Database/Control plane, storage & DevOps
Citrix ADC/Gateway: SAML SP/IdP config
CVSS 9.8CVE-2022-27518Control plane, storage & DevOpsKnown exploitedcurated
Impact
SAML SP/IdP config -> unauthenticated remote arbitrary code execution (nation-state exploited)
Who can reach it
Network (remote)
What to do
Control-plane: patch immediately
References
Related entries
- Brocade SANnav Management Portal - Zone management endpoints, before SANnav 2.2.0: SQL injection in multiple endpointsCVE-2022-28163 · Brocade SANnav Management Portal - Zone management endpoints, before SANnav 2.2.0Critical
- Pure Storage Purity//FA and Purity//FB management interface (exposed credential): A password for the array's managementCVE-2022-32554 · Pure Storage Purity//FA and Purity//FB management interface (exposed credential)Critical
- Brocade Fabric OS (unauthenticated remote code execution): Unauthenticated remote code execution on a Fibre ChannelCVE-2022-33186 · Brocade Fabric OS (unauthenticated remote code execution)Critical
- Fortinet FortiOS/FortiProxy: Auth bypass via an alternate pathCVE-2022-40684 · Fortinet FortiOS/FortiProxyCritical
- Fortinet FortiOS: SSL-VPN heap-based buffer overflowCVE-2022-42475 · Fortinet FortiOSCritical
- Linux NFS server (nfsd, nfssvc_decode_writeargs): The NFSv2/v3 write argument decoder has no lower bound on the lengthCVE-2022-49280 · Linux NFS server (nfsd, nfssvc_decode_writeargs)Critical
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.