From 9d4c61cc54a0280e0cde2f1ae19d29a2e4cee3ef Mon Sep 17 00:00:00 2001 From: Github-Bot Date: Sat, 13 Apr 2024 23:25:32 +0000 Subject: [PATCH] Updated by Github Bot --- cache/RedQueen.dat | 10 +++ cache/Tenable (Nessus).dat | 10 +++ data/cves.db | Bin 47071232 -> 47083520 bytes docs/index.html | 162 ++++++++++++++++++------------------- 4 files changed, 101 insertions(+), 81 deletions(-) diff --git a/cache/RedQueen.dat b/cache/RedQueen.dat index e4648c4ca2b..fd14fe26772 100644 --- a/cache/RedQueen.dat +++ b/cache/RedQueen.dat @@ -111,3 +111,13 @@ e8c7132832b8c0457c9738cf22d54c39 e2356450a8e3cea869f4ab9f384576f0 5c646c0ff6db3301cd6604c10c94f479 b8ac67ce43f7aed557d15eb9505552c9 +aa51b0f30e2c3691d842a8e2c66f4957 +6086b68aa48d324f3bbc4c53c2c723e7 +2b560c06437b96f3df4c593464e68589 +84e83374ff34c49bf7e90751a458c780 +643fddbc522c3912e57856e31dffa5ed +895f1645c8892e4ee85005154416a193 +cc96f68cf2bfcf578d886579d983567f +4550e052219e884aaa2d000778b46ec9 +c6fc0f1e11b594ee91e2af7ff115c3b6 +f8aa964dcb4956c9baacad51d77f32bc diff --git a/cache/Tenable (Nessus).dat b/cache/Tenable (Nessus).dat index 0ada6dcfaa7..22cb71a7643 100644 --- a/cache/Tenable (Nessus).dat +++ b/cache/Tenable (Nessus).dat @@ -114,3 +114,13 @@ f055ab7fbcada08b35fbb3cfaa461b47 d6e69687d570799e00c72934be69ee83 2294de2743ac043fbc4fa1e30c6c20f7 19243d5e8ea0ce74eb09c5fc33114ec8 +ff20f9e131b02fcf47f054144fd32463 +4ccfcb06f80909959f881e16781b18bf +835c1d006d96d491862095cc05b3d57f +63babce91580538085ca1cf65a58d9af +886a5a065150997c6a1672b5ef4e8f4b +4e583a2247233ca8c909462f2a208012 +fa25e69baf68c9828ef342387ff593c6 +96f091e6f1eaaf18d3b11f8f9c7cd66c +d060e0fe962b3d81454627d10fba89a5 +31ed67f1094c4ca8d945e256f6166b2c diff --git a/data/cves.db b/data/cves.db index a682669aaf98f35105f6a421dbc38a2b560371cf..1726005f48e32721b56548b0bb5bb4432cd197a2 100644 GIT binary patch delta 7204 zcmeI#X>=7;wg+&kG7v(5L?Fy?5yGI{q~-wyWK@(P3?hn{UAJykawW-y+=PGwBL zGB`$5EN~VTf>RJ>bOxjWdr;d(aPDr0#&&Ak;r%NpuUWEu?}N+t<*mi+e?2(b*s@0GWu8)im^6QC7U=o?qn9`Xtm@=7KGi5QgVajG|%ap^^ zj;TFU2c}%6Jf@SFIx=-)>dchS)P<=lQ#YpWOg)%-GWBBW&D4h}!qk`PWTt*h{h11w z1~3g|8pJf1=@h0@nT9Y$nF^VTm?S2dNnui%G$x(NU^1C3CYxy}(`ihnGYw-J&NPDQ z45pDxqnJiBjbR$gG>+*^rn8vFGo8(J4$}mtiAvIG)45DDn9gIG z$#g!`1x&M;E@Ya`bP-bt6XN4A#h6^CIFrZZGnF!xF(sHTW}3rP&Q!rv$&_T8%QTOv ziYdiZ%~ZoQpQ)B<0n^rbSGPnd+G8nXX{ElIbcYW@=zs!gMv$Ql@K| zu4TH8X&KXUrWH&pnXYHLf$2u3o0x89x`nBc=~kvyOt&%J&U6RUYNk7x0;V-gYnkq1 zx|``9rhA$0W4fQ|0j39;)-gTA^f1#SOzW98Ff}o4WO|h8F{a0vo?v>CshMdL(^E{F znVx2PhG`4aR;F!C+nIJS?PPkE={ct7nO5oi*VtS3~b*49%{>=0y(_felGQGugi0LrX+f45;z033-)B8*xFn!4M zSEj!){hjF}rjMCEVfvKmA52G>K4bbP)8|ZIFn!7N71P&D|6=-v>EBG>GJVJNJ<|_M zNmxb#h>!;9kO7&{8nU1bWJ6oXfp*XyIzTSu!AZ~&Izea1hc3_+xoOc9{5lSWsrc2VGfi-1yn*3=E6Lvf)rFk4a|pHSO5#*61WsDgUewNEQUI$hb!Pp zxC$5=U;6-=|UWQ$;8}`5}uor#@`(QsDfLG!7@CW!K{0Uxz*WnHLGrS3ZfrIcC z9D>8}HoODx!h7&Od;lN9U*T`?clZcChEL#A_y-(;&)}c%IeY3fg4orZFFbO6@F-(D}Fb$@|xiACHgPCwXTmZA+LYNH~ zK?#KMcOV8X#K8j}N}&uAa52n*a;ShxNWxs02UU=QYN&zvPzwuSAzT8N!ewwdEP};Q z2la3TTnSeJLjx>>){)vjyKl(x0mkG1)tO<~r>t?$l!J@cfD zN$J<5J=>hSa`PMFsQOVDUz>^D1}9s!tJi(Yaco12yD`ny4cCr2j_bsAIc}Q1s>Iw6 zHsAH$%H^YHjEyRiqDEC!Qtdl??Gn2OO?%dhXZo@!$+5T{kH&pjk7}~wMPsV#M`Iq| zf_KTbYJ@#z9_!IHd{^>iPnKi4t$Cg;dy3sk&kMC+N}o&mJ{ZvTZqrNhziq)lA=vI*zGFbxF1*0~6Ox zFN|v1v8YQwrlBCPJrpbnbMfiD-`f*XUU96uPv!aruN>R$kt3PIrrpm6Sx>3)SW%MYUQCo?dQ5jK=`JU^WT1)1%I<}5VOgAJ~ z!c@%|R#c7qnycHYW@w&a>DCD{$B=(q$J6$TV?Ec!dP{l~iQq@E$=s-==}J_N#bjik zg#N07&5Emv=Bu%oi!N1HaZN?_%%4xu)Q)x-PVuZkwyf*Eu0>(00`}ar3svhwc?8WOQhU!!BL8x>ZhP)|!k~ zLUUej{X!wykivPEJuy0%FID+c2bqBN!FJUxNmnh&(p^V(eM5J2D{eO)E*;-3I8^$I znBGyd%yKW4id2_XC2LB{B8ILu9yz$IW8;=?E3(VxC!B~Asq|{g6O~@XEpw_Ix7w?U zBr5TM7pZhAyhzf=Py9r=HzX4CT&E`GMdsBcs}q%_kwhv|kw}#}mGN>f9zGQQEPSZY zEsTs^Ft!saF`{i2jJ-y2;K$g|oD{oAyxLd(wtvsUQT`0du&U4l)!1VIYu zf$_pr(U5{O-u1+RL8R~%F)Jh7DOPagmS@HM;86cZ#Z!9z;&T4FgGoaigTBqn#iC%1 zzgz4jnX0v<9XDmQgtCj;(51x3HRao$tjaM-!DWxjTGBOH)BNxN59CR^#hxM}dAMMq zp!fWxTny@8+9O!O_N=x-X6u&dRX9O#^QS`3VEc=+#FK)^+e^i0u=2atg^OASw$Z#x zFoVdtJz_?77$&>rKnd!x9B;-6To}Y(=u*0h&EvEYFz#mInB=S0TL zn2HKg(jqwAkN!iEjUV@FcyLOZ9BeFDC-e(e>V}{e#=ZFo*DI__%^i`PTRkkbFg3uf zhz~0%DVbI>8K##^Eg4%fvSi}OnfSlp$oe9oU+ao^tf(UH25U2Y@z$0wIvELJ@X;`~ zWSbHUpS}s%w*AcmLi_*2acz8Sw>UvE75SQJ+|(|N?9$ol(%B`Nr(3F{C>kmP)pZbE z$<_?TR~$vMq{ba%&i*N~LjAd7Bq)A(s+it6GTHYLt>eNe1v}a{2s6?rI*H1FdN@MY z+lC9d`IEfbNU@Vj)h4UrMWeBU6IB(F;y@_*MCc;O!HO3S2m^xn%MF4O%-y=q1%fTOve1Eu5(6Qy@H(EAqCbi0m zwD~4;TizL`i<8rurKXG1)1pf{b5mYRVEU*HeM(f>i{slwMmC}5bWqf3x~J&)kdX}| z)|l7j_Mh_VdU3sQY7i-x!^^MRWHCFqp!Z&}e?X7z!%o`z{c=Adg z%v(Ng-f~dbW0^SafAe&>M;i~%|9Ai@C)JegtNL+r{)WOE!bUsqNwz$Ek?V@#8}yVOi-q<>g5ib!4g< zU#wx_Ip>n2|AhjdS=leLlQsPMvvQzv*jo@=vh zEP*PsB2ijaeeB`mqM(Eawk-d)!)p5@}`$?Q9a-m!p?0-kVL0kOcVPQnu3O_XoCBEww%?*T} zJB7|cU49daxC5^r5Qe0ersB21ymgDkhr5Kejq>w222HOn5(|Ed5ge_q`ab_iL1vhe Giu7Nx70e<4 delta 2751 zcmWmG^Ox5N7>41Q@62Rla!s~v+jc$KwkJH{}P*_;87b{|FhKFX#3b#U5gcWH;S&6K~RuU_zmCQQ)V_rd7+TZPl^rTJ@~@Rs*Y{ z)yQgWHL;pn&8+5D3#+Bo%4%)3vD#YgtoBw1tE1J)>TGqfx?0_=?p6=0r^PTeCO23mux!PXFKs5Q(QZjG=;TBEGd));H7HO?AuO|T|fldQ?s6loRn}^2jkVTVXRWt3SR1WP z)@Eyqwbj~YZMSwhbtwYvf>xgyKI%XZWPFN?cQ`TwgjCIzE zv(8!Ptqayg>ymZZx?;s!SFHr=nswc}VcoQDS+}h_)?MqKb>DhmJ+vNKuUU_+*R40K zH?6mbrDUcGWkQ!-_7U_^48ITdt$b`(uf~?4f?8t$f$b}f>MjqrvKIBIM6ht8uMiCT6 zF%(A$ltd|%Mj4bvIh02QR753IMio>=HB?6p)I=@RMjg~eJ=8}7G(;mbMiVqeGc-pF zv_vbkMjNz6JG4g!bVMg~Mi+ENH*`l2^hB_KFZ4zq^hH1P#{dk(APmM348<@E#|VtX zD2&D!jKw&N#{^8oBuvH>OvN-z#|*?`CT3wa=D?VXd6pfzIEhm@jWall zIGn?IT);(K!ev}RJgy=E*Ki#-a1*z18+ULQ_i!H%@DPvi8Xn_yyn#3I7T(4?co*;C zeSClq@ew}86FkK;e1cE$953)0KF1gM5?|qKe1n(x7T@7}{D2?v6Mn`k{DNQc8-B+h z_!EEOZ~TLQ@n84?g*bnN5P?WUArTTI36dfik|PCDA{A024bmbV(jx;hA{v>H8Cj4O z*^nJMkQ2EOgWSl2yvT?AD1d?}gu*C-q9}&qD1nkFh0-X4vM7i0sDO&7gvzLbs;GwQ zsDYZOh1#ftx~PZxXn=-jgvMxsrf7!dXn~e!h1O_;wrGd;=zxysgwE)KuIPsD=z*RH z_V0z>=!3rKhyECVff$6r7=ob~hT#~2kr;*17=y7Ghw+$ziI{}Rn1ZR8hUu7rSj@yM z%*GrTb1@I|u>cFP2#c`vcx3ahaOYq1XNu>l*g37fG6Td@t>u>(7?3%jug zd$AAuaR3K#2#0Y5M{x|taRMiC3a4=fXG5127ux+a$;F5*VZpPv?#bvH4YobLwl$O@ zzQ?n;P`-#neZ9APSXli0=W(G|Nw%ep8694KS;EV>5IGm*e2@!4E(W<2(8{}S)`#~Or;uBsz4ArfhJTlp-u#}lov`#)DS$x`B e8Nzo)#K)w$9%>L7S898^OQHBvRUU + @@ -283,6 +283,86 @@

眈眈探求 | TITLE URL + + ff20f9e131b02fcf47f054144fd32463 + CVE-2024-3739 + 2024-04-13 19:15:53 + A vulnerability classified as critical was found in cym1102 nginxWebUI up to 3.9.9. This vulnerability affects unknown code of the file /adminPage/main/upload. The manipulation of the argument file leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-260578 is the identifier assigned to this vulnerability. + 详情 + + + + 4ccfcb06f80909959f881e16781b18bf + CVE-2024-3738 + 2024-04-13 18:15:07 + A vulnerability classified as critical has been found in cym1102 nginxWebUI up to 3.9.9. This affects the function handlePath of the file /adminPage/conf/saveCmd. The manipulation of the argument nginxPath leads to improper certificate validation. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-260577 was assigned to this vulnerability. + 详情 + + + + 835c1d006d96d491862095cc05b3d57f + CVE-2024-3737 + 2024-04-13 17:15:50 + A vulnerability was found in cym1102 nginxWebUI up to 3.9.9. It has been rated as critical. Affected by this issue is the function findCountByQuery of the file /adminPage/www/addOver. The manipulation of the argument dir leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-260576. + 详情 + + + + 63babce91580538085ca1cf65a58d9af + CVE-2024-32487 + 2024-04-13 15:15:52 + less through 653 allows OS command execution via a newline character in the name of a file, because quoting is mishandled in filename.c. Exploitation typically requires use with attacker-controlled file names, such as the files extracted from an untrusted archive. Exploitation also requires the LESSOPEN environment variable, but this is set by default in many common cases. + 详情 + + + + 886a5a065150997c6a1672b5ef4e8f4b + CVE-2024-3736 + 2024-04-13 14:15:07 + A vulnerability was found in cym1102 nginxWebUI up to 3.9.9. It has been declared as problematic. Affected by this vulnerability is the function upload of the file /adminPage/main/upload. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-260575. + 详情 + + + + 4e583a2247233ca8c909462f2a208012 + CVE-2024-3735 + 2024-04-13 13:15:46 + A vulnerability was found in Smart Office up to 20240405. It has been classified as problematic. Affected is an unknown function of the file Main.aspx. The manipulation of the argument New Password/Confirm Password with the input 1 leads to weak password requirements. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. VDB-260574 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. + 详情 + + + + fa25e69baf68c9828ef342387ff593c6 + CVE-2024-3721 + 2024-04-13 12:15:12 + A vulnerability was found in TBK DVR-4104 and DVR-4216 up to 20240412 and classified as critical. This issue affects some unknown processing of the file /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___. The manipulation of the argument mdb/mdc leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-260573 was assigned to this vulnerability. + 详情 + + + + 96f091e6f1eaaf18d3b11f8f9c7cd66c + CVE-2024-3720 + 2024-04-13 12:15:11 + A vulnerability has been found in Tianwell Fire Intelligent Command Platform 1.1.1.1 and classified as critical. This vulnerability affects unknown code of the file /mfsNotice/page of the component API Interface. The manipulation of the argument gsdwid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-260572. + 详情 + + + + d060e0fe962b3d81454627d10fba89a5 + CVE-2024-26817 + 2024-04-13 12:15:11 + In the Linux kernel, the following vulnerability has been resolved: amdkfd: use calloc instead of kzalloc to avoid integer overflow This uses calloc instead of doing the multiplication which might overflow. + 详情 + + + + 31ed67f1094c4ca8d945e256f6166b2c + CVE-2024-3719 + 2024-04-13 11:15:46 + A vulnerability, which was classified as critical, was found in Campcodes House Rental Management System 1.0. This affects an unknown part of the file ajax.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-260571. + 详情 + + 4fb231048c1f9f7ab953622d4993218e CVE-2024-3698 @@ -443,86 +523,6 @@

眈眈探求 | 详情 - - 5b04a3e27db944229f192131fe1caf90 - CVE-2024-31944 - 2024-04-10 18:15:08 - Cross-Site Request Forgery (CSRF) vulnerability in Octolize WooCommerce UPS Shipping – Live Rates and Access Points.This issue affects WooCommerce UPS Shipping – Live Rates and Access Points: from n/a through 2.2.4. - 详情 - - - - cdbe7700995e9888a647e8c1ae7d9e5d - CVE-2024-31943 - 2024-04-10 18:15:08 - Cross-Site Request Forgery (CSRF) vulnerability in Octolize USPS Shipping for WooCommerce – Live Rates.This issue affects USPS Shipping for WooCommerce – Live Rates: from n/a through 1.9.2. - 详情 - - - - fc6d41a82e26c8569cb87356890f3624 - CVE-2024-31461 - 2024-04-10 18:15:07 - Plane, an open-source project management tool, has a Server-Side Request Forgery (SSRF) vulnerability in versions prior to 0.17-dev. This issue may allow an attacker to send arbitrary requests from the server hosting the application, potentially leading to unauthorized access to internal systems. The impact of this vulnerability includes, but is not limited to, unauthorized access to internal services accessible from the server, potential leakage of sensitive information from internal services, manipulation of internal systems by interacting with internal APIs. Version 0.17-dev contains a patch for this issue. Those who are unable to update immediately may mitigate the issue by restricting outgoing network connections from servers hosting the application to essential services only and/or implementing strict input validation on URLs or parameters that are used to generate server-side requests. - 详情 - - - - 6cca780c86ce5fa125cd1ce5392903e1 - CVE-2024-31242 - 2024-04-10 18:15:07 - Missing Authorization vulnerability in Bricksforge.This issue affects Bricksforge: from n/a through 2.0.17. - 详情 - - - - b43b364de3a6ebb5359192440d49ef1e - CVE-2024-31230 - 2024-04-10 18:15:07 - Missing Authorization vulnerability in ShortPixel ShortPixel Adaptive Images.This issue affects ShortPixel Adaptive Images: from n/a through 3.8.2. - 详情 - - - - 3a56c25d315675184cadfedd77c1ea2e - CVE-2024-31214 - 2024-04-10 18:15:07 - Traccar is an open source GPS tracking system. Traccar versions 5.1 through 5.12 allow arbitrary files to be uploaded through the device image upload API. Attackers have full control over the file contents, full control over the directory where the file is stored, full control over the file extension, and partial control over the file name. While it's not for an attacker to overwrite an existing file, an attacker can create new files with certain names and attacker-controlled extensions anywhere on the file system. This can potentially lead to remote code execution, XSS, DOS, etc. The default install of Traccar makes this vulnerability more severe. Self-registration is enabled by default, allowing anyone to create an account to exploit this vulnerability. Traccar also runs by default with root/system privileges, allowing files to be placed anywhere on the file system. Version 6.0 contains a fix for the issue. One may also turn off self-registration by default, as that would make most vulnerabilities in the application much harder to exploit by default and reduce the severity considerably. - 详情 - - - - 3f471ecf5f8dd2e5b932d7c9366e7b60 - CVE-2024-3570 - 2024-04-10 17:15:58 - A stored Cross-Site Scripting (XSS) vulnerability exists in the chat functionality of the mintplex-labs/anything-llm repository, allowing attackers to execute arbitrary JavaScript in the context of a user's session. By manipulating the ChatBot responses, an attacker can inject malicious scripts to perform actions on behalf of the user, such as creating a new admin account or changing the user's password, leading to a complete takeover of the AnythingLLM application. The vulnerability stems from the improper sanitization of user and ChatBot input, specifically through the use of `dangerouslySetInnerHTML`. Successful exploitation requires convincing an admin to add a malicious LocalAI ChatBot to their AnythingLLM instance. - 详情 - - - - c6c2b4de3819a8a9e164ce228bf5af3d - CVE-2024-3569 - 2024-04-10 17:15:58 - A Denial of Service (DoS) vulnerability exists in the mintplex-labs/anything-llm repository when the application is running in 'just me' mode with a password. An attacker can exploit this vulnerability by making a request to the endpoint using the [validatedRequest] middleware with a specially crafted 'Authorization:' header. This vulnerability leads to uncontrolled resource consumption, causing a DoS condition. - 详情 - - - - da3606d440a3a32031edd55a2aaf4665 - CVE-2024-3568 - 2024-04-10 17:15:58 - The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data within the `load_repo_checkpoint()` function of the `TFPreTrainedModel()` class. Attackers can execute arbitrary code and commands by crafting a malicious serialized payload, exploiting the use of `pickle.load()` on data from potentially untrusted sources. This vulnerability allows for remote code execution (RCE) by deceiving victims into loading a seemingly harmless checkpoint during a normal training process, thereby enabling attackers to execute arbitrary code on the targeted machine. - 详情 - - - - 6514fc5e7e0ac13c0aa1d2fe4b25f166 - CVE-2024-3388 - 2024-04-10 17:15:57 - A vulnerability in the GlobalProtect Gateway in Palo Alto Networks PAN-OS software enables an authenticated attacker to impersonate another user and send network packets to internal assets. However, this vulnerability does not allow the attacker to receive response packets from those internal assets. - 详情 - -