CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!
Threat and Vulnerability Intelligence Database
Example Searches:
CVE
Threat Actors
Countries
Vendors
Severity
Known Exploited
CVE-2024-38346 |
Description: The CloudStack cluster service runs on unauthenticated port (default 9090) that can be misused to run arbitrary commands on targeted hypervisors and CloudStack management server hosts. Some of these commands were found to have command injection vulnerabilities that can result in arbitrary code execution via agents on the hosts that may run as a privileged user. An attacker that can reach the cluster service on the unauthenticated port (default 9090), can exploit this to perform remote code execution on CloudStack managed hosts and result in complete compromise of the confidentiality, integrity, and availability of CloudStack managed infrastructure.
Users are recommended to restrict the network access to the cluster service port (default 9090) on a CloudStack management server host to only its peer CloudStack management server hosts. Users are recommended to upgrade to version 4.18.2.1, 4.19.0.2 or later, which addresses this issue.
CVSS: CRITICAL (9.8) EPSS Score: 0.23%
February 14th, 2025 (5 months ago)
|
|
CVE-2024-3834 |
Description: Use after free in Downloads in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
EPSS Score: 0.1%
February 14th, 2025 (5 months ago)
|
|
CVE-2024-3833 |
Description: Object corruption in WebAssembly in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. (Chromium security severity: High)
EPSS Score: 0.12%
February 14th, 2025 (5 months ago)
|
|
CVE-2024-3832 |
Description: Object corruption in V8 in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. (Chromium security severity: High)
EPSS Score: 0.07%
February 14th, 2025 (5 months ago)
|
|
CVE-2024-38276 |
Description: Incorrect CSRF token checks resulted in multiple CSRF risks.
EPSS Score: 0.06%
February 14th, 2025 (5 months ago)
|
|
CVE-2024-38274 |
Description: Insufficient escaping of calendar event titles resulted in a stored XSS risk in the event deletion prompt.
EPSS Score: 0.05%
February 14th, 2025 (5 months ago)
|
|
CVE-2024-38273 |
Description: Insufficient capability checks meant it was possible for users to gain access to BigBlueButton join URLs they did not have permission to access.
EPSS Score: 0.05%
February 14th, 2025 (5 months ago)
|
|
CVE-2024-37894 |
Description: Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Out-of-bounds Write error when assigning ESI variables, Squid is susceptible to a Memory Corruption error. This error can lead to a Denial of Service attack.
CVSS: MEDIUM (6.3) EPSS Score: 0.05%
February 14th, 2025 (5 months ago)
|
|
CVE-2024-3772 |
Description: Regular expression denial of service in Pydanic < 2.4.0, < 1.10.13 allows remote attackers to cause denial of service via a crafted email string.
CVSS: MEDIUM (5.9) EPSS Score: 0.04%
February 14th, 2025 (5 months ago)
|
|
CVE-2024-37603 |
Description: An issue was discovered in Mercedes Benz NTG (New Telematics Generation) 6. A possible type confusion exists in the user data import/export function of NTG 6 head units. To perform this attack, local access to the USB interface of the car is needed. With prepared data, an attacker can cause the User-Data service to fail. The failed service instance will restart automatically.
EPSS Score: 0.04%
February 14th, 2025 (5 months ago)
|