New_entries

CVE-2019-25210

description

An issue was discovered in Cloud Native Computing Foundation (CNCF) Helm through 3.13.3. It displays values of secrets when the –dry-run flag is used. This is a security concern in some use cases, such as a –dry-run call by a CI/CD tool. NOTE: the vendors position is that this behavior was introduced intentionally, and cannot be removed without breaking backwards compatibility (some users may be relying on these values).

中文

通过3.13.3，在云原生计算基金会（CNCF）Helm中发现了一个问题。当使用–dry-run标志时，它显示机密的值。在某些用例中，这是一个安全问题，例如由CI/CD工具进行的–dry-run调用。注意：供应商的立场是，这种行为是故意引入的，在不破坏向后兼容性的情况下无法删除（一些用户可能依赖这些值）。

cvss epss percentile
None 0.04% 6.97%

references

CVE-2022-43880

description

IBM QRadar WinCollect Agent 10.0 through 10.1.2 could allow a privileged user to cause a denial of service. IBM X-Force ID: 240151.

中文

IBM QRadar WinCollect Agent 10.0到10.1.2可以允许特权用户造成拒绝服务。IBM X-Force ID:240151。

cvss epss percentile
4.4 MEDIUM 0.04% 6.97%

references

CVE-2023-27291

description

IBM Watson CP4D Data Stores 4.6.0, 4.6.1, 4.6.2, and 4.6.3 does not encrypt sensitive or critical information before storage or transmission which could allow an attacker to obtain sensitive information. IBM X-Force ID: 248740.

中文

IBM Watson CP4D数据存储4.6.0、4.6.1、4.6.2和4.6.3在存储或传输之前不加密敏感或关键信息，这可能会使攻击者获得敏感信息。IBM X-Force ID:248740。

cvss epss percentile
4.5 MEDIUM 0.04% 6.97%

references

CVE-2023-28512

description

IBM Watson CP4D Data Stores 4.6.0, 4.6.1, and 4.6.2 could allow an attacker with specific knowledge about the system to manipulate data due to improper input validation. IBM X-Force ID: 250396.

中文

IBM Watson CP4D数据存储4.6.0、4.6.1和4.6.2可能允许具有系统特定知识的攻击者由于输入验证不当而操纵数据。IBM X-Force ID:250396。

cvss epss percentile
5.9 MEDIUM 0.04% 6.97%

references

CVE-2023-43054

description

IBM Engineering Test Management 7.0.2 and 7.0.3 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 267459.

中文

IBM Engineering Test Management 7.0.2和7.0.3易受存储的跨站点脚本攻击。此漏洞允许用户在Web UI中嵌入任意JavaScript代码，从而更改预期功能，从而可能导致可信会话中的凭据泄露。IBM X-Force ID:267459。

cvss epss percentile
6.4 MEDIUM 0.04% 6.97%

references

CVE-2023-47742

description

IBM QRadar Suite Products 1.10.12.0 through 1.10.18.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 could disclose sensitive information using man in the middle techniques due to not correctly enforcing all aspects of certificate validation in some circumstances. IBM X-Force ID: 272533.

中文

IBM QRadar Suite产品1.10.12.0至1.10.18.0和IBM Cloud Pak for Security 1.10.0.0至1.10.11.0可能会使用中间人技术泄露敏感信息，因为在某些情况下，没有正确执行证书验证的所有方面。IBM X-Force ID:272533。

cvss epss percentile
5.9 MEDIUM 0.04% 6.97%

references

CVE-2023-47745

description

IBM MQ Operator 2.0.0 LTS, 2.0.18 LTS, 3.0.0 CD, 3.0.1 CD, 2.4.0 through 2.4.7, 2.3.0 through 2.3.3, 2.2.0 through 2.2.2, and 2.3.0 through 2.3.3 stores or transmits user credentials in plain clear text which can be read by a local user using a trace command. IBM X-Force ID: 272638.

中文

IBM MQ Operator 2.0.0 LTS、2.0.18 LTS、3.0.0 CD、3.0.1 CD、2.4.0至2.4.7、2.3.0至2.3.3、2.2.0至2.2.2和2.3.0至2.3.3以纯明文存储或传输用户凭据，本地用户可以使用trace命令读取这些凭据。IBM X-Force ID:272638。

cvss epss percentile
6.2 MEDIUM 0.04% 6.97%

references

CVE-2024-0765

description

As a default user on a multi-user instance of AnythingLLM, you could execute a call to the /export-data endpoint of the system and then unzip and read that export that would enable you do exfiltrate data of the system at that save state. This would require the attacked to be granted explicit access to the system, but they can do this at any role. Additionally, post-download, the data is deleted so no evidence would exist that the exfiltration occured.

中文

作为AnythingLLM多用户实例上的默认用户，您可以执行对系统的“/export-data”端点的调用，然后解压缩并读取该导出，这将使您能够在该保存状态下对系统的数据进行过滤。这将要求被攻击者被授予对系统的显式访问权限，但他们可以在任何角色上这样做。此外，下载后，数据会被删除，因此不会有证据表明发生了外过滤。

cvss epss percentile
9.6 CRITICAL 0.04% 6.97%

references

CVE-2024-1938

description

Type Confusion in V8 in Google Chrome prior to 122.0.6261.94 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. (Chromium security severity: High)

中文

122.06261.94之前版本的Google Chrome V8中的Type Confusion允许远程攻击者通过特制的HTML页面潜在地利用对象损坏。（铬安全严重性：高）

cvss epss percentile
None 0.04% 12.45%

references

CVE-2024-1939

description

Type Confusion in V8 in Google Chrome prior to 122.0.6261.94 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

中文

122.06261.94之前版本的Google Chrome V8中的Type Confusion允许远程攻击者通过特制的HTML页面利用堆损坏进行潜在攻击。（铬安全严重性：高）

cvss epss percentile
None 0.04% 12.45%

references

CVE-2024-2135

description

A vulnerability was found in Bdtask Hospita AutoManager up to 20240223 and classified as problematic. This issue affects some unknown processing of the file /hospital_activities/birth/form of the component Hospital Activities Page. The manipulation of the argument Description with the input leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-255497 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

中文

截至20240223年，在Bdtask Hospita AutoManager中发现了一个漏洞，并将其归类为有问题。此问题影响了对组件“医院活动页面”的文件/hhospital_activitys/birth/form的一些未知处理。通过输入＜img src=a oneror＝alert（1）＞操作参数Description会导致跨站点脚本编写。攻击可以远程启动。该漏洞已向公众公开，并可能被利用。标识符VDB-255497已分配给此漏洞。注：我们很早就联系了供应商，但没有以任何方式作出回应。

cvss epss percentile
2.4 LOW 0.04% 12.45%

references

CVE-2024-2145

description

A vulnerability was found in SourceCodester Online Mobile Management Store 1.0. It has been classified as problematic. Affected is an unknown function of the file /endpoint/update-tracker.php. The manipulation of the argument firstname leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-255498 is the identifier assigned to this vulnerability.

中文

在SourceCodester Online Mobile Management Store 1.0中发现一个漏洞。它被列为有问题的。受影响的是文件/endpoint/update-tracker.php的一个未知函数。参数firstname的操作会导致跨站点脚本编写。可以远程发起攻击。该漏洞已向公众公开，并可能被利用。VDB-255498是分配给此漏洞的标识符。

cvss epss percentile
3.5 LOW 0.04% 12.45%

references

CVE-2024-2146

description

A vulnerability was found in SourceCodester Online Mobile Management Store 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /?p=products. The manipulation of the argument search leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-255499.

中文

在SourceCodester Online Mobile Management Store 1.0中发现一个漏洞。它已被宣布为有问题。受此漏洞影响的是文件/？的未知功能？p=产品。对参数搜索的操作会导致跨站点脚本编写。可以远程发起攻击。该漏洞已向公众公开，并可能被利用。此漏洞的相关标识符为VDB-255499。

cvss epss percentile
3.5 LOW 0.04% 12.45%

references

CVE-2024-2147

description

A vulnerability was found in SourceCodester Online Mobile Management Store 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/login.php. The manipulation of the argument username leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-255500.

中文

在SourceCodester Online Mobile Management Store 1.0中发现一个漏洞。它被评为关键。受此问题影响的是文件/admin/login.php的一些未知功能。参数username的操作导致sql注入。攻击可能是远程发起的。该漏洞已向公众公开，并可能被利用。此漏洞的标识符为VDB-255500。

cvss epss percentile
7.3 HIGH 0.04% 12.45%

references

CVE-2024-2148

description

A vulnerability classified as critical has been found in SourceCodester Online Mobile Management Store 1.0. This affects an unknown part of the file /classes/Users.php. The manipulation of the argument img leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-255501 was assigned to this vulnerability.

中文

在SourceCodester Online Mobile Management Store 1.0中发现一个被归类为关键的漏洞。这会影响文件/classes/Users.php的未知部分。参数img的操作导致不受限制的上传。可以远程发起攻击。该漏洞已向公众公开，并可能被利用。标识符VDB-255501已分配给此漏洞。

cvss epss percentile
6.3 MEDIUM 0.04% 12.45%

references

CVE-2024-2149

description

A vulnerability classified as critical was found in CodeAstro Membership Management System 1.0. This vulnerability affects unknown code of the file settings.php. The manipulation of the argument currency leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-255502 is the identifier assigned to this vulnerability.

中文

在CodeAstro成员管理系统1.0中发现一个被归类为关键的漏洞。此漏洞影响文件settings.php的未知代码。参数货币的操作导致sql注入。可以远程发起攻击。该漏洞已向公众公开，并可能被利用。VDB-255502是分配给此漏洞的标识符。

cvss epss percentile
4.7 MEDIUM 0.04% 12.45%

references

CVE-2024-2150

description

A vulnerability, which was classified as critical, has been found in SourceCodester Insurance Management System 1.0. This issue affects some unknown processing. The manipulation of the argument page leads to file inclusion. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-255503.

中文

在SourceCodester保险管理系统1.0中发现了一个被归类为关键的漏洞。此问题会影响一些未知的处理。参数页的操作会导致包含文件。攻击可以远程启动。该漏洞已向公众公开，并可能被利用。此漏洞的关联标识符为VDB-255503。

cvss epss percentile
5.3 MEDIUM 0.04% 12.45%

references

CVE-2024-2151

description

A vulnerability classified as problematic was found in SourceCodester Online Mobile Management Store 1.0. Affected by this vulnerability is an unknown functionality of the component Product Price Handler. The manipulation of the argument quantity with the input -1 leads to business logic errors. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-255583.

中文

在SourceCodester Online Mobile Management Store 1.0中发现一个被归类为有问题的漏洞。受此漏洞影响的是组件产品价格处理程序的未知功能。使用输入-1操作参数量会导致业务逻辑错误。可以远程发起攻击。该漏洞已向公众公开，并可能被利用。此漏洞的关联标识符为VDB-255583。

cvss epss percentile
4.3 MEDIUM 0.04% 12.45%

references

CVE-2024-22355

description

IBM QRadar Suite Products 1.10.12.0 through 1.10.18.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 280781.

中文

IBM QRadar Suite产品1.10.12.0至1.10.18.0和IBM Cloud Pak for Security 1.10.0.0至1.10.11.0默认情况下不要求用户具有强密码，这使攻击者更容易破坏用户帐户。IBM X-Force ID:280781。

cvss epss percentile
5.9 MEDIUM 0.04% 6.97%

references

CVE-2024-24302

description

An issue was discovered in Tunis Soft “Product Designer” (productdesigner) module for PrestaShop before version 1.178.36, allows remote attackers to execute arbitrary code, escalate privileges, and obtain sensitive information via the postProcess() method.

中文

在版本1.178.36之前的PrestaShop的Tunis Soft“产品设计器”（productdesigner）模块中发现一个问题，允许远程攻击者通过postProcess（）方法执行任意代码、提升权限和获取敏感信息。

cvss epss percentile
None 0.04% 6.97%

references

CVE-2024-24307

description

Path Traversal vulnerability in Tunis Soft “Product Designer” (productdesigner) module for PrestaShop before version 1.178.36, allows a remote attacker to escalate privileges and obtain sensitive information via the ajaxProcessCropImage() method.

中文

PrestaShop 1.178.36之前版本的Tunis Soft“产品设计器”（productdesigner）模块中存在Path Traversal漏洞，允许远程攻击者通过ajaxProcessCropImage（）方法升级权限并获取敏感信息。

cvss epss percentile
None 0.04% 6.97%

references

CVE-2024-25016

description

IBM MQ and IBM MQ Appliance 9.0, 9.1, 9.2, 9.3 LTS and 9.3 CD could allow a remote unauthenticated attacker to cause a denial of service due to incorrect buffering logic. IBM X-Force ID: 281279.

中文

IBM MQ和IBM MQ Appliance 9.0、9.1、9.2、9.3 LTS和9.3 CD允许未经身份验证的远程攻击者由于缓冲逻辑不正确而导致拒绝服务。IBM X-Force ID:281279。

cvss epss percentile
7.5 HIGH 0.04% 6.97%

references

CVE-2024-25551

description

Cross Site Scripting (XSS) vulnerability in sourcecodester Simple Student Attendance System v1.0 allows attackers to execute arbitrary code via crafted GET request to web application URL.

中文

sourcecodester Simple Student Attendance System v1.0中存在跨站点脚本（XSS）漏洞，攻击者可以通过特制的对web应用程序URL的GET请求执行任意代码。

cvss epss percentile
None 0.04% 6.97%

references

CVE-2024-25839

description

An issue was discovered in Webbax “Super Newsletter” (supernewsletter) module for PrestaShop versions 1.4.21 and before, allows local attackers to escalate privileges and obtain sensitive information.

中文

在PrestaShop 1.4.21及之前版本的Webbax“超级时事通讯”（supernewssletter）模块中发现一个问题，该问题允许本地攻击者升级权限并获取敏感信息。

cvss epss percentile
None 0.04% 6.97%

references

CVE-2024-25842

description

An issue was discovered in Presta World “Account Manager - Sales Representative & Dealers - CRM” (prestasalesmanager) module for PrestaShop before version 9.0, allows remote attackers to escalate privilege and obtain sensitive information via the uploadLogo() and postProcess methods.

中文

在版本9.0之前的PrestaShop的Presta World“Account Manager-Sales Representative&Dealers-CRM”（prestasalemanager）模块中发现一个问题，远程攻击者可以通过uploadLogo（）和postProcess方法升级权限并获取敏感信息。

cvss epss percentile
None 0.04% 6.97%

references

CVE-2024-25844

description

An issue was discovered in Common-Services “So Flexibilite” (soflexibilite) module for PrestaShop before version 4.1.26, allows remote attackers to escalate privileges and obtain sensitive information via debug file.

中文

在版本4.1.26之前的PrestaShop的通用服务“So Flexibilite”（soflexibilite）模块中发现一个问题，远程攻击者可以通过调试文件升级权限并获取敏感信息。

cvss epss percentile
None 0.04% 6.97%

references

CVE-2024-25847

description

SQL Injection vulnerability in MyPrestaModules “Product Catalog (CSV, Excel) Import” (simpleimportproduct) modules for PrestaShop versions 6.5.0 and before, allows attackers to escalate privileges and obtain sensitive information via Send::__construct() and importProducts::_addDataToDb methods.

中文

PrestaShop 6.5.0及以前版本的MyPrestaModules“Product Catalog（CSV，Excel）Import”（simpleimportproduct）模块中存在SQL注入漏洞，允许攻击者通过Send:：__construct（）和importProducts:：_addDataToDb方法提升权限并获取敏感信息。

cvss epss percentile
None 0.04% 6.97%

references

CVE-2024-26469

description

Server-Side Request Forgery (SSRF) vulnerability in Tunis Soft “Product Designer” (productdesigner) module for PrestaShop before version 1.178.36, allows remote attackers to cause a denial of service (DoS) and escalate privileges via the url parameter in the postProcess() method.

中文

PrestaShop 1.178.36之前版本的Tunis Soft“产品设计器”（productdesigner）模块中的服务器端请求伪造（SSRF）漏洞允许远程攻击者通过postProcess（）方法中的url参数造成拒绝服务（DoS）并提升权限。

cvss epss percentile
None 0.04% 6.97%

references

CVE-2024-27255

description

IBM MQ Operator 2.0.0 LTS, 2.0.18 LTS, 3.0.0 CD, 3.0.1 CD, 2.4.0 through 2.4.7, 2.3.0 through 2.3.3, 2.2.0 through 2.2.2, and 2.3.0 through 2.3.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 283905.

中文

IBM MQ Operator 2.0.0 LTS、2.0.18 LTS、3.0.0 CD、3.0.1 CD、2.4.0到2.4.7、2.3.0到2.3.3、2.2.0到2.2.2和2.3.0到2.3.3使用的加密算法比预期的要弱，攻击者可以解密高度敏感的信息。IBM X-Force ID:283905。

cvss epss percentile
5.9 MEDIUM 0.04% 6.97%

references

CVE-2024-28084

description

p2putil.c in iNet wireless daemon (IWD) through 2.15 allows attackers to cause a denial of service (daemon crash) or possibly have unspecified other impact because of initialization issues in situations where parsing of advertised service information fails.

中文

iNet无线守护进程（IWD）至2.15中的p2putil.c允许攻击者在解析播发服务信息失败的情况下，由于初始化问题而导致拒绝服务（守护进程崩溃）或可能产生未指定的其他影响。

cvss epss percentile
None 0.04% 6.97%

references

CVE-2024-28088

description

LangChain through 0.1.10 allows ../ directory traversal by an actor who is able to control the final part of the path parameter in a load_chain call. This bypasses the intended behavior of loading configurations only from the hwchase17/langchain-hub GitHub repository. The outcome can be disclosure of an API key for a large language model online service, or remote code execution.

中文

LangChain通过0.1.10允许../由能够控制loadchain调用中路径参数的最后部分的参与者进行目录遍历。这绕过了仅从hwchase17/langchain-hub GitHub存储库加载配置的预期行为。结果可以是公开大型语言模型在线服务的API密钥，或者远程代码执行。

cvss epss percentile
None 0.04% 6.97%

references

Modified_entries

CVE-2021-31152

description

Multilaser Router AC1200 V02.03.01.45_pt contains a cross-site request forgery (CSRF) vulnerability. An attacker can enable remote access, change passwords, and perform other actions through misconfigured requests, entries, and headers.

中文

多层路由器AC1200 V02.03.01.45_pt包含跨站点请求伪造（CSRF）漏洞。攻击者可以通过配置错误的请求、条目和标头启用远程访问、更改密码以及执行其他操作。

cvss epss percentile
None 0.44% 74.21%

references

CVE-2023-49114

description

A DLL hijacking vulnerability was identified in the Qognify VMS Client Viewer version 7.1 or higher, which allows local users to execute arbitrary code and obtain higher privileges via careful placement of a malicious DLL, if some specific pre-conditions are met.

中文

在Qognify VMS Client Viewer 7.1或更高版本中发现了DLL劫持漏洞，如果满足某些特定的先决条件，本地用户可以通过小心放置恶意DLL来执行任意代码并获得更高的权限。

cvss epss percentile
None 0.04% 6.97%

references

CVE-2023-52466

description

** REJECT ** This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

中文

拒绝此CVE ID已被其CVE编号机构拒绝或撤回。

cvss epss percentile
None 0.04% 6.97%

CVE-2024-0565

description

An out-of-bounds memory read flaw was found in receive_encrypted_standard in fs/smb/client/smb2ops.c in the SMB Client sub-component in the Linux Kernel. This issue occurs due to integer underflow on the memcpy length, leading to a denial of service.

中文

在Linux内核中smb客户端子组件的fs/smb/client/sb2ops.c中的receive_encrypted_standard中发现越界内存读取缺陷。出现此问题的原因是内存长度上的整数下溢，导致拒绝服务。

cvss epss percentile
6.8 MEDIUM 0.04% 5.41%

references

CVE-2024-1923

description

A vulnerability was found in SourceCodester Simple Student Attendance System 1.0 and classified as critical. Affected by this issue is the function delete_class/delete_student of the file /ajax-api.php of the component List of Classes Page. The manipulation of the argument id with the input 1337+or+1=1;–+ leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-254858 is the identifier assigned to this vulnerability.

中文

在SourceCodester Simple Student Attendance System 1.0中发现一个漏洞，该漏洞被归类为严重漏洞。受此问题影响的是组件类列表页面的文件/ajax-api.php的函数delete_class/delete_student。输入1337+或+1=1的参数id的操作；–+导致sql注入。攻击可能是远程发起的。该漏洞已向公众公开，并可能被利用。VDB-254858是分配给此漏洞的标识符。

cvss epss percentile
6.3 MEDIUM 0.04% 12.45%

references