From 00d36ec5ec06713014738e096784cd4cf65b9025 Mon Sep 17 00:00:00 2001 From: Github-Bot Date: Tue, 13 Feb 2024 10:28:06 +0000 Subject: [PATCH] Updated by Github Bot --- cache/Tenable (Nessus).dat | 10 +++ data/cves.db | Bin 46055424 -> 46063616 bytes docs/index.html | 162 ++++++++++++++++++------------------- 3 files changed, 91 insertions(+), 81 deletions(-) diff --git a/cache/Tenable (Nessus).dat b/cache/Tenable (Nessus).dat index 7903e610174..23ed08914a4 100644 --- a/cache/Tenable (Nessus).dat +++ b/cache/Tenable (Nessus).dat @@ -168,3 +168,13 @@ c7066a1278fbaaa7394cb5700fbf70e2 e4cf737008a30ca57ff4412f12dbe41b 060f7bf21981a500e82c1c0eefef12a8 8fa5a716a7437bfdae163da7d9ecc0e1 +932602bf23ed6be6fa7cd58444930af1 +42df8328796113c645b60c784cbbaf87 +ed5cca03f52b4cfb895ff92a9211bad3 +954baa39956472e2e4f25604d4de7005 +3d503e6f01e58b930dbdd8267b9ccafa +7b1de36105bcebb60b0301f47e2b21aa +c82f8b94754d3c8405cad1cc1c24367c +f2f1e142d82a127a8a75009515df0d81 +4e8a6504adf3b01184d90663573b87cd +fedcff969fe657533267a92fe0fa8bc9 diff --git a/data/cves.db b/data/cves.db index 31099e3115a516589a226b0b4697a0b78ebb0421..206d3e87cbf54e7a7015c10f822363b16174831e 100644 GIT binary patch delta 6825 zcmeI$X?PT6wg+&kNCG5*5JG?umO_v<3DsS_1_VObB@hUL3(KkQu1?x?xkC_&P-jHx-uzD-Iy+8>dw@I z>2ju?Oud+TGxcHW%hZo4k13z2fT=%|%4A`(GHFaUCOeaZ$;sqmax)b&4PY9`bOqBO zrol`@n2MN&G8HooV;ashf@vhvD5lX&W0&OJQz_E~rin~tOp}Q;!JCp?qOQXw2tXsru&%IGYO^*OdFZ* zXL^8X6VroCo0%SBdYI`Erbn3`V|twF38p8RwlLK*ZDrcV^c2%}rX5UAGwo#B#qbdX8xyQv=g}rstVnVEP@?@0ng?dWq>}rdOB_FdbximFYF6*O?A6y}@*t z=?K%COh=jCV)_Hq+f09CI>z)4)4NQ6Vmi)rg6SmFDW=m*XPDk&`ZLq}OlO%sU^>V2 z7p4!H&NF?)^fA*XOrJ7+#`HPU7ffF=eZ}-O(>F|iW%`!s0@L4^E;9X{={u(HnSNM8 z((NRH3{4>kk|70}L33yUsgMTg&=Oif2DFAuXaiZ$7P6row1*Cm105k3IzeaX0$o9Y zZg3fNhaPY_^n_l}8~Q+B=m&X_4+YR4RIq>*G_Zjk9N+{OxSImM!{$p16RUWD1mV>9!g;XOoTF+1Xsaim;zVBHE=Cl2UB4hOotg@=3fU7 zc)(muK3ER|Ho!)>A0B{B z@E~l4hu~p&1RjOQ;Bj~Yo`fw>4_jdyJO$ff2RscsVHZ3D&%$ol1AE~)*ar=;AD)L7 z;CJwQcoANLm*EvS00-e!cnw~ML+}P1h9mGM9EG>w5AZhp5stw-@Gkrbj>8E!38&yR zoPqb?&+tB+g%98y`~^OQ^Y9UT44=TK@ELp#U%;2}6?_ffz+d58xB!2Hi|}{&4!(yU zq$MO{`GX8iAqkQp1)4!~XaT8^2IM!SvK=fE6^bfgK#+1Q)oW5C*_NxB>>jU>E{L zFcgYm7z~FIFcL<=Xcz-m!dNJQaWEcAVFFBqGMEHc!DN^MSHm@MEnEjvVH!+_8DQpL z2M>6`2L|||94a6H*Fz-)p$b9}hH97z5r{$zYG4-B!fdF68{kH`32ug4U=GZMc`zRq zz(QbH1dHKTSOQC78Qcc9!yT|3R=`TQ6IQ`pa5t=mIIMwtU@feJd*MD<4+1v8Mz|jy zfKBiqY=(#6VR!@{g~#A=cmke;El>|zVH-RJ+hGShE$^kB@}`r`$EUpA#4PsqrJvd< zua%pooJiT1slF$@DDPBDM_n(a_xqTIjypbLF?IR-XLrhIcA3pHX7jAs>^7S{^1k=a z?v-QyYBB6C zk6TlH9-q%;bvQk4uU8lQD*ns*MOCR2_CkxjP<8#AzmfW#k$PIppSG|i3o=u(AX{6It-I|ukFINO zx7}fLS`DjV^IPo>)#kJL45unATR)LFKE>25yMQ(#1TV- zVQ=NH^P?811s3;@84{MwrBb_i!#fGyZ zAs<|N-y05B1`MTlz^_CD8(5Y;_F!`G+4s#VHe=KMT0yFGuuW zin#d4$o>Zri^D%GmU`Q?{6u1x^=C1|9Fe6?ZK+c?e0EGmRrA}e9-G(iak=e&zuT(2 ztrm+%k8j+*E@ypYyPVY2=C+8_J717GWJG5LX8$-XEd`eN>0{^G#mB$*L%X&<DzZ)IA#>~?HgY?xF)9C#3D>15>-Nm;lotMPmDzZSUTo?$gmN> zFTrmND_$MpT{XM~+I# z|5^{?{Nh5nr+DLwy>gQ3w%BgXW-$%X_gdUlTikVqTeCV;tH*EE44=b;gIRZaeRh}4 zX2aR6i=yvR<=iBP%VHO&PIx3$)PJ;0(&8_wl>_4AHZN%wzs_1&C_a5Ip0nAWy zi;mAdu_ZgbthiY5L=3$$5Gohbd-an$C5Cly8zn()wCCOT5~7CMJn`&LgF^{;68f5(Sw1HydwUeeK=8mzEIny0Dyu zVGhZHu(lwq+YFcPu&XxR=hr-{#p1I0+^WN&*`1ol<&4klFbW&Mo7?4N*=mcQesgkr zIUEuFkJrn&EsILVCeCwg1fiHX*}Y!wIHI;G6; znrGoJ?ntbgYbO;c<$4U&U|lpW?f9~@_^i8IYSzqaL}Gd%Bt9!DL#fa=FIP^DPu;V+ zO~y}&wUN?3R1{GZ5Bx(b3Xq(vj=JgmIBQs*1f!1-Y@XK zWH~vl@sO_ygfJxC`md1`Q8MxasdXZRA8XmhB)R?LjYS-zIez4WIA9d5BCd8qC6z7=@7LzE#&wYI|C;nCP;jH-F zrWZ1@ubMcv@u9#R;z(m}(Rf4Zk@n))2a}{$B5nLGDMxI$u}Dr5-;e7gr;3)?Wm84y oz!bF8PgF>)<3q~MB@O@8icdW2{?;QG4bxW1JsP)N9B0~p0Svo}ssI20 delta 2614 zcmWmG^>-Hp7=>~6rAEVGba!`mcZ_bhba(fN3ykjW?uOALYzYOFP6d=!FaQ;w{qTAI zfP2n+&KrK_V`zBz$IyA{Vn2)#Bj1bpnJWc7oG2^E3Rp3%SXOK+juqDmw&Gdwtprv= zE0LAhN@69ol35{Eaw~-uYNfPNS*fiwR$42amEOu=WwbI`nXN2VRx6v8-O6F*v~pRw ztvpsS*5KqR#~f@Ro<##RkSKum8~jPRjZm+ z-Kt^Lv}#$ktvXg+tDaTgYG5_A8d+ghW2=eP)M{omw^~>&tyWfRtBuvxYG<{#I#?Yo z_UUAGwz^ndt!`F#tB2Lo>Sgt|`dEFfepY{LfHlw>WDT~4SVOI0)^KZtHPRYojkd;E zW36%4cx!?cZcVf%S(B|PmaVDQG;6vQVa>2+TC=R#)*NfDHP4!FEwC0^i>$@g5^Jfo z%vx@(uvS{Dtku>UYpu1;T5oNzHd>pk&DIuctF_JAZtbvkTDz>>)*frGwa?mb9k32s zhpfZa5i8O6=j{V&RXZJ^VVn9=hhe2m)2L-*VZ@Ix7G#gqIJo- zY<*{aZ(XsjTGy-}tRJoG)(z{Xb<4VK-LdXk_pJNY1M8vn$ok3p*?Md}v7TDLSif4& ztmoDX>!tO|dTqV2ezShJ-dgXhKde8kzpTHl_tppNqxFyVul1kxDMCTB6@&m{A{JsJ z4&ovh@em&gkPwNG7)g*6$q<6%NP$qKL@K048l*)!q(=s1L?&cL7Gy;>WJeC?&yJ@=!M?sgTCm8 z{uqFP7=*zXf}t3O;TVCD7=_UogRvNg@tA;cOvEHi#uOM+F%8oZff<;IS(uGEn2ULs zj|EtWMOcg_Sc+v>julvmRalKRSc`R7j}6#}P1uYr*otk~jvd&EUD%C1*o%GGj{`V} zLpY2hh{RDG!*QIzNu0uIMBxn1;vCN7GklIO@Fl*&*Z2nC;sP$>5-#IAe2*)*ifi}* zKjJ!W;3jV2Htygq?%_Tj;2|F2C;W`Zc!H<+1;64Mp5p~x;uT)w4SvJ#c#C)V1ApQ# z{EhecfRFeG|KdM<3W`vG^G5(N5eu;q2XPUMc!-Y#NQgv8j3h{kWC%fWq(CTAA{A02 z4bmbV(jx;hA`>zr3$h{`vLgp_A{TNa5Aq@(@}mF>q7VwB2#TT@ilYQdq7+J_49cP$ z%A*1*q7o{j3aX+Ss-p&Kq84hS4(g&F>Z1V~q7lN-7){U=&Cnbz&=RfC8g0-P?a&?_ z&=Jx5cS2`$L05D`cl1C{^g?g+L0|Mke+9n%*8y+#{w+GA}q!dEX6V`#|o^(Dy+sDti?L4#|CV~ zCTzwQY{fQg#}4eoF6_o0?8QFp#{nF~Asoh$z$rxrHr)?y5a)4>=w~k~;e*J)ia=Dz pgW$l`pvb~uwfhI=K7A4youkn?7Me>JR diff --git a/docs/index.html b/docs/index.html index b939ff732cc..af603161df3 100644 --- a/docs/index.html +++ b/docs/index.html @@ -1,4 +1,4 @@ - + @@ -283,6 +283,86 @@

眈眈探求 | TITLE URL + + 932602bf23ed6be6fa7cd58444930af1 + CVE-2023-6815 + 2024-02-13 07:15:46 + Incorrect Privilege Assignment vulnerability in Mitsubishi Electric Corporation MELSEC iQ-R Series Safety CPU R08/16/32/120SFCPU all versions and MELSEC iQ-R Series SIL2 Process CPU R08/16/32/120PSFCPU all versions allows a remote authenticated attacker who has logged into the product as a non-administrator user to disclose the credentials (user ID and password) of a user with a lower access level than the attacker by sending a specially crafted packet. + 详情 + + + + 42df8328796113c645b60c784cbbaf87 + CVE-2024-25914 + 2024-02-13 05:15:09 + Cross-Site Request Forgery (CSRF) vulnerability in Photoboxone SMTP Mail.This issue affects SMTP Mail: from n/a through 1.3.20. + 详情 + + + + ed5cca03f52b4cfb895ff92a9211bad3 + CVE-2024-21491 + 2024-02-13 05:15:08 + Versions of the package svix before 1.17.0 are vulnerable to Authentication Bypass due to an issue in the verify function where signatures of different lengths are incorrectly compared. An attacker can bypass signature verification by providing a shorter signature that matches the beginning of the actual signature. **Note:** The attacker would need to know a victim uses the Rust library for verification,no easy way to automatically check that; and uses webhooks by a service that uses Svix, and then figure out a way to craft a malicious payload that will actually include all of the correct identifiers needed to trick the receivers to cause actual issues. + 详情 + + + + 954baa39956472e2e4f25604d4de7005 + CVE-2023-52431 + 2024-02-13 05:15:08 + The Plack::Middleware::XSRFBlock package before 0.0.19 for Perl allows attackers to bypass a CSRF protection mechanism via an empty form value and an empty cookie (if signed cookies are disabled). + 详情 + + + + 3d503e6f01e58b930dbdd8267b9ccafa + CVE-2022-48623 + 2024-02-13 05:15:08 + The Cpanel::JSON::XS package before 4.33 for Perl performs out-of-bounds accesses in a way that allows attackers to obtain sensitive information or cause a denial of service. + 详情 + + + + 7b1de36105bcebb60b0301f47e2b21aa + CVE-2024-25643 + 2024-02-13 04:15:08 + The SAP Fiori app (My Overtime Request) - version 605, does not perform the necessary authorization checks for an authenticated user which may result in an escalation of privileges. It is possible to manipulate the URLs of data requests to access information that the user should not have access to. There is no impact on integrity and availability. + 详情 + + + + c82f8b94754d3c8405cad1cc1c24367c + CVE-2024-24741 + 2024-02-13 04:15:08 + SAP Master Data Governance for Material Data - versions 618, 619, 620, 621, 622, 800, 801, 802, 803, 804, does not perform necessary authorization check for an authenticated user, resulting in escalation of privileges. This could allow an attacker to read some sensitive information but no impact to integrity and availability. + 详情 + + + + f2f1e142d82a127a8a75009515df0d81 + CVE-2024-22129 + 2024-02-13 04:15:08 + SAP Companion - version <3.1.38, has a URL with parameter that could be vulnerable to XSS attack. The attacker could send a malicious link to a user that would possibly allow an attacker to retrieve the sensitive information and cause minor impact on the integrity of the web application. + 详情 + + + + 4e8a6504adf3b01184d90663573b87cd + CVE-2024-22024 + 2024-02-13 04:15:07 + An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy Secure (9.x, 22.x) and ZTA gateways which allows an attacker to access certain restricted resources without authentication. + 详情 + + + + fedcff969fe657533267a92fe0fa8bc9 + CVE-2024-25642 + 2024-02-13 03:15:09 + Due to improper validation of certificate in SAP Cloud Connector - version 2.0, attacker can impersonate the genuine servers to interact with SCC breaking the mutual authentication. Hence, the attacker can intercept the request to view/modify sensitive information. There is no impact on the availability of the system. + 详情 + + 6f31033eeb01582e6f7026c776e4fb77 CVE-2024-25744 @@ -443,86 +523,6 @@

眈眈探求 | 详情 - - a4f6a250e2a5cceccd57d833a0bc1d09 - CVE-2024-23724 - 2024-02-11 01:15:08 - Ghost through 5.76.0 allows stored XSS, and resultant privilege escalation in which a contributor can take over any account, via an SVG profile picture that contains JavaScript code to interact with the API on localhost TCP port 3001. NOTE: The discoverer reports that "The vendor does not view this as a valid vector." - 详情 - - - - 4af14b5ecf1632767d889fe4108a3b5f - CVE-2024-1430 - 2024-02-11 01:15:07 - A vulnerability has been found in Netgear R7000 1.0.11.136_10.2.120 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /currentsetting.htm of the component Web Management Interface. The manipulation leads to information disclosure. The exploit has been disclosed to the public and may be used. The identifier VDB-253381 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. - 详情 - - - - 321ee7bd3eff437df0ce32737d318c47 - CVE-2024-22313 - 2024-02-10 16:15:08 - IBM Storage Defender - Resiliency Service 2.0 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 278749. - 详情 - - - - 34d2bca3e6d18e59ffc753e611d0daa1 - CVE-2024-22312 - 2024-02-10 16:15:08 - IBM Storage Defender - Resiliency Service 2.0 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 278748. - 详情 - - - - f4f9ca58a6c1a835ad662c25aa818998 - CVE-2023-50957 - 2024-02-10 16:15:07 - IBM Storage Defender - Resiliency Service 2.0 could allow a privileged user to perform unauthorized actions after obtaining encrypted data from clear text key storage. IBM X-Force ID: 275783. - 详情 - - - - 03fffefb6ae52488a2423ab10240a426 - CVE-2023-45718 - 2024-02-09 22:15:08 - Sametime is impacted by a failure to invalidate sessions. The application is setting sensitive cookie values in a persistent manner in Sametime Web clients. When this happens, cookie values can remain valid even after a user has closed out their session. - 详情 - - - - 646fecf76a0cda275d7593a2c7559d25 - CVE-2023-45716 - 2024-02-09 22:15:07 - Sametime is impacted by sensitive information passed in URL. - 详情 - - - - 8bec4e47b075006cea0a6983203bea78 - CVE-2023-50349 - 2024-02-09 21:15:07 - Sametime is impacted by a Cross Site Request Forgery (CSRF) vulnerability. Some REST APIs in the Sametime Proxy application can allow an attacker to perform malicious actions on the application. - 详情 - - - - ed2021c0efd8928d43fc3bf4201b9bde - CVE-2024-1246 - 2024-02-09 20:15:54 - Concrete CMS in version 9 before 9.2.5 is vulnerable to reflected XSS via the Image URL Import Feature due to insufficient validation of administrator provided data. A rogue administrator could inject malicious code when importing images, leading to the execution of the malicious code on the website user’s browser. The Concrete CMS Security team scored this 2 with CVSS v3 vector AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N. This does not affect Concrete versions prior to version 9. - 详情 - - - - d66473d0e3a60316e1a21e207a0ee59b - CVE-2024-1245 - 2024-02-09 20:15:54 - Concrete CMS version 9 before 9.2.5 is vulnerable to stored XSS in file tags and description attributes since administrator entered file attributes are not sufficiently sanitized in the Edit Attributes page. A rogue administrator could put malicious code into the file tags or description attributes and, when another administrator opens the same file for editing, the malicious code could execute. The Concrete CMS Security team scored this 2.4 with CVSS v3 vector AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N. - 详情 - -