CVE-2024-2291

CVE-2024-2291 (MOVEit Transfer) is a logging bypass vulnerability affecting MOVEit Transfer versions prior to 2022.0.11 (14.0.11), 2022.1.12 (14.1.12), 2023.0.9 (15.0.9), and 2023.1.4 (15.1.4). An authenticated user can manipulate a request to bypass the web application’s logging mechanism, causi...

CVE-2024-23721

CVE-2024-23721 concerns a Directory Traversal in the Draytek Vigor3910, specifically in the process_post function. Affected product/version: Draytek Vigor3910 4.3.2.5 and earlier. The issue is triggered by a crafted POST request that causes the function to export information, indicating a potenti...

Lurking in the Shadows: Attack Trends Shine Light on API Threats

...

CVE-2024-2632

Summary: CVE-2024-2632 is an information-exposure vulnerability in Meta4 HR exposed via HTTP GET to /sitetest/english/dumpenv.jsp. The endpoint reportedly leaks substantial environment details, including process variables, Tomcat version, library versions, and underlying OS. Sources across NVD/CV...

CVE-2024-1145

The CVE-2024-1145 entry concerns Devklan’s Alma Blog (versions 2.1.10 and earlier) with a user-enumeration vulnerability. The affected component is the user-facing response handling that allows a remote attacker to discover valid user accounts by inspecting request responses. Impact is informatio...

CVE-2024-26030

Adobe Experience Manager 6.5.19 and earlier are affected by a stored XSS vulnerability in vulnerable form fields. The issue allows attacker-injected JavaScript to run in a victim’s browser when visiting affected pages. Remediation is available via Adobe APSB24-05 security update; apply the APSB24...

Authorization Bypass

Mattermost is vulnerable to Authorization Bypass in Playbooks Plugin Endpoint. The vulnerability is due to Mattermost's failure to perform authorization checks in the /plugins/playbooks/api/v0/runs/add-to-timeline-dialog endpoint of the Playbooks plugin. This allows an attacker to obtain limited...

CVE-2024-22257

CVE-2024-22257 refers to a broken access control in Spring Security where an application vulnerable if it directly uses AuthenticatedVoter.vote with a null Authentication. The entry lists affected versions: 5.7.x prior to 5.7.12, 5.8.x prior to 5.8.11, 6.0.x prior to 6.0.9, 6.1.x prior to 6.1.8, ...

CVE-2024-2586

AMSS++ v4.31 is affected by CVE-2024-2586 due to an SQL injection in the username parameter of /amssplus/index.php, allowing an attacker to craft a query to retrieve data from the database. The vulnerability is network-based with low exploit complexity, and the impact is on confidentiality (high)...

CVE-2024-2002

CVE-2024-2002 describes a double-free in libdwarf when processing a multiply-corrupted DWARF object, where an allocation may be freed twice, leading to unpredictable results. Multiple connected advisories (Red Hat, CBL Mariner, Tencent/TSSA, Azure Linux, etc.) confirm libdwarf as the vulnerable c...

CVE-2024-28039

CVE-2024-28039 affects FitNesse (all releases) with an improper restriction of XML external entity references (CWE-611). A remote, unauthenticated attacker can potentially obtain sensitive information, alter data, or cause a denial-of-service (DoS). Public documents consistently describe the impa...

UPS Network Management Card 4 - Path Traversal Vulnerability

Exploit Title: UPS Network Management Card 4 - Path Traversal Google Dork: inurl:nmc inurl:logon.htm Exploit Author: Víctor García Vendor Homepage: https://www.apc.com/ Version: 4 Tested on: Kali Linux CVE: N/A PoC: curl -k...

Cisco IP Phones Stored Cross-Site Scripting (CVE-2023-20265)

A vulnerability in the web-based management interface of a small subset of Cisco IP Phones could allow an authenticated, remote attacker to conduct a stored cross-site scripting XSS attack against a user of the interface on an affected device. This vulnerability is due to insufficient validation ...

CVE-2024-24867

CVE-2024-24867 affects the WordPress plugin WP Visitor Statistics (Real Time Traffic). Affected software: WP Visitor Statistics (Real Time Traffic) versions up to 6.9.4. The underlying issue is exposure of sensitive information to unauthorized actors via log files. CVSS data indicate a NETWORK at...

CVE-2024-25933

CVE-2024-25933 concerns PeproDev Ultimate Invoice plugin for WordPress. Public details in connected sources indicate unauthenticated exposure of sensitive information via the init_plugin path, affecting PeproDev Ultimate Invoice versions up to 1.9.7. The NVD metrics assign a high base score (7.5)...

CVE-2019-6022

creationtimestamp| type| source ---|---|--- 2024-03-17 09:47:07+00:00| seen| https://t.me/ctinow/209831...

CVE-2019-19910

creationtimestamp| type| source ---|---|--- 2024-03-16 09:22:00+00:00| seen| https://t.me/ctinow/209426...

CVE-2019-5080

creationtimestamp| type| source ---|---|--- 2024-03-16 06:46:24+00:00| seen| https://t.me/ctinow/209362 2025-09-09 09:06:14+00:00| seen| https://bsky.app/profile/certvde.infosec.exchange.ap.brid.gy/post/3lyfeceklkj52...

CVE-2019-11108

creationtimestamp| type| source ---|---|--- 2024-03-15 14:21:55+00:00| seen| https://t.me/ctinow/208769...

CVE-2023-27502

Intel Local Manageability Service prior to v2316.5.1.2 is affected by CVE-2023-27502, which enables potential information disclosure via local access through log message disclosure. The issue is limited to authenticated Local Manageability Service users and involves sensitive data being written i...