K000137522: BIG-IP iControl REST vulnerability CVE-2024-22093

Security Advisory Description When running in Appliance mode, an authenticated remote command injection vulnerability exists in an undisclosed iControl REST endpoint on multi-bladed systems. A successful exploit can allow the attacker to cross a security boundary. CVE-2024-22093 Impact This...

CVE-2024-24189

creationtimestamp| type| source ---|---|--- 2024-02-07 15:26:32+00:00| seen| https://t.me/ctinow/180748 2024-03-01 19:17:01+00:00| seen| https://t.me/ctinow/197917 2025-06-20 20:44:18+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/19075...

Critical Vulnerabilities in Ivanti Exploited in-the-Wild: everything you need to know

Detect and mitigate CVE-2023-46805, CVE-2024-21887, CVE-2024-21888 and CVE-2024-21893, critical vulnerabilities in Ivanti VPN products. Organizations should patch urgently, and government agencies are instructed to isolate Ivanti VPN instances...

CVE-2024-22901

creationtimestamp| type| source ---|---|--- 2024-02-02 03:22:02+00:00| seen| https://t.me/ctinow/177899 2024-02-05 13:40:05+00:00| published-proof-of-concept| https://t.me/truesecator/5374 2024-02-07 21:17:19+00:00| seen| https://t.me/ctinow/180973 2024-02-24 14:47:01+00:00| seen|...

CVE-2024-24756 Crafatar path traversal vulnerability

Crafatar serves Minecraft avatars based on the skin for use in external applications. Files outside of the lib/public/ directory can be requested from the server. Instances running behind Cloudflare including crafatar.com are not affected. Instances using the Docker container as shown in the READ...

Hardcoded credentials

Hard-coded credentials in mod-remote-storage versions under 1.7.2 and from 2.0.0 to 2.0.3 allows unauthorized users to gain read access to mod-inventory-storage records including instances, holdings, items, contributor-types, and identifier-types...

CVE-2024-21597

An Exposure of Resource to Wrong Sphere vulnerability in the Packet Forwarding Engine PFE of Juniper Networks Junos OS on MX Series allows an unauthenticated, network-based attacker to bypass the intended access restrictions. In an Abstracted Fabric AF scenario if routing-instances RI are...

Design/Logic Flaw

An Exposure of Resource to Wrong Sphere vulnerability in the Packet Forwarding Engine PFE of Juniper Networks Junos OS on MX Series allows an unauthenticated, network-based attacker to bypass the intended access restrictions. In an Abstracted Fabric AF scenario if routing-instances RI are...

CVE-2024-21597 Junos OS: MX Series: In an AF scenario traffic can bypass configured lo0 firewall filters

An Exposure of Resource to Wrong Sphere vulnerability in the Packet Forwarding Engine PFE of Juniper Networks Junos OS on MX Series allows an unauthenticated, network-based attacker to bypass the intended access restrictions. In an Abstracted Fabric AF scenario if routing-instances RI are...

CVE-2023-51960

creationtimestamp| type| source ---|---|--- 2024-01-10 16:32:20+00:00| seen| https://t.me/ctinow/165917 2024-01-13 08:16:58+00:00| seen| https://t.me/ctinow/167729 2024-01-28 14:26:39+00:00| seen| https://t.me/ctinow/174948...

PT-2024-1131 · Juniper Networks · Junos

Name of the Vulnerable Software and Affected Versions: Juniper Networks Junos OS on MX Series versions earlier than 20.4R3-S9 Juniper Networks Junos OS on MX Series version 21.2 versions earlier than 21.2R3-S3 Juniper Networks Junos OS on MX Series version 21.4 versions earlier than 21.4R3-S5...

CVE-2023-49920

creationtimestamp| type| source ---|---|--- 2023-12-21 11:22:22+00:00| seen| https://t.me/ctinow/157613 2024-01-10 14:21:45+00:00| seen| https://t.me/ctinow/165802 2024-01-14 10:11:39+00:00| seen| https://t.me/ctinow/167984...

PT-2023-31832 · Navidrome · Navidrome

Name of the Vulnerable Software and Affected Versions: Navidrome versions prior to 0.50.2 Description: A security issue has been identified in Navidrome's subsonic endpoint, allowing for authentication bypass. This exploit enables unauthorized access to any known account by utilizing a JSON Web...

CVE-2023-50263

Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. In Nautobot 1.x and 2.0.x prior to 1.6.7 and 2.0.6, the URLs /files/get/?name=... and /files/download/?name=... are used to provid...

Different numbers of launches reported in the Dashboard vs. Activity Manager views of Director

The number of application instances displayed in Director under 'Sessions' 'Applications' and in 'User' 'Activity Manager' doesn't match, with higher numbers reported in 'Activity Manager'...

RHEL 9 : Red Hat Ceph Storage 6.1 (RHSA-2023:7740)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7740 advisory. Red Hat Ceph Storage is a scalable, open, software-defined storage platform that combines the most stable version of the Ceph storage system...

Ultimate Dashboard < 3.7.11 - Login Page Disclosure on Multi-site

Description The plugin is vulnerable to secret login page disclosure, allowing unauthenticated attackers to discover the secret login page URL on multi-site instances...

Cactus Ransomware Exploits Vulnerabilities in Qlik Sense

Summary: The Cactus ransomware is actively exploiting critical Qlik Sense vulnerabilities, with the ultimate goal of establishing persistence and enabling remote control, infiltrating corporate networks stealthily. This serves as a stark reminder that unpatched Qlik Sense instances are prime...

ALSA-2023:6943 Moderate: cloud-init security, bug fix, and enhancement update

The cloud-init packages provide a set of init scripts for cloud instances. Cloud instances need special scripts to run during initialization to retrieve and install SSH keys, and to let the user run various scripts. Security Fixes: cloud-init: sensitive data could be exposed in logs CVE-2023-1786...

VulnCheck KEV: CVE-2021-4191

An issue has been discovered in GitLab CE/EE affecting versions 13.0 to 14.6.5, 14.7 to 14.7.4, and 14.8 to 14.8.2. Private GitLab instances with restricted sign-ups may be vulnerable to user enumeration to unauthenticated users through the GraphQL API...