CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!
Threat and Vulnerability Intelligence Database
Example Searches:
CVE
Threat Actors
Countries
Vendors
Severity
Known Exploited
CVE-2024-39936 |
Description: An issue was discovered in HTTP2 in Qt before 5.15.18, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.7, and 6.6.x through 6.7.x before 6.7.3. Code to make security-relevant decisions about an established connection may execute too early, because the encrypted() signal has not yet been emitted and processed..
CVSS: HIGH (8.6) EPSS Score: 0.08% SSVC Exploitation: none
March 19th, 2025 (4 months ago)
|
|
CVE-2024-36132 |
Description: Insufficient verification of authentication controls in EPMM prior to 12.1.0.1 allows a remote attacker to bypass authentication and access sensitive resources.
CVSS: HIGH (8.2) EPSS Score: 2.67% SSVC Exploitation: none
March 19th, 2025 (4 months ago)
|
|
CVE-2024-21136 |
Description: Vulnerability in the Oracle Retail Xstore Office product of Oracle Retail Applications (component: Security). Supported versions that are affected are 19.0.5, 20.0.3, 20.0.4, 22.0.0 and 23.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Xstore Office. While the vulnerability is in Oracle Retail Xstore Office, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Retail Xstore Office accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).
CVSS: HIGH (8.6) EPSS Score: 0.16% SSVC Exploitation: none
March 19th, 2025 (4 months ago)
|
|
CVE-2025-27363 |
Description:
Nessus Plugin ID 232845 with High Severity
Synopsis
The remote Debian host is missing a security-related update.
Description
The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dsa-5880 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-5880-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso March 17, 2025 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : freetype CVE ID : CVE-2025-27363 An out-of-bounds write vulnerability when attempting to parse font subglyph structures related to TrueType GX and variable font files was discovered in FreeType, which may result in the execution of arbitrary code when processing specially crafted fonts. For the stable distribution (bookworm), this problem has been fixed in version 2.12.1+dfsg-5+deb12u4. We recommend that you upgrade your freetype packages. For the detailed security status of freetype please refer to its security tracker page at: https://security-tracker.debian.org/tracker/freetype Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.d...
CVSS: HIGH (8.1) EPSS Score: 5.37%
March 19th, 2025 (4 months ago)
|
|
CVE-2025-21172 |
Description:
Nessus Plugin ID 232847 with High Severity
Synopsis
The remote Windows host is affected by a .NET Core vulnerability
Description
The version of Microsoft .NET 8 Core installed on the remote host is prior to 8.0.12. It is, therefore, affected by multiple vulnerabilities as referenced in the vendor advisory. - .NET and Visual Studio Remote Code Execution Vulnerability (CVE-2025-21172) - .NET Elevation of Privilege Vulnerability (CVE-2025-21173) - .NET and Visual Studio Remote Code Execution Vulnerability (CVE-2025-21176)Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Update .NET Core, remove vulnerable packages and refer to vendor advisory.
Read more at https://www.tenable.com/plugins/nessus/232847
CVSS: HIGH (7.5)
March 19th, 2025 (4 months ago)
|
|
Description: Impact
It's possible for an user to get access to private information through the REST API - but could also be through another API - when a sub wiki is using "Prevent unregistered users to view pages". The vulnerability only affects subwikis, and it only concerns specific right options such as "Prevent unregistered users to view pages". or "Prevent unregistered users to edit pages".
It's possible to detect the vulnerability by enabling "Prevent unregistered users to view pages" and then trying to access a page through the REST API without using any credentials.
Patches
The vulnerability has been patched in XWiki 15.10.14, 16.4.6 and 16.10.0RC1.
Workarounds
There's no workaround.
References
JIRA ticket: https://jira.xwiki.org/browse/XWIKI-22640
Commit of the fix: https://github.com/xwiki/xwiki-platform/commit/5f98bde87288326cf5787604e2bb87836875ed0e
For more information
If you have any questions or comments about this advisory:
Open an issue in Jira XWiki.org
Email us at Security Mailing List
References
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-gq32-758c-3wm3
https://nvd.nist.gov/vuln/detail/CVE-2025-29924
https://github.com/xwiki/xwiki-platform/commit/5f98bde87288326cf5787604e2bb87836875ed0e
https://jira.xwiki.org/browse/XWIKI-22640
https://github.com/advisories/GHSA-gq32-758c-3wm3
CVSS: HIGH (8.7) EPSS Score: 0.07%
March 19th, 2025 (4 months ago)
|
|
|
Description: Impact
Protected pages are listed when requesting the REST endpoints /rest/wikis/[wikiName]/pages even if the user doesn't have view rights on them.
It's particularly true if the entire wiki is protected with "Prevent unregistered user to view pages": the endpoint would still list the pages of the wiki (actually it only impacts the main wiki due to XWIKI-22639).
Patches
The problem has been patched in XWiki 15.10.14, 16.4.6, 16.10.0RC1. In those versions the endpoint can still be requested but the result is filtered out based on pages rights.
Workarounds
There's no workaround except upgrading or applying manually the changes of the commits (see references) in xwiki-platform-rest-server and recompiling / rebuilding it.
References
Original JIRA ticket: https://jira.xwiki.org/browse/XWIKI-22630
Related JIRA ticket: https://jira.xwiki.org/browse/XWIKI-22639
Commits of the patch: https://github.com/xwiki/xwiki-platform/commit/bca72f5ce971a31dba2a016d8dd8badda4475206 and https://github.com/xwiki/xwiki-platform/commit/1fb12d2780f37b34a1b4dfdf8457d97ce5cbb2df
For more information
If you have any questions or comments about this advisory:
Open an issue in Jira XWiki.org
Email us at Security Mailing List
References
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-22q5-9phm-744v
https://nvd.nist.gov/vuln/detail/CVE-2025-29925
https://github.com/xwiki/xwiki-platform/commit/1fb12d2780f37b34a1b4dfdf8457d97ce5cbb2df
https://github.com/xwiki/xwiki-platform/commit/bca...
CVSS: HIGH (8.7) EPSS Score: 0.08%
March 19th, 2025 (4 months ago)
|
|
|
Description: Impact
Any user can exploit the WikiManager REST API to create a new wiki, where the user could become an administrator and so performs other attacks on the farm.
Note that this REST API is not bundled in XWiki Standard by default: it needs to be installed manually through the extension manager.
Patches
The problem has been patched in versions 15.10.15, 16.4.6 and 16.10.0 of the REST module.
Workarounds
There's no workaround other than upgrading the dependency.
References
JIRA ticket: https://jira.xwiki.org/browse/XWIKI-22490
Commit of the fix: https://github.com/xwiki/xwiki-platform/commit/82aa670106c7f5e6238ca6ed59a52d1800e05b99
For more information
If you have any questions or comments about this advisory:
Open an issue in Jira XWiki.org
Email us at Security Mailing List
Attribution
You can specify here who reported the issue.
References
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-gfp2-6qhm-7x43
https://nvd.nist.gov/vuln/detail/CVE-2025-29926
https://github.com/xwiki/xwiki-platform/commit/82aa670106c7f5e6238ca6ed59a52d1800e05b99
https://jira.xwiki.org/browse/XWIKI-22490
https://github.com/advisories/GHSA-gfp2-6qhm-7x43
CVSS: HIGH (7.9) EPSS Score: 0.07%
March 19th, 2025 (4 months ago)
|
|
CVE-2025-27415 |
Description: Nuxt is an open-source web development framework for Vue.js. Prior to 3.16.0, by sending a crafted HTTP request to a server behind an CDN, it is possible in some circumstances to poison the CDN cache and highly impacts the availability of a site. It is possible to craft a request, such as https://mysite.com/?/_payload.json which will be rendered as JSON. If the CDN in front of a Nuxt site ignores the query string when determining whether to cache a route, then this JSON response could be served to future visitors to the site. An attacker can perform this attack to a vulnerable site in order to make a site unavailable indefinitely. It is also possible in the case where the cache will be reset to make a small script to send a request each X seconds (=caching duration) so that the cache is permanently poisoned making the site completely unavailable. This vulnerability is fixed in 3.16.0.
CVSS: HIGH (7.5) EPSS Score: 0.34% SSVC Exploitation: none
March 19th, 2025 (4 months ago)
|
|
CVE-2024-40786 |
Description: This issue was addressed through improved state management. This issue is fixed in iOS 17.6 and iPadOS 17.6, iOS 16.7.9 and iPadOS 16.7.9, macOS Ventura 13.6.8. An attacker may be able to view sensitive user information.
CVSS: HIGH (7.5) EPSS Score: 0.23% SSVC Exploitation: none
March 19th, 2025 (4 months ago)
|