{"vulnerability": "cve-2022-3126", "sightings": [{"uuid": "8fea2e53-a84f-475d-8c01-4c34d66ef4b7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-31262", "type": "seen", "source": "https://t.me/poxek/2647", "content": "\u0414\u043e\u0440\u043e\u0433\u0438\u0435 \u043c\u043e\u0438 \u043f\u043e\u0434\u043f\u0438\u0441\u0447\u0438\u043a\u0438, \u043f\u043e\u0437\u0434\u0440\u0430\u0432\u043b\u044f\u044e \u0432\u0441\u0435\u0445 \u0412\u0430\u0441 \u0441 \u043d\u0430\u0441\u0442\u0443\u043f\u0430\u044e\u0449\u0438\u043c \u041d\u043e\u0432\u044b\u043c \u0413\u043e\u0434\u043e\u043c!\n\u0425\u043e\u0442\u0435\u043b\u043e\u0441\u044c \u0431\u044b \u043f\u043e\u0434\u0432\u0435\u0441\u0442\u0438 \u0438\u0442\u043e\u0433\u0438 \u0432 \u0446\u0438\u0444\u0440\u0430\u0445 \u043f\u0440\u043e \u043a\u0430\u043d\u0430\u043b)\n\n\u2705 \u041a\u0430\u043d\u0430\u043b \u0443\u0436\u0435 \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0431\u043e\u043b\u0435\u0435 14 \u043c\u0435\u0441\u044f\u0446\u0435\u0432! \n\n\u2705 \u0417\u0430 \u044d\u0442\u043e \u0432\u0440\u0435\u043c\u044f \u043c\u044b \u0441\u043c\u043e\u0433\u043b\u0438 \u043d\u0430\u0431\u0440\u0430\u0442\u044c 700 \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u0445 \u043f\u043e\u0434\u043f\u0438\u0441\u0447\u0438\u043a\u043e\u0432, \u0441 \u043a\u043e\u0442\u043e\u0440\u044b\u043c\u0438 \u044f \u0438\u043d\u043e\u0433\u0434\u0430 \u043f\u0435\u0440\u0435\u0441\u0435\u043a\u0430\u044e\u0441\u044c \u043d\u0430 \u043c\u0435\u0440\u043e\u043f\u0440\u0438\u044f\u0442\u0438\u044f\u0445!\n\n\u2705 \u041c\u043d\u043e\u044e \u0431\u044b\u043b\u043e \u0441\u0434\u0435\u043b\u0430\u043d\u043e \u0431\u043e\u043b\u0435\u0435 2500 \u043f\u043e\u0441\u0442\u043e\u0432!\n\n\u2705 \u0412 \u0441\u0440\u0435\u0434\u043d\u0435\u043c \u0431\u043e\u043b\u0435\u0435 \u043f\u043e\u043b\u043e\u0432\u0438\u043d\u044b \u0438\u0437 \u0412\u0430\u0441 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0447\u0438\u0442\u0430\u044e\u0442 \u0438 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u0443\u044e\u0442\u0441\u044f \u043a\u0430\u043d\u0430\u043b\u043e\u043c!\n\n\u2705 \u0417\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u043f\u043e\u043b \u0433\u043e\u0434\u0430 \u043c\u044b \u0441\u043c\u043e\u0433\u043b\u0438 \u043f\u0440\u043e\u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0432\u044b\u0440\u0430\u0441\u0442\u0438. \u0417\u0430\u043a\u043b\u044e\u0447\u0438\u043b\u0438 \u0441 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u043c\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430\u043c\u0438 \u0440\u0430\u0432\u043d\u043e\u0435 \u0441\u043e\u0442\u0440\u0443\u0434\u043d\u0438\u0447\u0435\u0441\u0442\u0432\u043e\n\n\u2705 \u0421\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e \u0441 \u043a\u0430\u043d\u0430\u043b\u043e\u043c NetRunner \u0431\u044b\u043b\u0430 \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0430 \u043f\u0435\u0440\u0432\u0430\u044f \u043d\u0430\u0448\u0430 CTF. (\u041e\u043d\u0430 \u0434\u043e \u0441\u0438\u0445 \u043f\u043e\u0440 \u0430\u043a\u0442\u0438\u0432\u043d\u0430, \u0442\u0430\u043a \u0447\u0442\u043e \u0434\u0435\u0440\u0437\u0430\u0439\u0442\u0435)\n\n\u2705 \u041c\u043e\u0439 \u043f\u0440\u043e\u0435\u043a\u0442, \u0432\u044b\u0440\u043e\u0441 \u0438\u0437 \"\u043a\u0430\u043d\u0430\u043b\u0430 \u0434\u043b\u044f \u0441\u0432\u043e\u0438\u0445\" \u0432 \u0434\u043e\u0432\u043e\u043b\u044c\u043d\u043e \u043a\u0440\u0443\u043f\u043d\u044b\u0439 \u043a\u0430\u043d\u0430\u043b. \u041e\u043d \u043f\u0435\u0440\u0435\u0436\u0438\u043b \u0438 \u0432\u044b\u0433\u043e\u0440\u0430\u043d\u0438\u044f, \u0438 \u043f\u0438\u043a\u0438 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438.\n\n\u2705 \u042f \u0447\u0438\u0442\u0430\u043b \u0432\u0430\u0448\u0438 \u043f\u043e\u0436\u0435\u043b\u0430\u043d\u0438\u044f. \u041e\u0431\u0449\u0430\u043b\u0441\u044f \u0441 \u043f\u043e\u0434\u043f\u0438\u0441\u0447\u0438\u043a\u0430\u043c\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u043b\u0438 \u043a\u0430\u043a\u0438\u0435-\u0442\u043e \u043d\u043e\u0432\u044b\u0435 \u0438\u0434\u0435\u0438! \u0412 \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e\u0441\u0442\u0438 \u0431\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u044f \u0438\u043c \u044f \u043d\u0435 \u0437\u0430\u0431\u0440\u0430\u0441\u044b\u0432\u0430\u043b \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u043f\u043e\u0441\u0442\u043e\u0432)\n\n\n\u0422\u0430\u043a\u0436\u0435 \u044f \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u0438\u043b \u0432\u0430\u043c \u0422\u041e\u041f \u0441\u0430\u043c\u044b\u0445 \u0447\u0438\u0442\u0430\u0435\u043c\u044b\u0445 \u043f\u043e\u0441\u0442\u043e\u0432 \u043d\u0430 \u043a\u0430\u043d\u0430\u043b\u0435 \u0437\u0430 \u0433\u043e\u0434:\n1. \u0425\u043e\u0447\u0443 \u0441\u0435\u0433\u043e\u0434\u043d\u044f \u0432\u0430\u043c \u043f\u043e\u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u043e\u0432\u0430\u0442\u044c \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043f\u043e\u0434\u043a\u0430\u0441\u0442\u043e\u0432 \u043d\u0430 \u0442\u0435\u043c\u0443 \u0418\u0411/\u0418\u0422.\n2. \u041f\u0430\u043a \u0441\u0432\u0435\u0436\u0438\u0445 \u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0445 CVE \u0434\u043b\u044f Apple\n3. \u041d\u0435 \u0440\u0435\u043a\u043b\u0430\u043c\u0430 Baikal )\n4. CVE-2022-31262 GOG Galaxy LPE\n\u042d\u0442\u0438 \u043f\u043e\u0441\u0442\u044b \u043d\u0430\u0431\u0440\u0430\u043b\u0438 \u0440\u0435\u043a\u043e\u0440\u0434\u043d\u043e\u0435 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u043f\u0440\u043e\u0441\u043c\u043e\u0442\u0440\u043e\u0432 \u0431\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u044f \u0432\u0430\u0448\u0438\u043c \u0440\u0435\u043f\u043e\u0441\u0442\u0430\u043c!\n\n\u042d\u0442\u043e \u0433\u043e\u0434 \u0441 \u0442\u043e\u0447\u043a\u0438 \u0437\u0440\u0435\u043d\u0438\u044f \u0418\u0411 \u043d\u0430\u043c \u0437\u0430\u043f\u043e\u043c\u043d\u0438\u043b\u0441\u044f \u0431\u043e\u043b\u044c\u0448\u0438\u043c \u043a\u043e\u043b-\u0432\u043e\u043c \u0443\u0442\u0435\u0447\u0435\u043a \u0432 \u0420\u0424 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f\u0445, \u0443\u0445\u043e\u0434\u043e\u043c IT \u0433\u0438\u0433\u0430\u043d\u0442\u043e\u0432 \u0438\u0437 \u0420\u0424, \u043f\u043e\u044f\u0432\u043b\u0435\u043d\u0438\u0435 \u043e\u0442\u0435\u0447\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0445 BugBounty \u043f\u043b\u043e\u0449\u0430\u0434\u043e\u043a, \u0443\u0441\u043a\u043e\u0440\u0435\u043d\u0438\u044e \u0440\u043e\u0441\u0442\u0430 \u043e\u0442\u0435\u0447\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0433\u043e \u0440\u044b\u043d\u043a\u0430 \u0418\u0422 \u0438 \u0418\u0411. \n\u0422\u0430\u043a \u0447\u0442\u043e \u043a\u0430\u043a\u0438\u043c \u0431\u044b \u044d\u0442\u043e\u0442 \u0433\u043e\u0434 \u043f\u043b\u043e\u0445\u0438\u043c \u043d\u0435 \u043a\u0430\u0437\u0430\u043b\u0441\u044f, \u0432\u0441\u0435\u0433\u0434\u0430 \u043d\u0443\u0436\u043d\u043e \u0441\u0442\u0430\u0440\u0430\u0442\u044c\u0441\u044f \u0438\u0441\u043a\u0430\u0442\u044c \u0447\u0442\u043e-\u0442\u043e \u043f\u043e\u0437\u0438\u0442\u0438\u0432\u043d\u043e\u0435 \u0432 \u043d\u0451\u043c)\n\n\u041f\u043b\u0430\u043d\u044b \u043d\u0430 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0439 \u0433\u043e\u0434:\n\u2757\ufe0f \u0427\u0430\u0449\u0435 \u043f\u043e\u0441\u0435\u0449\u0430\u0442\u044c \u0418\u0411 \u0442\u0443\u0441\u043e\u0432\u043a\u0438 \u0438 \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u0438\n\n\u2757\ufe0f \u0421\u0434\u0435\u043b\u0430\u0442\u044c \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0433\u043b\u0443\u0431\u043e\u043a\u0438\u0445 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0439\n\n\u2757\ufe0f \u041f\u043e\u0434\u0442\u044f\u043d\u0443\u0442\u044c \u0437\u0434\u043e\u0440\u043e\u0432\u044c\u0435 \n\n\u2757\ufe0f \u0414\u0430\u043b\u044c\u0448\u0435 \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0442\u044c \u043a\u0430\u043d\u0430\u043b \u0441 \u0432\u0430\u0448\u0435\u0439 \u043f\u043e\u043c\u043e\u0449\u044c\u044e!\n\n\u2757\ufe0f \u0412\u044b\u0439\u0442\u0438 \u043d\u0430 \u0441\u043e\u0442\u0440\u0443\u0434\u043d\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u0441 \u043a\u0440\u0443\u043f\u043d\u044b\u043c\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430\u043c\u0438\n\n\u2757\ufe0f \u0420\u0430\u0434\u043e\u0432\u0430\u0442\u044c \u0432\u0430\u0441 \u043d\u043e\u0432\u044b\u043c \u0443\u0432\u043b\u0435\u043a\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u043c \u0438 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u043c \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u043e\u043c!\n\n\u0423\u0434\u0430\u0447\u0438, \u0437\u0434\u043e\u0440\u043e\u0432\u044c\u044f \u0432\u0430\u043c \u0438 \u0432\u0430\u0448\u0438\u043c \u0431\u043b\u0438\u0437\u043a\u0438\u043c, \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u043e\u0439 \u0440\u0430\u0431\u043e\u0442\u044b \u0438 \u043f\u043e\u0431\u043e\u043b\u044c\u0448\u0435 \u0434\u0435\u043d\u0435\u0433!)", "creation_timestamp": "2022-12-31T22:07:56.000000Z"}, {"uuid": "1df4b923-8b70-4b94-b6f8-31056b0cb0e4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-31262", "type": "seen", "source": "https://t.me/poxek/2635", "content": "CVE-2022-31262\n\nGOG Galaxy LPE\n\n\u0412 \u0445\u043e\u0434\u0435 \u043c\u043e\u0438\u0445 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0439, \u043e\u043f\u0438\u0441\u0430\u043d\u043d\u044b\u0445 \u0432 \u0434\u0440\u0443\u0433\u043e\u043c \u043f\u043e\u0441\u0442\u0435 \"\u041e\u0445\u043e\u0442\u0430 \u0437\u0430 LPE \u0432 \u0438\u0433\u0440\u043e\u0432\u043e\u043c \u041f\u041e\". \u041c\u043d\u0435 \u0431\u044b\u043b\u043e \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e \u0443\u0437\u043d\u0430\u0442\u044c \u043e \u0441\u043b\u0443\u0436\u0431\u0430\u0445 GOG, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u044e\u0442\u0441\u044f \u043a\u0430\u043a \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430. \u042f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u043b GOG \u043d\u0430 \"\u0441\u0432\u0435\u0436\u0443\u044e\" \u0441\u0438\u0441\u0442\u0435\u043c\u0443 Windows 11 \u0438 Windows 10 \u0438 \u0441\u043d\u043e\u0432\u0430 \u043e\u0431\u0440\u0430\u0442\u0438\u043b \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u043d\u0430 \u0441\u043b\u0443\u0436\u0431\u0443 \"GalaxCommunication\". \u041a\u0430\u043a \u043c\u044b \u0432\u0438\u0434\u0438\u043c, \u0441\u043b\u0443\u0436\u0431\u0430 \u043f\u043e-\u043f\u0440\u0435\u0436\u043d\u0435\u043c\u0443 \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0441 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438 SYSTEM. \u041f\u0440\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 GOG: 2.0.46 \u043e\u0442 16 \u0444\u0435\u0432\u0440\u0430\u043b\u044f 2022 \u0433\u043e\u0434\u0430 (\u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u043d\u0430\u0439\u0434\u0435\u043d) - 2.0.51 \u043e\u0442 \u0438\u044e\u043d\u044f 2022 \u0433\u043e\u0434\u0430 (\u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0432\u0441\u0435 \u0435\u0449\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d).\n\n#CVE #POC", "creation_timestamp": "2022-12-21T08:44:04.000000Z"}, {"uuid": "e1506cc9-331d-4888-97fc-f434aadb9556", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-31262", "type": "published-proof-of-concept", "source": "https://t.me/netrunnerz/373", "content": "CVE-2022-31262\n\nGOG Galaxy LPE\n\n\u0412 \u0445\u043e\u0434\u0435 \u043c\u043e\u0438\u0445 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0439, \u043e\u043f\u0438\u0441\u0430\u043d\u043d\u044b\u0445 \u0432 \u0434\u0440\u0443\u0433\u043e\u043c \u043f\u043e\u0441\u0442\u0435 \"\u041e\u0445\u043e\u0442\u0430 \u0437\u0430 LPE \u0432 \u0438\u0433\u0440\u043e\u0432\u043e\u043c \u041f\u041e\". \u041c\u043d\u0435 \u0431\u044b\u043b\u043e \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e \u0443\u0437\u043d\u0430\u0442\u044c \u043e \u0441\u043b\u0443\u0436\u0431\u0430\u0445 GOG, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u044e\u0442\u0441\u044f \u043a\u0430\u043a \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430. \u042f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u043b GOG \u043d\u0430 \"\u0441\u0432\u0435\u0436\u0443\u044e\" \u0441\u0438\u0441\u0442\u0435\u043c\u0443 Windows 11 \u0438 Windows 10 \u0438 \u0441\u043d\u043e\u0432\u0430 \u043e\u0431\u0440\u0430\u0442\u0438\u043b \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u043d\u0430 \u0441\u043b\u0443\u0436\u0431\u0443 \"GalaxCommunication\". \u041a\u0430\u043a \u043c\u044b \u0432\u0438\u0434\u0438\u043c, \u0441\u043b\u0443\u0436\u0431\u0430 \u043f\u043e-\u043f\u0440\u0435\u0436\u043d\u0435\u043c\u0443 \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0441 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438 SYSTEM. \u041f\u0440\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 GOG: 2.0.46 \u043e\u0442 16 \u0444\u0435\u0432\u0440\u0430\u043b\u044f 2022 \u0433\u043e\u0434\u0430 (\u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u043d\u0430\u0439\u0434\u0435\u043d) - 2.0.51 \u043e\u0442 \u0438\u044e\u043d\u044f 2022 \u0433\u043e\u0434\u0430 (\u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0432\u0441\u0435 \u0435\u0449\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d).\n\n#CVE #POC", "creation_timestamp": "2022-12-21T11:31:23.000000Z"}, {"uuid": "1798f35e-e7d3-45f6-830d-cc90f5e59544", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-3126", "type": "seen", "source": "https://t.me/cibsecurity/51559", "content": "\u203c CVE-2022-3126 \u203c\n\nThe Frontend File Manager Plugin WordPress plugin before 21.4 does not have CSRF check when uploading files, which could allow attackers to make logged in users upload files on their behalf\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-10-17T16:13:00.000000Z"}, {"uuid": "84c6a932-2103-4eaa-8741-7d48bbd6c027", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-31262", "type": "seen", "source": "https://t.me/cibsecurity/48286", "content": "\u203c CVE-2022-31262 \u203c\n\nAn exploitable local privilege escalation vulnerability exists in GOG Galaxy 2.0.46. Due to insufficient folder permissions, an attacker can hijack the %ProgramData%\\GOG.com folder structure and change the GalaxyCommunication service executable to a malicious file, resulting in code execution as SYSTEM.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-08-17T18:40:29.000000Z"}, {"uuid": "1f8e5b2b-33c8-4448-800f-eed0e6a7d090", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-31261", "type": "seen", "source": "https://t.me/cibsecurity/43262", "content": "\u203c CVE-2022-31261 \u203c\n\nAn XXE issue was discovered in Morpheus through 5.2.16 and 5.4.x through 5.4.4. A successful attack requires a SAML identity provider to be configured. In order to exploit the vulnerability, the attacker must know the unique SAML callback ID of the configured identity source. A remote attacker can send a request crafted with an XXE payload to invoke a malicious DTD hosted on a system that they control. This results in reading local files that the application has access to.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-05-24T18:37:12.000000Z"}, {"uuid": "b5ee4380-f029-4f12-bcfe-78e95d8385bb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-31263", "type": "seen", "source": "https://t.me/cibsecurity/43202", "content": "\u203c CVE-2022-31263 \u203c\n\napp/models/user.rb in Mastodon before 3.5.0 allows a bypass of e-mail restrictions.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-05-24T07:36:17.000000Z"}, {"uuid": "92372dbf-afee-48b8-a3e8-cde9eca44139", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-31262", "type": "published-proof-of-concept", "source": "https://t.me/CVEhub/1205", "content": "\ud83d\udc7eCVE SERVICE \ud83c\udff7#CVE\nMumber: CVE-2022-31262\nGithub: https://github.com/secure-77/CVE-2022-31262\nDescribe: \n**", "creation_timestamp": "2026-08-01T06:00:04.115888Z"}, {"uuid": "7a482b29-e849-4801-9a78-4ed436cc3c96", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-31269", "type": "published-proof-of-concept", "source": "https://t.me/CVEhub/1317", "content": "\ud83d\udc7eCVE SERVICE \ud83c\udff7#CVE\nMumber: CVE-2022-31269\nGithub: https://github.com/Henry4E36/CVE-2022-31269\nDescribe: \n**", "creation_timestamp": "2026-08-01T06:00:04.308181Z"}, {"uuid": "6e27b101-673e-4c16-8a6f-ac7803b46ca3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-31269", "type": "seen", "source": "https://t.me/CVEhub/1317", "content": "\ud83d\udc7eCVE SERVICE \ud83c\udff7#CVE\nMumber: CVE-2022-31269\nGithub: https://github.com/Henry4E36/CVE-2022-31269\nDescribe: \n**", "creation_timestamp": "2026-07-29T12:01:03.051782Z"}, {"uuid": "e7231e22-5681-4820-91aa-b82a75cc3a97", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-31262", "type": "seen", "source": "https://t.me/CVEhub/1205", "content": "\ud83d\udc7eCVE SERVICE \ud83c\udff7#CVE\nMumber: CVE-2022-31262\nGithub: https://github.com/secure-77/CVE-2022-31262\nDescribe: \n**", "creation_timestamp": "2026-07-29T12:01:03.198166Z"}, {"uuid": "789c239d-c12f-4866-b871-f491ddf224b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-31269", "type": "seen", "source": "https://t.me/hacking_Attack/64718", "content": "Exploit Collector\nNortek Linear eMerge E3-Series Credential Disclosure\n\nhttps://3.bp.blogspot.com/-L1ywDwIvHnM/WWlvbqBqi6I/AAAAAAAAIPQ/e-y1sGxHKpMGeO7A8b-5LHWSXrbuRWhUwCLcBGAs/s1600/h73.png \nNortek Linear eMerge E3-Series versions 0.32-07p, 0.32-07e, 0.32-07p, 0.32-08f, and 0.32-09c suffer from an administrative credential disclosure vulnerability.\n\nSHA-256 | 307313c2ca8b81c83cd5647ca35cba3eab21050364f124ce96583e8dff6bcfd4\n\nDownload\n# Exploit Title: Nortek Linear eMerge E3-Series - Information\nDisclosure lead to access admin dashboard\n# Exploit Author: Omar Hashim\n# Version: 0.32-07p,0.32-07e,0.32-07p,0.32-08f,0.32-09c\n# Vendor home page : https://www.nortekcontrol.com/access-control/\n# Vendor home page : https://linear-solutions.com/\n# Authentication Required: No\n# CVE : CVE-2022-31269\n\n# Description\n====================\nAdmin credentials are stored in clear text at the endpoint /test.txt\n(This occurs in situations where the default credentials admin:admin have been\nchanged.) Allows an unauthenticated attacker to obtain admini\ncredentials, access\nthe admin dashboard of Linear eMerge E3-Series devices, control entire building\ndoors, cameras, elevator, etc... and access information about employees who can\naccess the building and take control of the entire building\n#Proof Of Concept:\n====================\n\nhttp://<host:port/test.txt\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-01T20:01:26.604484Z"}, {"uuid": "1c577411-3c49-4f2e-a578-a2c2ff78da16", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-31269", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/64718", "content": "Exploit Collector\nNortek Linear eMerge E3-Series Credential Disclosure\n\nhttps://3.bp.blogspot.com/-L1ywDwIvHnM/WWlvbqBqi6I/AAAAAAAAIPQ/e-y1sGxHKpMGeO7A8b-5LHWSXrbuRWhUwCLcBGAs/s1600/h73.png \nNortek Linear eMerge E3-Series versions 0.32-07p, 0.32-07e, 0.32-07p, 0.32-08f, and 0.32-09c suffer from an administrative credential disclosure vulnerability.\n\nSHA-256 | 307313c2ca8b81c83cd5647ca35cba3eab21050364f124ce96583e8dff6bcfd4\n\nDownload\n# Exploit Title: Nortek Linear eMerge E3-Series - Information\nDisclosure lead to access admin dashboard\n# Exploit Author: Omar Hashim\n# Version: 0.32-07p,0.32-07e,0.32-07p,0.32-08f,0.32-09c\n# Vendor home page : https://www.nortekcontrol.com/access-control/\n# Vendor home page : https://linear-solutions.com/\n# Authentication Required: No\n# CVE : CVE-2022-31269\n\n# Description\n====================\nAdmin credentials are stored in clear text at the endpoint /test.txt\n(This occurs in situations where the default credentials admin:admin have been\nchanged.) Allows an unauthenticated attacker to obtain admini\ncredentials, access\nthe admin dashboard of Linear eMerge E3-Series devices, control entire building\ndoors, cameras, elevator, etc... and access information about employees who can\naccess the building and take control of the entire building\n#Proof Of Concept:\n====================\n\nhttp://<host:port/test.txt\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-05T12:00:05.620786Z"}]}