CVE-2022-36782

Pal Electronics Systems - Pal Gate Authorization Errors. The vulnerability is an authorization problem in PalGate device management android client app. Gates of bulidings and parking lots with a simple button in any smartphone. The API was found after a decompiling and static research using Jadx, and a dynamic analasys using Frida. The attacker can iterate over all the IOT devices to see every entry and exit, on every gate and device all over the world, he can also scrape the server and create a user's DB with full names and phone number of over 2.8 million users, and to see all of the users' movement in and out of gates, even in real time.

• https://www.gov.il/en/Departments/faq/cve_advisoriesThird Party Advisory, VDB Entry
• https://www.gov.il/en/Departments/faq/cve_advisoriesThird Party Advisory, VDB Entry

Published

Sep 13, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-36777IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.11.0…6.5
• CVE-2022-36778insert HTML / js code inside input how to get to the vulnera…5.4
• CVE-2022-36779PROSCEND - PROSCEND / ADVICE .Ltd - G/5G Industrial Cellular…9.8
• CVE-2022-3678Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2022-36780Avdor CIS - crystal quality Credentials Management Errors. T…5.3
• CVE-2022-36781ConnectWise ScreenConnect versions 22.6 and below contained …5.3
• CVE-2022-36783AlgoSec – FireFlow Reflected Cross-Site-Scripting (RXSS) A m…5.4
• CVE-2022-36784 Elsight – Elsight Halo  Remote Code Execution (RCE) Elsight…9.8
• CVE-2022-36785 D-Link – G integrated Access Device4 Information Disclosure…7.5
• CVE-2022-36786DLINK - DSL-224 Post-auth RCE. DLINK router version 3.0.8 ha…9.9
• CVE-2022-36787 webvendome - webvendome SQL Injection. SQL Injection in the…9.8
• CVE-2022-36788A heap-based buffer overflow vulnerability exists in the Tri…7.8