Threat and Vulnerability Intelligence Database
Example Searches:
CVE
Threat Actors
Countries
Vendors
Severity
Known Exploited
CVE-2024-47138 |
Description: The administrative interface listens by default on all interfaces on a TCP port and does not require authentication when being accessed.
CVSS: CRITICAL (9.8) EPSS Score: 0.04%
November 27th, 2024 (5 months ago)
|
|
CVE-2024-43639 |
Description: Windows KDC Proxy Remote Code Execution Vulnerability
CVSS: CRITICAL (9.8) EPSS Score: 0.16%
November 27th, 2024 (5 months ago)
|
|
CVE-2024-43602 |
Description: Azure CycleCloud Remote Code Execution Vulnerability
CVSS: CRITICAL (9.9) EPSS Score: 0.07%
November 27th, 2024 (5 months ago)
|
|
CVE-2024-35244 |
Description: There are several hidden accounts. Some of them are intended for maintenance engineers, and with the knowledge of their passwords (e.g., by examining the coredump), these accounts can be used to re-configure the device. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].
CVSS: CRITICAL (9.1) EPSS Score: 0.04%
November 27th, 2024 (5 months ago)
|
|
CVE-2024-33610 |
Description: "sessionlist.html" and "sys_trayentryreboot.html" are accessible with no authentication. "sessionlist.html" provides logged-in users' session information including session cookies, and "sys_trayentryreboot.html" allows to reboot the device. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].
CVSS: CRITICAL (9.1) EPSS Score: 0.09%
November 27th, 2024 (5 months ago)
|
|
CVE-2024-11693 |
Description: The executable file warning was not presented when downloading .library-ms files.
*Note: This issue only affected Windows operating systems. Other operating systems are unaffected.* This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Thunderbird < 133, and Thunderbird < 128.5.
CVSS: CRITICAL (9.8) EPSS Score: 0.05%
November 27th, 2024 (5 months ago)
|
|
CVE-2024-11680 |
🚨 Marked as known exploited on December 3rd, 2024 (5 months ago).
Description: ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw by sending crafted HTTP requests to options.php, enabling unauthorized modification of the application's configuration. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript.
CVSS: CRITICAL (9.8) EPSS Score: 46.82%
November 27th, 2024 (5 months ago)
|
|
CVE-2024-11145 |
Description: Valor Apps Easy Folder Listing Pro has a deserialization vulnerability that allows an unauthenticated, remote attacker to execute arbitrary code with the privileges of the Joomla! application. Fixed in versions 3.8 and 4.5.
CVSS: CRITICAL (9.8) EPSS Score: 0.04%
November 27th, 2024 (5 months ago)
|
|
CVE-2024-11024 |
Description: The AppPresser – Mobile App Framework plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.4.6. This is due to the plugin not properly validating a user's password reset code prior to updating their password. This makes it possible for unauthenticated attackers, with knowledge of a user's email address, to reset the user's password and gain access to their account.
CVSS: CRITICAL (9.8) EPSS Score: 0.04%
November 27th, 2024 (5 months ago)
|
|
CVE-2024-10961 |
Description: The Social Login plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 5.9.0. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email and the user does not have an already-existing account for the service returning the token.
CVSS: CRITICAL (9.8) EPSS Score: 0.05%
November 27th, 2024 (5 months ago)
|