CVE-2024-25620 vulnerabilities

Vulnerabilities for packages: k8sgpt, flux-source-controller, kubescape, zarf, up, cilium-cli, eksctl, flux-helm-controller, helm-operator, zot, helm-push, trivy, kubevela, kots, k9s, chartmuseum...

AZL-34355 CVE-2024-25620 affecting package cert-manager for versions less than 1.11.2-12

Helm is a tool for managing Charts. Charts are packages of pre-configured Kubernetes resources. When either the Helm client or SDK is used to save a chart whose name within the Chart.yaml file includes a relative path change, the chart would be saved outside its expected directory based on the...

CVE-2023-34983

creationtimestamp| type| source ---|---|--- 2024-02-14 17:02:54+00:00| seen| https://t.me/ctinow/184802 2024-03-06 13:41:09+00:00| seen| https://t.me/ctinow/201339 2026-03-19 00:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0316/...

CVE-2023-31347

creationtimestamp| type| source ---|---|--- 2024-02-13 21:31:50+00:00| seen| https://t.me/ctinow/184231 2026-03-19 00:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0316/...

CVE-2023-31346

creationtimestamp| type| source ---|---|--- 2024-02-13 21:31:49+00:00| seen| https://t.me/ctinow/184230 2026-03-19 00:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0316/...

Siemens SCALANCE W1750D

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories CERT Services | Services |...

SUSE: Security Advisory (SUSE-SU-2023:2882-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2023-50782

creationtimestamp| type| source ---|---|--- 2024-02-05 22:21:26+00:00| seen| https://t.me/ctinow/179542 2026-03-19 00:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0316/...

CVE-2023-7216

creationtimestamp| type| source ---|---|--- 2024-02-05 16:31:18+00:00| seen| https://t.me/ctinow/179312 2024-02-06 05:16:20+00:00| seen| https://t.me/ctinow/179748 2024-02-13 03:16:22+00:00| seen| https://t.me/ctinow/183576 2024-05-14 03:25:11+00:00| published-proof-of-concept|...

CVE-2024-24864

creationtimestamp| type| source ---|---|--- 2024-02-05 09:31:40+00:00| seen| https://t.me/ctinow/179072 2024-02-29 08:16:42+00:00| seen| https://t.me/ctinow/196324 2026-03-19 00:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0316/ 2026-06-28 15:08:19+00:00| seen|...

Russian APT28 Hackers Targeting High-Value Orgs with NTLM Relay Attacks

Russian state-sponsored actors have staged NT LAN Manager NTLM v2 hash relay attacks through various methods from April 2022 to November 2023, targeting high-value targets worldwide. The attacks, attributed to an "aggressive" hacking crew called APT28, have set their eyes on organizations dealing...

DirtyMoe Malware Infects 2,000+ Ukrainian Computers for DDoS and Cryptojacking

The Computer Emergency Response Team of Ukraine CERT-UA has warned that more than 2,000 computers in the country have been infected by a strain of malware called DirtyMoe. The agency attributed the campaign to a threat actor it calls UAC-0027. DirtyMoe, active since at least 2016, is capable of...

GHSA-XW73-RW38-6VJC vulnerabilities

Vulnerabilities for packages: docker-credential-gcr, nerdctl, skaffold, k3s, vexctl, skopeo, helm, argo-workflows, cri-tools, ko-fips, gitsign, cadvisor-fips, policy-controller-fips, scorecard, docker-machine-driver-harvester, helm-fips, kubevela, falcoctl, falcoctl-fips, kargo, tekton-chains,...

CVE-2024-24557 vulnerabilities

Vulnerabilities for packages: docker-credential-gcr, nerdctl, skaffold, k3s, vexctl, skopeo, helm, argo-workflows, cri-tools, ko-fips, gitsign, cadvisor-fips, policy-controller-fips, scorecard, docker-machine-driver-harvester, helm-fips, kubevela, falcoctl, falcoctl-fips, kargo, tekton-chains,...

CVE-2023-51837

CVE-2023-51837 affects MeshCentral 1.1.16. The issue is missing SSL certificate validation in HTTPS/TLS handling, enabling high-impact exposure on network access (confidentiality, integrity, and availability all rated high). Public references consistently describe the vulnerability without giving...

Authentication flaw

Dex is an identity service that uses OpenID Connect to drive authentication for other apps. Dex 2.37.0 serves HTTPS with insecure TLS 1.0 and TLS 1.1. cmd/dex/serve.go line 425 seemingly sets TLS 1.2 as minimum version, but the whole tlsConfig is ignored after TLS cert reloader was introduced in...

CVE-2023-2007

creationtimestamp| type| source ---|---|--- 2024-01-19 18:32:05+00:00| seen| https://t.me/ctinow/170328 2026-03-19 00:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0316/...

CVE-2024-22195

creationtimestamp| type| source ---|---|--- 2024-01-11 04:32:16+00:00| seen| https://t.me/ctinow/166304 2024-01-11 12:16:32+00:00| seen| https://t.me/ctinow/166471 2024-01-26 20:23:05+00:00| seen| https://t.me/arpsyndicate/3059 2024-01-30 09:41:34+00:00| seen| https://t.me/ctinow/175778 2025-02-1...

PT-2024-4665 · Python +9 · Python +9

Name of the Vulnerable Software and Affected Versions: Python versions prior to 3.10.14 Python versions prior to 3.11.9 Python versions prior to 3.12.3 Python versions prior to 3.13.0a5 Description: A defect was discovered in the Python “ssl” module where there is a memory race condition with the...

CVE-2023-50495

creationtimestamp| type| source ---|---|--- 2024-01-02 14:36:31+00:00| seen| https://t.me/ctinow/161788 2024-01-19 18:32:08+00:00| seen| https://t.me/ctinow/170331 2026-03-19 00:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0316/...