Threat and Vulnerability Intelligence Database
Example Searches:
CVE
Threat Actors
Countries
Vendors
Severity
Known Exploited
CVE-2024-21985 |
Description: ONTAP 9 versions prior to 9.9.1P18, 9.10.1P16, 9.11.1P13, 9.12.1P10
and 9.13.1P4 are susceptible to a vulnerability which could allow an
authenticated user with multiple remote accounts with differing roles to
perform actions via REST API beyond their intended privilege. Possible
actions include viewing limited configuration details and metrics or
modifying limited settings, some of which could result in a Denial of
Service (DoS).
CVSS: HIGH (7.6) EPSS Score: 0.12% SSVC Exploitation: none
May 29th, 2025 (10 days ago)
|
|
CVE-2024-21649 |
Description: The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC). Prior to 4.2.0, authenticated users could inject code into algorithm environment variables, resulting in remote code execution. This vulnerability is patched in 4.2.0.
CVSS: HIGH (8.8) EPSS Score: 3.6% SSVC Exploitation: none
May 29th, 2025 (10 days ago)
|
|
CVE-2024-21620 |
Description: An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in J-Web of Juniper Networks Junos OS on SRX Series and EX Series allows an attacker to construct a URL that when visited by another user enables the attacker to execute commands with the target's permissions, including an administrator.
A specific invocation of the emit_debug_note method in webauth_operation.php will echo back the data it receives.
This issue affects Juniper Networks Junos OS on SRX Series and EX Series:
* All versions earlier than 20.4R3-S10;
* 21.2 versions earlier than 21.2R3-S8;
* 21.4 versions earlier than 21.4R3-S6;
* 22.1 versions earlier than 22.1R3-S5;
* 22.2 versions earlier than 22.2R3-S3;
* 22.3 versions earlier than 22.3R3-S2;
* 22.4 versions earlier than 22.4R3-S1;
* 23.2 versions earlier than 23.2R2;
* 23.4 versions earlier than 23.4R2.
CVSS: HIGH (8.8) EPSS Score: 0.25% SSVC Exploitation: none
May 29th, 2025 (10 days ago)
|
|
CVE-2024-1117 |
Description: A vulnerability was found in openBI up to 1.0.8. It has been declared as critical. Affected by this vulnerability is the function index of the file /application/index/controller/Screen.php. The manipulation of the argument fileurl leads to code injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252475. In openBI bis 1.0.8 wurde eine kritische Schwachstelle ausgemacht. Es geht um die Funktion index der Datei /application/index/controller/Screen.php. Durch die Manipulation des Arguments fileurl mit unbekannten Daten kann eine code injection-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk erfolgen. Der Exploit steht zur öffentlichen Verfügung.
CVSS: HIGH (7.3) EPSS Score: 0.06% SSVC Exploitation: none
May 29th, 2025 (10 days ago)
|
|
CVE-2024-1115 |
Description: A vulnerability was found in openBI up to 1.0.8 and classified as critical. This issue affects the function dlfile of the file /application/websocket/controller/Setting.php. The manipulation of the argument phpPath leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-252473 was assigned to this vulnerability. Eine kritische Schwachstelle wurde in openBI bis 1.0.8 gefunden. Betroffen davon ist die Funktion dlfile der Datei /application/websocket/controller/Setting.php. Dank Manipulation des Arguments phpPath mit unbekannten Daten kann eine os command injection-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei über das Netzwerk erfolgen. Der Exploit steht zur öffentlichen Verfügung.
CVSS: HIGH (7.3) EPSS Score: 0.48% SSVC Exploitation: none
May 29th, 2025 (10 days ago)
|
|
CVE-2024-1112 |
Description: Heap-based buffer overflow vulnerability in Resource Hacker, developed by Angus Johnson, affecting version 3.6.0.92. This vulnerability could allow an attacker to execute arbitrary code via a long filename argument.
CVSS: HIGH (7.3) EPSS Score: 32.55% SSVC Exploitation: none
May 29th, 2025 (10 days ago)
|
|
CVE-2024-1085 |
Description: A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation.
The nft_setelem_catchall_deactivate() function checks whether the catch-all set element is active in the current generation instead of the next generation before freeing it, but only flags it inactive in the next generation, making it possible to free the element multiple times, leading to a double free vulnerability.
We recommend upgrading past commit b1db244ffd041a49ecc9618e8feb6b5c1afcdaa7.
CVSS: HIGH (7.8) EPSS Score: 0.02% SSVC Exploitation: none
May 29th, 2025 (10 days ago)
|
|
CVE-2024-1069 |
Description: The Contact Form Entries plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation on the 'view_page' function in versions up to, and including, 1.3.2. This makes it possible for authenticated attackers with administrator-level capabilities or above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS: HIGH (7.2) EPSS Score: 2.46% SSVC Exploitation: none
May 29th, 2025 (10 days ago)
|
|
CVE-2024-1006 |
Description: A vulnerability was found in Shanxi Diankeyun Technology NODERP up to 6.0.2 and classified as critical. This issue affects some unknown processing of the file application/index/common.php of the component Cookie Handler. The manipulation of the argument Nod_User_Id/Nod_User_Token leads to improper authentication. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252275. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Eine kritische Schwachstelle wurde in Shanxi Diankeyun Technology NODERP bis 6.0.2 gefunden. Davon betroffen ist unbekannter Code der Datei application/index/common.php der Komponente Cookie Handler. Dank Manipulation des Arguments Nod_User_Id/Nod_User_Token mit unbekannten Daten kann eine improper authentication-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk erfolgen. Der Exploit steht zur öffentlichen Verfügung.
CVSS: HIGH (7.3) EPSS Score: 0.06% SSVC Exploitation: none
May 29th, 2025 (10 days ago)
|
|
CVE-2024-1002 |
Description: A vulnerability classified as critical was found in Totolink N200RE 9.3.5u.6139_B20201216. Affected by this vulnerability is the function setIpPortFilterRules of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ePort leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252271. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. In Totolink N200RE 9.3.5u.6139_B20201216 wurde eine kritische Schwachstelle entdeckt. Das betrifft die Funktion setIpPortFilterRules der Datei /cgi-bin/cstecgi.cgi. Durch Manipulieren des Arguments ePort mit unbekannten Daten kann eine stack-based buffer overflow-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk angegangen werden. Der Exploit steht zur öffentlichen Verfügung.
CVSS: HIGH (7.2) EPSS Score: 0.07% SSVC Exploitation: poc
May 29th, 2025 (10 days ago)
|