Internet Storm Center Spotlight


INTERNET STORM CENTER SPOTLIGHT

ISC provides a free analysis and warning service to thousands of Internet users and organizations, and is actively working with Internet Service Providers to fight back against the most malicious attackers. https://isc.sans.edu/about.html

Microsoft January 2024 Patch Tuesday

Published: 2024-01-10

Last Updated: 2024-01-10 00:38:10 UTC

by Johannes Ullrich (Version: 1)

Microsoft today surprised with a light patch Tuesday. We only received 48 patches for Microsoft products and four for Chromium, affecting Microsoft Edge. Only two of the 48 patches are rated critical; none had been disclosed or exploited before today. The update also includes an SQLite patch affecting Microsoft products. This issue fixed the "Stranger Strings" vulnerability, patched in 2022 in the open-source version of SQLite.

The critical Kerberos vulnerability is interesting and should be patched quickly. It may allow an attacker with a MitM position to impersonate a Kerberos server and bypass authentication. Kerberos weaknesses have been abused in these scenarios in the past, and obtaining a MitM position is typically not that difficult after the perimeter of a network has been breached.

Read the full entry: https://isc.sans.edu/diary/Microsoft+January+2024+Patch+Tuesday/30548

Jenkins Brute Force Scans

Published: 2024-01-09

Last Updated: 2024-01-09 17:17:36 UTC

by Johannes Ullrich (Version: 1)

Our honeypots saw a number of scans for "/j_acegi_security_check" the last two days. This URL has not been hit much lately, but was hit pretty hard last March. The URL is associated with Jenkins, and can be used to brute force passwords.

A typical request seen by our honeypots ...

The body of the request URL decodes to ...

The Chinese characters at the end translate to "Log in," indicating that this request may have been originally based on a Chinese language version of Jenkins. I have observed usernames like admin, 1, 123, adminadmin, root. The intent of this particular query may be to test if the server is running Jenkins and not an actual brute-force attempt. But it is always difficult to guess a particular attack's intent. The honeypot is not attempting to emulate Jenkins at this point (something we may need to add to our agile honeypots soon).

Read the full entry: https://isc.sans.edu/diary/Jenkins+Brute+Force+Scans/30546/

Suspicious Prometei Botnet Activity

Published: 2024-01-07

Last Updated: 2024-01-07 20:23:34 UTC

by Guy Bruneau (Version: 1)

On the 31 Dec 2023, after trying multiple username/password combination, actor using IP 194.30.53.68 successfully loging to the honeypot and uploaded eight files where 2 of them are protected with a 7zip password (updates1.7z & updates2.7z). Some of these files have been identified to be related to the Prometei trojan by Virustotal. The file sqhost.exe was last found by Talos used with the Prometei botnet as a trojan coin miner.

Read the full entry: https://isc.sans.edu/diary/Suspicious+Prometei+Botnet+Activity/30538/

Internet Storm Center Entries


Recent CVEs


The list is assembled by pulling recent vulnerabilities from NIST NVD, Microsoft, Twitter mentions of vulnerabilities, ISC Diaries and Podcast, and the CISA list of known exploited vulnerabilities. There are also some unscored, but significant, vulnerabilities at the end. This includes vulnerabilities that have not been added to the NVD yet.

CVE-2024-0057 - NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability

Product: Microsoft .NET Framework

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-0057

ISC Diary: https://isc.sans.edu/diary/30548

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-0057



CVE-2024-20674 - Windows Kerberos Security Feature Bypass Vulnerability

Product: Microsoft Windows

CVSS Score: 9.0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-20674

ISC Diary: https://isc.sans.edu/diary/30548

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20674



CVE-2024-0193 - Linux kernel is vulnerable to a use-after-free flaw in the netfilter subsystem, potentially enabling a local unprivileged user to escalate their privileges.

Product: Linux Kernel

CVSS Score: 6.7

NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-0193

ISC Podcast: https://isc.sans.edu/podcastdetail.html?podcastid=8802

NVD References: 

- https://access.redhat.com/security/cve/CVE-2024-0193

- https://bugzilla.redhat.com/show_bug.cgi?id=2255653



CVE-2023-32874 - The Modem IMS Stack is vulnerable to an out of bounds write, allowing remote code execution without additional privileges or user interaction.

Product: Mediatek LR13

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-32874

NVD References: https://corp.mediatek.com/product-security-bulletin/January-2024



CVE-2023-33025 - Memory corruption in Data Modem when a non-standard SDP body, during a VOLTE call.

Product: Qualcomm AR8035

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-33025

NVD References: https://www.qualcomm.com/company/product-security/bulletins/january-2024-bulletin



CVE-2023-6436 - Ekol Informatics Website Template is vulnerable to SQL injection.

Product: Ekolbilisim Web Sablonu Yazilimi

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-6436

NVD References: https://www.usom.gov.tr/bildirim/tr-24-0001



CVE-2023-4280 - Silicon Labs TrustZone implementation in v4.3.x and earlier of the Gecko SDK allows unauthorized access to trusted memory.

Product: Silabs Gecko Software Development Kit

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-4280

NVD References: 

- https://community.silabs.com/069Vm0000004NinIAE

- https://github.com/SiliconLabs/gecko_sdk



CVE-2023-48419 -  Google Home devices in the wifi vicinity of an attacker can be exploited to spy on users, leading to Elevation of Privilege.

Product: Google Nest Audio

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-48419

NVD References: https://support.google.com/product-documentation/answer/14273332?hl=en&ref_topic=12974021&sjid=4533873659772963473-NA#zippy=%2Cspeakers



CVE-2023-50711 - vmm-sys-util versions 0.5.0 to 0.12.0 allow out of bounds memory accesses in the `FamStructWrapper::deserialize` implementation due to a lack of length verification in the header.

Product: Rust-Vmm Vmm-Sys-Util

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-50711

NVD References: 

- https://github.com/rust-vmm/vmm-sys-util/commit/30172fca2a8e0a38667d934ee56682247e13f167

- https://github.com/rust-vmm/vmm-sys-util/security/advisories/GHSA-875g-mfp6-g7f9



CVE-2023-47458 - SpringBlade v.3.7.0 and before lacks permissions control framework, enabling remote attackers to escalate privileges.

Product: Bladex Springblade

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-47458

NVD References: 

- http://springblade.com

- https://gist.github.com/Mr-F0reigner/b05487f5ca52d17e214fffd6e1e0312a

- https://gitee.com/smallc/SpringBlade



CVE-2024-0194 - CodeAstro Internet Banking System up to 1.0 allows remote attackers to upload arbitrary files due to unrestricted upload capabilities in the Profile Picture Handler component.

Product: Codeastro Internet Banking System

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-0194

NVD References: 

- https://drive.google.com/file/d/147yg6oMHoJ1WvhH-TT0-GXDjKyNCSoeX/view?usp=sharing

- https://vuldb.com/?ctiid.249509

- https://vuldb.com/?id.249509



CVE-2024-0195 - Spider-flow 0.4.3 is vulnerable to a critical code injection attack in the FunctionService.saveFunction function of the file src/main/java/org/spiderflow/controller/FunctionController.java, allowing remote exploitation; the vulnerability has been publicly disclosed and assigned the identifier VDB-249510.

Product: Ssssssss Spider-Flow

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-0195

NVD References: 

- https://github.com/laoquanshi/puppy/blob/main/spider-flow%20code%20injection%20causes%20rce.md

- https://vuldb.com/?ctiid.249510

- https://vuldb.com/?id.249510



CVE-2024-21623 - OTClient is vulnerable to expression injection in Actions, allowing an attacker to run remote commands, leak secrets, and alter the repository.

Product: Mehah OTClient

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-21623

NVD References: 

- https://github.com/mehah/otclient/blob/72744edc3b9913b920e0fd12e929604f682fda75/.github/workflows/analysis-sonarcloud.yml#L91-L104

- https://github.com/mehah/otclient/commit/db560de0b56476c87a2f967466407939196dd254

- https://github.com/mehah/otclient/security/advisories/GHSA-q6gr-wc79-v589

- https://securitylab.github.com/research/github-actions-preventing-pwn-requests/

- https://securitylab.github.com/research/github-actions-untrusted-input/



CVE-2023-6339 - Google Nest WiFi Pro root code-execution & user-data compromise

Product: Google Nest WiFi Pro

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-6339

NVD References: 

- https://support.google.com/product-documentation/answer/14273332?hl=en&ref_topic=12974021&sjid=4533873659772963473-NA

- https://vuldb.com/?id.249563



CVE-2024-21632 - "Omniauth-microsoft_graph version prior to 2.0.0 allows for account takeover due to lack of validation of the `email` attribute, posing a risk when used as a trusted user identifier in nOAuth configuration."

Product: Recognizeapp Omniauth\\

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-21632

NVD References: 

- https://github.com/synth/omniauth-microsoft_graph/commit/f132078389612b797c872b45bd0e0b47382414c1

- https://github.com/synth/omniauth-microsoft_graph/security/advisories/GHSA-5g66-628f-7cvj

- https://www.descope.com/blog/post/noauth



CVE-2023-50351 - HCL DRYiCE MyXalytics is affected by an insecure key rotation mechanism that enables attackers to compromise data confidentiality or integrity.

Product: HCLtech Dryice MyXalytics

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-50351

NVD References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0109608



CVE-2023-45722 - HCL DRYiCE MyXalytics is vulnerable to path traversal arbitrary file read, allowing potential exploits to disrupt or take over the application by accessing files outside of the restricted directory.

Product: HCLtech Dryice MyXalytics

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-45722

NVD References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0109608



CVE-2023-45723 - HCL DRYiCE MyXalytics is affected by a path traversal vulnerability enabling unauthorized file uploads and manipulation of file storage location on the server.

Product: HCLtech Dryice MyXalytics

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-45723

NVD References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0109608



CVE-2023-45724 - HCL DRYiCE MyXalytics product is vulnerable to unauthenticated file upload, allowing the upload of a specific file without requiring user authentication.

Product: HCLtech Dryice MyXalytics

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-45724

NVD References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0109608



CVE-2023-46308 - In Plotly plotly.js before 2.25.2, plot API calls have a risk of __proto__ being polluted in expandObjectPaths or nestedProperty.

Product:  Plotly.Js

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-46308

NVD References: 

- https://github.com/plotly/plotly.js/releases/tag/v2.25.2

- https://plotly.com/javascript/



CVE-2023-52304, CVE-2023-52307, CVE-2023-52309 through CVE-2023-52311, CVE-2023-52314 - Multiple Vulnerabilities in PaddlePaddle before 2.6.0

Product: PaddlePaddle 

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-52304

NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-52307

NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-52309

NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-52310

NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-52311

NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-52314

NVD References: 

- https://github.com/PaddlePaddle/Paddle/blob/develop/security/advisory/pdsa-2023-013.md

- https://github.com/PaddlePaddle/Paddle/blob/develop/security/advisory/pdsa-2023-016.md

- https://github.com/PaddlePaddle/Paddle/blob/develop/security/advisory/pdsa-2023-018.md

- https://github.com/PaddlePaddle/Paddle/blob/develop/security/advisory/pdsa-2023-019.md

- https://github.com/PaddlePaddle/Paddle/blob/develop/security/advisory/pdsa-2023-020.md

- https://github.com/PaddlePaddle/Paddle/blob/develop/security/advisory/pdsa-2023-023.md




CVE-2023-51784 - Apache InLong before 1.10.0 allows attackers to remotely execute code due to improper control of code generation, which is fixed by upgrading to 1.10.0 or cherry-picking the patch.

Product: Apache InLong

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-51784

NVD References: 

- http://www.openwall.com/lists/oss-security/2024/01/03/1

- https://lists.apache.org/thread/4nxbyl6mh5jgh0plk0qposbxwn6w9h8j



CVE-2023-39655 - The NPM package @perfood/couch-auth versions <= 0.20.0 is vulnerable to host header injection, allowing an attacker to reset other users' passwords and take over their accounts.

Product: Perfood Couchauth

CVSS Score: 9.6

NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-39655

NVD References: 

- https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2023-39655

- https://www.npmjs.com/package/%40perfood/couch-auth



CVE-2023-50253 - Laf cloud development platform versions 1.0.0-beta.13 and prior allow authenticated users to obtain any pod logs under the same namespace, resulting in unauthorized access to sensitive information.

Product: Laf cloud development platform

CVSS Score: 9.6

NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-50253

NVD References: 

- https://github.com/labring/laf/pull/1468

- https://github.com/labring/laf/security/advisories/GHSA-g9c8-wh35-g75f



CVE-2023-50090 - Ureport2 2.2.9 and earlier versions allow arbitrary file writing and command execution through a crafted POST request in the saveReportFile method.

Product: Ureport2 Project 

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-50090

NVD References: 

- https://github.com/advisories/GHSA-445x-c8qq-qfr9

- https://lemono.fun/thoughts/UReport2-RCE.html



CVE-2024-0222 - Chromium: CVE-2024-0222 Use after free in ANGLE

Product: Google Chrome

CVSS Score: 0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-0222

ISC Diary: https://isc.sans.edu/diary/30548

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-0222

NVD References: 

- https://chromereleases.googleblog.com/2024/01/stable-channel-update-for-desktop.html

- https://crbug.com/1501798

- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AYONA2XSNFMXLAW4IHLFI5UVV3QRNG5K/

- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D6C2HN4T2S6GYNTAUXLH45LQZHK7QPHP/



CVE-2024-0223 - Chromium: CVE-2024-0223 Heap buffer overflow in ANGLE

Product: Google Chrome

CVSS Score: 0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-0223

ISC Diary: https://isc.sans.edu/diary/30548

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-0223

NVD References: 

- https://chromereleases.googleblog.com/2024/01/stable-channel-update-for-desktop.html

- https://crbug.com/1505009

- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AYONA2XSNFMXLAW4IHLFI5UVV3QRNG5K/

- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D6C2HN4T2S6GYNTAUXLH45LQZHK7QPHP/



CVE-2024-0224 - Chromium: CVE-2024-0224 Use after free in WebAudio

Product: Google Chrome

CVSS Score: 0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-0224

ISC Diary: https://isc.sans.edu/diary/30548

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-0224

NVD References: 

- https://chromereleases.googleblog.com/2024/01/stable-channel-update-for-desktop.html

- https://crbug.com/1505086

- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AYONA2XSNFMXLAW4IHLFI5UVV3QRNG5K/

- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D6C2HN4T2S6GYNTAUXLH45LQZHK7QPHP/



CVE-2024-0225 - Chromium: CVE-2024-0225 Use after free in WebGPU

Product: Google Chrome

CVSS Score: 0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-0225

ISC Diary: https://isc.sans.edu/diary/30548

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-0225

NVD References: 

- https://chromereleases.googleblog.com/2024/01/stable-channel-update-for-desktop.html

- https://crbug.com/1506923

- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AYONA2XSNFMXLAW4IHLFI5UVV3QRNG5K/

- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D6C2HN4T2S6GYNTAUXLH45LQZHK7QPHP/



CVE-2023-49622, CVE-2023-49624, CVE-2023-49625, CVE-2023-49633, CVE-2023-49639, CVE-2023-49658, CVE-2023-49665, CVE-2023-49666 -  Multiple unauthenticated SQL Injection vulnerabilities in Billing Software v1.0.

Product: Kashipara Billing Software

CVSS Score: 9.8 

NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-49622

NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-49624

NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-49625

NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-49633

NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-49639

NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-49658

NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-49665

NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-49666

NVD References: 

- https://fluidattacks.com/advisories/zimerman/

- https://www.kashipara.com/



CVE-2023-50743, CVE-2023-50752, CVE-2023-50753 - Multiple unauthenticated SQL Injection vulnerabilities in Online Notice Board System v1.0. 

Product: Kashipara Online Notice Board System

CVSS Score: 9.8 AtRiskScore 30

NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-50743

NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-50752

NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-50753

NVD References: 

- https://fluidattacks.com/advisories/perahia/

- https://www.kashipara.com/



CVE-2023-50862 through CVE-2023-50867 -  Multiple unauthenticated SQL Injection vulnerabilities in Travel Website v1.0.

Product: Kashipara Travel Website

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-50862

NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-50863

NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-50864

NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-50865

NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-50866

NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-50867

NVD References: 

- https://fluidattacks.com/advisories/evans/

- https://www.kashipara.com/



CVE-2023-51673 - Stylish Price List – Price Table Builder & QR Code Restaurant Menu is vulnerable to a Cross-Site Request Forgery (CSRF) issue from n/a through 7.0.17.

Product: Stylish Price List

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-51673

NVD References: https://patchstack.com/database/vulnerability/stylish-price-list/wordpress-stylish-price-list-plugin-7-0-17-broken-access-control-vulnerability?_s_id=cve



CVE-2022-46839 - JS Help Desk – Best Help Desk & Support Plugin allows unrestricted uploading of files with dangerous types, potentially leading to arbitrary code execution.

Product: JS Help Desk JS Help Desk – Best Help Desk & Support Plugin

CVSS Score: 10.0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2022-46839

NVD References: https://patchstack.com/database/vulnerability/js-support-ticket/wordpress-js-help-desk-plugin-2-7-1-arbitrary-file-upload-vulnerability?_s_id=cve



CVE-2024-0287 - Kashipara Food Management System 1.0 is vulnerable to remote SQL injection in the file itemBillPdf.php via manipulation of the printid argument (CVE-ID: VDB-249848).

Product: Kashipara Food Management System

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-0287

NVD References: 

- https://github.com/laoquanshi/heishou/blob/main/Food%20Management%20System%20SQL%20Injection%20Vulnerability5.md

- https://vuldb.com/?ctiid.249848

- https://vuldb.com/?id.249848



CVE-2024-0288 - Kashipara Food Management System 1.0 is vulnerable to SQL injection via the product_name parameter in the rawstock_used_damaged_submit.php file, allowing remote attackers to exploit this and disclosing the vulnerability to the public, with identifier VDB-249849.

Product: Kashipara Food Management System

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-0288

NVD References: 

- https://github.com/laoquanshi/heishou/blob/main/Food%20Management%20System%20SQL%20Injection%20Vulnerability12.md

- https://vuldb.com/?ctiid.249849

- https://vuldb.com/?id.249849



CVE-2024-0289 - Kashipara Food Management System 1.0 is vulnerable to remote SQL injection via manipulation of the itemype argument in stock_entry_submit.php (VDB-249850).

Product: Kashipara Food Management System

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-0289

NVD References: 

- https://github.com/laoquanshi/heishou/blob/main/Food%20Management%20System%20SQL%20Injection%20Vulnerability14.md

- https://vuldb.com/?ctiid.249850

- https://vuldb.com/?id.249850



CVE-2024-0290 - Kashipara Food Management System 1.0 is vulnerable to remote SQL injection via manipulation of the item_type argument in stock_edit.php (CVE: VDB-249851).

Product: Kashipara Food Management System

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-0290

NVD References: 

- https://github.com/laoquanshi/heishou/blob/main/Food%20Management%20System%20SQL%20Injection%20Vulnerability15.md

- https://vuldb.com/?ctiid.249851

- https://vuldb.com/?id.249851



CVE-2023-6921 - PrestaShow Google Integrator, a PrestaShop addon, is vulnerable to Blind SQL Injection, enabling extraction and modification of data by inserting commands through cookies.

Product: PrestaShow PrestaShop

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-6921

NVD References: 

- https://cert.pl/en/posts/2024/01/CVE-2023-6921/

- https://cert.pl/posts/2024/01/CVE-2023-6921/

- https://prestashow.pl/pl/moduly-prestashop/28-prestashop-google-integrator-ga4-gtm-ads-remarketing.html



CVE-2023-47211 - ManageEngine OpManager 12.7.258 allows arbitrary file creation through a directory traversal vulnerability in the uploadMib functionality, triggered by a specially crafted HTTP request with a malicious MiB file.

Product: ManageEngine OpManager

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-47211

NVD References: 

- https://talosintelligence.com/vulnerability_reports/TALOS-2023-1851

- https://www.manageengine.com/itom/advisory/cve-2023-47211.html



CVE-2024-21650 - XWiki Platform is vulnerable to remote code execution (RCE) through user registration, allowing attackers to execute arbitrary code via crafted payloads in the "first name" or "last name" fields, affecting installations with guest registration enabled, and is patched in XWiki versions 14.10.17, 15.5.3, and 15.8 RC1.

Product: XWiki Platform  XWiki

CVSS Score: 10.0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-21650

NVD References: 

- https://github.com/xwiki/xwiki-platform/commit/b290bfd573c6f7db6cc15a88dd4111d9fcad0d31

- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-rj7p-xjv7-7229

- https://jira.xwiki.org/browse/XWIKI-21173



CVE-2023-52215 - UkrSolution Simple Inventory Management - SQL Injection vulnerability in WooCommerce plugin allows for unauthorized access to the database.

Product: UkrSolution Simple Inventory Management

CVSS Score: 9.3

NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-52215

NVD References: https://patchstack.com/database/vulnerability/barcode-scanner-lite-pos-to-manage-products-inventory-and-orders/wordpress-barcode-scanner-with-inventory-order-manager-plugin-1-5-1-unauthenticated-sql-injection-vulnerability?_s_id=cve



CVE-2023-52218 - The Anton Bond Woocommerce Tranzila Payment Gateway before version 1.0.9 is vulnerable to Deserialization of Untrusted Data.

Product: Anton Bond Woocommerce Tranzila Payment Gateway

CVSS Score: 10.0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-52218

NVD References: https://patchstack.com/database/vulnerability/woo-tranzila-gateway/wordpress-woocommerce-tranzila-gateway-plugin-1-0-8-unauthenticated-php-object-injection-vulnerability?_s_id=cve



CVE-2023-52219 - Deserialization of Untrusted Data vulnerability in Gecka Gecka Terms Thumbnails.This issue affects Gecka Terms Thumbnails: from n/a through 1.1.

Product: Gecka Terms Thumbnails

CVSS Score: 9.9

NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-52219

NVD References: https://patchstack.com/database/vulnerability/gecka-terms-thumbnails/wordpress-gecka-terms-thumbnails-plugin-1-1-php-object-injection-vulnerability?_s_id=cve



CVE-2023-52225 - Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics is vulnerable to a Deserialization of Untrusted Data vulnerability.

Product: Tagbox

CVSS Score: 10.0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-52225

NVD References: https://patchstack.com/database/vulnerability/taggbox-widget/wordpress-tagbox-widget-plugin-3-1-unauthenticated-php-object-injection-vulnerability?_s_id=cve



CVE-2023-52207 - SVNLabs Softwares HTML5 MP3 Player with Playlist Free is vulnerable to a Deserialization of Untrusted Data flaw affecting versions from n/a through 3.0.0.

Product: SVNLabs Softwares HTML5 MP3 Player with Playlist Free

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-52207

NVD References: https://patchstack.com/database/vulnerability/html5-mp3-player-with-playlist/wordpress-html5-mp3-player-plugin-3-0-0-php-object-injection-vulnerability?_s_id=cve



CVE-2023-50982 - Stud.IP 5.x through 5.3.3 allows XSS and enables the upload of executable files, resulting in remote code execution with www-data user privileges.

Product: Stud.IP 5.x through 5.3.3

CVSS Score: 9.0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-50982

NVD References: 

- https://gitlab.studip.de/studip/studip/-/tags

- https://rehmeinfosec.de/labor/cve-2023-50982

- https://sourceforge.net/projects/studip/files/Stud.IP/5.4/



CVE-2023-52200 - ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup is vulnerable to Cross-Site Request Forgery (CSRF) and Deserialization of Untrusted Data.

Product: Repute Infosystems ARMember – Membership Plugin

CVSS Score: 9.6

NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-52200

NVD References: https://patchstack.com/database/vulnerability/armember-membership/wordpress-armember-lite-plugin-4-0-22-cross-site-request-forgery-csrf-to-php-object-injection-vulnerability?_s_id=cve



CVE-2023-52205 - SVNLabs Softwares HTML5 SoundCloud Player with Playlist Free before 2.8.0 suffers from a deserialization vulnerability when processing untrusted data.

Product: SVNLabs Softwares HTML5 SoundCloud Player with Playlist Free

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-52205

NVD References: https://patchstack.com/database/vulnerability/html5-soundcloud-player-with-playlist/wordpress-html5-soundcloud-player-plugin-2-8-0-php-object-injection-vulnerability?_s_id=cve



CVE-2023-52202 - HTML5 MP3 Player with Folder Feedburner Playlist Free is vulnerable to a Deserialization of Untrusted Data vulnerability from n/a through 2.8.0.

Product: SVNLabs Softwares  HTML5 MP3 Player with Folder Feedburner Playlist Free

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-52202

NVD References: https://patchstack.com/database/vulnerability/html5-mp3-player-with-mp3-folder-feedburner-playlist/wordpress-html5-mp3-player-with-folder-feedburner-plugin-2-8-0-php-object-injection-vulnerability?_s_id=cve



CVE-2024-21663 - Discord-Recon is vulnerable to remote code execution, allowing attackers to execute shell commands in the server without admin privileges, but this has been fixed in version 0.0.8.

Product: Discord-Recon 

CVSS Score: 9.9

NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-21663

NVD References: 

- https://github.com/DEMON1A/Discord-Recon/commit/f9cb0f67177f5e2f1022295ca8e641e47837ec7a

- https://github.com/DEMON1A/Discord-Recon/issues/23

- https://github.com/DEMON1A/Discord-Recon/security/advisories/GHSA-fjcj-g7x8-4rp7



CVE-2024-21646 - Azure uAMQP, a general purpose C library for AMQP 1.0, is vulnerable to remote code execution due to an integer overflow or wraparound or memory safety issue when receiving crafted binary type data, but has been patched in release 2024-01-01. Product: Microsoft Azure uAMQP

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-21646

NVD References: 

- https://github.com/Azure/azure-uamqp-c/commit/12ddb3a31a5a97f55b06fa5d74c59a1d84ad78fe

- https://github.com/Azure/azure-uamqp-c/security/advisories/GHSA-j29m-p99g-7hpv



CVE-2023-7220 - Totolink NR1800X 9.1.0u.6279_B20210910 is vulnerable to a critical stack-based buffer overflow in the loginAuth function of the file /cgi-bin/cstecgi.cgi, allowing for remote attacks via manipulation of the password argument, with the exploit publicly disclosed as VDB-249854.

Product: Totolink NR1800X

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-7220

NVD References: 

- https://github.com/jylsec/vuldb/blob/main/TOTOLINK/NR1800X/1/README.md

- https://vuldb.com/?ctiid.249854

- https://vuldb.com/?id.249854



CVE-2023-49621 - SIMATIC CN 4100 (All versions < V2.7) uses default admin credentials, allowing an attacker to gain complete control of the device.

Product: SIMATIC vulnerablity

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-49621

NVD References: https://cert-portal.siemens.com/productcert/pdf/ssa-777015.pdf



CVE-2023-51438 - SIMATIC IPC1047E, SIMATIC IPC647E, SIMATIC IPC847E are vulnerable to unauthorized access through the Redfish server in default installations of maxView Storage Manager.

Product: SIMATIC maxView Storage Manager

CVSS Score: 10.0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-51438

NVD References: https://cert-portal.siemens.com/productcert/pdf/ssa-702935.pdf



CVE-2023-5347 - Korenix JetNet Series devices are vulnerable to improper verification of cryptographic signature, allowing the replacement of the entire operating system, including Trusted Executables.

Product: Korenix JetNet Series

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-5347

NVD References: 

- https://cyberdanube.com/en/en-multiple-vulnerabilities-in-korenix-jetnet-series/

- https://www.beijerelectronics.com/en/support/Help___online?docId=69947



CVE-2023-7221 - Totolink T6 4.1.9cu.5241_B20210923 is vulnerable to a critical buffer overflow in the component HTTP POST Request Handler's function main due to the manipulation of the argument v41, allowing remote attackers to initiate attacks; exploit details have been publicly disclosed under the identifier VDB-249855 with no response from the vendor.

Product: Totolink T6

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-7221

NVD References: 

- https://github.com/jylsec/vuldb/blob/main/TOTOLINK/T6/1/README.md

- https://vuldb.com/?ctiid.249855

- https://vuldb.com/?id.249855



CVE-2024-0056 - Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability

Product: Microsoft.Data.SqlClient and System.Data.SqlClient

CVSS Score: 8.7

NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-0056

ISC Diary: https://isc.sans.edu/diary/30548

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-0056



CVE-2024-20652 - Windows HTML Platforms Security Feature Bypass Vulnerability

Product: Microsoft Windows

CVSS Score: 7.5

NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-20652

ISC Diary: https://isc.sans.edu/diary/30548

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20652



CVE-2024-20653 - Microsoft Common Log File System Elevation of Privilege Vulnerability

Product: Microsoft  Common Log File System

CVSS Score: 7.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-20653

ISC Diary: https://isc.sans.edu/diary/30548

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20653



CVE-2024-20654 - Microsoft ODBC Driver Remote Code Execution Vulnerability

Product: Microsoft ODBC Driver

CVSS Score: 8.0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-20654

ISC Diary: https://isc.sans.edu/diary/30548

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20654



CVE-2024-20656 - Visual Studio Elevation of Privilege Vulnerability

Product: Microsoft Visual Studio

CVSS Score: 7.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-20656

ISC Diary: https://isc.sans.edu/diary/30548

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20656



CVE-2024-20657 - Windows Group Policy Elevation of Privilege Vulnerability

Product: Microsoft Windows

CVSS Score: 7.0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-20657

ISC Diary: https://isc.sans.edu/diary/30548

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20657



CVE-2024-20658 - Microsoft Virtual Hard Disk Elevation of Privilege Vulnerability

Product: Microsoft Virtual Hard Disk

CVSS Score: 7.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-20658

ISC Diary: https://isc.sans.edu/diary/30548

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20658



CVE-2024-20661 - Microsoft Message Queuing Denial of Service Vulnerability

Product: Microsoft Message Queuing

CVSS Score: 7.5

NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-20661

ISC Diary: https://isc.sans.edu/diary/30548

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20661



CVE-2024-20672 - .NET Core and Visual Studio Denial of Service Vulnerability

Product: Microsoft .NET Core and Visual Studio

CVSS Score: 7.5

NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-20672

ISC Diary: https://isc.sans.edu/diary/30548

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20672



CVE-2024-20676 - Azure Storage Mover Remote Code Execution Vulnerability

Product: Microsoft  Azure Storage Mover

CVSS Score: 8.0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-20676

ISC Diary: https://isc.sans.edu/diary/30548

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20676

      


CVE-2024-20677 - Microsoft Office Remote Code Execution Vulnerability

Product: Microsoft Office

CVSS Score: 7.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-20677

ISC Diary: https://isc.sans.edu/diary/30548

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20677



CVE-2024-20681 - Windows Subsystem for Linux Elevation of Privilege Vulnerability

Product: Microsoft Windows

CVSS Score: 7.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-20681

ISC Diary: https://isc.sans.edu/diary/30548

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20681



CVE-2024-20682 - Windows Cryptographic Services Remote Code Execution Vulnerability

Product: Microsoft Windows Cryptographic Services

CVSS Score: 7.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-20682

ISC Diary: https://isc.sans.edu/diary/30548

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20682



CVE-2024-20683, CVE-2024-20686 -  Win32k Elevation of Privilege Vulnerabilities

Product: Microsoft Win32k

CVSS Score: 7.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-20683

NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-20686

ISC Diary: https://isc.sans.edu/diary/30548

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20683

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20686



CVE-2024-20687 -  Microsoft AllJoyn API Denial of Service Vulnerability

Product: Microsoft AllJoyn API

CVSS Score: 7.5

NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-20687

ISC Diary: https://isc.sans.edu/diary/30548

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20687



CVE-2024-20696, CVE-2024-20697 - Windows Libarchive Remote Code Execution Vulnerabilities

Product: Microsoft Windows

CVSS Score: 7.3

NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-20696

NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-20697

ISC Diary: https://isc.sans.edu/diary/30548

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20696

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20697



CVE-2024-20698 - Windows Kernel Elevation of Privilege Vulnerability

Product: Microsoft Windows Kernel

CVSS Score: 7.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-20698

ISC Diary: https://isc.sans.edu/diary/30548

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20698



CVE-2024-20700 - Windows Hyper-V Remote Code Execution Vulnerability

Product: Microsoft Windows Hyper-V

CVSS Score: 7.5

NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-20700

ISC Diary: https://isc.sans.edu/diary/30548

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20700



CVE-2024-21307 - Remote Desktop Client Remote Code Execution Vulnerability

Product: Microsoft Remote Desktop Client

CVSS Score: 7.5

NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-21307

ISC Diary: https://isc.sans.edu/diary/30548

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21307



CVE-2024-21309 - Windows Kernel-Mode Driver Elevation of Privilege Vulnerability

Product: Microsoft Windows

CVSS Score: 7.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-21309

ISC Diary: https://isc.sans.edu/diary/30548

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21309



CVE-2024-21310 - Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

Product: Microsoft Windows Cloud Files Mini Filter Driver

CVSS Score: 7.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-21310

ISC Diary: https://isc.sans.edu/diary/30548

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21310



CVE-2024-21312 - .NET Framework Denial of Service Vulnerability

Product: Microsoft .NET Framework

CVSS Score: 7.5

NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-21312

ISC Diary: https://isc.sans.edu/diary/30548

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21312



CVE-2024-21318 - Microsoft SharePoint Server Remote Code Execution Vulnerability

Product: Microsoft SharePoint Server

CVSS Score: 8.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-21318

ISC Diary: https://isc.sans.edu/diary/30548

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21318



CVE-2023-37293 - AMI’s SPx BMC vulnerability allows an adjacent network attacker to cause a stack-based buffer overflow, risking the compromise of confidentiality, integrity, and availability.

Product: AMI SPx

CVSS Score: 9.6

NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-37293

NVD References: https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2023010.pdf



CVE-2023-3043 - AMI’s SPx product is vulnerable to a stack-based buffer overflow through an adjacent network, resulting in potential loss of confidentiality, integrity, and availability.

Product: AMI SPx

CVSS Score: 9.6

NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-3043

NVD References: https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2023010.pdf



CVE-2022-35737 - MITRE: CVE-2022-35737 SQLite allows an array-bounds overflow

Product: Netapp Ontap_Select_Deploy_Administration_Utility -

CVSS Score: 0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2022-35737

ISC Diary: https://isc.sans.edu/diary/30548

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35737



CVE-2023-50916 - Kyocera Device Manager before 3.1.1213.0 allows NTLM credential exposure during UNC path authentication via a crafted change from a local path to a UNC path.

Product: Kyocera Device Manager

CVSS Score: 0

CISA KEV: ???

NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-50916

NVD References:

- https://www.kyoceradocumentsolutions.us/en/about-us/pr-and-award-certifications/press/kyocera-device-manager-cve-2023-50196-vulnerability-solution-update.html

- https://www.trustwave.com/en-us/resources/security-resources/security-advisories/

- https://www.trustwave.com/hubfs/Web/Library/Advisories_txt/TWSL2024-001_kyocera-v2.txt        



CVE-2023-29357 - Microsoft SharePoint Server Privilege Escalation Vulnerability

Product: Microsoft SharePoint Server

CVSS Score: 9.8

CISA KEV:???

NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-29357

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29357



The following vulnerabilities need a manual review:



CVE-2023-46805 - Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability

Product: Ivanti Connect Secure and Policy Secure

CISA KEV: since 2024.01.10   



CVE-2024-21887 - Ivanti Connect Secure and Policy Secure Command Injection Vulnerability

Product: Ivanti Connect Secure and Policy Secure

CISA KEV: since 2024.01.10