{"vulnerability": "cve-2022-4249", "sightings": [{"uuid": "02744804-0b04-4d4d-a043-b84f9a27fedf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2022-42490", "type": "seen", "source": "https://t.me/cibsecurity/56981", "content": "\u203c CVE-2022-42490 \u203c\n\nSeveral OS command injection vulnerabilities exist in the m2m binary of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafted network request can lead to arbitrary command execution. An attacker can send a network request to trigger these vulnerabilities.This command injection is reachable through the m2m's DOWNLOAD_CFG_FILE command\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-01-27T00:43:51.000000Z"}, {"uuid": "0d68382e-5851-4831-9f5d-80340983e146", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2022-42494", "type": "seen", "source": "https://t.me/cibsecurity/52663", "content": "\u203c CVE-2022-42494 \u203c\n\nServer Side Request Forgery (SSRF) vulnerability in All in One SEO Pro plugin <= 4.2.5.1 on WordPress.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-11-08T22:35:22.000000Z"}, {"uuid": "8c5922d6-1619-46ca-b2da-d38735eaeee8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2022-42491", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/9759", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2022-42491\n\ud83d\udd25 CVSS Score: 9.8 (cvssV3_0, Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)\n\ud83d\udd39 Description: Several OS command injection vulnerabilities exist in the m2m binary of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafted network request can lead to arbitrary command execution. An attacker can send a network request to trigger these vulnerabilities.This command injection is reachable through the m2m's M2M_CONFIG_SET command\n\ud83d\udccf Published: 2023-01-26T21:24:34.886Z\n\ud83d\udccf Modified: 2025-03-31T18:35:29.103Z\n\ud83d\udd17 References:\n1. https://talosintelligence.com/vulnerability_reports/TALOS-2022-1640", "creation_timestamp": "2025-03-31T19:31:26.000000Z"}, {"uuid": "67246fba-65d6-4692-be8a-f02f81f734ab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2022-42498", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/5978", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2022-42498\n\ud83d\udd25 CVSS Score: N/A\n\ud83d\udd39 Description: In Pixel cellular firmware, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-240662453References: N/A\n\ud83d\udccf Published: 2023-03-24T00:00:00.000Z\n\ud83d\udccf Modified: 2025-02-28T20:13:34.538Z\n\ud83d\udd17 References:\n1. https://source.android.com/security/bulletin/pixel/2023-03-01", "creation_timestamp": "2025-02-28T20:27:09.000000Z"}, {"uuid": "ed1df718-8692-40a2-b5d8-e3cf07a6b2ca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2022-42499", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/5972", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2022-42499\n\ud83d\udd25 CVSS Score: N/A\n\ud83d\udd39 Description: In sms_SendMmCpErrMsg of sms_MmConManagement.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-242001391References: N/A\n\ud83d\udccf Published: 2023-03-24T00:00:00.000Z\n\ud83d\udccf Modified: 2025-02-28T20:14:45.802Z\n\ud83d\udd17 References:\n1. https://source.android.com/security/bulletin/pixel/2023-03-01", "creation_timestamp": "2025-02-28T20:27:01.000000Z"}, {"uuid": "d6d0f12f-0654-4dba-be8a-4a20b04764e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2022-42490", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/9393", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2022-42490\n\ud83d\udd25 CVSS Score: 9.8 (cvssV3_0, Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)\n\ud83d\udd39 Description: Several OS command injection vulnerabilities exist in the m2m binary of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafted network request can lead to arbitrary command execution. An attacker can send a network request to trigger these vulnerabilities.This command injection is reachable through the m2m's DOWNLOAD_CFG_FILE command\n\ud83d\udccf Published: 2023-01-26T21:24:34.744Z\n\ud83d\udccf Modified: 2025-03-28T16:12:03.721Z\n\ud83d\udd17 References:\n1. https://talosintelligence.com/vulnerability_reports/TALOS-2022-1640", "creation_timestamp": "2025-03-28T16:28:01.000000Z"}, {"uuid": "b795e4da-69a8-4e90-af1d-ab605db33de0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2022-42493", "type": "seen", "source": "https://t.me/cibsecurity/57016", "content": "\u203c CVE-2022-42493 \u203c\n\nSeveral OS command injection vulnerabilities exist in the m2m binary of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafted network request can lead to arbitrary command execution. An attacker can send a network request to trigger these vulnerabilities.This command injection is reachable through the m2m's DOWNLOAD_INFO command.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-01-27T00:47:11.000000Z"}]}