Skip to content

Commit

Permalink
Updated by Github Bot
Browse files Browse the repository at this point in the history
  • Loading branch information
Github-Bot committed Jul 3, 2024
1 parent c4c95d1 commit 3824b81
Show file tree
Hide file tree
Showing 3 changed files with 91 additions and 81 deletions.
10 changes: 10 additions & 0 deletions cache/Tenable (Nessus).dat
View file
Original file line number Diff line number Diff line change
Expand Up @@ -159,3 +159,13 @@ d92b3366a3521445bb7e53fcc0451a1b
5dac148e832cc8129bd25e8805a70571
0c6d3931567571b09f0e78b05be5775f
ad927e1c87132d3c28ea9e92e3582f46
5ab87198afdda372a76a80a58f7a4a68
ea7df40427a717ea3f86cd3a43dd805c
1f7f2cded2e8740df20b7096fb6e30a8
0aa39f8e1bdb48fafbd03295a54c6b1c
fe0bfd4cec099045c032ec190adc7565
bc345fa030f2e43eaa3ece6bfa1212f7
9d66a9a9ca3eab0ad140e08df1b7316b
fe57b1f41b6be71c4793bc162b74593a
9bfaffacf475506020465479c7ccbf36
a04e45b662fd7612a1f0aa283f37f6fe
Binary file modified data/cves.db
View file
Binary file not shown.
162 changes: 81 additions & 81 deletions docs/index.html
View file
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
<!-- RELEASE TIME : 2024-07-03 12:39:10 -->
<!-- RELEASE TIME : 2024-07-03 15:22:47 -->
<html lang="zh-cn">

<head>
Expand Down Expand Up @@ -283,6 +283,86 @@ <h2><a href="https://exp-blog.com" target="_blank">眈眈探求</a> | <a href="h
<th width="43%">TITLE</th>
<th width="5%">URL</th>
</tr>
<tr>
<td>5ab87198afdda372a76a80a58f7a4a68</td>
<td>CVE-2024-6469</td>
<td>2024-07-03 11:15:04 <img src="imgs/new.gif" /></td>
<td>A vulnerability was found in playSMS 1.4.3. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /index.php?app=main&inc=feature_firewall&op=firewall_list of the component Template Handler. The manipulation of the argument IP address with the input {{`id`} leads to injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-270277 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2024-6469">详情</a></td>
</tr>

<tr>
<td>ea7df40427a717ea3f86cd3a43dd805c</td>
<td>CVE-2024-6428</td>
<td>2024-07-03 09:15:08 <img src="imgs/new.gif" /></td>
<td>Mattermost versions 9.8.0, 9.7.x <= 9.7.4, 9.6.x <= 9.6.2, 9.5.x <= 9.5.5 fail to prevent specifying a RemoteId when creating a new user which allows an attacker to specify both a remoteId and the user ID, resulting in creating a user with a user-defined user ID. This can cause some broken functionality in User Management such administrative actions against the user not working.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2024-6428">详情</a></td>
</tr>

<tr>
<td>1f7f2cded2e8740df20b7096fb6e30a8</td>
<td>CVE-2024-39830</td>
<td>2024-07-03 09:15:07 <img src="imgs/new.gif" /></td>
<td>Mattermost versions 9.8.x <= 9.8.0, 9.7.x <= 9.7.4, 9.6.x <= 9.6.2 and 9.5.x <= 9.5.5, when shared channels are enabled, fail to use constant time comparison for remote cluster tokens which allows an attacker to retrieve the remote cluster token via a timing attack during remote cluster token comparison.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2024-39830">详情</a></td>
</tr>

<tr>
<td>0aa39f8e1bdb48fafbd03295a54c6b1c</td>
<td>CVE-2024-39807</td>
<td>2024-07-03 09:15:07 <img src="imgs/new.gif" /></td>
<td>Mattermost versions 9.5.x <= 9.5.5 and 9.8.0 fail to properly sanitize the recipients of a webhook event which allows an attacker monitoring webhook events to retrieve the channel IDs of archived or restored channels.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2024-39807">详情</a></td>
</tr>

<tr>
<td>fe0bfd4cec099045c032ec190adc7565</td>
<td>CVE-2024-39361</td>
<td>2024-07-03 09:15:06 <img src="imgs/new.gif" /></td>
<td>Mattermost versions 9.8.0, 9.7.x <= 9.7.4, 9.6.x <= 9.6.2 and 9.5.x <= 9.5.5 fail to prevent users from specifying a RemoteId for their posts which allows an attacker to specify both a remoteId and the post ID, resulting in creating a post with a user-defined post ID. This can cause some broken functionality in the channel or thread with user-defined posts</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2024-39361">详情</a></td>
</tr>

<tr>
<td>bc345fa030f2e43eaa3ece6bfa1212f7</td>
<td>CVE-2024-39353</td>
<td>2024-07-03 09:15:06 <img src="imgs/new.gif" /></td>
<td>Mattermost versions 9.5.x <= 9.5.5 and 9.8.0 fail to sanitize the RemoteClusterFrame payloads before audit logging them which allows a high privileged attacker with access to the audit logs to read message contents.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2024-39353">详情</a></td>
</tr>

<tr>
<td>9d66a9a9ca3eab0ad140e08df1b7316b</td>
<td>CVE-2024-36257</td>
<td>2024-07-03 09:15:06 <img src="imgs/new.gif" /></td>
<td>Mattermost versions 9.5.x <= 9.5.5 and 9.8.0, when using shared channels with multiple remote servers connected, fail to check that the remote server A requesting the server B to update the profile picture of a user is the remote that actually has the user as a local one . This allows a malicious remote A to change the profile images of users that belong to another remote server C that is connected to the server A.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2024-36257">详情</a></td>
</tr>

<tr>
<td>fe57b1f41b6be71c4793bc162b74593a</td>
<td>CVE-2024-6340</td>
<td>2024-07-03 08:15:10 <img src="imgs/new.gif" /></td>
<td>The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown widget in all versions up to, and including, 4.10.35 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2024-6340">详情</a></td>
</tr>

<tr>
<td>9bfaffacf475506020465479c7ccbf36</td>
<td>CVE-2024-6263</td>
<td>2024-07-03 08:15:10 <img src="imgs/new.gif" /></td>
<td>The WP Lightbox 2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ parameter in all versions up to, and including, 3.0.6.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2024-6263">详情</a></td>
</tr>

<tr>
<td>a04e45b662fd7612a1f0aa283f37f6fe</td>
<td>CVE-2024-4482</td>
<td>2024-07-03 08:15:09 <img src="imgs/new.gif" /></td>
<td>The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Countdown' widget in all versions up to, and including, 5.6.1 due to insufficient input sanitization and output escaping on user supplied 'text_days' attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2024-4482">详情</a></td>
</tr>

<tr>
<td>9b70227dbf1642174570fced1dda7334</td>
<td>CVE-2024-6440</td>
Expand Down Expand Up @@ -443,86 +523,6 @@ <h2><a href="https://exp-blog.com" target="_blank">眈眈探求</a> | <a href="h
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2024-20077">详情</a></td>
</tr>

<tr>
<td>c471d502cd5db88f83ff496bcdb81aa0</td>
<td>CVE-2024-35119</td>
<td>2024-06-30 17:15:03</td>
<td>IBM InfoSphere Information Server 11.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in a stack trace. This information could be used in further attacks against the system. IBM X-Force ID: 290342.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2024-35119">详情</a></td>
</tr>

<tr>
<td>aa6fd912d0b542a61e5b23af4cbd64b3</td>
<td>CVE-2024-31902</td>
<td>2024-06-30 17:15:02</td>
<td>IBM InfoSphere Information Server 11.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 289234.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2024-31902">详情</a></td>
</tr>

<tr>
<td>dd1f83522d698106b8be438344986dd4</td>
<td>CVE-2024-28798</td>
<td>2024-06-30 17:15:02</td>
<td>IBM InfoSphere Information Server 11.7 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 287172.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2024-28798">详情</a></td>
</tr>

<tr>
<td>522a2dcf88ece5c4b7d33e18a7d25bb3</td>
<td>CVE-2023-50954</td>
<td>2024-06-30 17:15:02</td>
<td>IBM InfoSphere Information Server 11.7 returns sensitive information in URL information that could be used in further attacks against the system. IBM X-Force ID: 275776.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2023-50954">详情</a></td>
</tr>

<tr>
<td>a211a848e7c4095555a40dd5bab41c3f</td>
<td>CVE-2024-5062</td>
<td>2024-06-30 16:15:03</td>
<td>A reflected Cross-Site Scripting (XSS) vulnerability was identified in zenml-io/zenml version 0.57.1. The vulnerability exists due to improper neutralization of input during web page generation, specifically within the survey redirect parameter. This flaw allows an attacker to redirect users to a specified URL after completing a survey, without proper validation of the 'redirect' parameter. Consequently, an attacker can execute arbitrary JavaScript code in the context of the user's browser session. This vulnerability could be exploited to steal cookies, potentially leading to account takeover.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2024-5062">详情</a></td>
</tr>

<tr>
<td>720c71976c910f1ec5725f83d56bfb71</td>
<td>CVE-2024-28795</td>
<td>2024-06-30 16:15:02</td>
<td>IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 286832.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2024-28795">详情</a></td>
</tr>

<tr>
<td>f766b54ca0a64748f3d409a56387b138</td>
<td>CVE-2023-35022</td>
<td>2024-06-30 16:15:02</td>
<td>IBM InfoSphere Information Server 11.7 could allow a local user to update projects that they do not have the authorization to access. IBM X-Force ID: 258254.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2023-35022">详情</a></td>
</tr>

<tr>
<td>04948b47c2c5cf6ca5b263a13d52b8fb</td>
<td>CVE-2024-6415</td>
<td>2024-06-30 04:15:02</td>
<td>A vulnerability classified as problematic was found in Ingenico Estate Manager 2023. Affected by this vulnerability is an unknown functionality of the file /emgui/rest/preferences/PREF_HOME_PAGE/sponsor/3/ of the component New Widget Handler. The manipulation of the argument URL leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-270001 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2024-6415">详情</a></td>
</tr>

<tr>
<td>4e58b2192572fe324d1e65ccec8b8b18</td>
<td>CVE-2024-6414</td>
<td>2024-06-30 03:15:02</td>
<td>A vulnerability classified as problematic has been found in Parsec Automation TrakSYS 11.x.x. Affected is an unknown function of the file TS/export/contentpage of the component Export Page. The manipulation of the argument ID leads to direct request. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-270000. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2024-6414">详情</a></td>
</tr>

<tr>
<td>9b10a66072ccf63d5e2b7b6cf97db3bf</td>
<td>CVE-2024-5926</td>
<td>2024-06-30 01:15:09</td>
<td>Path Traversal: '\..\filename' in GitHub repository stitionai/devika prior to -.</td>
<td><a target="_blank" href="https://www.tenable.com/cve/CVE-2024-5926">详情</a></td>
</tr>

</tbody>
</table>
</div>
Expand Down

0 comments on commit 3824b81

Please sign in to comment.