From f4bdd7e848d26c0016ea2d7c2b128d58db0a37a9 Mon Sep 17 00:00:00 2001 From: Github-Bot Date: Wed, 8 May 2024 07:25:39 +0000 Subject: [PATCH] Updated by Github Bot --- cache/Nsfocus.dat | 15 ++ cache/Tenable (Nessus).dat | 10 + data/cves.db | Bin 47403008 -> 47419392 bytes docs/index.html | 402 ++++++++++++++++++------------------- 4 files changed, 226 insertions(+), 201 deletions(-) diff --git a/cache/Nsfocus.dat b/cache/Nsfocus.dat index 5184781df83..4497329a253 100644 --- a/cache/Nsfocus.dat +++ b/cache/Nsfocus.dat @@ -113,3 +113,18 @@ eb7df21e92dee2c4af829c367b2966b3 29d6f20452439c43f4a6a3569e3d76b3 4d5f9149443004fd4767459bd07734d7 0bed997cc19ccb5aae04bb814d5dd84a +f38cd5d0e49cdfd96593ab8c576d0638 +931980481d5e62d65c3120fa34d53dea +af5ab7402edbcffba782efc76f1210d5 +5bc0ade68ac7e2329634c900b220f236 +f858d7f1ae681d2d3ecdc32e0afda767 +7bf2d005016eff3535919c62d7bdeb48 +8601f610d9c3f317f18c8788cb5291d8 +8427c43f1fac1d903d18294509959f3c +4d948e23703c002e321c1fdb7af74b87 +b9d00a7f8c74c7705c627b0363c1fac4 +88f9842fbf1d0cb3b8e2d319f10c7cde +15fe0c1350cd6213263aeb04266c9fbc +f03ef7fb3d699a842e1a1fec38587f7f +3658d37af87f97dbf3c350b1e1954e31 +9395eea460da83a16ff89b2b9b9824c2 diff --git a/cache/Tenable (Nessus).dat b/cache/Tenable (Nessus).dat index 6ed65926a62..a2997577982 100644 --- a/cache/Tenable (Nessus).dat +++ b/cache/Tenable (Nessus).dat @@ -142,3 +142,13 @@ a6c271677f8b5c4d62dcb2e8082098de f0ea29e053227cf62051a1a5725afc5d 3b27ca14bad075026017b1c9b37ba3a7 6cbdf5d08ee14f65dcf9ef372bada2a5 +ee4d6349ce5e5820111c2f9faf97110a +e4aa475ad5c994cbd6aaadbbc024b14b +4fa9d1071d1d5f6ae3d0b1278b123840 +acb1dd99034b22e19bbceb314bbd00db +87e8581c949994b12aacc97f24a9d939 +5aa7fe79f5f805d1b88b5ed25e66fc70 +7b3a71c97d206d3b26244f96efd1cfc4 +52fa672bbd3a7f22a0f78fd08f91a0ee +ef976b03caaeb0cdf5fee42b6b02e889 +1e5dfcdbfb82e43fab4e5369d9a56145 diff --git a/data/cves.db b/data/cves.db index 4a048e2c68623be1ea11b1a6e0a73902135b8630..dd1966204dfe0c6b5ba7d28c08b8a9a3b91db279 100644 GIT binary patch delta 12185 zcmeI&d3aRiy$5jSkcF@s5<(yZ4`Ej(%sFRPTmu1(CJ+Qgw3XkPvm_&vnJ`O2R2m}w z5ZnN_aX;WvwY7>`gF9*!H(b!x)~c;kE47PDZM9UZ_xqj+2x{;3_TJ~YeV)r7AM!wE z-tD~a@BO{+Vdci>DpqcMzG8h<;pBe(ypav^QJ%>?#N=U;nEEpnFcmTtF%>fnU@Bo6 z$TWy)Fw+pGp-jV=4q_^08qQS4RL(Slse)-FQzg?VrqN7QOk7Bii~bSl$#n7+$&8q*RcjE~L~WipsdCX2~tYGG<+iZPwew3I2%)W(!x zN;0)GEn`YCrI|8JS*8xAPNwBdT})>%oyl|-(+Z~VF?BPoWa?o$n`sr(IZVv7n(17o zHB4)n&SN^C=>nz;nJ!{l$F!bl1JlJ!moQz*bQ#m-OgW}2n66~His@>mYnZNOx{k?V z+Q_tt>3XIcm~LdciRt@HH#6PBbSu*jn10A~8`F=NZfClKX*1KEOm{Ke&GciYdzgBe zwlLkxbRX0GOb;+U$n+4?!%SP59$|Wv=`p6CFg?!n1k*OACz+mNdYb7Ore~S9Gd;)j zJktwIFEZ_5dWq>}rk^tXjOi7opELb}=~bp*GQGz1I@23Wzhe3|)0<2?nSR6c7Sr2I zzh!!dX&2M)nBHajJ<}hU{>bzvruUfMXZnEYL#977eZ=$^roS?M%=8J<-gJzfyC%^(&2q(fxun10u#c&Fo z3g3b6!fCJs#Q5tF1p`d5z=jrRg&3R;OCb(zkboq#!!k%g8ZwZD4(NpC&;@6}nQ#`Y zfbT&!tb`so8&<(Nz_1$5g*C7i&V%#e0=N(^f_1PSHo(Pj30w-7!R3&HE8t4F3a*B0 z;99s29M}k(;Ci?LZiJiQ`*1Vd0=L2s;D>M<{0MG`J76>133tKW@ME|KdSMIP3-`hO z@Blmr55dE*6&`^{;W79LJPuF5Hh2=Af~Vmbcow$9bMQR8058H0cnMyHpTf`J75F*) z0$zn*!fWt4yaB(0U&EWQ6Mh44!Q1d#cn5aD@8DhdJ^TUw2!De2;C=W2K7>ERNAMT; zD|`%}z~5ju{2e}p&)^^MIeg(+OA?kpNYEb&pb(0n7zRKI41_^27>2-57zPJHDGY}) zD2EYH0VAOjM!{&Pf-z7HW8q+sVI0)Jc$feaVG>M+DKHfdfkR;$c%c@igAWu?K?6So zAP6A{Lj-2PVQ@Gc0Y}17a5U7xOqd1rFdOE;F>ow2z;SRqG(r>1g?Z2n^Wg+o01M$n zI0+WP$*>qsfm7i-@Lf0!mVg+49im`>2^QGU0<92((_tyZp$!s{gmzd4DM&*Gvd{sY zupGMJ3^)_cf)(&R=!TWh182i3I0qP3!?~~q*1~ykK3o77!bPwS*24z47%qWJ;WD@! za&QG)30J|@a1C4w*MS2YVG~>rH^7Z>6MP?ThFjoP_yPP7Zi64e?QjQdhCAUdxEp>9 z_dqXffqUUTxE~&X2jL-j7`DPA@F+Y6KY_>L3D^ct!c*`xJOj_dc6bh+hZo>Q=^@%7 z-Oyd)kp}#^pU5h=4qmxK`pi>YQe4t+!0rKCOMQ)=o&C4S2i;N7f3!Euz2oqy5ciJ7 zk0AGs!H)pDwAodbg<*Oqt& zG!)-lTv*gn_2xxc{@v}HcHN%aXOK=7 zl?8gLxwl+YW}vcg*p8qJcGOl(pAprfVM{eNC1NW+BV?G?ewE>Y;QMO56^|t>U2d*x zk{4J;%F5(EeEqdCMSia@;Ptt~rihw?qNcJvHAN$)&!>m%uo3bbp^z_N1l3T~rv)`b zv30}Qu<3cJtURE6i_*JA>7gEtdxw{xA3a0R5x*JnqwQMArx`wHz1> zPal_x`tRxS0@0>$&q(eqMUN+o$&PUi8Gg+c-BZknPcxOUijVmskw65q@heSIf&qWC z-fpF4Wi#^JW2QIF$=zv}RqZ>h?ktap*?5o`RxumHL7!p=6`vU~G+R?bwh}hNp>WuU z2GodRhWD#P^J0>Q0?vvX3q2F}EqET974r2=;@)AR;4BIbMQs&NEZ|dumThYREf7&6 zcxGlOYFbhM{sm)Zs9GevAeo36i|QI1bIlhG9_4&I_Gzhd?+7gxbtpZh+&fg%aXjj< zv1Cj%S+{~=#l*z34Aan5%ct9>9twW#p@o&OvM`&9CTAv->5M!p+192f%(PRA^_q_Z zVm*aa(UBp0IueK)KHWqOx)H(zQ6oXkZ$x~)sH*yGRSWJnLg+|H4F(!!Hpya5wWRb+ z42x=JHZ9x9lzhhYdAXenH|#gpj~7*HBFqgIRf;FC+W|cq@?#pBQNy;QdMK<~wh;>2 zii$@S_-d7^<`0T0W0#D(s4BO4`k-!rD2~R;})>+ zRDuCRQ_vw@^P2(9wDhmmft9O$eZo5*p3YLuJ^`sw)D-Bc;NF3vrW3_e(!z!rFnyLk zVwkoW2?ipX9t|6TP|)-Rwf$!T0+Jfh!m)+fgq6Ph+{&>|V#*Wytdl}fesHTa_hspG z&#)obl?tSR{Yq{t8d`9bw58Oy@>7qO2Vv_O*yNpj&Is+C5leIMI zf34P+>-qS~vfP`wpAK=PoriixIFs(5Dh&_nhKQW8M2nn3Q71LYovl{Na{n@Ozk=jg zT87{L{FF2)3wBJ>k(7&g%lIB&JOC9W@1BCLt*@( zg&pOY$EB(YzYQvYk7t50?(r{9e)0bFuY~7Cl@& zURynWiRIUIe<+}v0V5Le8&NZ;>$-^vhjb*W^lYW9SQxnO8BMo!Mi)80&hgSU>^65 z5-mP|v3CCAC6?tk5z!)s6|e$f)u$+mq1q8!N7Cac#v7ihVl>#VgzIwK=YKS&NXE1^ zmO49{KKIl(jU!W1Nq2n~lQk*pa#TEmbUNGC?nXU4Hn9*oVyU@SW>!3AB{B{3W_RF6 zV=~!3Whx$0rZs6!b3a9&BUXF@QxQ!`i0bWBvhAB%o$r6GELQPk^eWSyN-pm*C(EXe zd7H?2{<68UEM+arBJE4p$_=(0k45o0XW0wKN)=AojfY61E5*2pK!O3cruB6abAFoR zc_rv68=p3i42YqPrQ{@jq&j113+1%M#8A2`#qk_@ji<`ly({S%nOiyX+~ShGZE;Fx zyzi+Pm}se$Pe7A0mO}+Ect!;DEQ(5GV&Z|I^VrnfI=V0_+4$ZC7|ZOp@|@B?-Y-?= zUZ4Nb-~;pL|MmPC`=8Grr}2#6dumJb0Y_}^QomRF6|U}=E8Te9v);9b;$$fz*P4K~ zCa@%+<2Yc2B6h$I`vRsC4Tqxv%T$ri1Z~6Fv2nXp)uKc+-`u3!D5kxPOl)qpEsF4x zv}F-+k*{OJPA1awba^I%SKnXdS@9&+%1o}%XDG&>+-i~K&|X}rkyQ~=x$AR%E(H)uoLt(t==or zN5hSuY5Wdr4VxX7Uv_VCK4jl zpG}DXBxZiXGQ{4HmOEqdIEK(jBC2BClIUzSZcXb(gj#C3fz{9vz2yY<@_djH4MubI z1ipqA>75BwAMJ8?k9>c{gNYf|ezB)7U-}l0z?}n!9he0F_mkkT|G^~4-TCR3Y1aiF zL;k7xF3oapwTKv(bZeJ%FA0Y%oEQ}&;*TIZL(-{Z8;pc()sMV1;_N)@5ot_+Tp8t* zyWbeyrZv+dY$9dG$4 zsnQvC*e%i^r*7L@p0eB>xmydnr-{4+D^nynonl{>MY0o@Q^{mTwwAZYlZabllBZ(E z(mh9uzOs=iCGm0H6#uS^T*qBvnN(7oE99E?cor8AHMMdbmKs*4n=Z8K?O4oW<%rFD zhB)%Xm!gh+0<$==if&m*)kOA_Li_W%irYV=A}Kx9U0)m^%pyXP4UIKyGl3Q`~?n_~?`mMCHqhzf#!a4GZDyg`;!~LS@c$@x} zZX?v;RE-#vK%b)+E%*1fNZzJcwa8ZzNYqSuPQ#peB5sKsS{A>ZDkBQ&G9q`E9M@AV zmiw>yXXl0*#5c4ooAD-XXYpI-cuFVq6*%3rI;NjtrIJ(K#v_#F6Dqe0&JN>JPepg! z>YD*>0w?!{KKzVzpzanlNVFmCPHcI)l`*ELTXi$pnIBiT_4^ExI3Tv`DUrP5IiOh$ za~s?OYUSDPiO7uUEeV`eV}>~Sq_gAWnZ5a@_@emBSL=4#CvEeLs)}3s(lqi#F&``h z*nNs}#vQdyD$7;9(LDTQWS#l+-O%wN%pN>;@%X2Sh@8%1%DVHd@63zUv2Q_gy46hw zt>w4|6Aw9=ZD|$rFrCbKuD^HW(Dt})SmJ5m{AS9z53hNARPJbguh99RZn~#%FuHH< znLN4fzpfhL{_+rakzl!@0ph{hT_^$D5sFXgqKUd`#>DP|Q&Z{gN>4?gZ~MX=!q9i< zDfguK<)^SA;hf#BXIjO1d`}N^A9j9Rp1W{#dvW%owUOI8i%G*#7ob|`F{KD;qfbe~hVV~bQ(;Ky4JNB4Jm zri>D)m0_haIwEo3Jzg9cNIadZo3X9D(89UR%zb#w?UlK8PE+wDvHy#mSkEHnBZjx^ zpY|*H%f5f9?7{n%?da7DJco$eJ~VYb-p?E?y0~tfwr<>#P!wH5IvFxmU(nQ|YEbq2 z?Fe3Yn2KTNdR}cBwJ4uOHo8gO2_mVR-IvsfgW;@X!j83M``!}N$K10Kax1YLiOu%E zIB*u_51h`1)|sBM2fIhje^w&SmqTW6_l)k&pOoB7HoRBDg-{ZyLf=ugFBQb@8%uN~ zm+r~>D4A-hO|`exqDi$KzS_Q1a+99GsHbZ8J$q8$ot~U=w_IIbYIRM=CXXA!HoYBt zwDZUpDNn`0$OVu@M7_95%Jn>#sm zqen><-F6b^Q88?o41GsS@y4Z7Pl@}${H@(SL!Cq#n8GEyn@oslM1ASaj2SbL?~pjE ze);iQycNa49+zHmoJ{e@o>XD)$GY?Hd32GNWcD6XV+k8QPZ(%{coQHJAaRK8%3l+T zaody8_Z{8cN9aBwku-_hIydLq+oM5nL~2&?PnF>e1q#kk?I+(F{?v#*F7xc z7xB|=z|GO)t|DL;<14{+(8xAa$f8(W6`n9FvlwL7Os>r=Lta-G1p)p8}h!n#! zNbNUhYw3$mc*Yfo|9Uf^*t@oYduv3Rv1Y!uX1=ai0n;|{Usj@cZ;byzphx{yKnvoI zLk|QMr!F;I8Z$AZseyWLV=S>$uCHtMV((Jr`ub+vfo9|d3-Btc5ob3?_ssTG=0*=yYjJ?x0swV{=EXUQy`GU1fWUoV9~ic!oPKz4aj8VQ#DL9qYW=@{%;5xUavRGNIa4VaY-O6F*v~pRwtvpsVXKH$)GB5b zw@O$gtx{HLtBh6FDrc3qDp(b*N>*j7idEIBW>vRpST(I$R&A?}RoAL#)wdd04Xs92 zW2=eP)M{omw^~>&tyWfRtBuvxYG<{#I#?a8PF82Di`CWYW_7oESUs&?R&T41)z_j= zKdZkrz#3=`vIbj2tfAI0Yq%9@jj%>qqpZ=^7;CIG&Khq`uqIlQtjX3CYpONPnr_Xo zW?HkX*;bS_$C_)+v*ug27FY|dMOL)6*ji#OwPLJg)^aP>T4AlUR#~g9HP%{doweTD zU~RNES(~jb)>dnq6=!X?c33;DUDj@EkG0p@XYIERSO={`)?w?2b<{d$9k)(cC#_S~ zY3qy?Z=JQyS?8?_)z;MrdSE@Y9$AmA zB3KQtv{?kt-q|ltyk7R)@$qEXa&V62mvHVFj62T zQXw@$kOpay4(Sn!3+ zB~TKjP#R@W7UfVL6;KhCP#INF71dB3HBb|^P#bkn7xhpd4bTvc&=^h76wS~aEzlCJ z&>C&f7VXd;9ncY-&>3CO72VJsJMZw7ytL~hyECVff$6r7=ob~hT(|B2#mxi zjK&y@#W;+|1Wd#vOvV&U#WYOE49vtV%tjREU@qoiK8yueh((CTVl2T@#9$egBNi*L z605KpYp@pUupS$*5u30XTd)<|5Qpv9ft}ce-PnV@*oXZ%fP*-M!#IMYIELdmfs;6e z(>Q~8oW(hu#|2zO0xlsDmvIGGaShjT12=ICw{Zt|aS!+L01xp9kCB8Yc#1dhCf>r^ zcn9y|J-m+(@F70J$9RTM@F_mS=lB9&;wyZOZ}2U?!}s_BKjJ6+jOTcPU+@yY;y3(` zKkz61!ryp>fAAXr21P5t{1HHM1S17fA{A021Zj{K>5v|w$bc|pL?&cL7Gy;@vLQQi zASZGmH}W7a@*x8GQ2+%|2!&AuMNtgJQ354V3Z+p7Wl;|0Q2`ZE36)U=RZ$JqQ3Ewm z3$;-Pbx{xX(Ett62#wJMP0Gd_j3F3`VHl1`jKD~Y!f1@aSd7DXOu$4;!emUrR7}Hk%)m^{!fZrg z4(4JW=EGQkg;<1WEXEQnMGTfz%OW6}jL4~tF; yB!)#l3A{WLk~}n!EJI}I(a^+<&$0xb2ggT@c@dd1KB8Rb4S~c!o2P--LH_|ARSjhT diff --git a/docs/index.html b/docs/index.html index 37965cdbd61..9f82a3832f2 100644 --- a/docs/index.html +++ b/docs/index.html @@ -1,4 +1,4 @@ - + @@ -283,6 +283,86 @@

眈眈探求 | TITLE URL + + ee4d6349ce5e5820111c2f9faf97110a + CVE-2024-4418 + 2024-05-08 03:15:07 + A race condition leading to a stack use-after-free flaw was found in libvirt. Due to a bad assumption in the virNetClientIOEventLoop() method, the `data` pointer to a stack-allocated virNetClientIOEventData structure ended up being used in the virNetClientIOEventFD callback while the data pointer's stack frame was concurrently being "freed" when returning from virNetClientIOEventLoop(). The 'virtproxyd' daemon can be used to trigger requests. If libvirt is configured with fine-grained access control, this issue, in theory, allows a user to escape their otherwise limited access. This flaw allows a local, unprivileged user to access virtproxyd without authenticating. Remote users would need to authenticate before they could access it. + 详情 + + + + e4aa475ad5c994cbd6aaadbbc024b14b + CVE-2024-4393 + 2024-05-08 03:15:07 + The Social Connect plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.2. This is due to insufficient verification on the OpenID server being supplied during the social login through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email. + 详情 + + + + 4fa9d1071d1d5f6ae3d0b1278b123840 + CVE-2024-4162 + 2024-05-08 03:15:06 + A buffer error in Panasonic KW Watcher versions 1.00 through 2.83 may allow attackers malicious read access to memory. + 详情 + + + + acb1dd99034b22e19bbceb314bbd00db + CVE-2024-2860 + 2024-05-08 02:15:09 + The PostgreSQL implementation in Brocade SANnav versions before 2.3.0a is vulnerable to an incorrect local authentication flaw. An attacker accessing the VM where the Brocade SANnav is installed can gain access to sensitive data inside the PostgreSQL database. + 详情 + + + + 87e8581c949994b12aacc97f24a9d939 + CVE-2024-2746 + 2024-05-08 02:15:09 + Incomplete fix for CVE-2024-1929 The problem with CVE-2024-1929 was that the dnf5 D-Bus daemon accepted arbitrary configuration parameters from unprivileged users, which allowed a local root exploit by tricking the daemon into loading a user controlled "plugin". All of this happened before Polkit authentication was even started. The dnf5 library code does not check whether non-root users control the directory in question. On one hand, this poses a Denial-of-Service attack vector by making the daemonoperate on a blocking file (e.g. named FIFO special file) or a very large file that causes an out-of-memory situation (e.g. /dev/zero). On the other hand, this can be used to let the daemon process privileged files like /etc/shadow. The file in question is parsed as an INI file. Error diagnostics resulting from parsing privileged files could cause information leaks, if these diagnostics are accessible to unprivileged users. In the case of libdnf5, no such user accessible diagnostics should exist, though. Also, a local attacker can place a valid repository configuration file in this directory. This configuration file allows to specify a plethora of additional configuration options. This makes various additional code paths in libdnf5 accessible to the attacker. + 详情 + + + + 5aa7fe79f5f805d1b88b5ed25e66fc70 + CVE-2024-1930 + 2024-05-08 02:15:09 + No Limit on Number of Open Sessions / Bad Session Close Behaviour in dnf5daemon-server before 5.1.17 allows a malicious user to impact Availability via No Limit on Number of Open Sessions. There is no limit on how many sessions D-Bus clients may create using the `open_session()` D-Bus method. For each session a thread is created in dnf5daemon-server. This spends a couple of hundred megabytes of memory in the process. Further connections will become impossible, likely because no more threads can be spawned by the D-Bus service. + 详情 + + + + 7b3a71c97d206d3b26244f96efd1cfc4 + CVE-2024-1929 + 2024-05-08 02:15:09 + Local Root Exploit via Configuration Dictionary in dnf5daemon-server before 5.1.17 allows a malicious user to impact Confidentiality and Integrity via Configuration Dictionary. There are issues with the D-Bus interface long before Polkit is invoked. The `org.rpm.dnf.v0.SessionManager.open_session` method takes a key/value map of configuration entries. A sub-entry in this map, placed under the "config" key, is another key/value map. The configuration values found in it will be forwarded as configuration overrides to the `libdnf5::Base` configuration. Practically all libdnf5 configuration aspects can be influenced here. Already when opening the session via D-Bus, the libdnf5 will be initialized using these override configuration values. There is no sanity checking of the content of this "config" map, which is untrusted data. It is possible to make the library loading a plug-in shared library under control of an unprivileged user, hence achieving root access. + 详情 + + + + 52fa672bbd3a7f22a0f78fd08f91a0ee + CVE-2024-4456 + 2024-05-08 01:15:06 + In affected versions of Octopus Server with certain access levels it was possible to embed a Cross-Site Scripting payload on the audit page. + 详情 + + + + ef976b03caaeb0cdf5fee42b6b02e889 + CVE-2023-40490 + 2024-05-07 23:15:16 + Maxon Cinema 4D SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Maxon Cinema 4D. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-21438. + 详情 + + + + 1e5dfcdbfb82e43fab4e5369d9a56145 + CVE-2023-37325 + 2024-05-07 23:15:16 + D-Link DAP-2622 DDP Set SSID List Missing Authentication Vulnerability. This vulnerability allows network-adjacent attackers to make unauthorized changes to device configuration on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the DDP service. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to manipulate wireless authentication settings. Was ZDI-CAN-20104. + 详情 + + 2d9be68420cba2948c175e712a063298 CVE-2024-2913 @@ -443,86 +523,6 @@

眈眈探求 | 详情 - - 9a64fd3ea990ec616bdbf594b16b0e6e - CVE-2024-4493 - 2024-05-05 03:15:07 - A vulnerability, which was classified as critical, was found in Tenda i21 1.0.0.14(4656). Affected is the function formSetAutoPing. The manipulation of the argument ping1/ping2 leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-263082 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. - 详情 - - - - 72fe7aa0e375a66197448fea1aa700ca - CVE-2024-34490 - 2024-05-05 03:15:07 - In Maxima through 5.47.0 before 51704c, the plotting facilities make use of predictable names under /tmp. Thus, the contents may be controlled by a local attacker who can create files in advance with these names. This affects, for example, plot2d. - 详情 - - - - fc24713ce3a9173484ce6b5457714923 - CVE-2024-34489 - 2024-05-05 03:15:07 - OFPHello in parser.py in Faucet SDN Ryu 4.34 allows attackers to cause a denial of service (infinite loop) via length=0. - 详情 - - - - 0cc1c8dd6314f422d5b4c25fa3ef8af3 - CVE-2024-34488 - 2024-05-05 03:15:07 - OFPMultipartReply in parser.py in Faucet SDN Ryu 4.34 allows attackers to cause a denial of service (infinite loop) via b.length=0. - 详情 - - - - db0165496031b41f4575154155f0f1e3 - CVE-2024-34487 - 2024-05-05 03:15:07 - OFPFlowStats in parser.py in Faucet SDN Ryu 4.34 allows attackers to cause a denial of service (infinite loop) via inst.length=0. - 详情 - - - - 4364e0e862f93ef28657ee90fb05e3cf - CVE-2024-34486 - 2024-05-05 03:15:07 - OFPPacketQueue in parser.py in Faucet SDN Ryu 4.34 allows attackers to cause a denial of service (infinite loop) via OFPQueueProp.len=0. - 详情 - - - - d43a7635a07e7d333585d0738dc300fe - CVE-2024-34484 - 2024-05-05 02:15:07 - OFPBucket in parser.py in Faucet SDN Ryu 4.34 allows attackers to cause a denial of service (infinite loop) via action.len=0. - 详情 - - - - c36c5f3ab5c1f39bfa19caa675010301 - CVE-2024-34483 - 2024-05-05 02:15:06 - OFPGroupDescStats in parser.py in Faucet SDN Ryu 4.34 allows attackers to cause a denial of service (infinite loop) via OFPBucket.len=0. - 详情 - - - - 21c9f7c337ff541d7e2fc92a89dfb471 - CVE-2024-4492 - 2024-05-05 01:15:06 - A vulnerability, which was classified as critical, has been found in Tenda i21 1.0.0.14(4656). This issue affects the function formOfflineSet of the file /goform/setStaOffline. The manipulation of the argument GO/ssidIndex leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-263081 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. - 详情 - - - - 5a052594ee52aa6cdd21db8de39c800a - CVE-2024-34478 - 2024-05-05 01:15:06 - btcd before 0.24.0 does not correctly implement the consensus rules outlined in BIP 68 and BIP 112, making it susceptible to consensus failures. Specifically, it uses the transaction version as a signed integer when it is supposed to be treated as unsigned. There can be a chain split and loss of funds. - 详情 - - @@ -1971,6 +1971,126 @@

眈眈探求 | TITLE URL + + f38cd5d0e49cdfd96593ab8c576d0638 + CVE-2023-42938 + 2024-05-08 07:23:31 + iTunes for Windows权限提升漏洞 + 详情 + + + + 931980481d5e62d65c3120fa34d53dea + CVE-2024-25653 + 2024-05-08 07:23:31 + Delinea PAM Secret Server访问控制错误漏洞 + 详情 + + + + af5ab7402edbcffba782efc76f1210d5 + CVE-2024-22346 + 2024-05-08 07:23:31 + IBM i权限许可和访问控制漏洞 + 详情 + + + + 5bc0ade68ac7e2329634c900b220f236 + CVE-2024-27265 + 2024-05-08 07:23:31 + IBM Integration Bus for z/OS跨站请求伪造漏洞 + 详情 + + + + f858d7f1ae681d2d3ecdc32e0afda767 + CVE-2024-28181 + 2024-05-08 07:23:31 + TurboBoost Commands注入漏洞 + 详情 + + + + 7bf2d005016eff3535919c62d7bdeb48 + CVE-2024-22398 + 2024-05-08 07:23:31 + SonicWALL Email Security Appliance路径遍历漏洞 + 详情 + + + + 8601f610d9c3f317f18c8788cb5291d8 + CVE-2023-38575 + 2024-05-08 07:23:31 + Intel Processors信息泄露漏洞 + 详情 + + + + 8427c43f1fac1d903d18294509959f3c + CVE-2024-1654 + 2024-05-08 07:23:31 + PaperCut NG/MF远程代码执行漏洞 + 详情 + + + + 4d948e23703c002e321c1fdb7af74b87 + CVE-2024-25649 + 2024-05-08 07:23:31 + Delinea PAM Secret Server和Distributed Engine信息泄露漏洞 + 详情 + + + + b9d00a7f8c74c7705c627b0363c1fac4 + CVE-2024-25651 + 2024-05-08 07:23:31 + Delinea PAM Secret Server信息泄露漏洞 + 详情 + + + + 88f9842fbf1d0cb3b8e2d319f10c7cde + CVE-2024-25652 + 2024-05-08 07:23:31 + Delinea PAM Secret Server信息泄露漏洞 + 详情 + + + + 15fe0c1350cd6213263aeb04266c9fbc + CVE-2023-43490 + 2024-05-08 07:23:31 + Intel Xeon Processors计算错误漏洞 + 详情 + + + + f03ef7fb3d699a842e1a1fec38587f7f + CVE-2024-28390 + 2024-05-08 07:23:31 + PrestaShop访问控制错误漏洞 + 详情 + + + + 3658d37af87f97dbf3c350b1e1954e31 + CVE-2024-28391 + 2024-05-08 07:23:31 + PrestaShop SQL注入漏洞 + 详情 + + + + 9395eea460da83a16ff89b2b9b9824c2 + CVE-2024-28746 + 2024-05-08 07:23:31 + Apache Airflow权限保留错误漏洞 + 详情 + + d3b4fd9837f6546b2bfa1ca69f70cddf CVE-2024-28193 @@ -2091,126 +2211,6 @@

眈眈探求 | 详情 - - f3b5656ddf12b384ebc85b927640549b - CVE-2023-48383 - 2024-05-07 03:23:17 - NETVISION INFORMATION airPASS路径遍历漏洞 - 详情 - - - - 7fef99a9163f2d933f8b3d75db1e970a - CVE-2024-0533 - 2024-05-07 03:23:17 - Tenda A15堆栈缓冲区溢出漏洞 - 详情 - - - - 6f2bee6528bfcca73911a0c94a52faca - CVE-2024-0532 - 2024-05-07 03:23:17 - Tenda A15堆栈缓冲区溢出漏洞 - 详情 - - - - c33c1bca9468e52129e659f953d2da7a - CVE-2024-0531 - 2024-05-07 03:23:17 - Tenda A15堆栈缓冲区溢出漏洞 - 详情 - - - - fce4f8f3d9b413fb8500f3c47bca98d6 - CVE-2024-0530 - 2024-05-07 03:23:17 - CXBSoft Post-Office SQL注入漏洞 - 详情 - - - - c0bae53a86a90bb410f3a4f956e1d92b - CVE-2024-0529 - 2024-05-07 03:23:17 - CXBSoft Post-Office SQL注入漏洞 - 详情 - - - - 202ac73778954ebcb4f3bbb942711ec6 - CVE-2024-0528 - 2024-05-07 03:23:17 - CXBSoft Post-Office SQL注入漏洞 - 详情 - - - - 29da3af117d22d7dc90c7f5f406bef47 - CVE-2023-5253 - 2024-05-07 03:23:17 - Nozomi Networks Guardian访问控制错误漏洞 - 详情 - - - - 9f3794d390b40b3c9e2da34180e1e4dc - CVE-2023-6915 - 2024-05-07 03:23:17 - Linux Kernel空指针解引用漏洞 - 详情 - - - - b732168a1519bcedf3166663e2a26c8d - CVE-2023-46749 - 2024-05-07 03:23:17 - Apache Shiro路径遍历漏洞 - 详情 - - - - 46572a5f45380d25c67937d4501d7a77 - CVE-2024-0548 - 2024-05-07 03:23:17 - FreeFloat FTP Server命令拒绝服务漏洞 - 详情 - - - - eb7df21e92dee2c4af829c367b2966b3 - CVE-2024-0547 - 2024-05-07 03:23:17 - Ability FTP Server命令拒绝服务漏洞 - 详情 - - - - 29d6f20452439c43f4a6a3569e3d76b3 - CVE-2024-0546 - 2024-05-07 03:23:17 - EasyFTP命令拒绝服务漏洞 - 详情 - - - - 4d5f9149443004fd4767459bd07734d7 - CVE-2024-0545 - 2024-05-07 03:23:17 - CodeCanyon RISE Rise Ultimate Project Manager输入验证错误漏洞 - 详情 - - - - 0bed997cc19ccb5aae04bb814d5dd84a - CVE-2024-0543 - 2024-05-07 03:23:17 - CodeAstro Real Estate Management System SQL注入漏洞 - 详情 - -