Update Sat Apr 13 10:02:29 UTC 2024

2020/CVE-2020-7981.md

@@ -0,0 +1,17 @@
+### [CVE-2020-7981](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7981)
+![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brighgreen)
+
+### Description
+
+sql.rb in Geocoder before 1.6.1 allows Boolean-based SQL injection when within_bounding_box is used in conjunction with untrusted sw_lat, sw_lng, ne_lat, or ne_lng data.
+
+### POC
+
+#### Reference
+- https://github.com/alexreisner/geocoder/commit/dcdc3d8675411edce3965941a2ca7c441ca48613
+
+#### Github
+No PoCs found on GitHub currently.
+

2021/CVE-2021-38536.md

@@ -0,0 +1,17 @@
+### [CVE-2021-38536](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38536)
+![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brighgreen)
+
+### Description
+
+Certain NETGEAR devices are affected by stored XSS. This affects D6200 before 1.1.00.40, D7000 before 1.0.1.78, R6020 before 1.0.0.48, R6080 before 1.0.0.48, R6120 before 1.0.0.66, R6260 before 1.1.0.78, R6700v2 before 1.2.0.76, R6800 before 1.2.0.76, R6900v2 before 1.2.0.76, R6850 before 1.1.0.78, R7200 before 1.2.0.76, R7350 before 1.2.0.76, R7400 before 1.2.0.76, R7450 before 1.2.0.76, AC2100 before 1.2.0.76, AC2400 before 1.2.0.76, AC2600 before 1.2.0.76, RAX35 before 1.0.3.62, and RAX40 before 1.0.3.62.
+
+### POC
+
+#### Reference
+- https://kb.netgear.com/000063774/Security-Advisory-for-Stored-Cross-Site-Scripting-on-Some-Routers-and-Gateways-PSV-2019-0193
+
+#### Github
+No PoCs found on GitHub currently.
+

2024/CVE-2024-1957.md

@@ -0,0 +1,17 @@
+### [CVE-2024-1957](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-1957)
+![](https://img.shields.io/static/v1?label=Product&message=GiveWP%20%E2%80%93%20Donation%20Plugin%20and%20Fundraising%20Platform&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=*%3C%3D%203.6.1%20&color=brighgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%20Improper%20Neutralization%20of%20Input%20During%20Web%20Page%20Generation%20('Cross-site%20Scripting')&color=brighgreen)
+
+### Description
+
+The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'give_form' shortcode in all versions up to, and including, 3.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
+
+### POC
+
+#### Reference
+No PoCs from references.
+
+#### Github
+- https://github.com/fkie-cad/nvd-json-data-feeds
+

2024/CVE-2024-24576.md

@@ -17,9 +17,11 @@ No PoCs from references.
 - https://github.com/WoodManGitHub/CVE-Research
 - https://github.com/aydinnyunus/CVE-2024-24576-Exploit
 - https://github.com/brains93/CVE-2024-24576-PoC-Python
+- https://github.com/fireinrain/github-trending
 - https://github.com/fkie-cad/nvd-json-data-feeds
 - https://github.com/foxoman/CVE-2024-24576-PoC---Nim
 - https://github.com/frostb1ten/CVE-2024-24576-PoC
+- https://github.com/jafshare/GithubTrending
 - https://github.com/kherrick/lobsters
 - https://github.com/nomi-sec/PoC-in-GitHub
 - https://github.com/securitycipher/daily-bugbounty-writeups

2024/CVE-2024-24680.md

@@ -14,4 +14,5 @@ No PoCs from references.
 
 #### Github
 - https://github.com/ch4n3-yoon/ch4n3-yoon
+- https://github.com/fkie-cad/nvd-json-data-feeds
 

2024/CVE-2024-2583.md

@@ -0,0 +1,17 @@
+### [CVE-2024-2583](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2583)
+![](https://img.shields.io/static/v1?label=Product&message=WP%20Shortcodes%20Plugin%20%E2%80%94%20Shortcodes%20Ultimate&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0%3C%207.0.5%20&color=brighgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%20Cross-Site%20Scripting%20(XSS)&color=brighgreen)
+
+### Description
+
+The WP Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 7.0.5 does not properly escape some of its shortcodes attributes before they are echoed back to users, making it possible for users with the contributor role to conduct Stored XSS attacks.
+
+### POC
+
+#### Reference
+- https://wpscan.com/vulnerability/98d8c713-e8cd-4fad-a8fb-7a40db2742a2/
+
+#### Github
+- https://github.com/fkie-cad/nvd-json-data-feeds
+

2024/CVE-2024-26811.md

@@ -0,0 +1,17 @@
+### [CVE-2024-26811](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26811)
+![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=1da177e4c3f4%3C%2051a6c2af9d20%20&color=brighgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brighgreen)
+
+### Description
+
+In the Linux kernel, the following vulnerability has been resolved:ksmbd: validate payload size in ipc responseIf installing malicious ksmbd-tools, ksmbd.mountd can return invalid ipcresponse to ksmbd kernel server. ksmbd should validate payload size ofipc response from ksmbd.mountd to avoid memory overrun orslab-out-of-bounds. This patch validate 3 ipc response that has payload.
+
+### POC
+
+#### Reference
+No PoCs from references.
+
+#### Github
+- https://github.com/fkie-cad/nvd-json-data-feeds
+

2024/CVE-2024-27351.md

@@ -15,4 +15,5 @@ No PoCs from references.
 #### Github
 - https://github.com/NaInSec/CVE-LIST
 - https://github.com/ch4n3-yoon/ch4n3-yoon
+- https://github.com/fkie-cad/nvd-json-data-feeds
 

2024/CVE-2024-3027.md

@@ -0,0 +1,17 @@
+### [CVE-2024-3027](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-3027)
+![](https://img.shields.io/static/v1?label=Product&message=Smart%20Slider%203&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=*%3C%3D%203.5.1.22%20&color=brighgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-285%20Improper%20Authorization&color=brighgreen)
+
+### Description
+
+The Smart Slider 3 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the upload function in all versions up to, and including, 3.5.1.22. This makes it possible for authenticated attackers, with contributor-level access and above, to upload files, including SVG files, which can be used to conduct stored cross-site scripting attacks.
+
+### POC
+
+#### Reference
+No PoCs from references.
+
+#### Github
+- https://github.com/fkie-cad/nvd-json-data-feeds
+

2024/CVE-2024-3400.md

@@ -15,6 +15,7 @@ A command injection vulnerability in the GlobalProtect feature of Palo Alto Netw
 No PoCs from references.
 
 #### Github
+- https://github.com/DrewskyDev/CVE-2024-3400
 - https://github.com/fkie-cad/nvd-json-data-feeds
 - https://github.com/nomi-sec/PoC-in-GitHub
 

github.txt

@@ -152617,6 +152617,7 @@ CVE-2024-1939 - https://github.com/fkie-cad/nvd-json-data-feeds
 CVE-2024-1941 - https://github.com/fkie-cad/nvd-json-data-feeds
 CVE-2024-1954 - https://github.com/fkie-cad/nvd-json-data-feeds
 CVE-2024-1956 - https://github.com/fkie-cad/nvd-json-data-feeds
+CVE-2024-1957 - https://github.com/fkie-cad/nvd-json-data-feeds
 CVE-2024-1958 - https://github.com/fkie-cad/nvd-json-data-feeds
 CVE-2024-1962 - https://github.com/fkie-cad/nvd-json-data-feeds
 CVE-2024-1965 - https://github.com/fkie-cad/nvd-json-data-feeds
@@ -154448,9 +154449,11 @@ CVE-2024-24575 - https://github.com/fkie-cad/nvd-json-data-feeds
 CVE-2024-24576 - https://github.com/WoodManGitHub/CVE-Research
 CVE-2024-24576 - https://github.com/aydinnyunus/CVE-2024-24576-Exploit
 CVE-2024-24576 - https://github.com/brains93/CVE-2024-24576-PoC-Python
+CVE-2024-24576 - https://github.com/fireinrain/github-trending
 CVE-2024-24576 - https://github.com/fkie-cad/nvd-json-data-feeds
 CVE-2024-24576 - https://github.com/foxoman/CVE-2024-24576-PoC---Nim
 CVE-2024-24576 - https://github.com/frostb1ten/CVE-2024-24576-PoC
+CVE-2024-24576 - https://github.com/jafshare/GithubTrending
 CVE-2024-24576 - https://github.com/kherrick/lobsters
 CVE-2024-24576 - https://github.com/nomi-sec/PoC-in-GitHub
 CVE-2024-24576 - https://github.com/securitycipher/daily-bugbounty-writeups
@@ -154475,6 +154478,7 @@ CVE-2024-2465 - https://github.com/fkie-cad/nvd-json-data-feeds
 CVE-2024-2468 - https://github.com/NaInSec/CVE-LIST
 CVE-2024-2468 - https://github.com/fkie-cad/nvd-json-data-feeds
 CVE-2024-24680 - https://github.com/ch4n3-yoon/ch4n3-yoon
+CVE-2024-24680 - https://github.com/fkie-cad/nvd-json-data-feeds
 CVE-2024-24681 - https://github.com/fkie-cad/nvd-json-data-feeds
 CVE-2024-24683 - https://github.com/NaInSec/CVE-LIST
 CVE-2024-2469 - https://github.com/NaInSec/CVE-LIST
@@ -155047,6 +155051,7 @@ CVE-2024-2581 - https://github.com/fkie-cad/nvd-json-data-feeds
 CVE-2024-25817 - https://github.com/CuB3y0nd/CuB3y0nd
 CVE-2024-25817 - https://github.com/fkie-cad/nvd-json-data-feeds
 CVE-2024-25828 - https://github.com/fkie-cad/nvd-json-data-feeds
+CVE-2024-2583 - https://github.com/fkie-cad/nvd-json-data-feeds
 CVE-2024-25830 - https://github.com/0xNslabs/CVE-2024-25832-PoC
 CVE-2024-25830 - https://github.com/fkie-cad/nvd-json-data-feeds
 CVE-2024-25831 - https://github.com/fkie-cad/nvd-json-data-feeds
@@ -155521,6 +155526,7 @@ CVE-2024-26794 - https://github.com/fkie-cad/nvd-json-data-feeds
 CVE-2024-2680 - https://github.com/NaInSec/CVE-LIST
 CVE-2024-26800 - https://github.com/fkie-cad/nvd-json-data-feeds
 CVE-2024-2681 - https://github.com/NaInSec/CVE-LIST
+CVE-2024-26811 - https://github.com/fkie-cad/nvd-json-data-feeds
 CVE-2024-2682 - https://github.com/NaInSec/CVE-LIST
 CVE-2024-2683 - https://github.com/NaInSec/CVE-LIST
 CVE-2024-2684 - https://github.com/NaInSec/CVE-LIST
@@ -155721,6 +155727,7 @@ CVE-2024-27319 - https://github.com/fkie-cad/nvd-json-data-feeds
 CVE-2024-27350 - https://github.com/fkie-cad/nvd-json-data-feeds
 CVE-2024-27351 - https://github.com/NaInSec/CVE-LIST
 CVE-2024-27351 - https://github.com/ch4n3-yoon/ch4n3-yoon
+CVE-2024-27351 - https://github.com/fkie-cad/nvd-json-data-feeds
 CVE-2024-27356 - https://github.com/aggressor0/GL.iNet-RCE
 CVE-2024-27356 - https://github.com/fkie-cad/nvd-json-data-feeds
 CVE-2024-27357 - https://github.com/p4yl0ad/p4yl0ad
@@ -155739,6 +155746,7 @@ CVE-2024-27447 - https://github.com/fkie-cad/nvd-json-data-feeds
 CVE-2024-27454 - https://github.com/fkie-cad/nvd-json-data-feeds
 CVE-2024-27455 - https://github.com/fkie-cad/nvd-json-data-feeds
 CVE-2024-27456 - https://github.com/fkie-cad/nvd-json-data-feeds
+CVE-2024-27462 - https://github.com/nomi-sec/PoC-in-GitHub
 CVE-2024-27474 - https://github.com/dead1nfluence/Leantime-POC
 CVE-2024-27474 - https://github.com/nomi-sec/PoC-in-GitHub
 CVE-2024-27476 - https://github.com/dead1nfluence/Leantime-POC
@@ -156523,6 +156531,7 @@ CVE-2024-29375 - https://github.com/c0rvane/CVE-2024-29375
 CVE-2024-29375 - https://github.com/ismailcemunver/CVE-2024-29375
 CVE-2024-29375 - https://github.com/nomi-sec/PoC-in-GitHub
 CVE-2024-2938 - https://github.com/fkie-cad/nvd-json-data-feeds
+CVE-2024-29384 - https://github.com/nomi-sec/PoC-in-GitHub
 CVE-2024-29385 - https://github.com/NaInSec/CVE-LIST
 CVE-2024-29385 - https://github.com/yj94/Yj_learning
 CVE-2024-2939 - https://github.com/fkie-cad/nvd-json-data-feeds
@@ -156778,6 +156787,7 @@ CVE-2024-30262 - https://github.com/fkie-cad/nvd-json-data-feeds
 CVE-2024-30263 - https://github.com/fkie-cad/nvd-json-data-feeds
 CVE-2024-30266 - https://github.com/fkie-cad/nvd-json-data-feeds
 CVE-2024-30269 - https://github.com/fkie-cad/nvd-json-data-feeds
+CVE-2024-3027 - https://github.com/fkie-cad/nvd-json-data-feeds
 CVE-2024-3030 - https://github.com/fkie-cad/nvd-json-data-feeds
 CVE-2024-30381 - https://github.com/fkie-cad/nvd-json-data-feeds
 CVE-2024-30382 - https://github.com/fkie-cad/nvd-json-data-feeds
@@ -157255,6 +157265,7 @@ CVE-2024-3385 - https://github.com/fkie-cad/nvd-json-data-feeds
 CVE-2024-3386 - https://github.com/fkie-cad/nvd-json-data-feeds
 CVE-2024-3387 - https://github.com/fkie-cad/nvd-json-data-feeds
 CVE-2024-3388 - https://github.com/fkie-cad/nvd-json-data-feeds
+CVE-2024-3400 - https://github.com/DrewskyDev/CVE-2024-3400
 CVE-2024-3400 - https://github.com/fkie-cad/nvd-json-data-feeds
 CVE-2024-3400 - https://github.com/nomi-sec/PoC-in-GitHub
 CVE-2024-3413 - https://github.com/fkie-cad/nvd-json-data-feeds

references.txt

@@ -68882,6 +68882,7 @@ CVE-2020-7961 - http://packetstormsecurity.com/files/157254/Liferay-Portal-Java-
 CVE-2020-7961 - http://packetstormsecurity.com/files/158392/Liferay-Portal-Remote-Code-Execution.html
 CVE-2020-7980 - http://packetstormsecurity.com/files/156143/Satellian-1.12-Remote-Code-Execution.html
 CVE-2020-7980 - https://github.com/Xh4H/Satellian-CVE-2020-7980
+CVE-2020-7981 - https://github.com/alexreisner/geocoder/commit/dcdc3d8675411edce3965941a2ca7c441ca48613
 CVE-2020-7982 - https://blog.forallsecure.com/uncovering-openwrt-remote-code-execution-cve-2020-7982
 CVE-2020-7982 - https://github.com/openwrt/openwrt/commits/master
 CVE-2020-7984 - https://blog.huntresslabs.com/validating-the-solarwinds-n-central-dumpster-diver-vulnerability-5e3a045982e5
@@ -75397,6 +75398,7 @@ CVE-2021-3853 - https://huntr.dev/bounties/2b6a7647-8f2b-4510-b40f-c52aedc2820d
 CVE-2021-38530 - https://kb.netgear.com/000063770/Security-Advisory-for-Pre-Authentication-Command-Injection-on-Some-WiFi-Systems-PSV-2019-0151
 CVE-2021-38532 - https://kb.netgear.com/000063787/Security-Advisory-for-Security-Misconfiguration-on-WAC104-PSV-2021-0124
 CVE-2021-38535 - https://kb.netgear.com/000063773/Security-Advisory-for-Stored-Cross-Site-Scripting-on-Some-Routers-and-Gateways-PSV-2019-0192
+CVE-2021-38536 - https://kb.netgear.com/000063774/Security-Advisory-for-Stored-Cross-Site-Scripting-on-Some-Routers-and-Gateways-PSV-2019-0193
 CVE-2021-3855 - https://docs.liman.dev/baslangic/guvenlik
 CVE-2021-3857 - https://huntr.dev/bounties/18f7eaee-6309-40cb-aed3-d5ac0af03cf3
 CVE-2021-3858 - https://huntr.dev/bounties/a2fac2eb-100d-45b1-9ac7-71847c2f2b6b
@@ -93464,6 +93466,7 @@ CVE-2024-25811 - https://github.com/Fei123-design/vuln/blob/master/Dreamer%20CMS
 CVE-2024-25817 - https://github.com/advisories/GHSA-3qx3-6hxr-j2ch
 CVE-2024-25817 - https://www.cubeyond.net/blog/my-cves/eza-cve-report
 CVE-2024-25828 - https://github.com/sec-Kode/cve
+CVE-2024-2583 - https://wpscan.com/vulnerability/98d8c713-e8cd-4fad-a8fb-7a40db2742a2/
 CVE-2024-25830 - https://neroteam.com/blog/f-logic-datacube3-vulnerability-report
 CVE-2024-25831 - https://neroteam.com/blog/f-logic-datacube3-vulnerability-report
 CVE-2024-25832 - https://neroteam.com/blog/f-logic-datacube3-vulnerability-report