Threat and Vulnerability Intelligence Database
Example Searches:
CVE
Threat Actors
Countries
Vendors
Severity
Known Exploited
CVE-2024-53677 |
Description: Threat actors are attempting to exploit a recently disclosed security flaw impacting Apache Struts that could pave the way for remote code execution.
The issue, tracked as CVE-2024-53677, carries a CVSS score of 9.5 out of 10.0, indicating critical severity. The vulnerability shares similarities with another critical bug the project maintainers addressed in December 2023 (CVE-2023-50164, CVSS
CVSS: CRITICAL (9.5) EPSS Score: 0.04%
December 18th, 2024 (4 months ago)
|
|
CVE-2024-55949 |
Description: Impact
Privilege escalation in IAM import API, all users are impacted since MinIO commit 580d9db85e04f1b63cc2909af50f0ed08afa965f
Patches
commit f246c9053f9603e610d98439799bdd2a6b293427
Author: Aditya Manthramurthy <[email protected]>
Date: Wed Dec 11 18:09:40 2024 -0800
fix: Privilege escalation in IAM import API (#20756)
This API had missing permissions checking, allowing a user to change
their policy mapping by:
1. Craft iam-info.zip file: Update own user permission in
user_mappings.json
2. Upload it via `mc admin cluster iam import nobody iam-info.zip`
Here `nobody` can be a user with pretty much any kind of permission (but
not anonymous) and this ends up working.
Some more detailed steps - start from a fresh setup:
```
./minio server /tmp/d{1...4} &
mc alias set myminio http://localhost:9000 minioadmin minioadmin
mc admin user add myminio nobody nobody123
mc admin policy attach myminio readwrite nobody nobody123
mc alias set nobody http://localhost:9000 nobody nobody123
mc admin cluster iam export myminio
mkdir /tmp/x && mv myminio-iam-info.zip /tmp/x
cd /tmp/x
unzip myminio-iam-info.zip
echo '{"nobody":{"version":1,"policy":"consoleAdmin","updatedAt":"2024-08-13T19:47:10.1Z"}}' > \
iam-assets/user_mappings.json
zip -r myminio-iam-info-updated.zip iam-assets/
mc admin cluster iam import nobody ./myminio-iam-info-updat...
CVSS: CRITICAL (9.3) EPSS Score: 0.05%
December 18th, 2024 (4 months ago)
|
|
CVE-2024-53677 |
Description: A recently patched critical Apache Struts 2 vulnerability tracked as CVE-2024-53677 is actively exploited using public proof-of-concept exploits to find vulnerable devices. [...]
CVSS: CRITICAL (9.5) EPSS Score: 0.04%
December 18th, 2024 (4 months ago)
|
|
CVE-2024-8972 |
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mobil365 Informatics Saha365 App allows SQL Injection.This issue affects Saha365 App: before 30.09.2024.
CVSS: CRITICAL (9.8) EPSS Score: 0.09%
December 18th, 2024 (4 months ago)
|
|
CVE-2024-12356 |
🚨 Marked as known exploited on December 19th, 2024 (4 months ago).
Description: A critical vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) products which can allow an unauthenticated attacker to inject commands that are run as a site user.
CVSS: CRITICAL (9.8) EPSS Score: 1.3%
December 18th, 2024 (4 months ago)
|
|
CVE-2024-10205 |
Description: Authentication Bypass
vulnerability in Hitachi Ops Center Analyzer on Linux, 64 bit (Hitachi Ops Center Analyzer detail view component), Hitachi Infrastructure Analytics Advisor on Linux, 64 bit (Hitachi Data Center Analytics
component
).This issue affects Hitachi Ops Center Analyzer: from 10.0.0-00 before 11.0.3-00; Hitachi Infrastructure Analytics Advisor: from 2.1.0-00 through 4.4.0-00.
CVSS: CRITICAL (9.4) EPSS Score: 0.04%
December 18th, 2024 (4 months ago)
|
|
CVE-2023-34157 |
Description: Vulnerability of HwWatchHealth being hijacked.Successful exploitation of this vulnerability may cause repeated pop-up windows of the app.
CVSS: CRITICAL (10.0) EPSS Score: 0.06%
December 18th, 2024 (4 months ago)
|
|
CVE-2024-56012 |
Description: Cross-Site Request Forgery (CSRF) vulnerability in Pearlbells Flash News / Post (Responsive) allows Privilege Escalation.This issue affects Flash News / Post (Responsive): from n/a through 4.1.
CVSS: CRITICAL (9.8) EPSS Score: 0.04%
December 17th, 2024 (4 months ago)
|
|
CVE-2024-55988 |
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Amol Nirmala Waman Navayan CSV Export allows Blind SQL Injection.This issue affects Navayan CSV Export: from n/a through 1.0.9.
CVSS: CRITICAL (9.3) EPSS Score: 0.04%
December 17th, 2024 (4 months ago)
|
|
CVE-2024-55982 |
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in richteam Share Buttons – Social Media allows Blind SQL Injection.This issue affects Share Buttons – Social Media: from n/a through 1.0.2.
CVSS: CRITICAL (9.3) EPSS Score: 0.04%
December 17th, 2024 (4 months ago)
|