Drug Dealers Have Moved on to Social Media

The marketing of illegal drugs on open platforms is “gaining prominence,” authorities note, while the number of drug transactions on the dark web has decreased in recent years...

CVE-2024-12469

creationtimestamp| type| source ---|---|--- 2024-12-17 09:31:53+00:00| seen| https://infosec.exchange/users/cve/statuses/113667467509014864 2024-12-17 09:35:10+00:00| seen| https://infosec.exchange/users/cve/statuses/113667480613404199 2024-12-17 10:10:08+00:00| seen|...

CVE-2024-9624

The WP All Import Pro plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.9.3 due to missing SSRF protection on the pmxicurldownload function. This makes it possible for authenticated attackers, with Administrator-level access and above, to ma...

CVE-2024-9624 WP All Import Pro <= 4.9.3 - Authenticated (Administrator+) Server-Side Request Forgery via File Import

The WP All Import Pro plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.9.3 due to missing SSRF protection on the pmxicurldownload function. This makes it possible for authenticated attackers, with Administrator-level access and above, to ma...

CVE-2024-49775

creationtimestamp| type| source ---|---|--- 2024-12-16 16:08:33+00:00| seen| https://infosec.exchange/users/vuldb/statuses/113663365166493371 2024-12-19 11:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-24-354-04 2024-12-20 08:01:31+00:00| seen|...

BIT-NODE-MIN-2021-22921

Node.js before 16.4.1, 14.17.2, and 12.22.2 is vulnerable to local privilege escalation attacks under certain conditions on Windows platforms. More specifically, improper configuration of permissions in the installation directory allows an attacker to perform two different escalation attacks: PAT...

BIT-NODE-MIN-2022-32223

Node.js is vulnerable to Hijack Execution Flow: DLL Hijacking under certain conditions on Windows platforms.This vulnerability can be exploited if the victim has the following dependencies on a Windows machine: OpenSSL has been installed and “C:\Program Files\Common Files\SSL\openssl.cnf”...

CVE-2024-55628

creationtimestamp| type| source ---|---|--- 2024-12-16 12:57:32+00:00| seen| https://t.me/truesecator/6543 2024-12-19 13:01:33+00:00| seen| https://t.me/ptescalator/199 2025-01-06 18:04:28+00:00| seen| https://infosec.exchange/users/cve/statuses/113782729492440784 2025-01-06 18:16:02+00:00| seen|...

CVE-2024-53376

creationtimestamp| type| source ---|---|--- 2024-12-15 22:45:16+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/9438 2024-12-16 03:32:11+00:00| seen| https://infosec.exchange/users/cve/statuses/113660390988031437 2024-12-16 05:38:05+00:00| seen| https://t.me/cvedetector/12957...

编号撤回

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL. wordPress plugin is an application plugin. This CVE number has been...

Iran-Linked IOCONTROL Malware Targets SCADA and Linux-Based IoT Platforms

Iran-affiliated threat actors have been linked to a new custom malware that's geared toward IoT and operational technology OT environments in Israel and the United States. The malware has been codenamed IOCONTROL by OT cybersecurity company Claroty, highlighting its ability to attack IoT and...

Authorities Shut Down 27 DDoS-for-Hire Platforms, Arrest 3 Admins

Just in time for the holidays!...

DEBIAN-CVE-2024-54534

The issue was addressed with improved memory handling. This issue is fixed in Safari 18.2, iOS 18.2 and iPadOS 18.2, iPadOS 17.7.6, macOS Sequoia 15.2, tvOS 18.2, visionOS 2.2, watchOS 11.2. Processing maliciously crafted web content may lead to memory corruption...

DEBIAN-CVE-2024-54508

The issue was addressed with improved memory handling. This issue is fixed in Safari 18.2, iOS 18.2 and iPadOS 18.2, iPadOS 17.7.6, macOS Sequoia 15.2, tvOS 18.2, visionOS 2.2, watchOS 11.2. Processing maliciously crafted web content may lead to an unexpected process crash...

CVE-2024-54510

A race condition was addressed with improved locking. This issue is fixed in iPadOS 17.7.3, watchOS 11.2, tvOS 18.2, macOS Sequoia 15.2, iOS 18.2 and iPadOS 18.2, macOS Ventura 13.7.2, macOS Sonoma 14.7.2. An app may be able to leak sensitive kernel state...

CVE-2024-54514

The issue was addressed with improved checks. This issue is fixed in watchOS 11.2, tvOS 18.2, macOS Sequoia 15.2, iOS 18.2 and iPadOS 18.2, macOS Ventura 13.7.2, macOS Sonoma 14.7.2. An app may be able to break out of its sandbox...

CVE-2024-54492

This issue was addressed by using HTTPS when sending information over the network. This issue is fixed in macOS Sequoia 15.2, iOS 18.2 and iPadOS 18.2, iPadOS 17.7.3, visionOS 2.2. An attacker in a privileged network position may be able to alter network traffic...

CVE-2024-44290

This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 18.1 and iPadOS 18.1, watchOS 11.1. An app may be able to determine a user’s current location...

CVE-2024-44245

The issue was addressed with improved memory handling. This issue is fixed in iPadOS 17.7.3, visionOS 2.2, macOS Sequoia 15.2, iOS 18.2 and iPadOS 18.2, macOS Sonoma 14.7.2. An app may be able to cause unexpected system termination or corrupt kernel memory...

UBUNTU-CVE-2024-54508

The issue was addressed with improved memory handling. This issue is fixed in Safari 18.2, iOS 18.2 and iPadOS 18.2, iPadOS 17.7.6, macOS Sequoia 15.2, tvOS 18.2, visionOS 2.2, watchOS 11.2. Processing maliciously crafted web content may lead to an unexpected process crash...