Skip to content

Commit

Permalink
Updated by Github Bot
Browse files Browse the repository at this point in the history
  • Loading branch information
Github-Bot committed Feb 16, 2024
1 parent 7a17cc9 commit 5667f1c
Show file tree
Hide file tree
Showing 3 changed files with 91 additions and 81 deletions.
10 changes: 10 additions & 0 deletions cache/Tenable (Nessus).dat
View file
Original file line number Diff line number Diff line change
Expand Up @@ -198,3 +198,13 @@ bf6ad87d2a8511d99f253c17c79dcdd3
e21bfe93720eca43aebe350aa7426243
c549c1e3e23fe847b0cac550846cbdc3
c97466358b23783d42d48f5c6667eb6b
53c6301f0b16a3aa4a5ee955344de741
574016161377ae9ae1592699188687af
00e0ec8936dea0b4a966b587ff45428d
70578916122a5d2d34fb945f0a99dc68
b912c9386d4340744f88103808ae773e
47b8143ac434ef799ef39620e99cf8f6
d1bfee929a23cf2ece3a7993813cec56
909d302aba10cbd9780b93203f2fa1f3
f9999686045b837373b3ea9157837116
b7831d3ab4efc3db55ce206998468ce1
Binary file modified data/cves.db
View file
Binary file not shown.
162 changes: 81 additions & 81 deletions docs/index.html
View file
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
<!-- RELEASE TIME : 2024-02-16 03:24:14 -->
<!-- RELEASE TIME : 2024-02-16 21:19:57 -->
<html lang="zh-cn">

<head>
Expand Down Expand Up @@ -283,6 +283,86 @@ <h2><a href="https://exp-blog.com" target="_blank">眈眈探求</a> | <a href="h
<th width="43%">TITLE</th>
<th width="5%">URL</th>
</tr>
<tr>
<td>53c6301f0b16a3aa4a5ee955344de741</td>
<td>CVE-2024-21915</td>
<td>2024-02-16 19:15:08 <img src="imgs/new.gif" /></td>
<td>A privilege escalation vulnerability exists in Rockwell Automation FactoryTalk® Service Platform (FTSP). If exploited, a malicious user with basic user group privileges could potentially sign into the software and receive FTSP Administrator Group privileges. A threat actor could potentially read and modify sensitive data, delete data and render the FTSP system unavailable.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2024-21915">详情</a></td>
</tr>

<tr>
<td>574016161377ae9ae1592699188687af</td>
<td>CVE-2024-1591</td>
<td>2024-02-16 19:15:08 <img src="imgs/new.gif" /></td>
<td>Prior to version 24.1, a local authenticated attacker can view Sysvol when Privilege Management for Windows is configured to use a GPO policy. This allows them to view the policy and potentially find configuration issues.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2024-1591">详情</a></td>
</tr>

<tr>
<td>00e0ec8936dea0b4a966b587ff45428d</td>
<td>CVE-2024-0015</td>
<td>2024-02-16 19:15:08 <img src="imgs/new.gif" /></td>
<td>In convertToComponentName of DreamService.java, there is a possible way to launch arbitrary protected activities due to intent redirection. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2024-0015">详情</a></td>
</tr>

<tr>
<td>70578916122a5d2d34fb945f0a99dc68</td>
<td>CVE-2023-40085</td>
<td>2024-02-16 19:15:08 <img src="imgs/new.gif" /></td>
<td>In convertSubgraphFromHAL of ShimConverter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2023-40085">详情</a></td>
</tr>

<tr>
<td>b912c9386d4340744f88103808ae773e</td>
<td>CVE-2023-21165</td>
<td>2024-02-16 19:15:08 <img src="imgs/new.gif" /></td>
<td>In DevmemIntUnmapPMR of devicemem_server.c, there is a possible arbitrary code execution due to a use after free. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2023-21165">详情</a></td>
</tr>

<tr>
<td>47b8143ac434ef799ef39620e99cf8f6</td>
<td>CVE-2024-1515</td>
<td>2024-02-16 18:15:07 <img src="imgs/new.gif" /></td>
<td>Rejected reason: Erroneous assignement</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2024-1515">详情</a></td>
</tr>

<tr>
<td>d1bfee929a23cf2ece3a7993813cec56</td>
<td>CVE-2024-23591</td>
<td>2024-02-16 17:15:08 <img src="imgs/new.gif" /></td>
<td>ThinkSystem SR670V2 servers manufactured from approximately June 2021 to July 2023 were left in Manufacturing Mode which could allow an attacker with privileged logical access to the host or physical access to server internals to modify or disable Intel Boot Guard firmware integrity, SPS security, and other SPS configuration setting.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2024-23591">详情</a></td>
</tr>

<tr>
<td>909d302aba10cbd9780b93203f2fa1f3</td>
<td>CVE-2024-1444</td>
<td>2024-02-16 17:15:08 <img src="imgs/new.gif" /></td>
<td>Rejected reason: Erroneous assignment</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2024-1444">详情</a></td>
</tr>

<tr>
<td>f9999686045b837373b3ea9157837116</td>
<td>CVE-2024-1342</td>
<td>2024-02-16 16:15:57 <img src="imgs/new.gif" /></td>
<td>A flaw was found in OpenShift. The existing Cross-Site Request Forgery (CSRF) protections in place do not properly protect GET requests, allowing for the creation of WebSockets via CSRF.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2024-1342">详情</a></td>
</tr>

<tr>
<td>b7831d3ab4efc3db55ce206998468ce1</td>
<td>CVE-2024-25320</td>
<td>2024-02-16 15:15:08 <img src="imgs/new.gif" /></td>
<td>Tongda OA v2017 and up to v11.9 was discovered to contain a SQL injection vulnerability via the $AFF_ID parameter at /affair/delete.php.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2024-25320">详情</a></td>
</tr>

<tr>
<td>f4b6c8602f534398ec169444ba866ec5</td>
<td>CVE-2024-25620</td>
Expand Down Expand Up @@ -443,86 +523,6 @@ <h2><a href="https://exp-blog.com" target="_blank">眈眈探求</a> | <a href="h
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2024-25120">详情</a></td>
</tr>

<tr>
<td>932602bf23ed6be6fa7cd58444930af1</td>
<td>CVE-2023-6815</td>
<td>2024-02-13 07:15:46</td>
<td>Incorrect Privilege Assignment vulnerability in Mitsubishi Electric Corporation MELSEC iQ-R Series Safety CPU R08/16/32/120SFCPU all versions and MELSEC iQ-R Series SIL2 Process CPU R08/16/32/120PSFCPU all versions allows a remote authenticated attacker who has logged into the product as a non-administrator user to disclose the credentials (user ID and password) of a user with a lower access level than the attacker by sending a specially crafted packet.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2023-6815">详情</a></td>
</tr>

<tr>
<td>42df8328796113c645b60c784cbbaf87</td>
<td>CVE-2024-25914</td>
<td>2024-02-13 05:15:09</td>
<td>Cross-Site Request Forgery (CSRF) vulnerability in Photoboxone SMTP Mail.This issue affects SMTP Mail: from n/a through 1.3.20.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2024-25914">详情</a></td>
</tr>

<tr>
<td>ed5cca03f52b4cfb895ff92a9211bad3</td>
<td>CVE-2024-21491</td>
<td>2024-02-13 05:15:08</td>
<td>Versions of the package svix before 1.17.0 are vulnerable to Authentication Bypass due to an issue in the verify function where signatures of different lengths are incorrectly compared. An attacker can bypass signature verification by providing a shorter signature that matches the beginning of the actual signature. **Note:** The attacker would need to know a victim uses the Rust library for verification,no easy way to automatically check that; and uses webhooks by a service that uses Svix, and then figure out a way to craft a malicious payload that will actually include all of the correct identifiers needed to trick the receivers to cause actual issues.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2024-21491">详情</a></td>
</tr>

<tr>
<td>954baa39956472e2e4f25604d4de7005</td>
<td>CVE-2023-52431</td>
<td>2024-02-13 05:15:08</td>
<td>The Plack::Middleware::XSRFBlock package before 0.0.19 for Perl allows attackers to bypass a CSRF protection mechanism via an empty form value and an empty cookie (if signed cookies are disabled).</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2023-52431">详情</a></td>
</tr>

<tr>
<td>3d503e6f01e58b930dbdd8267b9ccafa</td>
<td>CVE-2022-48623</td>
<td>2024-02-13 05:15:08</td>
<td>The Cpanel::JSON::XS package before 4.33 for Perl performs out-of-bounds accesses in a way that allows attackers to obtain sensitive information or cause a denial of service.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2022-48623">详情</a></td>
</tr>

<tr>
<td>7b1de36105bcebb60b0301f47e2b21aa</td>
<td>CVE-2024-25643</td>
<td>2024-02-13 04:15:08</td>
<td>The SAP Fiori app (My Overtime Request) - version 605, does not perform the necessary authorization checks for an authenticated user which may result in an escalation of privileges. It is possible to manipulate the URLs of data requests to access information that the user should not have access to. There is no impact on integrity and availability.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2024-25643">详情</a></td>
</tr>

<tr>
<td>c82f8b94754d3c8405cad1cc1c24367c</td>
<td>CVE-2024-24741</td>
<td>2024-02-13 04:15:08</td>
<td>SAP Master Data Governance for Material Data - versions 618, 619, 620, 621, 622, 800, 801, 802, 803, 804, does not perform necessary authorization check for an authenticated user, resulting in escalation of privileges. This could allow an attacker to read some sensitive information but no impact to integrity and availability.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2024-24741">详情</a></td>
</tr>

<tr>
<td>f2f1e142d82a127a8a75009515df0d81</td>
<td>CVE-2024-22129</td>
<td>2024-02-13 04:15:08</td>
<td>SAP Companion - version <3.1.38, has a URL with parameter that could be vulnerable to XSS attack. The attacker could send a malicious link to a user that would possibly allow an attacker to retrieve the sensitive information and cause minor impact on the integrity of the web application.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2024-22129">详情</a></td>
</tr>

<tr>
<td>4e8a6504adf3b01184d90663573b87cd</td>
<td>CVE-2024-22024</td>
<td>2024-02-13 04:15:07</td>
<td>An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy Secure (9.x, 22.x) and ZTA gateways which allows an attacker to access certain restricted resources without authentication.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2024-22024">详情</a></td>
</tr>

<tr>
<td>fedcff969fe657533267a92fe0fa8bc9</td>
<td>CVE-2024-25642</td>
<td>2024-02-13 03:15:09</td>
<td>Due to improper validation of certificate in SAP Cloud Connector - version 2.0, attacker can impersonate the genuine servers to interact with SCC breaking the mutual authentication. Hence, the attacker can intercept the request to view/modify sensitive information. There is no impact on the availability of the system.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2024-25642">详情</a></td>
</tr>

</tbody>
</table>
</div>
Expand Down

0 comments on commit 5667f1c

Please sign in to comment.