From 7f8610da2a43f1f46278c4c8a2bf37f7ca40b018 Mon Sep 17 00:00:00 2001 From: Github-Bot Date: Fri, 15 Sep 2023 01:23:06 +0000 Subject: [PATCH] Updated by Github Bot --- cache/Tenable (Nessus).dat | 4 ++ data/cves.db | Bin 42745856 -> 42749952 bytes docs/index.html | 126 ++++++++++++++++++------------------- 3 files changed, 67 insertions(+), 63 deletions(-) diff --git a/cache/Tenable (Nessus).dat b/cache/Tenable (Nessus).dat index 98421af38fb..2177497940b 100644 --- a/cache/Tenable (Nessus).dat +++ b/cache/Tenable (Nessus).dat @@ -148,3 +148,7 @@ c1b39aa49825042c255f6a349166f640 04c898f7c3c54b1231fc16fb05f609f0 f33002340526f3940c4e64ebe5e5d9b3 c3382eca347a7df78808d1152607e4df +461e49f95d6b6c09c79b5224f5de618c +cc1740c98cbd7aa69183dd5e5ec79a32 +8f06033f8a258de4d23a374797fac4af +d56b80dc455efba8e48303b45521ae59 diff --git a/data/cves.db b/data/cves.db index dd27d18305dffccdfcdd3c22d944e5344c46cbaa..54c860a9b4cc60f66799e2b4ed3ee9f65ef2d488 100644 GIT binary patch delta 3539 zcmdtkXLJoq!Cz$cCLQ$u3Ioy#%Dgf3rKAEF`;OvjMR{67pAy2v`U< z7DW-PU;{-A7Hp`9y*KP)j9~Bo<(})&FZbLJ_tQOde$SbC-#PC*&-2clGv(!bTbFO& z+j>)0`s{l3`W)VD46)6w0AVBSM13NSNGBQ)XAl`gL!uGUm}o*YC7KbOZW&sF_1W$IENTS3?_yULy2L;aAE{8k{CsdCdLqBiE+euVgfOd zm_$q_rVvw!X~c9QkC;KsB+eyf5wnRo#9U$?F`rmKEF=~Y>Q8{kCxS$Xu!t~GKok-Y zVllCVC?bl9C=nw{h^0iFC?yg^8L^C5PMk-qAkHT)ATA^>B32Tsh;pKWs3cYsRRoEP ziA#tz#9Cq>>6NcN6yz_Y(IJ_Y?bw{lo*rgTw*i zA>ttMFi}GsA|4?gB_1OlCk_)&5Kj_M5l<7(5J!k-iRXytiKD~|#4+MU;w9o`;uYdm z;x*!R;tk?W;w|EB;vM2$;yvPh;sfGC;yCdU@iFlU@hR~c@j3AY@g;GB_=>0{z9#C3 zZ-|q`DdJn=JK}rd2jWNKC*o(~7vfjqH{y5VkF~IEfKBXDU(zI98ps)vAq}OGG?pgP zRGLY1X(25oQ(8%DX(Mf=owSz@(owRclXR9drHdHSRk}%c=^;I(m-LoC(pUP)S<+t| zk}U(oDWREEiL86hKOl#G@!GFHaPc$pv*Ws*#m zDKb^2$#lt+88TDOm02=d=Ez)`C-Y^2ER;o(>VH7;B`6`WBrF9|C=ppKOQcAOB`Pr~ zk);xsQb|aeER*GOo~)4b|{#v3w$*%4hPqd?8=T z3HeHDgUz}WT*_2;W9!-$|xBvV`Qw1lkqY^ zCdwq4EK_8vOq1!7Co^QGoGY_rw#<>aGEe5q0$C`FB-Q_bw7q59XOzz>v8VTWtg3d(##38pSGYJ8E=h$osjxN`*4b-LZCP(` zx_e7`D7{g}qxG5=Hs0Fs!;G4ib;oUc)At#5yX^HHm04A_d5tDH`c`yzS9A}AygB(k zXDI0LdaZDNz-M`UZl^n6mo774CCw*K+Oje|E;H9R(Tc`OOAIsHneB8`?|EWN2Y_b77iU6e}>6mRa!?MsX}uR%B(noG!P+>35hO!^|0IdIviH;{px;S|Ayi{e#Wn zI{nDiW>xLbp!| z(yS@5JJZTat$1?d&V#l#O^W`?-Cl$urS7+;)O4{dKJ)x?0+Ucb8+?9EOV9?Cv)Fh7(V2;}%ppF0%t zT3#!d>klLYfzI|$X*n*hGkL@QDq9z0%;YJPMj44nv1KIUf#4D=ZY;CnrIA?FaI5vM zhG14RxlP1{bK`iQyXBK|Dz`)k2bHg zJIqwhY*ke|Rkil6>g=xSyvUPdS{{Gc?+xYT=LDU8RhaK}xjbQS$jUL3U0+Ywv(h|% zubHf9*5BT)`sAK*ZB{LhBnpj0p=Fc=3L?=!B2{U)EE+t0qVv>Lw-H4VE1GcR2THAw zF|15u(L^NpubZdFiXy=k#)w!n94RP^pC0UHlm_FL6*Xev(+iAAT}&S~a@@>3W4V=Y z1VY7;s1b=KtfYI!W?N>m#h6!YX?-Hp7=>~6rMpJg$kE+3x?{j#G?(t~9&v#Y0s;e+QaY4UK#9=`wxmIKHy9v3 z`{DEa0r#BuoHuIC&fuu1oxuyTC5(s{ui){8Az?ugQ)C5M0V}?hz)EN(vJzWKtfW>l zE4h`zN@=CCQd?=Pv{pJRy%lU_urgYitjtyxE31{w%5LSba$32p5G%Kp$I5Hvv+`R7 ztWc|QVc3 zvT9p(th!b`tG?C1YG^gG8e2`QrdBhnxfO1;uv%KJtO%>M)y9gn+FI?b_Erb0qt(gk zY<02Nr>oV?>TdP0dRo1#-c}#0uhq}$Zw;^pT7#^?)(~r`HOv}rjj%>qqpZ=^7;CIG z&Khq`uqIlQtjSiCHN~20O|zz3wq{r}tyxyIHQSnF&9&xPA6WCP1=d3ALu-+>*ji%6 zSWB&C)^h73>tkz$wbEK;t+v)!pIDz-Ypr$GdTWEV(b{BfwzgPXt!>t4*5}rCYlpSd z+GXvwzOcTu_E>wZeb!gj*VcaPfOXJ1WW`#Cts~Y^>zH-iI$@o(zOlZwPFbg|@2u~w zAFLm(pRAv)U#wrPGuBz_oORy1U|qC+vwpY!u>Q0zS(mLV)>Z48b=|sQ-L!65x2-$Y zUF)88-+Ev@v>sWHttZw~>zVc3dSSh^URkfLH`ZU)-_}3Yzt&spo%NsfK3YNZ6odfc zBLNa35fUQ_k|G(BBLz|-6;dM&(jpzwBN!Qw5t)z~S&$XkkR3UY6S)wA+{lBx$cOwW zfKU`fArwXt6h$!Yy&_p*|X* zAsV4EnxH9~p*h0Q0xi)B5onDzh(ueoLwj^UM|47GbV1zyUC|BQ(E~lv3%$_?ebEp7 zF#rQG2!k;MLop1)F#;no3ZpRwV=)fnF#!`X36l|pDVU0Bm=0qGW?~kiF&lF*7xVA| z=3@aC;zKOLVk|)nmSP!}<0E{G6!*QIzNqmEEaSEsL9lpm8_z^$hXZ(U+ zaRz5`4(D+J7x5c@#~=6;mv9+Za23~Z9XD_jw{RPGa2NM*9}n;lkMI~z@D$JR953(^ zukadg@E88ZKlm4K@ecpteNeOloIe7Hj|51FL`aMzNQz`gjuc3VR7j09NQ-nxk6>g# zMr1-}WIb93@Z^rBE7WP!{D-9u-g# zl~5T~P!-is9bu?}ny7`^sDrwwhx%xMhG>MwXo99_hUN%I3$#QlM4&a=AQElS4(-ta z9nlG$(FJk)cSSdJM-TKwFZ4zq^hH1P#{dk(APmM348<@E#|VtXD2&D!jKw&N#{^8o zBuqvWreG?jVS3=899TC$N#jH>;_)OMi%qe>ftWySy717zwZPtxsK{YK^Iyd{KxV{c VW?W{)B|0v%1F^4S<^+;&{vS%UmaG5( diff --git a/docs/index.html b/docs/index.html index c9294bc1f3f..fd0bfe37c00 100644 --- a/docs/index.html +++ b/docs/index.html @@ -1,4 +1,4 @@ - + @@ -30,7 +30,7 @@

眈眈探求 | + 2023-09-13 09:00:41 2023-09 补丁日: 微软多个漏洞安全更新通告 详情 @@ -283,6 +283,38 @@

眈眈探求 | TITLE URL + + 461e49f95d6b6c09c79b5224f5de618c + CVE-2023-4951 + 2023-09-14 17:15:11 + A cross site scripting issue was discovered with the pagination function on the "Client-based Authentication Policy Configuration" screen of the GreenRADIUS web admin interface. This issue is found in GreenRADIUS v5.1.1.1 and prior. A fix was included in v5.1.2.2. + 详情 + + + + cc1740c98cbd7aa69183dd5e5ec79a32 + CVE-2023-36250 + 2023-09-14 17:15:11 + CSV Injection vulnerability in GNOME time tracker version 3.0.2, allows local attackers to execute arbitrary code via crafted .tsv file when creating a new record. + 详情 + + + + 8f06033f8a258de4d23a374797fac4af + CVE-2023-42180 + 2023-09-14 16:15:08 + An arbitrary file upload vulnerability in the /user/upload component of lenosp 1.0-1.2.0 allows attackers to execute html code via a crafted JPG file. + 详情 + + + + d56b80dc455efba8e48303b45521ae59 + CVE-2023-42178 + 2023-09-14 16:15:08 + Lenosp 1.0.0-1.2.0 is vulnerable to SQL Injection via the log query module. + 详情 + + f206b86950f1d4daa0901cc88b6975db CVE-2023-30909 @@ -366,7 +398,7 @@

眈眈探求 | + 2023-09-13 17:15:10 Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms (ex. Linux) allows an attacker to cause a denial of service by initiating a significant number of connections with the server. Note that gRPC C++ Python, and Ruby are affected, but gRPC Java, and Go are NOT affected. 详情 @@ -374,7 +406,7 @@

眈眈探求 | + 2023-09-13 17:15:10 A flaw was found in KVM AMD Secure Encrypted Virtualization (SEV) in the Linux kernel. A KVM guest using SEV-ES or SEV-SNP with multiple vCPUs can trigger a double fetch race condition vulnerability and invoke the `VMGEXIT` handler recursively. If an attacker manages to call the handler multiple times, they can trigger a stack overflow and cause a denial of service or potentially guest-to-host escape in kernel configurations without stack guard pages (`CONFIG_VMAP_STACK`). 详情 @@ -382,7 +414,7 @@

眈眈探求 | + 2023-09-13 17:15:10 A flaw was found in QEMU. The async nature of hot-unplug enables a race scenario where the net device backend is cleared before the virtio-net pci frontend has been unplugged. A malicious guest could use this time window to trigger an assertion and cause a denial of service. 详情 @@ -390,7 +422,7 @@

眈眈探求 | + 2023-09-13 17:15:09 A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local user to disable the agent. 详情 @@ -398,7 +430,7 @@

眈眈探求 | + 2023-09-13 17:15:09 A flaw was found in the QEMU built-in VNC server while processing ClientCutText messages. A wrong exit condition may lead to an infinite loop when inflating an attacker controlled zlib buffer in the `inflate_buffer` function. This could allow a remote authenticated client who is able to send a clipboard to the VNC server to trigger a denial of service. 详情 @@ -406,7 +438,7 @@

眈眈探求 | + 2023-09-13 17:15:09 This CVE exists because of an incomplete fix for CVE-2021-3750. More specifically, the qemu-kvm package as released for Red Hat Enterprise Linux 9.1 via RHSA-2022:7967 included a version of qemu-kvm that was actually missing the fix for CVE-2021-3750. 详情 @@ -414,7 +446,7 @@

眈眈探求 | + 2023-09-13 17:15:09 A vulnerability in the iPXE boot function of Cisco IOS XR software could allow an authenticated, local attacker to install an unverified software image on an affected device. This vulnerability is due to insufficient image verification. An attacker could exploit this vulnerability by manipulating the boot parameters for image verification during the iPXE boot process on an affected device. A successful exploit could allow the attacker to boot an unverified software image on the affected device. 详情 @@ -422,7 +454,7 @@

眈眈探求 | + 2023-09-13 17:15:09 A vulnerability in the Connectivity Fault Management (CFM) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to incorrect processing of invalid continuity check messages (CCMs). An attacker could exploit this vulnerability by sending crafted CCMs to an affected device. A successful exploit could allow the attacker to cause the CFM service to crash when a user displays information about maintenance end points (MEPs) for peer MEPs on an affected device. 详情 @@ -430,7 +462,7 @@

眈眈探求 | + 2023-09-13 17:15:09 A vulnerability in the access control list (ACL) processing on MPLS interfaces in the ingress direction of Cisco IOS XR Software could allow an unauthenticated, remote attacker to bypass a configured ACL. This vulnerability is due to incomplete support for this feature. An attacker could exploit this vulnerability by attempting to send traffic through an affected device. A successful exploit could allow the attacker to bypass an ACL on the affected device. There are workarounds that address this vulnerability. This advisory is part of the September 2023 release of the Cisco IOS XR Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see Cisco Event Response: September 2023 Semiannual Cisco IOS XR Software Security Advisory Bundled Publication . 详情 @@ -438,7 +470,7 @@

眈眈探求 | + 2023-09-13 17:15:09 A vulnerability in the classic access control list (ACL) compression feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to bypass the protection that is offered by a configured ACL on an affected device. This vulnerability is due to incorrect destination address range encoding in the compression module of an ACL that is applied to an interface of an affected device. An attacker could exploit this vulnerability by sending traffic through the affected device that should be denied by the configured ACL. A successful exploit could allow the attacker to bypass configured ACL protections on the affected device, allowing the attacker to access trusted networks that the device might be protecting. There are workarounds that address this vulnerability. This advisory is part of the September 2023 release of the Cisco IOS XR Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see Cisco Event Response: September 2023 Semiannual Cisco IOS XR Software Security Advisory Bundled Publication . 详情 @@ -491,38 +523,6 @@

眈眈探求 | 详情 - - 56d2a9b86de0fdf1c9f42a50f2d7f3dc - CVE-2023-41879 - 2023-09-11 22:15:00 - Magento LTS is the official OpenMage LTS codebase. Guest orders may be viewed without authentication using a "guest-view" cookie which contains the order's "protect_code". This code is 6 hexadecimal characters which is arguably not enough to prevent a brute-force attack. Exposing each order would require a separate brute force attack. This issue has been patched in versions 19.5.1 and 20.1.1. - 详情 - - - - 84bef31a330ac0a504bce8c4425e4b71 - CVE-2023-38878 - 2023-09-11 22:15:00 - A reflected cross-site scripting (XSS) vulnerability in DevCode OpenSTAManager versions 2.4.24 to 2.4.47 may allow a remote attacker to execute arbitrary JavaScript in the web browser of a victim by injecting a malicious payload into the 'error' and 'error_description' parameters of 'oauth2.php'. - 详情 - - - - c90fe8a365ac60a46b0f4021e251bc89 - CVE-2023-4897 - 2023-09-11 21:15:00 - Relative Path Traversal in GitHub repository mintplex-labs/anything-llm prior to 0.0.1. - 详情 - - - - 7641218df173837e3b093c589708f823 - CVE-2023-35687 - 2023-09-11 21:15:00 - In MtpPropertyValue of MtpProperty.h, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. - 详情 - - @@ -1798,7 +1798,7 @@

眈眈探求 | + 2023-09-13 20:08:44 Adobe Illustrator 缓冲区错误漏洞 详情 @@ -1806,7 +1806,7 @@

眈眈探求 | + 2023-09-13 20:08:44 Adobe Illustrator 资源管理错误漏洞 详情 @@ -1814,7 +1814,7 @@

眈眈探求 | + 2023-09-13 20:08:30 Adobe Illustrator 缓冲区错误漏洞 详情 @@ -1822,7 +1822,7 @@

眈眈探求 | + 2023-09-13 20:08:30 Adobe Illustrator 缓冲区错误漏洞 详情 @@ -2094,7 +2094,7 @@

眈眈探求 | + 2023-09-13 03:20:51 Microsoft Chromium (Chromium-based)堆缓冲区溢出漏洞 详情 @@ -2102,7 +2102,7 @@

眈眈探求 | + 2023-09-13 03:20:51 Microsoft Dynamics 365 (on-premises)跨站脚本漏洞 详情 @@ -2110,7 +2110,7 @@

眈眈探求 | + 2023-09-13 03:20:51 Microsoft Office欺骗漏洞 详情 @@ -2118,7 +2118,7 @@

眈眈探求 | + 2023-09-13 03:20:51 Microsoft Windows Defender Attack Surface Reduction安全功能绕过漏洞 详情 @@ -2126,7 +2126,7 @@

眈眈探求 | + 2023-09-13 03:20:51 Microsoft DHCP Server Service拒绝服务漏洞 详情 @@ -2134,7 +2134,7 @@

眈眈探求 | + 2023-09-13 03:20:51 Microsoft Windows GDI权限提升漏洞 详情 @@ -2142,7 +2142,7 @@

眈眈探求 | + 2023-09-13 03:20:51 Microsoft Exchange Server远程代码执行漏洞 详情 @@ -2150,7 +2150,7 @@

眈眈探求 | + 2023-09-13 03:20:51 Microsoft Exchange Server远程代码执行漏洞 详情 @@ -2158,7 +2158,7 @@

眈眈探求 | + 2023-09-13 03:20:51 Microsoft Exchange Server欺骗漏洞 详情 @@ -2166,7 +2166,7 @@

眈眈探求 | + 2023-09-13 03:20:51 Microsoft 3D Viewer内存错误引用漏洞 详情 @@ -2174,7 +2174,7 @@

眈眈探求 | + 2023-09-13 03:20:51 Microsoft Exchange Server远程代码执行漏洞 详情 @@ -2182,7 +2182,7 @@

眈眈探求 | + 2023-09-13 03:20:51 Microsoft Visual Studio Code远程代码执行漏洞 详情 @@ -2190,7 +2190,7 @@

眈眈探求 | + 2023-09-13 03:20:51 Microsoft 3D Viewer远程代码执行漏洞 详情 @@ -2198,7 +2198,7 @@

眈眈探求 | + 2023-09-13 03:20:51 Microsoft 3D Viewer远程代码执行漏洞 详情 @@ -2206,7 +2206,7 @@

眈眈探求 | + 2023-09-13 03:20:51 Microsoft Identity Linux Broker信息泄露漏洞 详情