Vulnerability Disclosure

Microsoft Defender for Cloud Management Port Exposure Confusion

Multiple DMS XSS (CVE-2022-47412 through CVE-20222-47419)

CVE-2023-22374: F5 BIG-IP Format String Vulnerability

Refreshing Rapid7's Coordinated Vulnerability Disclosure Policy

Cengage LTI Session Management Leakage

CVE-2022-4261: Rapid7 Nexpose Update Validation Issue (FIXED)

CVE-2022-41622 and CVE-2022-41800 (FIXED): F5 BIG-IP and iControl REST Vulnerabilities and Exposures

FLEXlm and Citrix ADM Denial of Service Vulnerability

Baxter SIGMA Spectrum Infusion Pumps: Multiple Vulnerabilities (FIXED)

Rapid7 Discovered Vulnerabilities in Cisco ASA, ASDM, and FirePOWER Services Software

CVE-2022-31660 and CVE-2022-31661 (FIXED): VMware Workspace ONE Access, Identity Manager, and vRealize Automation LPE

Spencer McIntyre

QNAP Poisoned XML Command Injection (Silently Patched)

Primary Arms PII Disclosure via IDOR (FIXED)

CVE-2022-35629..35632 Velociraptor Multiple Vulnerabilities (FIXED)

CVE-2022-30526 (Fixed): Zyxel Firewall Local Privilege Escalation

CVE-2021-3779: Ruby-MySQL Gem Client File Read (FIXED)

CVE-2022-31749: WatchGuard Authenticated Arbitrary File Read/Write (Fixed)

CVE-2022-32230: Windows SMB Denial-of-Service Vulnerability (FIXED)

Spencer McIntyre

CVE-2022-22977: VMware Guest Authentication Service LPE (FIXED)

CVE-2022-30525 (FIXED): Zyxel Firewall Unauthenticated Remote Command Injection

CVE-2022-28810: ManageEngine ADSelfService Plus Authenticated Command Execution (Fixed)