diff --git a/cache/Nsfocus.dat b/cache/Nsfocus.dat index c0f7d7f58a0..7c1f2bccfd0 100644 --- a/cache/Nsfocus.dat +++ b/cache/Nsfocus.dat @@ -105,3 +105,18 @@ c1104e121dedd93008ec08ec6d99ead2 2582f2f830bccde9b8335adc68d16c6a 5cb8905bf02711857d8047922e64a66f 9c40576dc6b23a4860b784361f146cf1 +caadcc05c1989a087e6db4fc6e8253f8 +b330203da07b0eb590da57ad5678c3cf +a7c420f4d7cf17b006a54a151b0f3595 +924b4ba551fad3642be6b2e804bb472c +38581a23d63e63403f15028f1610c49e +2d4edd918ce1ca3dc9e82719be1b071d +2854d8150ae02684543f313a8963619b +0e56769fcaf815af6d808232aee51fd9 +ca02ac81b19cd0cddddfcbdd3690cdfd +4d963cb9b306d566e111a67cb1e792e6 +a271b99ab7121de68330567567375694 +0db2cc897276c86e072bd6cf5d307191 +a8c356386402871a9f587e9a452afa6b +3ed137719ee4b0d107ce01cbe2f52365 +1a658c7b99bbcd91fae75f04ba20b368 diff --git a/data/cves.db b/data/cves.db index e2dd16b5517..c44b4cbf266 100644 Binary files a/data/cves.db and b/data/cves.db differ diff --git a/docs/index.html b/docs/index.html index 8bd15b45316..4a7c234dad1 100644 --- a/docs/index.html +++ b/docs/index.html @@ -1,4 +1,4 @@ - + @@ -286,7 +286,7 @@

眈眈探求 | + 2024-11-23 07:38:07 The WPGYM - Wordpress Gym Management System plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the MJ_gmgt_add_staff_member() function in all versions up to, and including, 67.1.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to create new user accounts with the administrator role. 详情 @@ -294,7 +294,7 @@

眈眈探求 | + 2024-11-23 07:38:07 The School Management System for Wordpress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the mj_smgt_user_avatar_image_upload() function in all versions up to, and including, 91.5.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. 详情 @@ -302,7 +302,7 @@

眈眈探求 | + 2024-11-23 07:38:06 The WPGYM - Wordpress Gym Management System plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the MJ_gmgt_user_avatar_image_upload() function in all versions up to, and including, 67.1.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. 详情 @@ -310,7 +310,7 @@

眈眈探求 | + 2024-11-23 07:38:05 The FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.82 via deserialization of untrusted input in the 'formatResult' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. The vulnerability was partially patched in version 2.2.82. 详情 @@ -318,7 +318,7 @@

眈眈探求 | + 2024-11-23 07:38:03 The School Management System for Wordpress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the mj_smgt_load_documets_new() and mj_smgt_load_documets() functions in all versions up to, and including, 91.5.0. This makes it possible for authenticated attackers, with Student-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. 详情 @@ -326,7 +326,7 @@

眈眈探求 | + 2024-11-23 06:54:54 The Checkout with Cash App on WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the '_wp_http_referer' parameter in several files in all versions up to, and including, 6.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. 详情 @@ -334,7 +334,7 @@

眈眈探求 | + 2024-11-23 06:54:53 The Chessgame Shizzle plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'cs_nonce' parameter in all versions up to, and including, 1.3.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. 详情 @@ -342,7 +342,7 @@

眈眈探求 | + 2024-11-23 06:54:49 The Custom CSS, JS & PHP plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.3.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. 详情 @@ -350,7 +350,7 @@

眈眈探求 | + 2024-11-23 05:40:11 The Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder plugin for WordPress is vulnerable to POST-Based Reflected Cross-Site Scripting via the Custom HTML Form parameters in all versions up to, and including, 6.16.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. 详情 @@ -358,7 +358,7 @@

眈眈探求 | + 2024-11-23 04:32:22 The AutoListicle: Automatically Update Numbered List Articles plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'auto-list-number' shortcode in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. 详情 @@ -366,7 +366,7 @@

眈眈探求 | + 2024-11-23 02:05:58 Ubuntu's implementation of pulseaudio can be crashed by a malicious program if a bluetooth headset is connected. 详情 @@ -2108,123 +2108,123 @@

眈眈探求 | - OpenText Self Service Password Reset跨站脚本漏洞 - 详情 + caadcc05c1989a087e6db4fc6e8253f8 + CVE-2024-49675 + 2024-11-25 03:34:23 + WordPress plugin iBryl Switch User认证绕过漏洞 + 详情 - 770d478ba8e0f37d04724782037a69d1 - CVE-2024-37008 - 2024-11-25 03:30:34 - Autodesk Revit基于栈的缓冲区溢出漏洞 - 详情 + b330203da07b0eb590da57ad5678c3cf + CVE-2024-47904 + 2024-11-25 03:34:23 + Siemens InterMesh 7177和Siemens InterMesh命令执行漏洞 + 详情 - 49cb105a55db96d7875934cc7d8f2010 - CVE-2023-49198 - 2024-11-25 03:30:34 - Apache SeaTunnel信息泄露漏洞 - 详情 + a7c420f4d7cf17b006a54a151b0f3595 + CVE-2024-47575 + 2024-11-25 03:34:23 + Fortinet FortiManager访问控制错误漏洞 + 详情 - 6b32df25960aadfcdf8b712f6a2ee707 - CVE-2023-22576 - 2024-11-25 03:30:34 - Dell Repository Manager本地权限提升漏洞 - 详情 + 924b4ba551fad3642be6b2e804bb472c + CVE-2024-49370 + 2024-11-25 03:34:23 + Pimcore信息泄露漏洞 + 详情 - 185d7a461bb56ebfdb136c3074b93b14 - CVE-2024-7854 - 2024-11-25 03:30:34 - WordPress插件Woo Inquiry SQL注入漏洞 - 详情 + 38581a23d63e63403f15028f1610c49e + CVE-2024-10290 + 2024-11-25 03:34:23 + ZZCMS信息泄露漏洞 + 详情 - fc6732cd537d4949db843a1f57a662f0 - CVE-2024-7651 - 2024-11-25 03:30:34 - WordPress插件App Builder有限SQL注入漏洞 - 详情 + 2d4edd918ce1ca3dc9e82719be1b071d + CVE-2024-10283 + 2024-11-25 03:34:23 + Tenda缓冲区溢出漏洞 + 详情 - 0e40a1a31f88e929617a398dff784790 - CVE-2024-7647 - 2024-11-25 03:30:34 - WordPress插件OTA Sync Booking Engine Widget跨站请求伪造漏洞 - 详情 + 2854d8150ae02684543f313a8963619b + CVE-2024-50050 + 2024-11-25 03:34:23 + Meta Llama Llama Stack远程代码执行漏洞 + 详情 - 6b022e6d47ab8aac3f3876957d59c406 - CVE-2024-7998 - 2024-11-25 03:30:34 - Octopus Server Cookie使用错误过期时间漏洞 - 详情 + 0e56769fcaf815af6d808232aee51fd9 + CVE-2024-10280 + 2024-11-25 03:34:23 + Tenda多款产品存在代码问题漏洞 + 详情 - 4b951bf11171b68468c1d3c493b0c35c - CVE-2024-5335 - 2024-11-25 03:30:34 - WordPress插件Ultimate Store Kit PHP对象注入漏洞 - 详情 + ca02ac81b19cd0cddddfcbdd3690cdfd + CVE-2024-10250 + 2024-11-25 03:34:23 + WordPress plugin Nioland跨站脚本漏洞 + 详情 - 6af3fbe5d64ca5cf96ebcd47fa183832 - CVE-2024-6339 - 2024-11-25 03:30:34 - WordPress主题Phlox PRO反射型跨站脚本漏洞 - 详情 + 4d963cb9b306d566e111a67cb1e792e6 + CVE-2024-10041 + 2024-11-25 03:34:23 + Linux Linux-pam命令执行漏洞 + 详情 - 79f6ab7f554c8dcef937b7babac593a4 - CVE-2024-7629 - 2024-11-25 03:30:34 - WordPress视频插件Responsive存储型跨站脚本漏洞 - 详情 + a271b99ab7121de68330567567375694 + CVE-2024-49653 + 2024-11-25 03:34:23 + WordPress plugin Portfolleo文件无限制上传漏洞 + 详情 - ecff4bdb9561d6a89d2c3e45771f245e - CVE-2024-7390 - 2024-11-25 03:30:34 - WordPress插件WP Testimonial Widget未授权数据修改漏洞 - 详情 + 0db2cc897276c86e072bd6cf5d307191 + CVE-2024-49657 + 2024-11-25 03:34:23 + WordPress plugin 3D Work In Progress缺少授权漏洞 + 详情 - 4d8ba8452ee0e04c237766dd6f29d784 - CVE-2024-45242 - 2024-11-22 09:24:20 - EnGenius ENH1350EXT命令执行漏洞 - 详情 + a8c356386402871a9f587e9a452afa6b + CVE-2024-49676 + 2024-11-25 03:34:23 + WordPress plugin Custom Icons for Elementor代码问题漏洞 + 详情 - fb6ef77fd43b58da25f1b8f830cec2c9 - CVE-2024-6814 - 2024-11-22 09:24:20 - NETGEAR ProSAFE Network Management System SQL注入漏洞 - 详情 + 3ed137719ee4b0d107ce01cbe2f52365 + CVE-2024-49684 + 2024-11-25 03:34:23 + WordPress plugin Backup and Staging by WP Time Capsule代码问题漏洞 + 详情 - 7ea647e0658782efd486684c34638c6c - CVE-2024-48424 - 2024-11-22 09:24:20 - assimp堆栈缓冲区溢出漏洞 - 详情 + 1a658c7b99bbcd91fae75f04ba20b368 + CVE-2024-49669 + 2024-11-25 03:34:23 + WordPress plugin INK Official代码问题漏洞 + 详情