From 795975e7f75117a12a7fed9cd0b777de901b5333 Mon Sep 17 00:00:00 2001 From: Github-Bot Date: Wed, 24 Apr 2024 03:25:14 +0000 Subject: [PATCH] Updated by Github Bot --- cache/Nsfocus.dat | 15 +++ cache/RedQueen.dat | 2 + data/cves.db | Bin 47202304 -> 47206400 bytes docs/index.html | 292 ++++++++++++++++++++++----------------------- 4 files changed, 163 insertions(+), 146 deletions(-) diff --git a/cache/Nsfocus.dat b/cache/Nsfocus.dat index 11cc4ce0ab8..ec350ce5521 100644 --- a/cache/Nsfocus.dat +++ b/cache/Nsfocus.dat @@ -188,3 +188,18 @@ d6c5c294d48a46d68f8b7b82114744b3 ecb3931117c18f588d59321497d5ab03 3a1461afb1f7210c872c26397f023bdc 683bb70b842a85f8d42f09138e262e48 +d44a869f1f9124848e7d045c0ce9eb0b +72579810e7f195cdb385f919519e100a +114e50e70cd10a0834836de3bd59fd8a +df7e115fa5c7a7c13b06afea54deed61 +7eb62c06ef8ff48d16f9e1544666d3d8 +31b8d828a9e73fd10f5b974831cc68f7 +fdef16d6144db285f015307e82f07a9d +39ea8472a0942092df64eba3954bfddf +e9b819a96a928c1c8d1fb11fe625c841 +4b15b1b31e332a6ca6ae607e90d532d3 +967295d1e563f29a145094c01c1bed83 +02aa7712665d545a48955fe1cc272baa +c1e8d3f4847190513e5b33dea94114c3 +8a5bb5e975960c79ac61f263d909d0c9 +bf581ecb4d714c46e4c834f4b0e96c59 diff --git a/cache/RedQueen.dat b/cache/RedQueen.dat index 918d8598b82..bc3f215c793 100644 --- a/cache/RedQueen.dat +++ b/cache/RedQueen.dat @@ -175,3 +175,5 @@ d3030211dcec9a42a92987f13596ad55 e11870f3f07072687523d416df59c498 c2940fd6df7360d0eda5471b42246380 588937a2b4f6f9768ad4ea800d6c8998 +2ef04c4b02d59bbdfc4ea56ab259e4a6 +b6fea27f784cf473ec11a8ca7203bc70 diff --git a/data/cves.db b/data/cves.db index 2151ad2c3e6ba208eb5d4d651c77398fac12aa85..3afb0510f6099c346a67bc6171a999ce73bd6d46 100644 GIT binary patch delta 4638 zcma*pX`GJr8V7Lmn8A!0OCk|XN`xo(zNn<^YlMi(b+4Kj%giKNJ?U4dEUBhQ4^oy= zdMK4jDq2w5SD{V&zIUqgyU(d}&dl+m7vJkMytuFb@A@w@GiPpXF>~4077JPz^r%xO zU9hn9-;)gd7Ly1nCUv0!c%ThjfJ~ z5EY_9bcg{lAr{1jI1m@o4RQkHM94{y?vRrqJs_t*PKES@^n&z;^nvt+^n>(=41f%T z41x@X41t^m844K&IUO<_G6FIZat34+WHjVV$Qa02$XSrHA?HBGK{y`|;zI&R2#Fvu zWIW_tNEzfj$OOnlNI7H@WHMw5WGbWrQVFSooDZ1>xd1X9G6QlULuNs)fB={V{{ov90@>3Hf&3aO-#P6nA|kxdS{)QwJ{6X_)C zPA5|jI)zT9p45waQy=O}{ir_;pn)`q2GbBajfT=NI-Q2o2pUOe&?p*BXVMrNOJ~v9 zbPkQ9Wd0uc6i`SJ#WbGIr7}8?CeTDGr%5!KrqEQXph~Ku^JyAgK+|akT}T(v#dHZ> zN|(`0%FyLBi>@Hhm2?%&ra3g1uBL0~TAD}mX#p*y>u3>OPdCtwR82S0&9s=7&@Hr- zZlx?Oqvf=MZljfSJKaI6Xf>^&wR9)lMeFEpx`)=&y_BO3w2|(k`)LzBKo8PGw3!~J zN9a-7LXXi_dYqo1CutjPr>E#?dWN2*9ki2n(R1`X?WPy#MS6)|rdQ}ydW~MEH|R}z zi{7R^^bYN%eYBt6rT6H4`hY&91N0GnOrOxF^cj6lU(lEI6@5+L(6{s*eNR8okMtA$ zOux{t^bh)tey2b3=17XypHftp@~MF8QGIGag;YchshCQr5jCbJ)RYdPW^^burxtV= zwWPzT6}6@#s13EHBdL^*qIPsN9YgKuSn5C>={V{{ov90@>3Hf&3aO-#P6nA|kxdS{ z)QwJ{6X_)CPA5|jI)zT9p45waQy=O}{ir_;pn)`q2GbBajfT=NI-Q2o2pUOe&?p*B zXVMrNOJ~v9bPkQ9Wd0uc6i`SJ#WbGIr7}8?CeTDGr%5!KrqEQXph~Ku^JyAgK+|ak zT}T(v#dHZ>N|(`0%FyLBi>@Hhm2?%&ra3g1uBL0~TAD}mX#p*y>u3>OPdCtwR82S0 z&9s=7&@Hr-Zlx?Oqvf=MZljfSJKaI6Xf>^&wR9)lMeFEpx`)=&y_BO3w2|(k`%{m| zrqs&44IZw$v`+HJ-j?Ehn^M#2rW(G!<%;(wRb1zuI>i-*JL`W}Kd)ZPg2DN->Mly{Nj1vrUEQR|^$YuDnsSj1 z1|NRhK)qymXc(Sjxv?6%s%AKb6WO6+n1K>RZsaTefz4YEEXnpfqjy?UG$XBYW}2He+(1eDzG0;!J5n9r4oyq-G755T(l%3{Tja;4qeg*mgtp4| zR%8T@Zp2(iVG9maDJj%WJ58F4bMr3AL?1(q5!VCX7t zs01|^VWd@6(??CN2!~cgm6fHvr$v*hhE|l7XT46FQ>C?!%wV>2l}sb#?BrPXX1hR* zoKTN>AZ^uEOjVCeU)RIPa}AY4&}(Gos2$ZYMnzubjG-0PUpH#nJgfZie5$bC{~pXF zl&dD8tiM7jn&;WJs#%s9nuh5aj%%86qy~XzYrf~z>cUXQ-wxG3X{TjcAZI3_MlzIZ z*_vyHYGhh^tht_Qm=HE^?E7Y>%Sn4tDZfGl``A6-jp^kH38nz3gFwr2;b?kkqZciA+;DB{d&v`Ma}ZR*LMpE5K%^_z{UmbGvH*yI<6l4*rp zI+@Tow%`?yOeM0FfYb35zIKjog^}*_-Hk)%|L&!2+5g@0QzuRiCRENStvWX<&kk#` zGu6801f$|A3sQ*g5>+!KLMM!c5eUx delta 2758 zcmWmG^Ox5N7>41Q?=(%eIoY;t+x2AIo~fQ}+qNf9w$^N`ZQZKf*1SJIT=yUFob#UZ z#%#TkAtvTZhNW2}ON50LORy}uMtF%>S>aa5im(z`kyb)0%1UGkv! zU^TQFS&gkGR#U5))!b@fwX|AUt*tgzTdSSb-s)g=v^rUxtu9tqtDDu`>S3`@Ppg;J z+v;QWwfb58tpV0RYmhbA8e$E#hFQa{5!Og+lr`EKV~w@OS>vq<)v}RehW?OTtxz;>uzO}$wXf3i9TT85^)-r3kwZd9yt+G~IYpk`_I%~bP z!P;nTvNl^=tgY5IYrD0>+G*{wc3XR_z1BW!zjeSmXdSW+TSu&;)-mh2b;3Gnow80_ zan>2@taZ*hZ(Xo1T9>SN>#}vlx@ujsu3I;(o7OGswspt4Yu&T%TMw*<)+6h&^@jDP z^_KOv^^Wzf^`7;<^?~)F^^x_l^~CzbdTKqho?D+jT57v*?E9)ogXX~}~i}kDZoAtZ(hxMoRm-V;xkM*zh-#mpcQaD10KmtS}A)=57 ziID_JkqpU^0x6LSsgVY0kq+sR0U41AnUMuqkqz0A133|mT*!?)$cuc)j{+!&LMV(P zD2iezjuI$|QYeiwD2s9^j|!-WN~nw~sETT+jvAGd_j3F3`VHl1P z7>Q9BjWHODaTt#Yn21T3j47CkX_$@}#9{_!Vit_qn1i{Phxu55g;<2eSc0WkhUHj+ zl~{$;hy6H!gE)l4ID(@%hT}MalQ@Ob zh{GA2#W|eE1zf}>#N#rq;3}@+I&R=5Zs9iW;4bdrJ|5s99^oj!^pYStY;}`sj-|##B zz@PXFf8!tgi~qvsDa83Bga{-+BoZPDiI5mckQB*~94U|zsgN3JkQV8X9vP4knUEP- zkQLdG9XXH_(a43|$b-Ddhx{mjf+&Q-D1xFWhT4JD1)*nhw`X^il~IjsDi4f zhU%z+ny7`^sDrwwhx%xMhG>MwXo99_hURF2mS~06XoI$BhxX`zj_8EW=z^~3hVJNr zVE>-zh2H3czUYVk7=VEoguxhsp%{kY7=e)(h0z#;u^5N(n1G3xgvpqKshEc8h(Ro7 zU?yh4n2kA@i+Pxj1z3nhSd1lDie*@i6yzaz4m~AQyvN3KAdWa*!)Qt_HalNy-NN+0S_(2 diff --git a/docs/index.html b/docs/index.html index b2987a601ca..6048154839d 100644 --- a/docs/index.html +++ b/docs/index.html @@ -1,4 +1,4 @@ - + @@ -286,7 +286,7 @@

眈眈探求 | + 2024-04-22 23:15:51 A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with the envFrom field populated. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the kubernetes.io/enforce-mountable-secrets annotation are used together with containers, init containers, and ephemeral containers with the envFrom field populated. 详情 @@ -294,7 +294,7 @@

眈眈探求 | + 2024-04-22 23:15:50 Hydra is a Continuous Integration service for Nix based projects. Attackers can execute arbitrary code in the browser context of Hydra and execute authenticated HTTP requests. The abused feature allows Nix builds to specify files that Hydra serves to clients. One use of this functionality is serving NixOS `.iso` files. The issue is only with html files served by Hydra. The issue has been patched on https://hydra.nixos.org around 2024-04-21 14:30 UTC. The nixpkgs package were fixed in unstable and 23.11. Users with custom Hydra packages can apply the fix commit to their local installations. The vulnerability is only triggered when opening HTML build artifacts, so not opening them until the vulnerability is fixed works around the issue. 详情 @@ -302,7 +302,7 @@

眈眈探求 | + 2024-04-22 23:15:50 Ant Media Server is live streaming engine software. A local privilege escalation vulnerability in present in versions 2.6.0 through 2.8.2 allows any unprivileged operating system user account to escalate privileges to the root user account on the system. This vulnerability arises from Ant Media Server running with Java Management Extensions (JMX) enabled and authentication disabled on localhost on port 5599/TCP. This vulnerability is nearly identical to the local privilege escalation vulnerability CVE-2023-26269 identified in Apache James. Any unprivileged operating system user can connect to the JMX service running on port 5599/TCP on localhost and leverage the MLet Bean within JMX to load a remote MBean from an attacker-controlled server. This allows an attacker to execute arbitrary code within the Java process run by Ant Media Server and execute code within the context of the `antmedia` service account on the system. Version 2.9.0 contains a patch for the issue. As a workaround, one may remove certain parameters from the `antmedia.service` file. 详情 @@ -310,7 +310,7 @@

眈眈探求 | + 2024-04-22 23:15:50 jadx is a Dex to Java decompiler. Prior to version 1.5.0, the package name is not filtered before concatenation. This can be exploited to inject arbitrary code into the package name. The vulnerability allows an attacker to execute commands with shell privileges. Version 1.5.0 contains a patch for the vulnerability. 详情 @@ -318,7 +318,7 @@

眈眈探求 | + 2024-04-22 23:15:50 LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Versions prior to 24.4.0 are vulnerable to SQL injection. The `order` parameter is obtained from `$request`. After performing a string check, the value is directly incorporated into an SQL statement and concatenated, resulting in a SQL injection vulnerability. An attacker may extract a whole database this way. Version 24.4.0 fixes the issue. 详情 @@ -326,7 +326,7 @@

眈眈探求 | + 2024-04-22 22:15:08 LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Prior to version 24.4.0, there is improper sanitization on the `Service` template name, which can lead to stored Cross-site Scripting. Version 24.4.0 fixes this vulnerability. 详情 @@ -334,7 +334,7 @@

眈眈探求 | + 2024-04-22 22:15:07 LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A SQL injection vulnerability in POST /search/search=packages in LibreNMS prior to version 24.4.0 allows a user with global read privileges to execute SQL commands via the package parameter. With this vulnerability, an attacker can exploit a SQL injection time based vulnerability to extract all data from the database, such as administrator credentials. Version 24.4.0 contains a patch for the vulnerability. 详情 @@ -342,7 +342,7 @@

眈眈探求 | + 2024-04-22 22:15:07 FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based based clients using `/bpp:32` legacy `GDI` drawing path with a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, use modern drawing paths (e.g. `/rfx` or `/gfx` options). The workaround requires server side support. 详情 @@ -350,7 +350,7 @@

眈眈探求 | + 2024-04-22 22:15:07 FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients and servers that use a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. No known workarounds are available. 详情 @@ -358,7 +358,7 @@

眈眈探求 | + 2024-04-22 22:15:07 A heap-buffer-overflow vulnerability in the read_byte function in NanoMQ v.0.21.7 allows attackers to cause a denial of service via transmission of crafted hexstreams. 详情 @@ -1971,10 +1971,130 @@

眈眈探求 | TITLE URL + + d44a869f1f9124848e7d045c0ce9eb0b + CVE-2024-25501 + 2024-04-23 03:23:07 + Winmail任意代码执行漏洞 + 详情 + + + + 72579810e7f195cdb385f919519e100a + CVE-2024-28089 + 2024-04-23 03:23:07 + Hitron Technologies CODA-4582跨站脚本漏洞 + 详情 + + + + 114e50e70cd10a0834836de3bd59fd8a + CVE-2024-1767 + 2024-04-23 03:23:07 + WordPress Blocksy theme跨站脚本漏洞 + 详情 + + + + df7e115fa5c7a7c13b06afea54deed61 + CVE-2024-28753 + 2024-04-23 03:23:07 + RaspAP信息泄露漏洞 + 详情 + + + + 7eb62c06ef8ff48d16f9e1544666d3d8 + CVE-2023-32264 + 2024-04-23 03:23:07 + OpenText Documentum D2源验证错误漏洞 + 详情 + + + + 31b8d828a9e73fd10f5b974831cc68f7 + CVE-2024-2339 + 2024-04-23 03:23:07 + PostgreSQL Anonymizer输入验证错误漏洞 + 详情 + + + + fdef16d6144db285f015307e82f07a9d + CVE-2024-23297 + 2024-04-23 03:23:07 + Apple多款产品信息泄露漏洞 + 详情 + + + + 39ea8472a0942092df64eba3954bfddf + CVE-2024-1320 + 2024-04-23 03:23:07 + WordPress EventPrime Plugin跨站脚本漏洞 + 详情 + + + + e9b819a96a928c1c8d1fb11fe625c841 + CVE-2024-28754 + 2024-04-23 03:23:07 + RaspAP拒绝服务漏洞 + 详情 + + + + 4b15b1b31e332a6ca6ae607e90d532d3 + CVE-2024-1125 + 2024-04-23 03:23:07 + WordPress EventPrime Plugin授权错误漏洞 + 详情 + + + + 967295d1e563f29a145094c01c1bed83 + CVE-2024-28122 + 2024-04-23 03:23:07 + JWX不受控制的资源消耗漏洞 + 详情 + + + + 02aa7712665d545a48955fe1cc272baa + CVE-2024-1124 + 2024-04-23 03:23:07 + WordPress EventPrime Plugin授权错误漏洞 + 详情 + + + + c1e8d3f4847190513e5b33dea94114c3 + CVE-2024-28184 + 2024-04-23 03:23:07 + WeasyPrint信息泄露漏洞 + 详情 + + + + 8a5bb5e975960c79ac61f263d909d0c9 + CVE-2024-1123 + 2024-04-23 03:23:07 + WordPress EventPrime Plugin授权错误漏洞 + 详情 + + + + bf581ecb4d714c46e4c834f4b0e96c59 + CVE-2023-49340 + 2024-04-23 03:23:07 + Newland Nquire 1000 Interactive Kiosk访问控制错误漏洞 + 详情 + + e9a3507f450b02345057f383f7d3c852 CVE-2024-23268 - 2024-04-22 09:22:44 + 2024-04-22 09:22:44 Apple多款产品注入漏洞 详情 @@ -1982,7 +2102,7 @@

眈眈探求 | + 2024-04-22 09:22:44 Apple visionOS和macOS Sonoma越界读取漏洞 详情 @@ -1990,7 +2110,7 @@

眈眈探求 | + 2024-04-22 09:22:44 Apple多款产品任意代码执行漏洞 详情 @@ -1998,7 +2118,7 @@

眈眈探求 | + 2024-04-22 09:22:44 Apple多款产品权限降低漏洞 详情 @@ -2006,7 +2126,7 @@

眈眈探求 | + 2024-04-22 09:22:44 Apple多款产品信息泄露漏洞 详情 @@ -2014,7 +2134,7 @@

眈眈探求 | + 2024-04-22 09:22:44 Apple多款产品拒绝服务漏洞 详情 @@ -2022,7 +2142,7 @@

眈眈探求 | + 2024-04-22 09:22:44 Apple多款产品信息泄露漏洞 详情 @@ -2030,7 +2150,7 @@

眈眈探求 | + 2024-04-22 09:22:44 Apple macOS Sonoma权限管理错误漏洞 详情 @@ -2038,7 +2158,7 @@

眈眈探求 | + 2024-04-22 09:22:44 Apple多款产品信息泄露漏洞 详情 @@ -2046,7 +2166,7 @@

眈眈探求 | + 2024-04-22 09:22:44 Adobe Experience Manager跨站脚本漏洞 详情 @@ -2054,7 +2174,7 @@

眈眈探求 | + 2024-04-22 09:22:44 Apple多款产品内存破坏漏洞 详情 @@ -2062,7 +2182,7 @@

眈眈探求 | + 2024-04-22 09:22:44 Apple多款产品信息泄露漏洞 详情 @@ -2070,7 +2190,7 @@

眈眈探求 | + 2024-04-22 09:22:44 Apple多款产品状态管理错误漏洞 详情 @@ -2078,7 +2198,7 @@

眈眈探求 | + 2024-04-22 09:22:44 Apple多款产品逻辑漏洞 详情 @@ -2086,131 +2206,11 @@

眈眈探求 | + 2024-04-22 09:22:44 Apple macOS Sonoma信息泄露漏洞 详情 - - 01aa165c6aff1f5e1ea450668b48d4e5 - CVE-2023-6699 - 2024-04-22 03:23:52 - WordPress Plugin WP Compress路径遍历漏洞 - 详情 - - - - e934324478b55a7965212683b3b9123e - CVE-2023-6883 - 2024-04-22 03:23:52 - WordPress Plugin Easy Social Feed关键资源权限分配错误漏洞 - 详情 - - - - 91121de19136fa1fbbb7983da9096c0d - CVE-2024-24469 - 2024-04-22 03:23:52 - flusity CMS跨站请求伪造漏洞 - 详情 - - - - ce8e649cdfa76d1d4d5db805c370f32c - CVE-2024-24397 - 2024-04-22 03:23:52 - Stimulsoft GmbH Stimulsoft Dashboard.JS跨站脚本漏洞 - 详情 - - - - 6fb511710a909d2301f2d923dbef3051 - CVE-2024-21665 - 2024-04-22 03:23:52 - Pimcore Ecommerce Framework Bundle访问控制不当漏洞 - 详情 - - - - 752f13c236139632712476f55dd9676f - CVE-2024-21666 - 2024-04-22 03:23:52 - Pimcore Customer Management Framework访问控制错误漏洞 - 详情 - - - - 5281e293f335ea66158f635bd5cb0721 - CVE-2022-40361 - 2024-04-22 03:23:52 - Elite CRM跨站脚本执行漏洞 - 详情 - - - - 26bcd4765d3e77b46bdbc4d4f3976a14 - CVE-2022-45794 - 2024-04-22 03:23:52 - Omron PLC访问控制错误漏洞 - 详情 - - - - bcdcacc9f4ea9e7ec3e01e92ec2c5ccb - CVE-2023-4246 - 2024-04-22 03:23:52 - WordPress GiveWP plugin跨站请求伪造漏洞 - 详情 - - - - 5c10acfc6ee65d78469502c3d49763ab - CVE-2024-21667 - 2024-04-22 03:23:52 - Pimcore Customer Management Framework访问控制错误漏洞（CVE-2024-21667 ） - 详情 - - - - c19b0008c370ec20eceafed67b0a06f9 - CVE-2024-23054 - 2024-04-22 03:23:52 - Plone Docker Official Image远程代码执行漏洞 - 详情 - - - - f464980fc574cf2b683de529df66224c - CVE-2023-4962 - 2024-04-22 03:23:52 - WordPress Video PopUp plugin跨站脚本漏洞 - 详情 - - - - 44a7e28bd2103fb7b24b0813f18ee67b - CVE-2023-4247 - 2024-04-22 03:23:52 - WordPress Plugin GiveWP跨站请求伪造漏洞 - 详情 - - - - 9aa8b3d60a56a53f92f72c8a3aac314f - CVE-2023-4960 - 2024-04-22 03:23:52 - WordPress WCFM Marketplace plugin跨站脚本漏洞 - 详情 - - - - b0d0402483124fd90dc5613f15033936 - CVE-2023-4248 - 2024-04-22 03:23:52 - WordPress GiveWP plugin跨站请求伪造漏洞 - 详情 - -