Threat and Vulnerability Intelligence Database
Example Searches:
CVE
Threat Actors
Countries
Vendors
Severity
Known Exploited
CVE-2025-0180 |
Description: The WP Foodbakery plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.3. This is due to the plugin not properly restricting what user meta can be updated during profile registration. This makes it possible for unauthenticated attackers to register on the site as an administrator.
CVSS: CRITICAL (9.8) EPSS Score: 0.09%
February 12th, 2025 (2 months ago)
|
|
CVE-2024-47908 |
Description: OS command injection in the admin web console of Ivanti CSA before version 5.0.5 allows a remote authenticated attacker with admin privileges to achieve remote code execution.
CVSS: CRITICAL (9.1) EPSS Score: 0.05%
February 12th, 2025 (2 months ago)
|
|
CVE-2024-10644 |
Description: Code injection in Ivanti Connect Secure before version 22.7R2.4 and Ivanti Policy Secure before version 22.7R1.3 allows a remote authenticated attacker with admin privileges to achieve remote code execution.
CVSS: CRITICAL (9.1) EPSS Score: 0.04%
February 12th, 2025 (2 months ago)
|
|
CVE-2024-38856 |
Description: Apache OFBiz Exploit - CVE-2024-38856
CVSS: CRITICAL (9.8)
February 11th, 2025 (2 months ago)
|
|
CVE-2025-24032 |
Description: PAM-PKCS#11 is a Linux-PAM login module that allows a X.509 certificate based user login. Prior to version 0.6.13, if cert_policy is set to none (the default value), then pam_pkcs11 will only check if the user is capable of logging into the token. An attacker may create a different token with the user's public data (e.g. the user's certificate) and a PIN known to the attacker. If no signature with the private key is required, then the attacker may now login as user with that created token. The default to *not* check the private key's signature has been changed with commit commi6638576892b59a99389043c90a1e7dd4d783b921, so that all versions starting with pam_pkcs11-0.6.0 should be affected. As a workaround, in `pam_pkcs11.conf`, set at least `cert_policy = signature;`.
CVSS: CRITICAL (9.2) EPSS Score: 0.05%
February 11th, 2025 (2 months ago)
|
|
CVE-2025-24016 |
Description: Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 4.4.0 and prior to version 4.9.1, an unsafe deserialization vulnerability allows for remote code execution on Wazuh servers. DistributedAPI parameters are a serialized as JSON and deserialized using `as_wazuh_object` (in `framework/wazuh/core/cluster/common.py`). If an attacker manages to inject an unsanitized dictionary in DAPI request/response, they can forge an unhandled exception (`__unhandled_exc__`) to evaluate arbitrary python code. The vulnerability can be triggered by anybody with API access (compromised dashboard or Wazuh servers in the cluster) or, in certain configurations, even by a compromised agent. Version 4.9.1 contains a fix.
CVSS: CRITICAL (9.9) EPSS Score: 0.04%
February 11th, 2025 (2 months ago)
|
|
CVE-2024-28986 |
Description: SolarWinds Web Help Desk was found to be susceptible to a Java Deserialization Remote Code Execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine.
While it was reported as an unauthenticated vulnerability, SolarWinds has been unable to reproduce it without authentication after thorough testing.
However, out of an abundance of caution, we recommend all Web Help Desk customers apply the patch, which is now available.
CVSS: CRITICAL (9.8) EPSS Score: 2.95%
February 11th, 2025 (2 months ago)
|
|
CVE-2024-24116 |
Description: An issue in Ruijie RG-NBS2009G-P RGOS v.10.4(1)P2 Release(9736) allows a remote attacker to gain privileges via the system/config_menu.htm.
CVSS: CRITICAL (9.8) EPSS Score: 1.19%
February 11th, 2025 (2 months ago)
|
|
CVE-2024-13011 |
Description: The WP Foodbakery plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'upload_publisher_profile_image' function in versions up to, and including, 4.7. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS: CRITICAL (9.8) EPSS Score: 0.09%
February 11th, 2025 (2 months ago)
|
|
CVE-2024-24790 |
Description:
Nessus Plugin ID 215168 with Critical Severity
Synopsis
The remote SUSE host is missing a security update.
Description
The remote SUSE Linux SLES12 / SLES_SAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2025:0377-1 advisory. - Update to version 20250115.01 (bsc#1236406, bsc#1236407) - CVE-2024-24790: Bump the golang compiler version to 1.22.4 (bsc#1225974)Tenable has extracted the preceding description block directly from the SUSE security advisory.Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
Solution
Update the affected google-osconfig-agent package.
Read more at https://www.tenable.com/plugins/nessus/215168
CVSS: CRITICAL (9.8) EPSS Score: 0.06%
February 10th, 2025 (2 months ago)
|