CVE-2022-3427

A use of hard-coded cryptographic key vulnerability in Johnson Controls EasyIO FS32 allows retrieval of embedded sensitive data. This issue affects EasyIO FS32 versions before 3.0b63.

This vulnerability enables unauthenticated remote code execution (RCE) on a victim's machine by exploiting a combination of cryptographic weaknesses and memory management issues in the SConnect native host component. The attack leverages an unrestricted messaging interface between an attacker-controlled web page and the native host, allowing malicious input to bypass security checks.

A flaw in Foreman allows an authenticated user with low-level Viewer permissions to cause unauthorized information disclosure by submitting requests to template preview endpoints. The user can access sensitive data such as host root passwords. Under insecure configurations with Safemode disabled, the flaw may also allow arbitrary command execution as the Foreman system account.

A flaw in Foreman allows an authenticated attacker with low-level permissions to achieve remote code execution (RCE) by bypassing the Safemode sandbox within the templating engine. Due to improper handling of delegated methods, the attacker can append unauthorized functions to the allowed execution list, enabling arbitrary command execution on the hosting server.

In Apache HTTP Server's mod_ssl from 2.4.0 through 2.4.68, improper privilege management via SSLRequire and file-related expressions may lead to unauthorized access.

In Apache HTTP Server's mod_http2 from 2.4.0 through 2.4.68, a Use After Free vulnerability exists via shared session->bbtmp re-entrancy.

In Apache HTTP Server's mod_rewrite from 2.4.0 through 2.4.68, a Use After Free vulnerability exists when using lookahead (%{LA-U:HTTP:...}).

The Kernel Memory Access Driver (PSKMAD) used by WatchGuard endpoint security products does not properly enforce authentication. A local, authenticated attacker can bypass the driver's access-control handshake and issue arbitrary privileged commands to the driver, resulting in disclosure of kernel and process memory.

Classroom 50 prior to version 1.11.0, when running `gh teacher download`, clones each student's assignment repository and then writes autograde artifacts (`result.json` and `results.json`) into the just-cloned working tree. The write followed symlinks, so a student who committed `result.json` or `results.json` as a symlink could redirect the teacher's write to an arbitrary path (e.g. `~/.zshrc`, `~/.ssh/authorized_keys`, a cron file, or an in-clone `.git/hooks/*` file), with attacker-controlled bytes. This is an arbitrary file write leading to code execution as the teacher, whose `gh` token carries `admin:org`, `repo`, and `workflow` across the entire classroom organization.