Update CVE list 2024-08-07 19:03

docs/CVE_list.json

@@ -1 +1 @@
-[{"cve": "CVE-2024-2716", "desc": "A vulnerability was found in Campcodes Complete Online DJ Booking System 1.0. It has been classified as problematic. This affects an unknown part of the file /admin/contactus.php. The manipulation of the argument email leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-257469 was assigned to this vulnerability.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-24785", "desc": "If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected content into templates.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds", "https://github.com/testing-felickz/docker-scout-demo"]}, {"cve": "CVE-2024-27399", "desc": "In the Linux kernel, the following vulnerability has been resolved:Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeoutThere is a race condition between l2cap_chan_timeout() andl2cap_chan_del(). When we use l2cap_chan_del() to delete thechannel, the chan->conn will be set to null. But the conn couldbe dereferenced again in the mutex_lock() of l2cap_chan_timeout().As a result the null pointer dereference bug will happen. TheKASAN report triggered by POC is shown below:[  472.074580] ==================================================================[  472.075284] BUG: KASAN: null-ptr-deref in mutex_lock+0x68/0xc0[  472.075308] Write of size 8 at addr 0000000000000158 by task kworker/0:0/7[  472.075308][  472.075308] CPU: 0 PID: 7 Comm: kworker/0:0 Not tainted 6.9.0-rc5-00356-g78c0094a146b #36[  472.075308] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu4[  472.075308] Workqueue: events l2cap_chan_timeout[  472.075308] Call Trace:[  472.075308]  <TASK>[  472.075308]  dump_stack_lvl+0x137/0x1a0[  472.075308]  print_report+0x101/0x250[  472.075308]  ? __virt_addr_valid+0x77/0x160[  472.075308]  ? mutex_lock+0x68/0xc0[  472.075308]  kasan_report+0x139/0x170[  472.075308]  ? mutex_lock+0x68/0xc0[  472.075308]  kasan_check_range+0x2c3/0x2e0[  472.075308]  mutex_lock+0x68/0xc0[  472.075308]  l2cap_chan_timeout+0x181/0x300[  472.075308]  process_one_work+0x5d2/0xe00[  472.075308]  worker_thread+0xe1d/0x1660[  472.075308]  ? pr_cont_work+0x5e0/0x5e0[  472.075308]  kthread+0x2b7/0x350[  472.075308]  ? pr_cont_work+0x5e0/0x5e0[  472.075308]  ? kthread_blkcg+0xd0/0xd0[  472.075308]  ret_from_fork+0x4d/0x80[  472.075308]  ? kthread_blkcg+0xd0/0xd0[  472.075308]  ret_from_fork_asm+0x11/0x20[  472.075308]  </TASK>[  472.075308] ==================================================================[  472.094860] Disabling lock debugging due to kernel taint[  472.096136] BUG: kernel NULL pointer dereference, address: 0000000000000158[  472.096136] #PF: supervisor write access in kernel mode[  472.096136] #PF: error_code(0x0002) - not-present page[  472.096136] PGD 0 P4D 0[  472.096136] Oops: 0002 [#1] PREEMPT SMP KASAN NOPTI[  472.096136] CPU: 0 PID: 7 Comm: kworker/0:0 Tainted: G    B              6.9.0-rc5-00356-g78c0094a146b #36[  472.096136] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu4[  472.096136] Workqueue: events l2cap_chan_timeout[  472.096136] RIP: 0010:mutex_lock+0x88/0xc0[  472.096136] Code: be 08 00 00 00 e8 f8 23 1f fd 4c 89 f7 be 08 00 00 00 e8 eb 23 1f fd 42 80 3c 23 00 74 08 48 88[  472.096136] RSP: 0018:ffff88800744fc78 EFLAGS: 00000246[  472.096136] RAX: 0000000000000000 RBX: 1ffff11000e89f8f RCX: ffffffff8457c865[  472.096136] RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffff88800744fc78[  472.096136] RBP: 0000000000000158 R08: ffff88800744fc7f R09: 1ffff11000e89f8f[  472.096136] R10: dffffc0000000000 R11: ffffed1000e89f90 R12: dffffc0000000000[  472.096136] R13: 0000000000000158 R14: ffff88800744fc78 R15: ffff888007405a00[  472.096136] FS:  0000000000000000(0000) GS:ffff88806d200000(0000) knlGS:0000000000000000[  472.096136] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033[  472.096136] CR2: 0000000000000158 CR3: 000000000da32000 CR4: 00000000000006f0[  472.096136] Call Trace:[  472.096136]  <TASK>[  472.096136]  ? __die_body+0x8d/0xe0[  472.096136]  ? page_fault_oops+0x6b8/0x9a0[  472.096136]  ? kernelmode_fixup_or_oops+0x20c/0x2a0[  472.096136]  ? do_user_addr_fault+0x1027/0x1340[  472.096136]  ? _printk+0x7a/0xa0[  472.096136]  ? mutex_lock+0x68/0xc0[  472.096136]  ? add_taint+0x42/0xd0[  472.096136]  ? exc_page_fault+0x6a/0x1b0[  472.096136]  ? asm_exc_page_fault+0x26/0x30[  472.096136]  ? mutex_lock+0x75/0xc0[  472.096136]  ? mutex_lock+0x88/0xc0[  472.096136]  ? mutex_lock+0x75/0xc0[  472.096136]  l2cap_chan_timeo---truncated---", "poc": ["https://git.kernel.org/stable/c/06acb75e7ed600d0bbf7bff5628aa8f24a97978c", "https://git.kernel.org/stable/c/6466ee65e5b271Line truncated
+[{"cve": "CVE-2024-4837", "desc": "In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via a trust boundary violation vulnerability.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-28580", "desc": "Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to execute arbitrary code via the ReadData() function when reading images in RAS format.", "poc": ["https://github.com/Ruanxingzhi/vul-report/tree/master/freeimage-r1909", "https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-4440", "desc": "The 140+ Widgets | Best Addons For Elementor \u2013 FREE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 1.4.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-36673", "desc": "Sourcecodester Pharmacy/Medical Store Point of Sale System 1.0 is vulnerable SQL Injection via login.php. This vulnerability stems from inadequate validation of user inputs for the email and password parameters, allowing attackers to inject malicious SQL queries.", "poc": ["https://github.com/CveSecLook/cve/issues/39", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-32290", "desc": "Tenda W30E v1.0 v1.0.1.25(633) firmware has a stack overflow vulnerability via the page parameter in the fromAddressNat function.", "poc": ["https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/W30E/fromAddressNat_page.md", "https://github.com/LaPhilosophie/IoT-vulnerable"]}, {"cve": "CVE-2024-32288", "desc": "Tenda W30E v1.0 V1.0.1.25(633) firmware has a stack overflow vulnerability located via the page parameter in the fromwebExcptypemanFilter function.", "poc": ["https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/W30E/fromwebExcptypemanFilter.md", "https://github.com/LaPhilosophie/IoT-vulnerable"]}, {"cve": "CVE-2024-0287", "desc": "A vulnerability was found in Kashipara Food Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file itemBillPdf.php. The manipulation of the argument printid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249848.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-2681", "desc": "A vulnerability was found in Campcodes Online Job Finder System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /admin/employee/index.php. The manipulation of the argument view leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-257381 was assigned to this vulnerability.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-26062", "desc": "Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim\u2019s browser when they browse to the page containing the vulnerable field.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-34921", "desc": "TOTOLINK X5000R v9.1.0cu.2350_B20230313 was discovered to contain a command injection via the disconnectVPN function.", "poc": ["https://github.com/cainiao159357/x5000r_poc/blob/main/README.md"]}, {"cve": "CVE-2024-24793", "desc": "A use-after-free vulnerability exists in the DICOM Element Parsing as implemented in Imaging Data Commons libdicom 1.0.5. A specially crafted DICOM file can cause premature freeing of memory that is used later. To trigger this vulnerability, an attacker would need to induce the vulnerable application to process a malicious DICOM image.The Use-After-Free happens in the `parse_meta_element_create()` parsing the elements in the File Meta Information header.", "poc": ["https://talosintelligence.com/vulnerability_reports/TALOS-2024-1931", "https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1931"]}, {"cve": "CVE-2024-2879", "desc": "The LayerSlider plugin for WordPress is vulnerable to SQL Injection via the ls_get_popup_markup action in versions 7.9.11 and 7.10.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into alrLine truncated