https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Sat, 12 Sep 2026 12:51:07 +0000 https://vulnerability.circl.lu/sighting/5f82669a-e686-40c7-99ff-24c5752cab73/export {"uuid": "5f82669a-e686-40c7-99ff-24c5752cab73", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34150", "type": "seen", "source": "https://t.me/hacking_Attack/62357", "content": "Black Hat Ethical Hacking\nZero-day flaws in GPS tracker pose surveillance, fuel cut-off risks to vehicles\n\nZero-day flaws in GPS tracker pose surveillance, fuel cut-off risks to vehiclesPost Views: 18 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes\nA raft of zero-day\u00a0flaws found in a popular automotive GPS tracking device \u201ccould have disastrous and even life-threatening implications\u201d, security researchers warn.\n\nSix as-yet-unpatched vulnerabilities unearthed by BitSight researcher Pedro Umbelino affect the API server, GPS tracker protocol, and web server of the MV720 GPS tracker, which was developed by China-based company MiCODUS.\n\nSuccessful abuse of the bugs could see attackers \u201ccut fuel to an entire fleet of commercial or emergency vehicles\u201d, use GPS data \u201cto monitor and abruptly stop vehicles on dangerous highways\u201d, or \u201ctrack individuals or demand ransom payments to return disabled vehicles to working condition\u201d, according to research\u00a0(PDF) from BitSight.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Huge attack surfaceAccording to the cybersecurity firm, the MiCODUS MV720 provides theft protection and fleet management functionality to customers in at least in 169 countries, including a Fortune 50 energy company, a national military in South America, a federal government in Western Europe, a national law enforcement agency in Western Europe, and a nuclear power plant operator.\n\nAlarmingly, BitSight said Umbelino also uncovered security issues associated with the firm\u2019s cloud-based device management interface for the web, iOS, and Android, a finding which means other MiCODUS GPS tracking models could also be insecure. If MiCODUS\u2019 own figures are accurate, that equates to 1.5 million potentially vulnerable devices worldwide.\n\nWith security patches yet to materialize, BitSight has urged users to \u201cimmediately stop using or disable any MiCODUS MV720 GPS trackers until a fix is made available\u201d.\n\nA security advisory\u00a0from the US Cybersecurity and Infrastructure Security Agency (CISA) said that \u201cno known public exploits specifically target these vulnerabilities\u201d in the MV720 GPS tracker.\nTrending: How Misconfigurations in Linux can leave you vulnerable to Attackers Trending: Recon Tool: WayMore Authentication issuesTwo critical authentication issues in the API server, both notching a CVSS score of 9.8, enable \u201can attacker to send SMS commands directly to the GPS tracker as if they were coming from the GPS owner\u2019s mobile number\u201d.\n\nOne bug relates to a hard-coded master password (CVE-2022-2107) and the other, resulting from improper authentication (CVE-2022-2141), potentially enables manipulator-in-the-middle (MitM) attacks.\n\nThe devices and the mobile interface are preconfigured with the default password \u2018123456\u2019, which BitSight classed as a high severity (CVSS 8.1) issue, although CISA declined to assign a CVE. \u201cThere is no mandatory rule to change the password nor is there any claiming process\u201d, according to BitSight, which found that 94.5% of 1,000 responding device IDs still had the default password.\n\nWith the device ID easily predictable and the server seemingly lacking password brute force mitigations such as rate-limiting, attackers can easily access random GPS trackers.\n\nA high severity (CVSS 7.5) reflected cross-site scripting\u00a0(XSS) vulnerability affecting the main web server, meanwhile, could enable attackers to \u201cfully compromise the device\u201d.\n\nThe main web server also contains a pair of authenticated insecure direct object reference vulnerabilities, tracked as CVE-2022-34150 (CVSS 7.1) and CVE-2022-[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-06T00:00:44.065970Z"} {"uuid": "5f82669a-e686-40c7-99ff-24c5752cab73", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34150", "type": "seen", "source": "https://t.me/hacking_Attack/62357", "content": "Black Hat Ethical Hacking\nZero-day flaws in GPS tracker pose surveillance, fuel cut-off risks to vehicles\n\nZero-day flaws in GPS tracker pose surveillance, fuel cut-off risks to vehiclesPost Views: 18 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes\nA raft of zero-day\u00a0flaws found in a popular automotive GPS tracking device \u201ccould have disastrous and even life-threatening implications\u201d, security researchers warn.\n\nSix as-yet-unpatched vulnerabilities unearthed by BitSight researcher Pedro Umbelino affect the API server, GPS tracker protocol, and web server of the MV720 GPS tracker, which was developed by China-based company MiCODUS.\n\nSuccessful abuse of the bugs could see attackers \u201ccut fuel to an entire fleet of commercial or emergency vehicles\u201d, use GPS data \u201cto monitor and abruptly stop vehicles on dangerous highways\u201d, or \u201ctrack individuals or demand ransom payments to return disabled vehicles to working condition\u201d, according to research\u00a0(PDF) from BitSight.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Huge attack surfaceAccording to the cybersecurity firm, the MiCODUS MV720 provides theft protection and fleet management functionality to customers in at least in 169 countries, including a Fortune 50 energy company, a national military in South America, a federal government in Western Europe, a national law enforcement agency in Western Europe, and a nuclear power plant operator.\n\nAlarmingly, BitSight said Umbelino also uncovered security issues associated with the firm\u2019s cloud-based device management interface for the web, iOS, and Android, a finding which means other MiCODUS GPS tracking models could also be insecure. If MiCODUS\u2019 own figures are accurate, that equates to 1.5 million potentially vulnerable devices worldwide.\n\nWith security patches yet to materialize, BitSight has urged users to \u201cimmediately stop using or disable any MiCODUS MV720 GPS trackers until a fix is made available\u201d.\n\nA security advisory\u00a0from the US Cybersecurity and Infrastructure Security Agency (CISA) said that \u201cno known public exploits specifically target these vulnerabilities\u201d in the MV720 GPS tracker.\nTrending: How Misconfigurations in Linux can leave you vulnerable to Attackers Trending: Recon Tool: WayMore Authentication issuesTwo critical authentication issues in the API server, both notching a CVSS score of 9.8, enable \u201can attacker to send SMS commands directly to the GPS tracker as if they were coming from the GPS owner\u2019s mobile number\u201d.\n\nOne bug relates to a hard-coded master password (CVE-2022-2107) and the other, resulting from improper authentication (CVE-2022-2141), potentially enables manipulator-in-the-middle (MitM) attacks.\n\nThe devices and the mobile interface are preconfigured with the default password \u2018123456\u2019, which BitSight classed as a high severity (CVSS 8.1) issue, although CISA declined to assign a CVE. \u201cThere is no mandatory rule to change the password nor is there any claiming process\u201d, according to BitSight, which found that 94.5% of 1,000 responding device IDs still had the default password.\n\nWith the device ID easily predictable and the server seemingly lacking password brute force mitigations such as rate-limiting, attackers can easily access random GPS trackers.\n\nA high severity (CVSS 7.5) reflected cross-site scripting\u00a0(XSS) vulnerability affecting the main web server, meanwhile, could enable attackers to \u201cfully compromise the device\u201d.\n\nThe main web server also contains a pair of authenticated insecure direct object reference vulnerabilities, tracked as CVE-2022-34150 (CVSS 7.1) and CVE-2022-[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-06T00:00:44.065970Z"} https://vulnerability.circl.lu/sighting/5f82669a-e686-40c7-99ff-24c5752cab73/export Sun, 06 Sep 2026 00:00:44 +0000 https://vulnerability.circl.lu/sighting/7d78fdde-46b9-4c8d-9bbb-836de9267f1f/export {"uuid": "7d78fdde-46b9-4c8d-9bbb-836de9267f1f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34150", "type": "seen", "source": "https://t.me/hacking_Attack/62357", "content": "Black Hat Ethical Hacking\nZero-day flaws in GPS tracker pose surveillance, fuel cut-off risks to vehicles\n\nZero-day flaws in GPS tracker pose surveillance, fuel cut-off risks to vehiclesPost Views: 18 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes\nA raft of zero-day\u00a0flaws found in a popular automotive GPS tracking device \u201ccould have disastrous and even life-threatening implications\u201d, security researchers warn.\n\nSix as-yet-unpatched vulnerabilities unearthed by BitSight researcher Pedro Umbelino affect the API server, GPS tracker protocol, and web server of the MV720 GPS tracker, which was developed by China-based company MiCODUS.\n\nSuccessful abuse of the bugs could see attackers \u201ccut fuel to an entire fleet of commercial or emergency vehicles\u201d, use GPS data \u201cto monitor and abruptly stop vehicles on dangerous highways\u201d, or \u201ctrack individuals or demand ransom payments to return disabled vehicles to working condition\u201d, according to research\u00a0(PDF) from BitSight.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Huge attack surfaceAccording to the cybersecurity firm, the MiCODUS MV720 provides theft protection and fleet management functionality to customers in at least in 169 countries, including a Fortune 50 energy company, a national military in South America, a federal government in Western Europe, a national law enforcement agency in Western Europe, and a nuclear power plant operator.\n\nAlarmingly, BitSight said Umbelino also uncovered security issues associated with the firm\u2019s cloud-based device management interface for the web, iOS, and Android, a finding which means other MiCODUS GPS tracking models could also be insecure. If MiCODUS\u2019 own figures are accurate, that equates to 1.5 million potentially vulnerable devices worldwide.\n\nWith security patches yet to materialize, BitSight has urged users to \u201cimmediately stop using or disable any MiCODUS MV720 GPS trackers until a fix is made available\u201d.\n\nA security advisory\u00a0from the US Cybersecurity and Infrastructure Security Agency (CISA) said that \u201cno known public exploits specifically target these vulnerabilities\u201d in the MV720 GPS tracker.\nTrending: How Misconfigurations in Linux can leave you vulnerable to Attackers Trending: Recon Tool: WayMore Authentication issuesTwo critical authentication issues in the API server, both notching a CVSS score of 9.8, enable \u201can attacker to send SMS commands directly to the GPS tracker as if they were coming from the GPS owner\u2019s mobile number\u201d.\n\nOne bug relates to a hard-coded master password (CVE-2022-2107) and the other, resulting from improper authentication (CVE-2022-2141), potentially enables manipulator-in-the-middle (MitM) attacks.\n\nThe devices and the mobile interface are preconfigured with the default password \u2018123456\u2019, which BitSight classed as a high severity (CVSS 8.1) issue, although CISA declined to assign a CVE. \u201cThere is no mandatory rule to change the password nor is there any claiming process\u201d, according to BitSight, which found that 94.5% of 1,000 responding device IDs still had the default password.\n\nWith the device ID easily predictable and the server seemingly lacking password brute force mitigations such as rate-limiting, attackers can easily access random GPS trackers.\n\nA high severity (CVSS 7.5) reflected cross-site scripting\u00a0(XSS) vulnerability affecting the main web server, meanwhile, could enable attackers to \u201cfully compromise the device\u201d.\n\nThe main web server also contains a pair of authenticated insecure direct object reference vulnerabilities, tracked as CVE-2022-34150 (CVSS 7.1) and CVE-2022-[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-05T15:00:06.757873Z"} {"uuid": "7d78fdde-46b9-4c8d-9bbb-836de9267f1f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34150", "type": "seen", "source": "https://t.me/hacking_Attack/62357", "content": "Black Hat Ethical Hacking\nZero-day flaws in GPS tracker pose surveillance, fuel cut-off risks to vehicles\n\nZero-day flaws in GPS tracker pose surveillance, fuel cut-off risks to vehiclesPost Views: 18 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes\nA raft of zero-day\u00a0flaws found in a popular automotive GPS tracking device \u201ccould have disastrous and even life-threatening implications\u201d, security researchers warn.\n\nSix as-yet-unpatched vulnerabilities unearthed by BitSight researcher Pedro Umbelino affect the API server, GPS tracker protocol, and web server of the MV720 GPS tracker, which was developed by China-based company MiCODUS.\n\nSuccessful abuse of the bugs could see attackers \u201ccut fuel to an entire fleet of commercial or emergency vehicles\u201d, use GPS data \u201cto monitor and abruptly stop vehicles on dangerous highways\u201d, or \u201ctrack individuals or demand ransom payments to return disabled vehicles to working condition\u201d, according to research\u00a0(PDF) from BitSight.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Huge attack surfaceAccording to the cybersecurity firm, the MiCODUS MV720 provides theft protection and fleet management functionality to customers in at least in 169 countries, including a Fortune 50 energy company, a national military in South America, a federal government in Western Europe, a national law enforcement agency in Western Europe, and a nuclear power plant operator.\n\nAlarmingly, BitSight said Umbelino also uncovered security issues associated with the firm\u2019s cloud-based device management interface for the web, iOS, and Android, a finding which means other MiCODUS GPS tracking models could also be insecure. If MiCODUS\u2019 own figures are accurate, that equates to 1.5 million potentially vulnerable devices worldwide.\n\nWith security patches yet to materialize, BitSight has urged users to \u201cimmediately stop using or disable any MiCODUS MV720 GPS trackers until a fix is made available\u201d.\n\nA security advisory\u00a0from the US Cybersecurity and Infrastructure Security Agency (CISA) said that \u201cno known public exploits specifically target these vulnerabilities\u201d in the MV720 GPS tracker.\nTrending: How Misconfigurations in Linux can leave you vulnerable to Attackers Trending: Recon Tool: WayMore Authentication issuesTwo critical authentication issues in the API server, both notching a CVSS score of 9.8, enable \u201can attacker to send SMS commands directly to the GPS tracker as if they were coming from the GPS owner\u2019s mobile number\u201d.\n\nOne bug relates to a hard-coded master password (CVE-2022-2107) and the other, resulting from improper authentication (CVE-2022-2141), potentially enables manipulator-in-the-middle (MitM) attacks.\n\nThe devices and the mobile interface are preconfigured with the default password \u2018123456\u2019, which BitSight classed as a high severity (CVSS 8.1) issue, although CISA declined to assign a CVE. \u201cThere is no mandatory rule to change the password nor is there any claiming process\u201d, according to BitSight, which found that 94.5% of 1,000 responding device IDs still had the default password.\n\nWith the device ID easily predictable and the server seemingly lacking password brute force mitigations such as rate-limiting, attackers can easily access random GPS trackers.\n\nA high severity (CVSS 7.5) reflected cross-site scripting\u00a0(XSS) vulnerability affecting the main web server, meanwhile, could enable attackers to \u201cfully compromise the device\u201d.\n\nThe main web server also contains a pair of authenticated insecure direct object reference vulnerabilities, tracked as CVE-2022-34150 (CVSS 7.1) and CVE-2022-[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-05T15:00:06.757873Z"} https://vulnerability.circl.lu/sighting/7d78fdde-46b9-4c8d-9bbb-836de9267f1f/export Sat, 05 Sep 2026 15:00:06 +0000 https://vulnerability.circl.lu/sighting/0d1d3383-04ac-496c-8376-6ec7ec3f243a/export {"uuid": "0d1d3383-04ac-496c-8376-6ec7ec3f243a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34150", "type": "seen", "source": "https://t.me/hacking_Attack/62357", "content": "Black Hat Ethical Hacking\nZero-day flaws in GPS tracker pose surveillance, fuel cut-off risks to vehicles\n\nZero-day flaws in GPS tracker pose surveillance, fuel cut-off risks to vehiclesPost Views: 18 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes\nA raft of zero-day\u00a0flaws found in a popular automotive GPS tracking device \u201ccould have disastrous and even life-threatening implications\u201d, security researchers warn.\n\nSix as-yet-unpatched vulnerabilities unearthed by BitSight researcher Pedro Umbelino affect the API server, GPS tracker protocol, and web server of the MV720 GPS tracker, which was developed by China-based company MiCODUS.\n\nSuccessful abuse of the bugs could see attackers \u201ccut fuel to an entire fleet of commercial or emergency vehicles\u201d, use GPS data \u201cto monitor and abruptly stop vehicles on dangerous highways\u201d, or \u201ctrack individuals or demand ransom payments to return disabled vehicles to working condition\u201d, according to research\u00a0(PDF) from BitSight.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Huge attack surfaceAccording to the cybersecurity firm, the MiCODUS MV720 provides theft protection and fleet management functionality to customers in at least in 169 countries, including a Fortune 50 energy company, a national military in South America, a federal government in Western Europe, a national law enforcement agency in Western Europe, and a nuclear power plant operator.\n\nAlarmingly, BitSight said Umbelino also uncovered security issues associated with the firm\u2019s cloud-based device management interface for the web, iOS, and Android, a finding which means other MiCODUS GPS tracking models could also be insecure. If MiCODUS\u2019 own figures are accurate, that equates to 1.5 million potentially vulnerable devices worldwide.\n\nWith security patches yet to materialize, BitSight has urged users to \u201cimmediately stop using or disable any MiCODUS MV720 GPS trackers until a fix is made available\u201d.\n\nA security advisory\u00a0from the US Cybersecurity and Infrastructure Security Agency (CISA) said that \u201cno known public exploits specifically target these vulnerabilities\u201d in the MV720 GPS tracker.\nTrending: How Misconfigurations in Linux can leave you vulnerable to Attackers Trending: Recon Tool: WayMore Authentication issuesTwo critical authentication issues in the API server, both notching a CVSS score of 9.8, enable \u201can attacker to send SMS commands directly to the GPS tracker as if they were coming from the GPS owner\u2019s mobile number\u201d.\n\nOne bug relates to a hard-coded master password (CVE-2022-2107) and the other, resulting from improper authentication (CVE-2022-2141), potentially enables manipulator-in-the-middle (MitM) attacks.\n\nThe devices and the mobile interface are preconfigured with the default password \u2018123456\u2019, which BitSight classed as a high severity (CVSS 8.1) issue, although CISA declined to assign a CVE. \u201cThere is no mandatory rule to change the password nor is there any claiming process\u201d, according to BitSight, which found that 94.5% of 1,000 responding device IDs still had the default password.\n\nWith the device ID easily predictable and the server seemingly lacking password brute force mitigations such as rate-limiting, attackers can easily access random GPS trackers.\n\nA high severity (CVSS 7.5) reflected cross-site scripting\u00a0(XSS) vulnerability affecting the main web server, meanwhile, could enable attackers to \u201cfully compromise the device\u201d.\n\nThe main web server also contains a pair of authenticated insecure direct object reference vulnerabilities, tracked as CVE-2022-34150 (CVSS 7.1) and CVE-2022-[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:01:44.074370Z"} {"uuid": "0d1d3383-04ac-496c-8376-6ec7ec3f243a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34150", "type": "seen", "source": "https://t.me/hacking_Attack/62357", "content": "Black Hat Ethical Hacking\nZero-day flaws in GPS tracker pose surveillance, fuel cut-off risks to vehicles\n\nZero-day flaws in GPS tracker pose surveillance, fuel cut-off risks to vehiclesPost Views: 18 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes\nA raft of zero-day\u00a0flaws found in a popular automotive GPS tracking device \u201ccould have disastrous and even life-threatening implications\u201d, security researchers warn.\n\nSix as-yet-unpatched vulnerabilities unearthed by BitSight researcher Pedro Umbelino affect the API server, GPS tracker protocol, and web server of the MV720 GPS tracker, which was developed by China-based company MiCODUS.\n\nSuccessful abuse of the bugs could see attackers \u201ccut fuel to an entire fleet of commercial or emergency vehicles\u201d, use GPS data \u201cto monitor and abruptly stop vehicles on dangerous highways\u201d, or \u201ctrack individuals or demand ransom payments to return disabled vehicles to working condition\u201d, according to research\u00a0(PDF) from BitSight.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Huge attack surfaceAccording to the cybersecurity firm, the MiCODUS MV720 provides theft protection and fleet management functionality to customers in at least in 169 countries, including a Fortune 50 energy company, a national military in South America, a federal government in Western Europe, a national law enforcement agency in Western Europe, and a nuclear power plant operator.\n\nAlarmingly, BitSight said Umbelino also uncovered security issues associated with the firm\u2019s cloud-based device management interface for the web, iOS, and Android, a finding which means other MiCODUS GPS tracking models could also be insecure. If MiCODUS\u2019 own figures are accurate, that equates to 1.5 million potentially vulnerable devices worldwide.\n\nWith security patches yet to materialize, BitSight has urged users to \u201cimmediately stop using or disable any MiCODUS MV720 GPS trackers until a fix is made available\u201d.\n\nA security advisory\u00a0from the US Cybersecurity and Infrastructure Security Agency (CISA) said that \u201cno known public exploits specifically target these vulnerabilities\u201d in the MV720 GPS tracker.\nTrending: How Misconfigurations in Linux can leave you vulnerable to Attackers Trending: Recon Tool: WayMore Authentication issuesTwo critical authentication issues in the API server, both notching a CVSS score of 9.8, enable \u201can attacker to send SMS commands directly to the GPS tracker as if they were coming from the GPS owner\u2019s mobile number\u201d.\n\nOne bug relates to a hard-coded master password (CVE-2022-2107) and the other, resulting from improper authentication (CVE-2022-2141), potentially enables manipulator-in-the-middle (MitM) attacks.\n\nThe devices and the mobile interface are preconfigured with the default password \u2018123456\u2019, which BitSight classed as a high severity (CVSS 8.1) issue, although CISA declined to assign a CVE. \u201cThere is no mandatory rule to change the password nor is there any claiming process\u201d, according to BitSight, which found that 94.5% of 1,000 responding device IDs still had the default password.\n\nWith the device ID easily predictable and the server seemingly lacking password brute force mitigations such as rate-limiting, attackers can easily access random GPS trackers.\n\nA high severity (CVSS 7.5) reflected cross-site scripting\u00a0(XSS) vulnerability affecting the main web server, meanwhile, could enable attackers to \u201cfully compromise the device\u201d.\n\nThe main web server also contains a pair of authenticated insecure direct object reference vulnerabilities, tracked as CVE-2022-34150 (CVSS 7.1) and CVE-2022-[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:01:44.074370Z"} https://vulnerability.circl.lu/sighting/0d1d3383-04ac-496c-8376-6ec7ec3f243a/export Wed, 02 Sep 2026 01:01:44 +0000 https://vulnerability.circl.lu/sighting/7d290098-72f6-448e-9f47-6ff450f0d76a/export {"uuid": "7d290098-72f6-448e-9f47-6ff450f0d76a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34150", "type": "seen", "source": "https://t.me/hacking_Attack/62357", "content": "Black Hat Ethical Hacking\nZero-day flaws in GPS tracker pose surveillance, fuel cut-off risks to vehicles\n\nZero-day flaws in GPS tracker pose surveillance, fuel cut-off risks to vehiclesPost Views: 18 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes\nA raft of zero-day\u00a0flaws found in a popular automotive GPS tracking device \u201ccould have disastrous and even life-threatening implications\u201d, security researchers warn.\n\nSix as-yet-unpatched vulnerabilities unearthed by BitSight researcher Pedro Umbelino affect the API server, GPS tracker protocol, and web server of the MV720 GPS tracker, which was developed by China-based company MiCODUS.\n\nSuccessful abuse of the bugs could see attackers \u201ccut fuel to an entire fleet of commercial or emergency vehicles\u201d, use GPS data \u201cto monitor and abruptly stop vehicles on dangerous highways\u201d, or \u201ctrack individuals or demand ransom payments to return disabled vehicles to working condition\u201d, according to research\u00a0(PDF) from BitSight.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Huge attack surfaceAccording to the cybersecurity firm, the MiCODUS MV720 provides theft protection and fleet management functionality to customers in at least in 169 countries, including a Fortune 50 energy company, a national military in South America, a federal government in Western Europe, a national law enforcement agency in Western Europe, and a nuclear power plant operator.\n\nAlarmingly, BitSight said Umbelino also uncovered security issues associated with the firm\u2019s cloud-based device management interface for the web, iOS, and Android, a finding which means other MiCODUS GPS tracking models could also be insecure. If MiCODUS\u2019 own figures are accurate, that equates to 1.5 million potentially vulnerable devices worldwide.\n\nWith security patches yet to materialize, BitSight has urged users to \u201cimmediately stop using or disable any MiCODUS MV720 GPS trackers until a fix is made available\u201d.\n\nA security advisory\u00a0from the US Cybersecurity and Infrastructure Security Agency (CISA) said that \u201cno known public exploits specifically target these vulnerabilities\u201d in the MV720 GPS tracker.\nTrending: How Misconfigurations in Linux can leave you vulnerable to Attackers Trending: Recon Tool: WayMore Authentication issuesTwo critical authentication issues in the API server, both notching a CVSS score of 9.8, enable \u201can attacker to send SMS commands directly to the GPS tracker as if they were coming from the GPS owner\u2019s mobile number\u201d.\n\nOne bug relates to a hard-coded master password (CVE-2022-2107) and the other, resulting from improper authentication (CVE-2022-2141), potentially enables manipulator-in-the-middle (MitM) attacks.\n\nThe devices and the mobile interface are preconfigured with the default password \u2018123456\u2019, which BitSight classed as a high severity (CVSS 8.1) issue, although CISA declined to assign a CVE. \u201cThere is no mandatory rule to change the password nor is there any claiming process\u201d, according to BitSight, which found that 94.5% of 1,000 responding device IDs still had the default password.\n\nWith the device ID easily predictable and the server seemingly lacking password brute force mitigations such as rate-limiting, attackers can easily access random GPS trackers.\n\nA high severity (CVSS 7.5) reflected cross-site scripting\u00a0(XSS) vulnerability affecting the main web server, meanwhile, could enable attackers to \u201cfully compromise the device\u201d.\n\nThe main web server also contains a pair of authenticated insecure direct object reference vulnerabilities, tracked as CVE-2022-34150 (CVSS 7.1) and CVE-2022-[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:34.362574Z"} {"uuid": "7d290098-72f6-448e-9f47-6ff450f0d76a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34150", "type": "seen", "source": "https://t.me/hacking_Attack/62357", "content": "Black Hat Ethical Hacking\nZero-day flaws in GPS tracker pose surveillance, fuel cut-off risks to vehicles\n\nZero-day flaws in GPS tracker pose surveillance, fuel cut-off risks to vehiclesPost Views: 18 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes\nA raft of zero-day\u00a0flaws found in a popular automotive GPS tracking device \u201ccould have disastrous and even life-threatening implications\u201d, security researchers warn.\n\nSix as-yet-unpatched vulnerabilities unearthed by BitSight researcher Pedro Umbelino affect the API server, GPS tracker protocol, and web server of the MV720 GPS tracker, which was developed by China-based company MiCODUS.\n\nSuccessful abuse of the bugs could see attackers \u201ccut fuel to an entire fleet of commercial or emergency vehicles\u201d, use GPS data \u201cto monitor and abruptly stop vehicles on dangerous highways\u201d, or \u201ctrack individuals or demand ransom payments to return disabled vehicles to working condition\u201d, according to research\u00a0(PDF) from BitSight.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Huge attack surfaceAccording to the cybersecurity firm, the MiCODUS MV720 provides theft protection and fleet management functionality to customers in at least in 169 countries, including a Fortune 50 energy company, a national military in South America, a federal government in Western Europe, a national law enforcement agency in Western Europe, and a nuclear power plant operator.\n\nAlarmingly, BitSight said Umbelino also uncovered security issues associated with the firm\u2019s cloud-based device management interface for the web, iOS, and Android, a finding which means other MiCODUS GPS tracking models could also be insecure. If MiCODUS\u2019 own figures are accurate, that equates to 1.5 million potentially vulnerable devices worldwide.\n\nWith security patches yet to materialize, BitSight has urged users to \u201cimmediately stop using or disable any MiCODUS MV720 GPS trackers until a fix is made available\u201d.\n\nA security advisory\u00a0from the US Cybersecurity and Infrastructure Security Agency (CISA) said that \u201cno known public exploits specifically target these vulnerabilities\u201d in the MV720 GPS tracker.\nTrending: How Misconfigurations in Linux can leave you vulnerable to Attackers Trending: Recon Tool: WayMore Authentication issuesTwo critical authentication issues in the API server, both notching a CVSS score of 9.8, enable \u201can attacker to send SMS commands directly to the GPS tracker as if they were coming from the GPS owner\u2019s mobile number\u201d.\n\nOne bug relates to a hard-coded master password (CVE-2022-2107) and the other, resulting from improper authentication (CVE-2022-2141), potentially enables manipulator-in-the-middle (MitM) attacks.\n\nThe devices and the mobile interface are preconfigured with the default password \u2018123456\u2019, which BitSight classed as a high severity (CVSS 8.1) issue, although CISA declined to assign a CVE. \u201cThere is no mandatory rule to change the password nor is there any claiming process\u201d, according to BitSight, which found that 94.5% of 1,000 responding device IDs still had the default password.\n\nWith the device ID easily predictable and the server seemingly lacking password brute force mitigations such as rate-limiting, attackers can easily access random GPS trackers.\n\nA high severity (CVSS 7.5) reflected cross-site scripting\u00a0(XSS) vulnerability affecting the main web server, meanwhile, could enable attackers to \u201cfully compromise the device\u201d.\n\nThe main web server also contains a pair of authenticated insecure direct object reference vulnerabilities, tracked as CVE-2022-34150 (CVSS 7.1) and CVE-2022-[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:34.362574Z"} https://vulnerability.circl.lu/sighting/7d290098-72f6-448e-9f47-6ff450f0d76a/export Tue, 01 Sep 2026 20:01:34 +0000 https://vulnerability.circl.lu/sighting/5cbe743a-f7a6-4fc5-8b1f-6fc38ec3237f/export {"uuid": "5cbe743a-f7a6-4fc5-8b1f-6fc38ec3237f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34159", "type": "seen", "source": "https://t.me/cvedetector/13397", "content": "{\n \"Source\": \"CVE FEED\",\n \"Title\": \"CVE-2022-34159 - Huawei Printers Unvalidated Input Exception\", \n \"Content\": \"CVE ID : CVE-2022-34159 \nPublished : Dec. 20, 2024, 3:15 a.m. | 42\u00a0minutes ago \nDescription : Huawei printers have an input verification vulnerability. Successful exploitation of this vulnerability may cause device service exceptions. (Vulnerability ID: HWPSIRT-2022-80078) \n \nThis vulnerability has been assigned a Common Vulnerabilities and Exposures (CVE) ID: CVE-2022-34159. \nSeverity: 7.5 | HIGH \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n \"Detection Date\": \"20 Dec 2024\",\n \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-12-20T05:02:11.000000Z"} {"uuid": "5cbe743a-f7a6-4fc5-8b1f-6fc38ec3237f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34159", "type": "seen", "source": "https://t.me/cvedetector/13397", "content": "{\n \"Source\": \"CVE FEED\",\n \"Title\": \"CVE-2022-34159 - Huawei Printers Unvalidated Input Exception\", \n \"Content\": \"CVE ID : CVE-2022-34159 \nPublished : Dec. 20, 2024, 3:15 a.m. | 42\u00a0minutes ago \nDescription : Huawei printers have an input verification vulnerability. Successful exploitation of this vulnerability may cause device service exceptions. (Vulnerability ID: HWPSIRT-2022-80078) \n \nThis vulnerability has been assigned a Common Vulnerabilities and Exposures (CVE) ID: CVE-2022-34159. \nSeverity: 7.5 | HIGH \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n \"Detection Date\": \"20 Dec 2024\",\n \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-12-20T05:02:11.000000Z"} https://vulnerability.circl.lu/sighting/5cbe743a-f7a6-4fc5-8b1f-6fc38ec3237f/export Fri, 20 Dec 2024 05:02:11 +0000 https://vulnerability.circl.lu/sighting/9632b88d-10d0-4337-9edf-ec3e95622ca8/export {"uuid": "9632b88d-10d0-4337-9edf-ec3e95622ca8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34159", "type": "seen", "source": "https://bsky.app/profile/cve-notifications.bsky.social/post/3ldpgcepwel2a", "content": "", "creation_timestamp": "2024-12-20T03:15:57.601608Z"} {"uuid": "9632b88d-10d0-4337-9edf-ec3e95622ca8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34159", "type": "seen", "source": "https://bsky.app/profile/cve-notifications.bsky.social/post/3ldpgcepwel2a", "content": "", "creation_timestamp": "2024-12-20T03:15:57.601608Z"} https://vulnerability.circl.lu/sighting/9632b88d-10d0-4337-9edf-ec3e95622ca8/export Fri, 20 Dec 2024 03:15:57 +0000 https://vulnerability.circl.lu/sighting/705140ec-8aea-4b35-97d9-17fcb5ef52a4/export {"uuid": "705140ec-8aea-4b35-97d9-17fcb5ef52a4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34158", "type": "seen", "source": "https://t.me/arpsyndicate/3170", "content": "#ExploitObserverAlert\n\nCVE-2022-34158\n\nDESCRIPTION: Exploit Observer has 2 entries in 2 file formats related to CVE-2022-34158. A carefully crafted invocation on the Image plugin could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow a group privilege escalation of the attacker's account. Further examination of this issue established that it could also be used to modify the email associated with the attacked account, and then a reset password request from the login page.\n\nFIRST-EPSS: 0.003930000\nNVD-IS: 5.9\nNVD-ES: 2.8", "creation_timestamp": "2024-01-28T02:43:15.000000Z"} {"uuid": "705140ec-8aea-4b35-97d9-17fcb5ef52a4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34158", "type": "seen", "source": "https://t.me/arpsyndicate/3170", "content": "#ExploitObserverAlert\n\nCVE-2022-34158\n\nDESCRIPTION: Exploit Observer has 2 entries in 2 file formats related to CVE-2022-34158. A carefully crafted invocation on the Image plugin could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow a group privilege escalation of the attacker's account. Further examination of this issue established that it could also be used to modify the email associated with the attacked account, and then a reset password request from the login page.\n\nFIRST-EPSS: 0.003930000\nNVD-IS: 5.9\nNVD-ES: 2.8", "creation_timestamp": "2024-01-28T02:43:15.000000Z"} https://vulnerability.circl.lu/sighting/705140ec-8aea-4b35-97d9-17fcb5ef52a4/export Sun, 28 Jan 2024 02:43:15 +0000 https://vulnerability.circl.lu/sighting/b903f23b-bdd9-48a7-956c-74dbd3953b3a/export {"uuid": "b903f23b-bdd9-48a7-956c-74dbd3953b3a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34151", "type": "seen", "source": "https://t.me/itsec_news/3280", "content": "\u200b\u26a1\ufe0f\u041d\u043e\u0432\u044b\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b: Omron \u0431\u043e\u0440\u0435\u0442\u0441\u044f \u0441\u043e \u0441\u043b\u043e\u0436\u043d\u044b\u043c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c \u041f\u041e.\n\n\ud83d\udcac\u042f\u043f\u043e\u043d\u0441\u043a\u0430\u044f \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Omron \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0438\u0440\u0443\u0435\u043c\u043e\u043c \u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u043e\u043c \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0435 (\u041f\u041b\u041a, PLC) \u0438 \u0438\u043d\u0436\u0435\u043d\u0435\u0440\u043d\u043e\u043c \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u043c \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0438, \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0445 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 \u043f\u043e \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Dragos \u0432\u043e \u0432\u0440\u0435\u043c\u044f \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u043b\u043e\u0436\u043d\u043e\u0433\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e.\n\n\u0412 \u043f\u0440\u043e\u0448\u043b\u043e\u043c \u0433\u043e\u0434\u0443 \u0430\u043c\u0435\u0440\u0438\u043a\u0430\u043d\u0441\u043a\u043e\u0435 \u0430\u0433\u0435\u043d\u0442\u0441\u0442\u0432\u043e \u043f\u043e \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 CISA \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u043e \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u043e \u0442\u0440\u0435\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 , \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0438\u0445 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u044b Omron \u0441\u0435\u0440\u0438\u0439 NJ \u0438 NX. Dragos \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0430, \u0447\u0442\u043e \u043e\u0434\u043d\u0430 \u0438\u0437 \u044d\u0442\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u2013 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 CVE-2022-34151, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u0436\u0451\u0441\u0442\u043a\u043e \u0437\u0430\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c\u0438 \u0443\u0447\u0435\u0442\u043d\u044b\u043c\u0438 \u0434\u0430\u043d\u043d\u044b\u043c\u0438, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0430\u0441\u044c \u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a PLC Omron \u0438 \u0441\u0442\u0430\u043b\u0430 \u0446\u0435\u043b\u044c\u044e \u0430\u0442\u0430\u043a \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u043f\u0440\u043e\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f (ICS) \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c Pipedream (Incontroller).\n\nDragos \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u043b\u0430, \u0447\u0442\u043e \u043e\u0434\u0438\u043d \u0438\u0437 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e Pipedream, BadOmen, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b CVE-2022-34151 \u0434\u043b\u044f \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0441 HTTP-\u0441\u0435\u0440\u0432\u0435\u0440\u043e\u043c \u043d\u0430 \u0446\u0435\u043b\u0435\u0432\u044b\u0445 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0430\u0445 Omron NX/NJ. BadOmen \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u0439 \u0438 \u0432\u044b\u0437\u043e\u0432\u0430 \u0441\u0431\u043e\u0435\u0432 \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430\u0445.\n\n\u0412\u043e \u0432\u0440\u0435\u043c\u044f \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e BadOmen Dragos \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0430 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430\u0445 Omron. CISA \u0438 Omron \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0438 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0438, \u0438\u043d\u0444\u043e\u0440\u043c\u0438\u0440\u0443\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u043e \u043d\u043e\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u0438 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0439.\n\n\u0412 Dragos \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0438 \u0438\u0437\u0434\u0430\u043d\u0438\u044e SecurityWeek, \u0447\u0442\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043d\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c \u041f\u041e, \u0438 \u043d\u0435\u0442 \u0434\u043e\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432 \u0438\u0445 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438. CISA \u0438 Omron \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0442\u0440\u0438 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0438.\n\n\u041e\u0434\u043d\u0430 \u0438\u0437 \u043d\u0438\u0445 \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u044b\u0441\u043e\u043a\u043e\u0433\u043e \u0443\u0440\u043e\u0432\u043d\u044f \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 CVE-2022-45790 (CVSS: 7.5) \u0432 PLC Omron \u0441\u0435\u0440\u0438\u0439 CJ/CS/CP, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b FINS, \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u043d\u044b\u0439 \u0430\u0442\u0430\u043a\u0430\u043c \u043c\u0435\u0442\u043e\u0434\u043e\u043c \u043f\u0435\u0440\u0435\u0431\u043e\u0440\u0430 (\u0431\u0440\u0443\u0442\u0444\u043e\u0440\u0441).\n\u0414\u0432\u0435 \u0434\u0440\u0443\u0433\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0438 \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u044e\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u043c \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0438 Omron: CVE-2022-45793 (CVSS: 5.5) \u0438 CVE-2018-1002205 (CVSS: 5.5).\n\u041e\u0442\u043c\u0435\u0442\u0438\u043c, \u0447\u0442\u043e \u0430\u0433\u0435\u043d\u0442\u0441\u0442\u0432\u043e \u043f\u043e \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0437\u0430\u0449\u0438\u0442\u0435 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0421\u0428\u0410 (CISA) \u0434\u043e\u0431\u0430\u0432\u0438\u043b\u043e \u0432\u043e\u0441\u0435\u043c\u044c \u043d\u043e\u0432\u044b\u0445 \u043f\u0443\u043d\u043a\u0442\u043e\u0432 \u0432 \u0441\u0432\u043e\u0439 \u043a\u0430\u0442\u0430\u043b\u043e\u0433 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0445 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 . \u0420\u0435\u0448\u0435\u043d\u0438\u0435 \u043e \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0438\u0438 \u0431\u044b\u043b\u043e \u043f\u0440\u0438\u043d\u044f\u0442\u043e \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0430\u043d\u0438\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 \u043e\u0431 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u044d\u0442\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438.\n\n\u041c\u0438\u043d\u0438\u0441\u0442\u0435\u0440\u0441\u0442\u0432\u043e \u043d\u0430\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0421\u0428\u0410 (DHS) \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0438\u043b\u043e \u0443\u043f\u0440\u043e\u0441\u0442\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u0444\u0435\u0434\u0435\u0440\u0430\u043b\u044c\u043d\u043e\u0439 \u043e\u0442\u0447\u0451\u0442\u043d\u043e\u0441\u0442\u0438 \u043e \u043a\u0438\u0431\u0435\u0440\u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u0445 \u0434\u043b\u044f \u043f\u043e\u0441\u0442\u0440\u0430\u0434\u0430\u0432\u0448\u0438\u0445 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u043f\u0443\u0442\u0451\u043c \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0435\u0434\u0438\u043d\u043e\u0433\u043e \u0432\u0435\u0431-\u043f\u043e\u0440\u0442\u0430\u043b\u0430 \u0434\u043b\u044f \u0442\u0430\u043a\u0438\u0445 \u043e\u0442\u0447\u0451\u0442\u043e\u0432.\n\n\ud83d\udd14 ITsec NEWS", "creation_timestamp": "2023-09-23T17:42:16.000000Z"} {"uuid": "b903f23b-bdd9-48a7-956c-74dbd3953b3a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34151", "type": "seen", "source": "https://t.me/itsec_news/3280", "content": "\u200b\u26a1\ufe0f\u041d\u043e\u0432\u044b\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b: Omron \u0431\u043e\u0440\u0435\u0442\u0441\u044f \u0441\u043e \u0441\u043b\u043e\u0436\u043d\u044b\u043c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c \u041f\u041e.\n\n\ud83d\udcac\u042f\u043f\u043e\u043d\u0441\u043a\u0430\u044f \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Omron \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0438\u0440\u0443\u0435\u043c\u043e\u043c \u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u043e\u043c \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0435 (\u041f\u041b\u041a, PLC) \u0438 \u0438\u043d\u0436\u0435\u043d\u0435\u0440\u043d\u043e\u043c \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u043c \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0438, \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0445 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 \u043f\u043e \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Dragos \u0432\u043e \u0432\u0440\u0435\u043c\u044f \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u043b\u043e\u0436\u043d\u043e\u0433\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e.\n\n\u0412 \u043f\u0440\u043e\u0448\u043b\u043e\u043c \u0433\u043e\u0434\u0443 \u0430\u043c\u0435\u0440\u0438\u043a\u0430\u043d\u0441\u043a\u043e\u0435 \u0430\u0433\u0435\u043d\u0442\u0441\u0442\u0432\u043e \u043f\u043e \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 CISA \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u043e \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u043e \u0442\u0440\u0435\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 , \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0438\u0445 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u044b Omron \u0441\u0435\u0440\u0438\u0439 NJ \u0438 NX. Dragos \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0430, \u0447\u0442\u043e \u043e\u0434\u043d\u0430 \u0438\u0437 \u044d\u0442\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u2013 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 CVE-2022-34151, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u0436\u0451\u0441\u0442\u043a\u043e \u0437\u0430\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c\u0438 \u0443\u0447\u0435\u0442\u043d\u044b\u043c\u0438 \u0434\u0430\u043d\u043d\u044b\u043c\u0438, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0430\u0441\u044c \u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a PLC Omron \u0438 \u0441\u0442\u0430\u043b\u0430 \u0446\u0435\u043b\u044c\u044e \u0430\u0442\u0430\u043a \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u043f\u0440\u043e\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f (ICS) \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c Pipedream (Incontroller).\n\nDragos \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u043b\u0430, \u0447\u0442\u043e \u043e\u0434\u0438\u043d \u0438\u0437 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e Pipedream, BadOmen, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b CVE-2022-34151 \u0434\u043b\u044f \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0441 HTTP-\u0441\u0435\u0440\u0432\u0435\u0440\u043e\u043c \u043d\u0430 \u0446\u0435\u043b\u0435\u0432\u044b\u0445 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0430\u0445 Omron NX/NJ. BadOmen \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u0439 \u0438 \u0432\u044b\u0437\u043e\u0432\u0430 \u0441\u0431\u043e\u0435\u0432 \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430\u0445.\n\n\u0412\u043e \u0432\u0440\u0435\u043c\u044f \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e BadOmen Dragos \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0430 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430\u0445 Omron. CISA \u0438 Omron \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0438 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0438, \u0438\u043d\u0444\u043e\u0440\u043c\u0438\u0440\u0443\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u043e \u043d\u043e\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u0438 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0439.\n\n\u0412 Dragos \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0438 \u0438\u0437\u0434\u0430\u043d\u0438\u044e SecurityWeek, \u0447\u0442\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043d\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c \u041f\u041e, \u0438 \u043d\u0435\u0442 \u0434\u043e\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432 \u0438\u0445 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438. CISA \u0438 Omron \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0442\u0440\u0438 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0438.\n\n\u041e\u0434\u043d\u0430 \u0438\u0437 \u043d\u0438\u0445 \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u044b\u0441\u043e\u043a\u043e\u0433\u043e \u0443\u0440\u043e\u0432\u043d\u044f \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 CVE-2022-45790 (CVSS: 7.5) \u0432 PLC Omron \u0441\u0435\u0440\u0438\u0439 CJ/CS/CP, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b FINS, \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u043d\u044b\u0439 \u0430\u0442\u0430\u043a\u0430\u043c \u043c\u0435\u0442\u043e\u0434\u043e\u043c \u043f\u0435\u0440\u0435\u0431\u043e\u0440\u0430 (\u0431\u0440\u0443\u0442\u0444\u043e\u0440\u0441).\n\u0414\u0432\u0435 \u0434\u0440\u0443\u0433\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0438 \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u044e\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u043c \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0438 Omron: CVE-2022-45793 (CVSS: 5.5) \u0438 CVE-2018-1002205 (CVSS: 5.5).\n\u041e\u0442\u043c\u0435\u0442\u0438\u043c, \u0447\u0442\u043e \u0430\u0433\u0435\u043d\u0442\u0441\u0442\u0432\u043e \u043f\u043e \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0437\u0430\u0449\u0438\u0442\u0435 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0421\u0428\u0410 (CISA) \u0434\u043e\u0431\u0430\u0432\u0438\u043b\u043e \u0432\u043e\u0441\u0435\u043c\u044c \u043d\u043e\u0432\u044b\u0445 \u043f\u0443\u043d\u043a\u0442\u043e\u0432 \u0432 \u0441\u0432\u043e\u0439 \u043a\u0430\u0442\u0430\u043b\u043e\u0433 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0445 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 . \u0420\u0435\u0448\u0435\u043d\u0438\u0435 \u043e \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0438\u0438 \u0431\u044b\u043b\u043e \u043f\u0440\u0438\u043d\u044f\u0442\u043e \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0430\u043d\u0438\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 \u043e\u0431 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u044d\u0442\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438.\n\n\u041c\u0438\u043d\u0438\u0441\u0442\u0435\u0440\u0441\u0442\u0432\u043e \u043d\u0430\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0421\u0428\u0410 (DHS) \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0438\u043b\u043e \u0443\u043f\u0440\u043e\u0441\u0442\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u0444\u0435\u0434\u0435\u0440\u0430\u043b\u044c\u043d\u043e\u0439 \u043e\u0442\u0447\u0451\u0442\u043d\u043e\u0441\u0442\u0438 \u043e \u043a\u0438\u0431\u0435\u0440\u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u0445 \u0434\u043b\u044f \u043f\u043e\u0441\u0442\u0440\u0430\u0434\u0430\u0432\u0448\u0438\u0445 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u043f\u0443\u0442\u0451\u043c \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0435\u0434\u0438\u043d\u043e\u0433\u043e \u0432\u0435\u0431-\u043f\u043e\u0440\u0442\u0430\u043b\u0430 \u0434\u043b\u044f \u0442\u0430\u043a\u0438\u0445 \u043e\u0442\u0447\u0451\u0442\u043e\u0432.\n\n\ud83d\udd14 ITsec NEWS", "creation_timestamp": "2023-09-23T17:42:16.000000Z"} https://vulnerability.circl.lu/sighting/b903f23b-bdd9-48a7-956c-74dbd3953b3a/export Sat, 23 Sep 2023 17:42:16 +0000 https://vulnerability.circl.lu/sighting/c2d8b019-99b9-40a9-aa93-754b2c7fe5ac/export {"uuid": "c2d8b019-99b9-40a9-aa93-754b2c7fe5ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34155", "type": "seen", "source": "https://t.me/cibsecurity/66911", "content": "\u203c CVE-2022-34155 \u203c\n\nImproper Authentication vulnerability in miniOrange OAuth Single Sign On \u00e2\u20ac\u201c SSO (OAuth Client) plugin allows Authentication Bypass.This issue affects OAuth Single Sign On \u00e2\u20ac\u201c SSO (OAuth Client): from n/a through 6.23.3.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-07-18T18:32:46.000000Z"} {"uuid": "c2d8b019-99b9-40a9-aa93-754b2c7fe5ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34155", "type": "seen", "source": "https://t.me/cibsecurity/66911", "content": "\u203c CVE-2022-34155 \u203c\n\nImproper Authentication vulnerability in miniOrange OAuth Single Sign On \u00e2\u20ac\u201c SSO (OAuth Client) plugin allows Authentication Bypass.This issue affects OAuth Single Sign On \u00e2\u20ac\u201c SSO (OAuth Client): from n/a through 6.23.3.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-07-18T18:32:46.000000Z"} https://vulnerability.circl.lu/sighting/c2d8b019-99b9-40a9-aa93-754b2c7fe5ac/export Tue, 18 Jul 2023 18:32:46 +0000 https://vulnerability.circl.lu/sighting/c0e7244b-7d03-49bf-a119-1d38a43108e2/export {"uuid": "c0e7244b-7d03-49bf-a119-1d38a43108e2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34158", "type": "seen", "source": "https://t.me/cibsecurity/47539", "content": "\u203c CVE-2022-34158 \u203c\n\nA carefully crafted invocation on the Image plugin could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow a group privilege escalation of the attacker's account. Further examination of this issue established that it could also be used to modify the email associated with the attacked account, and then a reset password request from the login page.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-08-04T12:19:30.000000Z"} {"uuid": "c0e7244b-7d03-49bf-a119-1d38a43108e2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34158", "type": "seen", "source": "https://t.me/cibsecurity/47539", "content": "\u203c CVE-2022-34158 \u203c\n\nA carefully crafted invocation on the Image plugin could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow a group privilege escalation of the attacker's account. Further examination of this issue established that it could also be used to modify the email associated with the attacked account, and then a reset password request from the login page.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-08-04T12:19:30.000000Z"} https://vulnerability.circl.lu/sighting/c0e7244b-7d03-49bf-a119-1d38a43108e2/export Thu, 04 Aug 2022 12:19:30 +0000