This archive contains all of the 150 exploits added to Packet Storm in April, 2022.
308c93a4119d3e38af49bcea7afd2162357abf8f1f8689ed16e0b2bc4aa0de4eThis Metasploit module abuses a vulnerability in certain WSO2 products that allow unrestricted file upload with resultant remote code execution. This affects WSO2 API Manager 2.2.0 and above through 4.0.0; WSO2 Identity Server 5.2.0 and above through 5.11.0; WSO2 Identity Server Analytics 5.4.0, 5.4.1, 5.5.0, and 5.6.0; WSO2 Identity Server as Key Manager 5.3.0 and above through 5.10.0; and WSO2 Enterprise Integrator 6.2.0 and above through 6.6.0.
7bdab9b3101da4ba2df8ff1f6a558171e4d8a503d4d44bcbaf0347587fa69a4dRed Hat Security Advisory 2022-1665-01 - The gzip packages contain the gzip data compression utility. gzip is used to compress regular files. It replaces them with files containing the .gz extension, while retaining ownership modes, access, and modification times.
ca530d5e9416b7c13a4d78af15826bfad84ef29c2938e0cbc37677862407e3f3WordPress Stafflist plugin version 3.1.2 suffers from a cross site request forgery vulnerability.
9d6c94780d9e6bad20039cfa30e21ac1263e9e05f4af98d371874857a71295c3WordPress Stafflist plugin version 3.1.2 suffers from a remote SQL injection vulnerability.
76212ce51a690afcb72976ffdf858974f47d6bff5804091f1c6e89f12d4ebfe3Ubuntu Security Notice 5382-2 - USN-5382-1 fixed a vulnerability in libinput. This update provides the corresponding updates for Ubuntu 22.04 LTS. Albin Eldstål-Ahrens and Lukas Lamster discovered libinput did not properly handle input devices with specially crafted names. A local attacker with physical access could use this to cause libinput to crash or expose sensitive information.
67195fd3b54b029ccd4a0d9b0290d31b7dec01f28c5744fb01748494eafc8e67Strap versions prior to 3.6.9 and 4.1.5 disclose a user's password due to simply base64 encoding it and sticking it in a cookie.
069e678d219ce2bfcd777e3fcf09ee5a7c59fe5b6c563e15e918fd0877c7aff7Red Hat Security Advisory 2022-1661-01 - The zlib packages provide a general-purpose lossless data compression library that is used by many different programs.
fb61b760ab6bb66f0eee64aa5821f9a9797c53303b63d5f75f4c30009296afe6Red Hat Security Advisory 2022-1663-01 - Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Issues addressed include a denial of service vulnerability.
6432414f7b8a6571ed395cf657578903108760e6c22f8983c8ddccfd17747480LockBit ransomware looks for and executes DLLs in its current directory. This can potentially allow us to execute our own code, control and terminate the malware pre-encryption. The exploit DLL will check if the current directory is "C:\Windows\System32" and if not we grab our process ID and terminate. Endpoint protection systems and or antivirus can potentially be killed prior to executing malware, but this method cannot as there's nothing to kill the DLL that just lives on disk waiting. All basic tests were conducted successfully in a virtual machine environment.
2309d126cc5ad752cce17568336336941a74bd3cad316628d72b23e6103bbdc2Red Hat Security Advisory 2022-1664-01 - lxml is an XML processing library providing access to libxml2 and libxslt libraries using the Python ElementTree API.
9e2395329688adbce9f1cb130f3cb5b197290b8c31a19fbfe1ef9ddcfdfbeb67Covid 19 Travel Pass Management System version 1.0 suffers from a remote SQL injection vulnerability.
8c232ce0a1da7fa75903ca2807d34366340d6c85780e027ddfaa612d65d60aeaRed Hat Security Advisory 2022-1662-01 - The Apache Maven Shared Utils project aims to be an improved functional replacement for plexus-utils in Maven. Issues addressed include a code execution vulnerability.
aa50bcf7e9ca9147b16c3946ba439286f9ef8c50feb70b742751fab6518e6934Toll Tax Management System version 1.0 suffers from a remote SQL injection vulnerability.
317767316eef211ac935a713d8b56603dc6e80969ace44334e34402ca5937bf6Red Hat Security Advisory 2022-1646-01 - Twisted is a networking engine written in Python, supporting numerous protocols. It contains a web server, numerous chat clients, chat servers, mail servers and more. Issues addressed include a HTTP request smuggling vulnerability.
edafd374bc7080d26a801370b03b76f7d43b88ef319ac614fe523e26bd1f10a3
© 2024 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed