Skip to content

Commit

Permalink
Updated by Github Bot
Browse files Browse the repository at this point in the history
  • Loading branch information
Github-Bot committed Oct 28, 2023
1 parent 4ba1538 commit 1f7de8a
Show file tree
Hide file tree
Showing 4 changed files with 92 additions and 81 deletions.
1 change: 1 addition & 0 deletions cache/NVD.dat
View file
Original file line number Diff line number Diff line change
Expand Up @@ -115,3 +115,4 @@ b513882c0adddf31da71a4111709a10e
62eb925eb36e0740b0aba423ecd8bdcf
d408a0277aa3b28a8b865f57b0f4f976
3237028aa824a64c58e9acef30a40bcf
57d06f20078627c485c62a20e5df638f
10 changes: 10 additions & 0 deletions cache/Tenable (Nessus).dat
View file
Original file line number Diff line number Diff line change
Expand Up @@ -135,3 +135,13 @@ f9008697825f0dbbf8a1d9e902d7a164
b231cdc27be30d12984a3703c1334359
d889995319a8621f5e6f050e2973c0d6
313f77b0c6a6692a00777ffec988a419
816dc4cad0144805ddfa71ed5c6dfe41
fa57eed6b5de738d9e2c936d6c417a16
70d45c45619e084686862da87009f561
4b620574ab124381fe1d1ea307eb63b3
d776108961cc4d48e2f955f3e522a8a8
d0669e869ebfa680da5af802829f2ff2
4cc6da377c2295ff53ea0aaef30f5c62
980d101286ba9214102e41ccbb80742b
5b03f00a4632d4b0885d81031be539bd
f7163a39ecec937783a5aa98bc73bc80
Binary file modified data/cves.db
View file
Binary file not shown.
162 changes: 81 additions & 81 deletions docs/index.html
View file
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
<!-- RELEASE TIME : 2023-10-28 14:24:32 -->
<!-- RELEASE TIME : 2023-10-28 16:28:07 -->
<html lang="zh-cn">

<head>
Expand Down Expand Up @@ -283,6 +283,86 @@ <h2><a href="https://exp-blog.com" target="_blank">眈眈探求</a> | <a href="h
<th width="43%">TITLE</th>
<th width="5%">URL</th>
</tr>
<tr>
<td>816dc4cad0144805ddfa71ed5c6dfe41</td>
<td>CVE-2023-5426</td>
<td>2023-10-28 12:15:00 <img src="imgs/new.gif" /></td>
<td>The Post Meta Data Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pmdm_wp_delete_user_meta, pmdm_wp_delete_term_meta, and pmdm_wp_ajax_delete_meta functions in versions up to, and including, 1.2.0. This makes it possible for unauthenticated attackers to delete user, term, and post meta belonging to arbitrary users.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2023-5426">详情</a></td>
</tr>

<tr>
<td>fa57eed6b5de738d9e2c936d6c417a16</td>
<td>CVE-2023-5425</td>
<td>2023-10-28 12:15:00 <img src="imgs/new.gif" /></td>
<td>The Post Meta Data Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pmdm_wp_change_user_meta and pmdm_wp_change_post_meta functions in versions up to, and including, 1.2.0. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to gain elevated (e.g., administrator) privileges.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2023-5425">详情</a></td>
</tr>

<tr>
<td>70d45c45619e084686862da87009f561</td>
<td>CVE-2023-46215</td>
<td>2023-10-28 08:15:00 <img src="imgs/new.gif" /></td>
<td>Insertion of Sensitive Information into Log File vulnerability in Apache Airflow Celery provider, Apache Airflow. Sensitive information logged as clear text when rediss, amqp, rpc protocols are used as Celery result backend Note: the vulnerability is about the information exposed in the logs not about accessing the logs. This issue affects Apache Airflow Celery provider: from 3.3.0 through 3.4.0; Apache Airflow: from 1.10.0 through 2.6.3. Users are recommended to upgrade Airflow Celery provider to version 3.4.1 and Apache Airlfow to version 2.7.0 which fixes the issue.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2023-46215">详情</a></td>
</tr>

<tr>
<td>4b620574ab124381fe1d1ea307eb63b3</td>
<td>CVE-2023-46570</td>
<td>2023-10-28 02:15:00 <img src="imgs/new.gif" /></td>
<td>An out-of-bounds read in radare2 v.5.8.9 and before exists in the print_insn32 function of libr/arch/p/nds32/nds32-dis.h.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2023-46570">详情</a></td>
</tr>

<tr>
<td>d776108961cc4d48e2f955f3e522a8a8</td>
<td>CVE-2023-46569</td>
<td>2023-10-28 02:15:00 <img src="imgs/new.gif" /></td>
<td>An out-of-bounds read in radare2 v.5.8.9 and before exists in the print_insn32_fpu function of libr/arch/p/nds32/nds32-dis.h.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2023-46569">详情</a></td>
</tr>

<tr>
<td>d0669e869ebfa680da5af802829f2ff2</td>
<td>CVE-2023-46468</td>
<td>2023-10-28 01:15:00 <img src="imgs/new.gif" /></td>
<td>An issue in juzawebCMS v.3.4 and before allows a remote attacker to execute arbitrary code via a crafted file to the custom plugin function.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2023-46468">详情</a></td>
</tr>

<tr>
<td>4cc6da377c2295ff53ea0aaef30f5c62</td>
<td>CVE-2023-46467</td>
<td>2023-10-28 01:15:00 <img src="imgs/new.gif" /></td>
<td>Cross Site Scripting vulnerability in juzawebCMS v.3.4 and before allows a remote attacker to execute arbitrary code via a crafted payload to the username parameter of the registration page.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2023-46467">详情</a></td>
</tr>

<tr>
<td>980d101286ba9214102e41ccbb80742b</td>
<td>CVE-2023-43322</td>
<td>2023-10-28 01:15:00 <img src="imgs/new.gif" /></td>
<td>ZPE Systems, Inc Nodegrid OS v5.0.0 to v5.0.17, v5.2.0 to v5.2.19, v5.4.0 to v5.4.16, v5.6.0 to v5.6.13, v5.8.0 to v5.8.10, and v5.10.0 to v5.10.3 was discovered to contain a command injection vulnerability via the endpoint /v1/system/toolkit/files/.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2023-43322">详情</a></td>
</tr>

<tr>
<td>5b03f00a4632d4b0885d81031be539bd</td>
<td>CVE-2023-46587</td>
<td>2023-10-27 23:15:00 <img src="imgs/new.gif" /></td>
<td>Buffer Overflow vulnerability in XnView Classic v.2.51.5 allows a local attacker to execute arbitrary code via a crafted TIF file.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2023-46587">详情</a></td>
</tr>

<tr>
<td>f7163a39ecec937783a5aa98bc73bc80</td>
<td>CVE-2023-5834</td>
<td>2023-10-27 22:15:00 <img src="imgs/new.gif" /></td>
<td>HashiCorp Vagrant's Windows installer targeted a custom location with a non-protected path that could be junctioned, introducing potential for unauthorized file system writes. Fixed in Vagrant 2.4.0.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2023-5834">详情</a></td>
</tr>

<tr>
<td>12be577c13ba835bf30871fbbd39b0f2</td>
<td>CVE-2023-46604</td>
Expand Down Expand Up @@ -443,86 +523,6 @@ <h2><a href="https://exp-blog.com" target="_blank">眈眈探求</a> | <a href="h
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2023-5783">详情</a></td>
</tr>

<tr>
<td>d9ca5f6fb3c1f096936485da34e3f1f7</td>
<td>CVE-2023-46584</td>
<td>2023-10-25 22:15:00</td>
<td>SQL Injection vulnerability in PHPGurukul Nipah virus (NiV) " Testing Management System v.1.0 allows a remote attacker to escalate privileges via a crafted request to the new-user-testing.php endpoint.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2023-46584">详情</a></td>
</tr>

<tr>
<td>700ba582118273bb871376c79bd46f7a</td>
<td>CVE-2023-46583</td>
<td>2023-10-25 22:15:00</td>
<td>Cross-Site Scripting (XSS) vulnerability in PHPGurukul Nipah virus (NiV) " Testing Management System v.1.0 allows attackers to execute arbitrary code via a crafted payload injected into the State field.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2023-46583">详情</a></td>
</tr>

<tr>
<td>54c992384472c438e1693882a8beb79d</td>
<td>CVE-2023-46232</td>
<td>2023-10-25 22:15:00</td>
<td>era-compiler-vyper is the EraVM Vyper compiler for zkSync Era, a layer 2 rollup that uses zero-knowledge proofs to scale Ethereum. Prior to era-compiler-vype version 1.3.10, a bug prevented the initialization of the first immutable variable for Vyper contracts meeting certain criteria. The problem arises when there is a String or Array with more 256-bit words allocated than initialized. It results in the second word’s index unset, that is effectively set to 0, so the first immutable value with the actual 0 index is overwritten in the ImmutableSimulator. Version 1.3.10 fixes this issue by setting all indexes in advance. The problem will go away, but it will get more expensive if the user allocates a lot of uninitialized space, e.g. `String[4096]`. Upgrading and redeploying affected contracts is the only way of working around the issue.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2023-46232">详情</a></td>
</tr>

<tr>
<td>9bf8be84c9a46ccfde7225a18f514519</td>
<td>CVE-2023-38849</td>
<td>2023-10-25 22:15:00</td>
<td>An issue in tire-sales Line v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2023-38849">详情</a></td>
</tr>

<tr>
<td>f76bb349a39c215029136532a960d968</td>
<td>CVE-2023-38848</td>
<td>2023-10-25 22:15:00</td>
<td>An issue in rmc R Beauty CLINIC Line v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2023-38848">详情</a></td>
</tr>

<tr>
<td>6c4f4eb458b4c9a9c62d4f9ee20bb475</td>
<td>CVE-2023-38847</td>
<td>2023-10-25 22:15:00</td>
<td>An issue in CHRISTINA JAPAN Line v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2023-38847">详情</a></td>
</tr>

<tr>
<td>5d41f56893fbdd734e3f59c1b97b7d11</td>
<td>CVE-2023-38846</td>
<td>2023-10-25 22:15:00</td>
<td>An issue in Marbre Lapin Line v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2023-38846">详情</a></td>
</tr>

<tr>
<td>6466d42781a5b44119f158e37730cb6e</td>
<td>CVE-2023-38845</td>
<td>2023-10-25 22:15:00</td>
<td>An issue in Anglaise Company Anglaise.Company v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2023-38845">详情</a></td>
</tr>

<tr>
<td>225248201b9d9f30d25420b6bf0682dd</td>
<td>CVE-2023-46233</td>
<td>2023-10-25 21:15:00</td>
<td>crypto-js is a JavaScript library of crypto standards. Prior to version 4.2.0, crypto-js PBKDF2 is 1,000 times weaker than originally specified in 1993, and at least 1,300,000 times weaker than current industry standard. This is because it both defaults to SHA1, a cryptographic hash algorithm considered insecure since at least 2005, and defaults to one single iteration, a 'strength' or 'difficulty' value specified at 1,000 when specified in 1993. PBKDF2 relies on iteration count as a countermeasure to preimage and collision attacks. If used to protect passwords, the impact is high. If used to generate signatures, the impact is high. Version 4.2.0 contains a patch for this issue. As a workaround, configure crypto-js to use SHA256 with at least 250,000 iterations.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2023-46233">详情</a></td>
</tr>

<tr>
<td>65be023916966835305b48a90f2bd078</td>
<td>CVE-2023-46137</td>
<td>2023-10-25 21:15:00</td>
<td>Twisted is an event-based framework for internet applications. Prior to version 23.10.0rc1, when sending multiple HTTP requests in one TCP packet, twisted.web will process the requests asynchronously without guaranteeing the response order. If one of the endpoints is controlled by an attacker, the attacker can delay the response on purpose to manipulate the response of the second request when a victim launched two requests using HTTP pipeline. Version 23.10.0rc1 contains a patch for this issue.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2023-46137">详情</a></td>
</tr>

</tbody>
</table>
</div>
Expand Down

0 comments on commit 1f7de8a

Please sign in to comment.