CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!
Threat and Vulnerability Intelligence Database
Example Searches:
CVE
Threat Actors
Countries
Vendors
Severity
Known Exploited
|
Description: Hazel discusses Interpol’s push to rename pig butchering scams as ‘romance baiting’. Plus, catch up on the latest vulnerability research from Talos, and why a recent discovery is a “rare industry win”.
February 13th, 2025 (5 months ago)
|
|
|
February 13th, 2025 (5 months ago)
|
CVE-2024-57727 |
Description: SimpleHelp remote support software contains multiple path traversal vulnerabilities that allow unauthenticated remote attackers to download arbitrary files from the SimpleHelp host via crafted HTTP requests. These files may include server configuration files and hashed user passwords.
EPSS Score: 0.47%
February 13th, 2025 (5 months ago)
|
|
|
Description: The Dutch Police (Politie) dismantled the ZServers/XHost bulletproof hosting operation after taking offline 127 servers used by the illegal platform. [...]
February 13th, 2025 (5 months ago)
|
|
|
Description: Summary / Details
Systems running the Instaclustr fork of Stratio's Cassandra-Lucene-Index plugin versions 4.0-rc1-1.0.0 through 4.0.16-1.0.0 and 4.1.0-1.0.0 through 4.1.8-1.0.0, installed into Apache Cassandra version 4.x, are susceptible to a vulnerability which when successfully exploited could allow authenticated Cassandra users to remotely bypass RBAC to access data and and escalate their privileges.
Affected Versions
- Cassandra-Lucene-Index plugin versions 4.0-rc1-1.0.0 through 4.0.16-1.0.0
- versions 4.1.0-1.0.0 through 4.1.8-1.0.0
when installed into Apache Cassandra version 4.x.
Required Configuration for Exploit
These are the conditions required to enable exploit:
Cassandra 4.x
Vulnerable version of the Cassandra-Lucene-Index plugin configured for use
Data added to tables
Lucene index created
Cassandra flush has run
Mitigation/Prevention
Mitigation requires dropping all Lucene indexes and stopping use of the plugin. Exploit will be possible any time the required conditions are met.
Solution
Upgrade to a fixed version of the Cassandra-Lucene-Index plugin.Review users in Cassandra to validate all superuser privileges.
References
https://github.com/instaclustr/cassandra-lucene-index/security/advisories/GHSA-mrqp-q7vx-v2cx
https://github.com/instaclustr/cassandra-lucene-index/commit/94380b165bd3e597d3e22e47f8cc674ec7c7bf7f
https://github.com/advisories/GHSA-mrqp-q7vx-v2cx
February 13th, 2025 (5 months ago)
|
|
CVE-2024-46910 |
Description: An authenticated user can perform XSS and potentially impersonate another user.
This issue affects Apache Atlas versions 2.3.0 and earlier.
Users are recommended to upgrade to version 2.4.0, which fixes the issue.
References
https://nvd.nist.gov/vuln/detail/CVE-2024-46910
https://lists.apache.org/thread/sqzp34l4cdk21zoq5g31qlsvr7jvb1fy
http://www.openwall.com/lists/oss-security/2025/02/12/2
https://github.com/advisories/GHSA-x3v6-f5fr-4wwv
EPSS Score: 0.04%
February 13th, 2025 (5 months ago)
|
|
CVE-2025-1247 |
Description: A flaw was found in Quarkus REST that allows request parameters to leak between concurrent requests if endpoints use field injection without a CDI scope. This vulnerability allows attackers to manipulate request data, impersonate users, or access sensitive information.
References
https://nvd.nist.gov/vuln/detail/CVE-2025-1247
https://access.redhat.com/security/cve/CVE-2025-1247
https://bugzilla.redhat.com/show_bug.cgi?id=2345172
https://github.com/quarkusio/quarkus/issues/45789
https://github.com/quarkusio/quarkus/commit/02ff9ed45c3928edf2a0f8b906543606fed7cd53
https://github.com/advisories/GHSA-phg3-gv66-q38x
CVSS: HIGH (8.3) EPSS Score: 0.05%
February 13th, 2025 (5 months ago)
|
|
CVE-2025-1247 |
Description: A flaw was found in Quarkus REST that allows request parameters to leak between concurrent requests if endpoints use field injection without a CDI scope. This vulnerability allows attackers to manipulate request data, impersonate users, or access sensitive information.
References
https://nvd.nist.gov/vuln/detail/CVE-2025-1247
https://access.redhat.com/security/cve/CVE-2025-1247
https://bugzilla.redhat.com/show_bug.cgi?id=2345172
https://github.com/quarkusio/quarkus/issues/45789
https://github.com/quarkusio/quarkus/commit/02ff9ed45c3928edf2a0f8b906543606fed7cd53
https://github.com/advisories/GHSA-phg3-gv66-q38x
CVSS: HIGH (8.3) EPSS Score: 0.05%
February 13th, 2025 (5 months ago)
|
|
|
Description: Zacks Investment Research (Zacks) last year reportedly suffered another data breach that exposed sensitive information related to roughly 12 million accounts. [...]
February 13th, 2025 (5 months ago)
|
|
|
Description: The attorneys filed court documents referencing eight non-existent cases, then admitted it was a "hallucination" by an AI tool.
February 13th, 2025 (5 months ago)
|