{"vulnerability": "CVE-2022-31704", "sightings": [{"uuid": "c7464c2e-0a69-41e5-8602-617c6c14d5fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-31704", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:45.000000Z"}, {"uuid": "7f25764f-3f1f-446c-a8c1-af5a17445ad1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-31704", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:46.000000Z"}, {"uuid": "3f5b0596-e4ae-42c5-bc16-cecd30686cca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-31704", "type": "seen", "source": "MISP/a9d21043-f825-4bac-8d2b-56fb9e8343e7", "content": "", "creation_timestamp": "2025-10-23T21:13:00.000000Z"}, {"uuid": "42accc7b-14b8-424b-b14e-f05b4e1b64d5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-31704", "type": "seen", "source": "https://gist.github.com/nguyentin1136-ops/f5bea0e7ad800547c3e9b5e241e2d65c", "content": "", "creation_timestamp": "2025-10-20T04:01:23.000000Z"}, {"uuid": "147c7b1f-ee11-4cae-97b2-59e42ff9e36f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-31704", "type": "seen", "source": "https://gist.github.com/nguyentin1136-ops/937b4359948bbce2e6e7cefbf97e8766", "content": "", "creation_timestamp": "2025-10-20T05:01:51.000000Z"}, {"uuid": "b00a0ff8-cdac-48f7-8934-072a93424c63", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-31704", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3m3dnrkxkvs2g", "content": "", "creation_timestamp": "2025-10-16T21:02:34.262124Z"}, {"uuid": "8a43f8b1-b4d5-487e-b9a5-228e458911f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-31704", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2022/CVE-2022-31704.yaml", "content": "", "creation_timestamp": "2025-10-15T13:14:20.000000Z"}, {"uuid": "ba6b5205-35db-4187-a7e7-9568d018adda", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-31704", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/vmware_vrli_rce.rb", "content": "", "creation_timestamp": "2023-09-08T21:32:40.000000Z"}, {"uuid": "39ff77e4-c32e-4b2e-9f85-396941299d83", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2022-31704", "type": "seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=955", "content": "", "creation_timestamp": "2023-01-26T04:00:00.000000Z"}, {"uuid": "069b3e8e-4bde-4924-9df0-625e0b35e5a1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-31704", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/10068", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2022-31704\n\ud83d\udd25 CVSS Score: N/A\n\ud83d\udd39 Description: The vRealize Log Insight contains a broken access control vulnerability. An unauthenticated malicious actor can remotely inject code into sensitive files of an impacted appliance which can result in remote code execution.\n\ud83d\udccf Published: 2023-01-25T00:00:00.000Z\n\ud83d\udccf Modified: 2025-04-02T13:26:58.952Z\n\ud83d\udd17 References:\n1. https://www.vmware.com/security/advisories/VMSA-2023-0001.html\n2. http://packetstormsecurity.com/files/174606/VMware-vRealize-Log-Insight-Unauthenticated-Remote-Code-Execution.html", "creation_timestamp": "2025-04-02T13:33:38.000000Z"}, {"uuid": "46c2750b-bb40-4501-a09a-a284a9f9c929", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-31704", "type": "seen", "source": "https://t.me/ctinow/89091", "content": "Critical VMware vRealize Log Insight flaws patched (CVE-2022-31706, CVE-2022-31704)\n\nhttps://ift.tt/bpfEuMw", "creation_timestamp": "2023-01-25T13:14:27.000000Z"}, {"uuid": "332cba2e-1341-4b1b-a68c-b33cd0a1a5d9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-31704", "type": "seen", "source": "https://t.me/true_secator/3983", "content": "VMware \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 vRealize Log Insight, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0433\u0443\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u043d\u0430 \u043d\u0435\u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445.\n\nvRealize Log Insight (VMware Aria Operations for Logs) \u2014 \u044d\u0442\u043e \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 \u0434\u043b\u044f \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0436\u0443\u0440\u043d\u0430\u043b\u0430\u043c\u0438 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0438 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u0432 \u0441\u0440\u0435\u0434\u0430\u0445 VMware.\n\n\u041f\u0435\u0440\u0432\u0430\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f CVE-2022-31703 \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u043a\u0430\u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u0431\u0445\u043e\u0434\u0430 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430, \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043c\u043e\u0433\u0443\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f \u0444\u0430\u0439\u043b\u043e\u0432 \u0432 \u041e\u0421 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 \u0434\u043b\u044f RCE.\n\n\u0412\u0442\u043e\u0440\u0430\u044f CVE-2022-31704 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c, \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0442\u0430\u043a\u0436\u0435 \u043c\u043e\u0436\u043d\u043e \u0437\u043b\u043e\u0443\u043f\u043e\u0442\u0440\u0435\u0431\u043b\u044f\u0442\u044c \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445 \u043f\u0443\u0442\u0435\u043c \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432.\n\n\u041e\u0431\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438\u043c\u0435\u044e\u0442\u00a0\u043e\u0446\u0435\u043d\u043a\u0443 CVSS 9,8/10\u00a0\u0438 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u044b \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438, \u043d\u0435 \u043f\u0440\u043e\u0448\u0435\u0434\u0448\u0438\u043c\u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443 \u043f\u043e\u0434\u043b\u0438\u043d\u043d\u043e\u0441\u0442\u0438, \u0432 \u0430\u0442\u0430\u043a\u0430\u0445 \u043d\u0438\u0437\u043a\u043e\u0439 \u0441\u043b\u043e\u0436\u043d\u043e\u0441\u0442\u0438, \u043d\u0435 \u0442\u0440\u0435\u0431\u0443\u044e\u0449\u0438\u0445 \u0432\u043c\u0435\u0448\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f.\n\nVMware\u00a0\u0442\u0430\u043a\u0436\u0435\u00a0\u0443\u0441\u0442\u0440\u0430\u043d\u0438\u043b\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0434\u0435\u0441\u0435\u0440\u0438\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 (CVE-2022-31710), \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u0432\u044b\u0437\u043e\u0432\u0430 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u044f DoS, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043e\u0448\u0438\u0431\u043a\u0443 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 (CVE-2022-31711), \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043e \u0441\u0435\u0430\u043d\u0441\u0435 \u0438\u043b\u0438 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0438.\n\n\u041e\u0448\u0438\u0431\u043a\u0438 \u0431\u044b\u043b\u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0441 \u0432\u044b\u043f\u0443\u0441\u043a\u043e\u043c VMware vRealize Log Insight 8.10.2.\u00a0\u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u043d\u0438 \u043e\u0434\u043d\u0430 \u0438\u0437 \u043e\u0448\u0438\u0431\u043e\u043a \u043d\u0435 \u0431\u044b\u043b\u0430 \u043f\u043e\u043c\u0435\u0447\u0435\u043d\u0430 \u043a\u0430\u043a \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u0430\u044f \u0432 \u0434\u0438\u043a\u043e\u0439 \u043f\u0440\u0438\u0440\u043e\u0434\u0435.\n\n\u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, VMware \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u044b\u0435 \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u0438 \u043f\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044e \u0434\u043e \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0439 \u0432\u0435\u0440\u0441\u0438\u0438 vRealize Log Insight\u00a0(\u0437\u0434\u0435\u0441\u044c) \u0438 \u043f\u043e\u0434\u0435\u043b\u0438\u043b\u0430\u0441\u044c \u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u043c \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c.\n\n\u0414\u043b\u044f \u0435\u0433\u043e \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u043d\u0430 \u043a\u0430\u0436\u0434\u043e\u043c \u0443\u0437\u043b\u0435 vRealize Log Insight \u0432 \u0441\u0432\u043e\u0435\u043c \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u043e\u0434 root \u0447\u0435\u0440\u0435\u0437 SSH \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0439 (\u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0439 VMware\u00a0\u0437\u0434\u0435\u0441\u044c), \u043f\u043e\u0441\u043b\u0435 \u0447\u0435\u0433\u043e \u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u0443\u0431\u0435\u0434\u0438\u0442\u044c\u0441\u044f \u0432 \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043e\u0431\u0445\u043e\u0434\u043d\u043e\u0433\u043e \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u044f, \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u0443\u044f \u043a\u0430\u0436\u0434\u044b\u0439 \u0443\u0437\u0435\u043b \u0438 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0435 \u043e \u0435\u0433\u043e \u0438\u043d\u0441\u0442\u0430\u043b\u043b\u044f\u0446\u0438\u0438.", "creation_timestamp": "2023-01-25T13:47:26.000000Z"}, {"uuid": "c06a7004-7214-4c99-aef5-002b623ef060", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-31704", "type": "seen", "source": "https://t.me/thehackernews/2984", "content": "VMware releases patch for 4 vulnerabilities in vRealize Log Insight, including 2 critical flaws (CVE-2022-31706 and CVE-2022-31704) that could lead to remote code execution attacks.\n\nRead details: https://thehackernews.com/2023/01/vmware-releases-patches-for-critical.html", "creation_timestamp": "2023-01-25T08:13:57.000000Z"}, {"uuid": "8e153306-ef88-4812-a219-6aa36ab2cf3e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-31704", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/9032", "content": "#exploit\n1. CVE-2023-38146:\nArbitrary Code Execution via Windows Themes\nhttps://exploits.forsale/themebleed\n\n2. CVE-2022-31704, CVE-2022-31706, CVE-2022-31711:\nVMware vRealize Log Insight Unauthenticated RCE\nhttps://packetstormsecurity.com/files/174606", "creation_timestamp": "2023-09-16T12:27:01.000000Z"}, {"uuid": "31ccaf7c-f001-4197-94be-02bf14d07072", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-31704", "type": "published-proof-of-concept", "source": "https://t.me/MrVGunz/683", "content": "CVE-2022-31706 & CVE-2022-31704 & CVE-2022-31710 & CVE-2022-31711 : VMware vRealize Log Insight VMSA-2023-0001\u00a0\nPOC : https://github.com/horizon3ai/vRealizeLogInsightRCE", "creation_timestamp": "2023-02-05T18:30:23.000000Z"}, {"uuid": "057bd4d4-a766-4e0e-a2cb-c96ca7e1fc75", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-31704", "type": "published-proof-of-concept", "source": "Telegram/E_yspdvD2OkGzVpTzZE5pT7_xF8O16klvXLRVGJdEx8V", "content": "", "creation_timestamp": "2023-10-22T23:08:41.000000Z"}, {"uuid": "dcbe3d97-a7c3-4c36-b479-b8e17d43110c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-31704", "type": "published-proof-of-concept", "source": "https://t.me/crackcodes/2486", "content": "\ud83d\udd25\ud83d\udd25\ud83d\udd25VMware vRealize Log Insight VMSA-2023-0001 Technical Deep Dive\nThis vulnerability is exploitable in the default configuration for VMware vRealize Log Insight. We have successfully reproduced this exploit and would like to provide the technical details about how this vulnerability works. \n\n\ud83d\udca5PoC for VMSA-2023-0001 affecting VMware vRealize Log Insight which includes the following CVEs:\n\ud83d\udcbe VMware vRealize Log Insight Directory Traversal Vulnerability\n(CVE-2022-31706)\n\ud83d\udcbe VMware vRealize Log Insight broken access control Vulnerability\n(CVE-2022-31704)\n\ud83d\udcbe VMware vRealize Log Insight contains an Information Disclosure Vulnerability\n(CVE-2022-31711)\n\nDownload:https://system32.ink/news-feed/p/205/", "creation_timestamp": "2023-02-02T01:33:27.000000Z"}, {"uuid": "795fa4a8-9d91-441e-bf75-eb1414e5126c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-31704", "type": "exploited", "source": "https://t.me/true_secator/5005", "content": "VMware \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0430\u0435\u0442 \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u0431\u0445\u043e\u0434\u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 vRealize Log Insight (VMware Aria Operations for Logs), \u0434\u043b\u044f \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0443\u0436\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d PoC.\n\n\u041e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u043c\u0430\u044f \u043a\u0430\u043a\u00a0CVE-2023-34051, \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043a\u043e\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root \u043f\u0440\u0438 \u0441\u043e\u0431\u043b\u044e\u0434\u0435\u043d\u0438\u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u0439.\n\n\u041f\u043e \u0441\u043b\u043e\u0432\u0430\u043c \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 Horizon3, \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0432\u0448\u0438\u0445 \u043e\u0448\u0438\u0431\u043a\u0443, \u0443\u0441\u043f\u0435\u0448\u043d\u0430\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0437\u0430\u0432\u0438\u0441\u0438\u0442 \u043e\u0442 \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u0438\u0439 \u043d\u0430 \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0430 \u0438\u043b\u0438 \u0441\u0442\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e IP-\u0430\u0434\u0440\u0435\u0441\u0430.\n\nHorizon3 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0430\u00a0\u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0430\u043d\u0430\u043b\u0438\u0437 \u043f\u0440\u0438\u0447\u0438\u043d\u00a0\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0441 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0435\u0439 \u043e \u0442\u043e\u043c, \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c CVE-2023-34051 \u0434\u043b\u044f RCE \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root \u043d\u0430 \u043d\u0435\u043f\u0440\u043e\u043f\u0430\u0442\u0447\u0435\u043d\u043d\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445 VMware.\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0442\u0430\u043a\u0436\u0435 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438\u00a0PoC-\u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u00a0\u0438 \u0441\u043f\u0438\u0441\u043e\u043a IOC \u0434\u043b\u044f \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u043f\u043e\u043f\u044b\u0442\u043e\u043a \u0432\u0437\u043b\u043e\u043c\u0430.\n\n\u0410\u043d\u043e\u043d\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0437\u043b\u043e\u0443\u043f\u043e\u0442\u0440\u0435\u0431\u043b\u044f\u0435\u0442 \u043f\u043e\u0434\u043c\u0435\u043d\u043e\u0439 IP-\u0430\u0434\u0440\u0435\u0441\u0430 \u0438 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u043c\u0438  \u043a\u043e\u043d\u0435\u0447\u043d\u044b\u043c\u0438 \u0442\u043e\u0447\u043a\u0430\u043c\u0438 Thrift RPC \u0434\u043b\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u0444\u0430\u0439\u043b\u043e\u0432.\n\n\u041a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044f \u044d\u0442\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442 \u0437\u0430\u0434\u0430\u043d\u0438\u0435 cron \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u043e\u0431\u0440\u0430\u0442\u043d\u043e\u0439 \u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0438, \u0432 \u0441\u0432\u044f\u0437\u0438 \u0441 \u0447\u0435\u043c \u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u0438\u0437\u043c\u0435\u043d\u0438\u0442\u044c \u0444\u0430\u0439\u043b \u043f\u043e\u043b\u0435\u0437\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0438\u0438 \u0441\u043e \u0441\u0440\u0435\u0434\u043e\u0439.\n\n\u0427\u0442\u043e\u0431\u044b \u044d\u0442\u0430 \u0430\u0442\u0430\u043a\u0430 \u0441\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0430, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u0434\u043e\u043b\u0436\u0435\u043d \u0438\u043c\u0435\u0442\u044c \u0442\u043e\u0442 \u0436\u0435 IP-\u0430\u0434\u0440\u0435\u0441, \u0447\u0442\u043e \u0438 \u0433\u043b\u0430\u0432\u043d\u044b\u0439/\u0440\u0430\u0431\u043e\u0447\u0438\u0439 \u0443\u0437\u0435\u043b.\n\n\u042d\u0442\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e \u0441\u0443\u0442\u0438 \u0442\u0430\u043a\u0436\u0435 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043e\u0431\u0445\u043e\u0434\u043e\u043c\u00a0\u0446\u0435\u043f\u043e\u0447\u043a\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u043e\u0448\u0438\u0431\u043e\u043a,\u00a0\u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 VMware \u0432 \u044f\u043d\u0432\u0430\u0440\u0435, \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c RCE.\n\n\u041f\u0435\u0440\u0432\u0430\u044f (CVE-2022-31706) - \u044d\u0442\u043e \u043e\u0448\u0438\u0431\u043a\u0430 \u043e\u0431\u0445\u043e\u0434\u0430 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430, \u0432\u0442\u043e\u0440\u0430\u044f (CVE-2022-31704) - \u043d\u0430\u0440\u0443\u0448\u0435\u043d\u0438\u0435 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430, \u0430 \u0442\u0440\u0435\u0442\u044c\u044f \u2014 \u043e\u0448\u0438\u0431\u043a\u0430 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 (CVE-2022-31711).\n\n\u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043c\u043e\u0433\u0443\u0442 \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u0438\u0442\u044c \u044d\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (\u0432 \u0441\u043e\u0432\u043e\u043a\u0443\u043f\u043d\u043e\u0441\u0442\u0438 \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0435 VMware \u043a\u0430\u043a\u00a0VMSA-2023-0001) \u0434\u043b\u044f \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 \u0432 \u041e\u0421 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043e \u043d\u0435\u043f\u0440\u043e\u043f\u0430\u0442\u0447\u0435\u043d\u043d\u043e\u0435 \u041f\u041e Aria Operations for Logs.\n\n\u0422\u043e\u0433\u0434\u0430 \u0447\u0435\u0440\u0435\u0437 \u043d\u0435\u0434\u0435\u043b\u044e \u043f\u043e\u0441\u043b\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f VMSA-2023-0001 Horizon3 \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 PoC-\u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442, \u0437\u043b\u043e\u0443\u043f\u043e\u0442\u0440\u0435\u0431\u043b\u044f\u044e\u0449\u0438\u0439 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u043c\u0438 \u043a\u043e\u043d\u0435\u0447\u043d\u044b\u043c\u0438 \u0442\u043e\u0447\u043a\u0430\u043c\u0438 Thrift RPC \u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0438\u0436\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u0444\u0430\u0439\u043b\u043e\u0432.\n\n\u042d\u0442\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043b\u0435\u0433\u043a\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c, \u043e\u0434\u043d\u0430\u043a\u043e \u043e\u043d\u0430 \u0442\u0440\u0435\u0431\u0443\u0435\u0442 \u043e\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u0439 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0434\u043b\u044f \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0439 \u043f\u043e\u043b\u0435\u0437\u043d\u043e\u0439 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0438.\n\n\u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u044d\u0442\u043e\u0442 \u043f\u0440\u043e\u0434\u0443\u043a\u0442 \u0432\u0440\u044f\u0434 \u043b\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u0432 \u0418\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0435, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u0434\u043e\u043b\u0436\u0435\u043d \u0431\u0443\u0434\u0435\u0442 \u0441\u043d\u0430\u0447\u0430\u043b\u0430 \u0437\u0430\u043a\u0440\u0435\u043f\u0438\u0442\u044c\u0441\u044f \u0433\u0434\u0435-\u0442\u043e \u0432 \u0441\u0435\u0442\u0438.\n\n\u041d\u043e \u0437\u0430\u0447\u0430\u0441\u0442\u0443\u044e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0440\u0430\u043d\u0435\u0435 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0441\u0435\u0442\u044f\u0445 \u0434\u043b\u044f \u0433\u043e\u0440\u0438\u0437\u043e\u043d\u0442\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u043f\u0435\u0440\u0435\u043c\u0435\u0449\u0435\u043d\u0438\u044f, \u0447\u0442\u043e \u0434\u0435\u043b\u0430\u0435\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 VMware \u0446\u0435\u043d\u043d\u044b\u043c\u0438 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u043c\u0438 \u0446\u0435\u043b\u044f\u043c\u0438.", "creation_timestamp": "2023-10-25T13:20:05.000000Z"}, {"uuid": "c5143b35-7050-4b98-aa54-e3f4009ab4b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-31704", "type": "seen", "source": "https://t.me/cissp/6552", "content": "VMware releases patch for 4 vulnerabilities in vRealize Log Insight, including 2 critical flaws (CVE-2022-31706 and CVE-2022-31704) that could lead to remote code execution attacks.\nRead details: https://thehackernews.com/2023/01/vmware-releases-patches-for-critical.html\n\n\nWarning: A massive malware campaign has infected more than 4,500 WordPress websites and is redirecting their visitors to sketchy ad pages.\nRead: https://thehackernews.com/2023/01/over-4500-wordpress-sites-hacked-to.html\nKeep your website secure and always be cautious of suspicious links.\n\n\n\u2069-Cyber Security awareness-\n\nUp2date 4 Defence Today,\nSecure Tomorrow\n@CisoasaService\n1401.11.06", "creation_timestamp": "2026-09-01T17:00:23.689198Z"}, {"uuid": "d02a8df0-fc3a-41a9-bfa5-f11f8918e875", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-31704", "type": "seen", "source": "https://t.me/hacking_Attack/124202", "content": "Black Hat Ethical Hacking\nVMware Security Alert: Proof-of-Concept Exploit Code Threatens Authentication Bypass Flaw\n\nVMware Security Alert: Proof-of-Concept Exploit Code Threatens Authentication Bypass Flaw\nPost Views: 20 Premium Content https://www.blackhatethicalhacking.com/wp-content/uploads/2023/07/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes\nVMware has issued a warning to its customers regarding a significant threat. Proof-of-concept (PoC) exploit code is now circulating for a critical authentication bypass flaw found in vRealize Log Insight, which has since been rebranded as VMware Aria Operations for Logs.\n\nVMware took immediate action to update its advisory, confirming the availability of the exploit code for CVE-2023-34051. This particular vulnerability presents a serious concern, as it could potentially allow unauthenticated attackers to execute code remotely with root-level permissions, under specific conditions.\n\nThe successful exploitation of this flaw relies on a series of factors. Specifically, the attacker must compromise a host within the targeted environment. This compromised host must also have the necessary permissions to add an extra interface or a static IP address, further emphasizing the importance of robust security practices and access controls.\n\nThe discovery of this flaw can be attributed to the diligent work of security researchers from Horizon3, who have conducted a detailed root cause analysis. Their findings, which were published on a recent Friday, provide additional insights into how CVE-2023-34051 can be leveraged to gain remote code execution privileges with root access. Furthermore, Horizon3\u2019s security team has also released a PoC exploit, along with a list of indicators of compromise (IOCs) that network defenders can employ to identify any attempts at exploitation within their own environments.\nSee Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses\nThe PoC exploit, as described by the Horizon3 Attack Team, relies on a combination of IP address spoofing and various Thrift RPC endpoints to achieve an arbitrary file write. Notably, the default configuration of this vulnerability involves the creation of a cron job to facilitate the generation of a reverse shell. To adapt this to specific environments, it is recommended to modify the payload file accordingly.\n\nIt\u2019s essential to highlight that for this attack to be successful, the attacker must possess the same IP address as a master or worker node within the target network, adding an additional layer of complexity to the exploitation process.\nWhile we haven\u2019t reversed the Cisco 0-day just yet, we do have the deep-dive and IOCs for CVE-2023-34051 affecting #VMware Aria Operations for Logs. \n\nThis vulnerability is a patch bypass discovered by @JamesHorseman2 that allows for RCE as root under certain conditions.\u2026 pic.twitter.com/L4cS6tWySy\n\n\u2014 Horizon3 Attack Team (@Horizon3Attack) October 20, 2023 RCE exploit chain This vulnerability is not an isolated concern. Instead, it is part of a chain of exploits that have previously been addressed by VMware. These earlier issues were resolved in a security update issued in January. The vulnerabilities in question included a directory traversal bug (CVE-2022-31706), a broken access control flaw (CVE-2022-31704), and an information disclosure bug (CVE-2022-31711). When chained together, these vulnerabilities could allow attackers to inject maliciously crafted files into the operating system of VMware appliances running unpatched Aria Operations for Logs software.\n\nWhile the exploitation of this vulnerability may seem straightforward, it\u2019s important to note that it does requir[...]", "creation_timestamp": "2026-09-01T20:00:45.224686Z"}, {"uuid": "c8af4980-c07c-49b1-b891-a05abf950f88", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-31704", "type": "seen", "source": "https://t.me/hacking_Attack/124202", "content": "Black Hat Ethical Hacking\nVMware Security Alert: Proof-of-Concept Exploit Code Threatens Authentication Bypass Flaw\n\nVMware Security Alert: Proof-of-Concept Exploit Code Threatens Authentication Bypass Flaw\nPost Views: 20 Premium Content https://www.blackhatethicalhacking.com/wp-content/uploads/2023/07/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes\nVMware has issued a warning to its customers regarding a significant threat. Proof-of-concept (PoC) exploit code is now circulating for a critical authentication bypass flaw found in vRealize Log Insight, which has since been rebranded as VMware Aria Operations for Logs.\n\nVMware took immediate action to update its advisory, confirming the availability of the exploit code for CVE-2023-34051. This particular vulnerability presents a serious concern, as it could potentially allow unauthenticated attackers to execute code remotely with root-level permissions, under specific conditions.\n\nThe successful exploitation of this flaw relies on a series of factors. Specifically, the attacker must compromise a host within the targeted environment. This compromised host must also have the necessary permissions to add an extra interface or a static IP address, further emphasizing the importance of robust security practices and access controls.\n\nThe discovery of this flaw can be attributed to the diligent work of security researchers from Horizon3, who have conducted a detailed root cause analysis. Their findings, which were published on a recent Friday, provide additional insights into how CVE-2023-34051 can be leveraged to gain remote code execution privileges with root access. Furthermore, Horizon3\u2019s security team has also released a PoC exploit, along with a list of indicators of compromise (IOCs) that network defenders can employ to identify any attempts at exploitation within their own environments.\nSee Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses\nThe PoC exploit, as described by the Horizon3 Attack Team, relies on a combination of IP address spoofing and various Thrift RPC endpoints to achieve an arbitrary file write. Notably, the default configuration of this vulnerability involves the creation of a cron job to facilitate the generation of a reverse shell. To adapt this to specific environments, it is recommended to modify the payload file accordingly.\n\nIt\u2019s essential to highlight that for this attack to be successful, the attacker must possess the same IP address as a master or worker node within the target network, adding an additional layer of complexity to the exploitation process.\nWhile we haven\u2019t reversed the Cisco 0-day just yet, we do have the deep-dive and IOCs for CVE-2023-34051 affecting #VMware Aria Operations for Logs. \n\nThis vulnerability is a patch bypass discovered by @JamesHorseman2 that allows for RCE as root under certain conditions.\u2026 pic.twitter.com/L4cS6tWySy\n\n\u2014 Horizon3 Attack Team (@Horizon3Attack) October 20, 2023 RCE exploit chain This vulnerability is not an isolated concern. Instead, it is part of a chain of exploits that have previously been addressed by VMware. These earlier issues were resolved in a security update issued in January. The vulnerabilities in question included a directory traversal bug (CVE-2022-31706), a broken access control flaw (CVE-2022-31704), and an information disclosure bug (CVE-2022-31711). When chained together, these vulnerabilities could allow attackers to inject maliciously crafted files into the operating system of VMware appliances running unpatched Aria Operations for Logs software.\n\nWhile the exploitation of this vulnerability may seem straightforward, it\u2019s important to note that it does requir[...]", "creation_timestamp": "2026-09-02T01:01:05.143074Z"}, {"uuid": "f9a86cac-ebdc-4f92-9780-f5359e0a2a8c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-31704", "type": "seen", "source": "https://t.me/cissp/6552", "content": "VMware releases patch for 4 vulnerabilities in vRealize Log Insight, including 2 critical flaws (CVE-2022-31706 and CVE-2022-31704) that could lead to remote code execution attacks.\nRead details: https://thehackernews.com/2023/01/vmware-releases-patches-for-critical.html\n\n\nWarning: A massive malware campaign has infected more than 4,500 WordPress websites and is redirecting their visitors to sketchy ad pages.\nRead: https://thehackernews.com/2023/01/over-4500-wordpress-sites-hacked-to.html\nKeep your website secure and always be cautious of suspicious links.\n\n\n\u2069-Cyber Security awareness-\n\nUp2date 4 Defence Today,\nSecure Tomorrow\n@CisoasaService\n1401.11.06", "creation_timestamp": "2026-09-02T01:04:04.219662Z"}]}