Update Thu Sep 28 11:04:11 UTC 2023

2016/CVE-2016-11060.md

@@ -0,0 +1,17 @@
+### [CVE-2016-11060](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-11060)
+![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brighgreen)
+
+### Description
+
+Certain NETGEAR devices are affected by insecure renegotiation. This affects SRX5308 before 2017-02-10, FVS336Gv3 before 2017-02-10, FVS318N before 2017-02-10, and FVS318Gv2 before 2017-02-10.
+
+### POC
+
+#### Reference
+- https://kb.netgear.com/31426/SSL-Renegotiation-Denial-of-Service-Vulnerability
+
+#### Github
+No PoCs found on GitHub currently.
+

2021/CVE-2021-24466.md

@@ -0,0 +1,18 @@
+### [CVE-2021-24466](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-24466)
+![](https://img.shields.io/static/v1?label=Product&message=Verse-O-Matic&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=4.1.1%3C%3D%204.1.1%20&color=brighgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-352%20Cross-Site%20Request%20Forgery%20(CSRF)&color=brighgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%20Cross-site%20Scripting%20(XSS)&color=brighgreen)
+
+### Description
+
+The Verse-O-Matic WordPress plugin through 4.1.1 does not have any CSRF checks in place, allowing attackers to make logged in administrators do unwanted actions, such as add/edit/delete arbitrary verses and change the settings. Due to the lack of sanitisation in the settings and verses, this could also lead to Stored Cross-Site Scripting issues
+
+### POC
+
+#### Reference
+- https://wpscan.com/vulnerability/37c7bdbb-f27f-47d3-9886-69d2e83d7581
+
+#### Github
+No PoCs found on GitHub currently.
+

2022/CVE-2022-22536.md

@@ -5,7 +5,7 @@
 ![](https://img.shields.io/static/v1?label=Version&message=%3D%207.49%20&color=brighgreen)
 ![](https://img.shields.io/static/v1?label=Version&message=%3D%207.53%20&color=brighgreen)
 ![](https://img.shields.io/static/v1?label=Version&message=%3D%20KERNEL%207.22%20&color=brighgreen)
-![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-444&color=brighgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-444%20Inconsistent%20Interpretation%20of%20HTTP%20Requests%20('HTTP%20Request%20Smuggling')&color=brighgreen)
 
 ### Description
 

2022/CVE-2022-29599.md

@@ -1,7 +1,7 @@
 ### [CVE-2022-29599](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29599)
 ![](https://img.shields.io/static/v1?label=Product&message=Apache%20Maven&color=blue)
 ![](https://img.shields.io/static/v1?label=Version&message=maven-shared-utils%3C%203.3.3%20&color=brighgreen)
-![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-77%20Improper%20Neutralization%20of%20Special%20Elements%20used%20in%20a%20Command%20('Command%20Injection')&color=brighgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-116%20Improper%20Encoding%20or%20Escaping%20of%20Output&color=brighgreen)
 
 ### Description
 

2023/CVE-2023-2315.md

@@ -0,0 +1,18 @@
+### [CVE-2023-2315](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-2315)
+![](https://img.shields.io/static/v1?label=Product&message=Opencart&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=4.0.0.0%3C%3D%204.0.2.2%20&color=brighgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-20%20Improper%20Input%20Validation&color=brighgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-22%20Improper%20Limitation%20of%20a%20Pathname%20to%20a%20Restricted%20Directory%20('Path%20Traversal')&color=brighgreen)
+
+### Description
+
+Path Traversal in OpenCart versions 4.0.0.0 to 4.0.2.2 allows an authenticated user with access/modify privilege on the Log component to empty out arbitrary files on the server
+
+### POC
+
+#### Reference
+- https://starlabs.sg/advisories/23/23-2315/
+
+#### Github
+No PoCs found on GitHub currently.
+

2023/CVE-2023-26145.md

@@ -0,0 +1,17 @@
+### [CVE-2023-26145](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-26145)
+![](https://img.shields.io/static/v1?label=Product&message=pydash&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0%3C%206.0.0%20&color=brighgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Command%20Injection&color=brighgreen)
+
+### Description
+
+This affects versions of the package pydash before 6.0.0. A number of pydash methods such as pydash.objects.invoke() and pydash.collections.invoke_map() accept dotted paths (Deep Path Strings) to target a nested Python object, relative to the original source object. These paths can be used to target internal class attributes and dict items, to retrieve, modify or invoke nested Python objects.**Note:**The pydash.objects.invoke() method is vulnerable to Command Injection when the following prerequisites are satisfied:1) The source object (argument 1) is not a built-in object such as list/dict (otherwise, the __init__.__globals__ path is not accessible)2) The attacker has control over argument 2 (the path string) and argument 3 (the argument to pass to the invoked method)The pydash.collections.invoke_map() method is also vulnerable, but is harder to exploit as the attacker does not have direct control over the argument to be passed to the invoked function.
+
+### POC
+
+#### Reference
+- https://security.snyk.io/vuln/SNYK-PYTHON-PYDASH-5916518
+
+#### Github
+No PoCs found on GitHub currently.
+

2023/CVE-2023-26149.md

@@ -0,0 +1,17 @@
+### [CVE-2023-26149](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-26149)
+![](https://img.shields.io/static/v1?label=Product&message=quill-mention&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0%3C%204.0.0%20&color=brighgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Cross-site%20Scripting%20(XSS)&color=brighgreen)
+
+### Description
+
+Versions of the package quill-mention before 4.0.0 are vulnerable to Cross-site Scripting (XSS) due to improper user-input sanitization, via the renderList function. **Note:**If the mentions list is sourced from unsafe (user-sourced) data, this might allow an injection attack when a Quill user hits @.
+
+### POC
+
+#### Reference
+- https://security.snyk.io/vuln/SNYK-JS-QUILLMENTION-5921549
+
+#### Github
+No PoCs found on GitHub currently.
+

2023/CVE-2023-30471.md

@@ -0,0 +1,17 @@
+### [CVE-2023-30471](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-30471)
+![](https://img.shields.io/static/v1?label=Product&message=WP%20Search%20Analytics&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%20Improper%20Neutralization%20of%20Input%20During%20Web%20Page%20Generation%20('Cross-site%20Scripting')&color=brighgreen)
+
+### Description
+
+Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Cornel Raiu WP Search Analytics plugin <= 1.4.7 versions.
+
+### POC
+
+#### Reference
+No PoCs from references.
+
+#### Github
+- https://github.com/hackintoanetwork/hackintoanetwork
+

2023/CVE-2023-30472.md

@@ -0,0 +1,17 @@
+### [CVE-2023-30472](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-30472)
+![](https://img.shields.io/static/v1?label=Product&message=URL%20Shortener%20by%20MyThemeShop&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%3C%3D%201.0.17%20&color=brighgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%20Improper%20Neutralization%20of%20Input%20During%20Web%20Page%20Generation%20('Cross-site%20Scripting')&color=brighgreen)
+
+### Description
+
+Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in MyThemeShop URL Shortener by MyThemeShop plugin <= 1.0.17 versions.
+
+### POC
+
+#### Reference
+No PoCs from references.
+
+#### Github
+- https://github.com/hackintoanetwork/hackintoanetwork
+

2023/CVE-2023-30493.md

@@ -0,0 +1,17 @@
+### [CVE-2023-30493](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-30493)
+![](https://img.shields.io/static/v1?label=Product&message=Ultimate%20Addons%20for%20Contact%20Form%207&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%20Improper%20Neutralization%20of%20Input%20During%20Web%20Page%20Generation%20('Cross-site%20Scripting')&color=brighgreen)
+
+### Description
+
+Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Themefic Ultimate Addons for Contact Form 7 plugin <= 3.2.0 versions.
+
+### POC
+
+#### Reference
+No PoCs from references.
+
+#### Github
+- https://github.com/hackintoanetwork/hackintoanetwork
+

2023/CVE-2023-35793.md

@@ -0,0 +1,17 @@
+### [CVE-2023-35793](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-35793)
+![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brighgreen)
+
+### Description
+
+An issue was discovered in Cassia Access Controller 2.1.1.2303271039. Establishing a web SSH session to gateways is vulnerable to Cross Site Request Forgery (CSRF) attacks.
+
+### POC
+
+#### Reference
+No PoCs from references.
+
+#### Github
+- https://github.com/nomi-sec/PoC-in-GitHub
+

2023/CVE-2023-36844.md

@@ -1,11 +1,11 @@
 ### [CVE-2023-36844](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-36844)
 ![](https://img.shields.io/static/v1?label=Product&message=Junos%20OS&color=blue)
-![](https://img.shields.io/static/v1?label=Version&message=unspecified%3C%2020.4R3-S9%20&color=brighgreen)
+![](https://img.shields.io/static/v1?label=Version&message=0%3C%2020.4R3-S9%20&color=brighgreen)
 ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-473%20PHP%20External%20Variable%20Modification&color=brighgreen)
 
 ### Description
 
-A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to control certain, important environments variables.Utilizing a crafted request an attacker is able to modify certain PHP environments variables leading to partial loss of integrity, which may allow chaining to other vulnerabilities.This issue affects Juniper Networks Junos OS on EX Series:  *  All versions prior to 20.4R3-S9;  *  21.2 versions prior to 21.2R3-S6;  *  21.3 versions prior to  21.3R3-S5;  *  21.4 versions prior to 21.4R3-S5;  *  22.1 versions prior to 22.1R3-S4;  *  22.2 versions prior to 22.2R3-S2;  *  22.3 versions prior to 22.3R3-S1;  *  22.4 versions prior to 22.4R2-S2, 22.4R3.
+A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to control certain, important environment variables.Using a crafted request an attacker is able to modify certain PHP environment variables leading to partial loss of integrity, which may allow chaining to other vulnerabilities.This issue affects Juniper Networks Junos OS on EX Series:  *  All versions prior to 20.4R3-S9;  *  21.1 versions 21.1R1 and later;  *  21.2 versions prior to 21.2R3-S7;  *  21.3 versions prior to  21.3R3-S5;  *  21.4 versions prior to 21.4R3-S5;  *  22.1 versions prior to 22.1R3-S4;  *  22.2 versions prior to 22.2R3-S2;  *  22.3 versions prior to 22.3R3-S1;  *  22.4 versions prior to 22.4R2-S2, 22.4R3;  *  23.2 versions prior to 23.2R1-S1, 23.2R2.
 
 ### POC
 

2023/CVE-2023-36845.md

@@ -1,11 +1,11 @@
 ### [CVE-2023-36845](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-36845)
 ![](https://img.shields.io/static/v1?label=Product&message=Junos%20OS&color=blue)
-![](https://img.shields.io/static/v1?label=Version&message=21.4%3C%2021.4R3-S5%20&color=brighgreen)
+![](https://img.shields.io/static/v1?label=Version&message=0%3C%2020.4R3-S9%20&color=brighgreen)
 ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-473%20PHP%20External%20Variable%20Modification&color=brighgreen)
 
 ### Description
 
-A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series and SRX Series allows an unauthenticated, network-based attacker to control certain, important environments variables.Utilizing a crafted request an attacker is able to modify a certain PHP environment variable leading to partial loss of integrity, which may allow chaining to other vulnerabilities.This issue affects Juniper Networks Junos OS on SRX Series:  *  All versions prior to 21.4R3-S5;  *  22.1 versions prior to 22.1R3-S4;  *  22.2 versions prior to 22.2R3-S2;  *  22.3 versions prior to 22.3R2-S2, 22.3R3-S1;  *  22.4 versions prior to 22.4R2-S1, 22.4R3;  *  23.2 versions prior to 23.2R1-S1, 23.2R2.
+A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series and SRX Series allows an unauthenticated, network-based attacker to remotely execute code.Using a crafted request which sets the variable PHPRC an attacker is able to modify the PHP execution environment allowing the injection und execution of code.This issue affects Juniper Networks Junos OS on EX Seriesand SRX Series:  *  All versions prior to 20.4R3-S9;  *  21.1 versions 21.1R1 and later;  *  21.2 versions prior to 21.2R3-S7;  *  21.3 versions prior to 21.3R3-S5;  *  21.4 versions prior to 21.4R3-S5;  *  22.1 versions prior to 22.1R3-S4;  *  22.2 versions prior to 22.2R3-S2;  *  22.3 versions prior to 22.3R2-S2, 22.3R3-S1;  *  22.4 versions prior to 22.4R2-S1, 22.4R3;  *  23.2 versions prior to 23.2R1-S1, 23.2R2.
 
 ### POC
 

2023/CVE-2023-36846.md

@@ -1,11 +1,11 @@
 ### [CVE-2023-36846](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-36846)
 ![](https://img.shields.io/static/v1?label=Product&message=Junos%20OS&color=blue)
-![](https://img.shields.io/static/v1?label=Version&message=unspecified%3C%2020.4R3-S8%20&color=brighgreen)
+![](https://img.shields.io/static/v1?label=Version&message=0%3C%2020.4R3-S8%20&color=brighgreen)
 ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-306%20Missing%20Authentication%20for%20Critical%20Function&color=brighgreen)
 
 ### Description
 
-A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity.With a specific request that doesn't require authentication an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrityfor a certain part of the file system, which may allow chaining to other vulnerabilities.This issue affects Juniper Networks Junos OS on SRX Series:  *  All versions prior to 20.4R3-S8;  *  21.2 versions prior to 21.2R3-S6;  *  21.3 versions prior to  21.3R3-S5;  *  21.4 versions prior to 21.4R3-S5;  *  22.1 versions prior to 22.1R3-S3;  *  22.2 versions prior to 22.2R3-S2;  *  22.3 versions prior to 22.3R2-S2, 22.3R3;  *  22.4 versions prior to 22.4R2-S1, 22.4R3.
+A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity.With a specific request to user.php that doesn't require authentication an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrityfor a certain part of the file system, which may allow chaining to other vulnerabilities.This issue affects Juniper Networks Junos OS on SRX Series:  *  All versions prior to 20.4R3-S8;  *  21.1 versions 21.1R1 and later;  *  21.2 versions prior to 21.2R3-S6;  *  21.3 versions prior to  21.3R3-S5;  *  21.4 versions prior to 21.4R3-S5;  *  22.1 versions prior to 22.1R3-S3;  *  22.2 versions prior to 22.2R3-S2;  *  22.3 versions prior to 22.3R2-S2, 22.3R3;  *  22.4 versions prior to 22.4R2-S1, 22.4R3.
 
 ### POC
 

2023/CVE-2023-36847.md

@@ -1,11 +1,11 @@
 ### [CVE-2023-36847](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-36847)
 ![](https://img.shields.io/static/v1?label=Product&message=Junos%20OS&color=blue)
-![](https://img.shields.io/static/v1?label=Version&message=unspecified%3C%2020.4R3-S8%20&color=brighgreen)
+![](https://img.shields.io/static/v1?label=Version&message=0%3C%2020.4R3-S8%20&color=brighgreen)
 ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-306%20Missing%20Authentication%20for%20Critical%20Function&color=brighgreen)
 
 ### Description
 
-A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity.With a specific request that doesn't require authentication an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrityfor a certain part of the file system, which may allow chaining to other vulnerabilities.This issue affects Juniper Networks Junos OS on EX Series:  *  All versions prior to 20.4R3-S8;  *  21.2 versions prior to 21.2R3-S6;  *  21.3 versions prior to  21.3R3-S5;  *  21.4 versions prior to 21.4R3-S4;  *  22.1 versions prior to 22.1R3-S3;  *  22.2 versions prior to 22.2R3-S1;  *  22.3 versions prior to 22.3R2-S2, 22.3R3;  *  22.4 versions prior to 22.4R2-S1, 22.4R3.
+A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity.With a specific request to installAppPackage.php that doesn't require authentication an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrityfor a certain part of the file system, which may allow chaining to other vulnerabilities.This issue affects Juniper Networks Junos OS on EX Series:  *  All versions prior to 20.4R3-S8;  *  21.1 versions 21.1R1 and later;  *  21.2 versions prior to 21.2R3-S6;  *  21.3 versions prior to  21.3R3-S5;  *  21.4 versions prior to 21.4R3-S4;  *  22.1 versions prior to 22.1R3-S3;  *  22.2 versions prior to 22.2R3-S1;  *  22.3 versions prior to 22.3R2-S2, 22.3R3;  *  22.4 versions prior to 22.4R2-S1, 22.4R3.
 
 ### POC
 

2023/CVE-2023-36874.md

@@ -42,7 +42,7 @@ Windows Error Reporting Service Elevation of Privilege Vulnerability
 ### POC
 
 #### Reference
-No PoCs from references.
+- http://packetstormsecurity.com/files/174843/Microsoft-Error-Reporting-Local-Privilege-Elevation.html
 
 #### Github
 - https://github.com/0xsyr0/OSCP

2023/CVE-2023-39007.md

@@ -5,7 +5,7 @@
 
 ### Description
 
-/ui/cron/item/open in the Cron component of OPNsense before 23.7 allows XSS.
+/ui/cron/item/open in the Cron component of OPNsense before 23.7 allows XSS via openAction in app/controllers/OPNsense/Cron/ItemController.php.
 
 ### POC
 

2023/CVE-2023-40663.md

@@ -0,0 +1,17 @@
+### [CVE-2023-40663](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-40663)
+![](https://img.shields.io/static/v1?label=Product&message=WP%20VR&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%20Improper%20Neutralization%20of%20Input%20During%20Web%20Page%20Generation%20('Cross-site%20Scripting')&color=brighgreen)
+
+### Description
+
+Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Rextheme WP VR plugin <= 8.3.4 versions.
+
+### POC
+
+#### Reference
+No PoCs from references.
+
+#### Github
+- https://github.com/hackintoanetwork/hackintoanetwork
+

2023/CVE-2023-4260.md

@@ -0,0 +1,19 @@
+### [CVE-2023-4260](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4260)
+![](https://img.shields.io/static/v1?label=Product&message=Zephyr&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0%3C%3D%203.4%20&color=brighgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-120%20Buffer%20Copy%20without%20Checking%20Size%20of%20Input%20('Classic%20Buffer%20Overflow')&color=brighgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-193%20Off-by-one%20Error&color=brighgreen)
+
+### Description
+
+Potential off-by-one buffer overflow vulnerability in the Zephyr fuse file system.
+
+### POC
+
+#### Reference
+No PoCs from references.
+
+#### Github
+- https://github.com/0xdea/advisories
+- https://github.com/hnsecurity/vulns
+