{"vulnerability": "CVE-2024-3969", "sightings": [{"uuid": "09380487-5b9d-4178-9846-2308190d7e12", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-39694", "type": "seen", "source": "https://t.me/cvedetector/2148", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-39694 - Duende IdentityServer OpenID Connect/OAuth 2.x Phishing Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2024-39694 \nPublished : July 31, 2024, 4:15 p.m. | 42\u00a0minutes ago \nDescription : Duende IdentityServer is an OpenID Connect and OAuth 2.x framework for ASP.NET Core. It is possible for an attacker to craft malicious Urls that certain functions in IdentityServer will incorrectly treat as local and trusted. If such a Url is returned as a redirect, some browsers will follow it to a third-party, untrusted site. Note: by itself, this vulnerability does **not** allow an attacker to obtain user credentials, authorization codes, access tokens, refresh tokens, or identity tokens. An attacker could however exploit this vulnerability as part of a phishing attack designed to steal user credentials. This vulnerability is fixed in 7.0.6, 6.3.10, 6.2.5, 6.1.8, and 6.0.5. Duende.IdentityServer 5.1 and earlier and all versions of IdentityServer4 are no longer supported and will not be receiving updates. If upgrading is not possible, use `IUrlHelper.IsLocalUrl` from ASP.NET Core to validate return Urls in user interface code in the IdentityServer host. \nSeverity: 4.7 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"31 Jul 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-07-31T19:20:43.000000Z"}, {"uuid": "6a8d04be-96b9-4fa3-a447-b4e220127258", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-39695", "type": "seen", "source": "https://github.blog/security/vulnerability-research/bugs-that-survive-the-heat-of-continuous-fuzzing/", "content": "", "creation_timestamp": "2025-12-29T21:01:14.000000Z"}, {"uuid": "4f5d0671-7da7-4cd3-98a1-83cfbf31f3ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-39697", "type": "seen", "source": "https://t.me/cvedetector/370", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-39697 - phonenumber is a library for parsing, formatting a\", \n  \"Content\": \"CVE ID : CVE-2024-39697 \nPublished : July 9, 2024, 3:15 p.m. | 16\u00a0minutes ago \nDescription : phonenumber is a library for parsing, formatting and validating international phone numbers. Since 0.3.4, the phonenumber parsing code may panic due to a panic-guarded out-of-bounds access on the phonenumber string. In a typical deployment of rust-phonenumber, this may get triggered by feeding a maliciously crafted phonenumber, e.g. over the network, specifically strings of the form `+dwPAA;phone-context=AA`, where the \"number\" part potentially parses as a number larger than 2^56. This vulnerability is fixed in 0.3.6. \nSeverity: 8.6 | HIGH \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"09 Jul 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-07-09T17:42:43.000000Z"}, {"uuid": "abbb24d8-168d-45f7-9a00-3087c2ffc77f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-39693", "type": "seen", "source": "https://t.me/cvedetector/585", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-39693 - Next.js is a React framework. A Denial of Service\", \n  \"Content\": \"CVE ID : CVE-2024-39693 \nPublished : July 10, 2024, 8:15 p.m. | 17\u00a0minutes ago \nDescription : Next.js is a React framework. A Denial of Service (DoS) condition was identified in Next.js. Exploitation of the bug can trigger a crash, affecting the availability of the server. his vulnerability was resolved in Next.js 13.5 and later. \nSeverity: 7.5 | HIGH \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"10 Jul 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-07-10T22:39:27.000000Z"}, {"uuid": "869718d7-cf89-4334-a076-80e673a961dc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-39691", "type": "seen", "source": "https://t.me/cvedetector/128", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-39691 - matrix-appservice-irc is a Node.js IRC bridge for\", \n  \"Content\": \"CVE ID : CVE-2024-39691 \nPublished : July 5, 2024, 7:15 p.m. | 46\u00a0minutes ago \nDescription : matrix-appservice-irc is a Node.js IRC bridge for the Matrix messaging protocol. The fix for GHSA-wm4w-7h2q-3pf7 / CVE-2024-32000 included in matrix-appservice-irc 2.0.0 relied on the Matrix homeserver-provided timestamp to determine whether a user has access to the event they're replying to when determining whether or not to include a truncated version of the original event in the IRC message. Since this value is controlled by external entities, a malicious Matrix homeserver joined to a room in which a matrix-appservice-irc bridge instance (before version 2.0.1) is present can fabricate the timestamp with the intent of tricking the bridge into leaking room messages the homeserver should not have access to. matrix-appservice-irc 2.0.1 drops the reliance on `origin_server_ts` when determining whether or not an event should be visible to a user, instead tracking the event timestamps internally. As a workaround, it's possible to limit the amount of information leaked by setting a reply template that doesn't contain the original message. \nSeverity: 4.3 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"05 Jul 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-07-05T22:06:55.000000Z"}, {"uuid": "6bf0f9c8-b266-4658-9a95-e5b96833fa0a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-39696", "type": "seen", "source": "https://t.me/cvedetector/129", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-39696 - Evmos is a decentralized Ethereum Virtual Machine\", \n  \"Content\": \"CVE ID : CVE-2024-39696 \nPublished : July 5, 2024, 7:15 p.m. | 46\u00a0minutes ago \nDescription : Evmos is a decentralized Ethereum Virtual Machine chain on the Cosmos Network. Prior to version 19.0.0, a user can create a vesting account with a 3rd party account (EOA or contract) as funder. Then, this user can create an authorization for the contract.CallerAddress, this is the authorization checked in the code. But the funds are taken from the funder address provided in the message. Consequently, the user can fund a vesting account with a 3rd party account without its permission. The funder address can be any address, so this vulnerability can be used to drain all the accounts in the chain. The issue has been patched in version 19.0.0. \nSeverity: 8.8 | HIGH \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"05 Jul 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-07-05T22:06:56.000000Z"}, {"uuid": "7ce594d7-b8ef-4699-a5b7-ef98b74904fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-39699", "type": "seen", "source": "https://t.me/cvedetector/190", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-39699 - Directus is a real-time API and App dashboard for\", \n  \"Content\": \"CVE ID : CVE-2024-39699 \nPublished : July 8, 2024, 4:15 p.m. | 23\u00a0minutes ago \nDescription : Directus is a real-time API and App dashboard for managing SQL database content. There was already a reported SSRF vulnerability via file import. It was fixed by resolving all DNS names and checking if the requested IP is an internal IP address. However it is possible to bypass this security measure and execute a SSRF using redirects. Directus allows redirects when importing file from the URL and does not check the result URL. Thus, it is possible to execute a request to an internal IP, for example to 127.0.0.1. However, it is blind SSRF, because Directus also uses response interception technique to get the information about the connect from the socket directly and it does not show a response if the IP address is internal. This vulnerability is fixed in 10.9.3. \nSeverity: 5.0 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"08 Jul 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-07-08T18:40:33.000000Z"}, {"uuid": "f835d1c4-f6a0-4e77-b452-f69d47d94b49", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-39695", "type": "seen", "source": "https://t.me/cvedetector/189", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-39695 - Exiv2 is a command-line utility and C++ library fo\", \n  \"Content\": \"CVE ID : CVE-2024-39695 \nPublished : July 8, 2024, 4:15 p.m. | 23\u00a0minutes ago \nDescription : Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An out-of-bounds read was found in Exiv2 version v0.28.2. The vulnerability is in the parser for the ASF video format, which was a new feature in v0.28.0. The out-of-bounds read is triggered when Exiv2 is used to read the metadata of a crafted video file. The bug is fixed in version v0.28.3. \nSeverity: 5.3 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"08 Jul 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-07-08T18:40:32.000000Z"}, {"uuid": "70710b10-3ba5-46f7-a018-a4522481d84b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-39696", "type": "seen", "source": "https://t.me/HackingInsights/5521", "content": "\u200aCVE-2024-39696: Critical Vulnerability Exposed Evmos Network to Potential Total Loss of Funds\n\nhttps://securityonline.info/cve-2024-39696-critical-vulnerability-exposed-evmos-network-to-potential-total-loss-of-funds/", "creation_timestamp": "2024-07-10T10:17:47.000000Z"}]}