Directus `search` query parameter allows enumeration of non permitted fields

Summary The search query parameter allows users with access to a collection to filter items based on fields they do not have permission to view. This allows the enumeration of unknown field contents. Details The searchable columns numbers & strings are not checked against permissions when injecti...

CVE-2025-2189

creationtimestamp| type| source ---|---|--- 2025-03-11 13:39:53+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/7137 2025-03-11 14:05:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lk4af5hvhd2n 2025-03-11 15:57:16+00:00| seen| https://t.me/cvedetector/20084 2025-03-12...

CVE-2025-27640

creationtimestamp| type| source ---|---|--- 2025-03-06 00:00:12+00:00| seen| https://bsky.app/profile/vulnalerts.bsky.social/post/3ljo6s6unt32u 2025-03-06 02:16:24+00:00| seen| Telegram/1U7UJatlqZUmbjXWeuQCngVjQ7QswDsWAeKV9UNcCr1yrhN 2025-03-06 12:00:07+00:00| seen|...

Linux Distros Unpatched Vulnerability : CVE-2025-21659

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: netdev: prevent accessing NAPI instances from another namespace The NAPI IDs were not fully...

CVE-2025-24521

creationtimestamp| type| source ---|---|--- 2025-03-04 11:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-25-063-02 2025-03-05 15:32:51+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/6547 2025-03-05 18:37:00+00:00| seen| https://t.me/cvedetector/19640 2025-03-05...

SUSE CVE-2022-49106

In the Linux kernel, the following vulnerability has been resolved: staging: vchiqarm: Avoid NULL ptr deref in vchiqdumpplatforminstances vchiqgetstate can return a NULL pointer. So handle this cases and avoid a NULL pointer derefence in vchiqdumpplatforminstances...

UBUNTU-CVE-2022-49106

In the Linux kernel, the following vulnerability has been resolved: staging: vchiqarm: Avoid NULL ptr deref in vchiqdumpplatforminstances vchiqgetstate can return a NULL pointer. So handle this cases and avoid a NULL pointer derefence in vchiqdumpplatforminstances...

CVE-2025-24490

creationtimestamp| type| source ---|---|--- 2025-02-24 09:30:39+00:00| seen| Telegram/Vvd5MA2nmu0duCxF3bbKYEKWTKbzMFIp2pUAfan9WmCtw 2025-02-24 09:48:41+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/114058233176053982 2025-02-24 10:26:03+00:00| seen|...

CVE-2024-32230

creationtimestamp| type| source ---|---|--- 2025-02-23 15:08:07+00:00| seen| https://bsky.app/profile/cyberpunk.tools/post/3liu4fnuys22r 2025-02-23 15:08:08+00:00| seen| https://bsky.app/profile/cyberpunk.tools/post/3liu4fogkcs2r 2025-02-23 15:08:08+00:00| seen|...

CVE-2025-24893

creationtimestamp| type| source ---|---|--- 2025-02-20 20:56:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lin6hwckvn2a 2025-02-20 21:48:44+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/114038415303555460 2025-02-20 23:12:05+00:00| published-proof-of-concept...

CVE-2024-49589 Foundry artifacts denial of service

Foundry Artifacts was found to be vulnerable to a Denial Of Service attack due to disk being potentially filled up based on an user supplied argument size...

PT-2025-6242

Name of the Vulnerable Software and Affected Versions Ivanti Connect Secure versions prior to 22.7R2.6 Description A stack-based buffer overflow in Ivanti Connect Secure allows a remote authenticated attacker to achieve remote code execution. The issue is actively exploited. Approximately 3.2...

CVE-2024-7492

The MainWP Child Reports plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2. This is due to missing or incorrect nonce validation on the networkoptionsaction function. This makes it possible for unauthenticated attackers to update arbitrary...

CVE-2024-51695

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Yes We Work Fabrica Synced Pattern Instances fabrica-reusable-block-instances allows Reflected XSS.This issue affects Fabrica Synced Pattern Instances: from n/a through = 1.0.8...

GHSA-VPXM-CR3R-PJP9 General OpenMRS Security Advisory, January 2025: Penetration Testing Results and Patches

Impact We recently underwent Penetration Testing of OpenMRS by a third-party company. Vulnerabilities were found, and fixes have been made and released. We've released security updates that include critical fixes, and so, we strongly recommend upgrading affected modules. This notice applies to al...

CVE-2022-4447

creationtimestamp| type| source ---|---|--- 2025-01-26 00:00:00+00:00| exploited| The Shadowserver honeypot/exploited-vulnerabilities - 2025-01-26 2025-01-26 00:00:00+00:00| seen| The Shadowserver honeypot/common-vulnerabilities - 2025-01-26 2025-01-31 00:00:00+00:00| seen| The Shadowserver...

CVE-2025-21659

In the Linux kernel, the following vulnerability has been resolved: netdev: prevent accessing NAPI instances from another namespace The NAPI IDs were not fully exposed to user space prior to the netlink API, so they were never namespaced. The netlink API must ensure that at the very least NAPI...

CVE-2025-21659 netdev: prevent accessing NAPI instances from another namespace

In the Linux kernel, the following vulnerability has been resolved: netdev: prevent accessing NAPI instances from another namespace The NAPI IDs were not fully exposed to user space prior to the netlink API, so they were never namespaced. The netlink API must ensure that at the very least NAPI...

CVE-2025-21659

CVE-2025-21659 covers a Linux kernel netdev issue where NAPI IDs were not namespaced because they were not exposed to user space before the netlink API. The vulnerability arises because netlink must ensure that a NAPI instance belongs to the same network namespace as the genl socket owner; otherw...

CVE-2025-21659

In the Linux kernel, the following vulnerability has been resolved: netdev: prevent accessing NAPI instances from another namespace The NAPI IDs were not fully exposed to user space prior to the netlink API, so they were never namespaced. The netlink API must ensure that at the very least NAPI...