diff --git a/2014/CVE-2014-4210.json b/2014/CVE-2014-4210.json index 6ac4b0c969..817680694d 100644 --- a/2014/CVE-2014-4210.json +++ b/2014/CVE-2014-4210.json @@ -42,10 +42,10 @@ "description": "weblogic 漏洞扫描工具。目前包含对以下漏洞的检测能力:CVE-2014-4210、CVE-2016-0638、CVE-2016-3510、CVE-2017-3248、CVE-2017-3506、CVE-2017-10271、CVE-2018-2628、CVE-2018-2893、CVE-2018-2894、CVE-2018-3191、CVE-2018-3245、CVE-2018-3252、CVE-2019-2618、CVE-2019-2725、CVE-2019-2729、CVE-2019-2890、CVE-2020-2551、CVE-2020-14750、CVE-2020-14882、CVE-2020-14883", "fork": false, "created_at": "2020-01-15T04:26:29Z", - "updated_at": "2022-12-30T07:10:52Z", + "updated_at": "2022-12-30T13:32:00Z", "pushed_at": "2022-07-17T12:41:46Z", - "stargazers_count": 1565, - "watchers_count": 1565, + "stargazers_count": 1567, + "watchers_count": 1567, "has_discussions": false, "forks_count": 315, "allow_forking": true, @@ -75,7 +75,7 @@ ], "visibility": "public", "forks": 315, - "watchers": 1565, + "watchers": 1567, "score": 0 }, { diff --git a/2016/CVE-2016-0638.json b/2016/CVE-2016-0638.json index a309d50320..d58f05f8fc 100644 --- a/2016/CVE-2016-0638.json +++ b/2016/CVE-2016-0638.json @@ -13,10 +13,10 @@ "description": "weblogic 漏洞扫描工具。目前包含对以下漏洞的检测能力:CVE-2014-4210、CVE-2016-0638、CVE-2016-3510、CVE-2017-3248、CVE-2017-3506、CVE-2017-10271、CVE-2018-2628、CVE-2018-2893、CVE-2018-2894、CVE-2018-3191、CVE-2018-3245、CVE-2018-3252、CVE-2019-2618、CVE-2019-2725、CVE-2019-2729、CVE-2019-2890、CVE-2020-2551、CVE-2020-14750、CVE-2020-14882、CVE-2020-14883", "fork": false, "created_at": "2020-01-15T04:26:29Z", - "updated_at": "2022-12-30T07:10:52Z", + "updated_at": "2022-12-30T13:32:00Z", "pushed_at": "2022-07-17T12:41:46Z", - "stargazers_count": 1565, - "watchers_count": 1565, + "stargazers_count": 1567, + "watchers_count": 1567, "has_discussions": false, "forks_count": 315, "allow_forking": true, @@ -46,7 +46,7 @@ ], "visibility": "public", "forks": 315, - "watchers": 1565, + "watchers": 1567, "score": 0 }, { diff --git a/2017/CVE-2017-0143.json b/2017/CVE-2017-0143.json index 885347c092..48de2cadb5 100644 --- a/2017/CVE-2017-0143.json +++ b/2017/CVE-2017-0143.json @@ -71,19 +71,19 @@ "description": null, "fork": false, "created_at": "2021-07-08T17:35:50Z", - "updated_at": "2022-12-25T12:03:16Z", + "updated_at": "2022-12-30T13:51:18Z", "pushed_at": "2022-11-02T15:35:18Z", - "stargazers_count": 22, - "watchers_count": 22, + "stargazers_count": 24, + "watchers_count": 24, "has_discussions": false, - "forks_count": 3, + "forks_count": 4, "allow_forking": true, "is_template": false, "web_commit_signoff_required": false, "topics": [], "visibility": "public", - "forks": 3, - "watchers": 22, + "forks": 4, + "watchers": 24, "score": 0 }, { diff --git a/2017/CVE-2017-0199.json b/2017/CVE-2017-0199.json index bd83523b7a..4d0cb8ba54 100644 --- a/2017/CVE-2017-0199.json +++ b/2017/CVE-2017-0199.json @@ -71,10 +71,10 @@ "description": "Exploit toolkit CVE-2017-0199 - v4.0 is a handy python script which provides pentesters and security researchers a quick and effective way to test Microsoft Office RCE. It could generate a malicious RTF\/PPSX file and deliver metasploit \/ meterpreter \/ other payload to victim without any complex configuration.", "fork": false, "created_at": "2017-04-17T08:10:07Z", - "updated_at": "2022-12-22T18:26:14Z", + "updated_at": "2022-12-30T16:01:42Z", "pushed_at": "2017-11-19T11:01:16Z", - "stargazers_count": 696, - "watchers_count": 696, + "stargazers_count": 697, + "watchers_count": 697, "has_discussions": false, "forks_count": 287, "allow_forking": true, @@ -83,7 +83,7 @@ "topics": [], "visibility": "public", "forks": 287, - "watchers": 696, + "watchers": 697, "score": 0 }, { diff --git a/2017/CVE-2017-0781.json b/2017/CVE-2017-0781.json index 2a5363a8ec..3db9f03cb1 100644 --- a/2017/CVE-2017-0781.json +++ b/2017/CVE-2017-0781.json @@ -13,10 +13,10 @@ "description": "Blueborne CVE-2017-0781 Android heap overflow vulnerability", "fork": false, "created_at": "2017-10-09T15:13:25Z", - "updated_at": "2022-12-23T14:09:22Z", + "updated_at": "2022-12-30T13:56:41Z", "pushed_at": "2021-07-29T12:00:48Z", - "stargazers_count": 94, - "watchers_count": 94, + "stargazers_count": 95, + "watchers_count": 95, "has_discussions": false, "forks_count": 50, "allow_forking": true, @@ -31,7 +31,7 @@ ], "visibility": "public", "forks": 50, - "watchers": 94, + "watchers": 95, "score": 0 }, { diff --git a/2017/CVE-2017-3248.json b/2017/CVE-2017-3248.json index ecaaca4920..ae978fe53b 100644 --- a/2017/CVE-2017-3248.json +++ b/2017/CVE-2017-3248.json @@ -42,10 +42,10 @@ "description": "weblogic 漏洞扫描工具。目前包含对以下漏洞的检测能力:CVE-2014-4210、CVE-2016-0638、CVE-2016-3510、CVE-2017-3248、CVE-2017-3506、CVE-2017-10271、CVE-2018-2628、CVE-2018-2893、CVE-2018-2894、CVE-2018-3191、CVE-2018-3245、CVE-2018-3252、CVE-2019-2618、CVE-2019-2725、CVE-2019-2729、CVE-2019-2890、CVE-2020-2551、CVE-2020-14750、CVE-2020-14882、CVE-2020-14883", "fork": false, "created_at": "2020-01-15T04:26:29Z", - "updated_at": "2022-12-30T07:10:52Z", + "updated_at": "2022-12-30T13:32:00Z", "pushed_at": "2022-07-17T12:41:46Z", - "stargazers_count": 1565, - "watchers_count": 1565, + "stargazers_count": 1567, + "watchers_count": 1567, "has_discussions": false, "forks_count": 315, "allow_forking": true, @@ -75,7 +75,7 @@ ], "visibility": "public", "forks": 315, - "watchers": 1565, + "watchers": 1567, "score": 0 }, { diff --git a/2018/CVE-2018-17463.json b/2018/CVE-2018-17463.json index ff976722a3..7d6cb004b2 100644 --- a/2018/CVE-2018-17463.json +++ b/2018/CVE-2018-17463.json @@ -42,10 +42,10 @@ "description": "Working Proof of Concept Exploit for CVE-2018-17463", "fork": false, "created_at": "2022-12-28T02:42:59Z", - "updated_at": "2022-12-30T02:08:52Z", + "updated_at": "2022-12-30T15:24:01Z", "pushed_at": "2022-12-28T02:45:52Z", - "stargazers_count": 1, - "watchers_count": 1, + "stargazers_count": 2, + "watchers_count": 2, "has_discussions": false, "forks_count": 1, "allow_forking": true, @@ -54,7 +54,7 @@ "topics": [], "visibility": "public", "forks": 1, - "watchers": 1, + "watchers": 2, "score": 0 } ] \ No newline at end of file diff --git a/2018/CVE-2018-2628.json b/2018/CVE-2018-2628.json index ba1dacd490..3167434e95 100644 --- a/2018/CVE-2018-2628.json +++ b/2018/CVE-2018-2628.json @@ -568,10 +568,10 @@ "description": "weblogic 漏洞扫描工具。目前包含对以下漏洞的检测能力:CVE-2014-4210、CVE-2016-0638、CVE-2016-3510、CVE-2017-3248、CVE-2017-3506、CVE-2017-10271、CVE-2018-2628、CVE-2018-2893、CVE-2018-2894、CVE-2018-3191、CVE-2018-3245、CVE-2018-3252、CVE-2019-2618、CVE-2019-2725、CVE-2019-2729、CVE-2019-2890、CVE-2020-2551、CVE-2020-14750、CVE-2020-14882、CVE-2020-14883", "fork": false, "created_at": "2020-01-15T04:26:29Z", - "updated_at": "2022-12-30T07:10:52Z", + "updated_at": "2022-12-30T13:32:00Z", "pushed_at": "2022-07-17T12:41:46Z", - "stargazers_count": 1565, - "watchers_count": 1565, + "stargazers_count": 1567, + "watchers_count": 1567, "has_discussions": false, "forks_count": 315, "allow_forking": true, @@ -601,7 +601,7 @@ ], "visibility": "public", "forks": 315, - "watchers": 1565, + "watchers": 1567, "score": 0 }, { diff --git a/2018/CVE-2018-7600.json b/2018/CVE-2018-7600.json index 96c4010ee5..e03550f280 100644 --- a/2018/CVE-2018-7600.json +++ b/2018/CVE-2018-7600.json @@ -47,7 +47,7 @@ "stargazers_count": 342, "watchers_count": 342, "has_discussions": false, - "forks_count": 117, + "forks_count": 116, "allow_forking": true, "is_template": false, "web_commit_signoff_required": false, @@ -60,7 +60,7 @@ "sa-core-2018-002" ], "visibility": "public", - "forks": 117, + "forks": 116, "watchers": 342, "score": 0 }, diff --git a/2019/CVE-2019-2618.json b/2019/CVE-2019-2618.json index c664681e96..956fb2b180 100644 --- a/2019/CVE-2019-2618.json +++ b/2019/CVE-2019-2618.json @@ -129,10 +129,10 @@ "description": "weblogic 漏洞扫描工具。目前包含对以下漏洞的检测能力:CVE-2014-4210、CVE-2016-0638、CVE-2016-3510、CVE-2017-3248、CVE-2017-3506、CVE-2017-10271、CVE-2018-2628、CVE-2018-2893、CVE-2018-2894、CVE-2018-3191、CVE-2018-3245、CVE-2018-3252、CVE-2019-2618、CVE-2019-2725、CVE-2019-2729、CVE-2019-2890、CVE-2020-2551、CVE-2020-14750、CVE-2020-14882、CVE-2020-14883", "fork": false, "created_at": "2020-01-15T04:26:29Z", - "updated_at": "2022-12-30T07:10:52Z", + "updated_at": "2022-12-30T13:32:00Z", "pushed_at": "2022-07-17T12:41:46Z", - "stargazers_count": 1565, - "watchers_count": 1565, + "stargazers_count": 1567, + "watchers_count": 1567, "has_discussions": false, "forks_count": 315, "allow_forking": true, @@ -162,7 +162,7 @@ ], "visibility": "public", "forks": 315, - "watchers": 1565, + "watchers": 1567, "score": 0 } ] \ No newline at end of file diff --git a/2020/CVE-2020-0796.json b/2020/CVE-2020-0796.json index bea01f42cf..4094d769e5 100644 --- a/2020/CVE-2020-0796.json +++ b/2020/CVE-2020-0796.json @@ -1130,10 +1130,10 @@ "description": "SMBGHOST local privilege escalation", "fork": false, "created_at": "2020-03-31T05:41:30Z", - "updated_at": "2020-03-31T05:47:04Z", + "updated_at": "2022-12-30T14:04:11Z", "pushed_at": "2020-03-31T05:45:23Z", - "stargazers_count": 0, - "watchers_count": 0, + "stargazers_count": 1, + "watchers_count": 1, "has_discussions": false, "forks_count": 1, "allow_forking": true, @@ -1149,7 +1149,7 @@ ], "visibility": "public", "forks": 1, - "watchers": 0, + "watchers": 1, "score": 0 }, { diff --git a/2020/CVE-2020-2551.json b/2020/CVE-2020-2551.json index 34f3edcac7..d854500aac 100644 --- a/2020/CVE-2020-2551.json +++ b/2020/CVE-2020-2551.json @@ -13,10 +13,10 @@ "description": "weblogic 漏洞扫描工具。目前包含对以下漏洞的检测能力:CVE-2014-4210、CVE-2016-0638、CVE-2016-3510、CVE-2017-3248、CVE-2017-3506、CVE-2017-10271、CVE-2018-2628、CVE-2018-2893、CVE-2018-2894、CVE-2018-3191、CVE-2018-3245、CVE-2018-3252、CVE-2019-2618、CVE-2019-2725、CVE-2019-2729、CVE-2019-2890、CVE-2020-2551、CVE-2020-14750、CVE-2020-14882、CVE-2020-14883", "fork": false, "created_at": "2020-01-15T04:26:29Z", - "updated_at": "2022-12-30T07:10:52Z", + "updated_at": "2022-12-30T13:32:00Z", "pushed_at": "2022-07-17T12:41:46Z", - "stargazers_count": 1565, - "watchers_count": 1565, + "stargazers_count": 1567, + "watchers_count": 1567, "has_discussions": false, "forks_count": 315, "allow_forking": true, @@ -46,7 +46,7 @@ ], "visibility": "public", "forks": 315, - "watchers": 1565, + "watchers": 1567, "score": 0 }, { diff --git a/2021/CVE-2021-32779.json b/2021/CVE-2021-32779.json deleted file mode 100644 index 69281c2071..0000000000 --- a/2021/CVE-2021-32779.json +++ /dev/null @@ -1,31 +0,0 @@ -[ - { - "id": 583145080, - "name": "CVE-2021-32779", - "full_name": "Live-Hack-CVE\/CVE-2021-32779", - "owner": { - "login": "Live-Hack-CVE", - "id": 121191732, - "avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/121191732?v=4", - "html_url": "https:\/\/github.com\/Live-Hack-CVE" - }, - "html_url": "https:\/\/github.com\/Live-Hack-CVE\/CVE-2021-32779", - "description": "Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions envoy incorrectly handled a URI '#fragment' element as part of the path element. Envoy is configured with an RBAC filter for authorization or similar mechanism with an explicit case of a CVE project by @Sn0wAlice", - "fork": false, - "created_at": "2022-12-28T22:44:41Z", - "updated_at": "2022-12-28T22:44:41Z", - "pushed_at": "2022-12-28T22:44:43Z", - "stargazers_count": 0, - "watchers_count": 0, - "has_discussions": false, - "forks_count": 0, - "allow_forking": true, - "is_template": false, - "web_commit_signoff_required": false, - "topics": [], - "visibility": "public", - "forks": 0, - "watchers": 0, - "score": 0 - } -] \ No newline at end of file diff --git a/2021/CVE-2021-44228.json b/2021/CVE-2021-44228.json index 3a4c579429..baff84dc3a 100644 --- a/2021/CVE-2021-44228.json +++ b/2021/CVE-2021-44228.json @@ -1,4 +1,33 @@ [ + { + "id": 440216413, + "name": "Log4j-Scanner-Exploit", + "full_name": "julian911015\/Log4j-Scanner-Exploit", + "owner": { + "login": "julian911015", + "id": 26369589, + "avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/26369589?v=4", + "html_url": "https:\/\/github.com\/julian911015" + }, + "html_url": "https:\/\/github.com\/julian911015\/Log4j-Scanner-Exploit", + "description": "Script en bash que permite identificar la vulnerabilidad Log4j CVE-2021-44228 de forma remota.", + "fork": false, + "created_at": "2021-12-20T15:22:50Z", + "updated_at": "2022-12-30T12:28:39Z", + "pushed_at": "2022-12-30T12:32:05Z", + "stargazers_count": 10, + "watchers_count": 10, + "has_discussions": false, + "forks_count": 3, + "allow_forking": true, + "is_template": false, + "web_commit_signoff_required": false, + "topics": [], + "visibility": "public", + "forks": 3, + "watchers": 10, + "score": 0 + }, { "id": 583519721, "name": "log4j2_CVE-2021-44228", diff --git a/2022/CVE-2022-0847.json b/2022/CVE-2022-0847.json index fec44d601a..4c2f1c430b 100644 --- a/2022/CVE-2022-0847.json +++ b/2022/CVE-2022-0847.json @@ -129,10 +129,10 @@ "description": "A root exploit for CVE-2022-0847 (Dirty Pipe)", "fork": false, "created_at": "2022-03-07T18:55:20Z", - "updated_at": "2022-12-30T06:57:00Z", + "updated_at": "2022-12-30T15:18:15Z", "pushed_at": "2022-03-08T06:20:05Z", - "stargazers_count": 1002, - "watchers_count": 1002, + "stargazers_count": 1003, + "watchers_count": 1003, "has_discussions": false, "forks_count": 216, "allow_forking": true, @@ -141,7 +141,7 @@ "topics": [], "visibility": "public", "forks": 216, - "watchers": 1002, + "watchers": 1003, "score": 0 }, { @@ -1898,5 +1898,34 @@ "forks": 2, "watchers": 4, "score": 0 + }, + { + "id": 583717581, + "name": "-Dirty-Pipe-CVE-2022-0847", + "full_name": "pmihsan\/-Dirty-Pipe-CVE-2022-0847", + "owner": { + "login": "pmihsan", + "id": 89512452, + "avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/89512452?v=4", + "html_url": "https:\/\/github.com\/pmihsan" + }, + "html_url": "https:\/\/github.com\/pmihsan\/-Dirty-Pipe-CVE-2022-0847", + "description": null, + "fork": false, + "created_at": "2022-12-30T17:17:44Z", + "updated_at": "2022-12-30T17:33:09Z", + "pushed_at": "2022-12-30T17:33:04Z", + "stargazers_count": 0, + "watchers_count": 0, + "has_discussions": false, + "forks_count": 0, + "allow_forking": true, + "is_template": false, + "web_commit_signoff_required": false, + "topics": [], + "visibility": "public", + "forks": 0, + "watchers": 0, + "score": 0 } ] \ No newline at end of file diff --git a/2022/CVE-2022-21999.json b/2022/CVE-2022-21999.json index b4f8e95618..73fbf77352 100644 --- a/2022/CVE-2022-21999.json +++ b/2022/CVE-2022-21999.json @@ -13,10 +13,10 @@ "description": "Exploit for CVE-2022-21999 - Windows Print Spooler Elevation of Privilege Vulnerability (LPE)", "fork": false, "created_at": "2022-02-08T17:25:44Z", - "updated_at": "2022-12-29T06:31:24Z", + "updated_at": "2022-12-30T12:31:51Z", "pushed_at": "2022-02-09T16:54:09Z", - "stargazers_count": 674, - "watchers_count": 674, + "stargazers_count": 675, + "watchers_count": 675, "has_discussions": false, "forks_count": 143, "allow_forking": true, @@ -28,7 +28,7 @@ ], "visibility": "public", "forks": 143, - "watchers": 674, + "watchers": 675, "score": 0 } ] \ No newline at end of file diff --git a/2022/CVE-2022-36619.json b/2022/CVE-2022-36619.json deleted file mode 100644 index 836b0fec9a..0000000000 --- a/2022/CVE-2022-36619.json +++ /dev/null @@ -1,31 +0,0 @@ -[ - { - "id": 583483018, - "name": "CVE-2022-36619", - "full_name": "Live-Hack-CVE\/CVE-2022-36619", - "owner": { - "login": "Live-Hack-CVE", - "id": 121191732, - "avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/121191732?v=4", - "html_url": "https:\/\/github.com\/Live-Hack-CVE" - }, - "html_url": "https:\/\/github.com\/Live-Hack-CVE\/CVE-2022-36619", - "description": "In D-link DIR-816 A2_v1.10CNB04.img,the network can be reset without authentication via \/goform\/setMAC. CVE project by @Sn0wAlice", - "fork": false, - "created_at": "2022-12-29T23:07:18Z", - "updated_at": "2022-12-29T23:07:18Z", - "pushed_at": "2022-12-29T23:07:20Z", - "stargazers_count": 0, - "watchers_count": 0, - "has_discussions": false, - "forks_count": 0, - "allow_forking": true, - "is_template": false, - "web_commit_signoff_required": false, - "topics": [], - "visibility": "public", - "forks": 0, - "watchers": 0, - "score": 0 - } -] \ No newline at end of file diff --git a/2022/CVE-2022-46689.json b/2022/CVE-2022-46689.json index cb9f137c7a..2364dfff45 100644 --- a/2022/CVE-2022-46689.json +++ b/2022/CVE-2022-46689.json @@ -13,10 +13,10 @@ "description": "Proof-of-concept app to overwrite fonts on iOS using CVE-2022-46689.", "fork": false, "created_at": "2022-12-26T06:56:35Z", - "updated_at": "2022-12-30T12:23:43Z", + "updated_at": "2022-12-30T18:18:52Z", "pushed_at": "2022-12-30T02:59:38Z", - "stargazers_count": 385, - "watchers_count": 385, + "stargazers_count": 396, + "watchers_count": 396, "has_discussions": false, "forks_count": 25, "allow_forking": true, @@ -25,7 +25,7 @@ "topics": [], "visibility": "public", "forks": 25, - "watchers": 385, + "watchers": 396, "score": 0 } ] \ No newline at end of file diff --git a/README.md b/README.md index ee56146807..d0a7d811bf 100644 --- a/README.md +++ b/README.md @@ -386,6 +386,7 @@ A flaw was found in the way the "flags" member of the new pipe buffer - [ih3na/debian11-dirty_pipe-patcher](https://github.com/ih3na/debian11-dirty_pipe-patcher) - [greenhandatsjtu/CVE-2022-0847-Container-Escape](https://github.com/greenhandatsjtu/CVE-2022-0847-Container-Escape) - [flux10n/CVE-2022-0847-DirtyPipe-Exploits](https://github.com/flux10n/CVE-2022-0847-DirtyPipe-Exploits) +- [pmihsan/-Dirty-Pipe-CVE-2022-0847](https://github.com/pmihsan/-Dirty-Pipe-CVE-2022-0847) ### CVE-2022-0848 (2022-03-04) @@ -8958,14 +8959,6 @@ TOTOLINK A810R V4.1.2cu.5182_B20201026 and V5.9c.4050_B20190424 was discovered t - [Live-Hack-CVE/CVE-2022-36616](https://github.com/Live-Hack-CVE/CVE-2022-36616) -### CVE-2022-36619 (2022-08-31) - - -In D-link DIR-816 A2_v1.10CNB04.img,the network can be reset without authentication via /goform/setMAC. - - -- [Live-Hack-CVE/CVE-2022-36619](https://github.com/Live-Hack-CVE/CVE-2022-36619) - ### CVE-2022-36636 (2022-09-02) @@ -17209,14 +17202,6 @@ Gatsby is a framework for building websites. The gatsby-source-wordpress plugin - [Live-Hack-CVE/CVE-2021-32770](https://github.com/Live-Hack-CVE/CVE-2021-32770) -### CVE-2021-32779 (2021-08-24) - - -Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions envoy incorrectly handled a URI '#fragment' element as part of the path element. Envoy is configured with an RBAC filter for authorization or similar mechanism with an explicit case of a final "/admin" path element, or is using a negative assertion with final path element of "/admin". The client sends request to "/app1/admin#foo". In Envoy prior to 1.18.0, or 1.18.0+ configured with path_normalization=false. Envoy treats fragment as a suffix of the query string when present, or as a suffix of the path when query string is absent, so it evaluates the final path element as "/admin#foo" and mismatches with the configured "/admin" path element. In Envoy 1.18.0+ configured with path_normalization=true. Envoy transforms this to /app1/admin%23foo and mismatches with the configured /admin prefix. The resulting URI is sent to the next server-agent with the offending "#foo" fragment which violates RFC3986 or with the nonsensical "%23foo" text appended. A specifically constructed request with URI containing '#fragment' element delivered by an untrusted client in the presence of path based request authorization resulting in escalation of Privileges when path based request authorization extensions. Envoy versions 1.19.1, 1.18.4, 1.17.4, 1.16.5 contain fixes that removes fragment from URI path in incoming requests. - - -- [Live-Hack-CVE/CVE-2021-32779](https://github.com/Live-Hack-CVE/CVE-2021-32779) - ### CVE-2021-32791 (2021-07-26) @@ -20003,6 +19988,7 @@ A improper neutralization of special elements used in an os command ('os command Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. +- [julian911015/Log4j-Scanner-Exploit](https://github.com/julian911015/Log4j-Scanner-Exploit) - [Nexolanta/log4j2_CVE-2021-44228](https://github.com/Nexolanta/log4j2_CVE-2021-44228) ### CVE-2021-44231 (2021-12-14)