PT-2024-9272 · Servicenow · Servicenow Now Platform

Name of the Vulnerable Software and Affected Versions: ServiceNow Now Platform affected versions not specified Description: The issue is related to a blind SQL injection vulnerability in the Now Platform, which could allow an unauthenticated user to extract unauthorized information. This...

PT-2024-9533 · Servicenow · Servicenow

Name of the Vulnerable Software and Affected Versions: ServiceNow affected versions not specified Description: The issue is related to incorrect code generation management in the Now Platform, which could enable an unauthenticated user to remotely execute code within the context of the Now...

CVE-2024-45219

Apache CloudStack CVE-2024-45219 concerns a KVM-related vulnerability where default user uploads/registrations of templates and volumes can bypass validation for KVM-compatible disks. The issue spans CloudStack versions 4.0.0–4.18.2.3 and 4.19.0.0–4.19.1.1, allowing an attacker who can upload or ...

CVE-2024-9916

creationtimestamp| type| source ---|---|--- 2024-10-13 22:16:19+00:00| seen| https://t.me/cvedetector/7789 2025-02-12 09:28:20+00:00| seen| https://infosec.exchange/users/shadowserver/statuses/113990205373134629 2025-02-12 09:29:27+00:00| seen|...

PT-2024-7225 · Pfsense · Pfsense

Name of the Vulnerable Software and Affected Versions: pfsense version 2.5.2 Description: A cross-site scripting XSS vulnerability in pfsense allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the $pconfig variable at "interfaces groups edit.php". This...

CVE-2024-8912

An HTTP Request Smuggling vulnerability in Looker allowed an unauthorized attacker to capture HTTP responses destined for legitimate users. There are two Looker versions that are hosted by Looker: Looker Google Cloud core was found to be vulnerable. This issue has already been mitigated and our...

CVE-2024-8912 HTTP Request Smuggling in Looker

An HTTP Request Smuggling vulnerability in Looker allowed an unauthorized attacker to capture HTTP responses destined for legitimate users. There are two Looker versions that are hosted by Looker: Looker Google Cloud core was found to be vulnerable. This issue has already been mitigated and our...

PT-2024-39313 · Looker · Looker

Name of the Vulnerable Software and Affected Versions: Looker versions prior to 23.12.123 Looker versions prior to 23.18.117 Looker versions prior to 24.0.92 Looker versions prior to 24.6.77 Looker versions prior to 24.8.66 Looker versions prior to 24.10.78 Looker versions prior to 24.12.56 Looke...

CVE-2024-47813 Wasmtime race condition could lead to WebAssembly control-flow integrity and type safety violations

Wasmtime is an open source runtime for WebAssembly. Under certain concurrent event orderings, a wasmtime::Engine's internal type registry was susceptible to double-unregistration bugs due to a race condition, leading to panics and potentially type registry corruption. That registry corruption...

Malicious Package

Overview branch-extension is a malicious package. This package contains malicious code that collects sensitive information about the victim and sends it to the attacker's remote server. While this package might be attempting to impersonate a valid organization, there is no connection between that...

Malicious Package

Overview svelte-hms-world is a malicious package. This package contains malicious code that collects sensitive information about the victim and sends it to the attacker's remote server. While this package might be attempting to impersonate a valid organization, there is no connection between that...

Malicious Package

Overview uchiwa is a malicious package. This package contains malicious code that collects sensitive information about the victim and sends it to the attacker's remote server. While this package might be attempting to impersonate a valid organization, there is no connection between that...

CVE-2024-8118

Grafana vulnerability CVE-2024-8118: The alert rule write API endpoint uses incorrect permissions, allowing users who can write external alert instances to also write alert rules. This is the same issue described in BIT-GRAFANA-2024-8118 and OSV entries, which confirm the description but do not p...

CVE-2024-8118

In Grafana, the wrong permission is applied to the alert rule write API endpoint, allowing users with permission to write external alert instances to also write alert rules...

CVE-2024-8945

creationtimestamp| type| source ---|---|--- 2024-09-17 20:37:34+00:00| seen| https://t.me/cvedetector/5821 2025-03-28 15:46:03+00:00| seen| https://bsky.app/profile/nimblenerd.social/post/3llh5vucbtd2e 2025-03-29 21:02:07+00:00| seen|...

GHSA-V6X6-4V4X-2FX9 Withdrawn Advisory: Lunary Cross-Site Request Forgery (CSRF) vulnerability

Withdrawn Advisory This advisory has been withdrawn because the lunary npm package is connected to https://github.com/lunary-ai/lunary-js, not the https://github.com/lunary-ai/lunary repo that is discussed in this advisory. The underlying vulnerability report is still valid, but it doesn't affect...

Siemens SIMATIC RFID Readers Improper Access Control Vulnerability

SIMATIC RF600 Readers are used for contactless identification of a variety of objects such as shipping containers, pallets, production goods, or often for recording bulk goods.SIMATIC RF1100 is an RFID-based solution for simple and versatile electronic authorization management.SIMATIC RF360R read...

CVE-2024-37993

A vulnerability has been identified in SIMATIC Reader RF610R CMIIT 6GT2811-6BC10-2AA0 All versions V4.2, SIMATIC Reader RF610R ETSI 6GT2811-6BC10-0AA0 All versions V4.2, SIMATIC Reader RF610R FCC 6GT2811-6BC10-1AA0 All versions V4.2, SIMATIC Reader RF615R CMIIT 6GT2811-6CC10-2AA0 All versions V4....

CVE-2024-37993

A vulnerability has been identified in SIMATIC Reader RF610R CMIIT 6GT2811-6BC10-2AA0 All versions V4.2, SIMATIC Reader RF610R ETSI 6GT2811-6BC10-0AA0 All versions V4.2, SIMATIC Reader RF610R FCC 6GT2811-6BC10-1AA0 All versions V4.2, SIMATIC Reader RF615R CMIIT 6GT2811-6CC10-2AA0 All versions V4....

The vulnerability of the automated deployment and scaling service for managed Apache Cassandra Azure Managed Instances lies in the lack of access control mechanisms, allowing attackers to escalate their privileges.

The vulnerability of the automated deployment and scaling service for managed Apache Cassandra instances in Azure is related to lack of access control. Exploiting this vulnerability could allow an attacker to enhance their privileges remotely...