Three privacy rules for 2025 (Lock and Code S06E02)

This week on the Lock and Code podcast… It’s Data Privacy Week right now, and that means, for the most part, that you’re going to see a lot of well-intentioned but clumsy information online about how to protect your data privacy. You’ll see articles about iPhone settings. You’ll hear acronyms for...

Three privacy rules for 2025 (Lock and Code S06E02)

This week on the Lock and Code podcast… It’s Data Privacy Week right now, and that means, for the most part, that you’re going to see a lot of well-intentioned but clumsy information online about how to protect your data privacy. You’ll see articles about iPhone settings. You’ll hear acronyms for...

Texas scrutinizes four more car manufacturers on privacy issues (updated)

The Texas Attorney General’s Office has started an investigation into how Ford, Hyundai, Toyota, and Fiat Chrysler collect, share, and sell consumer data, expanding an earlier probe launched last year into how modern automakers are potentially using customer driving data. We've addressed cars and...

CVE-2025-24353 Directus privilege escalation vulnerability using Share feature

Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 11.2.0, when sharing an item, a typical user can specify an arbitrary role. It allows the user to use a higher-privileged role to see fields that otherwise the user should not be able to see. Instanc...

PT-2025-5336 · Directus · Directus

Name of the Vulnerable Software and Affected Versions: Directus versions prior to 11.2.0 Description: The issue allows a typical user to specify an arbitrary role when sharing an item, enabling them to use a higher-privileged role to view fields they should not be able to see. This affects...

Directus 安全漏洞

Directus is a real-time Api and application dashboard open-sourced by Directus. It is used to manage Sql database content. A security vulnerability exists in Directus versions prior to 11.2.0 that stems from the ability of a user to specify arbitrary roles when sharing a project, resulting in a...

CVE-2024-57942

creationtimestamp| type| source ---|---|--- 2025-01-21 12:28:14+00:00| seen| https://infosec.exchange/users/cve/statuses/113866342006435319 2025-01-21 13:15:50+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lgawqjaufk2e 2025-01-21 13:39:32+00:00| seen|...

CVE-2024-22348

IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0. 25 uses Cross-Origin Resource Sharing CORS which could allow an attacker to carry out privileged actions and retrieve sensitive information as the domain name is not being limited to only trusted domains...

CVE-2024-22348 IBM UrbanCode Velocity cross-origin resource sharing

IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0. 25 uses Cross-Origin Resource Sharing CORS which could allow an attacker to carry out privileged actions and retrieve sensitive information as the domain name is not being limited to only trusted domains...

CVE-2024-22348 IBM UrbanCode Velocity cross-origin resource sharing

IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0. 25 uses Cross-Origin Resource Sharing CORS which could allow an attacker to carry out privileged actions and retrieve sensitive information as the domain name is not being limited to only trusted domains...

CVE-2024-22348

CVE-2024-22348 concerns IBM UrbanCode Velocity and IBM DevOps Velocity. According to the primary entry and corroborating Red Hat/IBM security notes, the vulnerability stems from Cross‑Origin Resource Sharing (CORS) configurations that do not restrict the domain name to trusted origins. Affected p...

IBM DevOps Velocity和IBM UrbanCode Velocity 安全漏洞

IBM DevOps Velocity and IBM UrbanCode Velocity are both products of International Business Machines IBM.IBM DevOps Velocity is an enterprise-class release management application that supports cloud-native and local deployments.IBM UrbanCode Velocity is an enterprise-class release management and...

DEBIAN-CVE-2024-57914

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpci: fix NULL pointer issue on shared irq case The tcpciirq may meet below NULL pointer dereference issue: 2.641851 Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010 2.641951 statu...

Find the helpers

Welcome to this week's edition of the Threat Source newsletter. "When I was a boy and I would see scary things in the news, my mother would say to me, 'Look for the helpers. You will always find people who are helping.'" ― Fred Rogers There's no world where following Mr. Roger's advice is wrong...

CVE-2024-54470

creationtimestamp| type| source ---|---|--- 2025-01-15 19:55:03+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/1837 2025-01-15 19:56:49+00:00| seen| https://infosec.exchange/users/cve/statuses/113834132073671712 2025-01-15 20:16:01+00:00| seen|...

DEBIAN-CVE-2024-57883

In the Linux kernel, the following vulnerability has been resolved: mm: hugetlb: independent PMD page table shared count The folio refcount may be increased unexpectly through trygetfolio by caller such as splithugepages. In hugepmdunshare, we use refcount to check whether a pmd page table is...

CVE-2024-55577

creationtimestamp| type| source ---|---|--- 2025-01-15 05:24:53+00:00| seen| https://infosec.exchange/users/cve/statuses/113830703436231851 2025-01-15 06:11:12+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/1706 2025-01-15 06:15:47+00:00| seen|...

CVE-2024-54142

Discourse AI is a Discourse plugin which provides a number of AI features. When sharing Discourse AI Bot conversations into posts, if the conversation had HTML entities those could leak into the Discourse application when a user visited a post with a onebox to said conversation. This issue has be...

CVE-2024-54142 Cross-site Scripting via Discourse-ai SharedAiConversation onebox in Discourse

Discourse AI is a Discourse plugin which provides a number of AI features. When sharing Discourse AI Bot conversations into posts, if the conversation had HTML entities those could leak into the Discourse application when a user visited a post with a onebox to said conversation. This issue has be...

CVE-2025-21282

creationtimestamp| type| source ---|---|--- 2025-01-14 17:29:48+00:00| seen| https://www.thezdi.com/blog/2025/1/14/the-january-2025-security-update-review 2025-01-14 18:19:59+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lfpuhwxz6y2t 2025-01-14 18:48:47+00:00| seen|...