{"metadata": {"vulnerability": "CVE-2024-40800", "count": 33, "kinds": {"milestone": 8, "sighting": 2, "kev": 0, "other": 23}}, "data": [{"timestamp": "2024-07-10T17:11:04.691Z", "date_only": false, "value": "2024-07-10T17:11:04.691Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2024-40800", "field": "cveMetadata.dateReserved"}, {"timestamp": "2024-07-29T00:00:00Z", "date_only": true, "value": "2024-07-29", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2024-AVI-0634", "record": "CERTFR-2024-AVI-0634", "field": "vendor_advisories.0.published_at"}, {"timestamp": "2024-07-29T22:00:00Z", "date_only": false, "value": "2024-07-29T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2024-1725", "record": "WID-SEC-W-2024-1725", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2024-07-29T22:00:00Z", "date_only": false, "value": "2024-07-29T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2024-1725", "record": "WID-SEC-W-2024-1725", "field": "document.tracking.initial_release_date"}, {"timestamp": "2024-07-29T22:00:00Z", "date_only": false, "value": "2024-07-29T22:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2024-1725", "record": "WID-SEC-W-2024-1725", "field": "vulnerabilities.0.release_date"}, {"timestamp": "2024-07-29T22:16:43.666Z", "date_only": false, "value": "2024-07-29T22:16:43.666Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2024-40800", "field": "cveMetadata.datePublished"}, {"timestamp": "2024-07-29T23:15:12Z", "date_only": false, "value": "2024-07-29T23:15:12Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-FC8M-X59C-5F6R", "record": "GHSA-FC8M-X59C-5F6R", "field": "database_specific.nvd_published_at"}, {"timestamp": "2024-07-29T23:15:12.743Z", "date_only": false, "value": "2024-07-29T23:15:12.743", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2024-40800", "record": "FKIE_CVE-2024-40800", "field": "published"}, {"timestamp": "2024-07-29T23:55:39.385Z", "date_only": false, "value": "2024-07-29T23:55:39.385736Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2024-40800", "field": "containers.adp.0.metrics.1.other.content.timestamp"}, {"timestamp": "2024-07-29T23:55:39.385Z", "date_only": false, "value": "2024-07-29T23:55:39.385736Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2024-40800", "record": "FKIE_CVE-2024-40800", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2024-07-30T00:00:00Z", "date_only": false, "value": "2024-07-30T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2024-AVI-0634", "record": "CERTFR-2024-AVI-0634", "field": "last_revision_date"}, {"timestamp": "2024-07-30T00:00:00Z", "date_only": false, "value": "2024-07-30T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2024-AVI-0634", "record": "CERTFR-2024-AVI-0634", "field": "initial_release_date"}, {"timestamp": "2024-07-30T00:00:00Z", "date_only": false, "value": "2024-07-30T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2024-AVI-0634", "record": "CERTFR-2024-AVI-0634", "field": "revisions.0.revision_date"}, {"timestamp": "2024-07-30T00:34:27Z", "date_only": false, "value": "2024-07-30T00:34:27Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-FC8M-X59C-5F6R", "record": "GHSA-FC8M-X59C-5F6R", "field": "published"}, {"timestamp": "2024-07-30T08:42:07.365Z", "date_only": false, "value": "2024-07-30T08:42:07.365674Z", "kind": "other", "label": "Advisory revision", "source": "csaf_ncscnl \u00b7 NCSC-2024-0320", "record": "NCSC-2024-0320", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2024-07-30T08:42:07.365Z", "date_only": false, "value": "2024-07-30T08:42:07.365674Z", "kind": "milestone", "label": "Published", "source": "csaf_ncscnl \u00b7 NCSC-2024-0320", "record": "NCSC-2024-0320", "field": "document.tracking.initial_release_date"}, {"timestamp": "2024-07-30T08:42:07.365Z", "date_only": false, "value": "2024-07-30T08:42:07.365674Z", "kind": "other", "label": "Updated", "source": "csaf_ncscnl \u00b7 NCSC-2024-0320", "record": "NCSC-2024-0320", "field": "document.tracking.current_release_date"}, {"timestamp": "2024-07-30T14:20:48.662Z", "date_only": false, "value": "2024-07-30T14:20:48.662Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2024-40800", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2024-08-14T03:55:57Z", "date_only": false, "value": "2024-08-14T03:55:57.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/ToCf6YsGId5JUWGMj9DuepDPCX4Mci4i8uh8beEPrs42uuDN", "record": "CVE-2024-40800", "field": "creation_timestamp", "uuid": "a6fb41c1-8c7c-44a1-9ec8-e4ccd6d2bb05"}, {"timestamp": "2024-10-15T22:00:00Z", "date_only": false, "value": "2024-10-15T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2024-1725", "record": "WID-SEC-W-2024-1725", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2024-11-20T23:00:00Z", "date_only": false, "value": "2024-11-20T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2024-1725", "record": "WID-SEC-W-2024-1725", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2024-12-13T19:00:23Z", "date_only": false, "value": "2024-12-13T19:00:23.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/cyber_hsecurity/1614", "record": "CVE-2024-40800", "field": "creation_timestamp", "uuid": "98d7785e-8339-4ed2-9fb8-6d5d81c7b333", "content": "function displayMessage(userInput) {\n    document.getElementById('message').innerHTML = userInput;\n}\n#### \u0643\u064a\u0641\u064a\u0629 \u0627\u0643\u062a\u0634\u0627\u0641 \u062b\u063a\u0631\u0629 XSS:\n1. \u062a\u062d\u0644\u064a\u0644 \u0627\u0644\u0643\u0648\u062f: \u0627\u0628\u062d\u062b \u0639\u0646 \u0627\u0644\u0623\u0645\u0627\u0643\u0646 \u0627\u0644\u062a\u064a \u064a\u062a\u0645 \u0641\u064a\u0647\u0627 \u0639\u0631\u0636 \u0645\u062f\u062e\u0644\u0627\u062a \u0627\u0644\u0645\u0633\u062a\u062e\u062f\u0645 \u062f\u0648\u0646 \u062a\u0646\u0642\u064a\u0629 (Sanitization).\n2. \u0627\u062e\u062a\u0628\u0627\u0631 \u0627\u0644\u0645\u062f\u062e\u0644\u0627\u062a: \u062d\u0627\u0648\u0644 \u0625\u062f\u062e\u0627\u0644 \u0634\u064a\u0641\u0631\u0629 JavaScript \u0641\u064a \u0627\u0644\u062d\u0642\u0648\u0644 \u0627\u0644\u062a\u064a \u062a\u0642\u0628\u0644 \u0645\u062f\u062e\u0644\u0627\u062a \u0627\u0644\u0645\u0633\u062a\u062e\u062f\u0645.\n\n#### \u0645\u062b\u0627\u0644 \u0639\u0645\u0644\u064a:\n\u0644\u0646\u0641\u062a\u0631\u0636 \u0623\u0646 \u0644\u062f\u064a\u0643 \u062d\u0642\u0644 \u0625\u062f\u062e\u0627\u0644 \u0641\u064a \u062a\u0637\u0628\u064a\u0642 kafka-ui \u064a\u0642\u0628\u0644 \u0645\u062f\u062e\u0644\u0627\u062a \u0627\u0644\u0645\u0633\u062a\u062e\u062f\u0645. \u064a\u0645\u0643\u0646 \u0627\u062e\u062a\u0628\u0627\u0631 \u0627\u0644\u062b\u063a\u0631\u0629 \u0639\u0628\u0631 \u0625\u062f\u062e\u0627\u0644 \u0634\u064a\u0641\u0631\u0629 JavaScript \u0628\u0633\u064a\u0637\u0629 \u0645\u062b\u0644:\nalert('XSS');\n\u0625\u0630\u0627 \u062a\u0645 \u0639\u0631\u0636 \u0627\u0644\u0631\u0633\u0627\u0644\u0629 \u0641\u064a \u0627\u0644\u0645\u062a\u0635\u0641\u062d\u060c \u0641\u0647\u0630\u0627 \u064a\u0639\u0646\u064a \u0623\u0646 \u0627\u0644\u062a\u0637\u0628\u064a\u0642 \u0639\u0631\u0636 \u0627\u0644\u0645\u062f\u062e\u0644\u0627\u062a \u062f\u0648\u0646 \u062a\u0646\u0642\u064a\u0629\u060c \u0645\u0645\u0627 \u064a\u0624\u0643\u062f \u0648\u062c\u0648\u062f \u062b\u063a\u0631\u0629 XSS.\n\n#### \u0643\u064a\u0641\u064a\u0629 \u0627\u0644\u0625\u0635\u0644\u0627\u062d:\n1. \u062a\u0646\u0642\u064a\u0629 \u0627\u0644\u0645\u062f\u062e\u0644\u0627\u062a: \u062a\u0623\u0643\u062f \u0645\u0646 \u062a\u0646\u0642\u064a\u0629 \u0643\u0627\u0641\u0629 \u0627\u0644\u0645\u062f\u062e\u0644\u0627\u062a \u0627\u0644\u062a\u064a \u064a\u062a\u0645 \u0639\u0631\u0636\u0647\u0627 \u0641\u064a \u0627\u0644\u0645\u062a\u0635\u0641\u062d.\n2. \u0627\u0633\u062a\u062e\u062f\u0627\u0645 \u0645\u0643\u062a\u0628\u0627\u062a \u0623\u0645\u0627\u0646: \u0645\u062b\u0644 DOMPurify \u0644\u062a\u0646\u0642\u064a\u0629 \u0627\u0644\u0645\u062f\u062e\u0644\u0627\u062a.\n\n\u0645\u062b\u0627\u0644 \u0639\u0644\u0649 \u0627\u0644\u0625\u0635\u0644\u0627\u062d \u0628\u0627\u0633\u062a\u062e\u062f\u0627\u0645 DOMPurify:\nfunction displayMessage(userInput) {\n    const sanitizedInput = DOMPurify.sanitize(userInput);\n    document.getElementById('message').innerHTML = sanitizedInput;\n}\n### GHSL-2023-230: \u062b\u063a\u0631\u0629 \u0623\u062e\u0631\u0649\n\u0628\u062f\u0648\u0646 \u062a\u0641\u0627\u0635\u064a\u0644 \u0625\u0636\u0627\u0641\u064a\u0629\u060c \u0645\u0646 \u0627\u0644\u0635\u0639\u0628 \u062a\u062d\u062f\u064a\u062f \u0646\u0648\u0639 \u0627\u0644\u062b\u063a\u0631\u0629. \u0644\u0643\u0646 \u064a\u0645\u0643\u0646 \u0627\u062a\u0628\u0627\u0639 \u0627\u0644\u062e\u0637\u0648\u0627\u062a \u0627\u0644\u0639\u0627\u0645\u0629 \u0644\u0627\u0643\u062a\u0634\u0627\u0641 \u0627\u0644\u062b\u063a\u0631\u0627\u062a \u0627\u0644\u0623\u0645\u0646\u064a\u0629:\n\n#### \u0627\u0644\u0637\u0631\u064a\u0642\u0629 \u0627\u0644\u0636\u0639\u064a\u0641\u0629 (Vulnerable method):\n\u0644\u0646\u0641\u062a\u0631\u0636 \u0623\u0646 \u0644\u062f\u064a\u0646\u0627 \u0637\u0631\u064a\u0642\u0629 \u062a\u062a\u0639\u0627\u0645\u0644 \u0645\u0639 \u0645\u062f\u062e\u0644\u0627\u062a \u0627\u0644\u0645\u0633\u062a\u062e\u062f\u0645 \u0641\u064a \u0627\u0633\u062a\u0639\u0644\u0627\u0645 SQL \u062f\u0648\u0646 \u062a\u0646\u0642\u064a\u0629:\n\nString query = \"SELECT * FROM users WHERE username = '\" + userInput + \"'\";\n#### \u0643\u064a\u0641\u064a\u0629 \u0627\u0643\u062a\u0634\u0627\u0641 \u0627\u0644\u062b\u063a\u0631\u0629:\n1. \u0645\u0631\u0627\u062c\u0639\u0629 \u0627\u0644\u0643\u0648\u062f: \u0627\u0628\u062d\u062b \u0639\u0646 \u0627\u0644\u0623\u0645\u0627\u0643\u0646 \u0627\u0644\u062a\u064a \u0642\u062f \u062a\u062d\u062a\u0648\u064a \u0639\u0644\u0649 \u062b\u063a\u0631\u0627\u062a \u0645\u062b\u0644 SQL Injection\u060c CSRF\u060c \u0648\u063a\u064a\u0631\u0647\u0627.\n2. \u0627\u062e\u062a\u0628\u0627\u0631 \u0627\u0644\u0623\u0645\u0627\u0646: \u0627\u0633\u062a\u062e\u062f\u0645 \u0623\u062f\u0648\u0627\u062a \u0645\u062b\u0644 OWASP ZAP \u0623\u0648 Burp Suite \u0644\u0625\u062c\u0631\u0627\u0621 \u0627\u062e\u062a\u0628\u0627\u0631\u0627\u062a \u0623\u0645\u0627\u0646 \u0634\u0627\u0645\u0644\u0629.\n\n#### \u0645\u062b\u0627\u0644 \u0639\u0645\u0644\u064a:\n\u062d\u0627\u0648\u0644 \u0625\u062f\u062e\u0627\u0644 \u0634\u064a\u0641\u0631\u0629 \u0636\u0627\u0631\u0629 \u0641\u064a \u062d\u0642\u0644 \u0627\u0644\u0625\u062f\u062e\u0627\u0644 \u0644\u0627\u062e\u062a\u0628\u0627\u0631 \u0627\u0633\u062a\u0639\u0644\u0627\u0645 SQL Injection:\n' OR '1'='1\n\u0625\u0630\u0627 \u062a\u0645 \u062a\u0646\u0641\u064a\u0630 \u0627\u0644\u0627\u0633\u062a\u0639\u0644\u0627\u0645 \u0628\u0646\u062c\u0627\u062d \u0648\u0639\u0631\u0636 \u0643\u0627\u0641\u0629 \u0627\u0644\u0645\u0633\u062a\u062e\u062f\u0645\u064a\u0646\u060c \u0641\u0647\u0630\u0627 \u064a\u0639\u0646\u064a \u0623\u0646 \u0627\u0644\u062a\u0637\u0628\u064a\u0642 \u0639\u0631\u0636 \u0627\u0644\u0645\u062f\u062e\u0644\u0627\u062a \u062f\u0648\u0646 \u062a\u0646\u0642\u064a\u0629\u060c \u0645\u0645\u0627 \u064a\u0624\u0643\u062f \u0648\u062c\u0648\u062f \u062b\u063a\u0631\u0629 SQL Injection.\n\n#### \u0643\u064a\u0641\u064a\u0629 \u0627\u0644\u0625\u0635\u0644\u0627\u062d:\n1. \u0627\u0633\u062a\u062e\u062f\u0627\u0645 \u0627\u0633\u062a\u0639\u0644\u0627\u0645\u0627\u062a \u0645\u062d\u0636\u0631\u0629 (Prepared Statements): \u062a\u0623\u0643\u062f \u0645\u0646 \u0627\u0633\u062a\u062e\u062f\u0627\u0645 \u0627\u0633\u062a\u0639\u0644\u0627\u0645\u0627\u062a \u0645\u062d\u0636\u0631\u0629 \u0644\u0644\u062a\u0639\u0627\u0645\u0644 \u0645\u0639 \u0645\u062f\u062e\u0644\u0627\u062a \u0627\u0644\u0645\u0633\u062a\u062e\u062f\u0645.\n\n\u0645\u062b\u0627\u0644 \u0639\u0644\u0649 \u0627\u0644\u0625\u0635\u0644\u0627\u062d \u0628\u0627\u0633\u062a\u062e\u062f\u0627\u0645 \u0627\u0633\u062a\u0639\u0644\u0627\u0645 \u0645\u062d\u0636\u0631:\nString query = \"SELECT * FROM users WHERE username = ?\";\nPreparedStatement stmt = connection.prepareStatement(query);\nstmt.setString(1, userInput);\nResultSet rs = stmt.executeQuery();\n### \u0623\u062f\u0648\u0627\u062a \u0645\u0641\u064a\u062f\u0629:\n- OWASP ZAP: \u0623\u062f\u0627\u0629 \u0645\u0641\u062a\u0648\u062d\u0629 \u0627\u0644\u0645\u0635\u062f\u0631 \u0644\u0627\u062e\u062a\u0628\u0627\u0631 \u0623\u0645\u0627\u0646 \u0627\u0644\u062a\u0637\u0628\u064a\u0642\u0627\u062a.\n- Burp Suite: \u0623\u062f\u0627\u0629 \u0645\u0647\u0646\u064a\u0629 \u0644\u0627\u062e\u062a\u0628\u0627\u0631 \u0623\u0645\u0627\u0646 \u0627\u0644\u062a\u0637\u0628\u064a\u0642\u0627\u062a.\n\nALSED404:\n\u0643\u0634\u0641\u062a \u0634\u0631\u0643\u0629 \u0645\u0627\u064a\u0643\u0631\u0648\u0633\u0648\u0641\u062a \u0639\u0646 \u0623\u0631\u0628\u0639 \u062b\u063a\u0631\u0627\u062a \u0623\u0645\u0646\u064a\u0629 \u0641\u064a OpenVPN \u0648\u0627\u0644\u062a\u064a \u064a\u0645\u0643\u0646 \u0631\u0628\u0637\u0647\u0627 \u0644\u062a\u0645\u0643\u064a\u0646 RCE \u0648\u062a\u0635\u0639\u064a\u062f \u0627\u0644\u0627\u0645\u062a\u064a\u0627\u0632\u0627\u062a \u0627\u0644\u0645\u062d\u0644\u064a\u0629.\n\n\u064a\u0645\u0643\u0646 \u0623\u0646 \u062a\u0624\u062f\u064a \u0647\u0630\u0647 \u0627\u0644\u062b\u063a\u0631\u0627\u062a \u0627\u0644\u0623\u0645\u0646\u064a\u0629 \u0625\u0644\u0649 \u0627\u0644\u062a\u062d\u0643\u0645 \u0627\u0644\u0643\u0627\u0645\u0644 \u0641\u064a \u0646\u0642\u0627\u0637 \u0627\u0644\u0646\u0647\u0627\u064a\u0629 \u0627\u0644\u0645\u0633\u062a\u0647\u062f\u0641\u0629\u060c \u0645\u0645\u0627 \u064a\u0639\u0631\u0636 \u0627\u0644\u0628\u064a\u0627\u0646\u0627\u062a \u0644\u0644\u062e\u0637\u0631 \u0648\u064a\u0639\u0631\u0636 \u0627\u0644\u0646\u0638\u0627\u0645 \u0644\u0644\u062e\u0637\u0631.\n\u0627\u0642\u0631\u0623: https://thehackernews.com/2024/08/microsoft-reveals-four-openvpn-flaws.html\n\nThe Smart Shadow:\n---\n\n\ud83d\udea8 CVE-2024-40800\n\n\u062a\u0645 \u0645\u0639\u0627\u0644\u062c\u0629 \u0645\u0634\u0643\u0644\u0629 \u0641\u064a \u0627\u0644\u062a\u062d\u0642\u0642 \u0645\u0646 \u0635\u062d\u0629 \u0627\u0644\u0645\u062f\u062e\u0644\u0627\u062a \u0645\u0646 \u062e\u0644\u0627\u0644 \u062a\u062d\u0633\u064a\u0646 \u0639\u0645\u0644\u064a\u0629 \u0627\u0644\u062a\u062d\u0642\u0642 \u0645\u0646 \u0635\u062d\u0629 \u0627\u0644\u0645\u062f\u062e\u0644\u0627\u062a. \u0647\u0630\u0647 \u0627\u0644\u0645\u0634\u0643\u0644\u0629 \u062a\u0645 \u0625\u0635\u0644\u0627\u062d\u0647\u0627 \u0641\u064a \u0627\u0644\u0625\u0635\u062f\u0627\u0631\u0627\u062a \u0627\u0644\u062a\u0627\u0644\u064a\u0629:\n- macOS Sonoma 14.6\n- macOS Monterey 12.7.6\n- macOS Ventura 13.6.8\n\n\ud83d\udd0d \u062a\u0641\u0627\u0635\u064a\u0644 \u0627\u0644\u062b\u063a\u0631\u0629:\n\u0647\u0630\u0647 \u0627\u0644\u062b\u063a\u0631\u0629 \u062a\u062a\u0639\u0644\u0642 \u0628\u0645\u0634\u0643\u0644\u0629 \u0641\u064a \u0627\u0644\u062a\u062d\u0642\u0642 \u0645\u0646 \u0635\u062d\u0629 \u0627\u0644\u0645\u062f\u062e\u0644\u0627\u062a\u060c \u0645\u0645\u0627 \u0642\u062f \u064a\u0633\u0645\u062d \u0644\u062a\u0637\u0628\u064a\u0642 \u063a\u064a\u0631 \u0645\u0635\u0631\u062d \u0644\u0647 \u0628\u062a\u0639\u062f\u064a\u0644 \u0623\u062c\u0632\u0627\u0621 \u0645\u062d\u0645\u064a\u0629 \u0645\u0646 \u0646\u0638\u0627\u0645 \u0627\u0644\u0645\u0644\u0641\u0627\u062a. \u0647\u0630\u0627 \u064a\u0645\u0643\u0646 \u0623\u0646 \u064a\u0624\u062f\u064a \u0625\u0644\u0649 \u062a\u0639\u062f\u064a\u0644\u0627\u062a \u063a\u064a\u0631 \u0645\u0635\u0631\u062d \u0628\u0647\u0627 \u0639\u0644\u0649 \u0627\u0644\u0646\u0638\u0627\u0645\u060c \u0645\u0645\u0627 \u064a\u0634\u0643\u0644 \u062e\u0637\u0631\u064b\u0627 \u0623\u0645\u0646\u064a\u064b\u0627 \u0643\u0628\u064a\u0631\u064b\u0627.\n\n\ud83d\udcc5 \u062a\u0627\u0631\u064a\u062e \u0627\u0644\u0625\u0635\u062f\u0627\u0631:\n\u062a\u0645 \u0646\u0634\u0631 \u062a\u0641\u0627\u0635\u064a\u0644 \u0647\u0630\u0647 \u0627\u0644\u062b\u063a\u0631\u0629 \u0641\u064a \u064a\u0648\u0644\u064a\u0648 2024 \u0639\u0644\u0649 \u0645\u0648\u0642\u0639 Full Disclosure\u060c \u0648\u0647\u0648 \u0645\u0635\u062f\u0631 \u0645\u0639\u0631\u0648\u0641 \u0628\u0646\u0634\u0631 \u0645\u0639\u0644\u0648\u0645\u0627\u062a \u062d\u0648\u0644 \u0627\u0644\u062b\u063a\u0631\u0627\u062a \u0627\u0644\u0623\u0645\u0646\u064a\u0629.\n\n\ud83d\udd12 \u0627\u0644\u062a\u0648\u0635\u064a\u0627\u062a:\n\u0646\u0646\u0635\u062d \u062c\u0645\u064a\u0639 \u0627\u0644\u0645\u0633\u062a\u062e\u062f\u0645\u064a\u0646 \u0627\u0644\u0630\u064a\u0646 \u064a\u0633\u062a\u062e\u062f\u0645\u0648\u0646 \u0627\u0644\u0625\u0635\u062f\u0627\u0631\u0627\u062a \u0627\u0644\u0645\u0630\u0643\u0648\u0631\u0629 \u0645\u0646 macOS \u0628\u062a\u062d\u062f\u064a\u062b \u0623\u0646\u0638\u0645\u062a\u0647\u0645 \u0641\u0648\u0631\u064b\u0627 \u0625\u0644\u0649 \u0627\u0644\u0625\u0635\u062f\u0627\u0631\u0627\u062a \u0627\u0644\u062a\u064a \u062a\u062d\u062a\u0648\u064a \u0639\u0644\u0649 \u0627\u0644\u0625\u0635\u0644\u0627\u062d\u0627\u062a \u0627\u0644\u0623\u0645\u0646\u064a\u0629 \u0627\u0644\u0645\u0630\u0643\u0648\u0631\u0629 \u0623\u0639\u0644\u0627\u0647. \u0627\u0644\u062a\u062d\u062f\u064a\u062b\u0627\u062a \u0627\u0644\u0623\u0645\u0646\u064a\u0629 \u0636\u0631\u0648\u0631\u064a\u0629 \u0644\u062d\u0645\u0627\u064a\u0629 \u0627\u0644\u0646\u0638\u0627\u0645 \u0645\u0646 \u0627\u0644\u0647\u062c\u0645\u0627\u062a \u0627\u0644\u0645\u062d\u062a\u0645\u0644\u0629 \u0648\u0636\u0645\u0627\u0646 \u0633\u0644\u0627\u0645\u0629 \u0627\u0644\u0628\u064a\u0627\u0646\u0627\u062a.\n\n\u0644\u0645\u0632\u064a\u062f \u0645\u0646 \u0627\u0644\u062a\u0641\u0627\u0635\u064a\u0644\u060c \u064a\u0645\u0643\u0646\u0643\u0645 \u0632\u064a\u0627\u0631\u0629 \u0627\u0644\u0631\u0627\u0628\u0637 \u0627\u0644\u062a\u0627\u0644\u064a: [Full Disclosure - CVE-2024-40800](http://seclists.org/fulldisclosure/2024/Jul/18)\n\n\u0627\u0628\u0642\u0648\u0627 \u0622\u0645\u0646\u064a\u0646! \ud83d\udee1\ufe0f\n\n---\n\n\ud83d\udea8 CVE-2024-39320: \u062b\u063a\u0631\u0629 \u0641\u064a \u0645\u0646\u0635\u0629 Discourse\n\n\u0627\u0643\u062a\u0634\u0641\u062a \u062b\u063a\u0631\u0629 \u0623\u0645\u0646\u064a\u0629 \u0641\u064a \u0645\u0646\u0635\u0629 \u0627\u0644\u0646\u0642\u0627\u0634 \u0645\u0641\u062a\u0648\u062d\u0629 \u0627\u0644\u0645\u0635\u062f\u0631 Discourse \u0642\u0628\u0644 \u0627\u0644\u0625\u0635\u062f\u0627\u0631\u064a\u0646 3.2.5 \u0648 3.3.0.beta5\u060c \u062a\u062a\u064a\u062d \u0644\u0644\u0645\u0647\u0627\u062c\u0645\u064a\u0646 \u0625\u0645\u0643\u0627\u0646\u064a\u0629 \u062d\u0642\u0646 \u0625\u0637\u0627\u0631\u0627\u062a (iframes) \u0645\u0646 \u0623\u064a \u0646\u0637\u0627\u0642\u060c \u0645\u062a\u062c\u0627\u0648\u0632\u064a\u0646 \u0627\u0644\u0642\u064a\u0648\u062f \u0627\u0644\u062a\u064a \u064a\u064f\u0641\u062a\u0631\u0636 \u0623\u0646 \u064a\u062a\u0645 \u0641\u0631\u0636\u0647\u0627 \u0639\u0628\u0631 \u0625\u0639\u062f\u0627\u062f allowed_iframes. \n\n\u0623\u0645\u062b\u0644\u0629 \u0639\u0644\u0649 \u0627\u0644\u0647\u062c\u0648\u0645:\n- \u064a\u0645\u0643\u0646 \u0644\u0644\u0645\u0647\u0627\u062c\u0645 \u0627\u0633\u062a\u063a\u0644\u0627\u0644 \u0647\u0630\u0647 \u0627\u0644\u062b\u063a\u0631\u0629 \u0644\u0625\u062f\u0631\u0627\u062c \u0645\u062d\u062a\u0648\u0649 \u0636\u0627\u0631 \u062f\u0627\u062e\u0644 \u0627\u0644\u0625\u0637\u0627\u0631\u0627\u062a \u0639\u0644\u0649 \u0635\u0641\u062d\u0627\u062a \u0627\u0644\u0645\u0646\u0627\u0642\u0634\u0629\u060c \u0645\u0645\u0627 \u064a\u0639\u0631\u0636 \u0627\u0644\u0645\u0633\u062a\u062e\u062f\u0645\u064a\u0646 \u0644\u0645\u062e\u0627\u0637\u0631 \u0645\u062b\u0644 \u0627\u0644\u062a\u0635\u064a\u062f \u0627\u0644\u0627\u062d\u062a\u064a\u0627\u0644\u064a \u0623\u0648 \u0633\u0631\u0642\u0629 \u0627\u0644\u0628\u064a\u0627\u0646\u0627\u062a.\n\n\u0627\u0644\u0625\u0635\u0644\u0627\u062d: \n- \u062a\u0645 \u0625\u0635\u0644\u0627\u062d \u0647\u0630\u0647 \u0627\u0644\u062b\u063a\u0631\u0629 \u0641\u064a \u0627\u0644\u0625\u0635\u062f\u0627\u0631\u064a\u0646 3.2.5 \u0648 3.3.0.beta5. \u064a\u064f\u0646\u0635\u062d \u0627\u0644\u0645\u0633\u062a\u062e\u062f\u0645\u0648\u0646 \u0628\u062a\u062d\u062f\u064a\u062b \u0645\u0646\u0635\u0627\u062a\u0647\u0645 \u0625\u0644\u0649 \u0647\u0630\u0647 \u0627\u0644\u0625\u0635\u062f\u0627\u0631\u0627\u062a \u0623\u0648 \u0627\u0644\u0625\u0635\u062f\u0627\u0631\u0627\u062a \u0627\u0644\u0623\u062d\u062f\u062b \u0644\u0636\u0645\u0627\u0646 \u0627\u0644\u062d\u0645\u0627\u064a\u0629 \u0645\u0646 \u0647\u0630\u0627 \u0627\u0644\u0647\u062c\u0648\u0645.", "url": "https://t.me/cyber_hsecurity/1614"}, {"timestamp": "2025-03-23T23:00:00Z", "date_only": false, "value": "2025-03-23T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2024-1725", "record": "WID-SEC-W-2024-1725", "field": "document.tracking.revision_history.3.date"}, {"timestamp": "2025-03-24T23:00:00Z", "date_only": false, "value": "2025-03-24T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2024-1725", "record": "WID-SEC-W-2024-1725", "field": "document.tracking.revision_history.4.date"}, {"timestamp": "2025-03-27T23:00:00Z", "date_only": false, "value": "2025-03-27T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2024-1725", "record": "WID-SEC-W-2024-1725", "field": "document.tracking.revision_history.5.date"}, {"timestamp": "2025-11-04T17:24:40.423Z", "date_only": false, "value": "2025-11-04T17:24:40.423Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CVE", "record": "CVE-2024-40800", "field": "containers.adp.1.providerMetadata.dateUpdated"}, {"timestamp": "2026-01-11T23:00:00Z", "date_only": false, "value": "2026-01-11T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2024-1725", "record": "WID-SEC-W-2024-1725", "field": "document.tracking.revision_history.6.date"}, {"timestamp": "2026-01-11T23:00:00Z", "date_only": false, "value": "2026-01-11T23:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2024-1725", "record": "WID-SEC-W-2024-1725", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-01-12T10:15:58.135Z", "date_only": false, "value": "2026-01-12T10:15:58.135+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2024-1725", "record": "WID-SEC-W-2024-1725", "field": "document.tracking.generator.date"}, {"timestamp": "2026-04-02T18:13:17.581Z", "date_only": false, "value": "2026-04-02T18:13:17.581Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2024-40800", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-04-02T18:13:17.581Z", "date_only": false, "value": "2026-04-02T18:13:17.581Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / apple", "record": "CVE-2024-40800", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-04-02T21:31:50Z", "date_only": false, "value": "2026-04-02T21:31:50Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-FC8M-X59C-5F6R", "record": "GHSA-FC8M-X59C-5F6R", "field": "modified"}, {"timestamp": "2026-06-17T07:46:36.130Z", "date_only": false, "value": "2026-06-17T07:46:36.130", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2024-40800", "record": "FKIE_CVE-2024-40800", "field": "lastModified"}]}