From 19f4de91941e220b67aa726f29fd1597ace0acfe Mon Sep 17 00:00:00 2001 From: Github-Bot Date: Thu, 2 May 2024 07:22:29 +0000 Subject: [PATCH] Updated by Github Bot --- cache/Tenable (Nessus).dat | 10 +++ data/cves.db | Bin 47329280 -> 47337472 bytes docs/index.html | 162 ++++++++++++++++++------------------- 3 files changed, 91 insertions(+), 81 deletions(-) diff --git a/cache/Tenable (Nessus).dat b/cache/Tenable (Nessus).dat index 8c391616f3b..924edd1cd18 100644 --- a/cache/Tenable (Nessus).dat +++ b/cache/Tenable (Nessus).dat @@ -182,3 +182,13 @@ eb585d5dcc3781c57fa58217a7c00262 b79d36fdb4fbb1617f3ed55bbb79edd5 1267a4c0b3618ccf33b578b1fd66d0b3 490a962058a3da6f7c619e49474a9ed3 +4810ab7e08b687ad36a8fc9ddb691030 +f794dd352e24cfd5132fb016b4298b0f +0bf51b0e42be1ac0b6f59c2eeae87c98 +16c1891aacfac54db2b539c550bdf731 +35efe05450f29c4c302e9400ae003c8d +4c0b35638f89cc770b3781ca3dbf1484 +1f3afc8d73a9096a0b601f35b7fecb2e +33313bde1f352d7a9eaeaa1ca8263713 +895333f55aa1938858d8eac91b80e6f9 +f480f67e37e259de13dabe683c388cab diff --git a/data/cves.db b/data/cves.db index ca03d4a38a626b9bc246ed5dac71031da3117a2c..6f3b9c58d50b9659944d095f32874e6dc532d163 100644 GIT binary patch delta 5755 zcmdVc33L=?wg+&k$VNg)0wDnsqzF6Gp{lD_6d`O93=k4PM1@=3U7a)}-J!cf2q+Me zivljeg%U+8DsG^t783d!QQX&}=erol`@n1(W4$~270!j#W6oJnRZeY5RX(`h(rsYg^Oe>h`nHrdwX(iK5OgA&F zVp`3#hUpfjTbXWSx}B+!X)V(oOm{Nf#dJ5*IwphZ9;Wq7_cGnbw1MeOsAR7Fulw4d!|1yy~p%NruUgX zVET~hBc_j;K4Ch`^eNM4Oy`(BXZjP<7ffF={h8@2roS-#mFa7yZK&>2#p3#36hWI$Kw2AR+uvLG9JKu_oeIgksz;S%Tr z67+>U=m-5_01SjdFc^lwP`DI^fd%qmILM%Y6;!Z+9UR~U7r0>rTn3lJNVoztPPeg;@SI z@PHS5po1UEpd11)59UJ!R6-C!Pz4Jh3=xPzH7tZ0SOm4O7?!{da3d^*Ww0FTU5V+yb}4ZE!m@!dkck?u5JGZdeBf+ym?3Ubqi7!2R$5n9u|d!b9*d zY=lSPQFsgTuow2h^UwnO;Q$4V;I+!MAV$ zE()ti#P$afIzk-8Ljoj15_E!ONP*6f3SA%#(jf!7LN~~S?vMr9&;xoxFUWyh=na=Z zACRCgAU1h^6=LLp3otDp!b!xWeb#V`#@pcJOV444U5!z{Q4X2Z2`9b6A{U@pY+ zuYm`=-~%1}PzL1?fO#+fvup%K=?9dIYy1$V*bfKb zAiMxC!XbDG4#N>R3di7OI1VS^6*vj4;y!85 zNw0DVTZLiuX&9J1*)n8Bwz?u)lRbXB;*oWm)uSt#SN1skcDL86>zeLz8m*g_=Vq%8 zyIY;Qs79-(kd%B^zEc{k;Kyhk>&-OMr}}ycGmN_DPGuTPuWm>*n~Vf8-u$rkcA<;e zIA@latOP2xGF|cqD)dOcRkqqJvfUyplGQpwv5%15|N6{E)A)NHkTr69;Yt5JPwyr^QjKa<@dUMK99q#$fhD*6mo{!6^E*f zvlIn_^QCcxC6-yL)gen&;ZRw=w=5u)>d_gT9-##yl>-YD0Jb|DVt{o=Tln1=!Qn?oNp`4_NQwoZW z{n;0?aw`I5<yjWY?a=v~ZkcJ^puqRpbpiqm19N$`kS z<{htBivtqA`^;!NdsP1W_u6Nb;zDzD&P!rK>UVvj{Yfa+|J#)7&HbP672{;Y*3gZc zm&MjppQG02XjqV4pVsbU7>f6nE|~< z4^JwUc6DrEMo2x-2E(3}DlBO42X$Y5}?`F=; zJSnEk3`Fy#>E(flRH4U4M?;b)6fKuRReDeg>%Kr(_qI0{RJjzYj#@%~izoJXSdWCN z!(LsA-35jHL&2h*%4SRQak1|&5#ZQgAV8zFPk4xV?xVwELcXIugPWJOcjlhzik=!$ zt@*t!pHtP`vfF_}$RWql?{WHdug4S)pAd7?R8@AAwl8;V2p!iv^X74}zacOFS{au& zArOv4r738qc|Ww(SPLH;*0rcE#ahl!lM~y`iuLE`%lpUk8E5*vG004R^0*i`9C5`C z(Hq;>(|(BBaBix0hwAdX++MHKiT|7~RFLZP_?2~$L%q79(y<=r&)Af?`-Uh~>kBp2uKRV_ZnMjNtJ`bysU zM%%f!hneYHeCVa82b>fW&DD7)#oC0TP#LP$%y|E_(B16Q|D>4F?Z+qH_xt&OeYI1G z-E5`6%}WsEAWl&^Wv=4zDlWI8X`3o@%f#`f$O*SM3^?kW-TzL zHIEr;G#)8QG0Yj~JDV3jNE4FGccu>%GmS@K8r$hr!(_oE4GYv{}t>bIE>(Q&*k3)$T@% zRehRAceqq9&JM4cu|W`X;%pA9+gNaDUT&}HI#N;_)TIeUg(cEtRhA`dzARf5x0!MF zP9eu=+_^o~+*?*BBqt;OXt^Fc?ac*8HVRp0)q__E>84b2nUHEOd2hCuZluSbiZgcY z2&KdqPb`+I%(@jlFz%_Y=Y^!9At@XRMWre|Tp5T&@Dlg^gDS1|g?{o-zVE94#@KrO W_puqDkNj|;DQ7<+#&xv1?f(HY8WjWp delta 2737 zcmW;ORd5yt6hvY2lOQ2D1c%@b!QI{6ZE<&p012=_(BK-}-5r9v1uE33P^I2dr#NoA$*km73M-`*YNfKm ztkhN-E3K8zN^fPbGFq9e%vQLS#mZ`Bv$9(`tejRZE4P)$im>up`Kh}_ zzSY2LXf?7LTTQH{Rx_)))xv6NwX#}UZLGFdJFC6b!RlyrvN~H`tgco!tGm_1>S^_| z=+oQkWA(NAS^cd6)tk4NNbce+8SexwZ>WFtqImdYmznDnqp10 zqO57wbZdqcZN*qKty$J=%hnugt~Jk!wdPw3tcBJhYq7P&inEql%dF+r3Tvgc%35u$ zvDRAato7CgE8f~@ZL&67Tdb|tHfy`J!`f->vUXd0ti9GgYrl2CI%plT4qHd8qt-F& zxOKuhX`Ql8TW74Z);a6Eb-}u5C0LiN%hna^s&&n}Zr!kMTDPp*)*b7vbr4tY58{)^FDD)*sfN)?e1&)<4!O>)%)fEm9ByNQz*D zAQ_S)1yUjusSt+LNQ1OUhxEvRjL3w{2uBuVMK)wd4&+2GOhpu?VLE0Y8ZnrOS(puD4(4JWVlf{Jun>!|7)ua` zrC5gLSb>#Th1FPtwOEJs*noI!#3pRU7Hq{fY{w4l#4hZ{9_+;fTRdU2$CT=QXnNlkqTi*jWkG$bV!d3$cRkHjBsQ@ zR%AnVq7VwB2#TT@ilYQdq7+Ia5@k>pjulvmRalKRSc`R7j}3^&Mr^`nY{6D+ z!*=YzPVB;N?7?2_!+spVK^($i9Klf>!*QIzNu0uIoWWU~!+Bi5MI_)7F5?QW;u@~w z25#aOZsQK_;vVkf0UqK};DQnZ+h?SBk#b>@*H2|aSaf3GX;4CjxcHzcfrN-lXM-X` z5*EiM1}3aZn=JHYlC-(f)J{DrEI!r!&{OF(?Rm)mH?M+2V%qxn#7(avPY0ePJShG+ HP&W8Kn* + @@ -283,6 +283,86 @@

眈眈探求 | TITLE URL + + 4810ab7e08b687ad36a8fc9ddb691030 + CVE-2023-51631 + 2024-05-02 00:15:07 + D-Link DIR-X3260 prog.cgi SetUsersSettings Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-X3260 routers. Authentication is required to exploit this vulnerability. The specific flaw exists within the prog.cgi binary, which handles HNAP requests made to the lighttpd webserver listening on TCP ports 80 and 443. The issue results from the lack of proper validation of a user-supplied string before copying it to a fixed-size stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21675. + 详情 + + + + f794dd352e24cfd5132fb016b4298b0f + CVE-2021-36594 + 2024-05-01 22:15:09 + SSRF in Oxwall 1.8.7 (11111) allows an attacker to execute arbitrary commands via Phar deserialization or internal API server or ... (via url parameter) + 详情 + + + + 0bf51b0e42be1ac0b6f59c2eeae87c98 + CVE-2021-36593 + 2024-05-01 22:15:09 + Oxwall 1.8.7 (11111) is vulnerable to Incorrect Access Control. Unauthenticated file upload allows an attacker to upload image files. + 详情 + + + + 16c1891aacfac54db2b539c550bdf731 + CVE-2024-4142 + 2024-05-01 21:15:51 + An Improper input validation vulnerability that could potentially lead to privilege escalation was discovered in JFrog Artifactory. Due to this vulnerability, users with low privileges may gain administrative access to the system. This issue can also be exploited in Artifactory platforms with anonymous access enabled. + 详情 + + + + 35efe05450f29c4c302e9400ae003c8d + CVE-2024-33423 + 2024-05-01 20:15:12 + Cross-Site Scripting (XSS) vulnerability in the Settings menu of CMSimple v5.15 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Logout parameter under the Language section. + 详情 + + + + 4c0b35638f89cc770b3781ca3dbf1484 + CVE-2024-33307 + 2024-05-01 20:15:12 + SourceCodester Laboratory Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via "Last Name" parameter in Create User. + 详情 + + + + 1f3afc8d73a9096a0b601f35b7fecb2e + CVE-2024-33306 + 2024-05-01 20:15:12 + SourceCodester Laboratory Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via "First Name" parameter in Create User. + 详情 + + + + 33313bde1f352d7a9eaeaa1ca8263713 + CVE-2024-25676 + 2024-05-01 20:15:12 + An issue was discovered in ViewerJS 0.5.8. A script from the component loads content via URL TAGs without properly sanitizing it. This leads to both open redirection and out-of-band resource loading. + 详情 + + + + 895333f55aa1938858d8eac91b80e6f9 + CVE-2024-24403 + 2024-05-01 20:15:12 + Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2024-30176. Reason: This record is a reservation duplicate of CVE-2024-30176. Notes: All CVE users should reference CVE-2024-30176 instead of this record. All references and descriptions in this record have been removed to prevent accidental usage. + 详情 + + + + f480f67e37e259de13dabe683c388cab + CVE-2023-46295 + 2024-05-01 20:15:12 + An issue was discovered in Teledyne FLIR M300 2.00-19. Unauthenticated remote code execution can occur in the web server. An attacker can exploit this by sending a POST request to the vulnerable PHP page. An attacker can elevate to root permissions with Sudo. + 详情 + + a1261b2c4b477c5b74cfeb25608072c7 CVE-2024-28979 @@ -443,86 +523,6 @@

眈眈探求 | 详情 - - e3bf125cf831009947f3bbfd387a6c6f - CVE-2024-4296 - 2024-04-29 02:15:06 - The account management interface of HGiga iSherlock (including MailSherlock, SpamSherlock, AuditSherlock) fails to filter special characters in certain function parameters, allowing remote attackers with administrative privileges to exploit this vulnerability to download arbitrary system files. - 详情 - - - - 71ba3a0585bb83f9918a0bb9ea6f7800 - CVE-2024-33903 - 2024-04-29 01:15:09 - In CARLA through 0.9.15.2, the collision sensor mishandles some situations involving pedestrians or bicycles, in part because the collision sensor function is not exposed to the Blueprint library. - 详情 - - - - 9dda4efd60143ba6b827d4bb0bff77fe - CVE-2024-33899 - 2024-04-29 00:15:07 - RARLAB WinRAR before 7.00, on Linux and UNIX platforms, allows attackers to spoof the screen output, or cause a denial of service, via ANSI escape sequences. - 详情 - - - - 283bb3000e0fc0f85206ca19e72fc6be - CVE-2024-33891 - 2024-04-28 23:15:07 - Delinea Secret Server before 11.7.000001 allows attackers to bypass authentication via the SOAP API in SecretServer/webservices/SSWebService.asmx. This is related to a hardcoded key, the use of the integer 2 for the Admin user, and removal of the oauthExpirationId attribute. - 详情 - - - - d05d84e1991b97aa5bcf00bf20b264f2 - CVE-2024-33331 - 2024-04-28 23:15:07 - Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2024-33891. Reason: This candidate is a reservation duplicate of CVE-2024-33891. Notes: All CVE users should reference CVE-2024-33891 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. - 详情 - - - - 72b1317d4082c7b4b6d96ed0b6ada2a8 - CVE-2024-33883 - 2024-04-28 16:15:23 - The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection. - 详情 - - - - 8a3d9e9f0be0277a2dad498aab208cd1 - CVE-2024-25050 - 2024-04-28 13:15:08 - IBM i 7.2, 7.3, 7.4, 7.5 and IBM Rational Development Studio for i 7.2, 7.3, 7.4, 7.5 networking and compiler infrastructure could allow a local user to gain elevated privileges due to an unqualified library call. A malicious actor could cause user-controlled code to run with administrator privileges. IBM X-Force ID: 283242. - 详情 - - - - e51bd18511f85dd246f6c515ec2af7ad - CVE-2022-48668 - 2024-04-28 13:15:08 - In the Linux kernel, the following vulnerability has been resolved: smb3: fix temporary data corruption in collapse range collapse range doesn't discard the affected cached region so can risk temporarily corrupting the file data. This fixes xfstest generic/031 I also decided to merge a minor cleanup to this into the same patch (avoiding rereading inode size repeatedly unnecessarily) to make it clearer. - 详情 - - - - 15e45ef5b7a214d58aadeca8b3096422 - CVE-2022-48667 - 2024-04-28 13:15:08 - In the Linux kernel, the following vulnerability has been resolved: smb3: fix temporary data corruption in insert range insert range doesn't discard the affected cached region so can risk temporarily corrupting file data. Also includes some minor cleanup (avoiding rereading inode size repeatedly unnecessarily) to make it clearer. - 详情 - - - - b694c1138e76c76fa8e0c545655608f2 - CVE-2022-48666 - 2024-04-28 13:15:08 - In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fix a use-after-free There are two .exit_cmd_priv implementations. Both implementations use resources associated with the SCSI host. Make sure that these resources are still available when .exit_cmd_priv is called by waiting inside scsi_remove_host() until the tag set has been freed. This commit fixes the following use-after-free: ================================================================== BUG: KASAN: use-after-free in srp_exit_cmd_priv+0x27/0xd0 [ib_srp] Read of size 8 at addr ffff888100337000 by task multipathd/16727 Call Trace: dump_stack_lvl+0x34/0x44 print_report.cold+0x5e/0x5db kasan_report+0xab/0x120 srp_exit_cmd_priv+0x27/0xd0 [ib_srp] scsi_mq_exit_request+0x4d/0x70 blk_mq_free_rqs+0x143/0x410 __blk_mq_free_map_and_rqs+0x6e/0x100 blk_mq_free_tag_set+0x2b/0x160 scsi_host_dev_release+0xf3/0x1a0 device_release+0x54/0xe0 kobject_put+0xa5/0x120 device_release+0x54/0xe0 kobject_put+0xa5/0x120 scsi_device_dev_release_usercontext+0x4c1/0x4e0 execute_in_process_context+0x23/0x90 device_release+0x54/0xe0 kobject_put+0xa5/0x120 scsi_disk_release+0x3f/0x50 device_release+0x54/0xe0 kobject_put+0xa5/0x120 disk_release+0x17f/0x1b0 device_release+0x54/0xe0 kobject_put+0xa5/0x120 dm_put_table_device+0xa3/0x160 [dm_mod] dm_put_device+0xd0/0x140 [dm_mod] free_priority_group+0xd8/0x110 [dm_multipath] free_multipath+0x94/0xe0 [dm_multipath] dm_table_destroy+0xa2/0x1e0 [dm_mod] __dm_destroy+0x196/0x350 [dm_mod] dev_remove+0x10c/0x160 [dm_mod] ctl_ioctl+0x2c2/0x590 [dm_mod] dm_ctl_ioctl+0x5/0x10 [dm_mod] __x64_sys_ioctl+0xb4/0xf0 dm_ctl_ioctl+0x5/0x10 [dm_mod] __x64_sys_ioctl+0xb4/0xf0 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x46/0xb0 - 详情 - -