{"vulnerability": "CVE-2022-22629", "sightings": [{"uuid": "1ad94a8d-54f8-4bc5-a4cd-3c6c0b296c86", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-22629", "type": "published-proof-of-concept", "source": "https://t.me/arvin_club/5775", "content": "CVE-2022-22629 Proof of Concept\nhttps://github.com/parsdefense/CVE-2022-22629", "creation_timestamp": "2022-09-11T08:55:45.000000Z"}, {"uuid": "6d05899d-022e-40f7-a2cc-e67d82279d4a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-22629", "type": "published-proof-of-concept", "source": "https://t.me/dilagrafie/2759", "content": "#Tools -\u00a0 \ud835\udddb\ud835\uddee\ud835\uddf0\ud835\uddf8\ud835\uddf2\ud835\uddff\ud835\ude00 \ud835\uddd9\ud835\uddee\ud835\uddf0\ud835\ude01\ud835\uddfc\ud835\uddff\ud835\ude06\n\nTracer\n\nFeatures:\n\u25ab\ufe0f 170+ sites that are checked\n\u25ab\ufe0f Filter websites based on their domain or category\n\u25ab\ufe0f Limit the pool of sites that will be checked\n\u25ab\ufe0f Save the result of each check in a report file\n\u25ab\ufe0f Open successful results in your browser\n\u25ab\ufe0f Customizability:\n\u25ab\ufe0f Use the included config file to change the behavior of Tracer\n\u25ab\ufe0f Easy to use\n\nhttps://github.com/chr3st5an/tracer\n\n\u200b\u200bxsser\n\nCross Site \"Scripter\" (aka XSSer) is an automatic -framework- to detect, exploit and report XSS vulnerabilities in web-based applications.\n\nIt provides several options to try to bypass certain filters and various special techniques for code injection.\n\nXSSer has pre-installed [ > 1300 XSS ] attacking vectors and can bypass-exploit code on several browsers/WAFs:\n\n\u25ab\ufe0f PHP-IDS\n\u25ab\ufe0f Imperva Incapsula WAF\n\u25ab\ufe0f WebKnight WAF\n\u25ab\ufe0f F5 Big IP WAF\n\u25ab\ufe0f Barracuda WAF\n\u25ab\ufe0f Mod-Security\n\u25ab\ufe0f QuickDefense\n\u25ab\ufe0f SucuriWAF \n\u25ab\ufe0f Google Chrome\n\u25ab\ufe0f Internet Explorer\n\u25ab\ufe0f Mozilla's Gecko rendering engine, used by Firefox/Iceweasel\n\u25ab\ufe0f Netscape in IE rendering engine mode\n\u25ab\ufe0f Netscape in the Gecko rendering engine mode\n\u25ab\ufe0f Opera Browser\n\nhttps://github.com/epsylon/xsser\n\nWebsite:\nhttps://xsser.03c8.net/\n\n\u200b\u200bOpenWRTInvasion\n\nRoot shell exploit for several Xiaomi routers: 4A Gigabit, 4A 100M, 4C, 3Gv2, 4Q, miWifi 3C...\n\nhttps://github.com/acecilia/OpenWRTInvasion\n\n\u200b\u200bMitra\n\nA tool to generate binary polyglots (files that are valid with several file formats).\n\nhttps://github.com/corkami/mitra\n\n\u200b\u200bCVE-2022-20126\n\nhttps://github.com/Trinadh465/packages_apps_Bluetooth_AOSP10_r33_CVE-2022-20126\n\n\u200b\u200bModules\n\nOpen sourced the \"assembly execute\" and \"powerpick\" module/command. Have fun.\n\nhttps://github.com/HavocFramework/Modules\n\n\u200b\u200bMinimalistic TCP and UDP port scanners\n\nA simple yet powerful TCP and UDP port scanners:\n\n\u25ab\ufe0f Detection of open, closed and filtered ports (both TCP and UDP)\n\u25ab\ufe0f Ability to scan a single host, network range or a list of hosts in a file\n\u25ab\ufe0f Adjustable timeout values for effective and reliable port scanning\n\nDespite the minimalistic design, both port scanners keep track of everything by using a simple state file (scanresults.txt) which is created in the current working directory. \n\nhttps://github.com/InfosecMatter/Minimalistic-offensive-security-tools\n\nDetails:\nhttps://www.infosecmatter.com/port-scanner-in-powershell-tcp-udp-ps1/\n\n\u200b\u200bontgo403\n\nA tool to bypass 40X errors.\n\nhttps://github.com/devploit/dontgo403\n\n\u200b\u200bCVE-2022-31188\n\nOpenCV CVAT (Computer Vision Annotation Tool) SSRF.\n\nCVAT is an open source Computer Vision Annotation Tool developed by Intel. Any user with \"Task Create\" authorization can trigger the SSRF vulnerability by sending a malicious HTTP request and gaining access to other open ports on the system.\n\nhttps://github.com/emirpolatt/CVE-2022-31188\n\n#cve\n\n\u200b\u200bRUST_SYSCALLS\n\nSingle stub direct and indirect syscalling with runtime SSN resolving for windows.\n\nFeatures:\n\u25ab\ufe0f One single line for all your syscalls\n\u25ab\ufe0f Function name hashing at compilation time\n\u25ab\ufe0f Direct or indirect sycalls\n\u25ab\ufe0f x86_64, WOW64 and x86 native support\n\u25ab\ufe0f Designed to allow the implementation of custom SSN fetching methods (check the end of this readme for more info)\n\nhttps://github.com/janoglezcampos/rust_syscalls\n\n\u200b\u200bCVE-2022-22629 Proof of concept\n\nThis post is about the poc for the WebGL bug that was patched in Safari 15.4 security updates.\n\nhttps://github.com/parsdefense/CVE-2022-22629\n\n#cve\n\n\u200b\u200bTcbElevation.cpp\n\nWe are releasing an alternative way for elevating to SYSTEM when you have SeTcbPrivilege\n\nHow?\n\nLeveraging AcquireCredentialsHandle through an SSPI hook that allows authenticating as SYSTEM to SCM\n\nShould be \"lighter\" than the classic S4U\n\nhttps://gist.github.com/antonioCoco/19563adef860614b56d010d92e67d178\n\n\u200b\u200bJava-Deserialization-Cheat-Sheet\n\nA cheat sheet for pentesters and researchers about deserialization vulnerabilities in various Java (JVM) serialization libraries.\n\nhttps://github.com/GrrrDog/Java-Deserialization-Cheat-Sheet\n\nJoin:\nhttps://t.me/dilagrafie\nhttps://t.me/HackerFactory\n\nWebsite:\nwww.ghostclan.org", "creation_timestamp": "2023-03-29T08:59:52.000000Z"}, {"uuid": "e2c65565-5a2e-4f46-99c3-127e1b8487ca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-22629", "type": "published-proof-of-concept", "source": "Telegram/nUu6bdD35eBCxzDPvI2Ltb8fqDe0eXWzvX_9jQw8cM__DZ0", "content": "", "creation_timestamp": "2022-09-10T07:58:18.000000Z"}, {"uuid": "ade6591f-705c-4eae-b6d6-93fc46fee0d3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-22629", "type": "published-proof-of-concept", "source": "https://t.me/proxy_bar/971", "content": "CVE-2022-22629\nMacOS: Big Sug, Catalina\n\u0421\u043f\u043b\u043e\u0438\u0442 \u043f\u043e\u0434 \u0421\u0430\u0444\u0430\u0440\u0438, \u043f\u0430\u0442\u0447 \u0443\u0436\u0435 \u0435\u0441\u0442\u044c \u0432 \u0432\u0435\u0440\u0441\u0438\u0438 Safari 15.4 (\u043d\u043e \u0432\u0440\u0435\u043c\u044f \u0435\u0449\u0435 \u0435\u0441\u0442\u044c)))\n\n#exploit #macos #safari", "creation_timestamp": "2022-09-10T07:25:33.000000Z"}, {"uuid": "bb0e8e7c-9028-4508-b76a-a59fdab37009", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-22629", "type": "seen", "source": "https://t.me/cibsecurity/50423", "content": "\u203c CVE-2022-22629 \u203c\n\nA buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.3, Safari 15.4, watchOS 8.5, iTunes 12.12.3 for Windows, iOS 15.4 and iPadOS 15.4, tvOS 15.4. Processing maliciously crafted web content may lead to arbitrary code execution.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-09-24T00:13:41.000000Z"}, {"uuid": "c843700c-e3b5-4880-8216-8cef302a1359", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-22629", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/6778", "content": "#exploit\n1. CVE-2022-22629:\nWebGL bug in Safari <15.4\nhttps://github.com/parsdefense/CVE-2022-22629\n\n2. CVE-2022-20128:\nAndroid Debug Bridge - directory traversal\nhttps://github.com/irsl/CVE-2022-20128\n\n3. CVE-2022-20360:\nAndroid setChecked LPE\nhttps://github.com/nidhi7598/packages_apps_Settings_AOSP_10_r33_CVE-2022-20360", "creation_timestamp": "2022-09-11T20:20:47.000000Z"}]}