From 46adff4333e10fc79edae4c899a7b970e906a2a4 Mon Sep 17 00:00:00 2001 From: motikan2010-bot Date: Wed, 20 Apr 2022 21:19:26 +0900 Subject: [PATCH] Auto Update 2022/04/20 12:19:26 --- 1999/CVE-1999-0532.json | 4 +-- 2008/CVE-2008-0166.json | 4 +-- 2014/CVE-2014-4210.json | 8 ++--- 2016/CVE-2016-0638.json | 8 ++--- 2017/CVE-2017-0199.json | 27 +++++++++++++++++ 2017/CVE-2017-3248.json | 8 ++--- 2017/CVE-2017-5645.json | 8 ++--- 2017/CVE-2017-5754.json | 8 ++--- 2017/CVE-2017-8917.json | 2 +- 2017/CVE-2017-9841.json | 27 +++++++++++++++++ 2018/CVE-2018-2628.json | 8 ++--- 2018/CVE-2018-3260.json | 8 ++--- 2018/CVE-2018-8639.json | 4 +-- 2019/CVE-2019-1458.json | 8 ++--- 2019/CVE-2019-17558.json | 12 ++++---- 2019/CVE-2019-17571.json | 8 ++--- 2019/CVE-2019-2618.json | 8 ++--- 2019/CVE-2019-2725.json | 8 ++--- 2019/CVE-2019-5736.json | 8 ++--- 2020/CVE-2020-0022.json | 8 ++--- 2020/CVE-2020-0041.json | 16 +++++----- 2020/CVE-2020-0380.json | 29 ++++++++++++++++++ 2020/CVE-2020-0683.json | 8 ++--- 2020/CVE-2020-0796.json | 8 ++--- 2020/CVE-2020-1054.json | 8 ++--- 2020/CVE-2020-14882.json | 12 ++++---- 2020/CVE-2020-17523.json | 4 +-- 2020/CVE-2020-1938.json | 4 +-- 2020/CVE-2020-2551.json | 8 ++--- 2020/CVE-2020-27301.json | 2 +- 2020/CVE-2020-2883.json | 8 ++--- 2021/CVE-2021-0433.json | 29 ++++++++++++++++++ 2021/CVE-2021-0475.json | 29 ++++++++++++++++++ 2021/CVE-2021-1675.json | 8 ++--- 2021/CVE-2021-21148.json | 8 ++--- 2021/CVE-2021-22053.json | 27 ----------------- 2021/CVE-2021-22214.json | 4 +-- 2021/CVE-2021-3129.json | 12 ++++---- 2021/CVE-2021-31805.json | 8 ++--- 2021/CVE-2021-3449.json | 8 ++--- 2021/CVE-2021-37580.json | 56 ----------------------------------- 2021/CVE-2021-4034.json | 16 +++++----- 2021/CVE-2021-40444.json | 8 ++--- 2021/CVE-2021-4045.json | 8 ++--- 2021/CVE-2021-44228.json | 48 +++++++++++++++--------------- 2021/CVE-2021-44529.json | 12 ++++---- 2022/CVE-2022-0482.json | 2 +- 2022/CVE-2022-0778.json | 8 ++--- 2022/CVE-2022-0847.json | 24 +++++++-------- 2022/CVE-2022-1329.json | 2 +- 2022/CVE-2022-21449.json | 56 +++++++++++++++++++++++++++++++++++ 2022/CVE-2022-21907.json | 4 +-- 2022/CVE-2022-21971.json | 8 ++--- 2022/CVE-2022-21999.json | 8 ++--- 2022/CVE-2022-22536.json | 8 ++--- 2022/CVE-2022-22954.json | 8 ++--- 2022/CVE-2022-22965.json | 4 +-- 2022/CVE-2022-23305.json | 8 ++--- 2022/CVE-2022-25636.json | 2 +- 2022/CVE-2022-26318.json | 12 ++++---- 2022/CVE-2022-26809.json | 64 ++++++++++++++++++++-------------------- 2022/CVE-2022-29072.json | 20 ++++++------- README.md | 52 +++++++++++++++++++++++++------- 63 files changed, 503 insertions(+), 359 deletions(-) create mode 100644 2020/CVE-2020-0380.json create mode 100644 2021/CVE-2021-0433.json create mode 100644 2021/CVE-2021-0475.json delete mode 100644 2021/CVE-2021-37580.json create mode 100644 2022/CVE-2022-21449.json diff --git a/1999/CVE-1999-0532.json b/1999/CVE-1999-0532.json index 1a18dff068..9cfccb1757 100644 --- a/1999/CVE-1999-0532.json +++ b/1999/CVE-1999-0532.json @@ -17,12 +17,12 @@ "pushed_at": "2018-02-10T20:07:14Z", "stargazers_count": 2, "watchers_count": 2, - "forks_count": 0, + "forks_count": 1, "allow_forking": true, "is_template": false, "topics": [], "visibility": "public", - "forks": 0, + "forks": 1, "watchers": 2, "score": 0 } diff --git a/2008/CVE-2008-0166.json b/2008/CVE-2008-0166.json index 7a0452ca84..57352e6b3a 100644 --- a/2008/CVE-2008-0166.json +++ b/2008/CVE-2008-0166.json @@ -17,14 +17,14 @@ "pushed_at": "2017-04-24T14:16:56Z", "stargazers_count": 336, "watchers_count": 336, - "forks_count": 105, + "forks_count": 106, "allow_forking": true, "is_template": false, "topics": [ "cve-2008-0166" ], "visibility": "public", - "forks": 105, + "forks": 106, "watchers": 336, "score": 0 }, diff --git a/2014/CVE-2014-4210.json b/2014/CVE-2014-4210.json index d33c122ca5..d865459aa3 100644 --- a/2014/CVE-2014-4210.json +++ b/2014/CVE-2014-4210.json @@ -40,10 +40,10 @@ "description": "weblogic 漏洞扫描工具。目前包含对以下漏洞的检测能力：CVE-2014-4210、CVE-2016-0638、CVE-2016-3510、CVE-2017-3248、CVE-2017-3506、CVE-2017-10271、CVE-2018-2628、CVE-2018-2893、CVE-2018-2894、CVE-2018-3191、CVE-2018-3245、CVE-2018-3252、CVE-2019-2618、CVE-2019-2725、CVE-2019-2729、CVE-2019-2890、CVE-2020-2551、CVE-2020-14882、CVE-2020-14883", "fork": false, "created_at": "2020-01-15T04:26:29Z", - "updated_at": "2022-04-20T05:31:52Z", + "updated_at": "2022-04-20T07:37:08Z", "pushed_at": "2020-11-27T15:10:58Z", - "stargazers_count": 1328, - "watchers_count": 1328, + "stargazers_count": 1330, + "watchers_count": 1330, "forks_count": 287, "allow_forking": true, "is_template": false, @@ -71,7 +71,7 @@ ], "visibility": "public", "forks": 287, - "watchers": 1328, + "watchers": 1330, "score": 0 }, { diff --git a/2016/CVE-2016-0638.json b/2016/CVE-2016-0638.json index f6c16a7d3b..dd6746f5e9 100644 --- a/2016/CVE-2016-0638.json +++ b/2016/CVE-2016-0638.json @@ -13,10 +13,10 @@ "description": "weblogic 漏洞扫描工具。目前包含对以下漏洞的检测能力：CVE-2014-4210、CVE-2016-0638、CVE-2016-3510、CVE-2017-3248、CVE-2017-3506、CVE-2017-10271、CVE-2018-2628、CVE-2018-2893、CVE-2018-2894、CVE-2018-3191、CVE-2018-3245、CVE-2018-3252、CVE-2019-2618、CVE-2019-2725、CVE-2019-2729、CVE-2019-2890、CVE-2020-2551、CVE-2020-14882、CVE-2020-14883", "fork": false, "created_at": "2020-01-15T04:26:29Z", - "updated_at": "2022-04-20T05:31:52Z", + "updated_at": "2022-04-20T07:37:08Z", "pushed_at": "2020-11-27T15:10:58Z", - "stargazers_count": 1328, - "watchers_count": 1328, + "stargazers_count": 1330, + "watchers_count": 1330, "forks_count": 287, "allow_forking": true, "is_template": false, @@ -44,7 +44,7 @@ ], "visibility": "public", "forks": 287, - "watchers": 1328, + "watchers": 1330, "score": 0 }, { diff --git a/2017/CVE-2017-0199.json b/2017/CVE-2017-0199.json index 52f8af89c1..4c79774fc2 100644 --- a/2017/CVE-2017-0199.json +++ b/2017/CVE-2017-0199.json @@ -492,5 +492,32 @@ "forks": 0, "watchers": 0, "score": 0 + }, + { + "id": 483583125, + "name": "CVE-2017-0199", + "full_name": "Phantomlancer123\/CVE-2017-0199", + "owner": { + "login": "Phantomlancer123", + "id": 102849364, + "avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/102849364?v=4", + "html_url": "https:\/\/github.com\/Phantomlancer123" + }, + "html_url": "https:\/\/github.com\/Phantomlancer123\/CVE-2017-0199", + "description": null, + "fork": false, + "created_at": "2022-04-20T09:07:52Z", + "updated_at": "2022-04-20T10:30:42Z", + "pushed_at": "2022-04-20T09:09:01Z", + "stargazers_count": 1, + "watchers_count": 1, + "forks_count": 0, + "allow_forking": true, + "is_template": false, + "topics": [], + "visibility": "public", + "forks": 0, + "watchers": 1, + "score": 0 } ] \ No newline at end of file diff --git a/2017/CVE-2017-3248.json b/2017/CVE-2017-3248.json index b2562c18ca..bcdd276801 100644 --- a/2017/CVE-2017-3248.json +++ b/2017/CVE-2017-3248.json @@ -40,10 +40,10 @@ "description": "weblogic 漏洞扫描工具。目前包含对以下漏洞的检测能力：CVE-2014-4210、CVE-2016-0638、CVE-2016-3510、CVE-2017-3248、CVE-2017-3506、CVE-2017-10271、CVE-2018-2628、CVE-2018-2893、CVE-2018-2894、CVE-2018-3191、CVE-2018-3245、CVE-2018-3252、CVE-2019-2618、CVE-2019-2725、CVE-2019-2729、CVE-2019-2890、CVE-2020-2551、CVE-2020-14882、CVE-2020-14883", "fork": false, "created_at": "2020-01-15T04:26:29Z", - "updated_at": "2022-04-20T05:31:52Z", + "updated_at": "2022-04-20T07:37:08Z", "pushed_at": "2020-11-27T15:10:58Z", - "stargazers_count": 1328, - "watchers_count": 1328, + "stargazers_count": 1330, + "watchers_count": 1330, "forks_count": 287, "allow_forking": true, "is_template": false, @@ -71,7 +71,7 @@ ], "visibility": "public", "forks": 287, - "watchers": 1328, + "watchers": 1330, "score": 0 }, { diff --git a/2017/CVE-2017-5645.json b/2017/CVE-2017-5645.json index 3e2c6077c4..6048ab30b9 100644 --- a/2017/CVE-2017-5645.json +++ b/2017/CVE-2017-5645.json @@ -40,10 +40,10 @@ "description": "Fastest filesystem scanner for log4shell (CVE-2021-44228, CVE-2021-45046) and other vulnerable (CVE-2017-5645, CVE-2019-17571, CVE-2022-23305, CVE-2022-23307 ... ) instances of log4j library. Excellent performance and low memory footprint.", "fork": false, "created_at": "2021-12-14T22:27:14Z", - "updated_at": "2022-04-04T16:34:45Z", + "updated_at": "2022-04-20T06:20:14Z", "pushed_at": "2022-02-23T00:44:17Z", - "stargazers_count": 22, - "watchers_count": 22, + "stargazers_count": 23, + "watchers_count": 23, "forks_count": 9, "allow_forking": true, "is_template": false, @@ -69,7 +69,7 @@ ], "visibility": "public", "forks": 9, - "watchers": 22, + "watchers": 23, "score": 0 } ] \ No newline at end of file diff --git a/2017/CVE-2017-5754.json b/2017/CVE-2017-5754.json index b6b9bff1b6..4f5fbf8709 100644 --- a/2017/CVE-2017-5754.json +++ b/2017/CVE-2017-5754.json @@ -13,10 +13,10 @@ "description": "SpecuCheck is a Windows utility for checking the state of the software mitigations and hardware against CVE-2017-5754 (Meltdown), CVE-2017-5715 (Spectre v2), CVE-2018-3260 (Foreshadow), and CVE-2018-3639 (Spectre v4)", "fork": false, "created_at": "2018-01-04T04:32:26Z", - "updated_at": "2022-03-16T13:26:43Z", + "updated_at": "2022-04-20T07:36:59Z", "pushed_at": "2019-11-19T03:36:46Z", - "stargazers_count": 548, - "watchers_count": 548, + "stargazers_count": 547, + "watchers_count": 547, "forks_count": 93, "allow_forking": true, "is_template": false, @@ -33,7 +33,7 @@ ], "visibility": "public", "forks": 93, - "watchers": 548, + "watchers": 547, "score": 0 }, { diff --git a/2017/CVE-2017-8917.json b/2017/CVE-2017-8917.json index 6d1cf6eabf..0752d86487 100644 --- a/2017/CVE-2017-8917.json +++ b/2017/CVE-2017-8917.json @@ -121,7 +121,7 @@ "description": null, "fork": false, "created_at": "2022-04-13T19:44:19Z", - "updated_at": "2022-04-18T10:56:11Z", + "updated_at": "2022-04-20T06:32:51Z", "pushed_at": "2022-04-13T19:46:12Z", "stargazers_count": 1, "watchers_count": 1, diff --git a/2017/CVE-2017-9841.json b/2017/CVE-2017-9841.json index c2bfea537a..c18e0d1d27 100644 --- a/2017/CVE-2017-9841.json +++ b/2017/CVE-2017-9841.json @@ -204,5 +204,32 @@ "forks": 0, "watchers": 0, "score": 0 + }, + { + "id": 483543263, + "name": "CVE-2017-9841", + "full_name": "jax7sec\/CVE-2017-9841", + "owner": { + "login": "jax7sec", + "id": 102047728, + "avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/102047728?v=4", + "html_url": "https:\/\/github.com\/jax7sec" + }, + "html_url": "https:\/\/github.com\/jax7sec\/CVE-2017-9841", + "description": "CVE-2017-9841批量扫描及利用脚本。PHPUnit是其中的一个基于PHP的测试框架。 PHPUnit 4.8.28之前的版本和5.6.3之前的5.x版本中的Util\/PHP\/eval-stdin.php文件存在安全漏洞。远程攻击者可通过发送以‘Contents area.", "fork": false, "created_at": "2022-04-15T22:59:03Z", - "updated_at": "2022-04-20T06:08:13Z", + "updated_at": "2022-04-20T12:18:45Z", "pushed_at": "2022-04-19T12:03:49Z", - "stargazers_count": 492, - "watchers_count": 492, - "forks_count": 77, + "stargazers_count": 511, + "watchers_count": 511, + "forks_count": 80, "allow_forking": true, "is_template": false, "topics": [], "visibility": "public", - "forks": 77, - "watchers": 492, + "forks": 80, + "watchers": 511, "score": 0 }, { @@ -40,17 +40,17 @@ "description": "Powershell to mitigate CVE-2022-29072", "fork": false, "created_at": "2022-04-18T17:08:43Z", - "updated_at": "2022-04-19T18:21:22Z", + "updated_at": "2022-04-20T11:54:30Z", "pushed_at": "2022-04-18T22:29:13Z", - "stargazers_count": 7, - "watchers_count": 7, + "stargazers_count": 8, + "watchers_count": 8, "forks_count": 5, "allow_forking": true, "is_template": false, "topics": [], "visibility": "public", "forks": 5, - "watchers": 7, + "watchers": 8, "score": 0 }, { diff --git a/README.md b/README.md index 7da2d3a1ba..8a9f3f1898 100644 --- a/README.md +++ b/README.md @@ -272,6 +272,15 @@ Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware - [Mr-xn/CVE-2022-21371](https://github.com/Mr-xn/CVE-2022-21371) +### CVE-2022-21449 (2022-04-19) + + +Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). + + +- [jfrog/jfrog-CVE-2022-21449](https://github.com/jfrog/jfrog-CVE-2022-21449) +- [jmiettinen/CVE-2022-21449-vuln-test](https://github.com/jmiettinen/CVE-2022-21449-vuln-test) + ### CVE-2022-21658 (2022-01-20) @@ -853,7 +862,12 @@ ZZ Inc. KeyMouse Windows 3.08 and prior is affected by a remote code execution v - [gerr-re/cve-2022-24644](https://github.com/gerr-re/cve-2022-24644) -### CVE-2022-24675 +### CVE-2022-24675 (2022-04-20) + + +encoding/pem in Go before 1.17.9 and 1.8.x before 1.8.1 has a Decode stack overflow via a large amount of PEM data. + + - [jfrog/jfrog-CVE-2022-24675](https://github.com/jfrog/jfrog-CVE-2022-24675) ### CVE-2022-24693 (2022-03-29) @@ -1310,6 +1324,14 @@ In sdp_copy_raw_data of sdp_discovery.cc, there is a possible system compromise - [Satheesh575555/System_bt_AOSP10-r33_CVE-2021-0397](https://github.com/Satheesh575555/System_bt_AOSP10-r33_CVE-2021-0397) +### CVE-2021-0433 (2021-04-13) + + +In onCreate of DeviceChooserActivity.java, there is a possible way to bypass user consent when pairing a Bluetooth device due to a tapjacking/overlay attack. This could lead to local escalation of privilege and pairing malicious devices with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11Android ID: A-171221090 + + +- [Trinadh465/frameworks_base_AOSP10_r33_CVE-2021-0433](https://github.com/Trinadh465/frameworks_base_AOSP10_r33_CVE-2021-0433) + ### CVE-2021-0472 (2021-06-11) @@ -1318,6 +1340,14 @@ In shouldLockKeyguard of LockTaskController.java, there is a possible way to exi - [nanopathi/framework_base_AOSP10_r33_CVE-2021-0472](https://github.com/nanopathi/framework_base_AOSP10_r33_CVE-2021-0472) +### CVE-2021-0475 (2021-06-11) + + +In on_l2cap_data_ind of btif_sock_l2cap.cc, there is possible memory corruption due to a use after free. This could lead to remote code execution over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-10Android ID: A-175686168 + + +- [ShaikUsaf/system_bt_AOSP10_r33_CVE-2021-0475](https://github.com/ShaikUsaf/system_bt_AOSP10_r33_CVE-2021-0475) + ### CVE-2021-0476 (2021-06-11) @@ -2402,7 +2432,6 @@ The vCenter Server contains an arbitrary file upload vulnerability in the Analyt Applications using both `spring-cloud-netflix-hystrix-dashboard` and `spring-boot-starter-thymeleaf` expose a way to execute code submitted within the request URI path during the resolution of view templates. When a request is made at `/hystrix/monitor;[user-provided data]`, the path elements following `hystrix/monitor` are being evaluated as SpringEL expressions, which can lead to code execution. -- [SecCoder-Security-Lab/spring-cloud-netflix-hystrix-dashboard-cve-2021-22053](https://github.com/SecCoder-Security-Lab/spring-cloud-netflix-hystrix-dashboard-cve-2021-22053) - [Vulnmachines/CVE-2021-22053](https://github.com/Vulnmachines/CVE-2021-22053) ### CVE-2021-22192 (2021-03-24) @@ -3783,15 +3812,6 @@ Windows Elevation of Privilege Vulnerability - [HuskyHacks/ShadowSteal](https://github.com/HuskyHacks/ShadowSteal) -### CVE-2021-37580 (2021-11-16) - - -A flaw was found in Apache ShenYu Admin. The incorrect use of JWT in ShenyuAdminBootstrap allows an attacker to bypass authentication. This issue affected Apache ShenYu 2.3.0 and 2.4.0 - - -- [Liang2580/CVE-2021-37580](https://github.com/Liang2580/CVE-2021-37580) -- [Wing-song/CVE-2021-37580](https://github.com/Wing-song/CVE-2021-37580) - ### CVE-2021-37624 (2021-10-25) @@ -5580,6 +5600,14 @@ In gatt_process_read_by_type_rsp of gatt_cl.cc, there is a possible out of bound - [Satheesh575555/system_bt_AOSP10_r33_CVE-2020-0377](https://github.com/Satheesh575555/system_bt_AOSP10_r33_CVE-2020-0377) +### CVE-2020-0380 (2020-09-17) + + +In allocExcessBits of bitalloc.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-146398979 + + +- [ShaikUsaf/system_bt_AOSP10_r33_CVE-2020-0380](https://github.com/ShaikUsaf/system_bt_AOSP10_r33_CVE-2020-0380) + ### CVE-2020-0391 (2020-09-17) @@ -17860,6 +17888,7 @@ Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, - [jacobsoo/RTF-Cleaner](https://github.com/jacobsoo/RTF-Cleaner) - [likescam/CVE-2017-0199](https://github.com/likescam/CVE-2017-0199) - [stealth-ronin/CVE-2017-0199-PY-KIT](https://github.com/stealth-ronin/CVE-2017-0199-PY-KIT) +- [Phantomlancer123/CVE-2017-0199](https://github.com/Phantomlancer123/CVE-2017-0199) ### CVE-2017-0204 (2017-04-12) @@ -19161,6 +19190,7 @@ Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows rem - [rodnt/laravel-phpunit-rce-masscaner](https://github.com/rodnt/laravel-phpunit-rce-masscaner) - [akr3ch/CVE-2017-9841](https://github.com/akr3ch/CVE-2017-9841) - [0zvxr/CVE-2017-9841](https://github.com/0zvxr/CVE-2017-9841) +- [jax7sec/CVE-2017-9841](https://github.com/jax7sec/CVE-2017-9841) ### CVE-2017-9934 (2017-07-17)