Category Archives: Advisories

ZDI-22-1460: SolarWinds Network Performance Monitor PropertyBagJsonConverter Deserialization of Untrusted Data Remote Code Execution Vulnerability

October 21, 2022

Read Time:7 Second

This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Network Performance Monitor. Authentication is required to exploit this vulnerability.

Advisories

ZDI-22-1459: SolarWinds Network Performance Monitor DeserializeFromStrippedXml Deserialization of Untrusted Data Remote Code Execution Vulnerability

October 21, 2022

Read Time:7 Second

This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Network Performance Monitor. Authentication is required to exploit this vulnerability.

Advisories

ZDI-22-1458: GNU Gzip zgrep Argument Injection Remote Code Execution Vulnerability

October 21, 2022

Read Time:10 Second

This vulnerability allows remote attackers to execute arbitrary code on affected installations of GNU Gzip. Interaction with this script is required to exploit this vulnerability but attack vectors may vary depending on the implementation.

Advisories

ZDI-22-1457: Linux Kernel nftables Uninitialized Variable Information Disclosure Vulnerability

October 21, 2022

Read Time:12 Second

This vulnerability allows local attackers to disclose sensitive information on affected installations of the Linux Kernel. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability.

Advisories

ZDI-22-1456: LibreOffice Exposed Dangerous Function Remote Code Execution Vulnerability

October 21, 2022

Read Time:11 Second

This vulnerability allows remote attackers to execute arbitrary code on affected installations of LibreOffice. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

Advisories

ZDI-22-1455: (Pwn2Own) Kepware KEPServerEX Stack-based Buffer Overflow Remote Code Execution Vulnerability

October 21, 2022

Read Time:7 Second

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kepware KEPServerEX. Authentication is not required to exploit this vulnerability.

Advisories

ZDI-22-1454: (Pwn2Own) Kepware KEPServerEX Heap-based Buffer Overflow Remote Code Execution Vulnerability

October 21, 2022

Read Time:7 Second

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kepware KEPServerEX. Authentication is not required to exploit this vulnerability.

Advisories

ZDI-22-1453: Delta Industrial Automation DIAEnergie Use Of Hard-Coded Credentials Authentication Bypass Vulnerability

October 21, 2022

Read Time:7 Second

This vulnerability allows remote attackers to bypass authentication on affected installations of Delta Industrial Automation DIAEnergie. Authentication is not required to exploit this vulnerability.

Advisories