Updated by CVEDB-BOT 🤖

CVELab · Feb 9, 2025 · ae78236 · ae78236
1 parent 286333c
commit ae78236
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 1 deletion.
diff --git a/db/cve.sqlite b/db/cve.sqlite
diff --git a/docs/README.md b/docs/README.md
@@ -2,7 +2,7 @@
 
 > Automatic monitor github cve using Github Actions 
 
- Last generated : 2025-02-09 16:25:34.779898
+ Last generated : 2025-02-09 17:19:24.005531
 
 | CVE | Name | Description | Date |
 |---|---|---|---|
@@ -1374,6 +1374,7 @@
 | [CVE-2024-36401](https://www.cve.org/CVERecord?id=CVE-2024-36401) | [thestar0/CVE-2024-36401-WoodpeckerPlugin](https://github.com/thestar0/CVE-2024-36401-WoodpeckerPlugin) | CVE-2024-36401-GeoServer Property 表达式注入 Rce woodpecker-framework 插件 | 2024-11-22T03:57:12Z|
 | [CVE-2024-36401](https://www.cve.org/CVERecord?id=CVE-2024-36401) | [XiaomingX/CVE-2024-36401-poc](https://github.com/XiaomingX/CVE-2024-36401-poc) | CVE-2024-36401是GeoServer中的一个高危远程代码执行漏洞。GeoServer是一款开源的地理数据服务器软件，主要用于发布、共享和处理各种地理空间数据。  ALIYUN  漏洞原理： 该漏洞源于GeoServer在处理属性名称时，将其不安全地解析为XPath表达式。具体而言，GeoServer调用的GeoTools库API在评估要素类型的属性名称时，以不安全的方式将其传递给commons-jxpath库。由于commons-jxpath库在解析XPath表达式时允许执行任意代码，攻击者可以通过构造特定的输入，利用多个OGC请求参数（如WFS GetFeature、WFS GetPropertyValue、WMS GetMap等），在未经身份验证的情况下远程执行任意代码。 | 2024-11-22T14:21:53Z|
 | [CVE-2024-36401](https://www.cve.org/CVERecord?id=CVE-2024-36401) | [0x0d3ad/CVE-2024-36401](https://github.com/0x0d3ad/CVE-2024-36401) | CVE-2024-36401 GeoServer Remote Code Execution | 2024-11-27T19:13:49Z|
+| [CVE-2024-36401](https://www.cve.org/CVERecord?id=CVE-2024-36401) | [wellwornele/CVE-2024-36401](https://github.com/wellwornele/CVE-2024-36401) | geoserver图形化漏洞利用工具 | 2025-02-09T17:11:49Z|
 | [CVE-2024-36117](https://www.cve.org/CVERecord?id=CVE-2024-36117) | [saketh-osmsec/CVE-2024-36117](https://github.com/saketh-osmsec/CVE-2024-36117) | no description | 2024-12-13T07:23:35Z|
 | [CVE-2024-36104](https://www.cve.org/CVERecord?id=CVE-2024-36104) | [ggfzx/CVE-2024-36104](https://github.com/ggfzx/CVE-2024-36104) | no description | 2024-06-17T07:57:58Z|
 | [CVE-2024-36079](https://www.cve.org/CVERecord?id=CVE-2024-36079) | [DxRvs/vaultize_CVE-2024-36079](https://github.com/DxRvs/vaultize_CVE-2024-36079) | no description | 2024-05-20T22:07:41Z|