Skip to content

Commit

Permalink
Updated by Github Bot
Browse files Browse the repository at this point in the history
  • Loading branch information
Github-Bot committed Mar 6, 2024
1 parent e0237bb commit 503d956
Show file tree
Hide file tree
Showing 3 changed files with 91 additions and 81 deletions.
10 changes: 10 additions & 0 deletions cache/Tenable (Nessus).dat
View file
Original file line number Diff line number Diff line change
Expand Up @@ -153,3 +153,13 @@ e705e2061906416d27b57c3e4074b308
2446b3bb481e971a6e8caae83c710a33
f4da2c7f26d24bae12b910f0f5709b9f
cfaced957e458a6bb6cf534426fd3853
ea95d9e88f5b6c26b5612f223c42e3a5
32d3e67523dbc15d53169a3b8d269771
b0b6a6db92fc5e1333838f83f64c2267
b39740862ccc3bf6f4f7d8847c144361
ac0977b2e9226fa2617a7cdbd31a1eaf
a12e6709f2372fba2bedeb76e6ee98f1
1bde3a0016dbe1bffed80582b4a87f29
881f070e95c767cf158ee51c5fb3fecc
fa72333eeec3853c565bbd783727f727
98af55805385d19566f4abc70c0dd3e6
Binary file modified data/cves.db
View file
Binary file not shown.
162 changes: 81 additions & 81 deletions docs/index.html
View file
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
<!-- RELEASE TIME : 2024-03-06 09:22:57 -->
<!-- RELEASE TIME : 2024-03-06 21:19:54 -->
<html lang="zh-cn">

<head>
Expand Down Expand Up @@ -283,6 +283,86 @@ <h2><a href="https://exp-blog.com" target="_blank">眈眈探求</a> | <a href="h
<th width="43%">TITLE</th>
<th width="5%">URL</th>
</tr>
<tr>
<td>ea95d9e88f5b6c26b5612f223c42e3a5</td>
<td>CVE-2024-2176</td>
<td>2024-03-06 19:15:09 <img src="imgs/new.gif" /></td>
<td>Use after free in FedCM in Google Chrome prior to 122.0.6261.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2024-2176">详情</a></td>
</tr>

<tr>
<td>32d3e67523dbc15d53169a3b8d269771</td>
<td>CVE-2024-2174</td>
<td>2024-03-06 19:15:09 <img src="imgs/new.gif" /></td>
<td>Inappropriate implementation in V8 in Google Chrome prior to 122.0.6261.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2024-2174">详情</a></td>
</tr>

<tr>
<td>b0b6a6db92fc5e1333838f83f64c2267</td>
<td>CVE-2024-27304</td>
<td>2024-03-06 19:15:08 <img src="imgs/new.gif" /></td>
<td>pgx is a PostgreSQL driver and toolkit for Go. SQL injection can occur if an attacker can cause a single query or bind message to exceed 4 GB in size. An integer overflow in the calculated message size can cause the one large message to be sent as multiple messages under the attacker's control. The problem is resolved in v4.18.2 and v5.5.4. As a workaround, reject user input large enough to cause a single query or bind message to exceed 4 GB in size.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2024-27304">详情</a></td>
</tr>

<tr>
<td>b39740862ccc3bf6f4f7d8847c144361</td>
<td>CVE-2024-27303</td>
<td>2024-03-06 19:15:08 <img src="imgs/new.gif" /></td>
<td>electron-builder is a solution to package and build a ready for distribution Electron, Proton Native app for macOS, Windows and Linux. A vulnerability that only affects eletron-builder prior to 24.13.2 in Windows, the NSIS installer makes a system call to open cmd.exe via NSExec in the `.nsh` installer script. NSExec by default searches the current directory of where the installer is located before searching `PATH`. This means that if an attacker can place a malicious executable file named cmd.exe in the same folder as the installer, the installer will run the malicious file. Version 24.13.2 fixes this issue. No known workaround exists. The code executes at the installer-level before the app is present on the system, so there's no way to check if it exists in a current installer.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2024-27303">详情</a></td>
</tr>

<tr>
<td>ac0977b2e9226fa2617a7cdbd31a1eaf</td>
<td>CVE-2024-27302</td>
<td>2024-03-06 19:15:08 <img src="imgs/new.gif" /></td>
<td>go-zero is a web and rpc framework. Go-zero allows user to specify a CORS Filter with a configurable allows param - which is an array of domains allowed in CORS policy. However, the `isOriginAllowed` uses `strings.HasSuffix` to check the origin, which leads to bypass via a malicious domain. This vulnerability is capable of breaking CORS policy and thus allowing any page to make requests and/or retrieve data on behalf of other users. Version 1.4.4 fixes this issue.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2024-27302">详情</a></td>
</tr>

<tr>
<td>a12e6709f2372fba2bedeb76e6ee98f1</td>
<td>CVE-2024-27289</td>
<td>2024-03-06 19:15:08 <img src="imgs/new.gif" /></td>
<td>pgx is a PostgreSQL driver and toolkit for Go. Prior to version 4.18.2, SQL injection can occur when all of the following conditions are met: the non-default simple protocol is used; a placeholder for a numeric value must be immediately preceded by a minus; there must be a second placeholder for a string value after the first placeholder; both must be on the same line; and both parameter values must be user-controlled. The problem is resolved in v4.18.2. As a workaround, do not use the simple protocol or do not place a minus directly before a placeholder.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2024-27289">详情</a></td>
</tr>

<tr>
<td>1bde3a0016dbe1bffed80582b4a87f29</td>
<td>CVE-2024-2173</td>
<td>2024-03-06 19:15:08 <img src="imgs/new.gif" /></td>
<td>Out of bounds memory access in V8 in Google Chrome prior to 122.0.6261.111 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2024-2173">详情</a></td>
</tr>

<tr>
<td>881f070e95c767cf158ee51c5fb3fecc</td>
<td>CVE-2024-27288</td>
<td>2024-03-06 19:15:07 <img src="imgs/new.gif" /></td>
<td>1Panel is an open source Linux server operation and maintenance management panel. Prior to version 1.10.1-lts, users can use Burp to obtain unauthorized access to the console page. The vulnerability has been fixed in v1.10.1-lts. There are no known workarounds.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2024-27288">详情</a></td>
</tr>

<tr>
<td>fa72333eeec3853c565bbd783727f727</td>
<td>CVE-2024-27287</td>
<td>2024-03-06 19:15:07 <img src="imgs/new.gif" /></td>
<td>ESPHome is a system to control your ESP8266/ESP32 for Home Automation systems. Starting in version 2023.12.9 and prior to version 2024.2.2, editing the configuration file API in dashboard component of ESPHome version 2023.12.9 (command line installation and Home Assistant add-on) serves unsanitized data with `Content-Type: text/html; charset=UTF-8`, allowing a remote authenticated user to inject arbitrary web script and exfiltrate session cookies via Cross-Site scripting. It is possible for a malicious authenticated user to inject arbitrary Javascript in configuration files using a POST request to the /edit endpoint, the configuration parameter allows to specify the file to write. To trigger the XSS vulnerability, the victim must visit the page` /edit?configuration=[xss file]`. Abusing this vulnerability a malicious actor could perform operations on the dashboard on the behalf of a logged user, access sensitive information, create, edit and delete configuration files and flash firmware on managed boards. In addition to this, cookies are not correctly secured, allowing the exfiltration of session cookie values. Version 2024.2.2 contains a patch for this issue.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2024-27287">详情</a></td>
</tr>

<tr>
<td>98af55805385d19566f4abc70c0dd3e6</td>
<td>CVE-2024-25111</td>
<td>2024-03-06 19:15:07 <img src="imgs/new.gif" /></td>
<td>Squid is a web proxy cache. Starting in version 3.5.27 and prior to version 6.8, Squid may be vulnerable to a Denial of Service attack against HTTP Chunked decoder due to an uncontrolled recursion bug. This problem allows a remote attacker to cause Denial of Service when sending a crafted, chunked, encoded HTTP Message. This bug is fixed in Squid version 6.8. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives. There is no workaround for this issue.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2024-25111">详情</a></td>
</tr>

<tr>
<td>76fe749e528b0e0ba03347d2879ef0d0</td>
<td>CVE-2024-25858</td>
Expand Down Expand Up @@ -443,86 +523,6 @@ <h2><a href="https://exp-blog.com" target="_blank">眈眈探求</a> | <a href="h
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2023-45592">详情</a></td>
</tr>

<tr>
<td>1d25dc9028a2fb002cee371183e64d48</td>
<td>CVE-2024-2168</td>
<td>2024-03-04 21:15:07</td>
<td>A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/operations/expense_category.php of the component HTTP POST Request Handler. The manipulation of the argument status leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-255678 is the identifier assigned to this vulnerability.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2024-2168">详情</a></td>
</tr>

<tr>
<td>d9562e267e1dc49a83468ecca80b53ab</td>
<td>CVE-2024-1319</td>
<td>2024-03-04 21:15:07</td>
<td>The Events Tickets Plus WordPress plugin before 5.9.1 does not prevent users with at least the contributor role from leaking the attendees list on any post type regardless of status. (e.g. draft, private, pending review, password-protected, and trashed posts).</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2024-1319">详情</a></td>
</tr>

<tr>
<td>2c3d89d53a7c97a25463dccbc6237918</td>
<td>CVE-2024-1316</td>
<td>2024-03-04 21:15:07</td>
<td>The Event Tickets and Registration WordPress plugin before 5.8.1, Events Tickets Plus WordPress plugin before 5.9.1 does not prevent users with at least the contributor role from leaking the existence of certain events they shouldn't have access to. (e.g. draft, private, pending review, pw-protected, and trashed events).</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2024-1316">详情</a></td>
</tr>

<tr>
<td>96e31c0c4bf945562ebf093e6dd9367a</td>
<td>CVE-2024-27889</td>
<td>2024-03-04 20:15:50</td>
<td>Multiple SQL Injection vulnerabilities exist in the reporting application of the Arista Edge Threat Management - Arista NG Firewall (NGFW). A user with advanced report application access rights can exploit the SQL injection, allowing them to execute commands on the underlying operating system with elevated privileges.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2024-27889">详情</a></td>
</tr>

<tr>
<td>fec974cbd701fc29682a21f3f394364a</td>
<td>CVE-2024-2048</td>
<td>2024-03-04 20:15:50</td>
<td>Vault and Vault Enterprise (“Vault”) TLS certificate auth method did not correctly validate client certificates when configured with a non-CA certificate as trusted certificate. In this configuration, an attacker may be able to craft a malicious certificate that could be used to bypass authentication. Fixed in Vault 1.15.5 and 1.14.10.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2024-2048">详情</a></td>
</tr>

<tr>
<td>97958b76da614589919e4983d43d023f</td>
<td>CVE-2023-6068</td>
<td>2024-03-04 20:15:50</td>
<td>On affected 7130 Series FPGA platforms running MOS and recent versions of the MultiAccess FPGA, application of ACL’s may result in incorrect operation of the configured ACL for a port resulting in some packets that should be denied being permitted and some</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2023-6068">详情</a></td>
</tr>

<tr>
<td>46602308321d0f2eb1b6be8fa8872cfa</td>
<td>CVE-2023-32331</td>
<td>2024-03-04 19:15:18</td>
<td>IBM Connect:Express for UNIX 1.5.0 is vulnerable to a buffer overflow that could allow a remote attacker to cause a denial of service through its browser UI. IBM X-Force ID: 254979.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2023-32331">详情</a></td>
</tr>

<tr>
<td>e90644165707cc3fbe045b23afb147cb</td>
<td>CVE-2021-47108</td>
<td>2024-03-04 19:15:18</td>
<td>In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: hdmi: Perform NULL pointer check for mtk_hdmi_conf In commit 41ca9caaae0b ("drm/mediatek: hdmi: Add check for CEA modes only") a check for CEA modes was added to function mtk_hdmi_bridge_mode_valid() in order to address possible issues on MT8167; moreover, with commit c91026a938c2 ("drm/mediatek: hdmi: Add optional limit on maximal HDMI mode clock") another similar check was introduced. Unfortunately though, at the time of writing, MT8173 does not provide any mtk_hdmi_conf structure and this is crashing the kernel with NULL pointer upon entering mtk_hdmi_bridge_mode_valid(), which happens as soon as a HDMI cable gets plugged in. To fix this regression, add a NULL pointer check for hdmi->conf in the said function, restoring HDMI functionality and avoiding NULL pointer kernel panics.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2021-47108">详情</a></td>
</tr>

<tr>
<td>7c0eaf649b34f374361868accc49200e</td>
<td>CVE-2021-47107</td>
<td>2024-03-04 19:15:18</td>
<td>In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix READDIR buffer overflow If a client sends a READDIR count argument that is too small (say, zero), then the buffer size calculation in the new init_dirlist helper functions results in an underflow, allowing the XDR stream functions to write beyond the actual buffer. This calculation has always been suspect. NFSD has never sanity- checked the READDIR count argument, but the old entry encoders managed the problem correctly. With the commits below, entry encoding changed, exposing the underflow to the pointer arithmetic in xdr_reserve_space(). Modern NFS clients attempt to retrieve as much data as possible for each READDIR request. Also, we have no unit tests that exercise the behavior of READDIR at the lower bound of @count values. Thus this case was missed during testing.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2021-47107">详情</a></td>
</tr>

<tr>
<td>a5b9327aee662195d51eb1fcdc5029ab</td>
<td>CVE-2021-47106</td>
<td>2024-03-04 19:15:18</td>
<td>In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fix use-after-free in nft_set_catchall_destroy() We need to use list_for_each_entry_safe() iterator because we can not access @catchall after kfree_rcu() call. syzbot reported: BUG: KASAN: use-after-free in nft_set_catchall_destroy net/netfilter/nf_tables_api.c:4486 [inline] BUG: KASAN: use-after-free in nft_set_destroy net/netfilter/nf_tables_api.c:4504 [inline] BUG: KASAN: use-after-free in nft_set_destroy+0x3fd/0x4f0 net/netfilter/nf_tables_api.c:4493 Read of size 8 at addr ffff8880716e5b80 by task syz-executor.3/8871 CPU: 1 PID: 8871 Comm: syz-executor.3 Not tainted 5.16.0-rc5-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description.constprop.0.cold+0x8d/0x2ed mm/kasan/report.c:247 __kasan_report mm/kasan/report.c:433 [inline] kasan_report.cold+0x83/0xdf mm/kasan/report.c:450 nft_set_catchall_destroy net/netfilter/nf_tables_api.c:4486 [inline] nft_set_destroy net/netfilter/nf_tables_api.c:4504 [inline] nft_set_destroy+0x3fd/0x4f0 net/netfilter/nf_tables_api.c:4493 __nft_release_table+0x79f/0xcd0 net/netfilter/nf_tables_api.c:9626 nft_rcv_nl_event+0x4f8/0x670 net/netfilter/nf_tables_api.c:9688 notifier_call_chain+0xb5/0x200 kernel/notifier.c:83 blocking_notifier_call_chain kernel/notifier.c:318 [inline] blocking_notifier_call_chain+0x67/0x90 kernel/notifier.c:306 netlink_release+0xcb6/0x1dd0 net/netlink/af_netlink.c:788 __sock_release+0xcd/0x280 net/socket.c:649 sock_close+0x18/0x20 net/socket.c:1314 __fput+0x286/0x9f0 fs/file_table.c:280 task_work_run+0xdd/0x1a0 kernel/task_work.c:164 tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop kernel/entry/common.c:175 [inline] exit_to_user_mode_prepare+0x27e/0x290 kernel/entry/common.c:207 __syscall_exit_to_user_mode_work kernel/entry/common.c:289 [inline] syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:300 do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f75fbf28adb Code: 0f 05 48 3d 00 f0 ff ff 77 45 c3 0f 1f 40 00 48 83 ec 18 89 7c 24 0c e8 63 fc ff ff 8b 7c 24 0c 41 89 c0 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 89 44 24 0c e8 a1 fc ff ff 8b 44 RSP: 002b:00007ffd8da7ec10 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 RAX: 0000000000000000 RBX: 0000000000000004 RCX: 00007f75fbf28adb RDX: 00007f75fc08e828 RSI: ffffffffffffffff RDI: 0000000000000003 RBP: 00007f75fc08a960 R08: 0000000000000000 R09: 00007f75fc08e830 R10: 00007ffd8da7ed10 R11: 0000000000000293 R12: 00000000002067c3 R13: 00007ffd8da7ed10 R14: 00007f75fc088f60 R15: 0000000000000032 </TASK> Allocated by task 8886: kasan_save_stack+0x1e/0x50 mm/kasan/common.c:38 kasan_set_track mm/kasan/common.c:46 [inline] set_alloc_info mm/kasan/common.c:434 [inline] ____kasan_kmalloc mm/kasan/common.c:513 [inline] ____kasan_kmalloc mm/kasan/common.c:472 [inline] __kasan_kmalloc+0xa6/0xd0 mm/kasan/common.c:522 kasan_kmalloc include/linux/kasan.h:269 [inline] kmem_cache_alloc_trace+0x1ea/0x4a0 mm/slab.c:3575 kmalloc include/linux/slab.h:590 [inline] nft_setelem_catchall_insert net/netfilter/nf_tables_api.c:5544 [inline] nft_setelem_insert net/netfilter/nf_tables_api.c:5562 [inline] nft_add_set_elem+0x232e/0x2f40 net/netfilter/nf_tables_api.c:5936 nf_tables_newsetelem+0x6ff/0xbb0 net/netfilter/nf_tables_api.c:6032 nfnetlink_rcv_batch+0x1710/0x25f0 net/netfilter/nfnetlink.c:513 nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:634 [inline] nfnetlink_rcv+0x3af/0x420 net/netfilter/nfnetlink.c:652 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x904/0xdf0 net/netlink/af_netlink.c:1921 sock_sendmsg_nosec net/ ---truncated---</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2021-47106">详情</a></td>
</tr>

</tbody>
</table>
</div>
Expand Down

0 comments on commit 503d956

Please sign in to comment.