Threat and Vulnerability Intelligence Database
Example Searches:
CVE
Threat Actors
Countries
Vendors
Severity
Known Exploited
CVE-2025-20156 |
Description: A vulnerability in the REST API of Cisco Meeting Management could allow a remote, authenticated attacker with low privileges to elevate privileges to administrator on an affected device.
This vulnerability exists because proper authorization is not enforced upon REST API users. An attacker could exploit this vulnerability by sending API requests to a specific endpoint. A successful exploit could allow the attacker to gain administrator-level control over edge nodes that are managed by Cisco Meeting Management.
CVSS: CRITICAL (9.9) EPSS Score: 0.05%
January 25th, 2025 (3 months ago)
|
|
CVE-2024-56404 |
Description: In One Identity Identity Manager 9.x before 9.3, an insecure direct object reference (IDOR) vulnerability allows privilege escalation. Only On-Premise installations are affected.
CVSS: CRITICAL (9.9) EPSS Score: 0.05%
January 25th, 2025 (3 months ago)
|
|
CVE-2024-55573 |
Description: An issue was discovered in Centreon centreon-web 24.10.x before 24.10.3, 24.04.x before 24.04.9, 23.10.x before 23.10.19, 23.04.x before 23.04.24. A user with high privileges is able to inject SQL into the form used to create virtual metrics.
CVSS: CRITICAL (9.1) EPSS Score: 0.04%
January 25th, 2025 (3 months ago)
|
|
CVE-2024-53923 |
Description: An issue was discovered in Centreon Web 24.10.x before 24.10.3, 24.04.x before 24.04.9, 23.10.x before 23.10.19, 23.04.x before 23.04.24. A user with high privileges is able to achieve SQL injection in the form to upload media.
CVSS: CRITICAL (9.1) EPSS Score: 0.04%
January 25th, 2025 (3 months ago)
|
|
CVE-2024-38821 |
Description: Spring WebFlux applications that have Spring Security authorization rules on static resources can be bypassed under certain circumstances.
For this to impact an application, all of the following must be true:
* It must be a WebFlux application
* It must be using Spring's static resources support
* It must have a non-permitAll authorization rule applied to the static resources support
CVSS: CRITICAL (9.1) EPSS Score: 0.04%
January 25th, 2025 (3 months ago)
|
|
CVE-2024-13545 |
Description: The Bootstrap Ultimate theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.9 via the path parameter. This makes it possible for unauthenticated attackers to include PHP files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where PHP files can be uploaded and included. If php://filter is enabled on the server, this issue may directly lead to Remote Code Execution.
CVSS: CRITICAL (9.8) EPSS Score: 0.09%
January 25th, 2025 (3 months ago)
|
|
CVE-2024-13161 |
🚨 Marked as known exploited on March 10th, 2025 (about 1 month ago).
Description: Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.
CVSS: CRITICAL (9.8) EPSS Score: 0.04%
January 25th, 2025 (3 months ago)
|
|
CVE-2024-13160 |
🚨 Marked as known exploited on March 10th, 2025 (about 1 month ago).
Description: Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.
CVSS: CRITICAL (9.8) EPSS Score: 0.04%
January 25th, 2025 (3 months ago)
|
|
CVE-2024-13159 |
🚨 Marked as known exploited on March 10th, 2025 (about 1 month ago).
Description: Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.
CVSS: CRITICAL (9.8) EPSS Score: 0.04%
January 25th, 2025 (3 months ago)
|
|
CVE-2024-10811 |
Description: Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.
CVSS: CRITICAL (9.8) EPSS Score: 0.04%
January 25th, 2025 (3 months ago)
|