CVE-2022-40238

A Remote Code Injection vulnerability exists in CERT software prior to version 1.50.5. An authenticated attacker can inject arbitrary pickle object as part of a user's profile. This can lead to code execution on the server when the user's profile is accessed.

• CWE-502
• CWE-502

• https://github.com/CERTCC/VINCE/issues?q=label%3AsecurityIssue Tracking, Vendor Advisory
• https://github.com/CERTCC/VINCE/issues?q=label%3AsecurityIssue Tracking, Vendor Advisory

Published

Oct 26, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-40231IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through…8.8
• CVE-2022-40232 IBM Sterling B2B Integrator Standard Edition 6.1.0.0 throug…8.8
• CVE-2022-40233IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privil…6.2
• CVE-2022-40234Versions of IBM Spectrum Protect Plus prior to 10.1.12 (excl…5.9
• CVE-2022-40235"IBM InfoSphere Information Server 11.7 could allow a user t…6.5
• CVE-2022-40237IBM MQ for HPE NonStop 8.1.0 is vulnerable to a denial of se…7.5
• CVE-2022-4024The Registration Forms WordPress plugin before 3.8.1.3 does …6.5
• CVE-2022-40242MegaRAC Default Credentials Vulnerability9.8
• CVE-2022-40246A potential attacker can write one byte by arbitrary address…7.2
• CVE-2022-40248An HTML injection vulnerability exists in CERT/CC VINCE soft…5.4
• CVE-2022-4025Inappropriate implementation in Paint in Google Chrome prior…4.3
• CVE-2022-40250An attacker can exploit this vulnerability to elevate privil…8.8