Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-25 11:09Z
2024-02-21
2024-02-21 08:15Z
CRIT

CVE-2023-52442 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate session id

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-52442

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate session id and tree id in compound request `smb2_get_msg()` in smb2_get_ksmbd_tcon() and smb2_check_user_session() will always return the first request smb2 header in a compound request. if `SMB2_TREE_CONNECT_HE` is the first command in compound request, will return 0, i.e. The tree id check is skipped. This patch use ksmbd_req_buf_next() to get current command in compound. CVSSv3.1 9.1 (CRITICAL) · EPSS 97th percentile

TYPVulnerability
9.1
CVSS v3.1
100
Edit Score
2024-02-21
2024-02-21 08:15Z
CRIT

CVE-2023-52441 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out of

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-52441

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out of bounds in init_smb2_rsp_hdr() If client send smb2 negotiate request and then send smb1 negotiate request, init_smb2_rsp_hdr is called for smb1 negotiate request since need_neg is set to false. This patch ignore smb1 packets after ->need_neg is set to false. CVSSv3.1 9.1 (CRITICAL) · EPSS 30th percentile

CWECWE 119TYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2024-02-21
2024-02-21 08:15Z
CRIT

CVE-2023-52440 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix slub overflow

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-52440

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix slub overflow in ksmbd_decode_ntlmssp_auth_blob() If authblob->SessionKey.Length is bigger than session key size(CIFS_KEY_SIZE), slub overflow can happen in key exchange codes. cifs_arc4_crypt copy to session key array from SessionKey from client. CVSSv3.1 9.8 (CRITICAL) · EPSS 98th percentile

CWECWE 119TYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2024-02-20
2024-02-20 18:15Z
HIGH

CVE-2023-52434 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-52434

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential OOBs in smb2_parse_contexts() Validate offsets and lengths before dereferencing create contexts in smb2_parse_contexts(). This fixes following oops when accessing invalid create contexts from server: BUG: unable to handle page fault for address: ffff8881178d8cc3 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 4a01067 P4D 4a01067 CVSSv3.1 8.1 (HIGH) · EPSS 43th percentile

CWECWE 119TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2024-02-17
2024-02-17 08:15Z
CRIT

CVE-2024-1512 — Stylemixthemes Masterstudy_lms: The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-1512

The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to union based SQL Injection via the 'user' parameter of the /lms/stm-lms/order/items REST route in all versions up to, and including, 3.2.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing q CVSSv3.1 9.8 (CRITICAL) · EPSS 100th percentile

CWECWE 89VNDStylemixthemesVNDMasterstudyTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2024-02-17
2024-02-17 08:15Z
CRIT

CVE-2024-0610 — Papaki Piraeus_bank_woocommerce_payment_gateway: The Piraeus Bank WooCommerce Payment Gateway plugin for WordPress is vulnerable to time-based blind

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-0610

The Piraeus Bank WooCommerce Payment Gateway plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'MerchantReference' parameter in all versions up to, and including, 1.6.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive infor CVSSv3.1 9.8 (CRITICAL) · EPSS 70th percentile

CWECWE 89VNDPapakiVNDPiraeusTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2024-02-15
2024-02-15 16:15Z
CRIT

CVE-2023-7081 — Postahsil Online_payment_system: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-7081

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in POSTAHSİL Online Payment System allows SQL Injection. This issue affects Online Payment System: before 14.02.2024. CVSSv3.1 9.8 (CRITICAL) · EPSS 22th percentile

CWECWE 89VNDPostahsilTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
728 × 90 / responsive · programmatic ad slot
2024-02-15
2024-02-15 16:15Z
CRIT

CVE-2023-5155 — Utarit Solipay_mobile: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-5155

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Utarit Information Technologies SoliPay Mobile App allows SQL Injection. This issue affects SoliPay Mobile App: before 5.0.8. CVSSv3.1 9.8 (CRITICAL) · EPSS 20th percentile

CWECWE 89VNDUtaritTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2024-02-15
2024-02-15 14:15Z
HIGH

CVE-2023-45581 — Fortinet Forticlient_enterprise_management_server: An improper privilege management vulnerability [CWE-269] vulnerability in Fortinet FortiClientEMS 7.2.0 through 7.2.2, FortiClientEM

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-45581

An improper privilege management vulnerability [CWE-269] vulnerability in Fortinet FortiClientEMS 7.2.0 through 7.2.2, FortiClientEMS 7.0.6 through 7.0.10, FortiClientEMS 7.0.0 through 7.0.4, FortiClientEMS 6.4 all versions, FortiClientEMS 06.02 all versions, FortiClientEMS 6.2 all versions allows an Site administrator with Super Admin privileges to perform global administrative operations affecting other sites via crafted HTTP or HTTPS requests. CVSSv3.1 8.8 (HIGH) · EPSS 57th percentile

CWECWE 269VNDFortinetVNDCweTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-02-15
2024-02-15 05:15Z
HIGH

CVE-2024-1488 — Fedoraproject Unbound: A vulnerability was found in Unbound due to incorrect default permissions, allowing any process

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-1488

A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the unbound group to modify the unbound runtime configuration. If a process can connect over localhost to port 8953, it can alter the configuration of unbound.service. This flaw allows an unprivileged attacker to manipulate a running instance, potentially altering forwarders, allowing them to track all queries forwarded by the local resolver, and, in some cases, disrupting CVSSv3.1 8.0 (HIGH) · EPSS 24th percentile

CWECWE 276VNDFedoraprojectVNDUnboundTYPVulnerability
8.0
CVSS v3.1
90
Edit Score
2024-02-14
2024-02-14 14:16Z
CRIT

CVE-2023-6441 — Unipa University_information_system: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-6441

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in UNI-PA University Marketing & Computer Internet Trade Inc. University Information System allows SQL Injection. This issue affects University Information System: before 12.12.2023. CVSSv3.1 9.8 (CRITICAL) · EPSS 37th percentile

CWECWE 89VNDUnipaTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2024-02-14
2024-02-14 00:00Z
INFO

Introduction to Hex-Rays decompilation internals

Elastic Security Labs·elastic.co

Elastic Security Labs published a technical deep-dive into Hex-Rays decompiler internals, covering microcode intermediate language (IL) structures, CTree (Abstract Syntax Tree) generation, and practical techniques for automating malware analysis tasks like custom import table annotation. The guide includes Python code examples for traversing and manipulating decompiled function representations to deobfuscate and rename variables in obfuscated binaries.

SRFApplicationSWHex RaysSWIda ProTYPResearchTECT1140
72
Edit Score
2024-02-13
2024-02-13 18:16Z
HIGH

CVE-2024-21420 — Microsoft Windows_10_1507: WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-21420

Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability CVSSv3.1 8.8 (HIGH) · EPSS 75th percentile

CWECWE 190VNDMicrosoftTYPVulnerability
8.8
CVSS v3.1
95
Edit Score
2024-02-13
2024-02-13 18:16Z
CRIT

CVE-2024-21413 — Microsoft 365_apps: Outlook Remote Code Execution Vulnerability

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-21413in the wild

Microsoft Outlook Remote Code Execution Vulnerability CVSSv3.1 9.8 (CRITICAL) · EPSS 100th percentile

CWECWE 20VNDMicrosoftTYPVulnerabilitySTAitw exploited
9.8
CVSS v3.1
100
Edit Score
2024-02-13
2024-02-13 18:15Z
HIGH

CVE-2024-21412 — Microsoft Windows_10_1809: Internet Shortcut Files Security Feature Bypass Vulnerability

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-21412in the wild

Internet Shortcut Files Security Feature Bypass Vulnerability CVSSv3.1 8.1 (HIGH) · EPSS 100th percentile

CWECWE 693VNDMicrosoftVNDInternetTYPVulnerabilitySTAitw exploited
8.1
CVSS v3.1
100
Edit Score
2024-02-13
2024-02-13 18:15Z
CRIT

CVE-2024-21403 — Microsoft Azure_kubernetes_service: Azure Kubernetes Service Confidential Container Elevation of Privilege Vulnerability

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-21403

Microsoft Azure Kubernetes Service Confidential Container Elevation of Privilege Vulnerability CVSSv3.1 9.0 (CRITICAL) · EPSS 69th percentile

CWECWE 552VNDMicrosoftTYPVulnerability
9.0
CVSS v3.1
95
Edit Score
2024-02-13
2024-02-13 18:15Z
CRIT

CVE-2024-21401 — Microsoft Entra_jira_sso_plugin: Entra Jira Single-Sign-On Plugin Elevation of Privilege Vulnerability

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-21401

Microsoft Entra Jira Single-Sign-On Plugin Elevation of Privilege Vulnerability CVSSv3.1 9.8 (CRITICAL) · EPSS 71th percentile

CWECWE 284VNDMicrosoftTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2024-02-13
2024-02-13 18:15Z
HIGH

CVE-2024-21395 — Microsoft Dynamics_365: Dynamics 365 (on-premises) Cross-site Scripting Vulnerability

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-21395

Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability CVSSv3.1 8.2 (HIGH) · EPSS 64th percentile

CWECWE 79VNDMicrosoftTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2024-02-13
2024-02-13 18:15Z
HIGH

CVE-2024-21391 — Microsoft Windows_10_1507: WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-21391

Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability CVSSv3.1 8.8 (HIGH) · EPSS 74th percentile

CWECWE 197VNDMicrosoftTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-02-13
2024-02-13 18:15Z
HIGH

CVE-2024-21380 — Microsoft Dynamics_365_business_central: Dynamics Business Central/NAV Information Disclosure Vulnerability

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-21380

Microsoft Dynamics Business Central/NAV Information Disclosure Vulnerability CVSSv3.1 8.0 (HIGH) · EPSS 75th percentile

CWECWE 200VNDMicrosoftTYPVulnerability
8.0
CVSS v3.1
91
Edit Score
2024-02-13
2024-02-13 18:15Z
HIGH

CVE-2024-21378 — Microsoft 365_apps: Outlook Remote Code Execution Vulnerability

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-21378

Microsoft Outlook Remote Code Execution Vulnerability CVSSv3.1 8.8 (HIGH) · EPSS 95th percentile

CWECWE 94VNDMicrosoftTYPVulnerability
8.8
CVSS v3.1
97
Edit Score
2024-02-13
2024-02-13 18:15Z
CRIT

CVE-2024-21376 — Microsoft Azure_kubernetes_service: Azure Kubernetes Service Confidential Container Remote Code Execution Vulnerability

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-21376

Microsoft Azure Kubernetes Service Confidential Container Remote Code Execution Vulnerability CVSSv3.1 9.0 (CRITICAL) · EPSS 64th percentile

CWECWE 284VNDMicrosoftTYPVulnerability
9.0
CVSS v3.1
95
Edit Score
2024-02-13
2024-02-13 18:15Z
HIGH

CVE-2024-21375 — Microsoft Windows_10_1507: WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-21375

Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability CVSSv3.1 8.8 (HIGH) · EPSS 74th percentile

CWECWE 416VNDMicrosoftTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-02-13
2024-02-13 18:15Z
HIGH

CVE-2024-21372 — Microsoft Windows_10_1507: Windows OLE Remote Code Execution Vulnerability

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-21372

Windows OLE Remote Code Execution Vulnerability CVSSv3.1 8.8 (HIGH) · EPSS 76th percentile

CWECWE 190VNDMicrosoftTYPVulnerability
8.8
CVSS v3.1
95
Edit Score
2024-02-13
2024-02-13 18:15Z
HIGH

CVE-2024-21371 — Microsoft Windows_10_1507: Windows Kernel Elevation of Privilege Vulnerability

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-21371

Windows Kernel Elevation of Privilege Vulnerability CVSSv3.1 7.0 (HIGH) · EPSS 95th percentile

CWECWE 367VNDMicrosoftTYPVulnerability
7.0
CVSS v3.1
88
Edit Score