CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!

Threat and Vulnerability Intelligence Database

RSS Feed

Example Searches:

CVE
Threat Actors
Countries
Vendors
Severity
Known Exploited

CVE-2024-52958
iota C.ai Conversational Platform - Improper Verification of Cryptographic Signature
Description: A improper verification of cryptographic signature vulnerability in plugin management in iota C.ai Conversational Platform from 1.0.0 through 2.1.3 allows remote authenticated users to load a malicious DLL via upload plugin function.

CVSS: CRITICAL (9.3)

EPSS Score: 0.04%

Source: CVE
November 28th, 2024 (7 months ago)

CVE-2024-52951
Description: Stored Cross-Site Scripting in the Access Request History in Omada Identity before version 15 update 1 allows an authenticated attacker to execute arbitrary code in the browser of a victim via a specially crafted link or by viewing a manipulated Access Request History

EPSS Score: 0.05%

Source: CVE
November 28th, 2024 (7 months ago)

CVE-2024-52787
Description: An issue in the upload_documents method of libre-chat v0.0.6 allows attackers to execute a path traversal via supplying a crafted filename in an uploaded file.

EPSS Score: 0.05%

Source: CVE
November 28th, 2024 (7 months ago)

CVE-2024-52771
Description: DedeBIZ v6.3.0 was discovered to contain an arbitrary file deletion vulnerability via the component /admin/file_manage_view.

EPSS Score: 0.04%

Source: CVE
November 28th, 2024 (7 months ago)

CVE-2024-52726
Description: CRMEB v5.4.0 is vulnerable to Arbitrary file read in the save_basics function which allows an attacker to obtain sensitive information

EPSS Score: 0.04%

Source: CVE
November 28th, 2024 (7 months ago)

CVE-2024-52323
Sensitive Data Exposure
Description: Zohocorp ManageEngine Analytics Plus versions below 6100 are vulnerable to authenticated sensitive data exposure which allows the users to retrieve sensitive tokens associated to the org-admin account.

CVSS: HIGH (8.1)

EPSS Score: 0.04%

Source: CVE
November 28th, 2024 (7 months ago)

CVE-2024-52307
authentik allows a timing attack due to missing constant time comparison for metrics view
Description: authentik is an open-source identity provider. Due to the usage of a non-constant time comparison for the /-/metrics/ endpoint it was possible to brute-force the SECRET_KEY, which is used to authenticate the endpoint. The /-/metrics/ endpoint returns Prometheus metrics and is not intended to be accessed directly, as the Go proxy running in the authentik server container fetches data from this endpoint and serves it on a separate port (9300 by default), which can be scraped by Prometheus without being exposed publicly. authentik 2024.8.5 and 2024.10.3 fix this issue. Since the /-/metrics/ endpoint is not intended to be accessed publicly, requests to the endpoint can be blocked by the reverse proxy/load balancer used in conjunction with authentik.

CVSS: MEDIUM (6.3)

EPSS Score: 0.04%

Source: CVE
November 28th, 2024 (7 months ago)

CVE-2024-51367
Description: An arbitrary file upload vulnerability in the component \Users\username.BlackBoard of BlackBoard v2.0.0.2 allows attackers to execute arbitrary code via uploading a crafted .xml file.

EPSS Score: 0.04%

Source: CVE
November 28th, 2024 (7 months ago)

CVE-2024-51364
Description: An arbitrary file upload vulnerability in ModbusMechanic v3.0 allows attackers to execute arbitrary code via uploading a crafted .xml file.

EPSS Score: 0.04%

Source: CVE
November 28th, 2024 (7 months ago)

CVE-2024-51330
Description: An issue in UltiMaker Cura v.4.41 and 5.8.1 and before allows a local attacker to execute arbitrary code via Inter-process communication (IPC) mechanism between Cura application and CuraEngine processes, localhost network stack, printing settings and G-code processing and transmission components, Ultimaker 3D Printers.

EPSS Score: 0.04%

Source: CVE
November 28th, 2024 (7 months ago)