.1 Release with Visual Updates, New Tools, Legacy SSH Workaround also availableVMware also provides workarounds for those who cannot immediately patch their appliances as a temporary solution. The steps detailed here\u00a0require admins to run a VMware-provided Python-based script on affected virtual appliances.\n\nHowever, the company says that the only way to remove the vulnerabilities entirely is to apply the patches.\n\n\u201cWorkarounds, while convenient, do not remove the vulnerabilities, and may introduce additional complexities that patching would not,\u201d VMware added.\n\n\u201cWhile the decision to patch or use the workaround is yours, VMware always strongly recommends patching as the simplest and most reliable way to resolve this issue.\u201d\n\nA document with additional questions and answers regarding the critical vulnerabilities patched today is available here.\n\nOn Monday, VMware also released security updates to address the critical Spring4Shell RCE flaw in VMware Tanzu Application Service for VMs, VMware Tanzu Operations Manager, and VMware Tanzu Kubernetes Grid Integrated Edition (TKGI). See Also: Offensive Security Tool: Scapy Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:01:59.680011Z"}]}