Platform

Featured Integrations

Reduce risk and mitigate cyber attacks, no matter your IT & security stack, maturity journey, or industry

See our Threat Intelligence Solutions in Action

Outcomes

Industries

Threat Intelligence solves pervasive challenges

Reduce operational risk through timely, precise, and actionable intelligence.

See Recorded Future’s Intelligence in Action

Products

Services

Research

Experience our platform live every week. Minimize risks with timely, actionable threat intelligence that helps you stay ahead of threats.

Join our Weekly Platform Preview

Resource Center

Additional Resources

Additional Topics

Resources

Why Recorded Future

About Us

Partner With Us

Join Us

Company

brand-logo-long-black.svg

Rectangular Logo - Digital (RGB).svg

Home

Blog

Careers

Contact Us

CVE-2024-10928 is a newly disclosed vulnerability affecting MonoCMS up to version 20240528. This issue lies in the Posts Page component's opensaved.php file, where the filtcategory/filtstatus argument is manipulable. This manipulation results in a cross-site scripting (XSS) vulnerability, allowing remote attackers to inject malicious code into users' browsers. The vendor has been contacted regarding this disclosure but has not responded, leaving users at risk until a patch is released.

CVE-2024-10928

CVE-2024-10927 is a newly disclosed vulnerability affecting MonoCMS up to version 20240528. This issue, located in the Account Information Page's /monofiles/account.php file, is classified as problematic. The vulnerability stems from a flaw in an unknown function, where manipulation of the userid argument results in cross-site scripting (XSS). Attacks can be executed remotely, increasing the risk for exploitation. Unfortunately, the exploit has been made public, leaving affected systems potentially vulnerable until a patch is released. Despite early disclosure to the vendor, they have yet to respond or provide a fix.

CVE-2024-10927

CVE-2024-51736 is a vulnerability affecting the Symphony process module in the Symphony PHP framework. On Windows systems, this issue arises when the `cmd.exe` executable is present in the current working directory and is inadvertently invoked by the `Process` class during command argument preparation. This vulnerability can potentially result in hijacking. Users are recommended to upgrade to release versions 5.4.46, 6.4.14, or 7.1.7 to mitigate this risk. Unfortunately, there are currently no known workarounds for this vulnerability.

CVE-2024-51736

CVE-2024-50345 is a vulnerability affecting the symfony/http-foundation module in the Symfony PHP framework. The `Request` class within this module fails to parse URIs with special characters in the same way as browsers, enabling an attacker to manipulate validators that rely on it. The consequence is unintended redirection to different domains. To mitigate this issue, users are advised to upgrade to versions 5.4.46, 6.4.14, and 7.1.7. Unfortunately, there are no known workarounds for this vulnerability, making upgrading the most effective solution.

CVE-2024-50345

CVE-2024-50343 affects the symfony/validator module in the Symphony PHP framework, which is used for input validation. Maliciously crafted input, ending with `\\n`, can trick the `Validator` into treating the input as complete instead of matching the entire input with regular expressions. This issue is present in Symfony versions 5.4.43, 6.4.11, and 7.1.4. To mitigate this vulnerability, users are advised to upgrade to versions that utilize the `D` regex modifier, such as those mentioned above. There are currently no known workarounds for this security flaw.

CVE-2024-50343

CVE-2024-50342 affects the symfony/http-client module in the Symphony PHP framework, which is used for fetching HTTP resources synchronously or asynchronously. This vulnerability allows for possible IP/port enumeration during host resolution with the `NoPrivateNetworkHttpClient`. Affected versions include 5.4.45, 6.4.13, and 7.1.6. To prevent the leaking of internal information, affected users are advised to upgrade to the latest versions (5.4.46, 6.4.14, and 7.1.7), as there are currently no known workarounds for this issue.

CVE-2024-50342

CVE-2024-50341 is a vulnerability affecting the symfony/security-bundle module in versions 6.4.10, 7.0.10, and 7.1.3 of the Symfony PHP framework. This module is responsible for integrating the Security component into Symfony. The issue lies in the fact that the custom `user_checker` defined on a firewall is not invoked when using the `Security::login` method for programmatic logins. This vulnerability allows unauthorized access, making it crucial for all users to upgrade to the latest versions, where the `Security::login` method now ensures the `user_checker` is called. No known workarounds exist for this vulnerability.

CVE-2024-50341

CVE-2024-10941 is a vulnerability that affects Firefox browsers versions below 126. An attacker could potentially exploit this issue by embedding a malformed URI in an iframe on a malicious website. While the vulnerability itself does not lead to a successful exploit, it can result in a non-exploitable browser crash. This could provide an opportunity for further attacks or distractions for the user, making it a potential security risk to be addressed.

CVE-2024-50340

CVE-2024-10926 is a newly disclosed vulnerability affecting IBPhoenix ibWebAdmin versions up to 1.0.2. This issue involves the processing of the /toggle_fold_panel.php file in the Tabelas Section component. The vulnerability allows for cross-site scripting attacks, which can be initiated remotely. The exploit for this vulnerability has been made public, making it a significant risk for affected systems. Despite early disclosure to the vendor, they have not yet responded to address the issue.

CVE-2024-10926

CVE-2024-51988 is a vulnerability affecting RabbitMQ, a popular messaging and streaming broker. In certain versions, the HTTP API allows for unauthorized queue deletion by users who hold valid credentials, some permissions for the target virtual host, and HTTP API access. This issue enables users to delete queues for which they have no deletion permissions. Version 3.12.11 of the open source RabbitMQ release and versions 1.5.2, 3.13.0, and 4.0.0 of the Tanzu release have addressed this vulnerability. Users are strongly advised to upgrade as soon as possible. Those unable to upgrade can disable the management plugin and implement alternative monitoring solutions, such as Prometheus and Grafana.

CVE-2024-51988

Refine your search

We could not find any results for your search, so why not start with the articles listed below?

Vulnerability Database

A comprehensive vulnerability resource that includes a curated collection of the latest software vulnerabilities publicly available for sec teams.

Top 9 Trending CVEs

Newly Added CVEs

Frequently Asked Questions

What is a vulnerability database?

Is there more than one vulnerability db?

What is a CVE identifier? (CVE ids)

What is the difference between CVE DB and CVE?

Does every vulnerability have a CVE?

How does a vulnerability become a CVE?

What's the difference between CVE and CVSS?

How does a CVE database help vulnerability management?

What are the most popular CVEs?