RHSA-2024:1867

creationtimestamp| type| source ---|---|--- 2024-11-17 10:25:44+00:00| seen| https://infosec.exchange/users/cve/statuses/113497810108556154 2025-03-06 15:10:49+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/6677 2025-03-26 19:26:07+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/8934...

CVE-2017-13309

In readEncryptedData of ConscryptEngine.java, there is a possible plaintext leak due to improperly used crypto. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2022-20931

creationtimestamp| type| source ---|---|--- 2024-11-15 16:08:32+00:00| seen| https://infosec.exchange/users/cve/statuses/113487833443786916...

PT-2024-34374 · Unknown · Python Food Ordering System

Name of the Vulnerable Software and Affected Versions: python food ordering system version V1.0 Description: The python food ordering system has an unauthorized vulnerability that leads to the leakage of sensitive user information. Attackers can access it through the...

122 million people’s business contact info leaked by data broker

A data broker has confirmed a business contact information database containing 132.8 million records has been leaked online. In February, 2024, a cybercriminal offered the records for sale on a data breach forum claiming the information came from pureincubation.com. Pure Incubation was founded in...

CVE-2024-10396

creationtimestamp| type| source ---|---|--- 2024-11-14 19:34:19+00:00| seen| https://infosec.exchange/users/cve/statuses/113482980334287462 2024-11-14 21:41:09+00:00| seen| https://t.me/cvedetector/11007...

CVE-2024-3502

In lunary-ai/lunary versions up to and including 1.2.5, an information disclosure vulnerability exists where account recovery hashes of users are inadvertently exposed to unauthorized actors. This issue occurs when authenticated users inspect responses from GET /v1/users/me and GET /v1/users/me/o...

PT-2024-34441 · Unknown · Kashipara E-Learning Management System Project

Name of the Vulnerable Software and Affected Versions: KASHIPARA E-learning Management System Project version 1.0 Description: A Stored Cross-Site Scripting XSS issue was found in the /admin/school year.php endpoint, specifically via the school year parameter. This allows remote attackers to...

The vulnerability of the /xml/info.xml file of the HTTP GET Request Handler component in D-Link routers such as DNS-320, DNS-320LW, DNS-325, and DNS-340L microprogrammed software systems allows a hacker to disclose confidential information.

The vulnerability of the /xml/info.xml file of the HTTP GET Request Handler component in D-Link DNS-320, DNS-320LW, DNS-325, and DNS-340L microprogrammed software routers is related to insufficient protection of sensitive data. Exploiting this vulnerability can allow an attacker to disclose...

CVE-2024-34022

creationtimestamp| type| source ---|---|--- 2024-11-13 23:28:03+00:00| seen| https://infosec.exchange/users/cve/statuses/113478237087324193...

CVE-2024-25563

Improper initialization in firmware for some IntelR PROSet/Wireless Software and IntelR KillerTM Wi-Fi before version 23.40 may allow a privileged user to potentially enable information disclosure via local access...

CVE-2024-21850

Sensitive information in resource not removed before reuse in some IntelR TDX Seamldr module software before version 1.5.02.00 may allow a privileged user to potentially enable escalation of privilege via local access...

CVE-2024-43084

In visitUris of multiple files, there is a possible information disclosure due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2024-21949

creationtimestamp| type| source ---|---|--- 2024-11-12 17:37:24+00:00| seen| https://infosec.exchange/users/cve/statuses/113471195978645045...

freerdp: rdp_write_logon_info_v1 NULL access

FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version 3.5.1 are vulnerable to a possible NULL access and crash. Version 3.5.1 contains a patch for the issue. No known workarounds are available...

kernel: drm/amdgpu: change vm->task_info handling

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: change vm-taskinfo handling This patch changes the handling and lifecycle of vm-taskinfo object. The major changes are: - vm-taskinfo is a dynamically allocated ptr now, and its uasge is reference counted. - introduci...

kernel: smb: client: fix use-after-free in smb2_query_info_compound()

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free in smb2queryinfocompound The following UAF was triggered when running fstests generic/072 with KASAN enabled against Windows Server 2022 and mount options...

kernel: cpumap: Zero-initialise xdp_rxq_info struct before running XDP program

In the Linux kernel, the following vulnerability has been resolved: cpumap: Zero-initialise xdprxqinfo struct before running XDP program The Linux kernel CVE team has assigned CVE-2024-27431 to this issue. Upstream advisory:...

CVE-2024-47799

Exposure of sensitive system information to an unauthorized control sphere issue exists in Mesh Wi-Fi router RP562B firmware version v1.0.2 and earlier. If this vulnerability is exploited, a network-adjacent authenticated attacker may obtain information of the other devices connected through the...

CVE-2024-49395 Mutt: neomutt: bcc email header field is indirectly leaked by cryptographic info block

In mutt and neomutt, PGP encryption does not use the --hidden-recipient mode which may leak the Bcc email header field by inferring from the recipients info...