CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!
Threat and Vulnerability Intelligence Database
Example Searches:
CVE
Threat Actors
Countries
Vendors
Severity
Known Exploited
CVE-2025-43862 |
Description: Dify is an open-source LLM app development platform. Prior to version 0.6.12, a normal user is able to access and modify APP orchestration, even though the web UI of APP orchestration is not presented for a normal user. This access control flaw allows non-admin users to make unauthorized access and changes on the APPSs. This issue has been patched in version 0.6.12. A workaround for this vulnerability involves updating the the access control mechanisms to enforce stricter user role permissions and implementing role-based access controls (RBAC) to ensure that only users with admin privileges can access Orchestration of the APPs.
CVSS: HIGH (7.6) EPSS Score: 0.04% SSVC Exploitation: none
April 25th, 2025 (about 2 months ago)
|
|
CVE-2025-3928 |
šØ Marked as known exploited on April 28th, 2025 (about 2 months ago).
Description: Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker. According to the Commvault advisory: "Webservers can be compromised through bad actors creating and executing webshells." Fixed in version 11.36.46, 11.32.89, 11.28.141, and 11.20.217 for Windows and Linux platforms.
CVSS: HIGH (8.8) EPSS Score: 15.08%
April 25th, 2025 (about 2 months ago)
|
|
CVE-2024-6199 |
Description: An unauthenticated attacker on the WAN interface, with the ability to intercept Dynamic DNS (DDNS) traffic between DDNSĀ services and the modem, could manipulate specific responses to include code that forces a buffer overflow on the modem.
Customers that have not enabled Dynamic DNS on their modem are not vulnerable.
CVSS: HIGH (7.7) EPSS Score: 0.02%
April 25th, 2025 (about 2 months ago)
|
|
CVE-2024-6198 |
Description: The device exposes a web interface on ports TCP/3030 and TCP/9882. This web service runs lighttpd, which implements theĀ āSNOREā interface. This interface is affected by a stack buffer overflow vulnerability due to insecure path parsing. An attacker
with access to the LAN network interface could use a specially crafted HTTP request to exploit a buffer overflow on theĀ modem.
CVSS: HIGH (7.7) EPSS Score: 0.03%
April 25th, 2025 (about 2 months ago)
|
|
CVE-2024-11917 |
Description: The JobSearch WP Job Board plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.8.8. This is due to improper configurations in the 'jobsearch_xing_response_data_callback', 'set_access_tokes', and 'google_callback' functions. This makes it possible for unauthenticated attackers to log in as the first connected Xing user, or any connected Xing user if the Xing id is known. It is also possible for unauthenticated attackers to log in as the first connected Google user if the user has logged in, without subsequently logging out, in thirty days. The vulnerability was partially patched in version 2.8.4.
CVSS: HIGH (8.1) EPSS Score: 0.17%
April 25th, 2025 (about 2 months ago)
|
|
CVE-2024-46774 |
Description: In the Linux kernel, the following vulnerability has been resolved:
powerpc/rtas: Prevent Spectre v1 gadget construction in sys_rtas()
Smatch warns:
arch/powerpc/kernel/rtas.c:1932 __do_sys_rtas() warn: potential
spectre issue 'args.args' [r] (local cap)
The 'nargs' and 'nret' locals come directly from a user-supplied
buffer and are used as indexes into a small stack-based array and as
inputs to copy_to_user() after they are subject to bounds checks.
Use array_index_nospec() after the bounds checks to clamp these values
for speculative execution.
CVSS: HIGH (7.1) EPSS Score: 0.09% SSVC Exploitation: none
April 25th, 2025 (about 2 months ago)
|
|
CVE-2025-1565 |
Description: The Mayosis Core plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 5.4.1 via the library/wave-audio/peaks/remote_dl.php file. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
CVSS: HIGH (7.5) EPSS Score: 0.17%
April 25th, 2025 (about 2 months ago)
|
|
CVE-2025-1279 |
Description: The BM Content Builder plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the ux_cb_tools_import_item_ajax AJAX action in all versions up to, and including, 3.16.2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
CVSS: HIGH (8.8) EPSS Score: 0.04%
April 25th, 2025 (about 2 months ago)
|
|
Description: Cybersecurity researchers have disclosed three security flaws in the Rack Ruby web server interface that, if successfully exploited, could enable attackers to gain unauthorized access to files, inject malicious data, and tamper with logs under certain conditions.
The vulnerabilities, flagged by cybersecurity vendor OPSWAT, are listed below -
CVE-2025-27610 (CVSS score: 7.5) - A path traversal
CVSS: HIGH (7.5)
April 25th, 2025 (about 2 months ago)
|
|
CVE-2025-46617 |
Description: Quantum StorNext Web GUI API before 7.2.4 grants access to internal StorNext configuration and unauthorized modification of some software configuration parameters via undocumented user credentials. This affects StorNext RYO before 7.2.4, StorNext Xcellis Workflow Director before 7.2.4, and ActiveScale Cold Storage.
CVSS: HIGH (7.2) EPSS Score: 0.03%
April 25th, 2025 (about 2 months ago)
|