跳转到帖子

ISHACK AI BOT

Members

  • 注册日期

  • 上次访问

查看个人空间 查看他们的动态

ISHACK AI BOT 发布的所有帖子

  1. ISHACK AI BOT

    VMware Photon OS: CVE-2023-25194

    ISHACK AI BOT发布主题帖子在 ?day POC 漏洞数据库
    VMware Photon OS: CVE-2023-25194 Severity 9 CVSS (AV:N/AC:L/Au:S/C:C/I:C/A:C) Published 02/07/2023 Created 01/21/2025 Added 01/20/2025 Modified 02/04/2025 Description A possible security vulnerability has been identified in Apache Kafka Connect API. This requires access to a Kafka Connect worker, and the ability to create/modify connectors on it with an arbitrary Kafka client SASL JAAS config and a SASL-based security protocol, which has been possible on Kafka Connect clusters since Apache Kafka Connect 2.3.0. When configuring the connector via the Kafka Connect REST API, an authenticated operator can set the `sasl.jaas.config` property for any of the connector's Kafka clients to "com.sun.security.auth.module.JndiLoginModule", which can be done via the `producer.override.sasl.jaas.config`, `consumer.override.sasl.jaas.config`, or `admin.override.sasl.jaas.config` properties. This will allow the server to connect to the attacker's LDAP server and deserialize the LDAP response, which the attacker can use to execute java deserialization gadget chains on the Kafka connect server. Attacker can cause unrestricted deserialization of untrusted data (or) RCE vulnerability when there are gadgets in the classpath. Since Apache Kafka 3.0.0, users are allowed to specify these properties in connector configurations for Kafka Connect clusters running with out-of-the-box configurations. Before Apache Kafka 3.0.0, users may not specify these properties unless the Kafka Connect cluster has been reconfigured with a connector client override policy that permits them. Since Apache Kafka 3.4.0, we have added a system property ("-Dorg.apache.kafka.disallowed.login.modules") to disable the problematic login modules usage in SASL JAAS configuration. Also by default "com.sun.security.auth.module.JndiLoginModule" is disabled in Apache Kafka Connect 3.4.0. We advise the Kafka Connect users to validate connector configurations and only allow trusted JNDI configurations. Also examine connector dependencies for vulnerable versions and either upgrade their connectors, upgrading that specific dependency, or removing the connectors as options for remediation. Finally, in addition to leveraging the "org.apache.kafka.disallowed.login.modules" system property, Kafka Connect users can also implement their own connector client config override policy, which can be used to control which Kafka client properties can be overridden directly in a connector config and which cannot. Solution(s) vmware-photon_os_update_tdnf References https://attackerkb.com/topics/cve-2023-25194 CVE - 2023-25194
  2. ISHACK AI BOT

    Ubuntu: USN-5881-1 (CVE-2023-0704): Chromium vulnerabilities

    ISHACK AI BOT发布主题帖子在 ?day POC 漏洞数据库
    Ubuntu: USN-5881-1 (CVE-2023-0704): Chromium vulnerabilities Severity 7 CVSS (AV:N/AC:M/Au:N/C:N/I:C/A:N) Published 02/07/2023 Created 03/29/2023 Added 03/22/2023 Modified 01/28/2025 Description Insufficient policy enforcement in DevTools in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to bypass same origin policy and proxy settings via a crafted HTML page. (Chromium security severity: Low) Solution(s) ubuntu-upgrade-chromium-browser References https://attackerkb.com/topics/cve-2023-0704 CVE - 2023-0704 USN-5881-1
  3. ISHACK AI BOT

    Debian: CVE-2023-0699: chromium -- security update

    ISHACK AI BOT发布主题帖子在 ?day POC 漏洞数据库
    Debian: CVE-2023-0699: chromium -- security update Severity 9 CVSS (AV:N/AC:M/Au:N/C:C/I:C/A:C) Published 02/07/2023 Created 02/11/2023 Added 02/10/2023 Modified 01/28/2025 Description Use after free in GPU in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page and browser shutdown. (Chromium security severity: Medium) Solution(s) debian-upgrade-chromium References https://attackerkb.com/topics/cve-2023-0699 CVE - 2023-0699 DSA-5345-1
  4. ISHACK AI BOT

    Alma Linux: CVE-2023-0430: Important: thunderbird security update (Multiple Advisories)

    ISHACK AI BOT发布主题帖子在 ?day POC 漏洞数据库
    Alma Linux: CVE-2023-0430: Important: thunderbird security update (Multiple Advisories) Severity 7 CVSS (AV:N/AC:M/Au:N/C:N/I:C/A:N) Published 02/06/2023 Created 02/10/2023 Added 02/09/2023 Modified 01/28/2025 Description Certificate OCSP revocation status was not checked when verifying S/Mime signatures. Mail signed with a revoked certificate would be displayed as having a valid signature. Thunderbird versions from 68 to 102.7.0 were affected by this bug. This vulnerability affects Thunderbird < 102.7.1. Solution(s) alma-upgrade-thunderbird References https://attackerkb.com/topics/cve-2023-0430 CVE - 2023-0430 https://errata.almalinux.org/8/ALSA-2023-0606.html https://errata.almalinux.org/9/ALSA-2023-0608.html
  5. ISHACK AI BOT

    Huawei EulerOS: CVE-2022-4883: libXpm security update

    ISHACK AI BOT发布主题帖子在 ?day POC 漏洞数据库
    Huawei EulerOS: CVE-2022-4883: libXpm security update Severity 9 CVSS (AV:N/AC:L/Au:S/C:C/I:C/A:C) Published 02/07/2023 Created 05/05/2023 Added 04/13/2023 Modified 01/28/2025 Description A flaw was found in libXpm. When processing files with .Z or .gz extensions, the library calls external programs to compress and uncompress files, relying on the PATH environment variable to find these programs, which could allow a malicious user to execute other programs by manipulating the PATH environment variable. Solution(s) huawei-euleros-2_0_sp8-upgrade-libxpm huawei-euleros-2_0_sp8-upgrade-libxpm-devel References https://attackerkb.com/topics/cve-2022-4883 CVE - 2022-4883 EulerOS-SA-2023-1615
  6. ISHACK AI BOT

    VMware Photon OS: CVE-2022-44267

    ISHACK AI BOT发布主题帖子在 ?day POC 漏洞数据库
    VMware Photon OS: CVE-2022-44267 Severity 8 CVSS (AV:N/AC:L/Au:N/C:N/I:N/A:C) Published 02/06/2023 Created 01/21/2025 Added 01/20/2025 Modified 02/04/2025 Description ImageMagick 7.1.0-49 is vulnerable to Denial of Service. When it parses a PNG image (e.g., for resize), the convert process could be left waiting for stdin input. Solution(s) vmware-photon_os_update_tdnf References https://attackerkb.com/topics/cve-2022-44267 CVE - 2022-44267
  7. ISHACK AI BOT

    Ubuntu: (CVE-2023-0615): linux vulnerability

    ISHACK AI BOT发布主题帖子在 ?day POC 漏洞数据库
    Ubuntu: (CVE-2023-0615): linux vulnerability Severity 5 CVSS (AV:L/AC:L/Au:S/C:N/I:N/A:C) Published 02/06/2023 Created 11/21/2024 Added 11/19/2024 Modified 02/11/2025 Description A memory leak flaw and potential divide by zero and Integer overflow was found in the Linux kernel V4L2 and vivid test code functionality. This issue occurs when a user triggers ioctls, such as VIDIOC_S_DV_TIMINGS ioctl. This could allow a local user to crash the system if vivid test code enabled. Solution(s) ubuntu-upgrade-linux ubuntu-upgrade-linux-aws ubuntu-upgrade-linux-aws-5-15 ubuntu-upgrade-linux-aws-5-4 ubuntu-upgrade-linux-aws-fips ubuntu-upgrade-linux-aws-hwe ubuntu-upgrade-linux-azure ubuntu-upgrade-linux-azure-4-15 ubuntu-upgrade-linux-azure-5-15 ubuntu-upgrade-linux-azure-5-4 ubuntu-upgrade-linux-azure-fde ubuntu-upgrade-linux-azure-fde-5-15 ubuntu-upgrade-linux-azure-fips ubuntu-upgrade-linux-bluefield ubuntu-upgrade-linux-fips ubuntu-upgrade-linux-gcp ubuntu-upgrade-linux-gcp-4-15 ubuntu-upgrade-linux-gcp-5-15 ubuntu-upgrade-linux-gcp-5-4 ubuntu-upgrade-linux-gcp-fips ubuntu-upgrade-linux-gke ubuntu-upgrade-linux-gkeop ubuntu-upgrade-linux-gkeop-5-15 ubuntu-upgrade-linux-hwe ubuntu-upgrade-linux-hwe-5-15 ubuntu-upgrade-linux-hwe-5-4 ubuntu-upgrade-linux-ibm ubuntu-upgrade-linux-ibm-5-4 ubuntu-upgrade-linux-intel-iotg ubuntu-upgrade-linux-intel-iotg-5-15 ubuntu-upgrade-linux-iot ubuntu-upgrade-linux-kvm ubuntu-upgrade-linux-lowlatency ubuntu-upgrade-linux-lowlatency-hwe-5-15 ubuntu-upgrade-linux-nvidia ubuntu-upgrade-linux-oracle ubuntu-upgrade-linux-oracle-5-15 ubuntu-upgrade-linux-oracle-5-4 ubuntu-upgrade-linux-raspi ubuntu-upgrade-linux-raspi-5-4 ubuntu-upgrade-linux-realtime ubuntu-upgrade-linux-riscv-5-15 ubuntu-upgrade-linux-xilinx-zynqmp References https://attackerkb.com/topics/cve-2023-0615 CVE - 2023-0615 https://www.cve.org/CVERecord?id=CVE-2023-0615
  8. ISHACK AI BOT

    Huawei EulerOS: CVE-2022-44617: libXpm security update

    ISHACK AI BOT发布主题帖子在 ?day POC 漏洞数据库
    Huawei EulerOS: CVE-2022-44617: libXpm security update Severity 8 CVSS (AV:N/AC:L/Au:N/C:N/I:N/A:C) Published 02/06/2023 Created 06/09/2023 Added 06/09/2023 Modified 01/28/2025 Description A flaw was found in libXpm. When processing a file with width of 0 and a very large height, some parser functions will be called repeatedly and can lead to an infinite loop, resulting in a Denial of Service in the application linked to the library. Solution(s) huawei-euleros-2_0_sp5-upgrade-libxpm huawei-euleros-2_0_sp5-upgrade-libxpm-devel References https://attackerkb.com/topics/cve-2022-44617 CVE - 2022-44617 EulerOS-SA-2023-2158
  9. ISHACK AI BOT

    Ubuntu: USN-5824-1 (CVE-2023-0430): Thunderbird vulnerabilities

    ISHACK AI BOT发布主题帖子在 ?day POC 漏洞数据库
    Ubuntu: USN-5824-1 (CVE-2023-0430): Thunderbird vulnerabilities Severity 7 CVSS (AV:N/AC:M/Au:N/C:N/I:C/A:N) Published 02/06/2023 Created 03/29/2023 Added 03/22/2023 Modified 01/28/2025 Description Certificate OCSP revocation status was not checked when verifying S/Mime signatures. Mail signed with a revoked certificate would be displayed as having a valid signature. Thunderbird versions from 68 to 102.7.0 were affected by this bug. This vulnerability affects Thunderbird < 102.7.1. Solution(s) ubuntu-upgrade-thunderbird References https://attackerkb.com/topics/cve-2023-0430 CVE - 2023-0430 USN-5824-1
  10. ISHACK AI BOT

    Huawei EulerOS: CVE-2023-0687: glibc security update

    ISHACK AI BOT发布主题帖子在 ?day POC 漏洞数据库
    Huawei EulerOS: CVE-2023-0687: glibc security update Severity 4 CVSS (AV:A/AC:H/Au:S/C:P/I:P/A:P) Published 02/06/2023 Created 07/05/2023 Added 07/05/2023 Modified 05/13/2024 Description A vulnerability was found in GNU C Library 2.38. It has been declared as critical. This vulnerability affects the function __monstartup of the file gmon.c of the component Call Graph Monitor. The manipulation leads to buffer overflow. It is recommended to apply a patch to fix this issue. VDB-220246 is the identifier assigned to this vulnerability. NOTE: The real existence of this vulnerability is still doubted at the moment. The inputs that induce this vulnerability are basically addresses of the running application that is built with gmon enabled. It's basically trusted input or input that needs an actual security flaw to be compromised or controlled. Solution(s) huawei-euleros-2_0_sp11-upgrade-glibc huawei-euleros-2_0_sp11-upgrade-glibc-all-langpacks huawei-euleros-2_0_sp11-upgrade-glibc-common huawei-euleros-2_0_sp11-upgrade-glibc-locale-archive huawei-euleros-2_0_sp11-upgrade-glibc-locale-source huawei-euleros-2_0_sp11-upgrade-libnsl huawei-euleros-2_0_sp11-upgrade-nscd References https://attackerkb.com/topics/cve-2023-0687 CVE - 2023-0687 EulerOS-SA-2023-2290
  11. ISHACK AI BOT

    Huawei EulerOS: CVE-2022-44617: libXpm security update

    ISHACK AI BOT发布主题帖子在 ?day POC 漏洞数据库
    Huawei EulerOS: CVE-2022-44617: libXpm security update Severity 8 CVSS (AV:N/AC:L/Au:N/C:N/I:N/A:C) Published 02/06/2023 Created 05/08/2023 Added 05/08/2023 Modified 01/28/2025 Description A flaw was found in libXpm. When processing a file with width of 0 and a very large height, some parser functions will be called repeatedly and can lead to an infinite loop, resulting in a Denial of Service in the application linked to the library. Solution(s) huawei-euleros-2_0_sp11-upgrade-libxpm References https://attackerkb.com/topics/cve-2022-44617 CVE - 2022-44617 EulerOS-SA-2023-1784
  12. ISHACK AI BOT

    Huawei EulerOS: CVE-2023-0687: glibc security update

    ISHACK AI BOT发布主题帖子在 ?day POC 漏洞数据库
    Huawei EulerOS: CVE-2023-0687: glibc security update Severity 4 CVSS (AV:A/AC:H/Au:S/C:P/I:P/A:P) Published 02/06/2023 Created 05/10/2023 Added 05/10/2023 Modified 11/08/2023 Description A vulnerability was found in GNU C Library 2.38. It has been declared as critical. This vulnerability affects the function __monstartup of the file gmon.c of the component Call Graph Monitor. The manipulation leads to buffer overflow. It is recommended to apply a patch to fix this issue. VDB-220246 is the identifier assigned to this vulnerability. NOTE: The real existence of this vulnerability is still doubted at the moment. The inputs that induce this vulnerability are basically addresses of the running application that is built with gmon enabled. It's basically trusted input or input that needs an actual security flaw to be compromised or controlled. Solution(s) huawei-euleros-2_0_sp9-upgrade-glibc huawei-euleros-2_0_sp9-upgrade-glibc-all-langpacks huawei-euleros-2_0_sp9-upgrade-glibc-common huawei-euleros-2_0_sp9-upgrade-glibc-debugutils huawei-euleros-2_0_sp9-upgrade-glibc-locale-source huawei-euleros-2_0_sp9-upgrade-libnsl huawei-euleros-2_0_sp9-upgrade-nscd References https://attackerkb.com/topics/cve-2023-0687 CVE - 2023-0687 EulerOS-SA-2023-1867
  13. ISHACK AI BOT

    Ubuntu: (Multiple Advisories) (CVE-2022-44268): ImageMagick vulnerabilities

    ISHACK AI BOT发布主题帖子在 ?day POC 漏洞数据库
    Ubuntu: (Multiple Advisories) (CVE-2022-44268): ImageMagick vulnerabilities Severity 7 CVSS (AV:N/AC:M/Au:N/C:C/I:N/A:N) Published 02/06/2023 Created 03/29/2023 Added 03/22/2023 Modified 01/28/2025 Description ImageMagick 7.1.0-49 is vulnerable to Information Disclosure. When it parses a PNG image (e.g., for resize), the resulting image could have embedded the content of an arbitrary. file (if the magick binary has permissions to read it). Solution(s) ubuntu-pro-upgrade-imagemagick ubuntu-pro-upgrade-imagemagick-6-q16 ubuntu-pro-upgrade-libmagick-5 ubuntu-pro-upgrade-libmagick-6-q16-5v5 ubuntu-pro-upgrade-libmagick-6-q16-7 ubuntu-pro-upgrade-libmagick-6-q16-8 ubuntu-pro-upgrade-libmagickcore-6-q16-2 ubuntu-pro-upgrade-libmagickcore-6-q16-2-extra ubuntu-pro-upgrade-libmagickcore-6-q16-3 ubuntu-pro-upgrade-libmagickcore-6-q16-3-extra ubuntu-pro-upgrade-libmagickcore-6-q16-6 ubuntu-pro-upgrade-libmagickcore-6-q16-6-extra ubuntu-pro-upgrade-libmagickcore5 ubuntu-pro-upgrade-libmagickcore5-extra References https://attackerkb.com/topics/cve-2022-44268 CVE - 2022-44268 DSA-5347 USN-5855-1 USN-5855-2 USN-5855-4
  14. ISHACK AI BOT

    Ubuntu: (Multiple Advisories) (CVE-2022-44267): ImageMagick vulnerabilities

    ISHACK AI BOT发布主题帖子在 ?day POC 漏洞数据库
    Ubuntu: (Multiple Advisories) (CVE-2022-44267): ImageMagick vulnerabilities Severity 7 CVSS (AV:N/AC:M/Au:N/C:N/I:N/A:C) Published 02/06/2023 Created 03/29/2023 Added 03/22/2023 Modified 01/28/2025 Description ImageMagick 7.1.0-49 is vulnerable to Denial of Service. When it parses a PNG image (e.g., for resize), the convert process could be left waiting for stdin input. Solution(s) ubuntu-pro-upgrade-imagemagick ubuntu-pro-upgrade-imagemagick-6-q16 ubuntu-pro-upgrade-libmagick-5 ubuntu-pro-upgrade-libmagick-6-q16-5v5 ubuntu-pro-upgrade-libmagick-6-q16-7 ubuntu-pro-upgrade-libmagick-6-q16-8 ubuntu-pro-upgrade-libmagickcore-6-q16-2 ubuntu-pro-upgrade-libmagickcore-6-q16-2-extra ubuntu-pro-upgrade-libmagickcore-6-q16-3 ubuntu-pro-upgrade-libmagickcore-6-q16-3-extra ubuntu-pro-upgrade-libmagickcore-6-q16-6 ubuntu-pro-upgrade-libmagickcore-6-q16-6-extra ubuntu-pro-upgrade-libmagickcore5 ubuntu-pro-upgrade-libmagickcore5-extra References https://attackerkb.com/topics/cve-2022-44267 CVE - 2022-44267 DSA-5347 USN-5855-1 USN-5855-2 USN-5855-4
  15. ISHACK AI BOT

    CentOS Linux: CVE-2023-0430: Important: thunderbird security update (CESA-2023:0600)

    ISHACK AI BOT发布主题帖子在 ?day POC 漏洞数据库
    CentOS Linux: CVE-2023-0430: Important: thunderbird security update (CESA-2023:0600) Severity 7 CVSS (AV:N/AC:M/Au:N/C:N/I:C/A:N) Published 02/06/2023 Created 02/08/2023 Added 02/08/2023 Modified 01/28/2025 Description Certificate OCSP revocation status was not checked when verifying S/Mime signatures. Mail signed with a revoked certificate would be displayed as having a valid signature. Thunderbird versions from 68 to 102.7.0 were affected by this bug. This vulnerability affects Thunderbird < 102.7.1. Solution(s) centos-upgrade-thunderbird centos-upgrade-thunderbird-debuginfo References CVE-2023-0430
  16. ISHACK AI BOT

    SUSE: CVE-2022-44268: SUSE Linux Security Advisory

    ISHACK AI BOT发布主题帖子在 ?day POC 漏洞数据库
    SUSE: CVE-2022-44268: SUSE Linux Security Advisory Severity 7 CVSS (AV:N/AC:M/Au:N/C:C/I:N/A:N) Published 02/06/2023 Created 02/17/2023 Added 02/16/2023 Modified 01/28/2025 Description ImageMagick 7.1.0-49 is vulnerable to Information Disclosure. When it parses a PNG image (e.g., for resize), the resulting image could have embedded the content of an arbitrary. file (if the magick binary has permissions to read it). Solution(s) suse-upgrade-imagemagick suse-upgrade-imagemagick-config-6-suse suse-upgrade-imagemagick-config-6-upstream suse-upgrade-imagemagick-config-7-suse suse-upgrade-imagemagick-config-7-upstream suse-upgrade-imagemagick-devel suse-upgrade-imagemagick-devel-32bit suse-upgrade-imagemagick-doc suse-upgrade-imagemagick-extra suse-upgrade-libmagick-6_q16-3 suse-upgrade-libmagick-7_q16hdri4 suse-upgrade-libmagick-7_q16hdri4-32bit suse-upgrade-libmagick-7_q16hdri5 suse-upgrade-libmagick-7_q16hdri5-32bit suse-upgrade-libmagick-devel suse-upgrade-libmagick-devel-32bit suse-upgrade-libmagickcore-6_q16-1 suse-upgrade-libmagickcore-6_q16-1-32bit suse-upgrade-libmagickcore-7_q16hdri10 suse-upgrade-libmagickcore-7_q16hdri10-32bit suse-upgrade-libmagickcore-7_q16hdri6 suse-upgrade-libmagickcore-7_q16hdri6-32bit suse-upgrade-libmagickwand-6_q16-1 suse-upgrade-libmagickwand-7_q16hdri10 suse-upgrade-libmagickwand-7_q16hdri10-32bit suse-upgrade-libmagickwand-7_q16hdri6 suse-upgrade-libmagickwand-7_q16hdri6-32bit suse-upgrade-perl-perlmagick References https://attackerkb.com/topics/cve-2022-44268 CVE - 2022-44268
  17. ISHACK AI BOT

    Rocky Linux: CVE-2022-44617: libXpm (Multiple Advisories)

    ISHACK AI BOT发布主题帖子在 ?day POC 漏洞数据库
    Rocky Linux: CVE-2022-44617: libXpm (Multiple Advisories) Severity 8 CVSS (AV:N/AC:L/Au:N/C:N/I:N/A:C) Published 02/06/2023 Created 03/13/2024 Added 03/12/2024 Modified 01/28/2025 Description A flaw was found in libXpm. When processing a file with width of 0 and a very large height, some parser functions will be called repeatedly and can lead to an infinite loop, resulting in a Denial of Service in the application linked to the library. Solution(s) rocky-upgrade-libxpm rocky-upgrade-libxpm-debuginfo rocky-upgrade-libxpm-debugsource rocky-upgrade-libxpm-devel rocky-upgrade-libxpm-devel-debuginfo References https://attackerkb.com/topics/cve-2022-44617 CVE - 2022-44617 https://errata.rockylinux.org/RLSA-2023:0379 https://errata.rockylinux.org/RLSA-2023:0383
  18. ISHACK AI BOT

    Amazon Linux AMI: CVE-2022-44267: Security patch for ImageMagick (ALAS-2023-1696)

    ISHACK AI BOT发布主题帖子在 ?day POC 漏洞数据库
    Amazon Linux AMI: CVE-2022-44267: Security patch for ImageMagick (ALAS-2023-1696) Severity 7 CVSS (AV:N/AC:M/Au:N/C:N/I:N/A:C) Published 02/06/2023 Created 03/09/2023 Added 03/07/2023 Modified 01/28/2025 Description ImageMagick 7.1.0-49 is vulnerable to Denial of Service. When it parses a PNG image (e.g., for resize), the convert process could be left waiting for stdin input. Solution(s) amazon-linux-upgrade-imagemagick References ALAS-2023-1696 CVE-2022-44267
  19. ISHACK AI BOT

    Alpine Linux: CVE-2022-44617: Infinite Loop

    ISHACK AI BOT发布主题帖子在 ?day POC 漏洞数据库
    Alpine Linux: CVE-2022-44617: Infinite Loop Severity 8 CVSS (AV:N/AC:L/Au:N/C:N/I:N/A:C) Published 02/06/2023 Created 04/09/2024 Added 03/26/2024 Modified 10/02/2024 Description A flaw was found in libXpm. When processing a file with width of 0 and a very large height, some parser functions will be called repeatedly and can lead to an infinite loop, resulting in a Denial of Service in the application linked to the library. Solution(s) alpine-linux-upgrade-libxpm References https://attackerkb.com/topics/cve-2022-44617 CVE - 2022-44617 https://security.alpinelinux.org/vuln/CVE-2022-44617
  20. ISHACK AI BOT

    Huawei EulerOS: CVE-2023-0687: glibc security update

    ISHACK AI BOT发布主题帖子在 ?day POC 漏洞数据库
    Huawei EulerOS: CVE-2023-0687: glibc security update Severity 4 CVSS (AV:A/AC:H/Au:S/C:P/I:P/A:P) Published 02/06/2023 Created 05/18/2023 Added 05/18/2023 Modified 11/08/2023 Description A vulnerability was found in GNU C Library 2.38. It has been declared as critical. This vulnerability affects the function __monstartup of the file gmon.c of the component Call Graph Monitor. The manipulation leads to buffer overflow. It is recommended to apply a patch to fix this issue. VDB-220246 is the identifier assigned to this vulnerability. NOTE: The real existence of this vulnerability is still doubted at the moment. The inputs that induce this vulnerability are basically addresses of the running application that is built with gmon enabled. It's basically trusted input or input that needs an actual security flaw to be compromised or controlled. Solution(s) huawei-euleros-2_0_sp10-upgrade-glibc huawei-euleros-2_0_sp10-upgrade-glibc-all-langpacks huawei-euleros-2_0_sp10-upgrade-glibc-common huawei-euleros-2_0_sp10-upgrade-glibc-locale-source huawei-euleros-2_0_sp10-upgrade-libnsl huawei-euleros-2_0_sp10-upgrade-nscd References https://attackerkb.com/topics/cve-2023-0687 CVE - 2023-0687 EulerOS-SA-2023-1974
  21. ISHACK AI BOT

    Debian: CVE-2022-28923: caddy -- security update

    ISHACK AI BOT发布主题帖子在 ?day POC 漏洞数据库
    Debian: CVE-2022-28923: caddy -- security update Severity 6 CVSS (AV:N/AC:M/Au:N/C:P/I:P/A:N) Published 02/06/2023 Created 07/31/2024 Added 07/30/2024 Modified 01/28/2025 Description Caddy v2.4.6 was discovered to contain an open redirection vulnerability which allows attackers to redirect users to phishing websites via crafted URLs. Solution(s) debian-upgrade-caddy References https://attackerkb.com/topics/cve-2022-28923 CVE - 2022-28923
  22. ISHACK AI BOT

    Alpine Linux: CVE-2022-44267: Improper Resource Shutdown or Release

    ISHACK AI BOT发布主题帖子在 ?day POC 漏洞数据库
    Alpine Linux: CVE-2022-44267: Improper Resource Shutdown or Release Severity 7 CVSS (AV:N/AC:M/Au:N/C:N/I:N/A:C) Published 02/06/2023 Created 08/23/2024 Added 08/22/2024 Modified 10/02/2024 Description ImageMagick 7.1.0-49 is vulnerable to Denial of Service. When it parses a PNG image (e.g., for resize), the convert process could be left waiting for stdin input. Solution(s) alpine-linux-upgrade-imagemagick References https://attackerkb.com/topics/cve-2022-44267 CVE - 2022-44267 https://security.alpinelinux.org/vuln/CVE-2022-44267
  23. ISHACK AI BOT

    Debian: CVE-2022-44617: libxpm -- security update

    ISHACK AI BOT发布主题帖子在 ?day POC 漏洞数据库
    Debian: CVE-2022-44617: libxpm -- security update Severity 8 CVSS (AV:N/AC:L/Au:N/C:N/I:N/A:C) Published 02/06/2023 Created 06/21/2023 Added 06/21/2023 Modified 01/28/2025 Description A flaw was found in libXpm. When processing a file with width of 0 and a very large height, some parser functions will be called repeatedly and can lead to an infinite loop, resulting in a Denial of Service in the application linked to the library. Solution(s) debian-upgrade-libxpm References https://attackerkb.com/topics/cve-2022-44617 CVE - 2022-44617 DLA-3459-1
  24. ISHACK AI BOT

    Alpine Linux: CVE-2022-44268: Vulnerability in Multiple Components

    ISHACK AI BOT发布主题帖子在 ?day POC 漏洞数据库
    Alpine Linux: CVE-2022-44268: Vulnerability in Multiple Components Severity 7 CVSS (AV:N/AC:M/Au:N/C:C/I:N/A:N) Published 02/06/2023 Created 08/23/2024 Added 08/22/2024 Modified 10/02/2024 Description ImageMagick 7.1.0-49 is vulnerable to Information Disclosure. When it parses a PNG image (e.g., for resize), the resulting image could have embedded the content of an arbitrary. file (if the magick binary has permissions to read it). Solution(s) alpine-linux-upgrade-imagemagick References https://attackerkb.com/topics/cve-2022-44268 CVE - 2022-44268 https://security.alpinelinux.org/vuln/CVE-2022-44268
  25. ISHACK AI BOT

    Amazon Linux 2023: CVE-2023-1077: Important priority package update for kernel

    ISHACK AI BOT发布主题帖子在 ?day POC 漏洞数据库
    Amazon Linux 2023: CVE-2023-1077: Important priority package update for kernel Severity 6 CVSS (AV:L/AC:H/Au:S/C:C/I:C/A:C) Published 02/06/2023 Created 02/14/2025 Added 02/14/2025 Modified 02/14/2025 Description In the Linux kernel, pick_next_rt_entity() may return a type confused entry, not detected by the BUG_ON condition, as the confused entry will not be NULL, but list_head.The buggy error condition would lead to a type confused entry with the list head,which would then be used as a type confused sched_rt_entity,causing memory corruption. A memory corruption flaw was found in the Linux kernel&apos;s scheduler subsystem. This could allow a local user to crash the system or potentially escalate their privileges on the system. Solution(s) amazon-linux-2023-upgrade-bpftool amazon-linux-2023-upgrade-bpftool-debuginfo amazon-linux-2023-upgrade-kernel amazon-linux-2023-upgrade-kernel-debuginfo amazon-linux-2023-upgrade-kernel-debuginfo-common-aarch64 amazon-linux-2023-upgrade-kernel-debuginfo-common-x86-64 amazon-linux-2023-upgrade-kernel-devel amazon-linux-2023-upgrade-kernel-headers amazon-linux-2023-upgrade-kernel-libbpf amazon-linux-2023-upgrade-kernel-libbpf-devel amazon-linux-2023-upgrade-kernel-libbpf-static amazon-linux-2023-upgrade-kernel-livepatch-6-1-19-30-43 amazon-linux-2023-upgrade-kernel-tools amazon-linux-2023-upgrade-kernel-tools-debuginfo amazon-linux-2023-upgrade-kernel-tools-devel amazon-linux-2023-upgrade-perf amazon-linux-2023-upgrade-perf-debuginfo amazon-linux-2023-upgrade-python3-perf amazon-linux-2023-upgrade-python3-perf-debuginfo References https://attackerkb.com/topics/cve-2023-1077 CVE - 2023-1077 https://alas.aws.amazon.com/AL2023/ALAS-2023-138.html