From ea6d7216d4ed6977607b5c1cd4e01099c0379299 Mon Sep 17 00:00:00 2001 From: Github-Bot Date: Fri, 20 Dec 2024 09:24:34 +0000 Subject: [PATCH] Updated by Github Bot --- cache/Nsfocus.dat | 15 +++ data/cves.db | Bin 50552832 -> 50556928 bytes docs/index.html | 262 +++++++++++++++++++++++----------------------- 3 files changed, 146 insertions(+), 131 deletions(-) diff --git a/cache/Nsfocus.dat b/cache/Nsfocus.dat index fd19111215c..74b50dbda33 100644 --- a/cache/Nsfocus.dat +++ b/cache/Nsfocus.dat @@ -140,3 +140,18 @@ c5c22eeb910f94d4b2cfccc53fe024b4 c89873a677eeba2554c51232bcfdb869 407587df3afafbf556ca40d7d64f0792 0a62b2872bc504fa8b99f8c4402c928c +ef3cf622fad7f26c1725bf23d5266ff4 +3ac9fff0bd53e4e9a73a8f580df2964f +29347e629f920acce581d0e297a85808 +2b47de209bf46333d8c985b15ff2d6d4 +12db2d662497ab92360687af922dd7b7 +405eac730e04718f2389829c4ebe340c +54cc60f968578af27fa549d7265298d8 +5ff1471136fe145794d1582a35334524 +68e837992841f97127270272dfa7f571 +a69181d42d73dec25edb9e6a867996fb +7a194b980285a47edcf37c91e0036d08 +c52b7b3da7db9b795f1aa606f19ce32c +8f90877c2a422d2d9d680dc04ba2592e +b3e87252cdff4fcb5322568c0a35ad0c +d8c6657e25395276ef58426a0e57d4a9 diff --git a/data/cves.db b/data/cves.db index 6cac65fb11ac9ad3bad7b1f1df52e2e1c9ae04a9..bb11a7ee54e052d2adc2ea9f2e16f4d278346245 100644 GIT binary patch delta 4440 zcmZYBcW@PD7sqjOLnP7>(EtKLKtKWS-M*+Gz1N6}1<&5QyMO}05L7HkkfWj^Vv8Cu z7VKEC_aOF)Sg;EyN)!ty7Etj0t~2^#_~UaXGk50qJm);mvy*wN78T9gu&C&Ywgo-w z)l0ieiu>mEtPqtvm6S@pN_~|Am3>qis1&N~tI|-VkxFBgCMr!;nyEBbX`!;8N=udf zRa&VWpmLx}kxFZoHY#mZ4pM2S(q5&5O0h~um4j6}sdQH9qH>5zSCwum-Bk`%IZUO8 zN>7zuDu=72RWd4uim76$*eZ^StKzBnD!o;XP&rcND3v}ceN~QD>8H|PWq`^+l|d?l zRfebxRT-u-TxEpHNR?44qgBSJj8z$@GG3)bdsVb+coTf5OWxC1?l~R?NDyOTIsmxL-SDCGHhRT^L zXQ|9lIa}o%m2*|jQ<yQI!i-E>gKzWueL?DwnEUrm{%oa+Sp@ zSEwvexl-jSm8(^*QMp#7Qsp|8>s4-0sZv?0vP|Vhm1>onRBl$eMdenN+qDo?6BrSi1OGb+!j z)Tpddc}``u%JV8OsJy81lFG{}uc*AL@|w!)DsQN~sq&V}8kM(I)~dXt@~+BzD(|bT zQ~5yULzRzIK34fetYV8Db08xCA}@X;Gb;7A;WKIn_1(GUGG00S`ygE0g{F$}{o0wXaB zqcH|!F%IKVf@3fN$Kp5~kBK+|C*mZWj7c~J$@~Lkkwb_GF(zXQrs7nbhH03N87Rd} zoQ^WgLOEvR44jFxFb8Mj9Gr{uFc;@z9x5;&7hnMt7vdsZjD@%am*O%k!sS?uE3gDt z;woH?Yj7Lkg}ZSNR^VRThx_pWR^mZC zgop769>rsL98cg$JcXz644y>|R^d6U#`AaqFXAP8n18?Fjtijt@i+AuY z-oyJ?hY#=}KElWN1fSwFe2(?lfQ|S9Ut$x!!q?c0T6}|Vu?64Zd;EYOu@&3!6Mn{a z{DNQc8-B+Q?8G1V6T7e*f8{Nd6weio?(YJ<$t?BaI9Un6O~OfeQ~l zdgBNjiKEa5eQ`AUp+5#-AO>MDhF~a$VK_!$Bt~I0#$YVQVLVE33?|@M9EamE5hvh8 zoP?7x38x^Le}F7<2oWL1WK6+SoQl&h4bw3LrI?A+QHEJ4$84N|GjSH?;B1_Ob8#N# z;(W|Q1?J-dEP&!dT!f3U5SQRmT!uxs9E))Umf%WUg{yH5u0w+=}J64Y%VC+=;tzH}1g-+>85gKOVqJJcx(zFdo69cnpu@2|S6X@HC#mv#7x; zJcreI9xvcUyo8tW3SPx)cpY!xO}vFQcpGc+4&KFkcpvNV0Y1b>_!ytyQ+$Tcu^t<+ z5ntd-Y{FOg8k}; zmej?0sm5Ju7F@L@6%|&tcwlg!g0!QxZ5Q`gx+O*VE-Bw9<%gvFn3Sza*_M=_lJav> zwkPG6r2Lwc-;(lsQg$R|XHx!1%AZNum6Y8{`73p4kEQwik(Xc7V`(b?!-twTs5how zqn8R-6fDm#&zoDXwzB!m@kb1=*q==mj%wX?oY`c88RYypj?>xDHX|$Y1J?|^*!I$4 zZ1|29Z+@y~b5-?#V+Zv#(uUR3O+BQl42=b%Y%*Bpj#6jrBhLg*UEtlWx__9haX!ziG!N97L1CuwJvNP1iN;-{k%#MUA!5kB!DRT-~tSzLyp5D6DDG z+)I_DYKqf&d0PvHR5aJxZtSZ25Ox)MImfZx$goY{He4s7W6N-YbY#1s75H^`<=bg{ z)YP)F(z41)*N$sbwRKs3LF%8ThkA^wqN&z)O`0A=eAbLS`ZRJO9mct=Z5oE{c)4_7 z+CiAk)roi0=HElDUOZ*pe>-NLUZ&zetvw{!`2?c9*iU<|n==B-FhV2rLx;1h7DvGVFd~X*MbzToz1^rU$1*WtB@pyH%Bx>@lFE3$vn;)^<(?)R%?a zAmdwE-%A^w9awG@=3>*$`I#u4Hk~l-)#<`_T)Y45snfz>N>%WFew%+sKb~Z(qDX5y zCCL*>4jez@WkSmcT{Dbwh8@vL@1@%(PXSojkpG+SF{W zG^lQ|W__w?&+9y#SSPtR9h2Ar#M*J3vD{3?bmAyu*{*Me8P14XW15z2)O{?rVff~N zvLG(6T(ZzUp!(?S_S8Om9PmgMa4YuH+Tvt^F6X3U-|=kM3u42K1KaXL*KlmZ z_rkh!w_MNg`c0o1{~i2jqP=AA9sb$7mA0cG=bGs#O$#1R-19xd&skA6 zGOfMtyye-M^uW^c(NXycQ)hBFcc+T>*!n2){fcH<+dj!p-c-g2vqtDRhUL3K);CP< zrRN5*&ocZ>TUNTHRyw3%>FzE;y5rDD3rI^Jdg&19?(SSVl@@7GR8qQ8@&0~X z_q@N)%ro;2y%QNe^gv|z4XiIvn!W+k`6tuL$;R!S?CmD);UrM1#o>8%V_M(ax}la<-Z zVr8|mS=p@|R!%FI6=CJJ@>qGTd{%y|fK|{cWEHlGSVgU3R&lF@RnjVDmA1-QWvy~n zd8>j|(W+!swyIcFt!h?v>np2R5HHdRBd_fz{AzWHq*$SWT^FR&%R` z)zV_0R#t1Pjn&p_XSKIFSRJiztWH*EtBcju>SlGfdRX6DJ*{3=Z|gg&kJZ=eXZ5!R zSOcv=*7w$6Ylt<}8fFc*Mpz>)TcfPe));H7HO?AuO|T-ZiPj`*vNgq;YE84ITQjVg z)-3A>Yqs^HHOHE3&9mlP3#^6KB5Sd=#9C@CvzA*ctd-U(Yqhn;T5GMd)>|8_jn*b> zv$e(AYHhQ&TRW_s)-G$ewa40P?X&h$z{bc=Y zow3eZ=dAPA1?!@9$@;~*Z2f9ov94Oztn1bd>!x+fx^3ODezShJ?pl9Xe_DT8_pJNY z1M8vn$a-x3Z9TD`TF_1LLwD{074NR zVfYL&5EHQw8*va9@em&gkPwORIT9lYk|G(BBOG5K1yUjvQX>u0A|28r12W=EWI|?S zK~`i#cH}@#$k7>c6=N}?1>qYTQT9Ll2tDxwl9qYA2` z8mi+f)Id#qjasOUI;e|!sE-C{h(>6PCTNOgXpRC&f7VXd;9ncZqpc6Wy z3%a5kx}yiaMNjlXZ+wS7=!<^nj{z8nLHHhnF$6;~48t)3BVmlfXpF&FjKg?LKqMw& z5+-8`reYeVV+Lko7Jk5N{D?W2i+Pxj1z3nhSd1lDie*@i6+2+9KvB7!BHH;ah$+OoWg1Rgr9K+XK@baaRC=` z3BTYne#I4B#Wh^V4cx>n+{PXJhTm})f8bC2g?qS<2Y84_c#OaC1W)k{&+!5;@d~f; z25<2W@9_a2@elsRfA|zKRsqf*0fZtt!tfblASPlVHsT;I;vqf~AR!Xrb0kI*BtxJf3Zz6Tq(&N~MLMKM24uvS$b`(uf~?4f?8t$f$b|^xMjqrvKIBIM6ht8uMiCT6 zF%(A$ltd|%Mj4bvIh02QR753IMio>=HB`q}sDYaJ8nsXxbx;@eP#+D@5RK3nP0$q0 z&>St$62bjjp*7l|E!v?yI-n!IK__%Z7j#88bVm<-i=OC(-uMoE&=>vC9|JHDgYZ2D zV+e*~7=~j6M#30{(HMiV7>DtgfJjWlBuvH>OvN-z#|+HGEc}4k_z`n37xOS53$PH2 zuoz3Q6w9z2E3gu)uo`Qy7VEGc8?X_Zuo+vh72B{KJFpYGup4`@7yGauQ8<8uIE2GE zf}=Qw<2ZqnIEB;r2|wcu&f*--;{q0pk4CYlZuY-9L%-dkz1@k_b z55as4=AU5x4d%aKJ_W`{%njuc5*igTHxPPxOWd%K!O`Lzi@7#zX=v{q3D5QJ77{hM Kc4+AE`2Pc=m2rsx diff --git a/docs/index.html b/docs/index.html index 785fc7221e6..11f0817aa33 100644 --- a/docs/index.html +++ b/docs/index.html @@ -1,4 +1,4 @@ - + @@ -366,7 +366,7 @@

眈眈探求 | + 2024-12-18 16:15:13 IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.9 stores user credentials in plain text which can be read by an authenticated user with access to the pod. 详情 @@ -374,7 +374,7 @@

眈眈探求 | + 2024-12-18 16:15:13 A use-after-free vulnerability exists in the way Foxit Reader 2024.3.0.26795 handles a checkbox CBF_Widget object. A specially crafted Javascript code inside a malicious PDF document can trigger this vulnerability, which can lead to memory corruption and result in arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled. 详情 @@ -382,7 +382,7 @@

眈眈探求 | + 2024-12-18 16:15:13 A use-after-free vulnerability exists in the way Foxit Reader 2024.3.0.26795 handles a 3D page object. A specially crafted Javascript code inside a malicious PDF document can trigger this vulnerability, which can lead to memory corruption and result in arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled. 详情 @@ -390,7 +390,7 @@

眈眈探求 | + 2024-12-18 16:15:13 IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.9 does not properly validate a certificate which could allow an attacker to spoof a trusted entity by interfering in the communication path between the host and client. 详情 @@ -398,7 +398,7 @@

眈眈探求 | + 2024-12-18 16:15:11 A denial-of-service vulnerability exists in the Rockwell Automation Power Monitor 1000. The vulnerability results in a buffer-overflow, potentially causing denial-of-service. 详情 @@ -406,7 +406,7 @@

眈眈探求 | + 2024-12-18 16:15:11 A denial-of-service and possible remote code execution vulnerability exists in the Rockwell Automation Power Monitor 1000. The vulnerability results in corruption of the heap memory which may compromise the integrity of the system, potentially allowing for remote code execution or a denial-of-service attack. 详情 @@ -414,7 +414,7 @@

眈眈探求 | + 2024-12-18 16:15:10 A device takeover vulnerability exists in the Rockwell Automation Power Monitor 1000. This vulnerability allows configuration of a new Policyholder user without any authentication via API. Policyholder user is the most privileged user that can perform edit operations, creating admin users and performing factory reset. 详情 @@ -422,7 +422,7 @@

眈眈探求 | + 2024-12-18 16:15:10 IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.9 could allow a privileged user to obtain highly sensitive user credentials from secret keys that are stored in clear text. 详情 @@ -430,7 +430,7 @@

眈眈探求 | + 2024-12-18 14:15:23 Incorrect Implementation of Authentication Algorithm in Apache Kafka's SCRAM implementation. Issue Summary: Apache Kafka's implementation of the Salted Challenge Response Authentication Mechanism (SCRAM) did not fully adhere to the requirements of RFC 5802 [1]. Specifically, as per RFC 5802, the server must verify that the nonce sent by the client in the second message matches the nonce sent by the server in its first message. However, Kafka's SCRAM implementation did not perform this validation. Impact: This vulnerability is exploitable only when an attacker has plaintext access to the SCRAM authentication exchange. However, the usage of SCRAM over plaintext is strongly discouraged as it is considered an insecure practice [2]. Apache Kafka recommends deploying SCRAM exclusively with TLS encryption to protect SCRAM exchanges from interception [3]. Deployments using SCRAM with TLS are not affected by this issue. How to Detect If You Are Impacted: If your deployment uses SCRAM authentication over plaintext communication channels (without TLS encryption), you are likely impacted. To check if TLS is enabled, review your server.properties configuration file for listeners property. If you have SASL_PLAINTEXT in the listeners, then you are likely impacted. Fix Details: The issue has been addressed by introducing nonce verification in the final message of the SCRAM authentication exchange to ensure compliance with RFC 5802. Affected Versions: Apache Kafka versions 0.10.2.0 through 3.9.0, excluding the fixed versions below. Fixed Versions: 3.9.0 3.8.1 3.7.2 Users are advised to upgrade to 3.7.2 or later to mitigate this issue. Recommendations for Mitigation: Users unable to upgrade to the fixed versions can mitigate the issue by: - Using TLS with SCRAM Authentication: Always deploy SCRAM over TLS to encrypt authentication exchanges and protect against interception. - Considering Alternative Authentication Mechanisms: Evaluate alternative authentication mechanisms, such as PLAIN, Kerberos or OAuth with TLS, which provide additional layers of security. 详情 @@ -438,7 +438,7 @@

眈眈探求 | + 2024-12-18 13:15:06 A Cleartext Storage of Sensitive Information vulnerability [CWE-312] in FortiClientWindows 7.4.0 through 7.4.1, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13 and FortiClientLinux 7.4.0 through 7.4.2, 7.2.0 through 7.2.7, 7.0.0 through 7.0.13 may permit a local authenticated user to retrieve VPN password via memory dump, due to JavaScript's garbage collector 详情 @@ -1987,6 +1987,126 @@

眈眈探求 | TITLE URL + + ef3cf622fad7f26c1725bf23d5266ff4 + CVE-2024-4741 + 2024-12-20 09:22:26 + OpenSSL内存错误引用漏洞 + 详情 + + + + 3ac9fff0bd53e4e9a73a8f580df2964f + CVE-2024-7048 + 2024-12-20 09:22:26 + Open WebUI权限管理不当漏洞 + 详情 + + + + 29347e629f920acce581d0e297a85808 + CVE-2024-48933 + 2024-12-20 09:22:26 + LemonLDAP::NG命令执行漏洞 + 详情 + + + + 2b47de209bf46333d8c985b15ff2d6d4 + CVE-2024-7037 + 2024-12-20 09:22:26 + Open WebUI路径遍历漏洞 + 详情 + + + + 12db2d662497ab92360687af922dd7b7 + CVE-2024-11165 + 2024-12-20 09:22:26 + YugabyteDB信息泄露漏洞 + 详情 + + + + 405eac730e04718f2389829c4ebe340c + CVE-2024-48510 + 2024-12-20 09:22:26 + DotNetZip目录遍历漏洞 + 详情 + + + + 54cc60f968578af27fa549d7265298d8 + CVE-2024-47828 + 2024-12-20 09:22:26 + Ampache跨站请求伪造漏洞 + 详情 + + + + 5ff1471136fe145794d1582a35334524 + CVE-2024-52293 + 2024-12-20 09:22:26 + Craft CMS路径遍历漏洞 + 详情 + + + + 68e837992841f97127270272dfa7f571 + CVE-2024-46304 + 2024-12-20 09:22:26 + obgm libcoap拒绝服务漏洞 + 详情 + + + + a69181d42d73dec25edb9e6a867996fb + CVE-2024-9671 + 2024-12-20 09:22:26 + Red Hat 3scale身份验证错误漏洞 + 详情 + + + + 7a194b980285a47edcf37c91e0036d08 + CVE-2024-9675 + 2024-12-20 09:22:26 + Buildah路径遍历漏洞 + 详情 + + + + c52b7b3da7db9b795f1aa606f19ce32c + CVE-2024-47425 + 2024-12-20 09:22:26 + Adobe Framemaker数字错误漏洞 + 详情 + + + + 8f90877c2a422d2d9d680dc04ba2592e + CVE-2024-25825 + 2024-12-20 09:22:26 + FydeOS多款产品信息泄露漏洞 + 详情 + + + + b3e87252cdff4fcb5322568c0a35ad0c + CVE-2024-7038 + 2024-12-20 09:22:26 + Open WebUI信息泄露漏洞 + 详情 + + + + d8c6657e25395276ef58426a0e57d4a9 + CVE-2024-49505 + 2024-12-20 09:22:26 + MirrorCache跨站脚本漏洞 + 详情 + + ed9709003f2850f368b87e359a4b7e22 CVE-2024-28731 @@ -2107,126 +2227,6 @@

眈眈探求 | 详情 - - 10f515684e689350774b3821a07710ca - CVE-2024-47877 - 2024-12-18 09:24:31 - codeclysm Extract命令执行漏洞 - 详情 - - - - ca1bc1dd1a6c49935452f5dc18f0ba7c - CVE-2024-44415 - 2024-12-18 09:24:31 - D-Link DI_8200缓冲区溢出漏洞 - 详情 - - - - d47874e7c1513ebe49c7949549ebef74 - CVE-2024-44414 - 2024-12-18 09:24:31 - WayOS FBM_292W命令注入漏洞 - 详情 - - - - 6bb5cd0c5c5f113c21800091ac61229e - CVE-2024-33579 - 2024-12-18 09:24:31 - Lenovo Baiying DLL劫持漏洞 - 详情 - - - - c9d621c12de97a061edaaf073ad1f092 - CVE-2024-47830 - 2024-12-18 09:24:31 - Plane权限错误漏洞 - 详情 - - - - 38bded66b3e5b4d19e6fe34fcf22ead4 - CVE-2024-47074 - 2024-12-18 09:24:31 - DataEase代码问题漏洞 - 详情 - - - - 3966fe51df0358fbc0c8eee4a9cd2e36 - CVE-2024-8376 - 2024-12-18 09:24:31 - Eclipse Mosquitto释放后重用漏洞 - 详情 - - - - dd5e8957aca724dba08798f4ade2f0c4 - CVE-2024-4089 - 2024-12-18 09:24:31 - Lenovo Super File权限提升漏洞 - 详情 - - - - 81d4d8902c3b33df18f6c49e352f33fb - CVE-2024-47875 - 2024-12-18 09:24:31 - Cure53 DOMPurify跨站脚本漏洞 - 详情 - - - - 93210ae12e1a7d9f6db333e4f67037f5 - CVE-2024-8755 - 2024-12-18 09:24:31 - Progress多个产品输入验证错误漏洞 - 详情 - - - - 511c48ad2e6b53d85cc0b411a49a2c85 - CVE-2024-33581 - 2024-12-18 09:24:31 - Lenovo PC Manager DLL劫持漏洞 - 详情 - - - - 4fee4f28171eb8d45bcb7e6042f1722d - CVE-2024-4132 - 2024-12-18 09:24:31 - Lenovo Lock Screen权限提升漏洞 - 详情 - - - - b8f38e44ab356dd48f0309545a8ddeba - CVE-2024-4131 - 2024-12-18 09:24:31 - Lenovo Emulator权限提升漏洞 - 详情 - - - - 144e283743321111c11b228551f0f348 - CVE-2024-4130 - 2024-12-18 09:24:31 - Lenovo App Store权限提升漏洞 - 详情 - - - - fd41ed18a67548fb1b9c7b902781fca2 - CVE-2024-45396 - 2024-12-18 09:24:31 - H2O quicly拒绝服务漏洞 - 详情 - -