From f04d79c63f98b211dbf3fd47a1266964fdddd324 Mon Sep 17 00:00:00 2001 From: trickest-workflows Date: Sun, 8 Jan 2023 13:53:15 +0000 Subject: [PATCH] Update Sun Jan 8 13:53:15 UTC 2023 --- 2005/CVE-2005-3178.md | 1 + 2017/CVE-2017-18813.md | 17 +++++++++++++++++ 2021/CVE-2021-29921.md | 1 + 2022/CVE-2022-34962.md | 2 +- 2022/CVE-2022-37450.md | 17 +++++++++++++++++ references.txt | 5 +++++ 6 files changed, 42 insertions(+), 1 deletion(-) create mode 100644 2017/CVE-2017-18813.md create mode 100644 2022/CVE-2022-37450.md diff --git a/2005/CVE-2005-3178.md b/2005/CVE-2005-3178.md index 7cc91adc56..966a224e64 100644 --- a/2005/CVE-2005-3178.md +++ b/2005/CVE-2005-3178.md @@ -11,6 +11,7 @@ Buffer overflow in xloadimage 4.1 and earlier, and xli, might allow user-assiste #### Reference - http://marc.info/?l=bugtraq&m=112862493918840&w=2 +- http://www.redhat.com/support/errata/RHSA-2005-802.html #### Github No PoCs found on GitHub currently. diff --git a/2017/CVE-2017-18813.md b/2017/CVE-2017-18813.md new file mode 100644 index 0000000000..03b5bc7801 --- /dev/null +++ b/2017/CVE-2017-18813.md @@ -0,0 +1,17 @@ +### [CVE-2017-18813](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18813) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brighgreen) + +### Description + +NETGEAR ReadyNAS OS 6 devices running ReadyNAS OS versions prior to 6.8.0 are affected by stored XSS. + +### POC + +#### Reference +- https://kb.netgear.com/000049052/Security-Advisory-for-Stored-Cross-Site-Scripting-Vulnerability-on-Some-ReadyNAS-Devices-PSV-2017-0296 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2021/CVE-2021-29921.md b/2021/CVE-2021-29921.md index 51a9f9cdbf..cbf265e3b8 100644 --- a/2021/CVE-2021-29921.md +++ b/2021/CVE-2021-29921.md @@ -11,6 +11,7 @@ In Python before 3,9,5, the ipaddress library mishandles leading zero characters #### Reference - https://github.com/python/cpython/pull/12577 +- https://github.com/python/cpython/pull/25099 - https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-014.md - https://sick.codes/sick-2021-014 - https://www.oracle.com/security-alerts/cpuoct2021.html diff --git a/2022/CVE-2022-34962.md b/2022/CVE-2022-34962.md index eb56b25742..6877207cad 100644 --- a/2022/CVE-2022-34962.md +++ b/2022/CVE-2022-34962.md @@ -10,7 +10,7 @@ OpenTeknik LLC OSSN OPEN SOURCE SOCIAL NETWORK v6.3 LTS was discovered to contai ### POC #### Reference -No PoCs from references. +- https://grimthereaperteam.medium.com/cve-2022-34962-ossn-6-3-lts-stored-xss-vulnerability-at-group-timeline-6ebe28dd6034 #### Github - https://github.com/ARPSyndicate/cvemon diff --git a/2022/CVE-2022-37450.md b/2022/CVE-2022-37450.md new file mode 100644 index 0000000000..62caedeca7 --- /dev/null +++ b/2022/CVE-2022-37450.md @@ -0,0 +1,17 @@ +### [CVE-2022-37450](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-37450) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brighgreen) + +### Description + +Go Ethereum (aka geth) through 1.10.21 allows attackers to increase rewards by mining blocks in certain situations, and using a manipulation of time-difference values to achieve replacement of main-chain blocks, aka Riskless Uncle Making (RUM), as exploited in the wild in 2020 through 2022. + +### POC + +#### Reference +- https://medium.com/@aviv.yaish/uncle-maker-time-stamping-out-the-competition-in-ethereum-d27c1cb62fef + +#### Github +No PoCs found on GitHub currently. + diff --git a/references.txt b/references.txt index f5aa772bf1..df663b80d2 100644 --- a/references.txt +++ b/references.txt @@ -1725,6 +1725,7 @@ CVE-2005-3156 - http://marc.info/?l=bugtraq&m=112812059917394&w=2 CVE-2005-3157 - http://marc.info/?l=bugtraq&m=112793982604963&w=2 CVE-2005-3158 - http://marc.info/?l=bugtraq&m=112801702000944&w=2 CVE-2005-3178 - http://marc.info/?l=bugtraq&m=112862493918840&w=2 +CVE-2005-3178 - http://www.redhat.com/support/errata/RHSA-2005-802.html CVE-2005-3180 - http://www.redhat.com/support/errata/RHSA-2005-808.html CVE-2005-3180 - http://www.securityfocus.com/archive/1/428028/100/0/threaded CVE-2005-3181 - http://www.redhat.com/support/errata/RHSA-2005-808.html @@ -35784,6 +35785,7 @@ CVE-2017-18800 - https://kb.netgear.com/000049356/Security-Advisory-for-Reflecte CVE-2017-18807 - https://kb.netgear.com/000049058/Security-Advisory-for-Stored-Cross-Site-Scripting-Vulnerability-on-Some-ReadyNAS-Devices-PSV-2017-2001 CVE-2017-18810 - https://kb.netgear.com/000049055/Security-Advisory-for-Stored-Cross-Site-Scripting-Vulnerability-on-Some-ReadyNAS-Devices-PSV-2017-0300 CVE-2017-18812 - https://kb.netgear.com/000049053/Security-Advisory-for-Stored-Cross-Site-Scripting-Vulnerability-on-Some-ReadyNAS-Devices-PSV-2017-0298 +CVE-2017-18813 - https://kb.netgear.com/000049052/Security-Advisory-for-Stored-Cross-Site-Scripting-Vulnerability-on-Some-ReadyNAS-Devices-PSV-2017-0296 CVE-2017-18833 - https://kb.netgear.com/000049029/Security-Advisory-for-Reflected-Cross-Site-Scripting-on-Some-Fully-Managed-Switches-PSV-2017-1955 CVE-2017-18835 - https://kb.netgear.com/000049027/Security-Advisory-for-Reflected-Cross-Site-Scripting-on-Some-Fully-Managed-Switches-PSV-2017-1957 CVE-2017-18836 - https://kb.netgear.com/000049026/Security-Advisory-for-Denial-of-Service-on-Some-Fully-Managed-Switches-PSV-2017-1959 @@ -60064,6 +60066,7 @@ CVE-2021-29662 - https://github.com/sickcodes/security/blob/master/advisories/SI CVE-2021-29662 - https://sick.codes/sick-2021-018/ CVE-2021-29663 - http://sourceforge.net/projects/coursems CVE-2021-29921 - https://github.com/python/cpython/pull/12577 +CVE-2021-29921 - https://github.com/python/cpython/pull/25099 CVE-2021-29921 - https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-014.md CVE-2021-29921 - https://sick.codes/sick-2021-014 CVE-2021-29921 - https://www.oracle.com/security-alerts/cpuoct2021.html @@ -66727,6 +66730,7 @@ CVE-2022-3495 - https://github.com/Hakcoder/Simple-Online-Public-Access-Catalog- CVE-2022-34955 - https://github.com/Kliqqi-CMS/Kliqqi-CMS/issues/261 CVE-2022-34956 - https://github.com/Kliqqi-CMS/Kliqqi-CMS/issues/261 CVE-2022-34961 - https://grimthereaperteam.medium.com/cve-2022-34961-ossn-6-3-lts-stored-xss-vulnerability-at-users-timeline-819a9d4e5e6c +CVE-2022-34962 - https://grimthereaperteam.medium.com/cve-2022-34962-ossn-6-3-lts-stored-xss-vulnerability-at-group-timeline-6ebe28dd6034 CVE-2022-34963 - https://grimthereaperteam.medium.com/cve-2022-34963-ossn-6-3-lts-stored-xss-vulnerability-at-news-feed-b8ae8f2fa5f3 CVE-2022-34964 - https://grimthereaperteam.medium.com/ossn-6-3-lts-stored-xss-vulnerability-at-sitepages-ba91bbeccf1c CVE-2022-34966 - https://grimthereaperteam.medium.com/cve-2022-34966-ossn-6-3-lts-html-injection-vulnerability-at-location-parameter-3fe791dd22c6 @@ -67183,6 +67187,7 @@ CVE-2022-37415 - https://gist.github.com/alfarom256/220cb75816ca2b5556e7fc8d8d28 CVE-2022-37416 - https://issuetracker.google.com/issues/231026247 CVE-2022-37434 - http://seclists.org/fulldisclosure/2022/Oct/41 CVE-2022-37434 - https://github.com/ivd38/zlib_overflow +CVE-2022-37450 - https://medium.com/@aviv.yaish/uncle-maker-time-stamping-out-the-competition-in-ethereum-d27c1cb62fef CVE-2022-37454 - https://mouha.be/sha-3-buffer-overflow/ CVE-2022-37461 - https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=30693 CVE-2022-3747 - https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2022-3747.txt