Update CVE list 2024-06-23 04:43

docs/CVE_list.json

@@ -1 +1 @@
-[{"cve": "CVE-2024-30165", "desc": "Amazon AWS Client VPN before 3.9.1 on macOS has a buffer overflow that could potentially allow a local actor to execute arbitrary commands with elevated permissions, a different vulnerability than CVE-2024-30164.", "poc": ["https://github.com/p4yl0ad/p4yl0ad"]}, {"cve": "CVE-2024-5097", "desc": "A vulnerability, which was classified as problematic, was found in SourceCodester Simple Inventory System 1.0. Affected is an unknown function of the file /tableedit.php#page=editprice. The manipulation of the argument itemnumber leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-265080.", "poc": ["https://github.com/rockersiyuan/CVE/blob/main/SourceCodester%20Simple%20Inventory%20System%20CSRF.md", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-35361", "desc": "MTab Bookmark v1.9.5 has an SQL injection vulnerability in /LinkStore/getIcon. An attacker can execute arbitrary SQL statements through this vulnerability without requiring any user rights.", "poc": ["https://github.com/Hebing123/cve/issues/37"]}, {"cve": "CVE-2024-1787", "desc": "The Contests by Rewards Fuel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'update_rewards_fuel_api_key' parameter in all versions up to, and including, 2.0.64 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-22877", "desc": "StrangeBee TheHive 5.2.0 to 5.2.8 is vulnerable to Cross Site Scripting (XSS) in the case reporting functionality. This feature allows an attacker to insert malicious JavaScript code inside the template or its variables, that will be executed in the context of the TheHive application when the HTML report is opened.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-20660", "desc": "Microsoft Message Queuing Information Disclosure Vulnerability", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-4620", "desc": "The ARForms - Premium WordPress Form Builder Plugin WordPress plugin before 6.6 allows unauthenticated users to modify uploaded files in such a way that PHP code can be uploaded when an upload file input is included on a form", "poc": ["https://wpscan.com/vulnerability/dc34dc2d-d5a1-4e28-8507-33f659ead647/", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-25154", "desc": "Improper URL validation leads to path traversal in FileCatalyst Direct 3.8.8 and earlier allowing an encoded payload to cause the web server to return files located outside of the web root which may lead to data leakage.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-4835", "desc": "A XSS condition exists within GitLab in versions 15.11 before 16.10.6, 16.11 before 16.11.3, and 17.0 before 17.0.1. By leveraging this condition, an attacker can craft a malicious page to exfiltrate sensitive user information.", "poc": ["https://github.com/netlas-io/netlas-dorks", "https://github.com/tanjiti/sec_profile"]}, {"cve": "CVE-2024-33438", "desc": "File Upload vulnerability in CubeCart before 6.5.5 allows an authenticated user to execute arbitrary code via a crafted .phar file.", "poc": ["https://github.com/julio-cfa/CVE-2024-33438", "https://github.com/julio-cfa/CVE-2024-33438", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2024-32977", "desc": "OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.10.0 contain a vulnerability that allows an unauthenticated attacker to completely bypass the authentication if the `autologinLocal` option is enabled within `config.yaml`, even if they come from networks that are not configured as `localNetworks`, spoofing their IP via the `X-Forwarded-For` header. If autologin is not enabled, this vulnerability does not have any impact. The vulnerability has been patched in version 1.10.1. Until the patch has been applied, OctoPrint administrators who have autologin enabled on their instances should disable it and/or to make the instance inaccessible from potentially hostile networks like the internet.", "poc": ["https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-2vjq-hg5w-5gm7"]}, {"cve": "CVE-2024-1827", "desc": "A vulnerability was found in code-projects Library System 1.0 and classified as critical. This issue affects some unknown processing of the file Source/librarian/user/teacher/login.php. The manipulation of the argument username/password leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated Line truncated
+[{"cve": "CVE-2024-30165", "desc": "Amazon AWS Client VPN before 3.9.1 on macOS has a buffer overflow that could potentially allow a local actor to execute arbitrary commands with elevated permissions, a different vulnerability than CVE-2024-30164.", "poc": ["https://github.com/p4yl0ad/p4yl0ad"]}, {"cve": "CVE-2024-5097", "desc": "A vulnerability, which was classified as problematic, was found in SourceCodester Simple Inventory System 1.0. Affected is an unknown function of the file /tableedit.php#page=editprice. The manipulation of the argument itemnumber leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-265080.", "poc": ["https://github.com/rockersiyuan/CVE/blob/main/SourceCodester%20Simple%20Inventory%20System%20CSRF.md", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-35361", "desc": "MTab Bookmark v1.9.5 has an SQL injection vulnerability in /LinkStore/getIcon. An attacker can execute arbitrary SQL statements through this vulnerability without requiring any user rights.", "poc": ["https://github.com/Hebing123/cve/issues/37"]}, {"cve": "CVE-2024-1787", "desc": "The Contests by Rewards Fuel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'update_rewards_fuel_api_key' parameter in all versions up to, and including, 2.0.64 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-22877", "desc": "StrangeBee TheHive 5.2.0 to 5.2.8 is vulnerable to Cross Site Scripting (XSS) in the case reporting functionality. This feature allows an attacker to insert malicious JavaScript code inside the template or its variables, that will be executed in the context of the TheHive application when the HTML report is opened.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-20660", "desc": "Microsoft Message Queuing Information Disclosure Vulnerability", "poc": ["https://github.com/NaInSec/CVE-LIST"]}, {"cve": "CVE-2024-4620", "desc": "The ARForms - Premium WordPress Form Builder Plugin WordPress plugin before 6.6 allows unauthenticated users to modify uploaded files in such a way that PHP code can be uploaded when an upload file input is included on a form", "poc": ["https://wpscan.com/vulnerability/dc34dc2d-d5a1-4e28-8507-33f659ead647/", "https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-25154", "desc": "Improper URL validation leads to path traversal in FileCatalyst Direct 3.8.8 and earlier allowing an encoded payload to cause the web server to return files located outside of the web root which may lead to data leakage.", "poc": ["https://github.com/fkie-cad/nvd-json-data-feeds"]}, {"cve": "CVE-2024-4835", "desc": "A XSS condition exists within GitLab in versions 15.11 before 16.10.6, 16.11 before 16.11.3, and 17.0 before 17.0.1. By leveraging this condition, an attacker can craft a malicious page to exfiltrate sensitive user information.", "poc": ["https://github.com/netlas-io/netlas-dorks", "https://github.com/tanjiti/sec_profile"]}, {"cve": "CVE-2024-33438", "desc": "File Upload vulnerability in CubeCart before 6.5.5 allows an authenticated user to execute arbitrary code via a crafted .phar file.", "poc": ["https://github.com/julio-cfa/CVE-2024-33438", "https://github.com/julio-cfa/CVE-2024-33438", "https://github.com/nomi-sec/PoC-in-GitHub"]}, {"cve": "CVE-2024-32977", "desc": "OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.10.0 contain a vulnerability that allows an unauthenticated attacker to completely bypass the authentication if the `autologinLocal` option is enabled within `config.yaml`, even if they come from networks that are not configured as `localNetworks`, spoofing their IP via the `X-Forwarded-For` header. If autologin is not enabled, this vulnerability does not have any impact. The vulnerability has been patched in version 1.10.1. Until the patch has been applied, OctoPrint administrators who have autologin enabled on their instances should disable it and/or to make the instance inaccessible from potentially hostile networks like the internet.", "poc": ["https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-2vjq-hg5w-5gm7"]}, {"cve": "CVE-2024-1827", "desc": "A vulnerability was found in code-projects Library System 1.0 and classified as critical. This issue affects some unknown processing of the file Source/librarian/user/teacher/login.php. The manipulation of the argument username/password leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated Line truncated