This module produces an out of bounds and generate a Denial of Service

IBM i Access Client Solutions is vulnerable to DLL hijacking when certain features are run on a Windows operating system that leverage native code. IBM has addressed this CVE by providing a fix to IBM i Access Client Solutions as described in the remediation/fixes section. The attacker must entice a victim into opening a specially crafted .hod, .bchx, .ws, .dttx and dtfx file. This file and the associated binary may be delivered to a user through remote WebDAV shares or zipped attach. An attacker may exploit this issue to execute arbitrary code.

This module exploits a XStream deserialization vulnerability to deploy an agent in VMware Workspace ONE Access that will run with root user privileges. The vulnerability is present in the resetPassword method of com.vmware.vshield.vsm.usermgmt.restcontroller.UserMgmtController class via the @RequestBody parameter with SecurityProfileDto type which sets the serializer to the vulnerable XStream.

This module exploits a XStream deserialization vulnerability to deploy an agent in VMware Workspace ONE Access that will run with root user privileges. The vulnerability is present in the resetPassword method of com.vmware.vshield.vsm.usermgmt.restcontroller.UserMgmtController class via the @RequestBody parameter with SecurityProfileDto type which sets the serializer to the vulnerable XStream.

This module exploits a java deserialization vulnerability present in the CewolfRenderer servlet. Also, this module exploits a blind XXE vulnerability present in the ProcessTrackingListener class.

This module exploits a java deserialization vulnerability present in the CewolfRenderer servlet. Also, this module exploits a blind XXE vulnerability present in the ProcessTrackingListener class.

An authentication bypass using an alternate path or channel vulnerability [CWE-288] in FortiOS, FortiProxy and FortiSwitchManager may allow an unauthenticated attacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.

This module exploits an Arbitrary File Deletion performed by a normal user in protected folders

The vulnerability is a win32k window object type confusion leading to an OOB (out-of-bounds) write which can be used to create arbitrary memory read and write capabilities within the Windows kernel to achieve elevated privileges.

A type confusion bug in nft_set_elem_init (leading to a buffer overflow) could be used by a local attacker to escalate privileges, a different vulnerability than CVE-2022-32250. (The attacker can obtain root access, but must start with an unprivileged user namespace to obtain CAP_NET_ADMIN access.) This can be fixed in nft_setelem_parse_data in net/netfilter/nf_tables_api.c.