CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!
Threat and Vulnerability Intelligence Database
Example Searches:
CVE
Threat Actors
Countries
Vendors
Severity
Known Exploited
CVE-2024-33891 |
Description: Delinea Secret Server before 11.7.000001 allows attackers to bypass authentication via the SOAP API in SecretServer/webservices/SSWebService.asmx. This is related to a hardcoded key, the use of the integer 2 for the Admin user, and removal of the oauthExpirationId attribute.
CVSS: HIGH (8.8) EPSS Score: 0.05%
February 13th, 2025 (5 months ago)
|
|
CVE-2024-31858 |
Description: Out-of-bounds write for some Intel(R) QuickAssist Technology software before version 2.2.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS: HIGH (7.3) EPSS Score: 0.04%
February 13th, 2025 (5 months ago)
|
|
CVE-2024-31155 |
Description: Improper buffer restrictions in the UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS: HIGH (8.7) EPSS Score: 0.04%
February 13th, 2025 (5 months ago)
|
|
CVE-2024-29214 |
Description: Improper input validation in UEFI firmware CseVariableStorageSmm for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS: HIGH (8.7) EPSS Score: 0.04%
February 13th, 2025 (5 months ago)
|
|
CVE-2024-28127 |
Description: Improper input validation in UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS: HIGH (8.7) EPSS Score: 0.04%
February 13th, 2025 (5 months ago)
|
|
CVE-2024-24582 |
Description: Improper input validation in XmlCli feature for UEFI firmware for some Intel(R) processors may allow privileged user to potentially enable escalation of privilege via local access.
CVSS: HIGH (8.7) EPSS Score: 0.04%
February 13th, 2025 (5 months ago)
|
|
CVE-2024-13800 |
Description: The ConvertPlus plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the 'cp_dismiss_notice' AJAX endpoint in all versions up to, and including, 3.5.30. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update option values to '1' on the WordPress site. This can be leveraged to update an option that would create an error on the site and deny service to legitimate users or be used to set some values to true such as registration.
CVSS: HIGH (8.1) EPSS Score: 0.05%
February 13th, 2025 (5 months ago)
|
|
CVE-2024-13714 |
Description: The All-Images.ai – IA Image Bank and Custom Image creation plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the '_get_image_by_url' function in all versions up to, and including, 1.0.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS: HIGH (8.8) EPSS Score: 0.05%
February 13th, 2025 (5 months ago)
|
|
CVE-2024-13656 |
Description: The Click Mag - Viral WordPress News Magazine/Blog Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the propanel_of_ajax_callback() function in all versions up to, and including, 3.6.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary option values on the WordPress site. This can be leveraged to delete an option that would create an error on the site and deny service to legitimate users.
CVSS: HIGH (8.1) EPSS Score: 0.05%
February 13th, 2025 (5 months ago)
|
|
CVE-2024-13654 |
Description: The ZoxPress - The All-In-One WordPress News Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the 'reset_options' function in all versions up to, and including, 2.12.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary option values on the WordPress site. This can be leveraged to delete an option that would create an error on the site and deny service to legitimate users.
CVSS: HIGH (8.1) EPSS Score: 0.05%
February 13th, 2025 (5 months ago)
|