{"vulnerability": "2024-65", "sightings": [{"uuid": "14646cd5-646e-4270-8756-f972bf7c9d61", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6519", "type": "seen", "source": "http://www.zerodayinitiative.com/advisories/ZDI-24-1382/", "content": "", "creation_timestamp": "2024-10-15T05:00:00.000000Z"}, {"uuid": "2145d9db-e9fd-4c6b-837c-dcb7763c5044", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6516", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/113600288647294309", "content": "", "creation_timestamp": "2024-12-05T12:47:22.803747Z"}, {"uuid": "e49730b8-31b6-49a8-8e66-dae011678cfb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6531", "type": "seen", "source": "MISP/3a089118-12d0-4531-a56f-c07879ef75da", "content": "", "creation_timestamp": "2024-11-28T14:07:07.000000Z"}, {"uuid": "864715c3-bb8c-44fb-8783-e94f06f98c03", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6515", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/113600229645819251", "content": "", "creation_timestamp": "2024-12-05T12:32:22.239155Z"}, {"uuid": "7671be19-19fc-4753-95fa-e7e05092fa77", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6528", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-354-07", "content": "", "creation_timestamp": "2024-12-19T11:00:00.000000Z"}, {"uuid": "80d493f7-d9dc-4d97-aac7-ad1ffeaebfe9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6515", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-007-01", "content": "", "creation_timestamp": "2025-01-07T11:00:00.000000Z"}, {"uuid": "780f6ced-3d5b-4fbd-aa86-8d7e27b3520c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6516", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-007-01", "content": "", "creation_timestamp": "2025-01-07T11:00:00.000000Z"}, {"uuid": "29405ef6-8d40-4ccd-bd48-9aca6957179e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6587", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-03-09)", "content": "", "creation_timestamp": "2025-03-09T00:00:00.000000Z"}, {"uuid": "df646c7b-2cb2-436f-9a84-ae65de4e2fff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6516", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3lmxigzkkhj2t", "content": "", "creation_timestamp": "2025-04-16T21:02:30.537353Z"}, {"uuid": "83b54507-a5b3-438a-89f0-f53e90c1180b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6531", "type": "seen", "source": "https://gist.github.com/EduardoCorpay/fdaeb4ec65cc4a1c8fcd2fb0162de09c", "content": "", "creation_timestamp": "2025-06-11T15:29:00.000000Z"}, {"uuid": "b10fed76-5cec-47d3-8c12-28f8e56d4636", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6555", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3m6ztowxxua2w", "content": "", "creation_timestamp": "2025-12-02T21:02:32.980315Z"}, {"uuid": "cc7260ff-78f2-4b65-9d46-389e1a790995", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6555", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2024/CVE-2024-6555.yaml", "content": "", "creation_timestamp": "2025-12-02T07:41:11.000000Z"}, {"uuid": "3cd8040c-c311-4c09-95da-ea60b9f0c7e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2024-6598", "type": "seen", "source": "https://www.knime.com/security/advisories#CVE-2026-4649", "content": "", "creation_timestamp": "2026-03-25T03:00:10.000000Z"}, {"uuid": "91622b83-492c-4e22-9448-50e6b17abd59", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2024-6519", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0316/", "content": "", "creation_timestamp": "2026-03-19T00:00:00.000000Z"}, {"uuid": "f89d7610-1f9a-4010-8257-d085c0a28c86", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2024-6530", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/db9dd42d-746e-40cf-bae6-61042f0c1d48", "content": "", "creation_timestamp": "2024-10-11T12:24:01.570554Z"}, {"uuid": "64a430c9-9f27-4463-b391-e6ed075881c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6531", "type": "seen", "source": "https://gist.github.com/fernandinand/80cb943bc13477d76a3adff5cb86715c", "content": "", "creation_timestamp": "2026-04-22T13:26:30.000000Z"}, {"uuid": "d208a264-3ab3-48b2-8744-337356a203fc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6593", "type": "seen", "source": "https://t.me/HackingInsights/14489", "content": "\u200aCritical WatchGuard Vulnerabilities Discovered: CVE-2024-6592 and CVE-2024-6593\n\nhttps://securityonline.info/critical-watchguard-vulnerabilities-discovered-cve-2024-6592-and-cve-2024-6593/", "creation_timestamp": "2024-09-28T10:56:34.000000Z"}, {"uuid": "32ca9647-edd6-4f2e-84f0-df86221a7579", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6592", "type": "seen", "source": "https://t.me/HackingInsights/14489", "content": "\u200aCritical WatchGuard Vulnerabilities Discovered: CVE-2024-6592 and CVE-2024-6593\n\nhttps://securityonline.info/critical-watchguard-vulnerabilities-discovered-cve-2024-6592-and-cve-2024-6593/", "creation_timestamp": "2024-09-28T10:56:34.000000Z"}, {"uuid": "34bb80ac-2b96-4a5b-b1bd-dab04930c5f1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6538", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/13562", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2024-6538\n\ud83d\udd25 CVSS Score: 5.3 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)\n\ud83d\udd39 Description: A flaw was found in OpenShift Console. A Server Side Request Forgery (SSRF) attack can happen if an attacker supplies all or part of a URL to the server to query. The server is considered to be in a privileged network position and can often reach exposed services that aren't readily available to clients due to network filtering. Leveraging such an attack vector, the attacker can have an impact on other services and potentially disclose information or have other nefarious effects on the system.\nThe /api/dev-console/proxy/internet endpoint on the OpenShift Console allows authenticated users to have the console's pod perform arbitrary and fully controlled HTTP(s) requests. The full response to these requests is returned by the endpoint.\nWhile the name of this endpoint suggests the requests are only bound to the internet, no such checks are in place. An authenticated user can therefore ask the console to perform arbitrary HTTP requests from outside the cluster to a service inside the cluster.\n\ud83d\udccf Published: 2024-11-25T06:15:12.697Z\n\ud83d\udccf Modified: 2025-04-26T03:36:36.815Z\n\ud83d\udd17 References:\n1. https://access.redhat.com/security/cve/CVE-2024-6538\n2. https://bugzilla.redhat.com/show_bug.cgi?id=2296057", "creation_timestamp": "2025-04-26T04:07:44.000000Z"}, {"uuid": "5eb7e6bf-4dfb-4a95-9e26-ff53c3a2b028", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6538", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/7286", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2024-6538\n\ud83d\udd25 CVSS Score: 5.3 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)\n\ud83d\udd39 Description: A flaw was found in OpenShift Console. A Server Side Request Forgery (SSRF) attack can happen if an attacker supplies all or part of a URL to the server to query. The server is considered to be in a privileged network position and can often reach exposed services that aren't readily available to clients due to network filtering. Leveraging such an attack vector, the attacker can have an impact on other services and potentially disclose information or have other nefarious effects on the system.\nThe /api/dev-console/proxy/internet endpoint on the OpenShit Console allows authenticated users to have the console's pod perform arbitrary and fully controlled HTTP(s) requests. The full response to these requests is returned by the endpoint.\nWhile the name of this endpoint suggests the requests are only bound to the internet, no such checks are in place. An authenticated user can therefore ask the console to perform arbitrary HTTP requests from outside the cluster to a service inside the cluster.\n\ud83d\udccf Published: 2024-11-25T06:15:12.697Z\n\ud83d\udccf Modified: 2025-03-12T05:24:41.909Z\n\ud83d\udd17 References:\n1. https://access.redhat.com/security/cve/CVE-2024-6538\n2. https://bugzilla.redhat.com/show_bug.cgi?id=2296057", "creation_timestamp": "2025-03-12T05:41:09.000000Z"}, {"uuid": "b24e85bb-b57a-4401-bbb6-e82dc3fc37d7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6509", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/9293", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2024-6509\n\ud83d\udd25 CVSS Score: 6.5 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)\n\ud83d\udd39 Description: Marinus Pfund, member of the AXIS OS Bug Bounty Program, \nhas found the VAPIX API alwaysmulti.cgi was vulnerable for file globbing which could lead to resource exhaustion of the Axis device. \nAxis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.\n\ud83d\udccf Published: 2024-09-10T04:58:28.559Z\n\ud83d\udccf Modified: 2025-03-28T07:27:30.180Z\n\ud83d\udd17 References:\n1. https://www.axis.com/dam/public/f6/c6/f5/cve-2024-6509-en-US-458043.pdf", "creation_timestamp": "2025-03-28T08:27:39.000000Z"}, {"uuid": "2925616b-a885-4f8d-88f3-13637d2ea276", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6576", "type": "seen", "source": "https://t.me/HackingInsights/7917", "content": "\u200aProgress Software Issues Security Alert for MOVEit Transfer Users: CVE-2024-6576\n\nhttps://securityonline.info/progress-software-issues-security-alert-for-moveit-transfer-users-cve-2024-6576/", "creation_timestamp": "2024-07-30T12:37:39.000000Z"}, {"uuid": "03780be3-d32d-4e95-8aad-a771c38ddeab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6516", "type": "seen", "source": "https://t.me/cvedetector/12079", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6516 - Cross Site Scripting vulnerabilities where found p\", \n  \"Content\": \"CVE ID : CVE-2024-6516 \nPublished : Dec. 5, 2024, 1:15 p.m. | 41\u00a0minutes ago \nDescription : Cross Site Scripting vulnerabilities where found providing a potential for malicious scripts to be injected into a client browser.\u00a0  \nAffected products:  \n  \n  \nABB ASPECT - Enterprise v3.08.02;   \nNEXUS Series v3.08.02;   \nMATRIX Series v3.08.02 \nSeverity: 9.0 | CRITICAL \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"05 Dec 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-12-05T15:21:13.000000Z"}, {"uuid": "a1505383-296b-4427-ba0c-43fee43084b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6515", "type": "seen", "source": "https://t.me/cvedetector/12078", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6515 - Web browser interface may manipulate application u\", \n  \"Content\": \"CVE ID : CVE-2024-6515 \nPublished : Dec. 5, 2024, 1:15 p.m. | 41\u00a0minutes ago \nDescription : Web browser interface may manipulate application username/password in clear text or Base64 encoding providing a higher probability of  unintended credentails exposure.\u00a0  \nAffected products:  \n  \n  \nABB ASPECT - Enterprise v3.08.02;   \nNEXUS Series v3.08.02;   \nMATRIX Series v3.08.02 \nSeverity: 9.6 | CRITICAL \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"05 Dec 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-12-05T15:21:12.000000Z"}, {"uuid": "67600a81-cd2c-4d03-9e65-ce657da8006f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6581", "type": "seen", "source": "https://t.me/cvedetector/9329", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6581 - Lollms SVG Image Upload XSS Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2024-6581 \nPublished : Oct. 29, 2024, 1:15 p.m. | 22\u00a0minutes ago \nDescription : A vulnerability in the discussion image upload function of the Lollms application, version v9.9, allows for the uploading of SVG files. Due to incomplete filtering in the sanitize_svg function, this can lead to cross-site scripting (XSS) vulnerabilities, which in turn pose a risk of remote code execution. The sanitize_svg function only removes script elements and 'on*' event attributes, but does not account for other potential vectors for XSS within SVG files. This vulnerability can be exploited when authorized users access a malicious URL containing the crafted SVG file. \nSeverity: 6.5 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"29 Oct 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-10-29T14:46:56.000000Z"}, {"uuid": "11c392b7-879e-430d-b382-a014a7eb466e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6519", "type": "seen", "source": "https://t.me/cvedetector/8500", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6519 - QEMU LSI53C895A SCSI Host Bus Adapter Use-After-Free VM Escape\", \n  \"Content\": \"CVE ID : CVE-2024-6519 \nPublished : Oct. 21, 2024, 3:15 p.m. | 23\u00a0minutes ago \nDescription : A use-after-free vulnerability was found in the QEMU LSI53C895A SCSI Host Bus Adapter emulation. This issue can lead to a crash or VM escape. \nSeverity: 8.2 | HIGH \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"21 Oct 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-10-21T17:41:25.000000Z"}, {"uuid": "afd12771-0d14-4889-95bf-8d8bdef12b2b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6530", "type": "seen", "source": "https://t.me/cvedetector/7598", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6530 - GitLab Cross-Site Scripting Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2024-6530 \nPublished : Oct. 10, 2024, 12:15 p.m. | 42\u00a0minutes ago \nDescription : A cross-site scripting issue has been discovered in GitLab affecting all versions starting from 17.1 prior 17.2.9, starting from 17.3 prior to 17.3.5, and starting from 17.4 prior to 17.4.2. When adding a authorizing an application, it can be made to render as HTML under specific circumstances. \nSeverity: 7.3 | HIGH \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"10 Oct 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-10-10T15:05:12.000000Z"}, {"uuid": "29b3c4d0-e544-40c0-848c-827a270d1c03", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6517", "type": "seen", "source": "https://t.me/cvedetector/6383", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6517 - WordPress Contact Form 7 Reflected Cross-Site Scripting\", \n  \"Content\": \"CVE ID : CVE-2024-6517 \nPublished : Sept. 26, 2024, 6:15 a.m. | 21\u00a0minutes ago \nDescription : The Contact Form 7 Math Captcha WordPress plugin through 2.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users. \nSeverity: 0.0 | NA \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"26 Sep 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-09-26T08:46:28.000000Z"}, {"uuid": "7cc9cfb5-c7e5-491f-a0fc-b2a9a1f7a914", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6512", "type": "seen", "source": "https://t.me/cvedetector/6317", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6512 - Devolutions Server Authorization Bypass\", \n  \"Content\": \"CVE ID : CVE-2024-6512 \nPublished : Sept. 25, 2024, 2:15 p.m. | 32\u00a0minutes ago \nDescription : Authorization bypass in the\u00a0PAM access request approval mechanism in Devolutions Server 2024.2.10 and earlier allows authenticated users with permissions to approve their own requests, bypassing intended security restrictions, via the PAM access request approval mechanism. \nSeverity: 0.0 | NA \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"25 Sep 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-09-25T16:50:02.000000Z"}, {"uuid": "4d1ece0c-37cd-4605-92c5-4b1adfec5d3c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6594", "type": "seen", "source": "https://t.me/cvedetector/6311", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6594 - WatchGuard Single Sign-On Client Denial of Service (DoS)\", \n  \"Content\": \"CVE ID : CVE-2024-6594 \nPublished : Sept. 25, 2024, 12:15 p.m. | 41\u00a0minutes ago \nDescription : Improper Handling of Exceptional Conditions vulnerability in the WatchGuard Single Sign-On Client on Windows causes the client to crash while handling malformed commands. An attacker with network access to the client could create a denial of service condition for the Single Sign-On service by repeatedly issuing malformed commands.  \n  \nThis issue affects Single Sign-On Client: through 12.7. \nSeverity: 7.5 | HIGH \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"25 Sep 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-09-25T15:09:38.000000Z"}, {"uuid": "d2e68a54-cc77-4125-9cf5-15cfc85eddd3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6593", "type": "seen", "source": "https://t.me/cvedetector/6310", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6593 - WatchGuard Authentication Gateway Unauthorized Command Execution\", \n  \"Content\": \"CVE ID : CVE-2024-6593 \nPublished : Sept. 25, 2024, 12:15 p.m. | 41\u00a0minutes ago \nDescription : Incorrect Authorization vulnerability in WatchGuard Authentication Gateway (aka Single Sign-On Agent) on Windows allows an attacker with network access to execute restricted management commands.  \nThis issue affects Authentication Gateway: through 12.10.2. \nSeverity: 9.1 | CRITICAL \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"25 Sep 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-09-25T15:09:37.000000Z"}, {"uuid": "108ad93e-3b4e-40ba-8615-fc2eeea69347", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6592", "type": "seen", "source": "https://t.me/cvedetector/6309", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6592 - WatchGuard Single Sign-On Agent Unauthorized Access\", \n  \"Content\": \"CVE ID : CVE-2024-6592 \nPublished : Sept. 25, 2024, 12:15 p.m. | 41\u00a0minutes ago \nDescription : Incorrect Authorization vulnerability in the protocol communication between the WatchGuard Authentication Gateway (aka Single Sign-On Agent) on Windows and the WatchGuard Single Sign-On Client on Windows and MacOS allows Authentication Bypass.This issue affects the Authentication Gateway: through 12.10.2; Windows Single Sign-On Client: through 12.7; MacOS Single Sign-On Client: through 12.5.4. \nSeverity: 9.1 | CRITICAL \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"25 Sep 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-09-25T15:09:36.000000Z"}, {"uuid": "110acce3-803f-496e-9f6d-d2ff59809e77", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6544", "type": "seen", "source": "https://t.me/cvedetector/5610", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6544 - Wordpress Custom Post Limits Full Path Disclosure\", \n  \"Content\": \"CVE ID : CVE-2024-6544 \nPublished : Sept. 13, 2024, 3:15 p.m. | 39\u00a0minutes ago \nDescription : The Custom Post Limits plugin for WordPress is vulnerable to full path disclosure in all versions up to, and including, 4.4.1. This is due to the plugin utilizing bootstrap and leaving test files with display_errors on. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website. \nSeverity: 5.3 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"13 Sep 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-09-13T17:57:53.000000Z"}, {"uuid": "b94821a7-1e91-47d0-89d9-6ac321a3026e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6582", "type": "seen", "source": "https://t.me/cvedetector/5624", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6582 - Lunary Ai Saml Access Control Bypass Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2024-6582 \nPublished : Sept. 13, 2024, 5:15 p.m. | 17\u00a0minutes ago \nDescription : A broken access control vulnerability exists in the latest version of lunary-ai/lunary. The `saml.ts` file allows a user from one organization to update the Identity Provider (IDP) settings and view the SSO metadata of another organization. This vulnerability can lead to unauthorized access and potential account takeover if the email of a user in the target organization is known. \nSeverity: 6.5 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"13 Sep 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-09-13T19:38:20.000000Z"}, {"uuid": "db456759-5c2e-4ebc-a3ca-bcbe67ff8168", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6587", "type": "seen", "source": "https://t.me/cvedetector/5622", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6587 - OpenAI Littelm API SSRF Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2024-6587 \nPublished : Sept. 13, 2024, 4:15 p.m. | 29\u00a0minutes ago \nDescription : A Server-Side Request Forgery (SSRF) vulnerability exists in berriai/litellm version 1.38.10. This vulnerability allows users to specify the `api_base` parameter when making requests to `POST /chat/completions`, causing the application to send the request to the domain specified by `api_base`. This request includes the OpenAI API key. A malicious user can set the `api_base` to their own domain and intercept the OpenAI API key, leading to unauthorized access and potential misuse of the API key. \nSeverity: 7.5 | HIGH \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"13 Sep 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-09-13T18:48:15.000000Z"}, {"uuid": "10014ced-891e-43e0-b931-7af788064d0e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6510", "type": "seen", "source": "https://t.me/cvedetector/5485", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6510 - AVG Internet Security COM-Hijacking Privilege Escalation\", \n  \"Content\": \"CVE ID : CVE-2024-6510 \nPublished : Sept. 12, 2024, 3:18 p.m. | 17\u00a0minutes ago \nDescription : Local Privilege Escalation in AVG Internet Security v24 on Windows allows a local unprivileged user to escalate privileges to SYSTEM via COM-Hijacking. \nSeverity: 7.8 | HIGH \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"12 Sep 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-09-12T17:42:35.000000Z"}, {"uuid": "d900593e-b552-421c-8300-de41cd6b1506", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6551", "type": "seen", "source": "https://t.me/cvedetector/4376", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6551 - GiveWP Symfony Full Path Disclosure Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2024-6551 \nPublished : Aug. 29, 2024, 11:15 a.m. | 21\u00a0minutes ago \nDescription : The GiveWP \u2013 Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.15.1. This is due to the plugin utilizing Symfony and leaving display_errors on within test files. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website. \nSeverity: 5.3 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"29 Aug 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-08-29T13:42:35.000000Z"}, {"uuid": "7e506d15-c268-46c6-a937-f6822f84c4b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6585", "type": "seen", "source": "https://t.me/cvedetector/4557", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6585 - Lightdash Stored Cross-Site Scripting (XSS)\", \n  \"Content\": \"CVE ID : CVE-2024-6585 \nPublished : Aug. 30, 2024, 11:15 p.m. | 18\u00a0minutes ago \nDescription : Multiple stored cross-site scripting (\u201cXSS\u201d) vulnerabilities in the markdown dashboard and dashboard comment functionality of Lightdash version 0.1024.6 allows remote authenticated threat actors to inject malicious scripts into vulnerable web pages. A threat actor could potentially exploit this vulnerability to store malicious JavaScript which executes in the context of a user\u2019s session with the application. \nSeverity: 0.0 | NA \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"31 Aug 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-08-31T01:41:24.000000Z"}, {"uuid": "a946066e-40c5-42f7-950b-51a7e5c06a5b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6586", "type": "seen", "source": "https://t.me/cvedetector/4556", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6586 - Lightdash SSRF and Session Takeover vulnerability\", \n  \"Content\": \"CVE ID : CVE-2024-6586 \nPublished : Aug. 30, 2024, 11:15 p.m. | 18\u00a0minutes ago \nDescription : Lightdash version 0.1024.6 allows users with the necessary permissions, such as Administrator or Editor, to create and share dashboards. A dashboard that contains HTML elements which point to a threat actor controlled source can trigger an SSRF request when exported, via a POST request to /api/v1/dashboards//export. The forged request contains the value of the exporting user\u2019s session token. A threat actor could obtain the session token of any user who exports the dashboard. The obtained session token can be used to perform actions as the victim on the application, resulting in session takeover. \nSeverity: 0.0 | NA \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"31 Aug 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-08-31T01:41:23.000000Z"}, {"uuid": "0fc99aad-9ba6-42cf-98e0-b558e6dd1973", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6500", "type": "seen", "source": "https://t.me/cvedetector/3377", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6500 - InPost for WooCommerce/PL PHP File Inclusion/Deletion Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2024-6500 \nPublished : Aug. 17, 2024, 3:15 a.m. | 15\u00a0minutes ago \nDescription : The InPost for WooCommerce plugin and InPost PL plugin for WordPress are vulnerable to unauthorized access and deletion of data due to a missing capability check on the 'parse_request' function in all versions up to, and including, 1.4.0 (for InPost for WooCommerce) as well as 1.4.4 (for InPost PL). This makes it possible for unauthenticated attackers to read and delete arbitrary files on Windows servers. On Linux servers, only files within the WordPress install will be deleted, but all files can be read. \nSeverity: 10.0 | CRITICAL \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"17 Aug 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-08-17T05:36:24.000000Z"}, {"uuid": "d6bc7931-7165-4c8b-af0b-76d6fc91d772", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6596", "type": "seen", "source": "https://t.me/cvedetector/5183", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6596 - Adobe PostScript Curve Deserialization RCE\", \n  \"Content\": \"CVE ID : CVE-2024-6596 \nPublished : Sept. 10, 2024, 8:15 a.m. | 27\u00a0minutes ago \nDescription : An unauthenticated remote attacker can run malicious c# code included in curve files and execute commands in the users context. \nSeverity: 9.8 | CRITICAL \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"10 Sep 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-09-10T10:52:59.000000Z"}, {"uuid": "e4f8367d-b8e1-4155-a973-401f978cca2c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6509", "type": "seen", "source": "https://t.me/cvedetector/5167", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6509 - \"Axis VAPIX File Globbing Vulnerability\"\", \n  \"Content\": \"CVE ID : CVE-2024-6509 \nPublished : Sept. 10, 2024, 5:15 a.m. | 15\u00a0minutes ago \nDescription : Marinus Pfund, member of the AXIS OS Bug Bounty Program,   \nhas found the VAPIX API alwaysmulti.cgi was vulnerable for file globbing which could lead to resource exhaustion of the Axis device.   \nAxis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution. \nSeverity: 6.5 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"10 Sep 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-09-10T07:32:25.000000Z"}, {"uuid": "ce2530db-aa31-4feb-825a-7f9a8070dcd1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6572", "type": "seen", "source": "https://t.me/cvedetector/5103", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6572 - Checkmk SFTP Service VNX SSH Host Key Spoofing Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2024-6572 \nPublished : Sept. 9, 2024, 10:15 a.m. | 45\u00a0minutes ago \nDescription : Improper host key checking in active check 'Check SFTP Service' and special agent 'VNX quotas and filesystem' in Checkmk before Checkmk 2.3.0p15, 2.2.0p33, 2.1.0p48 and 2.0.0 (EOL) allows man-in-the-middle attackers to intercept traffic \nSeverity: 0.0 | NA \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"09 Sep 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-09-09T13:08:35.000000Z"}, {"uuid": "8923100c-206e-4653-8c4a-8ef2dcd23469", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6568", "type": "seen", "source": "https://t.me/cvedetector/3736", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6568 - Flamix: Bitrix24 and Contact Form 7 WordPress Plugin Full Path Disclosure Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2024-6568 \nPublished : Aug. 21, 2024, 6:15 a.m. | 44\u00a0minutes ago \nDescription : The Flamix: Bitrix24 and Contact Form 7 integrations plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.1.0. This is due the plugin utilizing mobiledetect without preventing direct access to the files. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website. \nSeverity: 5.3 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"21 Aug 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-08-21T09:01:50.000000Z"}, {"uuid": "401f08f3-7993-44ca-bf34-c0f71512aefe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6508", "type": "seen", "source": "https://t.me/cvedetector/3735", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6508 - OpenShift Console CSRF in OAuth2 State Parameter\", \n  \"Content\": \"CVE ID : CVE-2024-6508 \nPublished : Aug. 21, 2024, 6:15 a.m. | 44\u00a0minutes ago \nDescription : An insufficient entropy vulnerability was found in the Openshift Console. In the authorization code type and implicit grant type, the OAuth2 protocol is vulnerable to a Cross-Site Request Forgery (CSRF) attack if the state parameter is used inefficiently. This flaw allows logging into the victim\u2019s current application account using a third-party account without any restrictions. \nSeverity: 8.0 | HIGH \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"21 Aug 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-08-21T09:01:49.000000Z"}, {"uuid": "c350c7cb-619f-4e99-a6df-321321e17da6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6502", "type": "seen", "source": "https://t.me/cvedetector/3925", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6502 - GitLab Branch Hijacking Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2024-6502 \nPublished : Aug. 22, 2024, 4:15 p.m. | 39\u00a0minutes ago \nDescription : An issue was discovered in GitLab CE/EE affecting all versions starting from 8.2 prior to 17.1.6 starting from 17.2 prior to 17.2.4, and starting from 17.3 prior to 17.3.1, which allows an attacker to create a branch with the same name as a deleted tag. \nSeverity: 5.7 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"22 Aug 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-08-22T19:23:01.000000Z"}, {"uuid": "2e225285-0574-4155-bfff-88209be00148", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6575", "type": "seen", "source": "https://t.me/cvedetector/3599", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6575 - Elementor Addons Stored Cross-Site Scripting\", \n  \"Content\": \"CVE ID : CVE-2024-6575 \nPublished : Aug. 20, 2024, 4:15 a.m. | 39\u00a0minutes ago \nDescription : The The Plus Addons for Elementor \u2013 Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018res_width_value\u2019 parameter within the plugin's tp_page_scroll widget in all versions up to, and including, 5.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. \nSeverity: 6.4 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"20 Aug 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-08-20T07:05:40.000000Z"}, {"uuid": "94f94ca0-e159-4cd8-8060-e9e8459f7df6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6567", "type": "seen", "source": "https://t.me/cvedetector/2322", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6567 - \"Ebook Store Plugin for WordPress Full Path Disclosure\"\", \n  \"Content\": \"CVE ID : CVE-2024-6567 \nPublished : Aug. 2, 2024, 2:15 a.m. | 33\u00a0minutes ago \nDescription : The Ebook Store plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 5.8001. This is due to the plugin utilizing fpdi-protection and not preventing direct access to test files that have display_errors set to true. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website. \nSeverity: 5.3 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"02 Aug 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-08-02T04:49:20.000000Z"}, {"uuid": "1b2867cd-fbe8-42b4-91bf-bc77a2becbf5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6532", "type": "seen", "source": "https://t.me/cvedetector/3111", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6532 - \"WordPress Google Sheet to Table Live Sync Stored Cross-Site Scripting\"\", \n  \"Content\": \"CVE ID : CVE-2024-6532 \nPublished : Aug. 14, 2024, 10:15 a.m. | 44\u00a0minutes ago \nDescription : The Sheet to Table Live Sync for Google Sheet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's STWT_Sheet_Table shortcode in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. \nSeverity: 6.4 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"14 Aug 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-08-14T13:11:52.000000Z"}, {"uuid": "ee436d84-1f8c-4313-a7d7-9c393bdae261", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6552", "type": "seen", "source": "https://t.me/cvedetector/2748", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6552 - Booking for Appointments and Events Calendar \u2013 Amelia WordPress Full Path Disclosure Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2024-6552 \nPublished : Aug. 8, 2024, 4:17 a.m. | 37\u00a0minutes ago \nDescription : The Booking for Appointments and Events Calendar \u2013 Amelia plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.2. This is due to the plugin utilizing Symfony and leaving display_errors on within test files. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website. \nSeverity: 5.3 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"08 Aug 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-08-08T07:11:43.000000Z"}, {"uuid": "1407604d-89e4-490d-9122-6594b116e36f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6522", "type": "seen", "source": "https://t.me/cvedetector/2680", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6522 - WordPress Modern Events Calendar Server-Side Request Forgery\", \n  \"Content\": \"CVE ID : CVE-2024-6522 \nPublished : Aug. 7, 2024, 11:15 a.m. | 15\u00a0minutes ago \nDescription : The Modern Events Calendar plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.12.1 via the 'mec_fes_form' AJAX function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. \nSeverity: 8.5 | HIGH \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"07 Aug 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-08-07T13:37:36.000000Z"}, {"uuid": "9f0f0271-597f-42c2-9e93-eef9d1b98037", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6558", "type": "seen", "source": "https://t.me/cvedetector/1646", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6558 - HMS Industrial Networks Anybus-CompactCom Cross-Site Scripting (XSS) Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2024-6558 \nPublished : July 25, 2024, 8:15 p.m. | 28\u00a0minutes ago \nDescription : HMS Industrial Networks  \n  \nAnybus-CompactCom 30 products are vulnerable to a XSS attack caused by the lack of input sanitation checks. As a consequence, it is possible to insert HTML code into input fields and store the HTML code. The stored HTML code will be embedded in the page and executed by host browser the next time the page is loaded, enabling social engineering attacks. \nSeverity: 6.3 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"25 Jul 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-07-25T22:46:18.000000Z"}, {"uuid": "69bf4362-362f-4e02-9ae6-cc385c8bb999", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6589", "type": "seen", "source": "https://t.me/cvedetector/1623", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6589 - \"LearnPress - WordPress LMS Plugin Local File Inclusion Vulnerability\"\", \n  \"Content\": \"CVE ID : CVE-2024-6589 \nPublished : July 25, 2024, 11:15 a.m. | 37\u00a0minutes ago \nDescription : The LearnPress \u2013 WordPress LMS Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.2.6.8.2 via the 'render_content_block_template' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other \u201csafe\u201d file types can be uploaded and included. \nSeverity: 8.8 | HIGH \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"25 Jul 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-07-25T14:24:21.000000Z"}, {"uuid": "2b6deb60-076f-43da-9267-1921390f785b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6553", "type": "seen", "source": "https://t.me/cvedetector/1545", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6553 - \"WordPress WP Meteor Full Path Disclosure Vulnerability\"\", \n  \"Content\": \"CVE ID : CVE-2024-6553 \nPublished : July 24, 2024, 7:15 a.m. | 36\u00a0minutes ago \nDescription : The WP Meteor Website Speed Optimization Addon plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.4.3.This is due to the plugin utilizing wpdesk and leaving test files with display_errors on. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website. \nSeverity: 5.3 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"24 Jul 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-07-24T09:57:39.000000Z"}, {"uuid": "5de72f4a-b430-4a49-b670-731764b70323", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6571", "type": "seen", "source": "https://t.me/cvedetector/1544", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6571 - WordPress Optimize Images Full Path Disclosure\", \n  \"Content\": \"CVE ID : CVE-2024-6571 \nPublished : July 24, 2024, 7:15 a.m. | 36\u00a0minutes ago \nDescription : The Optimize Images ALT Text (alt tag) & names for SEO using AI plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.1.1. This is due the plugin utilizing cocur and not preventing direct access to the generate-default.php file. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website. \nSeverity: 5.3 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"24 Jul 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-07-24T09:57:38.000000Z"}, {"uuid": "1e4af8fa-c985-41fe-9147-a9c157f88faf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6542", "type": "seen", "source": "https://t.me/cvedetector/1412", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6542 - Checkmk Livestatus Command Injection Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2024-6542 \nPublished : July 22, 2024, 10:15 a.m. | 31\u00a0minutes ago \nDescription : Improper neutralization of livestatus command delimiters in mknotifyd in Checkmk Severity: 6.5 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"22 Jul 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-07-22T12:48:04.000000Z"}, {"uuid": "4ab18fd3-ab28-4b51-9f39-3069348e7da0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6533", "type": "seen", "source": "https://t.me/cvedetector/3224", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6533 - Directus Cross-Site Scripting (XSS)\", \n  \"Content\": \"CVE ID : CVE-2024-6533 \nPublished : Aug. 15, 2024, 3:15 a.m. | 34\u00a0minutes ago \nDescription : Directus v10.13.0 allows an authenticated external attacker to execute arbitrary JavaScript on the client. This is possible because the application injects an attacker-controlled parameter that will be stored in the server and used by the client into an unsanitized DOM element. When chained with CVE-2024-6534, it could result in account takeover. \nSeverity: 4.1 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"15 Aug 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-08-15T05:56:35.000000Z"}, {"uuid": "9c7ffca5-65dd-48d7-b9e3-60bc4bcc10bb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6534", "type": "seen", "source": "https://t.me/cvedetector/3224", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6533 - Directus Cross-Site Scripting (XSS)\", \n  \"Content\": \"CVE ID : CVE-2024-6533 \nPublished : Aug. 15, 2024, 3:15 a.m. | 34\u00a0minutes ago \nDescription : Directus v10.13.0 allows an authenticated external attacker to execute arbitrary JavaScript on the client. This is possible because the application injects an attacker-controlled parameter that will be stored in the server and used by the client into an unsanitized DOM element. When chained with CVE-2024-6534, it could result in account takeover. \nSeverity: 4.1 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"15 Aug 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-08-15T05:56:35.000000Z"}, {"uuid": "647a954e-c0b2-4f05-9929-e6fc8302f051", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6533", "type": "seen", "source": "https://t.me/cvedetector/3228", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6534 - Directus Preset Assignment Privilege Escalation Stored Cross-Site Request Forgery\", \n  \"Content\": \"CVE ID : CVE-2024-6534 \nPublished : Aug. 15, 2024, 4:15 a.m. | 24\u00a0minutes ago \nDescription : Directus v10.13.0 allows an authenticated external attacker to modify presets created by the same user to assign them to another user. This is possible because the application only validates the user parameter in the 'POST /presets'\u00a0request but not in the PATCH request. When chained with CVE-2024-6533, it could result in account takeover. \nSeverity: 4.1 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"15 Aug 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-08-15T06:46:45.000000Z"}, {"uuid": "1358149b-3b78-4971-9694-40e6d083359f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6534", "type": "seen", "source": "https://t.me/cvedetector/3228", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6534 - Directus Preset Assignment Privilege Escalation Stored Cross-Site Request Forgery\", \n  \"Content\": \"CVE ID : CVE-2024-6534 \nPublished : Aug. 15, 2024, 4:15 a.m. | 24\u00a0minutes ago \nDescription : Directus v10.13.0 allows an authenticated external attacker to modify presets created by the same user to assign them to another user. This is possible because the application only validates the user parameter in the 'POST /presets'\u00a0request but not in the PATCH request. When chained with CVE-2024-6533, it could result in account takeover. \nSeverity: 4.1 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"15 Aug 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-08-15T06:46:45.000000Z"}, {"uuid": "66dcb2f0-ab54-4531-9ea1-e9d5c3edd5cb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6529", "type": "seen", "source": "https://t.me/cvedetector/2212", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6529 - Apache Strix Classified Listings Cross-Site Scripting Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2024-6529 \nPublished : Aug. 1, 2024, 6:15 a.m. | 22\u00a0minutes ago \nDescription : The Ultimate Classified Listings WordPress plugin before 1.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin \nSeverity: 0.0 | NA \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"01 Aug 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-08-01T08:44:01.000000Z"}, {"uuid": "f38ccfcc-df44-4583-8f26-6866102519b0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6536", "type": "seen", "source": "https://t.me/cvedetector/1976", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6536 - Zephyr Project Manager WordPress Stored Cross-Site Scripting Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2024-6536 \nPublished : July 30, 2024, 6:15 a.m. | 40\u00a0minutes ago \nDescription : The Zephyr Project Manager WordPress plugin before 3.3.99 does not sanitise and escape some of its settings, which could allow high privilege users such as editors and admins to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) \nSeverity: 0.0 | NA \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"30 Jul 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-07-30T09:02:27.000000Z"}, {"uuid": "ea2c3391-50fb-4852-afdc-20060b554588", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6573", "type": "seen", "source": "https://t.me/cvedetector/1735", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6573 - WordPress Intelligence Plugin Full Path Disclosure\", \n  \"Content\": \"CVE ID : CVE-2024-6573 \nPublished : July 27, 2024, 2:15 a.m. | 31\u00a0minutes ago \nDescription : The Intelligence plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.4.0. This is due the plugin not preventing direct access to the /vendor/levelten/intel/realtime/index.php file and display_errors being enabled. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website. \nSeverity: 5.3 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"27 Jul 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-07-27T04:54:48.000000Z"}, {"uuid": "8532341b-6c26-4fc5-b83e-28087991ff20", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6591", "type": "seen", "source": "https://t.me/cvedetector/1733", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6591 - WordPress Auction Plugin Email Exfiltration(',')\", \n  \"Content\": \"CVE ID : CVE-2024-6591 \nPublished : July 27, 2024, 2:15 a.m. | 31\u00a0minutes ago \nDescription : The Ultimate WordPress Auction Plugin plugin for WordPress is vulnerable to unauthorized email creation and sending due to a missing capability check on the 'send_auction_email_callback' and 'resend_auction_email_callback' functions in all versions up to, and including, 4.2.6. This makes it possible for unauthenticated attackers to craft emails that include links and send to any email address. \nSeverity: 5.8 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"27 Jul 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-07-27T04:54:46.000000Z"}, {"uuid": "04d7676f-4d7c-4281-af0a-fc4c82d67902", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6545", "type": "seen", "source": "https://t.me/cvedetector/1743", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6545 - WordPress Admin Trim Interface Plugin Full Path Disclosure\", \n  \"Content\": \"CVE ID : CVE-2024-6545 \nPublished : July 27, 2024, 2:15 a.m. | 31\u00a0minutes ago \nDescription : The Admin Trim Interface plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.5.1. This is due to the plugin utilizing bootstrap and leaving test files with display_errors on. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website. \nSeverity: 5.3 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"27 Jul 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-07-27T04:54:59.000000Z"}, {"uuid": "bdd880d0-30cc-42a2-9914-8d00df786fca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6578", "type": "seen", "source": "https://t.me/cvedetector/1911", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6578 - AimHubio Aim Cross-Site Scripting (XSS) Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2024-6578 \nPublished : July 29, 2024, 7:15 p.m. | 38\u00a0minutes ago \nDescription : A stored cross-site scripting (XSS) vulnerability exists in aimhubio/aim version 3.19.3. The vulnerability arises from the improper neutralization of input during web page generation, specifically in the logs-tab for runs. The terminal output logs are displayed using the `dangerouslySetInnerHTML` function in React, which is susceptible to XSS attacks. An attacker can exploit this vulnerability by injecting malicious scripts into the logs, which will be executed when a user views the logs-tab. \nSeverity: 7.2 | HIGH \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"29 Jul 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-07-29T22:09:38.000000Z"}, {"uuid": "d4bbebe6-49bc-46d7-84bd-77fc811d43eb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6576", "type": "seen", "source": "https://t.me/cvedetector/1846", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6576 - Progress MOVEit Transfer SFTP Module Authentication Bypass Privilege Escalation\", \n  \"Content\": \"CVE ID : CVE-2024-6576 \nPublished : July 29, 2024, 2:15 p.m. | 36\u00a0minutes ago \nDescription : Improper Authentication vulnerability in Progress MOVEit Transfer (SFTP module) can lead to Privilege Escalation.This issue affects MOVEit Transfer: from 2023.0.0 before 2023.0.12, from 2023.1.0 before 2023.1.7, from 2024.0.0 before 2024.0.3. \nSeverity: 7.3 | HIGH \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"29 Jul 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-07-29T17:07:42.000000Z"}, {"uuid": "37d06cf8-a0f2-4087-b065-2637ff6c7f6e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6520", "type": "seen", "source": "https://t.me/cvedetector/1754", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6520 - Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Cross-Site Scripting Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2024-6520 \nPublished : July 27, 2024, 12:15 p.m. | 39\u00a0minutes ago \nDescription : The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.1.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. \nSeverity: 5.5 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"27 Jul 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-07-27T14:57:09.000000Z"}, {"uuid": "06920646-702f-4bf2-b35b-2052d481a5fc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6518", "type": "seen", "source": "https://t.me/cvedetector/1756", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6518 - Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder Stored Cross-Site Scripting Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2024-6518 \nPublished : July 27, 2024, 12:15 p.m. | 39\u00a0minutes ago \nDescription : The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.1.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. \nSeverity: 5.5 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"27 Jul 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-07-27T14:57:11.000000Z"}, {"uuid": "c7ba1d7e-e375-4759-83a3-be12347c441b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6548", "type": "seen", "source": "https://t.me/cvedetector/1741", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6548 - WordPress Add Admin JavaScript Plugin Full Path Disclosure\", \n  \"Content\": \"CVE ID : CVE-2024-6548 \nPublished : July 27, 2024, 2:15 a.m. | 31\u00a0minutes ago \nDescription : The Add Admin JavaScript plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.0. This is due to the plugin utilizing bootstrap and leaving test files with display_errors on. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website. \nSeverity: 5.3 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"27 Jul 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-07-27T04:54:57.000000Z"}, {"uuid": "e4886815-bd90-4a53-b0db-666ae2768dd3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6547", "type": "seen", "source": "https://t.me/cvedetector/1740", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6547 - \"WordPress Add Admin CSS Plugin Full Path Disclosure\"\", \n  \"Content\": \"CVE ID : CVE-2024-6547 \nPublished : July 27, 2024, 2:15 a.m. | 31\u00a0minutes ago \nDescription : The Add Admin CSS plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.0.1.  This is due to the plugin utilizing bootstrap and leaving test files with display_errors on. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website. \nSeverity: 5.3 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"27 Jul 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-07-27T04:54:55.000000Z"}, {"uuid": "83b69489-76b8-40f9-bd33-c687fcb302e8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6521", "type": "seen", "source": "https://t.me/cvedetector/1752", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6521 - Fluent Forms Stored Cross-Site Scripting Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2024-6521 \nPublished : July 27, 2024, 12:15 p.m. | 39\u00a0minutes ago \nDescription : The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.1.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. \nSeverity: 5.5 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"27 Jul 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-07-27T14:57:07.000000Z"}, {"uuid": "23c38f5a-ecee-462f-9bf5-873accbd04bd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6569", "type": "seen", "source": "https://t.me/cvedetector/1750", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6569 - \"Campaign Monitor for WordPress Full Path Disclosure Vulnerability\"\", \n  \"Content\": \"CVE ID : CVE-2024-6569 \nPublished : July 27, 2024, 9:15 a.m. | 18\u00a0minutes ago \nDescription : The Campaign Monitor for WordPress plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.8.15. This is due the plugin not properly restricting direct access to /forms/views/admin/create.php and display_errors being enabled. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website. \nSeverity: 5.3 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"27 Jul 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-07-27T11:36:28.000000Z"}, {"uuid": "5b5d0dda-c7e1-45b2-96e2-7a7673a360bf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6549", "type": "seen", "source": "https://t.me/cvedetector/1739", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6549 - Apache Full Path Disclosure in WordPress Admin Post Navigation Plugin\", \n  \"Content\": \"CVE ID : CVE-2024-6549 \nPublished : July 27, 2024, 2:15 a.m. | 31\u00a0minutes ago \nDescription : The Admin Post Navigation plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.1. This is due to the plugin utilizing bootstrap and leaving test files with display_errors on. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website. \nSeverity: 5.3 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"27 Jul 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-07-27T04:54:54.000000Z"}, {"uuid": "9a410e2d-db76-4d42-8419-064f892ea4e5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6546", "type": "seen", "source": "https://t.me/cvedetector/1738", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6546 - WordPress One Click Close Comments Full Path Disclosure\", \n  \"Content\": \"CVE ID : CVE-2024-6546 \nPublished : July 27, 2024, 2:15 a.m. | 31\u00a0minutes ago \nDescription : The One Click Close Comments plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.7.1. This is due to the plugin utilizing bootstrap and leaving test files with display_errors on. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website. \nSeverity: 5.3 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"27 Jul 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-07-27T04:54:54.000000Z"}, {"uuid": "be511acd-1e8f-407d-bfaa-cf3b297f0624", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6566", "type": "seen", "source": "https://t.me/cvedetector/1737", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6566 - Aramex Shipping WooCommerce Full Path Disclosure in WordPress\", \n  \"Content\": \"CVE ID : CVE-2024-6566 \nPublished : July 27, 2024, 2:15 a.m. | 31\u00a0minutes ago \nDescription : The Aramex Shipping WooCommerce plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.1.21. This is due the plugin not preventing direct access to the composer-setup.php file which also has display_errors enabled. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website. \nSeverity: 5.3 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"27 Jul 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-07-27T04:54:50.000000Z"}, {"uuid": "95a802b2-95a4-4df5-91e5-42ed2e05d020", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6588", "type": "seen", "source": "https://t.me/cvedetector/715", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6588 - The PowerPress Podcasting plugin by Blubrry plugin\", \n  \"Content\": \"CVE ID : CVE-2024-6588 \nPublished : July 12, 2024, 7:15 a.m. | 40\u00a0minutes ago \nDescription : The PowerPress Podcasting plugin by Blubrry plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the \u2018media_url\u2019 parameter in all versions up to, and including, 11.9.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. \nSeverity: 6.4 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"12 Jul 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-07-12T10:13:35.000000Z"}, {"uuid": "45fd2745-c2a5-4628-aa4f-c4947cf35d23", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6555", "type": "seen", "source": "https://t.me/cvedetector/703", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6555 - The WP Popups \u2013 WordPress Popup builder plugin for\", \n  \"Content\": \"CVE ID : CVE-2024-6555 \nPublished : July 12, 2024, 6:15 a.m. | 41\u00a0minutes ago \nDescription : The WP Popups \u2013 WordPress Popup builder plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.2.0.1. This is due the plugin utilizing mobiledetect without preventing direct access to the files. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website. \nSeverity: 5.3 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"12 Jul 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-07-12T09:23:09.000000Z"}, {"uuid": "8827c6b7-faed-4cfb-9278-aee74a7ec097", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6528", "type": "seen", "source": "https://t.me/cvedetector/648", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6528 - CWE-79: Improper Neutralization of Input During We\", \n  \"Content\": \"CVE ID : CVE-2024-6528 \nPublished : July 11, 2024, 9:15 a.m. | 20\u00a0minutes ago \nDescription : CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site  \nScripting') vulnerability exists that could cause a vulnerability leading to a cross-site scripting  \ncondition where attackers can have a victim\u2019s browser run arbitrary JavaScript when they visit a  \npage containing the injected payload. \nSeverity: 5.4 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"11 Jul 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-07-11T11:37:48.000000Z"}, {"uuid": "b4c0557f-e79c-4fbf-9a63-11dbdf1c6222", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6531", "type": "seen", "source": "https://t.me/cvedetector/695", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6531 - A vulnerability has been identified in Bootstrap t\", \n  \"Content\": \"CVE ID : CVE-2024-6531 \nPublished : July 11, 2024, 6:15 p.m. | 33\u00a0minutes ago \nDescription : A vulnerability has been identified in Bootstrap that exposes users to Cross-Site Scripting (XSS) attacks. The issue is present in the carousel component, where the data-slide and data-slide-to attributes can be exploited through the href attribute of an tag due to inadequate sanitization. This vulnerability could potentially enable attackers to execute arbitrary JavaScript within the victim's browser. \nSeverity: 6.4 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"11 Jul 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-07-11T20:50:23.000000Z"}, {"uuid": "8ee8c8f3-ff8c-4d07-9a13-0d820cba86d7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6554", "type": "seen", "source": "https://t.me/cvedetector/629", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6554 - The Branda \u2013 White Label WordPress, Custom Login P\", \n  \"Content\": \"CVE ID : CVE-2024-6554 \nPublished : July 11, 2024, 4:15 a.m. | 41\u00a0minutes ago \nDescription : The Branda \u2013 White Label WordPress, Custom Login Page Customizer plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.4.18. This is due the plugin utilizing composer without preventing direct access to the files. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website. \nSeverity: 5.3 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"11 Jul 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-07-11T07:01:38.000000Z"}, {"uuid": "1572c4fb-19db-4efe-a82c-80c4b5970cb8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6556", "type": "seen", "source": "https://t.me/cvedetector/534", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6556 - The SmartCrawl WordPress SEO checker, SEO analyzer\", \n  \"Content\": \"CVE ID : CVE-2024-6556 \nPublished : July 10, 2024, 9:15 a.m. | 24\u00a0minutes ago \nDescription : The SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.10.8. This is due the plugin utilizing mobiledetect without preventing direct access to the files. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website. \nSeverity: 5.3 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"10 Jul 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-07-10T11:45:01.000000Z"}, {"uuid": "93082582-a62a-4baf-ab1d-84951f8174aa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6501", "type": "seen", "source": "https://t.me/cvedetector/442", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6501 - A flaw was found in NetworkManager. When a system\", \n  \"Content\": \"CVE ID : CVE-2024-6501 \nPublished : July 9, 2024, 8:15 p.m. | 28\u00a0minutes ago \nDescription : A flaw was found in NetworkManager. When a system running NetworkManager with DEBUG logs enabled and an interface eth1 configured with LLDP enabled, a malicious user could inject a malformed LLDP packet. NetworkManager would crash, leading to a denial of service. \nSeverity: 3.1 | LOW \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"09 Jul 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-07-09T22:45:54.000000Z"}, {"uuid": "c165527b-1907-43cb-987c-e7c8e0f59a52", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6550", "type": "seen", "source": "https://t.me/cvedetector/504", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6550 - The Gravity Forms: Multiple Form Instances plugin\", \n  \"Content\": \"CVE ID : CVE-2024-6550 \nPublished : July 10, 2024, 4:15 a.m. | 25\u00a0minutes ago \nDescription : The Gravity Forms: Multiple Form Instances plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.1.1. This is due to the plugin leaving test files with display_errors on. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website. \nSeverity: 5.3 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"10 Jul 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-07-10T06:43:31.000000Z"}, {"uuid": "729582a0-4098-4f4a-9a08-0abfa58f3b48", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6527", "type": "seen", "source": "https://t.me/cvedetector/351", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6527 - SQL Injection vulnerability in parameter \"w\" in fi\", \n  \"Content\": \"CVE ID : CVE-2024-6527 \nPublished : July 9, 2024, 2:15 p.m. | 26\u00a0minutes ago \nDescription : SQL Injection vulnerability in parameter \"w\" in file \"druk.php\" in MegaBIP software allows unauthorized attacker to\u00a0disclose the contents of the database and obtain administrator's token to modify the content of pages.\u00a0 This issue affects MegaBIP software versions through 5.13. \nSeverity: 0.0 | NA \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"09 Jul 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-07-09T16:52:09.000000Z"}, {"uuid": "973d30b2-3ff6-40a3-8281-917b82743f39", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6598", "type": "seen", "source": "https://t.me/cvedetector/350", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6598 - A denial-of-service attack is possible through the\", \n  \"Content\": \"CVE ID : CVE-2024-6598 \nPublished : July 9, 2024, 2:15 p.m. | 26\u00a0minutes ago \nDescription : A denial-of-service attack is possible through the execution functionality of KNIME Business Hub 1.10.0 and 1.10.1. It allows an authenticated attacker with job execution privileges to execute a job that causes internal messages to pile up until there are no more resources available for processing new messages. This leads to an outage of most functionality of KNIME Business Hub. Recovery from the situation is only possible by manual administrator interaction. Please contact our support for instructions in case you have run into this situation.  \n  \n  \nUpdating to KNIME Business Hub 1.10.2 or later solves the problem. \nSeverity: 0.0 | NA \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"09 Jul 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-07-09T16:52:08.000000Z"}, {"uuid": "7c3032b2-369f-46e9-ac80-49bd437eb088", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6535", "type": "seen", "source": "https://t.me/cvedetector/1049", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6535 - Skupper Console Authentication Bypass\", \n  \"Content\": \"CVE ID : CVE-2024-6535 \nPublished : July 17, 2024, 3:15 a.m. | 17\u00a0minutes ago \nDescription : A flaw was found in Skupper. When Skupper is initialized with the console-enabled and with console-auth set to Openshift, it configures the openshift oauth-proxy with a static cookie-secret. In certain circumstances, this may allow an attacker to bypass authentication to the Skupper console via a specially-crafted cookie. \nSeverity: 5.9 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"17 Jul 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-07-17T05:40:48.000000Z"}, {"uuid": "b93aa894-d3bb-476b-8a20-a91a57d30abf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6511", "type": "seen", "source": "https://t.me/cvedetector/66", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6511 - A vulnerability classified as problematic was foun\", \n  \"Content\": \"CVE ID : CVE-2024-6511 \nPublished : July 4, 2024, 7:15 p.m. | 27\u00a0minutes ago \nDescription : A vulnerability classified as problematic was found in y_project RuoYi up to 4.7.9. Affected by this vulnerability is the function isJsonRequest of the component Content-Type Handler. The manipulation of the argument HttpHeaders.CONTENT_TYPE leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-270343. \nSeverity: 3.5 | LOW \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"04 Jul 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-07-04T21:51:56.000000Z"}, {"uuid": "00dd0b5f-0ada-40bd-83b8-88e4affccf64", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6506", "type": "seen", "source": "https://t.me/cvedetector/53", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6506 - Information exposure vulnerability in the MRW plug\", \n  \"Content\": \"CVE ID : CVE-2024-6506 \nPublished : July 4, 2024, 1:15 p.m. | 41\u00a0minutes ago \nDescription : Information exposure vulnerability in the MRW plugin, in its\u00a05.4.3 version,\u00a0affecting the \"mrw_log\" functionality. This vulnerability could allow a remote attacker to obtain other customers' order information and access sensitive information such as name and phone number. This vulnerability also allows an attacker to create or overwrite shipping labels. \nSeverity: 8.2 | HIGH \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"04 Jul 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-07-04T16:00:34.000000Z"}, {"uuid": "7a9597bd-d93f-44a8-b8a4-a5c6aa747ce4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6507", "type": "seen", "source": "https://t.me/cvedetector/51", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6507 - Command injection when ingesting a remote Kaggle d\", \n  \"Content\": \"CVE ID : CVE-2024-6507 \nPublished : July 4, 2024, 12:15 p.m. | 53\u00a0minutes ago \nDescription : Command injection when ingesting a remote Kaggle dataset due to a lack of input sanitization in the ingest_kaggle() API \nSeverity: 8.1 | HIGH \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"04 Jul 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-07-04T15:10:23.000000Z"}, {"uuid": "d7dc7787-000f-416b-a942-b29770186a14", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6560", "type": "seen", "source": "https://t.me/cvedetector/1238", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6560 - Addonify \u2013 Quick View For WooCommerce Full Path Disclosure in WordPress\", \n  \"Content\": \"CVE ID : CVE-2024-6560 \nPublished : July 20, 2024, 3:15 a.m. | 15\u00a0minutes ago \nDescription : The Addonify \u2013 Quick View For WooCommerce plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.2.16. This is due the plugin utilizing mobiledetect without preventing direct access to the files. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website. \nSeverity: 5.3 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"20 Jul 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-07-20T05:35:10.000000Z"}, {"uuid": "4139c706-93b9-407b-b494-e2f43a0a1b8b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6504", "type": "seen", "source": "https://t.me/cvedetector/1149", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6504 - Rapid7 InsightVM Console Denial of Service Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2024-6504 \nPublished : July 18, 2024, 10:15 a.m. | 44\u00a0minutes ago \nDescription : Rapid7 InsightVM Console versions below 6.6.260 suffer from a protection mechanism failure whereby an attacker with network access to the InsightVM Console can cause it to overload or crash by sending repeated invalid REST requests in a short timeframe, to the Console's port 443 causing the console to enter an exception handling logging loop, exhausting the CPU.  There is no indication that an attacker can use this method to escalate privilege, acquire unauthorized access to data, or gain control of protected resources. This issue is fixed in version 6.6.261. \nSeverity: 4.3 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"18 Jul 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-07-18T13:27:12.000000Z"}, {"uuid": "4914628a-53a9-4c13-abe5-72c4e653a888", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6599", "type": "seen", "source": "https://t.me/cvedetector/1135", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6599 - Meks Video Importer Unauthenticated API Key Modification\", \n  \"Content\": \"CVE ID : CVE-2024-6599 \nPublished : July 18, 2024, 2:15 a.m. | 43\u00a0minutes ago \nDescription : The Meks Video Importer plugin for WordPress is vulnerable to unauthorized API key modification due to a missing capability check on the ajax_save_settings function in all versions up to, and including, 1.0.11. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify the plugin's API keys \nSeverity: 4.3 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"18 Jul 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-07-18T05:05:41.000000Z"}, {"uuid": "31db1988-dad1-411a-a5bd-ab0192657f27", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6595", "type": "seen", "source": "https://t.me/cvedetector/1046", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6595 - GitLab NPM Package Data Conflicting Upload Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2024-6595 \nPublished : July 17, 2024, 2:15 a.m. | 26\u00a0minutes ago \nDescription : An issue was discovered in GitLab CE/EE affecting all versions starting from 11.8 prior to 16.11.6, starting from 17.0 prior to 17.0.4, and starting from 17.1 prior to 17.1.2 where it was possible to upload an NPM package with conflicting package data. \nSeverity: 3.0 | LOW \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"17 Jul 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-07-17T04:50:44.000000Z"}, {"uuid": "ad4cea5b-e053-4a14-b872-932a8406c102", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6540", "type": "seen", "source": "https://t.me/cvedetector/853", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6540 - Improper filtering of fields when using the export\", \n  \"Content\": \"CVE ID : CVE-2024-6540 \nPublished : July 15, 2024, 8:15 a.m. | 43\u00a0minutes ago \nDescription : Improper filtering of fields when using the export function in the ticket overview of the external interface could allow an authorized user to download a list of tickets containing information about tickets of other customers. The problem only occurs if the TicketSearchLegacyEngine has been disabled by the administrator.  \nThis issue affects OTRS: 8.0.X, 2023.X, from 2024.X through 2024.4.x \nSeverity: 5.7 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"15 Jul 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-07-15T10:59:34.000000Z"}, {"uuid": "736c6b42-170b-4220-ac85-21aa1f3c8754", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6579", "type": "seen", "source": "https://t.me/cvedetector/925", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6579 - WPBakery Builder Plugin for WordPress (Unauthorized Settings Modification)\", \n  \"Content\": \"CVE ID : CVE-2024-6579 \nPublished : July 16, 2024, 10:15 a.m. | 32\u00a0minutes ago \nDescription : The Web and WooCommerce Addons for WPBakery Builder plugin for WordPress is vulnerable to unauthorized plugin settings modification due to a missing capability check on several plugin functions in all versions up to, and including, 1.4.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change some of the plugin settings. \nSeverity: 4.3 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"16 Jul 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-07-16T12:55:39.000000Z"}, {"uuid": "5d651829-754d-4b6c-99b5-ffd0ee31cb60", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6559", "type": "seen", "source": "https://t.me/cvedetector/914", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6559 - XCloner for WordPress Full Path Disclosure\", \n  \"Content\": \"CVE ID : CVE-2024-6559 \nPublished : July 16, 2024, 7:15 a.m. | 17\u00a0minutes ago \nDescription : The Backup, Restore and Migrate WordPress Sites With the XCloner Plugin plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 4.7.3. This is due the plugin utilizing sabre without preventing direct access to the files. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website. \nSeverity: 5.3 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"16 Jul 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-07-16T09:34:48.000000Z"}, {"uuid": "ea508aca-78b9-4e72-8ac6-17888bfd2f24", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6557", "type": "seen", "source": "https://t.me/cvedetector/913", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6557 - Apache WPDeveloper Full Path Disclosure in SchedulePress\", \n  \"Content\": \"CVE ID : CVE-2024-6557 \nPublished : July 16, 2024, 5:15 a.m. | 31\u00a0minutes ago \nDescription : The SchedulePress \u2013 Auto Post & Publish, Auto Social Share, Schedule Posts with Editorial Calendar & Missed Schedule Post Publisher plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 5.1.3. This is due the plugin utilizing the wpdeveloper library and leaving the demo files in place with display_errors on. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website. \nSeverity: 5.3 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"16 Jul 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-07-16T07:54:29.000000Z"}, {"uuid": "44454cf6-2c17-4d8c-92a6-aa85e7ef9370", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6570", "type": "seen", "source": "https://t.me/cvedetector/920", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6570 - WordPress Glossary wpdesk Full Path Disclosure\", \n  \"Content\": \"CVE ID : CVE-2024-6570 \nPublished : July 16, 2024, 9:15 a.m. | 41\u00a0minutes ago \nDescription : The Glossary plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.2.26. This is due the plugin utilizing wpdesk and not preventing direct access to the test files along with display_errors being enabled. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website. \nSeverity: 5.3 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"16 Jul 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-07-16T12:05:21.000000Z"}, {"uuid": "4b607228-5a9c-4ec2-93fc-3977fdb570ca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6565", "type": "seen", "source": "https://t.me/cvedetector/918", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6565 - AForms WP Plugin Full Path Disclosure Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2024-6565 \nPublished : July 16, 2024, 9:15 a.m. | 41\u00a0minutes ago \nDescription : The AForms \u2014 Form Builder for Price Calculator & Cost Estimation plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.2.6. This is due to the plugin utilizing the aura library and allowing direct access to the phpunit test files. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website. \nSeverity: 5.3 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"16 Jul 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-07-16T12:05:19.000000Z"}, {"uuid": "394c701b-88ea-47fe-829d-d865006277d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6574", "type": "seen", "source": "https://t.me/cvedetector/800", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6574 - The Laposta plugin for WordPress is vulnerable to\", \n  \"Content\": \"CVE ID : CVE-2024-6574 \nPublished : July 13, 2024, 6:15 a.m. | 32\u00a0minutes ago \nDescription : The Laposta plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.12. This is due to the plugin not preventing direct access to several test files. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website. This plugin is no longer being maintained and has been closed for downloads. \nSeverity: 5.3 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"13 Jul 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-07-13T08:49:36.000000Z"}, {"uuid": "3917491e-7146-4a9f-a5f3-82dc9dc82f2c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6580", "type": "seen", "source": "https://t.me/cvedetector/214", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6580 - The /n software IPWorks SSH library SFTPServer com\", \n  \"Content\": \"CVE ID : CVE-2024-6580 \nPublished : July 8, 2024, 7:15 p.m. | 15\u00a0minutes ago \nDescription : The /n software IPWorks SSH library SFTPServer component can be induced to make unintended filesystem or network path requests when loading a SSH public key or certificate. To be exploitable, an application calling the SFTPServer component must grant user access without verifying the SSH public key or certificate (which would most likely be a separate vulnerability in the calling application).\u00a0IPWorks SSH versions 22.0.8945 and 24.0.8945 were released to address this condition by blocking all filesystem and network path requests for SSH public keys or certificates. \nSeverity: 0.0 | NA \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"08 Jul 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-07-08T21:36:18.000000Z"}, {"uuid": "9f80cad8-1176-4614-8e6b-a6665fe8e502", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6526", "type": "seen", "source": "https://t.me/cvedetector/101", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6526 - A vulnerability classified as problematic has been\", \n  \"Content\": \"CVE ID : CVE-2024-6526 \nPublished : July 5, 2024, 2:15 p.m. | 23\u00a0minutes ago \nDescription : A vulnerability classified as problematic has been found in CodeIgniter Ecommerce-CodeIgniter-Bootstrap up to 1998845073cf433bc6c250b0354461fbd84d0e03. This affects an unknown part. The manipulation of the argument search_title/catName/sub/name/categorie leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 1b3da45308bb6c3f55247d0e99620b600bd85277. It is recommended to apply a patch to fix this issue. The identifier VDB-270369 was assigned to this vulnerability. \nSeverity: 3.5 | LOW \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"05 Jul 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-07-05T16:40:32.000000Z"}, {"uuid": "6d3cc055-0570-45d3-97b4-73ed6fd44c6b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6564", "type": "seen", "source": "https://t.me/cvedetector/187", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6564 - Buffer overflow in \"rcar_dev_init\" due to using d\", \n  \"Content\": \"CVE ID : CVE-2024-6564 \nPublished : July 8, 2024, 4:15 p.m. | 23\u00a0minutes ago \nDescription : Buffer overflow in \"rcar_dev_init\"  due to using due to using untrusted data (rcar_image_number) as a loop counter before verifying it against RCAR_MAX_BL3X_IMAGE. This could lead to a full bypass of secure boot. \nSeverity: 6.7 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"08 Jul 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-07-08T18:40:30.000000Z"}, {"uuid": "281f1af2-6cb4-412c-bd79-e565c2cd8f1f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6563", "type": "seen", "source": "https://t.me/cvedetector/186", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6563 - Buffer Copy without Checking Size of Input ('Class\", \n  \"Content\": \"CVE ID : CVE-2024-6563 \nPublished : July 8, 2024, 4:15 p.m. | 23\u00a0minutes ago \nDescription : Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Renesas arm-trusted-firmware allows Local Execution of Code. This vulnerability is associated with program files  ...  .  \n  \n  \n  \n  \nIn line 313 \"addr_loaded_cnt\" is checked not to be \"CHECK_IMAGE_AREA_CNT\" (5) or larger, this check does not halt the function. Immediately after (line 317) there will be an overflow in the buffer and the value of \"dst\" will be written to the area immediately after the buffer, which is \"addr_loaded_cnt\". This will allow an attacker to freely control the value of \"addr_loaded_cnt\" and thus control the destination of the write immediately after (line 318). The write in line 318 will then be fully controlled by said attacker, with whichever address and whichever value (\"len\") they desire. \nSeverity: 7.5 | HIGH \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"08 Jul 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-07-08T18:40:29.000000Z"}, {"uuid": "344e37c3-76e0-40ab-b95f-b58bfea8ded2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6539", "type": "seen", "source": "https://t.me/cvedetector/166", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6539 - A vulnerability classified as problematic has been\", \n  \"Content\": \"CVE ID : CVE-2024-6539 \nPublished : July 7, 2024, 11:15 p.m. | 38\u00a0minutes ago \nDescription : A vulnerability classified as problematic has been found in heyewei SpringBootCMS up to 2024-05-28. Affected is an unknown function of the file /guestbook of the component Guestbook Handler. The manipulation of the argument Content leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-270450 is the identifier assigned to this vulnerability. \nSeverity: 3.5 | LOW \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"08 Jul 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-07-08T01:57:24.000000Z"}, {"uuid": "5e8fb80b-b991-47f1-8684-8452b2d7322c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6505", "type": "seen", "source": "https://t.me/cvedetector/98", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6505 - A flaw was found in the virtio-net device in QEMU.\", \n  \"Content\": \"CVE ID : CVE-2024-6505 \nPublished : July 5, 2024, 2:15 p.m. | 23\u00a0minutes ago \nDescription : A flaw was found in the virtio-net device in QEMU. When enabling the RSS feature on the virtio-net network card, the indirections_table data within RSS becomes controllable. Setting excessively large values may cause an index out-of-bounds issue, potentially resulting in heap overflow access. This flaw allows a privileged user in the guest to crash the QEMU process on the host. \nSeverity: 6.0 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"05 Jul 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-07-05T16:40:30.000000Z"}, {"uuid": "b5a09d89-2f4a-47ca-88ce-c2842c0c5b3c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6525", "type": "seen", "source": "https://t.me/cvedetector/97", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6525 - ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability wa\", \n  \"Content\": \"CVE ID : CVE-2024-6525 \nPublished : July 5, 2024, 1:15 p.m. | 33\u00a0minutes ago \nDescription : ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DAR-7000 up to 20230922. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /log/decodmail.php. The manipulation of the argument file leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-270368. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. \nSeverity: 2.7 | LOW \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"05 Jul 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-07-05T15:50:20.000000Z"}, {"uuid": "fb3a2f58-da71-4c24-a1b5-62db493dddc4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6523", "type": "seen", "source": "https://t.me/cvedetector/95", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6523 - A vulnerability was found in ZKTeco BioTime up to\", \n  \"Content\": \"CVE ID : CVE-2024-6523 \nPublished : July 5, 2024, 11:15 a.m. | 52\u00a0minutes ago \nDescription : A vulnerability was found in ZKTeco BioTime up to 9.5.2. It has been classified as problematic. Affected is an unknown function of the component system-group-add Handler. The manipulation of the argument user with the input  leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-270366 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. \nSeverity: 3.5 | LOW \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"05 Jul 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-07-05T14:10:01.000000Z"}, {"uuid": "e67a6cee-09f4-420b-b039-d3afc17362f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6524", "type": "seen", "source": "https://t.me/cvedetector/96", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6524 - A vulnerability was found in ShopXO up to 6.1.0. I\", \n  \"Content\": \"CVE ID : CVE-2024-6524 \nPublished : July 5, 2024, 12:15 p.m. | 44\u00a0minutes ago \nDescription : A vulnerability was found in ShopXO up to 6.1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file extend/base/Uploader.php. The manipulation of the argument source leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-270367. NOTE: The original disclosure confuses CSRF with SSRF. \nSeverity: 5.5 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"05 Jul 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-07-05T15:00:09.000000Z"}, {"uuid": "5d721e59-1fbf-47a3-b2fc-ffc407a0c949", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6593", "type": "seen", "source": "https://t.me/CyberBulletin/974", "content": "\u26a1\ufe0fCritical WatchGuard Vulnerabilities Discovered: CVE-2024-6592 and CVE-2024-6593.\n\n#CyberBulletin", "creation_timestamp": "2024-09-28T07:19:29.000000Z"}, {"uuid": "26beb0c8-7a87-4b3a-acc5-ce481c8a90d7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6592", "type": "seen", "source": "https://t.me/CyberBulletin/974", "content": "\u26a1\ufe0fCritical WatchGuard Vulnerabilities Discovered: CVE-2024-6592 and CVE-2024-6593.\n\n#CyberBulletin", "creation_timestamp": "2024-09-28T07:19:29.000000Z"}, {"uuid": "d894f7d3-e286-4ad1-a26c-0af272af7cfe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6500", "type": "seen", "source": "https://t.me/Kelvinseccommunity/754", "content": "\u203c\ufe0f CVE-2024-6500 \u203c\ufe0f\n\nThe InPost for WooCommerce plugin and InPost PL plugin for WordPress are vulnerable to unauthorized access and deletion of data due to a missing capability check on the 'parserequest' function in all versions up to, and including, 1.4.0 for InPost for WooCommerce as well as 1.4.4 for InPost PL. This makes it possible for unauthenticated attackers to read and delete arbitrary files on Windows servers. On Linux servers, only files within the WordPress install will be deleted, but all files can be read.\n\n\ud83d\udcd6 Read more.\n\n\ud83d\udd17 Via \"National Vulnerability Database\"\n\n----------\n\ud83d\udc41\ufe0f Seen on @cibsecurity_CVEs", "creation_timestamp": "2024-08-18T09:57:24.000000Z"}, {"uuid": "9ac51639-b4ad-421e-a90f-2080cc1a127f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6567", "type": "seen", "source": "Telegram/8UfesJEMHKOk7yQ3ipwnMF4EZrU5JuDj3nncgp1pjC6IieTe", "content": "", "creation_timestamp": "2025-03-02T11:46:30.000000Z"}, {"uuid": "2703ccc5-6e06-4f0c-9f55-502eef6bdbbb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6567", "type": "published-proof-of-concept", "source": "https://t.me/codeb0ss/1535", "content": "New Wordpress VulExp , Enjoy;", "creation_timestamp": "2024-09-07T05:42:04.000000Z"}, {"uuid": "e5f52bde-afb8-4dd4-8ede-3f89b050b74c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6521", "type": "published-proof-of-concept", "source": "https://t.me/codeb0ss/1524", "content": "", "creation_timestamp": "2024-09-07T05:42:04.000000Z"}, {"uuid": "4e49d1d3-541b-46d5-ab22-71c5c6a199a3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6587", "type": "exploited", "source": "https://t.me/true_secator/6843", "content": "\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 GreyNoise \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0430\u044e\u0442 \u043e\u0431 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0438 \u0441\u043a\u043e\u043e\u0440\u0434\u0438\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u043c\u0430\u0441\u0441\u043e\u0432\u043e\u0439 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0438 \u043f\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 SSRF, \u043e\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u044e\u0449\u0438\u0445 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c.\n\n\u0410\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u0441\u0442\u0430\u0440\u0442\u043e\u0432\u0430\u043b\u0430 9 \u043c\u0430\u0440\u0442\u0430, \u0437\u0430\u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u043b\u0430\u0441\u044c \u0433\u0440\u0443\u043f\u043f\u0430 \u0438\u0437 400 IP-\u0430\u0434\u0440\u0435\u0441\u043e\u0432.\n\n\u0410\u0442\u0430\u043a\u0438 \u0431\u044b\u043b\u0438 \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u044b \u043e\u0434\u043d\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u043d\u0430 \u043e\u0448\u0438\u0431\u043a\u0438 SSRF \u0432 Zimbra, GitLab, DotNetNuke, VMware, ColumbiaSoft, Ivanti, BerriAI \u0438 OpenBMCS \u0438 \u043c\u043d\u043e\u0433\u0438\u0445 \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430\u0445.\n\n\u0411\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u0430\u0442\u0430\u043a \u0431\u044b\u043b\u0438 \u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u044b \u043d\u0430 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432 \u0421\u0428\u0410, \u0413\u0435\u0440\u043c\u0430\u043d\u0438\u0438, \u0418\u043d\u0434\u0438\u0438, \u042f\u043f\u043e\u043d\u0438\u0438 \u0438 \u0421\u0438\u043d\u0433\u0430\u043f\u0443\u0440\u0435, \u043d\u043e \u043d\u0430 \u043f\u0440\u043e\u0448\u043b\u043e\u0439 \u043d\u0435\u0434\u0435\u043b\u0435 \u043e\u0441\u043e\u0431\u043e\u0435 \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u043c\u0438 \u0431\u044b\u043b\u043e \u0443\u0434\u0435\u043b\u0435\u043d\u043e \u0418\u0437\u0440\u0430\u0438\u043b\u044e \u0438 \u041d\u0438\u0434\u0435\u0440\u043b\u0430\u043d\u0434\u0430\u043c.\n\n\u0412 \u0447\u0438\u0441\u043b\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 SSRF: \n- CVE-2017-0929\u00a0(CVSS: 7,5, DotNetNuke), \n- CVE-2020-7796\u00a0(CVSS: 9,8, Zimbra Collaboration Suite, \n- CVE-2021-21973\u00a0(CVSS: 5,3, VMware vCenter, \n- CVE-2021-22054\u00a0(CVSS: 7,5, VMware Workspace ONE UEM), \n- CVE-2021-22175\u00a0(CVSS: 9,8, GitLab CE/EE, \n- CVE-2021-22214\u00a0(CVSS: 8,6) \u0438 CVE-2021-39935\u00a0(CVSS: 7,5, GitLab CE/EE), \n- CVE-2023-5830\u00a0(CVSS: 9,8, ColumbiaSoft DocumentLocator), \n- CVE-2024-6587\u00a0(CVSS: 7,5, BerriAI LiteLLM), \n- CVE-2024-21893\u00a0(CVSS: 8,2, Ivanti Connect Secure),\n- OpenBMCS 2.4\u00a0\u0438 Zimbra Collaboration Suite\u00a0(\u0431\u0435\u0437 CVE).\n\n\u041a\u0430\u043a \u0443\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u0435\u0442 GreyNoise, \u043c\u043d\u043e\u0433\u0438\u0435 \u0438\u0437 IP-\u0430\u0434\u0440\u0435\u0441\u043e\u0432 \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u044b \u043e\u0434\u043d\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u043d\u0430 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 SSRF, \u043e\u0442\u043c\u0435\u0447\u0430\u044f, \u0447\u0442\u043e \u0448\u0430\u0431\u043b\u043e\u043d \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u0435\u043c\u043e\u0439  \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u0430\u0433\u0430\u0435\u0442 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0443\u044e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044e, \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0430\u0446\u0438\u044e \u0438\u043b\u0438 \u0441\u0431\u043e\u0440 \u0440\u0430\u0437\u0432\u0435\u0434\u044b\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043f\u0435\u0440\u0435\u0434 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0435\u0439.\n\n\u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 SSRF \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0442\u044c \u043a\u0430\u0440\u0442\u044b \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0445 \u0441\u0435\u0442\u0435\u0439, \u0432\u044b\u044f\u0432\u043b\u044f\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u0441\u0435\u0440\u0432\u0438\u0441\u044b \u0438 \u043a\u0440\u0430\u0441\u0442\u044c \u0443\u0447\u0435\u0442\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u0434\u043b\u044f \u043e\u0431\u043b\u0430\u0447\u043d\u044b\u0445 \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432.\n\nGreyNoise \u043e\u0442\u043c\u0435\u0442\u0438\u043b\u0430, \u0447\u0442\u043e \u0442\u0430\u043a\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0441\u044b\u0433\u0440\u0430\u043b\u0438 \u0432\u0430\u0436\u043d\u0443\u044e \u0440\u043e\u043b\u044c \u0432\u00a0\u0443\u0442\u0435\u0447\u043a\u0435 Capital One\u00a0\u0432 2019 \u0433\u043e\u0434\u0443, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u043b\u0430 \u0431\u043e\u043b\u0435\u0435 100 \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u043e\u0432 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439.\n\n\u0412 \u0441\u0432\u044f\u0437\u0438 \u0441 \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u043c\u0438 \u043f\u043e\u043f\u044b\u0442\u043a\u0430\u043c\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043a\u0440\u0430\u0439\u043d\u0435 \u0432\u0430\u0436\u043d\u043e \u043f\u0440\u0438\u043c\u0435\u043d\u0438\u0442\u044c \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f, \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0442\u044c \u0438\u0441\u0445\u043e\u0434\u044f\u0449\u0438\u0435 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u044b\u043c\u0438 \u043a\u043e\u043d\u0435\u0447\u043d\u044b\u043c\u0438 \u0442\u043e\u0447\u043a\u0430\u043c\u0438 \u0438 \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0442\u044c \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0438\u0441\u0445\u043e\u0434\u044f\u0449\u0438\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u044b.", "creation_timestamp": "2025-03-14T15:30:06.000000Z"}, {"uuid": "fb19029a-6aa2-4b09-a530-a35ff7ff16b0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6576", "type": "exploited", "source": "https://t.me/true_secator/6041", "content": "\u0412\u043a\u0440\u0430\u0442\u0446\u0435 \u043f\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c \u0438 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f\u043c, \u043a\u043e\u0438\u0445 \u043e\u043a\u0430\u0437\u0430\u043b\u043e\u0441\u044c \u043d\u0435 \u043c\u0430\u043b\u043e \u043d\u0430 \u043d\u0435\u0434\u0435\u043b\u0435.\n\nZoho \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u0434\u0432\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438\u00a0\u0434\u043b\u044f \u0441\u0432\u043e\u0435\u0433\u043e \u041f\u041e ManageEngine \u0441 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u0434\u0432\u0443\u0445 SQL-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043f\u043e\u0441\u043b\u0435 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 Exchange Reporter Plus.\n\n\u041e\u0448\u0438\u0431\u043a\u0438 \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u044e\u0442\u0441\u044f \u043a\u0430\u043a CVE-2024-38871 \u0438 CVE-2024-38872 (\u043e\u0431\u0435 \u0441 CVSS 8,3), \u0432 \u0434\u0438\u043a\u043e\u0439 \u043f\u0440\u0438\u0440\u043e\u0434\u0435 \u0435\u0449\u0435 \u043d\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0438\u0441\u044c, \u0432\u043e \u0432\u0441\u044f\u043a\u043e\u043c \u0441\u043b\u0443\u0447\u0430\u0435 \u043f\u043e\u043a\u0430.\n\n\u041c\u043d\u043e\u0433\u043e\u0441\u0442\u0440\u0430\u0434\u0430\u043b\u044c\u043d\u0430\u044f Progress \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0434\u043b\u044f \u043d\u0435 \u043c\u0435\u043d\u0435\u0435 \u043c\u043d\u043e\u0433\u043e\u0441\u0442\u0440\u0430\u0434\u0430\u043b\u044c\u043d\u043e\u0433\u043e MOVEit Transfer.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043d\u0435\u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 CVE-2024-6576 \u0432 \u043c\u043e\u0434\u0443\u043b\u044c SFTP \u0438\u043c\u0435\u0435\u0442 CVSS 7.3 \u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044e \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439. \u0423\u043f\u043e\u043c\u0438\u043d\u0430\u043d\u0438\u0439 \u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043d\u0435\u0442, \u043d\u043e \u0437\u043d\u0430\u044f MOVEit - \u043e\u0436\u0438\u0434\u0430\u0442\u044c \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u043e \u0441\u0442\u043e\u0438\u0442.\n\nSalt Security \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u043e XSS-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0441\u0435\u0440\u0432\u0438\u0441\u0435 Hotjar, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0433\u043b\u0430 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u043c \u0434\u0430\u043d\u043d\u044b\u043c \u043d\u0430 \u043a\u0440\u0443\u043f\u043d\u044b\u0445 \u043e\u043d\u043b\u0430\u0439\u043d-\u0441\u0435\u0440\u0432\u0438\u0441\u0430\u0445, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u0441\u0430\u0439\u0442\u044b \u043c\u0438\u0440\u043e\u0432\u044b\u0445 \u0431\u0440\u0435\u043d\u0434\u043e\u0432, \u0442\u0430\u043a\u0438\u0445 \u043a\u0430\u043a Adobe, Microsoft, Panasonic, Columbia, RyanAir, Decathlon, T-Mobile, Nintendo \u0438 \u0434\u0440.\n\n\u0422\u0435\u043f\u0435\u0440\u044c \u0434\u043b\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CosmicSting Magento \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u0430 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e PoC-\u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432. \n\n\u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0441\u0442\u0430\u043b\u0430 \u0430\u043a\u0442\u0438\u0432\u043d\u043e  \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0435\u0449\u0435 \u0432 \u043d\u0430\u0447\u0430\u043b\u0435 \u044d\u0442\u043e\u0433\u043e \u043c\u0435\u0441\u044f\u0446\u0430.\n\nCloudSEK \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0430, \u0447\u0442\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c LFI \u0432 Jenkins, \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0443\u044e \u043a\u0430\u043a CVE-2024-23897, \u0434\u043b\u044f \u0432\u0437\u043b\u043e\u043c\u0430 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0435\u0432 Github.\n\nMicrosoft\u00a0\u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0430\u00a0\u043e \u0437\u0430\u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u0438\u0438 0-day VMware ESXi (CVE-2024-37085) \u0432 \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0445 \u0430\u0442\u0430\u043a\u0430\u0445 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u043c\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438 \u0434\u043b\u044f \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0435\u0439, \u0442\u0430\u043a\u0438\u0445 \u043a\u0430\u043a Akira \u0438 Black Basta.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0434\u043d\u044f (CVE-2024-37085) \u043d\u0430\u0445\u043e\u0434\u0438\u043b\u0430\u0441\u044c \u0432 \u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u0438 ESXi Active Directory. \n\n\u041e\u043d\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u043b\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043e\u0431\u0445\u043e\u0434\u0438\u0442\u044c \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u0438 \u0441\u043e\u0437\u0434\u0430\u0432\u0430\u0442\u044c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439-\u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u043e\u0432 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 ESXi, \u043f\u0440\u0438\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u043d\u044b\u0445 \u043a \u0434\u043e\u043c\u0435\u043d\u0443.", "creation_timestamp": "2024-07-31T15:33:16.000000Z"}, {"uuid": "7d11239c-1b38-41ac-bce8-b422a4dd30f1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6530", "type": "seen", "source": "https://t.me/true_secator/6305", "content": "\u041f\u043e\u0434\u043a\u0430\u0442\u0438\u043b \u0432\u044b\u043f\u0443\u0441\u043a \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0439 GitLab: 17.4.2, 17.3.5, 17.2.9 \u0434\u043b\u044f GitLab Community Edition (CE) \u0438 Enterprise Edition (EE).\n\n\u0412 \u043e\u0431\u0449\u0435\u043c \u0441\u043e\u043e\u0431\u0449\u0430\u0435\u0442\u0441\u044f \u043e \u0432\u043e\u0441\u044c\u043c\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445, \u043e\u0434\u043d\u0430 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043e\u0446\u0435\u043d\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043a\u0430\u043a \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f, \u0447\u0435\u0442\u044b\u0440\u0435 - \u0432\u044b\u0441\u043e\u043a\u043e\u0441\u0435\u0440\u044c\u0435\u0437\u043d\u044b\u0435, \u0434\u0432\u0435 - \u0441\u0440\u0435\u0434\u043d\u0435\u0439 \u0438 \u043e\u0434\u043d\u0430 - \u043d\u0438\u0437\u043a\u043e\u0439 \u0441\u0442\u0435\u043f\u0435\u043d\u0438 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0441\u0442\u0438.\n\nCVSS 9.6 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d\u0430 CVE-2024-9164 \u0432 GitLab EE, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0435\u0439 \u0432\u0441\u0435 \u0432\u0435\u0440\u0441\u0438\u0438, \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 12.5 \u0434\u043e 17.2.9, \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 17.3, \u0434\u043e 17.3.5 \u0438 \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 17.4 \u0434\u043e 17.4.2, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u043a\u043e\u043d\u0432\u0435\u0439\u0435\u0440\u044b \u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0445 \u0432\u0435\u0442\u0432\u044f\u0445.\n\n\u0421\u0440\u0435\u0434\u0438 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u044b\u0445 - CVE-2024-8970 (CVSS 8.2), CVE-2024-8977 (CVSS 8.2) \u0438 CVE-2024-9631 (CVSS 7.5), CVE-2024-6530 (CVSS 7.3), \u0441\u0440\u0435\u0434\u043d\u0435\u0439 \u0441\u0442\u0435\u043f\u0435\u043d\u0438 - CVE-2024-9623 (CVSS 4.9) \u0438 CVE-2024-9623 (CVSS 4.3), \u0430 \u0442\u0430\u043a\u0436\u0435 \u043d\u0438\u0437\u043a\u043e\u0439 - CVE-2024-9596 (CVSS 3.7).\n\n\u0421\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0439 \u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043a\u0430\u043a\u043e\u0439-\u043b\u0438\u0431\u043e \u0438\u0437 \u043e\u0448\u0438\u0431\u043e\u043a \u0434\u043e \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0435\u0433\u043e \u0432\u0440\u0435\u043c\u0435\u043d\u0438 \u043d\u0435 \u043f\u043e\u0441\u0442\u0443\u043f\u0430\u043b\u043e.\n\n\u0427\u0435\u0433\u043e \u043d\u0435 \u0441\u043a\u0430\u0436\u0435\u0448\u044c \u043f\u0440\u043e 0-day \u0432 Mozilla Firefox, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u0443\u044e \u0432 \u0430\u0442\u0430\u043a\u0430\u0445.\n\n\u0412 \u0441\u0432\u044f\u0437\u0438 \u0441 \u0447\u0435\u043c, Mozilla \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u044d\u043a\u0441\u0442\u0440\u0435\u043d\u043d\u043e\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0434\u043b\u044f \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430. CVE-2024-9680 \u0431\u044b\u043b\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438 ESET \u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u043e\u0441\u043b\u0435 \u043e\u0441\u0432\u043e\u0431\u043e\u0436\u0434\u0435\u043d\u0438\u044f \u043f\u0430\u043c\u044f\u0442\u0438.\n\n\u041e\u0448\u0438\u0431\u043a\u0430 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u0443\u044e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u0430\u043c\u044f\u0442\u0438 \u043f\u043e\u0441\u043b\u0435 \u043e\u0441\u0432\u043e\u0431\u043e\u0436\u0434\u0435\u043d\u0438\u044f \u0432\u043e \u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u0439 \u0448\u043a\u0430\u043b\u0435 \u0430\u043d\u0438\u043c\u0430\u0446\u0438\u0438 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043e\u0442\u043e\u0431\u0440\u0430\u0436\u0430\u0435\u0442 \u0441\u0438\u043d\u0445\u0440\u043e\u043d\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0435 \u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u043e\u0435 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0432\u0441\u0435\u0445 \u0430\u043d\u0438\u043c\u0430\u0446\u0438\u0439, \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u043d\u044b\u0445 \u043a \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u043c\u0443 \u044d\u043b\u0435\u043c\u0435\u043d\u0442\u0443 \u0438\u043b\u0438 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u044b\u043c \u044d\u043b\u0435\u043c\u0435\u043d\u0442\u0430\u043c.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u044e\u044e \u0432\u0435\u0440\u0441\u0438\u044e Firefox (\u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0439 \u0432\u044b\u043f\u0443\u0441\u043a) \u0438 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u0441 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u043d\u043e\u0439 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u043e\u0439 (ESR).\n\n\u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0431\u044b\u043b\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u0432 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0445 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 Firefox 131.0.2, Firefox ESR 115.16.1 \u0438 Firefox ESR 128.3.1.\n\n\u0423\u0447\u0438\u0442\u044b\u0432\u0430\u044f \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u0439 \u0441\u0442\u0430\u0442\u0443\u0441 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 CVE-2024-9680 \u0438 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435 \u043a\u0430\u043a\u043e\u0439-\u043b\u0438\u0431\u043e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043e \u0442\u043e\u043c, \u043d\u0430 \u043a\u043e\u0433\u043e \u043e\u043d\u0430 \u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430, \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u0432 \u043f\u0440\u0438\u043e\u0440\u0438\u0442\u0435\u0442\u043d\u043e\u043c \u043f\u043e\u0440\u044f\u0434\u043a\u0435 \u043e\u0437\u0430\u0431\u043e\u0442\u0438\u0442\u044c\u0441\u044f \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435\u043c.", "creation_timestamp": "2024-10-10T15:20:05.000000Z"}, {"uuid": "b98784e7-55bc-4384-942b-b5b547cf3e7f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6593", "type": "seen", "source": "https://t.me/CyberBulletin/25857", "content": "\u26a1\ufe0fCritical WatchGuard Vulnerabilities Discovered: CVE-2024-6592 and CVE-2024-6593.\n\n#CyberBulletin", "creation_timestamp": "2024-09-28T09:34:34.000000Z"}, {"uuid": "d5403e04-afca-4c40-8601-17cef78b2ac9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6592", "type": "seen", "source": "https://t.me/CyberBulletin/25857", "content": "\u26a1\ufe0fCritical WatchGuard Vulnerabilities Discovered: CVE-2024-6592 and CVE-2024-6593.\n\n#CyberBulletin", "creation_timestamp": "2024-09-28T09:34:34.000000Z"}, {"uuid": "f417fe48-1cf7-45f6-86c6-23820f79e265", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6521", "type": "published-proof-of-concept", "source": "https://t.me/lubuklinggaucyber1/204", "content": "", "creation_timestamp": "2025-01-10T16:43:37.000000Z"}, {"uuid": "ff48f6cc-8c22-4211-9b53-97b4b928768a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6509", "type": "seen", "source": "https://t.me/CyberSachok/1873", "content": "\u041d\u0435 \u043f\u0440\u043e\u0448\u043b\u043e \u0438 \u043c\u0435\u0441\u044f\u0446\u0430\n\n\u0412 \u043d\u0430\u0447\u0430\u043b\u0435 \u043c\u0435\u0441\u044f\u0446\u0430 \u0441\u0442\u0430\u043b\u043e \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 RegreSSHion \u0432 \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u043e\u043c \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0435 OpenSSH. \u041f\u043e\u0441\u043b\u0435 \u0435\u0435 \u0430\u043d\u0430\u043b\u0438\u0437\u0430, \u043d\u0430 \u043d\u043e\u0432\u0443\u044e \u0431\u0440\u0435\u0448\u044c \u0432\u044b\u0448\u0435\u043b \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442 \u0410\u043b\u0435\u043a\u0441\u0430\u043d\u0434\u0440 \u041f\u0435\u0441\u043b\u044f\u043a(Solar designer). \n\n\u041d\u043e\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c(CVE-2024-6509) \u0432 \u043d\u0430\u0431\u043e\u0440\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u0434\u043b\u044f \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0441\u0432\u044f\u0437\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u0432 \u0441\u043b\u0443\u0447\u0430\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438. \n\nCVE-2024-6409 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435\u043c \u043a\u043e\u0434\u0430 \u0432 \u0434\u043e\u0447\u0435\u0440\u043d\u0435\u043c \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 privsep.\n\n\u00ab\u041e\u0441\u043d\u043e\u0432\u043d\u043e\u0435 \u043e\u0442\u043b\u0438\u0447\u0438\u0435 \u043d\u043e\u0432\u043e\u0439 \u0431\u0440\u0435\u0448\u0438 \u043e\u0442 CVE-2024-6387 \u2014 \u043d\u0430\u043b\u0438\u0447\u0438\u0435 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u044f \u0433\u043e\u043d\u043a\u0438 \u0438 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0432 \u0434\u043e\u0447\u0435\u0440\u043d\u0435\u043c \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 privsep, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0441 \u043f\u043e\u043d\u0438\u0436\u0435\u043d\u043d\u044b\u043c\u0438 \u043f\u0440\u0430\u0432\u0430\u043c\u0438\u00bb, \u2014 \u0433\u043e\u0432\u043e\u0440\u0438\u0442 \u041f\u0435\u0441\u043b\u044f\u043a.\n\n\u00ab\u0422\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c, \u043c\u043e\u0436\u043d\u043e \u0441\u0434\u0435\u043b\u0430\u0442\u044c \u0432\u044b\u0432\u043e\u0434, \u0447\u0442\u043e \u0440\u0438\u0441\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u0441\u043d\u0438\u0436\u0430\u044e\u0442\u0441\u044f. \u041e\u0434\u043d\u0430\u043a\u043e \u043a\u0438\u0431\u0435\u0440\u043f\u0440\u0435\u0441\u0442\u0443\u043f\u043d\u0438\u043a\u0438 \u0432\u0441\u0451 \u0440\u0430\u0432\u043d\u043e \u043c\u043e\u0433\u0443\u0442 \u043f\u0440\u0435\u0434\u043f\u043e\u0447\u0435\u0441\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044e CVE-2024-6387 \u0432 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445\u00bb.\n\n@cybersachok", "creation_timestamp": "2024-07-12T12:39:50.000000Z"}, {"uuid": "091db978-ff14-4d0e-a584-96d734e90b34", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2024-6533", "type": "published-proof-of-concept", "source": "https://github.com/directus/directus/security/advisories/GHSA-9qrm-48qf-r2rw", "content": "", "creation_timestamp": "2025-01-23T16:08:13.000000Z"}, {"uuid": "5c15772d-0b92-4140-bd56-d3785460d7cb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6531", "type": "published-proof-of-concept", "source": "Telegram/INbFbOAv1LhDwym0zMRLuEQymL8K9Atp4wW_21Q7XW8y0_4", "content": "", "creation_timestamp": "2026-08-16T19:00:03.934516Z"}, {"uuid": "6b4c3ff2-e790-49d5-b183-226aff059be1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6531", "type": "published-proof-of-concept", "source": "Telegram/INbFbOAv1LhDwym0zMRLuEQymL8K9Atp4wW_21Q7XW8y0_4", "content": "", "creation_timestamp": "2026-08-17T00:00:12.156121Z"}, {"uuid": "3c7f1684-ce3a-42b9-afde-38d4038bc1c0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2024-6533", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-9qrm-48qf-r2rw", "content": "", "creation_timestamp": "2026-08-14T20:35:08.409040Z"}, {"uuid": "28399e91-5f98-4293-8bc5-9669b98c4720", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6569", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2024/CVE-2024-6569.yaml", "content": "", "creation_timestamp": "2026-06-15T07:22:30.000000Z"}, {"uuid": "bd2fed8c-21d4-496d-9850-a50261efefac", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6587", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/58fd9c3c-4ecb-462d-a946-7f6a7de446e9", "content": "", "creation_timestamp": "2026-06-23T14:06:09.475151Z"}, {"uuid": "3367208a-ae69-45b9-ab04-537b5056075c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6587", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-06-26)", "content": "", "creation_timestamp": "2026-06-27T10:15:11.122634Z"}, {"uuid": "032f7d6b-7712-4d95-886c-9ba758aa53e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6581", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mpifautrzi2x", "content": "\ud83d\udccc CVE-2024-6581 - A vulnerability in the discussion image upload function of the Lollms application, version v9.9, allows for the uploading of SVG files. Due to incompl... https://www.cyberhub.blog/cves/CVE-2024-6581", "creation_timestamp": "2026-06-30T06:37:06.661921Z"}, {"uuid": "84609411-50ff-440c-9062-effcc97465bf", "vulnerability_lookup_origin": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2024-6587", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/ce3bfd59-5fcb-4339-a375-dc93f3ba1223", "content": "", "creation_timestamp": "2026-06-30T09:23:12.008852Z"}]}