CVE-2014-5513

Removed by vendor...

CVE-2014-5514

CVE-2014-5514 is represented as a reserved placeholder in the Initial document. The connected Ubuntu entry notes that ntopng had several vulnerabilities fixed upstream in version 1.2.1, which provides a remediation reference, but the provided materials do not include concrete technical details (a...

CVE-2014-5512

CVE-2014-5512 is associated with ntopng; Ubuntu notes indicate several vulnerabilities fixed upstream in version 1.2.1. Debian entry was removed by vendor. No specific exploitation details are provided in the connected sources. Mitigation mentioned: upgrade to ntopng 1.2.1 or later as per upstrea...

CVE-2014-5512

Removed by vendor...

CVE-2022-2205

Technical details for CVE-2022-2205 are not publicly available in the provided documents. Monitor for updates.

CVE-2014-9586

CVE-2014-9586 involves a lack of bounds checking in protocol parsing C++ code emitted by the binpac utility, as described by the Ubuntu security page. The connected Debian/OSV entries provide reservation/no detailed technical info, while the Ubuntu entry confirms the root cause but does not suppl...

CVE-2024-25635

alf.io is an open source ticket reservation system. Prior to version 2.0-Mr-2402, organization owners can view the generated API KEY and USERS of other organization owners using the http://192.168.26.128:8080/admin/api/users/ endpoint, which exposes the details of the provided user ID. This may...

CVE-2024-25635 IDOR Vulnerability: Allowing Organization Owner to view the other Organizations API KEY and USERS

alf.io is an open source ticket reservation system. Prior to version 2.0-Mr-2402, organization owners can view the generated API KEY and USERS of other organization owners using the http://192.168.26.128:8080/admin/api/users/ endpoint, which exposes the details of the provided user ID. This may...

CVE-2024-25635 IDOR Vulnerability: Allowing Organization Owner to view the other Organizations API KEY and USERS

alf.io is an open source ticket reservation system. Prior to version 2.0-Mr-2402, organization owners can view the generated API KEY and USERS of other organization owners using the http://192.168.26.128:8080/admin/api/users/ endpoint, which exposes the details of the provided user ID. This may...

CVE-2022-4094

Technical details for CVE-2022-4094 are not publicly available in the provided documents; no affected products, impact, or remediation are described. Monitor for updates.

PT-2024-21055 · Alf.Io · Alf.Io

Name of the Vulnerable Software and Affected Versions: alf.io versions prior to 2.0-Mr-2402 Description: The issue allows organization owners to view the generated API KEY and USERS of other organization owners. This is achieved through the "http://192.168.26.128:8080/admin/api/users/" endpoint,...

CISA and MS-ISAC Release Advisory on Compromised Account Used to Access State Government Organization

Today, CISA and the Multi-State Information Sharing & Analysis Center MS-ISAC released a joint Cybersecurity Advisory CSA, Threat Actor Leverages Compromised Account of Former Employee to Access State Government Organization to provide network defenders with the tactics, techniques, and procedure...

CVE-2024-25669

CaseAware a360inc contains a reflected cross-site scripting vulnerability in the user parameter passed to login.php. Exploitation could inject scripts into pages viewed by users, potentially enabling data theft, session hijacking, or defacement. The issue is reported as a bypass of a 2017 fix. Af...

Open redirect

Rejected reason: This is unused...

HackerOne: Non Org Admin/Group Manager can create groups in an organization

The report described a privilege escalation vulnerability that allowed a user with "Program Admin" permissions to escalate their privileges to higher levels, such as "Report Manager" or full administrator privileges, under certain circumstances. The vulnerability existed due to a mutation in the...

Stealthy Zardoor Backdoor Targets Saudi Islamic Charity Organization

An unnamed Islamic non-profit organization in Saudi Arabia has been targeted as part of a stealthy cyber espionage campaign designed to drop a previously undocumented backdoor called Zardoor. Cisco Talos, which discovered the activity in May 2023, said the campaign has likely persisted since at...

CVE-2024-25674

An issue was discovered in MISP before 2.4.184. Organisation logo upload is insecure because of a lack of checks for the file extension and MIME type...

CVE-2024-24830 OpenObserve Privilege Escalation Vulnerability in Users API

OpenObserve is a observability platform built specifically for logs, metrics, traces, analytics, designed to work at petabyte scale. A vulnerability has been identified in the "/api/orgid/users" endpoint. This vulnerability allows any authenticated regular user 'member' to add new users with...

CVE-2024-25106 OpenObserve Unauthorized Access Vulnerability in Users API

OpenObserve is a observability platform built specifically for logs, metrics, traces, analytics, designed to work at petabyte scale. A critical vulnerability has been identified in the "/api/orgid/users/emailid" endpoint. This vulnerability allows any authenticated user within an organization to...

CVE-2024-25106 OpenObserve Unauthorized Access Vulnerability in Users API

OpenObserve is a observability platform built specifically for logs, metrics, traces, analytics, designed to work at petabyte scale. A critical vulnerability has been identified in the "/api/orgid/users/emailid" endpoint. This vulnerability allows any authenticated user within an organization to...