Skip to content

Commit

Permalink
Updated by Github Bot
Browse files Browse the repository at this point in the history
  • Loading branch information
Github-Bot committed Oct 6, 2023
1 parent 7ce48f5 commit 16a51bc
Show file tree
Hide file tree
Showing 3 changed files with 91 additions and 81 deletions.
10 changes: 10 additions & 0 deletions cache/Tenable (Nessus).dat
View file
Original file line number Diff line number Diff line change
Expand Up @@ -180,3 +180,13 @@ f24724b4245f3d104822ccfa2b90371a
509b57e46b7c62e43ad7ee227d766a3b
ed2f1a8dc05feefc501efd1efda89a0f
ce7d6fda602857944038dd36ecb93ff4
e3ec2575a1c23253b20fdaedcdfff5cf
004d187d4b6141a1cf6956d672706151
6169bf7cae366b6512189c64dcd8c422
92a867aecc05624c8bbf1e77aa9ccec9
f31d2388c525bd75f3b04ef00ac874a9
b7cd828c20f2ec48441517a5d9cb9539
501f917969d8677450afad8668b0ca98
7126c63f2dfe3b0a76d3e6d332caccaf
33d427c1dd782d342c194fc5cf16636d
8196d85b4375094ccc4503f1b70c83e1
Binary file modified data/cves.db
View file
Binary file not shown.
162 changes: 81 additions & 81 deletions docs/index.html
View file
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
<!-- RELEASE TIME : 2023-10-06 22:25:24 -->
<!-- RELEASE TIME : 2023-10-06 23:21:47 -->
<html lang="zh-cn">

<head>
Expand Down Expand Up @@ -283,6 +283,86 @@ <h2><a href="https://exp-blog.com" target="_blank">眈眈探求</a> | <a href="h
<th width="43%">TITLE</th>
<th width="5%">URL</th>
</tr>
<tr>
<td>e3ec2575a1c23253b20fdaedcdfff5cf</td>
<td>CVE-2023-45303</td>
<td>2023-10-06 19:15:00 <img src="imgs/new.gif" /></td>
<td>ThingsBoard before 3.5 allows Server-Side Template Injection if users are allowed to modify an email template, because Apache FreeMarker supports freemarker.template.utility.Execute (for content sent to the /api/admin/settings endpoint).</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2023-45303">详情</a></td>
</tr>

<tr>
<td>004d187d4b6141a1cf6956d672706151</td>
<td>CVE-2023-45282</td>
<td>2023-10-06 19:15:00 <img src="imgs/new.gif" /></td>
<td>In NASA Open MCT (aka openmct) 2.2.5 before 545a177, prototype pollution can occur via an import action.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2023-45282">详情</a></td>
</tr>

<tr>
<td>6169bf7cae366b6512189c64dcd8c422</td>
<td>CVE-2023-21291</td>
<td>2023-10-06 19:15:00 <img src="imgs/new.gif" /></td>
<td>In visitUris of Notification.java, there is a possible way to reveal image contents from another user due to a missing permission check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2023-21291">详情</a></td>
</tr>

<tr>
<td>92a867aecc05624c8bbf1e77aa9ccec9</td>
<td>CVE-2023-21266</td>
<td>2023-10-06 19:15:00 <img src="imgs/new.gif" /></td>
<td>In killBackgroundProcesses of ActivityManagerService.java, there is a possible way to escape Google Play protection due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2023-21266">详情</a></td>
</tr>

<tr>
<td>f31d2388c525bd75f3b04ef00ac874a9</td>
<td>CVE-2023-21253</td>
<td>2023-10-06 19:15:00 <img src="imgs/new.gif" /></td>
<td>In multiple locations, there is a possible way to crash multiple system services due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2023-21253">详情</a></td>
</tr>

<tr>
<td>b7cd828c20f2ec48441517a5d9cb9539</td>
<td>CVE-2023-21252</td>
<td>2023-10-06 19:15:00 <img src="imgs/new.gif" /></td>
<td>In validatePassword of WifiConfigurationUtil.java, there is a possible way to get the device into a boot loop due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2023-21252">详情</a></td>
</tr>

<tr>
<td>501f917969d8677450afad8668b0ca98</td>
<td>CVE-2023-21244</td>
<td>2023-10-06 19:15:00 <img src="imgs/new.gif" /></td>
<td>In visitUris of Notification.java, there is a possible bypass of user profile boundaries due to a missing permission check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2023-21244">详情</a></td>
</tr>

<tr>
<td>7126c63f2dfe3b0a76d3e6d332caccaf</td>
<td>CVE-2023-5366</td>
<td>2023-10-06 18:15:00 <img src="imgs/new.gif" /></td>
<td>A flaw was found in Open vSwitch that allows ICMPv6 Neighbor Advertisement packets between virtual machines to bypass OpenFlow rules. This issue may allow a local attacker to create specially crafted packets with a modified or spoofed target IP address field that can redirect ICMPv6 traffic to arbitrary IP addresses.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2023-5366">详情</a></td>
</tr>

<tr>
<td>33d427c1dd782d342c194fc5cf16636d</td>
<td>CVE-2023-5214</td>
<td>2023-10-06 18:15:00 <img src="imgs/new.gif" /></td>
<td>In Puppet Bolt versions prior to 3.27.4, a path to escalate privileges was identified.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2023-5214">详情</a></td>
</tr>

<tr>
<td>8196d85b4375094ccc4503f1b70c83e1</td>
<td>CVE-2023-45239</td>
<td>2023-10-06 18:15:00 <img src="imgs/new.gif" /></td>
<td>A lack of input validation exists in tac_plus prior to commit 4fdf178 which, when pre or post auth commands are enabled, allows an attacker who can control the username, rem-addr, or NAC address sent to tac_plus to inject shell commands and gain remote code execution on the tac_plus server.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2023-45239">详情</a></td>
</tr>

<tr>
<td>9ca9792c98ad62b48e370e1aa295fd84</td>
<td>CVE-2023-44390</td>
Expand Down Expand Up @@ -443,86 +523,6 @@ <h2><a href="https://exp-blog.com" target="_blank">眈眈探求</a> | <a href="h
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2023-40561">详情</a></td>
</tr>

<tr>
<td>88e59260dbadebaa0ecf31c8a4f27e9e</td>
<td>CVE-2023-4997</td>
<td>2023-10-04 11:15:00</td>
<td>Improper authorisation of regular users in ProIntegra Uptime DC software (versions below 2.0.0.33940) allows them to change passwords of all other users including administrators leading to a privilege escalation.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2023-4997">详情</a></td>
</tr>

<tr>
<td>1f8e2d7cf544d0004d63acc13bb2f03f</td>
<td>CVE-2023-4586</td>
<td>2023-10-04 11:15:00</td>
<td>A vulnerability was found in the Hot Rod client. This security issue occurs as the Hot Rod client does not enable hostname validation when using TLS, possibly resulting in a man-in-the-middle (MITM) attack.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2023-4586">详情</a></td>
</tr>

<tr>
<td>03ec499fd4df3c0359e575bd0b41777a</td>
<td>CVE-2023-37995</td>
<td>2023-10-04 11:15:00</td>
<td>Cross-Site Request Forgery (CSRF) vulnerability in Chetan Gole WP-CopyProtect [Protect your blog posts] plugin <= 3.1.0 versions.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2023-37995">详情</a></td>
</tr>

<tr>
<td>112461645598307d69040e633887581e</td>
<td>CVE-2023-3701</td>
<td>2023-10-04 11:15:00</td>
<td>Aqua Drive, in its 2.4 version, is vulnerable to a relative path traversal vulnerability. By exploiting this vulnerability, an authenticated non privileged user could access/modify stored resources of other users. It could also be possible to access and modify the source and configuration files of the cloud disk platform, affecting the integrity and availability of the entire platform.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2023-3701">详情</a></td>
</tr>

<tr>
<td>b012832d3a8ddf9f201c46891c36ff94</td>
<td>CVE-2023-3512</td>
<td>2023-10-04 11:15:00</td>
<td>Relative path traversal vulnerability in Setelsa Security's ConacWin CB, in its 3.8.2.2 version and earlier, the exploitation of which could allow an attacker to perform an arbitrary download of files from the system via the "Download file" parameter.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2023-3512">详情</a></td>
</tr>

<tr>
<td>367ab702d6e0433e4c9910e8f46b41d3</td>
<td>CVE-2023-2809</td>
<td>2023-10-04 11:15:00</td>
<td>Plaintext credential usage vulnerability in Sage 200 Spain 2023.38.001 version, the exploitation of which could allow a remote attacker to extract SQL database credentials from the DLL application. This vulnerability could be linked to known techniques to obtain remote execution of MS SQL commands and escalate privileges on Windows systems because the credentials are stored in plaintext.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2023-2809">详情</a></td>
</tr>

<tr>
<td>1ffd2e6716db4435ec18865cf6140cfb</td>
<td>CVE-2023-25980</td>
<td>2023-10-04 11:15:00</td>
<td>Cross-Site Request Forgery (CSRF) vulnerability in CAGE Web Design | Rolf van Gelder Optimize Database after Deleting Revisions plugin <= 5.1 versions.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2023-25980">详情</a></td>
</tr>

<tr>
<td>3b649ea03a2f19d1c0ac1f6cd5828a63</td>
<td>CVE-2023-25788</td>
<td>2023-10-04 11:15:00</td>
<td>Cross-Site Request Forgery (CSRF) vulnerability in Saphali Saphali Woocommerce Lite plugin <= 1.8.13 versions.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2023-25788">详情</a></td>
</tr>

<tr>
<td>4b712849f4a1cc56a416ba5472b2bf81</td>
<td>CVE-2023-25489</td>
<td>2023-10-04 11:15:00</td>
<td>Cross-Site Request Forgery (CSRF) vulnerability in Jeff Sherk Update Theme and Plugins from Zip File plugin <= 2.0.0 versions.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2023-25489">详情</a></td>
</tr>

<tr>
<td>7c7e32d4464b3460b4820ff5d6f8be0d</td>
<td>CVE-2023-2422</td>
<td>2023-10-04 11:15:00</td>
<td>A flaw was found in Keycloak. A Keycloak server configured to support mTLS authentication for OAuth/OpenID clients does not properly verify the client certificate chain. A client that possesses a proper certificate can authorize itself as any other client, therefore, access data that belongs to other clients.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2023-2422">详情</a></td>
</tr>

</tbody>
</table>
</div>
Expand Down

0 comments on commit 16a51bc

Please sign in to comment.