opsecsafe — cyber intelligence

2024-07-31

2024-07-31 08:15Z

MED

CVE-2024-7264 — Haxx Libcurl: If given an syntactically incorrect field, the parser might end up using -1 for

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-7264

libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an ASN.1 Generalized Time field. If given an syntactically incorrect field, the parser might end up using -1 for the length of the *time fraction*, leading to a `strlen()` getting performed on a pointer to a heap buffer area that is not (purposely) null terminated. This flaw most likely leads to a crash, but can also lead to heap contents getting returned to the application when [CURLINFO_CERTINFO](h CVSSv3.1 6.5 (MEDIUM) · EPSS 97th percentile

CWECWE 125VNDHaxxVNDAsn1TYPVulnerability

6.5

CVSS v3.1

Edit Score

2024-07-30

2024-07-30 20:15Z

CRIT

CVE-2024-39011 — Chargeover Chargeover\/redoc: Prototype Pollution in chargeover redoc v2.0.9-rc.69 allows attackers to execute arbitrary code or cause

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-39011

Prototype Pollution in chargeover redoc v2.0.9-rc.69 allows attackers to execute arbitrary code or cause a Denial of Service (DoS) and cause other impacts via the function mergeObjects. CVSSv3.1 9.8 (CRITICAL) · EPSS 64th percentile

CWECWE 1321VNDPrototypeVNDChargeoverTYPVulnerability

9.8

CVSS v3.1

Edit Score

2024-07-30

2024-07-30 14:15Z

CRIT

CVE-2024-38909 — Std42 Elfinder: Studio 42 elFinder 2.1.64 is vulnerable to Incorrect Access Control.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-38909

Studio 42 elFinder 2.1.64 is vulnerable to Incorrect Access Control. Copying files with an unauthorized extension between server directories allows an arbitrary attacker to expose secrets, perform RCE, etc. CVSSv3.1 9.8 (CRITICAL) · EPSS 38th percentile

CWECWE 284VNDStudioVNDStd42TYPVulnerability

9.8

CVSS v3.1

Edit Score

2024-07-30

2024-07-30 13:15Z

CRIT

CVE-2024-6699 — Mikafon Ma7_firmware: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-6699

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mikafon Electronic Inc. Mikafon MA7 allows SQL Injection. This issue affects Mikafon MA7: from v3.0 before v3.1. CVSSv3.1 9.8 (CRITICAL) · EPSS 34th percentile

CWECWE 89VNDMikafonTYPVulnerability

9.8

CVSS v3.1

Edit Score

2024-07-30

2024-07-30 08:15Z

HIGH

CVE-2024-42225 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: replace skb_put

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-42225

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: replace skb_put with skb_put_zero Avoid potentially reusing uninitialized data CVSSv3.1 8.3 (HIGH)

CWECWE 908TYPVulnerability

8.3

CVSS v3.1

Edit Score

2024-07-30

2024-07-30 08:15Z

CRIT

CVE-2024-42108 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: net: rswitch: Avoid use-after-free

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-42108

In the Linux kernel, the following vulnerability has been resolved: net: rswitch: Avoid use-after-free in rswitch_poll() The use-after-free is actually in rswitch_tx_free(), which is inlined in rswitch_poll(). Since `skb` and `gq->skbs[gq->dirty]` are in fact the same pointer, the skb is first freed using dev_kfree_skb_any(), then the value in skb->len is used to update the interface statistics. Let's move around the instructions to use skb->len before the skb is freed. T CVSSv3.1 9.8 (CRITICAL)

CWECWE 416TYPVulnerability

9.8

CVSS v3.1

Edit Score

2024-07-29

2024-07-29 19:15Z

CRIT

CVE-2024-37858 — Oretnom23 Lost_and_found_information_system: SQL Injection vulnerability in Lost and Found Information System 1.0 allows a remote attacker

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-37858

SQL Injection vulnerability in Lost and Found Information System 1.0 allows a remote attacker to escalate privileges via the id parameter to php-lfis/admin/categories/manage_category.php. CVSSv3.1 9.8 (CRITICAL) · EPSS 54th percentile

CWECWE 89CWECWE 269VNDOretnom23TYPVulnerability

9.8

CVSS v3.1

Edit Score

2024-07-29

2024-07-29 19:15Z

HIGH

CVE-2024-37857 — Oretnom23 Lost_and_found_information_system: SQL Injection vulnerability in Lost and Found Information System 1.0 allows a remote attacker

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-37857

SQL Injection vulnerability in Lost and Found Information System 1.0 allows a remote attacker to escalate privileges via id parameter to php-lfis/admin/categories/view_category.php. CVSSv3.1 8.8 (HIGH) · EPSS 54th percentile

CWECWE 89VNDOretnom23TYPVulnerability

8.8

CVSS v3.1

Edit Score

2024-07-29

2024-07-29 16:15Z

HIGH

CVE-2024-42083 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: ionic: fix kernel panic

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-42083

In the Linux kernel, the following vulnerability has been resolved: ionic: fix kernel panic due to multi-buffer handling Currently, the ionic_run_xdp() doesn't handle multi-buffer packets properly for XDP_TX and XDP_REDIRECT. When a jumbo frame is received, the ionic_run_xdp() first makes xdp frame with all necessary pages in the rx descriptor. And if the action is either XDP_TX or XDP_REDIRECT, it should unmap dma-mapping and reset page pointer to NULL for all pages, not o CVSSv3.1 8.8 (HIGH)

CWECWE 476TYPVulnerability

8.8

CVSS v3.1

Edit Score

2024-07-29

2024-07-29 15:15Z

CRIT

CVE-2024-41081 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: ila: block BH in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-41081

In the Linux kernel, the following vulnerability has been resolved: ila: block BH in ila_output() As explained in commit 1378817486d6 ("tipc: block BH before using dst_cache"), net/core/dst_cache.c helpers need to be called with BH disabled. ila_output() is called from lwtunnel_output() possibly from process context, and under rcu_read_lock(). We might be interrupted by a softirq, re-enter ila_output() and corrupt dst_cache data structures. Fix the race by using local_bh CVSSv3.1 9.8 (CRITICAL)

TYPVulnerability

9.8

CVSS v3.1

Edit Score

2024-07-29

2024-07-29 15:15Z

CRIT

CVE-2024-41073 — Debian Debian_linux: In the Linux kernel, the following vulnerability has been resolved: nvme: avoid double free

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-41073

In the Linux kernel, the following vulnerability has been resolved: nvme: avoid double free special payload If a discard request needs to be retried, and that retry may fail before a new special payload is added, a double free will result. Clear the RQF_SPECIAL_LOAD when the request is cleaned. CVSSv3.1 9.8 (CRITICAL)

CWECWE 415TYPVulnerability

9.8

CVSS v3.1

Edit Score

2024-07-29

2024-07-29 15:15Z

HIGH

CVE-2024-41062 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: bluetooth/l2cap: sync sock recv

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-41062

In the Linux kernel, the following vulnerability has been resolved: bluetooth/l2cap: sync sock recv cb and release The problem occurs between the system call to close the sock and hci_rx_work, where the former releases the sock and the latter accesses it without lock protection. CPU0 CPU1 ---- ---- sock_close hci_rx_work l2cap_sock_release hci_acldata_packet l2cap_s CVSSv3.1 8.8 (HIGH)

TYPVulnerability

8.8

CVSS v3.1

Edit Score

2024-07-29

2024-07-29 15:15Z

HIGH

CVE-2024-41046 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: net: ethernet: lantiq_etop: fix

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-41046

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: lantiq_etop: fix double free in detach The number of the currently released descriptor is never incremented which results in the same skb being released multiple times. CVSSv3.1 8.8 (HIGH)

CWECWE 415TYPVulnerability

8.8

CVSS v3.1

Edit Score

2024-07-29

2024-07-29 15:15Z

CRIT

CVE-2024-41040 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: net/sched: Fix UAF when

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-41040

In the Linux kernel, the following vulnerability has been resolved: net/sched: Fix UAF when resolving a clash KASAN reports the following UAF: BUG: KASAN: slab-use-after-free in tcf_ct_flow_table_process_conn+0x12b/0x380 [act_ct] Read of size 1 at addr ffff888c07603600 by task handler130/6469 Call Trace: <IRQ> dump_stack_lvl+0x48/0x70 print_address_description.constprop.0+0x33/0x3d0 print_report+0xc0/0x2b0 kasan_report+0xd0/0x120 __asan_load1+0x6c/0x80 tc CVSSv3.1 9.8 (CRITICAL)

CWECWE 416TYPVulnerability

9.8

CVSS v3.1

Edit Score

2024-07-29

2024-07-29 07:15Z

HIGH

CVE-2024-41091 — Linux Linux_kernel: Once transmitted, this could either cause out-of-bound access beyond the actual length, or confuse

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-41091

In the Linux kernel, the following vulnerability has been resolved: tun: add missing verification for short frame The cited commit missed to check against the validity of the frame length in the tun_xdp_one() path, which could cause a corrupted skb to be sent downstack. Even before the skb is transmitted, the tun_xdp_one-->eth_type_trans() may access the Ethernet header although it can be less than ETH_HLEN. Once transmitted, this could either cause out-of-bound access beyo CVSSv3.1 8.8 (HIGH)

CWECWE 125TYPVulnerability

8.8

CVSS v3.1

Edit Score

2024-07-29

2024-07-29 07:15Z

HIGH

CVE-2024-41090 — Linux Linux_kernel: Once transmitted, this could either cause out-of-bound access beyond the actual length, or confuse

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-41090

In the Linux kernel, the following vulnerability has been resolved: tap: add missing verification for short frame The cited commit missed to check against the validity of the frame length in the tap_get_user_xdp() path, which could cause a corrupted skb to be sent downstack. Even before the skb is transmitted, the tap_get_user_xdp()-->skb_set_network_header() may assume the size is more than ETH_HLEN. Once transmitted, this could either cause out-of-bound access beyond the CVSSv3.1 8.8 (HIGH)

CWECWE 125TYPVulnerability

8.8

CVSS v3.1

Edit Score

2024-07-25

2024-07-25 21:46Z

CRIT

Softaculous Webuzo Authentication Bypass

Exodus Intel·blog.exodusintel.comCVE-2024-24621

Softaculous Webuzo contains a critical authentication bypass vulnerability in its password reset functionality (CVE-2024-24621, CVSS 10.0) that allows unauthenticated remote attackers to gain root-level server access. The vendor patched the issue within 24 hours of disclosure on July 12, 2024, with public disclosure following on July 25, 2024.

SRFApplicationTACTA0001SRFWebVNDSoftaculousVNDWebuzoTYPVulnerabilityTYPAdvisorySTGInitial Access

Edit Score

2024-07-25

2024-07-25 21:46Z

CRIT

Softaculous Webuzo FTP Management Command Injection

Exodus Intel·blog.exodusintel.comCVE-2024-24623

Softaculous Webuzo contains a command injection vulnerability in FTP management functionality (CVE-2024-24623) allowing authenticated remote attackers to execute arbitrary code. The vendor patched the issue within 24 hours of disclosure on July 12, 2024, with public disclosure following on July 25, 2024.

SRFApplicationTACTA0002SRFWebTACTA0003VNDSoftaculousVNDWebuzoTYPVulnerabilityTYPAdvisory

Edit Score

2024-07-25

2024-07-25 21:46Z

CRIT

Softaculous Webuzo Password Reset Command Injection

Exodus Intel·blog.exodusintel.comCVE-2024-24622

Softaculous Webuzo contains a command injection vulnerability in its password reset functionality (CVE-2024-24622) that allows authenticated remote attackers to execute arbitrary code with CVSS 9.0. The vendor patched the issue on July 12, 2024, one day after disclosure.

SRFApplicationTACTA0002SRFWebTACTA0003VNDSoftaculousVNDWebuzoTYPVulnerabilityTYPAdvisory

Edit Score

2024-07-24

2024-07-24 19:15Z

HIGH

CVE-2024-40495 — Linksys E2500_firmware: A vulnerability was discovered in Linksys Router E2500 with firmware 2.0.00, allows authenticated attackers

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-40495

A vulnerability was discovered in Linksys Router E2500 with firmware 2.0.00, allows authenticated attackers to execute arbitrary code via the hnd_parentalctrl_unblock function. CVSSv3.1 8.0 (HIGH) · EPSS 54th percentile

CWECWE 94VNDLinksysTYPVulnerability

8.0

CVSS v3.1

Edit Score

2024-07-22

2024-07-22 11:15Z

HIGH

CVE-2024-38708 — Ukrsolution Barcode_scanner_and_inventory_manager: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-38708

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inventory & Order Manager barcode-scanner-lite-pos-to-manage-products-inventory-and-orders.This issue affects Barcode Scanner with Inventory & Order Manager: from n/a through <= 1.6.1. CVSSv3.1 8.5 (HIGH)

CWECWE 89VNDUkrsolutionTYPVulnerability

8.5

CVSS v3.1

Edit Score

2024-07-20

2024-07-20 09:15Z

HIGH

CVE-2024-6497 — Squirrly Seo_plugin_by_squirrly_seo: The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to Stored Cross-Site

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-6497

The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 12.3.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-43286 appears to be a duplicate of this issue. CVSSv3.1 8.8 (HIGH)

CWECWE 89CWECWE 79VNDSquirrlyVNDSeoTYPVulnerability

8.8

CVSS v3.1

Edit Score

2024-07-19

2024-07-19 05:15Z

HIGH

CVE-2024-21527 — Versions of the package github.com/gotenberg/gotenberg/v8/pkg/gotenberg before 8.1.0; versions of the package github.com/gotenberg/gotenberg/v8/pkg/modules/chromium before 8.1.0

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-21527

Versions of the package github.com/gotenberg/gotenberg/v8/pkg/gotenberg before 8.1.0; versions of the package github.com/gotenberg/gotenberg/v8/pkg/modules/chromium before 8.1.0; versions of the package github.com/gotenberg/gotenberg/v8/pkg/modules/webhook before 8.1.0 are vulnerable to Server-side Request Forgery (SSRF) via the /convert/html endpoint when a request is made to a file via localhost, such as <iframe src="\\localhost/etc/passwd">. By exploiting this vulnerabilit CVSSv3.1 8.2 (HIGH) · EPSS 43th percentile

CWECWE 918TYPVulnerability

8.2

CVSS v3.1

Edit Score

2024-07-18

2024-07-18 18:15Z

CRIT

CVE-2024-0857 — Uni-yaz Flexwater_corporate_water_management: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-0857

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Universal Software Inc. FlexWater Corporate Water Management allows SQL Injection. This issue affects FlexWater Corporate Water Management: before 5.452.0. CVSSv3.1 9.8 (CRITICAL) · EPSS 31th percentile

CWECWE 89VNDUni YazTYPVulnerability

9.8

CVSS v3.1

Edit Score

2024-07-18

2024-07-18 17:15Z

CRIT

CVE-2024-5619 — Authorization: Bypass Through User-Controlled Key vulnerability in PruvaSoft Informatics Apinizer Management Console allows Exploiting

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-5619

Authorization Bypass Through User-Controlled Key vulnerability in PruvaSoft Informatics Apinizer Management Console allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Apinizer Management Console: before 2024.05.1. CVSSv3.1 9.6 (CRITICAL) · EPSS 8th percentile

CWECWE 639TYPVulnerability

9.6

CVSS v3.1

Edit Score

Latest intel// live feed

CVE-2024-7264 — Haxx Libcurl: If given an syntactically incorrect field, the parser might end up using -1 for

CVE-2024-39011 — Chargeover Chargeover\/redoc: Prototype Pollution in chargeover redoc v2.0.9-rc.69 allows attackers to execute arbitrary code or cause

CVE-2024-38909 — Std42 Elfinder: Studio 42 elFinder 2.1.64 is vulnerable to Incorrect Access Control.

CVE-2024-6699 — Mikafon Ma7_firmware: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

CVE-2024-42225 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: replace skb_put

CVE-2024-42108 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: net: rswitch: Avoid use-after-free

CVE-2024-37858 — Oretnom23 Lost_and_found_information_system: SQL Injection vulnerability in Lost and Found Information System 1.0 allows a remote attacker

CVE-2024-37857 — Oretnom23 Lost_and_found_information_system: SQL Injection vulnerability in Lost and Found Information System 1.0 allows a remote attacker

CVE-2024-42083 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: ionic: fix kernel panic

CVE-2024-41081 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: ila: block BH in

CVE-2024-41073 — Debian Debian_linux: In the Linux kernel, the following vulnerability has been resolved: nvme: avoid double free

CVE-2024-41062 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: bluetooth/l2cap: sync sock recv

CVE-2024-41046 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: net: ethernet: lantiq_etop: fix

CVE-2024-41040 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: net/sched: Fix UAF when

CVE-2024-41091 — Linux Linux_kernel: Once transmitted, this could either cause out-of-bound access beyond the actual length, or confuse

CVE-2024-41090 — Linux Linux_kernel: Once transmitted, this could either cause out-of-bound access beyond the actual length, or confuse

Softaculous Webuzo Authentication Bypass

Softaculous Webuzo FTP Management Command Injection

Softaculous Webuzo Password Reset Command Injection

CVE-2024-40495 — Linksys E2500_firmware: A vulnerability was discovered in Linksys Router E2500 with firmware 2.0.00, allows authenticated attackers

CVE-2024-38708 — Ukrsolution Barcode_scanner_and_inventory_manager: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

CVE-2024-6497 — Squirrly Seo_plugin_by_squirrly_seo: The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to Stored Cross-Site

CVE-2024-21527 — Versions of the package github.com/gotenberg/gotenberg/v8/pkg/gotenberg before 8.1.0; versions of the package github.com/gotenberg/gotenberg/v8/pkg/modules/chromium before 8.1.0

CVE-2024-0857 — Uni-yaz Flexwater_corporate_water_management: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

CVE-2024-5619 — Authorization: Bypass Through User-Controlled Key vulnerability in PruvaSoft Informatics Apinizer Management Console allows Exploiting