Threat and Vulnerability Intelligence Database
Example Searches:
CVE
Threat Actors
Countries
Vendors
Severity
Known Exploited
CVE-2024-53197 |
🚨 Marked as known exploited on April 8th, 2025 (10 days ago).
Description: In the Linux kernel, the following vulnerability has been resolved:
ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices
A bogus device can provide a bNumConfigurations value that exceeds the
initial value used in usb_get_configuration for allocating dev->config.
This can lead to out-of-bounds accesses later, e.g. in
usb_destroy_configuration.
EPSS Score: 0.04%
December 28th, 2024 (4 months ago)
|
|
CVE-2024-53150 |
🚨 Marked as known exploited on April 8th, 2025 (10 days ago).
Description: In the Linux kernel, the following vulnerability has been resolved:
ALSA: usb-audio: Fix out of bounds reads when finding clock sources
The current USB-audio driver code doesn't check bLength of each
descriptor at traversing for clock descriptors. That is, when a
device provides a bogus descriptor with a shorter bLength, the driver
might hit out-of-bounds reads.
For addressing it, this patch adds sanity checks to the validator
functions for the clock descriptor traversal. When the descriptor
length is shorter than expected, it's skipped in the loop.
For the clock source and clock multiplier descriptors, we can just
check bLength against the sizeof() of each descriptor type.
OTOH, the clock selector descriptor of UAC2 and UAC3 has an array
of bNrInPins elements and two more fields at its tail, hence those
have to be checked in addition to the sizeof() check.
CVSS: HIGH (7.8) EPSS Score: 0.04%
December 25th, 2024 (4 months ago)
|
|
CVE-2024-12686 |
🚨 Marked as known exploited on January 13th, 2025 (3 months ago).
Description: A vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) which can allow an attacker with existing administrative privileges to inject commands and run as a site user.
CVSS: MEDIUM (6.6) EPSS Score: 6.18%
December 19th, 2024 (4 months ago)
|
|
CVE-2024-12356 |
🚨 Marked as known exploited on December 19th, 2024 (4 months ago).
Description: A critical vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) products which can allow an unauthenticated attacker to inject commands that are run as a site user.
CVSS: CRITICAL (9.8) EPSS Score: 1.3%
December 18th, 2024 (4 months ago)
|
|
CVE-2024-49138 |
🚨 Marked as known exploited on December 10th, 2024 (4 months ago).
Description: Windows Common Log File System Driver Elevation of Privilege Vulnerability
CVSS: HIGH (7.8) EPSS Score: 0.05%
December 12th, 2024 (4 months ago)
|
|
CVE-2024-55550 |
🚨 Marked as known exploited on January 7th, 2025 (3 months ago).
Description: Mitel MiCollab through 9.8 SP2 could allow an authenticated attacker with administrative privilege to conduct a local file read, due to insufficient input sanitization. A successful exploit could allow the authenticated admin attacker to access resources that are constrained to the admin access level, and the disclosure is limited to non-sensitive system information. This vulnerability does not allow file modification or privilege escalation.
CVSS: LOW (0.0) EPSS Score: 42.72%
December 11th, 2024 (4 months ago)
|
|
CVE-2024-41713 |
🚨 Marked as known exploited on January 7th, 2025 (3 months ago).
Description: A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct a path traversal attack, due to insufficient input validation. A successful exploit could allow unauthorized access, enabling the attacker to view, corrupt, or delete users' data and system configurations.
CVSS: LOW (0.0) EPSS Score: 95.44%
December 11th, 2024 (4 months ago)
|
|
CVE-2024-51378 |
🚨 Marked as known exploited on December 4th, 2024 (4 months ago).
Description: getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authentication and execute arbitrary commands via /dns/getresetstatus or /ftp/getresetstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.
CVSS: CRITICAL (10.0) EPSS Score: 23.11%
December 4th, 2024 (4 months ago)
|
|
CVE-2024-11667 |
🚨 Marked as known exploited on December 3rd, 2024 (5 months ago).
Description: A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through V5.38, USG FLEX series firmware versions V5.00 through V5.38, USG FLEX 50(W) series firmware versions V5.10 through V5.38, and USG20(W)-VPN series firmware versions V5.10 through V5.38 could allow an attacker to download or upload files via a crafted URL.
CVSS: HIGH (7.5) EPSS Score: 18.85%
December 4th, 2024 (4 months ago)
|
|
CVE-2024-53104 |
🚨 Marked as known exploited on February 4th, 2025 (2 months ago).
Description: In the Linux kernel, the following vulnerability has been resolved:
media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format
This can lead to out of bounds writes since frames of this type were not
taken into account when calculating the size of the frames buffer in
uvc_parse_streaming.
CVSS: LOW (0.0) EPSS Score: 0.04%
December 3rd, 2024 (5 months ago)
|