Skip to content

Commit 1ef3774

Browse files
trickest-workflowstrickest-workflows
committed
Update Wed Feb 19 12:24:46 UTC 2025
1 parent 3c277e0 commit 1ef3774

24 files changed

Lines changed: 211 additions & 9 deletions

‎2024/CVE-2024-12173.md‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
### [CVE-2024-12173](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-12173)
2+
![](https://img.shields.io/static/v1?label=Product&message=Master%20Slider&color=blue)
3+
![](https://img.shields.io/static/v1?label=Version&message=0%3C%203.10.5%20&color=brighgreen)
4+
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%20Cross-Site%20Scripting%20(XSS)&color=brighgreen)
5+
6+
### Description
7+
8+
The Master Slider WordPress plugin before 3.10.5 does not sanitise and escape some of its settings, which could allow high privilege users such as Editor and above to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
9+
10+
### POC
11+
12+
#### Reference
13+
- https://wpscan.com/vulnerability/0f35be0e-0f63-4e33-aa4d-c47b1f1e0595/
14+
15+
#### Github
16+
No PoCs found on GitHub currently.
17+

‎2024/CVE-2024-36694.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ OpenCart 4.0.2.3 is vulnerable to Server-Side Template Injection (SSTI) via the
1111

1212
#### Reference
1313
- https://github.com/A3h1nt/CVEs/blob/main/OpenCart/Readme.md
14+
- https://github.com/PawaritSanguanpang/CVEs/blob/main/OpenCart/CVE-2024-36694/README.md
1415
- https://medium.com/@pawarit.sanguanpang/opencart-v4-0-2-3-server-side-template-injection-0b173a3bdcf9
1516

1617
#### Github

‎2024/CVE-2024-46261.md‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,11 @@ cute_png v1.05 was discovered to contain a heap buffer overflow via the cp_make3
1010
### POC
1111

1212
#### Reference
13-
No PoCs from references.
13+
- https://github.com/Helson-S/FuzzyTesting/blob/master/cute_headers/cute_png/heapof-r1-cp_make32-cute_png-948c10
14+
- https://github.com/Helson-S/FuzzyTesting/blob/master/cute_headers/cute_png/heapof-r1-cp_make32-cute_png-948c10/poc
15+
- https://github.com/Helson-S/FuzzyTesting/blob/master/cute_headers/cute_png/heapof-r1-cp_make32-cute_png-948c10/poc/sample4.png
16+
- https://github.com/Helson-S/FuzzyTesting/blob/master/cute_headers/cute_png/heapof-r1-cp_make32-cute_png-948c10/vulDescription.assets/image-20240527232015967.png
17+
- https://github.com/Helson-S/FuzzyTesting/blob/master/cute_headers/cute_png/heapof-r1-cp_make32-cute_png-948c10/vulDescription.md
1418

1519
#### Github
1620
- https://github.com/fkie-cad/nvd-json-data-feeds

‎2024/CVE-2024-46263.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,11 @@ cute_png v1.05 was discovered to contain a stack overflow via the cp_dynamic() f
1010
### POC
1111

1212
#### Reference
13+
- https://github.com/Helson-S/FuzzyTesting/blob/master/cute_headers/cute_png/stkof-w1-cp_dynamic-cute_png-601c71
14+
- https://github.com/Helson-S/FuzzyTesting/blob/master/cute_headers/cute_png/stkof-w1-cp_dynamic-cute_png-601c71/poc
1315
- https://github.com/Helson-S/FuzzyTesting/blob/master/cute_headers/cute_png/stkof-w1-cp_dynamic-cute_png-601c71/poc/sample15.png
16+
- https://github.com/Helson-S/FuzzyTesting/blob/master/cute_headers/cute_png/stkof-w1-cp_dynamic-cute_png-601c71/vulDescription.assets/image-20240527235936692.png
17+
- https://github.com/Helson-S/FuzzyTesting/blob/master/cute_headers/cute_png/stkof-w1-cp_dynamic-cute_png-601c71/vulDescription.md
1418

1519
#### Github
1620
- https://github.com/fkie-cad/nvd-json-data-feeds

‎2024/CVE-2024-46264.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,8 +10,10 @@ cute_png v1.05 was discovered to contain a heap buffer overflow via the cp_find(
1010
### POC
1111

1212
#### Reference
13+
- https://github.com/Helson-S/FuzzyTesting/blob/master/cute_headers/cute_png/heapof-r4-cp_find-cute_png-979c8
1314
- https://github.com/Helson-S/FuzzyTesting/blob/master/cute_headers/cute_png/heapof-r4-cp_find-cute_png-979c8/poc
1415
- https://github.com/Helson-S/FuzzyTesting/blob/master/cute_headers/cute_png/heapof-r4-cp_find-cute_png-979c8/poc/sample8.png
16+
- https://github.com/Helson-S/FuzzyTesting/blob/master/cute_headers/cute_png/heapof-r4-cp_find-cute_png-979c8/vulDescription.assets/image-20240527233234147.png
1517
- https://github.com/Helson-S/FuzzyTesting/blob/master/cute_headers/cute_png/heapof-r4-cp_find-cute_png-979c8/vulDescription.md
1618

1719
#### Github

‎2024/CVE-2024-46274.md‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,9 @@ cute_png v1.05 was discovered to contain a heap buffer overflow via the cp_store
1010
### POC
1111

1212
#### Reference
13-
No PoCs from references.
13+
- https://github.com/Helson-S/FuzzyTesting/blob/master/cute_headers/cute_png/heapof-r65280-cp_stored-cute_png-543c2/poc
14+
- https://github.com/Helson-S/FuzzyTesting/blob/master/cute_headers/cute_png/heapof-r65280-cp_stored-cute_png-543c2/poc/sample10.png
15+
- https://github.com/Helson-S/FuzzyTesting/blob/master/cute_headers/cute_png/heapof-r65280-cp_stored-cute_png-543c2/vulDescription.md
1416

1517
#### Github
1618
- https://github.com/fkie-cad/nvd-json-data-feeds

‎2024/CVE-2024-46278.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ Teedy 1.11 is vulnerable to Cross Site Scripting (XSS) via the management consol
1010
### POC
1111

1212
#### Reference
13+
- https://github.com/ayato-shitomi/CVE-2024-46278-teedy_1.11_account-takeover
1314
- https://github.com/ayato-shitomi/teedy_1.11_account-takeover
1415

1516
#### Github

‎2024/CVE-2024-46316.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ DrayTek Vigor3900 v1.5.1.6 was discovered to contain a command injection vulnera
1010
### POC
1111

1212
#### Reference
13-
No PoCs from references.
13+
- https://github.com/glkfc/IoT-Vulnerability/blob/main/DaryTek/vigor3900_4.md
1414

1515
#### Github
1616
- https://github.com/fkie-cad/nvd-json-data-feeds

‎2024/CVE-2024-46424.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ TOTOLINK AC1200 T8 v4.1.5cu.861_B20230220 has a buffer overflow vulnerability in
1010
### POC
1111

1212
#### Reference
13-
No PoCs from references.
13+
- https://github.com/TTTJJJWWW/AHU-IoT-vulnerable/blob/main/TOTOLINK/AC1200T8/UploadCustomModule.md
1414

1515
#### Github
1616
- https://github.com/TTTJJJWWW/AHU-IoT-vulnerable

‎2024/CVE-2024-46471.md‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
### [CVE-2024-46471](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-46471)
2+
![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
3+
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
4+
![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brighgreen)
5+
6+
### Description
7+
8+
The Directory Listing in /uploads/ Folder in CodeAstro Membership Management System 1.0 exposes the structure and contents of directories, potentially revealing sensitive information.
9+
10+
### POC
11+
12+
#### Reference
13+
- https://github.com/JonMoriSenpai/CVE-WriteUps/blob/main/CodeAstro%20-%20MembershipM-PHP/CVE-2024-46471/writeup.md
14+
15+
#### Github
16+
No PoCs found on GitHub currently.
17+

0 commit comments

Comments
 (0)