Threat and Vulnerability Intelligence Database

Example Searches:

CVE-2024-29131	Apache Commons Configuration: StackOverflowError adding property in AbstractListDelimiterHandler.flattenIterator() Description: Out-of-bounds Write vulnerability in Apache Commons Configuration.This issue affects Apache Commons Configuration: from 2.0 before 2.10.1. Users are recommended to upgrade to version 2.10.1, which fixes the issue. EPSS Score: 0.05% Source: CVE December 14th, 2024 (4 months ago)
CVE-2024-26945	crypto: iaa - Fix nr_cpus < nr_iaa case Description: In the Linux kernel, the following vulnerability has been resolved: crypto: iaa - Fix nr_cpus < nr_iaa case If nr_cpus < nr_iaa, the calculated cpus_per_iaa will be 0, which causes a divide-by-0 in rebalance_wq_table(). Make sure cpus_per_iaa is 1 in that case, and also in the nr_iaa == 0 case, even though cpus_per_iaa is never used if nr_iaa == 0, for paranoia. EPSS Score: 0.04% Source: CVE December 14th, 2024 (4 months ago)
CVE-2024-12603	A logic vulnerability in the the mobile application (com.transsion.applock) can lead to bypassing the application password. Description: A logic vulnerability in the the mobile application (com.transsion.applock) can lead to bypassing the application password. EPSS Score: 0.04% Source: CVE December 14th, 2024 (4 months ago)
CVE-2024-10939	Image Widget < 4.4.11 - Admin+ Stored XSS Description: The Image Widget WordPress plugin before 4.4.11 does not sanitise and escape some of its Image Widget settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). EPSS Score: 0.04% Source: CVE December 14th, 2024 (4 months ago)
CVE-2024-10678	Ultimate Blocks < 3.2.4 - Contributor+ Stored XSS Description: The Ultimate Blocks WordPress plugin before 3.2.4 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. EPSS Score: 0.04% Source: CVE December 14th, 2024 (4 months ago)
CVE-2023-6291	Keycloak: redirect_uri validation bypass Description: A flaw was found in the redirect_uri validation logic in Keycloak. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may lead to an access token being stolen, making it possible for the attacker to impersonate other users. EPSS Score: 0.34% Source: CVE December 14th, 2024 (4 months ago)
CVE-2023-29402	Code injection via go command with cgo in cmd/go Description: The go command may generate unexpected code at build time when using cgo. This may result in unexpected behavior when running a go program which uses cgo. This may occur when running an untrusted module which contains directories with newline characters in their names. Modules which are retrieved using the go command, i.e. via "go get", are not affected (modules retrieved using GOPATH-mode, i.e. GO111MODULE=off, may be affected). EPSS Score: 0.89% Source: CVE December 14th, 2024 (4 months ago)
CVE-2023-29400	Improper handling of empty HTML attributes in html/template Description: Templates containing actions in unquoted HTML attributes (e.g. "attr={{.}}") executed with empty input can result in output with unexpected results when parsed due to HTML normalization rules. This may allow injection of arbitrary attributes into tags. EPSS Score: 0.1% Source: CVE December 14th, 2024 (4 months ago)
	New Linux Rootkit PUMAKIT Uses Advanced Stealth Techniques to Evade Detection Description: Cybersecurity researchers have uncovered a new Linux rootkit called PUMAKIT that comes with capabilities to escalate privileges, hide files and directories, and conceal itself from system tools, while simultaneously evading detection. "PUMAKIT is a sophisticated loadable kernel module (LKM) rootkit that employs advanced stealth mechanisms to hide its presence and maintain communication with Source: TheHackerNews December 13th, 2024 (4 months ago)
	FBI Busts Rydox Marketplace with 7,600 PII Sales, Cryptocurrency Worth $225K Seized Description: The U.S. Department of Justice (DoJ) on Thursday announced the shutdown of an illicit marketplace called Rydox ("rydox.ru" and "rydox[.]cc") for selling stolen personal information, access devices, and other tools for conducting cybercrime and fraud. In tandem, three Kosovo nationals and administrators of the service, Ardit Kutleshi, Jetmir Kutleshi, and Shpend Sokoli, have been arrested. Ardit Source: TheHackerNews December 13th, 2024 (4 months ago)