{"vulnerability": "cve-2022-3088", "sightings": [{"uuid": "eaf9cedb-383c-49cf-8d47-f76c8c76294d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-30882", "type": "seen", "source": "https://t.me/itsec_news/819", "content": "\u200b\u26d4\ufe0f \u041f\u0430\u043a\u0435\u0442\u044b PyPI \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0442 \u0431\u044d\u043a\u0434\u043e\u0440.\n\n\ud83d\udcac \u041f\u0430\u043a\u0435\u0442\u044b PyPI \u00abkeep\u00bb, \u00abpyanxdns\u00bb, \u00abapi-res-py\u00bb \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0442 \u0431\u044d\u043a\u0434\u043e\u0440 \u0438\u0437-\u0437\u0430 \u043d\u0430\u043b\u0438\u0447\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0439 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438 \u00abrequest\u00bb.\n\n\u0411\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u0432\u0435\u0440\u0441\u0438\u0439 \u043f\u0430\u043a\u0435\u0442\u0430 \u00abkeep\u00bb \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0437\u0430\u043f\u0440\u043e\u0441\u044b (requests) Python \u043c\u043e\u0434\u0443\u043b\u044f \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f HTTP-\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432, \u043f\u0430\u043a\u0435\u0442 \u00abkeep\u00bb v.1.2 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442 \u00abrequest\u00bb (\u0431\u0435\u0437 s ), \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c \u041f\u041e. \u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0430\u044f \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u044c \u00abrequest\u00bb \u0442\u0430\u043a\u0436\u0435 \u0431\u044b\u043b\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u0432 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 PyPI-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u00abpyanxdns\u00bb \u0438 \u00abapi-res-py\u00bb.\n\n\u0412 \u043c\u0430\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c GitHub duxinglin1 \u0437\u0430\u043c\u0435\u0442\u0438\u043b, \u0447\u0442\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0442 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u044c \u00abrequest\u00bb \u0441 \u043e\u0448\u0438\u0431\u043a\u043e\u0439, \u0430 \u043d\u0435 \u0437\u0430\u043a\u043e\u043d\u043d\u0443\u044e \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0443 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 (requests).\n\n\u0411\u044b\u043b\u0438 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438:\n\n\u2014 CVE-2022-30877 \u2014 \u043f\u0430\u043a\u0435\u0442 \u00abkeep\u00bb \u0432\u0435\u0440\u0441\u0438\u0438 1.2 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442 \u00ab\u0437\u0430\u043f\u0440\u043e\u0441\u00bb \u0431\u044d\u043a\u0434\u043e\u0440\u0430;\n\u2014 CVE-2022-30882 \u2014 \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442 \u043f\u0430\u043a\u0435\u0442 \u00abpyanxdns\u00bb \u0432\u0435\u0440\u0441\u0438\u0438 0.2;\n\u2014 CVE-2022-31313 \u2014 \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442 \u043f\u0430\u043a\u0435\u0442 \u00abapi-res-py\u00bb \u0432\u0435\u0440\u0441\u0438\u0438 0.1.\n\n\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a \u043f\u0430\u043a\u0435\u0442\u0430 \u00abpyanxdns\u00bb \u041c\u0430\u0440\u043a \u042d\u0433\u0435\u0431\u0435\u043a \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0434\u0438\u043b, \u0447\u0442\u043e \u0441\u0438\u0442\u0443\u0430\u0446\u0438\u044f \u043f\u0440\u043e\u0438\u0437\u043e\u0448\u043b\u0430 \u0438\u0437-\u0437\u0430 \u043e\u043f\u0435\u0447\u0430\u0442\u043a\u0438, \u0430 \u043d\u0435 \u0438\u0437-\u0437\u0430 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0443\u0447\u0435\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438. \u0412\u0438\u0434\u0438\u043c\u043e, \u0430\u0432\u0442\u043e\u0440\u044b \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u00abkeep\u00bb \u0438 \u00abapi-res-py\u00bb \u0442\u0430\u043a\u0436\u0435 \u0441\u043b\u0443\u0447\u0430\u0439\u043d\u043e \u0432\u0432\u0435\u043b\u0438 \u00abrequest\u00bb \u0432\u043c\u0435\u0441\u0442\u043e \u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u043e\u0433\u043e \u00abrequests\u00bb \u0438\u0437-\u0437\u0430 \u043e\u043f\u0435\u0447\u0430\u0442\u043a\u0438. \u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a \u043f\u043e\u0432\u0442\u043e\u0440\u043d\u043e \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u043b \u043d\u043e\u0432\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e \u0432 PyPI \u0438 \u0443\u0434\u0430\u043b\u0438\u043b \u0432\u0435\u0440\u0441\u0438\u044e, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0441\u0441\u044b\u043b\u0430\u0435\u0442\u0441\u044f \u043d\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0443\u044e \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u044c \u00abrequest\u00bb.\n\n#PyPi #\u0411\u044d\u043a\u0434\u043e\u0440\n\n\ud83d\udd14 ITsec NEWS", "creation_timestamp": "2022-06-13T17:50:52.000000Z"}, {"uuid": "991c88d4-5c8d-4d1f-9c78-535e6f4ace40", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-30882", "type": "seen", "source": "https://t.me/true_secator/3055", "content": "\u041b\u043e\u0432\u043a\u0438\u0439 \u043f\u0440\u0438\u0435\u043c \u043f\u0440\u043e\u0432\u0435\u0440\u043d\u0443\u043b\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0441 \u043f\u0430\u043a\u0435\u0442\u0430\u043c\u0438 PyPI keep, pyanxdns \u0438 api-res-py, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e\u043c \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u0446\u0435\u043f\u043e\u0447\u043a\u0443 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043f\u0440\u0438\u0441\u0442\u0440\u043e\u0438\u043b\u0438 \u0431\u044d\u043a\u0434\u043e\u0440. \u041f\u0440\u0438\u0447\u0435\u043c \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0430\u0444\u0435\u0440\u0443 \u0431\u0435\u0437 \u043e\u0441\u043e\u0431\u044b\u0445 \u0443\u0441\u0438\u043b\u0438\u0439, \u0430\u0432\u0442\u043e\u0440\u044b \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0441\u0430\u043c\u0438 \u043f\u043e\u043f\u0430\u043b\u0438\u0441\u044c \u0438\u0437-\u0437\u0430 \u0431\u0430\u043d\u0430\u043b\u044c\u043d\u043e\u0439 \u043e\u043f\u0435\u0447\u0430\u0442\u043a\u0438 \u0432\u00a0setup.py. \n\n\u041b\u0430\u0437\u0435\u0439\u043a\u0430 \u043d\u0430\u0448\u043b\u0430\u0441\u044c \u0432\u043e \u0432\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u043e\u043c \u0432 \u043a\u043e\u0434 \u043c\u043e\u0434\u0443\u043b\u0435 Python \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f HTTP-\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432. \u041e\u0440\u0438\u0433\u0438\u043d\u0430\u043b\u044c\u043d\u044b\u0439 \u0437\u0430\u043f\u0440\u043e\u0441\u00a0requests \u0431\u044b\u043b \u0438\u0437\u043c\u0435\u043d\u0435\u043d \u0432 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0445 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u043d\u0430 equest (\u0431\u0435\u0437\u00a0s), \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c \u041f\u041e. \u0411\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u0432\u043e\u0441\u0442\u0440\u0435\u0431\u043e\u0432\u0430\u043d\u044b \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430\u043c\u0438, \u0432 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438,\u00a0\u043f\u0430\u043a\u0435\u0442 keep \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u0442\u0441\u044f \u0432 \u0441\u0440\u0435\u0434\u043d\u0435\u043c \u0431\u043e\u043b\u0435\u0435 8000 \u0440\u0430\u0437\u00a0\u0432 \u043d\u0435\u0434\u0435\u043b\u044e.\n\n\u041f\u043e\u0434\u043c\u0435\u043d\u0430 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u0431\u044b\u043b\u0430 \u0437\u0430\u043c\u0435\u0447\u0435\u043d\u0430 \u043c\u0430\u0435 GitHub-\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c duxinglin1. \u0412\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c \u0431\u044b\u043b\u0438 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d\u044b: CVE-2022-30877\u00a0(\u0434\u043b\u044f keep \u0432\u0435\u0440\u0441\u0438\u0438 1.2), CVE-2022-30882\u00a0 (\u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u0430 \u0432\u0435\u0440\u0441\u0438\u044f 0.2 \u043f\u0430\u043a\u0435\u0442\u0430 pyanxdns), CVE-2022-31313\u00a0(\u0443\u044f\u0437\u0432\u0438\u043c\u0430\u044f \u0432\u0435\u0440\u0441\u0438\u044f 0.1 \u043f\u0430\u043a\u0435\u0442\u0430 api-res-py). \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0434\u0430\u0436\u0435 \u0435\u0441\u043b\u0438 \u043f\u0430\u043a\u0435\u0442 \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u0431\u044b\u043b \u0443\u0434\u0430\u043b\u0435\u043d PyPI, \u043c\u043d\u043e\u0433\u0438\u0435 \u0437\u0435\u0440\u043a\u0430\u043b\u044c\u043d\u044b\u0435 \u0441\u0430\u0439\u0442\u044b \u043d\u0435 \u0443\u0434\u0430\u043b\u0438\u043b\u0438 \u044d\u0442\u043e\u0442 \u043f\u0430\u043a\u0435\u0442 \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u0435\u0433\u043e \u0432\u0441\u0435 \u0435\u0449\u0435 \u043c\u043e\u0436\u043d\u043e \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c.\n\n\u0421\u0442\u0440\u043e\u043a\u0430 57 \u043a\u043e\u0434\u0430 \u043f\u043e\u0434\u0434\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u00ab\u0437\u0430\u043f\u0440\u043e\u0441\u0430\u00bb \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442 URL-\u0430\u0434\u0440\u0435\u0441 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e check.so \u0432 \u043a\u043e\u0434\u0438\u0440\u043e\u0432\u043a\u0435 base64.\u00a0\u0410\u043d\u0430\u043b\u0438\u0442\u0438\u043a\u0438 Intel \u043f\u043e\u00a0\u0443\u0433\u0440\u043e\u0437\u0430\u043c Blackorbird\u00a0\u0442\u0430\u043a\u0436\u0435\u00a0\u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u043b\u00a0\u0438 \u0434\u0440\u0443\u0433\u0438\u0435 URL-\u0430\u0434\u0440\u0435\u0441\u0430, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0435 \u0441 request: http://dexy[.]top/request/check.so \u0438 http://dexy[.]top/x.pyx.\n\nCheck.so \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442 \u0442\u0440\u043e\u044f\u043d \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 (RAT), \u0432 \u0441\u0432\u043e\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c, x.pyx \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u0435\u0442 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u0434\u043b\u044f \u043a\u0440\u0430\u0436\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u043a\u0440\u0430\u0434\u0435\u0442 \u0444\u0430\u0439\u043b\u044b cookie \u0438 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u0443\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u0441 Chrome, Firefox, Yandex \u0438 Brave, \u043f\u043e\u0441\u043b\u0435 \u0447\u0435\u0433\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043f\u0435\u0440\u0435\u0445\u043e\u0434\u044f\u0442 \u043a \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0445 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u043c \u0430\u043a\u043a\u0430\u0443\u043d\u0442\u043e\u0432 \u0438 \u0443\u0447\u0451\u0442\u043e\u043a.\n\n\u041d\u0430 \u0441\u0430\u043c\u043e\u043c \u0434\u0435\u043b\u0435 \u0442\u0440\u044e\u043a \u0441 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u043e\u0439 \u043d\u0435 \u043d\u043e\u0432\u044b\u0439: \u0432 2020 \u0433\u043e\u0434\u0443 Tencent Onion\u00a0\u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439\u00a0\u0437\u0430\u043f\u0440\u043e\u0441 typosquat, \u0437\u0430\u0433\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0439 \u0432 PyPI, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0432\u044b\u0434\u0430\u0432\u0430\u043b \u0441\u0435\u0431\u044f \u0437\u0430 \u043b\u0435\u0433\u0430\u043b\u044c\u043d\u0443\u044e HTTP-\u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0443\u00a0\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432, \u043d\u043e \u0432\u043c\u0435\u0441\u0442\u043e \u044d\u0442\u043e\u0433\u043e \u0433\u0440\u0443\u0437\u0438\u043b \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u041f\u041e. \n\n\u041f\u043e \u0438\u0442\u043e\u0433\u0443, \u043e\u0448\u0438\u0431\u043a\u0438 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u044b, \u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430\u043c - \u043e\u0447\u0435\u0440\u0435\u0434\u043d\u043e\u0435 \u043d\u0430\u043f\u043e\u043c\u0438\u043d\u0430\u043d\u0438\u0435 \u043e \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0438 \u043f\u0435\u0440\u0435\u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0435\u0433\u043e \u043a\u043e\u0434\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0439, \u043a\u0430\u043a \u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442 \u0441\u0438\u0442\u0443\u0430\u0446\u0438\u044f, \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d \u043d\u0435\u043f\u0440\u0435\u0434\u043d\u0430\u043c\u0435\u0440\u0435\u043d\u043d\u043e \u0435\u0433\u043e \u0436\u0435 \u0430\u0432\u0442\u043e\u0440\u0430\u043c\u0438.", "creation_timestamp": "2022-06-14T14:45:55.000000Z"}, {"uuid": "7f651a9a-8de3-40e6-9197-262f0503c99f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-3088", "type": "seen", "source": "https://t.me/cibsecurity/53615", "content": "\u203c CVE-2022-3088 \u203c\n\nUC-8100A-ME-T System Image: Versions v1.0 to v1.6, UC-2100 System Image: Versions v1.0 to v1.12, UC-2100-W System Image: Versions v1.0 to v 1.12, UC-3100 System Image: Versions v1.0 to v1.6, UC-5100 System Image: Versions v1.0 to v1.4, UC-8100 System Image: Versions v3.0 to v3.5, UC-8100-ME-T System Image: Versions v3.0 and v3.1, UC-8100A-ME-T System Image: Versions v1.0 to v1.6, UC-8200 System Image: v1.0 to v1.5, AIG-300 System Image: v1.0 to v1.4, UC-8410A with Debian 9 System Image: Versions v4.0.2 and v4.1.2, UC-8580 with Debian 9 System Image: Versions v2.0 and v2.1, UC-8540 with Debian 9 System Image: Versions v2.0 and v2.1, and DA-662C-16-LX (GLB) System Image: Versions v1.0.2 to v1.1.2 of Moxa's ARM-based computers have an execution with unnecessary privileges vulnerability, which could allow an attacker with user-level privileges to gain root privileges.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-02-08T17:23:06.000000Z"}, {"uuid": "08d5ee36-ebcf-4fd8-8c4b-96ac63c5d151", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-30882", "type": "seen", "source": "https://t.me/cibsecurity/44062", "content": "\u203c CVE-2022-30882 \u203c\n\npyanxdns package in PyPI version 0.2 is vulnerable to code execution backdoor. The impact is: execute arbitrary code (remote). When installing the pyanxdns package of version 0.2, the request package will be installed.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-06-09T00:32:31.000000Z"}, {"uuid": "8b096b2c-d675-4231-89e9-241bda0c9107", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-30885", "type": "seen", "source": "https://t.me/cibsecurity/45133", "content": "\u203c CVE-2022-30885 \u203c\n\n** Reserved ** The pyesasky for python, as distributed on PyPI, included a code-execution backdoor inserted by a third party. The current version, without this backdoor, is 1.2.0-1.4.2.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-06-25T00:31:30.000000Z"}, {"uuid": "acbdea39-4f54-4083-b2fe-3fba31945c06", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-30887", "type": "seen", "source": "https://t.me/cibsecurity/43057", "content": "\u203c CVE-2022-30887 \u203c\n\nPharmacy Management System v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the component /php_action/editProductImage.php. This vulnerability allows attackers to execute arbitrary code via a crafted image file.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-05-20T16:36:52.000000Z"}, {"uuid": "a7e6af1e-4b97-41b5-860e-b72242d8a394", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-30886", "type": "seen", "source": "https://t.me/cibsecurity/43052", "content": "\u203c CVE-2022-30886 \u203c\n\nSchool Dormitory Management System v1.0 was discovered to contain a SQL injection vulnerability via the month parameter at /dms/admin/reports/daily_collection_report.php.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-05-20T16:36:44.000000Z"}, {"uuid": "68d8fcc3-c0ce-49c7-a555-622fd78544e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-30882", "type": "seen", "source": "https://t.me/hacking_Attack/57174", "content": "Black Hat Ethical Hacking\nPyPI package \u2018keep\u2019 mistakenly included a password stealer\n\nPyPI package \u2018keep\u2019 mistakenly included a password stealerPost Views: 54 \nPremium Content https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/Patreon-3.png Subscribe to Patreon to watch this episode.\nReading Time: 4 Minutes\nPyPI packages \u2018keep,\u2019 \u2018pyanxdns,\u2019 \u2018api-res-py\u2019 were found to\u00a0be containing\u00a0a\u00a0backdoor due to the presence of malicious \u2018request\u2019 dependency within some\u00a0versions.\nFor example, while most versions of \u2018keep\u2019 project\u00a0use the legitimate Python module requests\u00a0for making HTTP requests, \u2018keep\u2019 v.1.2 contains \u2018request\u2019 (without s) which is\u00a0malware.\n\nBleepingComputer reached out to the authors of each of these packages to understand if this was caused by a\u00a0mere typographical error,\u00a0\u00a0self-sabotage,\u00a0or by maintainer accounts getting hijacked. PyPI package \u2018keep\u2019 uses malicious \u2018request\u2019Some versions of PyPI packages, \u2018keep,\u2019\u00a0\u2018pyanxdns,\u2019 and \u2018api-res-py\u2019 were caught using a malicious dependency,\u00a0\u2018request,\u2019\n\nBack in May, GitHub user duxinglin1\u00a0noticed\u00a0the\u00a0vulnerable versions contained the misspelled\u00a0\u2018request\u2019 dependency, as opposed to the legitimate requests\u00a0library.\n\nAs such, the following CVEs have been assigned this week with regards to the vulnerable versions:\n\n* CVE-2022-30877\u00a0\u2013\u00a0\u2018keep\u2019\u00a0version 1.2 contains the backdoor \u2018request\u2019, contrary to what the advisory implies.\n* CVE-2022-30882\u00a0\u2013 \u2018pyanxdns\u2019 version 0.2 impacted\n* CVE-2022-31313\u00a0\u2013 \u2018api-res-py\u2019 version 0.1 impacted\n\nAlthough \u2018pyanxdns\u2019 and \u2018api-res-py\u2019 might be small scale projects,\u00a0\u00a0the \u2018keep\u2019 package, in particular, gets downloaded over\u00a08,000\u00a0times\u00a0in a week on average\u2014with its version 1.2 using the malicious dependency:\nhttps://www.bleepstatic.com/images/news/u/1164866/2022/jun-2022/pypi-request-keep-backdoor/pypi-keep-page.jpeg \n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:36.327302Z"}, {"uuid": "f38073ee-be57-42cc-96dd-629fc0e7c901", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-30882", "type": "seen", "source": "https://t.me/hacking_Attack/57174", "content": "Black Hat Ethical Hacking\nPyPI package \u2018keep\u2019 mistakenly included a password stealer\n\nPyPI package \u2018keep\u2019 mistakenly included a password stealerPost Views: 54 \nPremium Content https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/Patreon-3.png Subscribe to Patreon to watch this episode.\nReading Time: 4 Minutes\nPyPI packages \u2018keep,\u2019 \u2018pyanxdns,\u2019 \u2018api-res-py\u2019 were found to\u00a0be containing\u00a0a\u00a0backdoor due to the presence of malicious \u2018request\u2019 dependency within some\u00a0versions.\nFor example, while most versions of \u2018keep\u2019 project\u00a0use the legitimate Python module requests\u00a0for making HTTP requests, \u2018keep\u2019 v.1.2 contains \u2018request\u2019 (without s) which is\u00a0malware.\n\nBleepingComputer reached out to the authors of each of these packages to understand if this was caused by a\u00a0mere typographical error,\u00a0\u00a0self-sabotage,\u00a0or by maintainer accounts getting hijacked. PyPI package \u2018keep\u2019 uses malicious \u2018request\u2019Some versions of PyPI packages, \u2018keep,\u2019\u00a0\u2018pyanxdns,\u2019 and \u2018api-res-py\u2019 were caught using a malicious dependency,\u00a0\u2018request,\u2019\n\nBack in May, GitHub user duxinglin1\u00a0noticed\u00a0the\u00a0vulnerable versions contained the misspelled\u00a0\u2018request\u2019 dependency, as opposed to the legitimate requests\u00a0library.\n\nAs such, the following CVEs have been assigned this week with regards to the vulnerable versions:\n\n* CVE-2022-30877\u00a0\u2013\u00a0\u2018keep\u2019\u00a0version 1.2 contains the backdoor \u2018request\u2019, contrary to what the advisory implies.\n* CVE-2022-30882\u00a0\u2013 \u2018pyanxdns\u2019 version 0.2 impacted\n* CVE-2022-31313\u00a0\u2013 \u2018api-res-py\u2019 version 0.1 impacted\n\nAlthough \u2018pyanxdns\u2019 and \u2018api-res-py\u2019 might be small scale projects,\u00a0\u00a0the \u2018keep\u2019 package, in particular, gets downloaded over\u00a08,000\u00a0times\u00a0in a week on average\u2014with its version 1.2 using the malicious dependency:\nhttps://www.bleepstatic.com/images/news/u/1164866/2022/jun-2022/pypi-request-keep-backdoor/pypi-keep-page.jpeg \n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:01:46.872203Z"}]}