Update Wed May 1 18:04:03 UTC 2024

trickest · May 1, 2024 · 5ff2748 · 5ff2748
1 parent 4c6a766
commit 5ff2748
Show file tree

Hide file tree

Showing 31 changed files with 232 additions and 2 deletions.
diff --git a/2012/CVE-2012-5688.md b/2012/CVE-2012-5688.md
@@ -10,7 +10,7 @@ ISC BIND 9.8.x before 9.8.4-P1 and 9.9.x before 9.9.2-P1, when DNS64 is enabled,
 ### POC
 
 #### Reference
-No PoCs from references.
+- http://www.ubuntu.com/usn/USN-1657-1
 
 #### Github
 - https://github.com/Reverier-Xu/bind-EDNS-client-subnet-patched

diff --git a/2015/CVE-2015-2180.md b/2015/CVE-2015-2180.md
@@ -10,7 +10,7 @@ The DBMail driver in the Password plugin in Roundcube before 1.1.0 allows remote
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://github.com/roundcube/roundcubemail/issues/4757
 
 #### Github
 - https://github.com/ARPSyndicate/cvemon

diff --git a/2015/CVE-2015-2181.md b/2015/CVE-2015-2181.md
@@ -0,0 +1,17 @@
+### [CVE-2015-2181](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2181)
+![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brighgreen)
+
+### Description
+
+Multiple buffer overflows in the DBMail driver in the Password plugin in Roundcube before 1.1.0 allow remote attackers to have unspecified impact via the (1) password or (2) username.
+
+### POC
+
+#### Reference
+- https://github.com/roundcube/roundcubemail/issues/4757
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2015/CVE-2015-7297.md b/2015/CVE-2015-7297.md
@@ -30,6 +30,7 @@ SQL injection vulnerability in Joomla! 3.2 before 3.4.4 allows remote attackers
 - https://github.com/Youhoohoo/maltrail-iie
 - https://github.com/a-belard/maltrail
 - https://github.com/areaventuno/exploit-joomla
+- https://github.com/dhruvbhaiji/Maltrail-IDS
 - https://github.com/hxp2k6/https-github.com-stamparm-maltrail
 - https://github.com/jweny/pocassistdb
 - https://github.com/khanzjob/maltrail

diff --git a/2015/CVE-2015-7857.md b/2015/CVE-2015-7857.md
@@ -27,6 +27,7 @@ SQL injection vulnerability in the getListQuery function in administrator/compon
 - https://github.com/Youhoohoo/maltrail-iie
 - https://github.com/a-belard/maltrail
 - https://github.com/areaventuno/exploit-joomla
+- https://github.com/dhruvbhaiji/Maltrail-IDS
 - https://github.com/hxp2k6/https-github.com-stamparm-maltrail
 - https://github.com/khanzjob/maltrail
 - https://github.com/mukarramkhalid/joomla-sqli-mass-exploit

diff --git a/2015/CVE-2015-7858.md b/2015/CVE-2015-7858.md
@@ -27,6 +27,7 @@ SQL injection vulnerability in Joomla! 3.2 before 3.4.4 allows remote attackers
 - https://github.com/Youhoohoo/maltrail-iie
 - https://github.com/a-belard/maltrail
 - https://github.com/areaventuno/exploit-joomla
+- https://github.com/dhruvbhaiji/Maltrail-IDS
 - https://github.com/hxp2k6/https-github.com-stamparm-maltrail
 - https://github.com/khanzjob/maltrail
 - https://github.com/mukarramkhalid/joomla-sqli-mass-exploit

diff --git a/2019/CVE-2019-5736.md b/2019/CVE-2019-5736.md
@@ -62,6 +62,7 @@ runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allow
 - https://github.com/Metarget/cloud-native-security-book
 - https://github.com/Metarget/k0otkit
 - https://github.com/Metarget/metarget
+- https://github.com/MrHyperIon101/docker-security
 - https://github.com/NetW0rK1le3r/awesome-hacking-lists
 - https://github.com/PercussiveElbow/docker-escape-tool
 - https://github.com/PercussiveElbow/docker-security-checklist

diff --git a/2020/CVE-2020-15157.md b/2020/CVE-2020-15157.md
@@ -14,6 +14,7 @@ No PoCs from references.
 
 #### Github
 - https://github.com/ARPSyndicate/cvemon
+- https://github.com/MrHyperIon101/docker-security
 - https://github.com/Petes77/Docker-Security
 - https://github.com/adavarski/HomeLab-Proxmox-k8s-DevSecOps-playground
 - https://github.com/adavarski/HomeLab-k8s-DevSecOps-playground

diff --git a/2020/CVE-2020-1947.md b/2020/CVE-2020-1947.md
@@ -30,6 +30,7 @@ No PoCs from references.
 - https://github.com/Mr-xn/Penetration_Testing_POC
 - https://github.com/PalindromeLabs/Java-Deserialization-CVEs
 - https://github.com/SexyBeast233/SecBooks
+- https://github.com/StarkChristmas/CVE-2020-1947
 - https://github.com/YIXINSHUWU/Penetration_Testing_POC
 - https://github.com/developer3000S/PoC-in-GitHub
 - https://github.com/hasee2018/Penetration_Testing_POC

diff --git a/2020/CVE-2020-24186.md b/2020/CVE-2020-24186.md
@@ -21,6 +21,7 @@ A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0
 - https://github.com/Elsfa7-110/kenzer-templates
 - https://github.com/Sakura-501/CVE-2020-24186-exploit
 - https://github.com/Shamsuzzaman321/Wordpress-Exploit-AiO-Package
+- https://github.com/Whiteh4tWolf/wordpress_shell_upload
 - https://github.com/ait-aecid/kyoushi-environment
 - https://github.com/h3v0x/CVE-2020-24186-WordPress-wpDiscuz-7.0.4-RCE
 - https://github.com/hev0x/CVE-2020-24186-WordPress-wpDiscuz-7.0.4-RCE

diff --git a/2020/CVE-2020-24490.md b/2020/CVE-2020-24490.md
@@ -14,6 +14,8 @@ No PoCs from references.
 
 #### Github
 - https://github.com/ARPSyndicate/cvemon
+- https://github.com/AbrarKhan/Linux-4.19.72_CVE-2020-24490
+- https://github.com/AbrarKhan/linux_CVE-2020-24490-beforePatch
 - https://github.com/Charmve/BLE-Security-Attack-Defence
 - https://github.com/Dikens88/hopp
 - https://github.com/H4lo/awesome-IoT-security-article

diff --git a/2021/CVE-2021-4034.md b/2021/CVE-2021-4034.md
@@ -375,6 +375,7 @@ A local privilege escalation vulnerability was found on polkit's pkexec utility.
 - https://github.com/windware1203/InfoSec_study
 - https://github.com/winterwolf32/CVE-S---Penetration_Testing_POC-
 - https://github.com/wongwaituck/CVE-2021-4034
+- https://github.com/wrdz13/YearOfTheRabbit-thm
 - https://github.com/wudicainiao/cve-2021-4034
 - https://github.com/x04000/AutoPwnkit
 - https://github.com/x04000/CVE-2021-4034

diff --git a/2021/CVE-2021-44228.md b/2021/CVE-2021-44228.md
@@ -246,6 +246,7 @@ Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12
 - https://github.com/Ibrahim0963/Web-Pentesting-Resources
 - https://github.com/Ilovewomen/db_script_v2
 - https://github.com/Ilovewomen/db_script_v2_2
+- https://github.com/InfoSecInnovations/Sentinel-Service-Offering
 - https://github.com/ItsCbass/CVE-2021-44228
 - https://github.com/IvanBlanquez/aws-training-resources
 - https://github.com/J0B10/Minzomat

diff --git a/2024/CVE-2024-1698.md b/2024/CVE-2024-1698.md
@@ -18,4 +18,5 @@ No PoCs from references.
 - https://github.com/kamranhasan/CVE-2024-1698-Exploit
 - https://github.com/nomi-sec/PoC-in-GitHub
 - https://github.com/tanjiti/sec_profile
+- https://github.com/wy876/POC
 
diff --git a/2024/CVE-2024-21006.md b/2024/CVE-2024-21006.md
@@ -13,5 +13,6 @@ Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware
 No PoCs from references.
 
 #### Github
+- https://github.com/nomi-sec/PoC-in-GitHub
 - https://github.com/tanjiti/sec_profile
 
diff --git a/2024/CVE-2024-21345.md b/2024/CVE-2024-21345.md
@@ -14,8 +14,11 @@ No PoCs from references.
 
 #### Github
 - https://github.com/FoxyProxys/CVE-2024-21345
+- https://github.com/aneasystone/github-trending
 - https://github.com/exploits-forsale/24h2-nt-exploit
 - https://github.com/exploits-forsale/CVE-2024-21345
+- https://github.com/fireinrain/github-trending
+- https://github.com/jafshare/GithubTrending
 - https://github.com/johe123qwe/github-trending
 - https://github.com/nomi-sec/PoC-in-GitHub
 
diff --git a/2024/CVE-2024-22403.md b/2024/CVE-2024-22403.md
@@ -0,0 +1,17 @@
+### [CVE-2024-22403](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-22403)
+![](https://img.shields.io/static/v1?label=Product&message=security-advisories&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3D%20%3C%2028.0.0%20&color=brighgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-613%3A%20Insufficient%20Session%20Expiration&color=brighgreen)
+
+### Description
+
+Nextcloud server is a self hosted personal cloud system. In affected versions OAuth codes did not expire. When an attacker would get access to an authorization code they could authenticate at any time using the code. As of version 28.0.0 OAuth codes are invalidated after 10 minutes and will no longer be authenticated. To exploit this vulnerability an attacker would need to intercept an OAuth code from a user session. It is recommended that the Nextcloud Server is upgraded to 28.0.0. There are no known workarounds for this vulnerability.
+
+### POC
+
+#### Reference
+No PoCs from references.
+
+#### Github
+- https://github.com/fkie-cad/nvd-json-data-feeds
+
diff --git a/2024/CVE-2024-26218.md b/2024/CVE-2024-26218.md
@@ -30,7 +30,10 @@ Windows Kernel Elevation of Privilege Vulnerability
 No PoCs from references.
 
 #### Github
+- https://github.com/aneasystone/github-trending
 - https://github.com/exploits-forsale/CVE-2024-26218
+- https://github.com/fireinrain/github-trending
+- https://github.com/jafshare/GithubTrending
 - https://github.com/johe123qwe/github-trending
 - https://github.com/nomi-sec/PoC-in-GitHub
 - https://github.com/tanjiti/sec_profile

diff --git a/2024/CVE-2024-27956.md b/2024/CVE-2024-27956.md
@@ -15,5 +15,7 @@ No PoCs from references.
 #### Github
 - https://github.com/NaInSec/CVE-LIST
 - https://github.com/nomi-sec/PoC-in-GitHub
+- https://github.com/tanjiti/sec_profile
 - https://github.com/truonghuuphuc/CVE-2024-27956
+- https://github.com/wy876/POC
 
diff --git a/2024/CVE-2024-28978.md b/2024/CVE-2024-28978.md
@@ -0,0 +1,17 @@
+### [CVE-2024-28978](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-28978)
+![](https://img.shields.io/static/v1?label=Product&message=Dell%20OpenManage%20Enterprise&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3D%203.10%20&color=brighgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-284%3A%20Improper%20Access%20Control&color=brighgreen)
+
+### Description
+
+Dell OpenManage Enterprise, versions 3.10 and 4.0, contains an Improper Access Control vulnerability. A high privileged remote attacker could potentially exploit this vulnerability, leading to unauthorized access to resources.
+
+### POC
+
+#### Reference
+No PoCs from references.
+
+#### Github
+- https://github.com/fkie-cad/nvd-json-data-feeds
+
diff --git a/2024/CVE-2024-28979.md b/2024/CVE-2024-28979.md
@@ -0,0 +1,17 @@
+### [CVE-2024-28979](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-28979)
+![](https://img.shields.io/static/v1?label=Product&message=Dell%20OpenManage%20Enterprise&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=N%2FA%3C%204.1.0%20&color=brighgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-20%3A%20Improper%20Input%20Validation&color=brighgreen)
+
+### Description
+
+Dell OpenManage Enterprise, versions prior to 4.1.0, contains an XSS injection vulnerability in UI. A high privileged local attacker could potentially exploit this vulnerability, leading to JavaScript injection.
+
+### POC
+
+#### Reference
+No PoCs from references.
+
+#### Github
+- https://github.com/fkie-cad/nvd-json-data-feeds
+
diff --git a/2024/CVE-2024-32766.md b/2024/CVE-2024-32766.md
@@ -20,4 +20,5 @@ No PoCs from references.
 #### Github
 - https://github.com/fkie-cad/nvd-json-data-feeds
 - https://github.com/nomi-sec/PoC-in-GitHub
+- https://github.com/p3c34r7/CVE-2024-32766-POC
 
diff --git a/2024/CVE-2024-33566.md b/2024/CVE-2024-33566.md
@@ -0,0 +1,17 @@
+### [CVE-2024-33566](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-33566)
+![](https://img.shields.io/static/v1?label=Product&message=OrderConvo&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-862%20Missing%20Authorization&color=brighgreen)
+
+### Description
+
+Missing Authorization vulnerability in N-Media OrderConvo allows OS Command Injection.This issue affects OrderConvo: from n/a through 12.4.
+
+### POC
+
+#### Reference
+No PoCs from references.
+
+#### Github
+- https://github.com/absholi7ly/absholi7ly
+
diff --git a/2024/CVE-2024-33763.md b/2024/CVE-2024-33763.md
@@ -0,0 +1,17 @@
+### [CVE-2024-33763](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-33763)
+![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brighgreen)
+
+### Description
+
+lunasvg v2.3.9 was discovered to contain a stack-buffer-underflow at lunasvg/source/layoutcontext.cpp.
+
+### POC
+
+#### Reference
+No PoCs from references.
+
+#### Github
+- https://github.com/fkie-cad/nvd-json-data-feeds
+
diff --git a/2024/CVE-2024-33764.md b/2024/CVE-2024-33764.md
@@ -0,0 +1,17 @@
+### [CVE-2024-33764](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-33764)
+![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brighgreen)
+
+### Description
+
+lunasvg v2.3.9 was discovered to contain a stack-overflow at lunasvg/source/element.h.
+
+### POC
+
+#### Reference
+No PoCs from references.
+
+#### Github
+- https://github.com/fkie-cad/nvd-json-data-feeds
+
diff --git a/2024/CVE-2024-33766.md b/2024/CVE-2024-33766.md
@@ -0,0 +1,17 @@
+### [CVE-2024-33766](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-33766)
+![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brighgreen)
+
+### Description
+
+lunasvg v2.3.9 was discovered to contain an FPE (Floating Point Exception) at blend_transformed_tiled_argb.isra.0.
+
+### POC
+
+#### Reference
+No PoCs from references.
+
+#### Github
+- https://github.com/fkie-cad/nvd-json-data-feeds
+
diff --git a/2024/CVE-2024-33767.md b/2024/CVE-2024-33767.md
@@ -0,0 +1,17 @@
+### [CVE-2024-33767](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-33767)
+![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brighgreen)
+
+### Description
+
+lunasvg v2.3.9 was discovered to contain a segmentation violation via the component composition_solid_source.
+
+### POC
+
+#### Reference
+No PoCs from references.
+
+#### Github
+- https://github.com/fkie-cad/nvd-json-data-feeds
+
diff --git a/2024/CVE-2024-33768.md b/2024/CVE-2024-33768.md
@@ -0,0 +1,17 @@
+### [CVE-2024-33768](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-33768)
+![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brighgreen)
+
+### Description
+
+lunasvg v2.3.9 was discovered to contain a segmentation violation via the component composition_solid_source_over.
+
+### POC
+
+#### Reference
+No PoCs from references.
+
+#### Github
+- https://github.com/fkie-cad/nvd-json-data-feeds
+
diff --git a/2024/CVE-2024-4040.md b/2024/CVE-2024-4040.md
@@ -18,6 +18,7 @@ A server side template injection vulnerability in CrushFTP in all versions befor
 - https://github.com/Praison001/CVE-2024-4040-CrushFTP-server
 - https://github.com/Stuub/CVE-2024-4040-SSTI-LFI
 - https://github.com/Stuub/CVE-2024-4040-SSTI-LFI-PoC
+- https://github.com/absholi7ly/absholi7ly
 - https://github.com/airbus-cert/CVE-2024-4040
 - https://github.com/fkie-cad/nvd-json-data-feeds
 - https://github.com/getdrive/PoC