Threat and Vulnerability Intelligence Database
Example Searches:
CVE
Threat Actors
Countries
Vendors
Severity
Known Exploited
CVE-2024-44131 |
Description: Details have emerged about a now-patched security vulnerability in Apple's iOS and macOS that, if successfully exploited, could sidestep the Transparency, Consent, and Control (TCC) framework and result in unauthorized access to sensitive information.
The flaw, tracked as CVE-2024-44131 (CVSS score: 5.3), resides in the FileProvider component, per Apple, and has been addressed with improved
EPSS Score: 0.14%
December 12th, 2024 (6 months ago)
|
|
Description: Why organisations should avoid ‘blame and fear’, and instead use technical measures to manage the threat from phishing.
December 12th, 2024 (6 months ago)
|
|
CVE-2024-11972 |
Description: Malicious actors are exploiting a critical vulnerability in the Hunk Companion plugin for WordPress to install other vulnerable plugins that could open the door to a variety of attacks.
The flaw, tracked as CVE-2024-11972 (CVSS score: 9.8), affects all versions of the plugin prior to 1.9.0. The plugin has over 10,000 active installations.
"This flaw poses a significant security risk, as it
EPSS Score: 0.04%
December 12th, 2024 (6 months ago)
|
|
|
Description: A global law enforcement operation has failed 27 stresser services that were used to conduct distributed denial-of-service (DDoS) attacks and took them offline as part of a multi-year international exercise called PowerOFF.
The effort, coordinated by Europol and involving 15 countries, dismantled several booter and stresser websites, including zdstresser.net, orbitalstress.net, and
December 12th, 2024 (6 months ago)
|
|
CVE-2024-9845 |
Description: Under specific circumstances, insecure permissions in Ivanti Automation before version 2024.4.0.1 allows a local authenticated attacker to achieve local privilege escalation.
CVSS: HIGH (7.8) EPSS Score: 0.04%
December 12th, 2024 (6 months ago)
|
|
CVE-2024-8602 |
Description: When the XML is read from the codes in the PDF and parsed using a DocumentBuilder, the default settings of the DocumentBuilder allow for an XXE (XML External Entity) attack. Further information on this can be found on the website of the Open Worldwide Application Security Project (OWASP). An attacker could theoretically leverage this by delivering a manipulated PDF file to the target, and depending on the environment, various actions can be executed. These actions include:
* Reading files from the operating system
* Crashing the thread handling the parsing or causing it to enter an infinite loop
* Executing HTTP requests
* Loading additional DTDs or XML files
* Under certain conditions, executing OS commands
CVSS: MEDIUM (6.3) EPSS Score: 0.04%
December 12th, 2024 (6 months ago)
|
|
CVE-2024-8496 |
Description: Under specific circumstances, insecure permissions in Ivanti Workspace Control before version 10.18.40.0 allows a local authenticated attacker to achieve local privilege escalation.
CVSS: HIGH (7.8) EPSS Score: 0.04%
December 12th, 2024 (6 months ago)
|
|
CVE-2024-55884 |
Description: In the Mullvad VPN client 2024.6 (Desktop), 2024.8 (iOS), and 2024.8-beta1 (Android), the exception-handling alternate stack can be exhausted, leading to heap-based out-of-bounds writes in enable() in exception_logging/unix.rs, aka MLLVD-CR-24-01. NOTE: achieving code execution is considered non-trivial.
CVSS: CRITICAL (9.0) EPSS Score: 0.05%
December 12th, 2024 (6 months ago)
|
|
CVE-2024-55660 |
Description: SiYuan is a personal knowledge management system. Prior to version 3.1.16, SiYuan's `/api/template/renderSprig` endpoint is vulnerable to Server-Side Template Injection (SSTI) through the Sprig template engine. Although the engine has limitations, it allows attackers to access environment variables. Version 3.1.16 contains a patch for the issue.
CVSS: MEDIUM (6.9) EPSS Score: 0.04%
December 12th, 2024 (6 months ago)
|
|
CVE-2024-55659 |
Description: SiYuan is a personal knowledge management system. Prior to version 3.1.16, the `/api/asset/upload` endpoint in Siyuan is vulnerable to both arbitrary file write to the host and stored cross-site scripting (via the file write). Version 3.1.16 contains a patch for the issue.
CVSS: HIGH (8.7) EPSS Score: 0.04%
December 12th, 2024 (6 months ago)
|