7083 matches found
CVE-2024-42499
Improper limitation of a pathname to a restricted directory 'Path Traversal' issue exists in FitNesse releases prior to 20241026. If this vulnerability is exploited, an attacker may be able to know whether a file exists at a specific path, and/or obtain some part of the file contents under specif...
CVE-2024-11120
CVE-2024-11120 is a pre-auth OS Command Injection affecting certain GeoVision EOL devices. Unauthenticated remote attackers can inject/execute commands, with active exploitation observed in the wild (Mirai-related activity via the /DateSetting.cgi endpoint and szSrvIpAddr parameter). Mitigations ...
CVE-2024-11120 GeoVision EOL devices - OS Command Injection
Certain EOL GeoVision devices have an OS Command Injection vulnerability. Unauthenticated remote attackers can exploit this vulnerability to inject and execute arbitrary system commands on the device. Moreover, this vulnerability has already been exploited by attackers, and we have received relat...
CVE-2024-11120 GeoVision EOL devices - OS Command Injection
Certain EOL GeoVision devices have an OS Command Injection vulnerability. Unauthenticated remote attackers can exploit this vulnerability to inject and execute arbitrary system commands on the device. Moreover, this vulnerability has already been exploited by attackers, and we have received relat...
webkitgtk: Arbitrary Remote Code Execution
A flaw was found in WebKitGTK. Processing malicious web content may lead to remote code execution. This vulnerability is known to be actively exploited in the wild and was included in the CISA's KEV catalog...
webkitgtk: type confusion may lead to arbitrary code execution
A flaw was found in WebKitGTK. Processing malicious web content may lead to remote code execution due to a type confusion issue. This vulnerability is known to be actively exploited in the wild and was included in the CISA's KEV catalog...
webkitgtk: Arbitrary Remote Code Execution
A flaw was found in WebKitGTK. Processing malicious web content may lead to remote code execution. This vulnerability is known to be actively exploited in the wild and was included in the CISA's KEV catalog...
webkitgtk: type confusion may lead to arbitrary code execution
A flaw was found in WebKitGTK. Processing malicious web content may lead to remote code execution due to a type confusion issue. This vulnerability is known to be actively exploited in the wild and was included in the CISA's KEV catalog...
webkitgtk: Arbitrary Remote Code Execution
A flaw was found in WebKitGTK. Processing malicious web content may lead to remote code execution. This vulnerability is known to be actively exploited in the wild and was included in the CISA's KEV catalog...
CVE-2018-17431
creationtimestamp| type| source ---|---|--- 2024-11-14 06:07:03+00:00| seen| MISP/0ffb58bb-1622-4d63-95e3-9bd2d81e65e1 2024-12-27 00:00:00+00:00| seen| The Shadowserver honeypot/common-vulnerabilities - 2024-12-27 2025-01-26 00:00:00+00:00| seen| The Shadowserver honeypot/common-vulnerabilities -...
CVE-2019-19824
creationtimestamp| type| source ---|---|--- 2024-11-14 00:00:00+00:00| exploited| The Shadowserver honeypot/exploited-vulnerabilities - 2024-11-14 2024-12-09 00:00:00+00:00| exploited| The Shadowserver honeypot/exploited-vulnerabilities - 2024-12-09 2024-12-25 00:00:00+00:00| exploited| The...
DEBIAN-CVE-2024-4741
Issue summary: Calling the OpenSSL API function SSLfreebuffers may cause memory to be accessed that was previously freed in some situations Impact summary: A use after free can have a range of potential consequences such as the corruption of valid data, crashes or execution of arbitrary code...
CVE-2024-52268
Cross-site scripting vulnerability exists in VK All in One Expansion Unit versions prior to 9.100.1.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is accessing the web site using the product...
CVE-2024-52268
The CVE-2024-52268 entry concerns the VK All in One Expansion Unit WordPress plugin. A stored cross-site scripting (CWE-79) vulnerability affects versions prior to 9.100.1.0, allowing an attacker to execute arbitrary JavaScript in a user’s browser when visiting a site using the vulnerable plugin....
CVE-2024-8069
creationtimestamp| type| source ---|---|--- 2024-11-12 16:21:28+00:00| seen| https://infosec.exchange/users/screaminggoat/statuses/113470897346004162 2024-11-12 19:44:08+00:00| seen| https://t.me/cvedetector/10676 2024-11-12 21:23:09+00:00| seen|...
CISA, FBI, NSA, and International Partners Release Joint Advisory on 2023 Top Routinely Exploited Vulnerabilities
Today, the Cybersecurity and Infrastructure Security Agency CISA, the Federal Bureau of Investigation FBI, National Security Agency NSA, and international partners released joint Cybersecurity Advisory, 2023 Top Routinely Exploited Vulnerabilities. This advisory supplies details on the top Common...
CVE-2024-29075
Active debug code vulnerability exists in Mesh Wi-Fi router RP562B firmware version v1.0.2 and earlier. If this vulnerability is exploited, a network-adjacent authenticated attacker may obtain or alter the settings of the device...
PT-2024-8515
Name of the Vulnerable Software and Affected Versions: Citrix Virtual Apps and Desktops CVAD versions 1912 LTSR, 2203, 2402, and 2407 Description: This issue involves improper privilege management within the Session Recording component of Citrix Virtual Apps and Desktops CVAD. Exploitation allows...
CVE-2018-17246
creationtimestamp| type| source ---|---|--- 2024-11-12 00:00:00+00:00| seen| The Shadowserver honeypot/common-vulnerabilities - 2024-11-12 2024-11-18 00:00:00+00:00| seen| The Shadowserver honeypot/common-vulnerabilities - 2024-11-18 2024-12-23 00:00:00+00:00| seen| The Shadowserver...
CVE-2021-29442
creationtimestamp| type| source ---|---|--- 2024-11-11 00:00:00+00:00| exploited| The Shadowserver honeypot/exploited-vulnerabilities - 2024-11-11 2024-11-12 00:00:00+00:00| seen| The Shadowserver honeypot/common-vulnerabilities - 2024-11-12 2024-11-18 00:00:00+00:00| seen| The Shadowserver...