Update Wed Jun 5 10:11:36 UTC 2024

2021/CVE-2021-29620.md

@@ -0,0 +1,17 @@
+### [CVE-2021-29620](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29620)
+![](https://img.shields.io/static/v1?label=Product&message=reportportal&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-611%3A%20Improper%20Restriction%20of%20XML%20External%20Entity%20Reference&color=brighgreen)
+
+### Description
+
+Report portal is an open source reporting and analysis framework. Starting from version 3.1.0 of the service-api XML parsing was introduced. Unfortunately the XML parser was not configured properly to prevent XML external entity (XXE) attacks. This allows a user to import a specifically-crafted XML file which imports external Document Type Definition (DTD) file with external entities for extraction of secrets from Report Portal service-api module or server-side request forgery. This will be resolved in the 5.4.0 release.
+
+### POC
+
+#### Reference
+- https://mvnrepository.com/artifact/com.epam.reportportal/service-api
+
+#### Github
+No PoCs found on GitHub currently.
+

2022/CVE-2022-2586.md

@@ -15,6 +15,7 @@ It was discovered that a nft object or expression could reference a nft set on a
 - https://ubuntu.com/security/notices/USN-5564-1
 - https://ubuntu.com/security/notices/USN-5565-1
 - https://ubuntu.com/security/notices/USN-5566-1
+- https://ubuntu.com/security/notices/USN-5582-1
 - https://www.openwall.com/lists/oss-security/2022/08/09/5
 
 #### Github

2022/CVE-2022-2588.md

@@ -15,6 +15,7 @@ It was discovered that the cls_route filter implementation in the Linux kernel w
 - https://ubuntu.com/security/notices/USN-5564-1
 - https://ubuntu.com/security/notices/USN-5565-1
 - https://ubuntu.com/security/notices/USN-5566-1
+- https://ubuntu.com/security/notices/USN-5582-1
 - https://www.openwall.com/lists/oss-security/2022/08/09/6
 
 #### Github

2024/CVE-2024-26471.md

@@ -10,7 +10,7 @@ A reflected cross-site scripting (XSS) vulnerability in zhimengzhe iBarn v1.5 al
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2024-26471
 
 #### Github
 - https://github.com/fkie-cad/nvd-json-data-feeds

2024/CVE-2024-4886.md

@@ -0,0 +1,17 @@
+### [CVE-2024-4886](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-4886)
+![](https://img.shields.io/static/v1?label=Product&message=buddyboss-platform&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0%3C%202.6.0%20&color=brighgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-639%20Authorization%20Bypass%20Through%20User-Controlled%20Key&color=brighgreen)
+
+### Description
+
+The  contains an IDOR vulnerability that allows a user to comment on a private post by manipulating the ID included in the request
+
+### POC
+
+#### Reference
+- https://wpscan.com/vulnerability/76e8591f-120c-4cd7-b9a2-79f8d4d98aa8/
+
+#### Github
+No PoCs found on GitHub currently.
+

references.txt

@@ -74511,6 +74511,7 @@ CVE-2021-29505 - https://www.oracle.com/security-alerts/cpuapr2022.html
 CVE-2021-29505 - https://www.oracle.com/security-alerts/cpujan2022.html
 CVE-2021-29505 - https://www.oracle.com/security-alerts/cpujul2022.html
 CVE-2021-29505 - https://www.oracle.com/security-alerts/cpuoct2021.html
+CVE-2021-29620 - https://mvnrepository.com/artifact/com.epam.reportportal/service-api
 CVE-2021-29623 - https://github.com/Exiv2/exiv2/pull/1627
 CVE-2021-29624 - https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html
 CVE-2021-29641 - http://packetstormsecurity.com/files/162118/Monospace-Directus-Headless-CMS-File-Upload-Rule-Bypass.html
@@ -82130,6 +82131,7 @@ CVE-2022-2586 - https://ubuntu.com/security/notices/USN-5562-1
 CVE-2022-2586 - https://ubuntu.com/security/notices/USN-5564-1
 CVE-2022-2586 - https://ubuntu.com/security/notices/USN-5565-1
 CVE-2022-2586 - https://ubuntu.com/security/notices/USN-5566-1
+CVE-2022-2586 - https://ubuntu.com/security/notices/USN-5582-1
 CVE-2022-2586 - https://www.openwall.com/lists/oss-security/2022/08/09/5
 CVE-2022-25860 - https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3177391
 CVE-2022-25862 - https://snyk.io/vuln/SNYK-JS-SDS-2385944
@@ -82155,6 +82157,7 @@ CVE-2022-2588 - https://ubuntu.com/security/notices/USN-5562-1
 CVE-2022-2588 - https://ubuntu.com/security/notices/USN-5564-1
 CVE-2022-2588 - https://ubuntu.com/security/notices/USN-5565-1
 CVE-2022-2588 - https://ubuntu.com/security/notices/USN-5566-1
+CVE-2022-2588 - https://ubuntu.com/security/notices/USN-5582-1
 CVE-2022-2588 - https://www.openwall.com/lists/oss-security/2022/08/09/6
 CVE-2022-25881 - https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3253332
 CVE-2022-25881 - https://security.snyk.io/vuln/SNYK-JS-HTTPCACHESEMANTICS-3248783
@@ -95391,6 +95394,7 @@ CVE-2024-26445 - https://github.com/xiaolanjing0/cms/blob/main/1.md
 CVE-2024-26454 - https://github.com/OmRajpurkar/Healthcare-Chatbot/issues/4
 CVE-2024-26454 - https://medium.com/@0x0d0x0a/healthcare-chatbot-xss-cve-2024-26454-acf2607bf210
 CVE-2024-26470 - https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2024-26470
+CVE-2024-26471 - https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2024-26471
 CVE-2024-26476 - https://github.com/mpdf/mpdf/issues/867
 CVE-2024-26489 - https://github.com/2111715623/cms/blob/main/3.md
 CVE-2024-26490 - https://github.com/2111715623/cms/blob/main/2.md
@@ -96735,6 +96739,7 @@ CVE-2024-4855 - https://gitlab.com/wireshark/wireshark/-/issues/19784
 CVE-2024-4856 - https://wpscan.com/vulnerability/6cf90a27-55e2-4b2c-9df1-5fa34c1bd9d1/
 CVE-2024-4857 - https://wpscan.com/vulnerability/bf1b8434-b361-4666-9058-d9f08c09d083/
 CVE-2024-4860 - https://www.tenable.com/security/research/tra-2024-16
+CVE-2024-4886 - https://wpscan.com/vulnerability/76e8591f-120c-4cd7-b9a2-79f8d4d98aa8/
 CVE-2024-4904 - https://github.com/Hefei-Coffee/cve/blob/main/upload.md
 CVE-2024-4912 - https://github.com/yylmm/CVE/blob/main/Online%20Examination%20System%20With%20Timer/SQL_addExamExe.md
 CVE-2024-4913 - https://github.com/yylmm/CVE/blob/main/Online%20Examination%20System%20With%20Timer/SQL_exam.md