Platform

Featured Integrations

Reduce risk and mitigate cyber attacks, no matter your IT & security stack, maturity journey, or industry

See our Threat Intelligence Solutions in Action

Outcomes

Industries

Threat Intelligence solves pervasive challenges

Reduce operational risk through timely, precise, and actionable intelligence.

See Recorded Future’s Intelligence in Action

Products

Services

Research

Minimize operational risks with our timely, precise, and actionable intelligence.

See Recorded Future in Action

Resource Center

Additional Resources

Additional Topics

Resources

Why Recorded Future

About Us

Partner With Us

Join Us

Company

brand-logo-long-black.svg

Rectangular Logo - Digital (RGB).svg

Blog

Careers at Recorded Future

Contact Us

CVE-2024-32034 is a vulnerability affecting Decidim, an open-source platform for participatory democracy. The vulnerability allows for potential Cross-site Scripting (XSS) attacks when an admin assigns a valuator to a proposal or performs actions that generate an admin activity log with crafted resources. It has been mitigated in versions 0.27.7, 0.28.2, and later; users are encouraged to upgrade to these versions to ensure security. For those unable to upgrade, redirecting the /admin and /admin/logs pages to alternative admin pages can help minimize exposure. The vulnerability poses a medium risk with a high confidentiality impact and requires user interaction for exploitation, making it critical for organizations using this platform to take preventive measures.

CVE-2024-32034

CVE-2023-25546 identifies an out-of-bounds read vulnerability in the UEFI firmware affecting certain Intel® Processors, which could potentially enable denial of service if exploited by a privileged user with local access. The vulnerability has a CVSS score of 2.5, categorized as low severity, but requires high privileges and presents a high attack complexity. While there is no impact on confidentiality or integrity, the availability impact is rated as low. To remediate this issue, users are advised to apply updates provided by Intel as outlined in their security advisory (Intel SA-01071). Organizations should be aware that even though the exploitability score is moderate (0.8), successful exploitation could disrupt services within their systems.

CVE-2023-25546

CVE-2023-23904 identifies a NULL pointer dereference vulnerability in the UEFI firmware for certain Intel processors, which can allow a privileged user to escalate privileges through local access. This vulnerability has a medium severity rating with a CVSS base score of 6.1, indicating that it poses significant risks regarding integrity while having low impacts on availability and confidentiality. Affected products include various Intel processors that utilize this firmware. To remediate the issue, organizations are advised to apply the latest firmware updates from Intel, as detailed in their advisory. If exploited, this vulnerability could lead to unauthorized access and control over affected systems, potentially compromising organizational resources.

CVE-2023-23904

CVE-2023-22351 describes an out-of-bounds write vulnerability in the UEFI firmware of certain Intel processors, which could allow a local privileged user to escalate their privileges. This vulnerability has a medium severity rating with a CVSS base score of 6.1 and requires high privileges to exploit, indicating that it poses a significant risk if exploited in environments where local access is possible. The integrity impact is rated as high, while confidentiality impact is none, suggesting that compromised systems could be altered without detection. To remediate this vulnerability, organizations are advised to apply firmware updates provided by Intel, which can be found in their security advisory linked here. Failure to address this issue could lead to unauthorized modifications of system settings or data by users with local access.

CVE-2023-22351

CVE-2024-45835 affects Mattermost Desktop App versions 5.8.0 and earlier, where insufficient configuration of Electron Fuses can allow attackers to access Chromium cookies or exploit other misconfigurations through remote or local means. The vulnerability has a CVSS base score of 6.5, indicating a medium severity level with low confidentiality and integrity impacts, requiring no user interaction or privileges for exploitation. Organizations using the affected versions should update their Mattermost Desktop applications to mitigate this risk. Failure to address this vulnerability may expose organizations to unauthorized data access and potential security breaches. More information on remediation can be found in the vendor’s advisory at Mattermost's security updates page.

CVE-2024-45835

CVE-2024-39772 affects Mattermost Desktop App versions up to 5.8.0, which have a vulnerability in their screen capture functionality, allowing attackers to potentially capture high-quality screenshots without user knowledge via JavaScript APIs. This vulnerability poses a low confidentiality impact and can be exploited over a network without requiring user interaction or elevated privileges. The exploitability score of the vulnerability is rated at 2.2, with a base severity classified as low (base score of 3.7). Organizations using the affected versions are advised to update to a patched version to mitigate the risk associated with this vulnerability. For further details and security updates, users can refer to the Mattermost security updates page.

CVE-2024-39772

CVE-2024-46419 identifies a buffer overflow vulnerability in the TOTOLINK AC1200 T8 router, specifically within the setWizardCfg function when processing the ssid5g parameter. This vulnerability is rated as critical, with a CVSS base score of 9.8, indicating a high impact on confidentiality, integrity, and availability if exploited over a network without requiring user interaction or special privileges. Organizations using affected versions (v4.1.5cu.861_B20230220) are at risk of significant security breaches due to the potential for unauthorized access and data manipulation. To remediate this issue, users should update their devices to the latest firmware version as provided by TOTOLINK or apply any relevant patches that address this vulnerability. The exploitability of this vulnerability is considered low in complexity but poses serious risks given its high-impact rating.

CVE-2024-46419

CVE-2024-46937 describes an improper access control vulnerability in the MFASOFT Secure Authentication Server (SAS) versions 1.8.x through 1.9.x prior to 1.9.040924, which allows remote attackers to access user tokens without authentication via the /api-selfportal/get-info-token-properties endpoint. The vulnerability can be exploited through a brute-force attack on the serial parameter using identifiers such as GA00001, GA00002, etc. Organizations using affected versions face potential risks including high confidentiality and integrity impacts, with a CVSS base score of 9.1 indicating critical severity. To remediate this vulnerability, users are advised to upgrade to version 1.9.040924 or later. Given that no privileges or user interactions are required for exploitation, this poses a significant threat to organizational security if left unaddressed.

CVE-2024-46937

CVE-2024-46451 identifies a buffer overflow vulnerability in the TOTOLINK AC1200 T8 v4.1.5cu.861_B20230220, specifically within the setWiFiAclRules function via the desc parameter. This vulnerability can be exploited remotely without requiring user interaction, posing a critical threat with a CVSS base score of 9.8, indicating high potential impacts on confidentiality, integrity, and availability. Affected organizations should update their firmware to mitigate the risks associated with this vulnerability, as it allows attackers to potentially execute arbitrary code on the device. The exploit complexity is low, meaning that even less skilled attackers could take advantage of this flaw. For additional details and remediation steps, affected users can refer to third-party advisories available online.

CVE-2024-46451

CVE-2024-46424 identifies a buffer overflow vulnerability found in the TOTOLINK AC1200 T8 router, specifically in the UploadCustomModule function, which can be exploited to cause a Denial of Service (DoS) when manipulating the File parameter. This vulnerability has a base severity rating of high (7.5) and an exploitability score of 3.9, indicating that it requires no user interaction and can be exploited over the network with low complexity. Affected organizations should implement updates or mitigations as recommended by the manufacturer to remediate this issue and prevent potential service disruptions. The vulnerability leaves systems vulnerable without affecting data confidentiality or integrity but poses a significant threat to availability. Further details and potential exploits can be found in third-party advisories linked in relevant security databases.

CVE-2024-46424

Refine your search

We could not find any results for your search, so why not start with the articles listed below?

Vulnerability Database

A comprehensive vulnerability resource that includes a curated collection of the latest software vulnerabilities publicly available for sec teams.

Top 9 Trending CVEs

Newly Added CVEs

Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future

Frequently Asked Questions

What is a vulnerability database?

Is there more than one vulnerability db?

What is a CVE identifier? (CVE ids)

What is the difference between CVE DB and CVE?

Does every vulnerability have a CVE?

How does a vulnerability become a CVE?

What's the difference between CVE and CVSS?

How does a CVE database help vulnerability management?

What are the most popular CVEs?