Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-24 13:13Z
2024-09-04
2024-09-04 20:15Z
CRIT

CVE-2024-44984 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix double DMA

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-44984

In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix double DMA unmapping for XDP_REDIRECT Remove the dma_unmap_page_attrs() call in the driver's XDP_REDIRECT code path. This should have been removed when we let the page pool handle the DMA mapping. This bug causes the warning: WARNING: CPU: 7 PID: 59 at drivers/iommu/dma-iommu.c:1198 iommu_dma_unmap_page+0xd5/0x100 CPU: 7 PID: 59 Comm: ksoftirqd/7 Tainted: G W 6.8.0-1010-gcp # CVSSv3.1 10.0 (CRITICAL)

TYPVulnerability
10.0
CVSS v3.1
100
Edit Score
2024-09-04
2024-09-04 19:15Z
HIGH

CVE-2024-44973 — Linux Linux_kernel: This results in a crash like this: BUG skbuff_head_cache (Tainted: G S B E

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-44973

In the Linux kernel, the following vulnerability has been resolved: mm, slub: do not call do_slab_free for kfence object In 782f8906f805 the freeing of kfence objects was moved from deep inside do_slab_free to the wrapper functions outside. This is a nice change, but unfortunately it missed one spot in __kmem_cache_free_bulk. This results in a crash like this: BUG skbuff_head_cache (Tainted: G S B E ): Padding overwritten. 0xffff88907fea0f00-0xffff88907fea0fff CVSSv3.1 8.1 (HIGH)

TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2024-09-04
2024-09-04 19:15Z
CRIT

CVE-2024-44970 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: SHAMPO, Fix invalid

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-44970

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink When all the strides in a WQE have been consumed, the WQE is unlinked from the WQ linked list (mlx5_wq_ll_pop()). For SHAMPO, it is possible to receive CQEs with 0 consumed strides for the same WQE even after the WQE is fully consumed and unlinked. This triggers an additional unlink for the same wqe which corrupts the linked list. Fix this scenario by ac CVSSv3.1 9.8 (CRITICAL)

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2024-09-04
2024-09-04 15:15Z
CRIT

CVE-2024-7078 — Semtekyazilim Semtek_sempos: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-7078

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Semtek Informatics Software Consulting Inc. Semtek Sempos allows SQL Injection. This issue affects Semtek Sempos: through 31072024. CVSSv3.1 9.8 (CRITICAL) · EPSS 42th percentile

CWECWE 89VNDSemtekyazilimTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2024-09-04
2024-09-04 15:15Z
CRIT

CVE-2024-7076 — Semtekyazilim Semtek_sempos: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-7076

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Semtek Informatics Software Consulting Inc. Semtek Sempos allows Blind SQL Injection. This issue affects Semtek Sempos: through 31072024. CVSSv3.1 9.8 (CRITICAL) · EPSS 42th percentile

CWECWE 89VNDSemtekyazilimTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2024-09-03
2024-09-03 14:15Z
CRIT

CVE-2024-4259 — Sambas Akos: Missing Authorization vulnerability in SAMPAŞ Holding AKOS (AkosCepVatandasService), SAMPAŞ Holding AKOS (TahsilatService) allows Collect

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-4259

Missing Authorization vulnerability in SAMPAŞ Holding AKOS (AkosCepVatandasService), SAMPAŞ Holding AKOS (TahsilatService) allows Collect Data as Provided by Users. This issue affects AKOS (AkosCepVatandasService): before V2.0; AKOS (TahsilatService): before V1.0.7. CVSSv3.1 9.8 (CRITICAL) · EPSS 30th percentile

CWECWE 862VNDSambasTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2024-09-02
2024-09-02 18:15Z
CRIT

CVE-2024-6919 — Nac Nacpremium: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-6919

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NAC Telecommunication Systems Inc. NACPremium allows Blind SQL Injection. This issue affects NACPremium: through 01082024. CVSSv3.1 9.8 (CRITICAL) · EPSS 38th percentile

CWECWE 89VNDNacTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
728 × 90 / responsive · programmatic ad slot
2024-08-30
2024-08-30 03:15Z
CRIT

CVE-2024-45492 — Libexpat_project Libexpat: nextScaffoldPart in xmlparse.c can have an integer overflow for m_groupSize on 32-bit platforms (where

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-45492

An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an integer overflow for m_groupSize on 32-bit platforms (where UINT_MAX equals SIZE_MAX). CVSSv3.1 9.8 (CRITICAL) · EPSS 80th percentile

CWECWE 190VNDLibexpat ProjectTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2024-08-30
2024-08-30 03:15Z
CRIT

CVE-2024-45491 — Libexpat_project Libexpat: dtdCopy in xmlparse.c can have an integer overflow for nDefaultAtts on 32-bit platforms (where

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-45491

An issue was discovered in libexpat before 2.6.3. dtdCopy in xmlparse.c can have an integer overflow for nDefaultAtts on 32-bit platforms (where UINT_MAX equals SIZE_MAX). CVSSv3.1 9.8 (CRITICAL) · EPSS 69th percentile

CWECWE 190VNDLibexpat ProjectTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2024-08-30
2024-08-30 00:00Z
HIGH

Linux Detection Engineering - A Sequel on Persistence Mechanisms

Elastic Security Labs·elastic.co

Elastic Security Labs publishes the third installment of a Linux persistence detection engineering series, covering System V init, Upstart, rc.local, and MOTD-based persistence mechanisms. The article provides theoretical explanations, practical setup instructions using the PANIX tool, detection rules, and threat-hunting queries (ES|QL and OSQuery) for each technique.

SRFOsTACTA0003OSLinuxTYPResearchTYPToolSTGPersistenceTECT1546TECT1037
72
Edit Score
2024-08-29
2024-08-29 18:15Z
CRIT

CVE-2024-44779 — Vtiger Vtiger_crm: A reflected cross-site scripting (XSS) vulnerability in the viewname parameter in the index page

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-44779

A reflected cross-site scripting (XSS) vulnerability in the viewname parameter in the index page of vTiger CRM 7.4.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload. CVSSv3.1 9.6 (CRITICAL) · EPSS 49th percentile

CWECWE 79VNDXssVNDVtigerTYPVulnerability
9.6
CVSS v3.1
98
Edit Score
2024-08-29
2024-08-29 18:15Z
CRIT

CVE-2024-44778 — Vtiger Vtiger_crm: A reflected cross-site scripting (XSS) vulnerability in the parent parameter in the index page

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-44778

A reflected cross-site scripting (XSS) vulnerability in the parent parameter in the index page of vTiger CRM 7.4.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload. CVSSv3.1 9.6 (CRITICAL) · EPSS 48th percentile

CWECWE 79VNDXssVNDVtigerTYPVulnerability
9.6
CVSS v3.1
98
Edit Score
2024-08-29
2024-08-29 18:15Z
CRIT

CVE-2024-44777 — Vtiger Vtiger_crm: A reflected cross-site scripting (XSS) vulnerability in the tag parameter in the index page

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-44777

A reflected cross-site scripting (XSS) vulnerability in the tag parameter in the index page of vTiger CRM 7.4.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload. CVSSv3.1 9.6 (CRITICAL) · EPSS 47th percentile

CWECWE 79VNDXssVNDVtigerTYPVulnerability
9.6
CVSS v3.1
98
Edit Score
2024-08-29
2024-08-29 16:15Z
CRIT

CVE-2024-43955 — Themeum Droip: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Themeum

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-43955

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Themeum Droip droip allows Path Traversal.This issue affects Droip: from n/a through < 2.5.2. CVSSv3.1 10.0 (CRITICAL)

CWECWE 22VNDThemeumTYPVulnerability
10.0
CVSS v3.1
100
Edit Score
2024-08-29
2024-08-29 15:15Z
CRIT

CVE-2024-39622 — Cridio Listingpro: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-39622

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CridioStudio ListingPro listingpro allows SQL Injection.This issue affects ListingPro: from n/a through <= 2.9.4. CVSSv3.1 9.3 (CRITICAL)

CWECWE 89VNDCridioTYPVulnerability
9.3
CVSS v3.1
97
Edit Score
2024-08-29
2024-08-29 15:15Z
HIGH

CVE-2024-39620 — Cridio Listingpro: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-39620

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CridioStudio ListingPro listingpro-plugin allows SQL Injection.This issue affects ListingPro: from n/a through <= 2.9.4. CVSSv3.1 8.5 (HIGH)

CWECWE 89VNDCridioTYPVulnerability
8.5
CVSS v3.1
93
Edit Score
2024-08-29
2024-08-29 15:15Z
CRIT

CVE-2024-38795 — Cridio Listingpro: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-38795

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CridioStudio ListingPro listingpro-plugin allows SQL Injection.This issue affects ListingPro: from n/a through <= 2.9.4. CVSSv3.1 9.3 (CRITICAL)

CWECWE 89VNDCridioTYPVulnerability
9.3
CVSS v3.1
97
Edit Score
2024-08-29
2024-08-29 11:15Z
HIGH

CVE-2024-7856 — Sonaar Mp3_audio_player_for_music\,_radio_\&_podcast: The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-7856

The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to unauthorized arbitrary file deletion due to a missing capability check on the removeTempFiles() function and insufficient path validation on the 'file' parameter in all versions up to, and including, 5.7.0.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files which can make remote code execution possible CVSSv3.1 8.1 (HIGH)

CWECWE 862VNDSonaarVNDMp3TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2024-08-29
2024-08-29 11:15Z
CRIT

CVE-2024-4428 — Menulux Managment_portal: Missing Authentication for Critical Function, Missing Authorization vulnerability in Menulux Information Technologies Managment Portal

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-4428

Missing Authentication for Critical Function, Missing Authorization vulnerability in Menulux Information Technologies Managment Portal allows Collect Data as Provided by Users. This issue affects Managment Portal: through 21.05.2024. CVSSv3.1 9.8 (CRITICAL) · EPSS 43th percentile

CWECWE 862CWECWE 306VNDMenuluxTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2024-08-27
2024-08-27 14:15Z
CRIT

CVE-2024-7071 — Brainlowcode Brain_low-code: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), CWE -

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-7071

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), CWE - 564 - SQL Injection: Hibernate vulnerability in Brain Information Technologies Inc. Brain Low-Code allows SQL Injection. This issue affects Brain Low-Code: before 2.1.0. CVSSv3.1 9.8 (CRITICAL) · EPSS 36th percentile

CWECWE 89VNDBrainlowcodeTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2024-08-24
2024-08-24 02:15Z
CRIT

CVE-2024-7568 — Pixeljar Favicon_generator: The Favicon Generator plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-7568

The Favicon Generator plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5. This is due to missing or incorrect nonce validation on the output_sub_admin_page_0 function. This makes it possible for unauthenticated attackers to delete arbitrary files on the server via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. The plugin author deleted the functionality of t CVSSv3.1 9.6 (CRITICAL)

CWECWE 352VNDPixeljarVNDFaviconTYPVulnerability
9.6
CVSS v3.1
98
Edit Score
2024-08-23
2024-08-23 17:15Z
CRIT

CVE-2024-42531 — Ezviz: Internet PT Camera CS-CV246 D15655150 allows an unauthenticated host to access its live

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-42531

Ezviz Internet PT Camera CS-CV246 D15655150 allows an unauthenticated host to access its live video stream by crafting a set of RTSP packets with a specific set of URLs that can be used to redirect the camera feed. NOTE: the vendor's perspective is that the Anonymous120386 sample code can establish RTSP protocol communictaion, but cannot obtain video or audio data; thus, there is no risk. CVSSv3.1 9.8 (CRITICAL) · EPSS 44th percentile

CWECWE 20VNDEzvizTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2024-08-23
2024-08-23 13:15Z
CRIT

CVE-2024-43883 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: usb: vhci-hcd: Do not

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-43883

In the Linux kernel, the following vulnerability has been resolved: usb: vhci-hcd: Do not drop references before new references are gained At a few places the driver carries stale pointers to references that can still be used. Make sure that does not happen. This strictly speaking closes ZDI-CAN-22273, though there may be similar races in the driver. CVSSv3.1 9.8 (CRITICAL)

CWECWE 416TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2024-08-23
2024-08-23 07:15Z
CRIT

CVE-2024-40766 — Sonicwall Sonicos: An improper access control vulnerability has been identified in the SonicWall SonicOS management access

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-40766

An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access and in specific conditions, causing the firewall to crash. This issue affects SonicWall Firewall Gen 5 and Gen 6 devices, as well as Gen 7 devices running SonicOS 7.0.1-5035 and older versions. CVSSv3.1 9.8 (CRITICAL)

CWECWE 284VNDSonicwallTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2024-08-22
2024-08-22 04:15Z
CRIT

CVE-2024-45163 — Mirai: The Mirai botnet through 2024-08-19 mishandles simultaneous TCP connections to the CNC (command and

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-45163

The Mirai botnet through 2024-08-19 mishandles simultaneous TCP connections to the CNC (command and control) server. Unauthenticated sessions remain open, causing resource consumption. For example, an attacker can send a recognized username (such as root), or can send arbitrary data. CVSSv3.1 9.1 (CRITICAL) · EPSS 54th percentile

CWECWE 400VNDMiraiTYPVulnerability
9.1
CVSS v3.1
96
Edit Score