CVE-2024-47031

Android before 2024-10-05 on Google Pixel devices allows privilege escalation in the ABL component, A-329163861...

CVE-2024-47014

Android before 2024-10-05 on Google Pixel devices allows privilege escalation in the ABL component, A-330537292...

CVE-2024-49357

CVE-2024-49357 affects ZimaOS (a CasaOS fork) on Zima devices and x86-64 with UEFI. Versions 1.2.4 and earlier expose sensitive data through unauthenticated API endpoints, e.g. /v1/users/image?path=/var/lib/casaos/1/app_order.json and /var/lib/casaos/1/system.json, enabling attackers to view inst...

CVE-2024-49357 ZimaOS (Installed Applications and System Information) has Unauthorized Sensitive Data Leak

ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.2.4 and all prior versions, the API endpoints in ZimaOS, such as http:///v1/users/image?path=/var/lib/casaos/1/apporder.json and http:///v1/users/image?path=/var/lib/casaos/1/system.json,...

CVE-2024-47878

OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, the /extension/gdata/authorized endpoint includes the state GET parameter verbatim in a tag in the output, so without escaping. An attacker could lead or redirect a user to a crafted URL containing...

CVE-2024-44206

creationtimestamp| type| source ---|---|--- 2024-10-24 20:09:59+00:00| seen| https://t.me/cvedetector/8815 2024-11-21 20:09:30+00:00| seen| https://infosec.exchange/users/harrysintonen/statuses/113522754831271673 2026-04-02 21:40:09+00:00| seen|...

CVE-2024-48542

CVE-2024-48542 affects Yamaha Headphones Controller, version 1.6.7. According to the connected sources, the root cause is incorrect access control in the firmware update and download processes, which enables attackers to access sensitive information by inspecting the APK’s code and data. Impact i...

CVE-2024-20264 Cisco Firepower Management Center Software Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Firepower Management Center FMC Software could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the interface of an affected device. This vulnerability is due to insufficient...

BELL-CVE-2024-49933

Bulletin has no description...

CVE-2024-7587

creationtimestamp| type| source ---|---|--- 2024-10-22 12:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-24-296-01 2024-10-23 02:20:16+00:00| seen| https://t.me/cvedetector/8670 2024-10-31 18:39:00+00:00| seen| https://t.me/icscert/939 2025-03-11 11:30:05+00:00| seen|...

CVE-2022-48993

REJECTED CVE A memory initialization vulnerability in the Linux Kernel's fbcon module allows uninitialized memory in the save variable to be copied during operations in fbconpreparelogo. This can result in unpredictable behavior, including kernel crashes or memory corruption, when handling frame...

CVE-2024-35286

creationtimestamp| type| source ---|---|--- 2024-10-22 00:24:20+00:00| seen| https://t.me/cvedetector/8577 2024-12-05 14:44:20+00:00| published-proof-of-concept| https://t.me/thebugbountyhunter/9404 2024-12-05 16:34:02+00:00| seen|...

CVE-2022-48949 igb: Initialize mailbox message for VF reset

In the Linux kernel, the following vulnerability has been resolved: igb: Initialize mailbox message for VF reset When a MAC address is not assigned to the VF, that portion of the message sent to the VF is not set. The memory, however, is allocated from the stack meaning that information may be...

CVE-2024-49874

In the Linux kernel, the following vulnerability has been resolved: i3c: master: svc: Fix use after free vulnerability in svci3cmaster Driver Due to Race Condition In the svci3cmasterprobe function, &master-hjwork is bound with svci3cmasterhjwork, &master-ibiwork is bound with svci3cmasteribiwork...

CVE-2024-49966 ocfs2: cancel dqi_sync_work before freeing oinfo

In the Linux kernel, the following vulnerability has been resolved: ocfs2: cancel dqisyncwork before freeing oinfo ocfs2globalreadinfo will initialize and schedule dqisyncwork at the end, if error occurs after successfully reading global quota, it will trigger the following warning with...

Internet Archive attackers email support users: “Your data is now in the hands of some random guy”

Those who hacked the Internet Archive haven't gone away. Users of the Internet Archive who have submitted helpdesk tickets are reporting replies to the tickets from the hackers themselves. Internet Archive, most known for its Wayback Machine, is a digital library that allows users to look at...

CVE-2024-49215

creationtimestamp| type| source ---|---|--- 2024-10-21 04:17:57+00:00| seen| https://t.me/cvedetector/8444...

CVE-2024-6333

creationtimestamp| type| source ---|---|--- 2024-10-17 16:38:44+00:00| seen| https://t.me/cvedetector/8184 2026-07-25 15:00:20+00:00| seen| https://t.me/ZerodayAlert/364 2026-07-26 00:00:44+00:00| seen| https://t.me/ZerodayAlert/364 2026-08-06 07:00:04+00:00| seen| https://t.me/ZerodayAlert/364...

CVE-2024-49580

The CVE-2024-49580 issue affects JetBrains Ktor, specifically the HttpCache Plugin, due to improper caching that can disclose response information. Affected products/versions include Ktor before 2.3.13 (and, per PT-Security, before 3.0.0 for related caching behavior). The documented impact is inf...

Esri Portal For ArcGIS Cross-Site Scripting Hole (CNVD-2024-41006)

Esri Portal For ArcGIS is a component from Environmental Systems Research Institute Esri that allows maps, scenes, applications, and other geographic information to be shared with others within an organization. Esri Portal For ArcGIS suffers from a cross-site scripting vulnerability that can be...