FTC cracks down on Genshin Impact gacha loot box practices
FTC cracks down on Genshin Impact gacha loot box practices

FTC cracks down on Genshin Impact gacha loot box practices

2025-01-17 22:18

Genshin Impact developer Cognosphere (aka Hoyoverse) has agreed to a $20 million settlement with...

FCC to telcos: By law you must secure your networks from foreign spies. Get on it

FCC to telcos: By law you must secure your networks from foreign spies. Get on it

2025-01-17 22:07

Plus: Uncle Sam is cross with this one Chinese biz over Salt Typhoon mega-snooping Decades-old...

Friday Squid Blogging: Opioid Alternatives from Squid Research

Friday Squid Blogging: Opioid Alternatives from Squid Research

2025-01-17 22:02

Is there nothing that squid research can’t solve? “If you’re working with an organism like squid...

Biden signs sweeping cybersecurity order, just in time for Trump to gut it

Biden signs sweeping cybersecurity order, just in time for Trump to gut it

2025-01-17 20:23

Ransomware, AI, secure software, digital IDs – there's something for everyone in the...

Otelier data breach exposes info, hotel reservations of millions

Otelier data breach exposes info, hotel reservations of millions

2025-01-17 20:17

Hotel management platform Otelier suffered a data breach after threat actors breached its Amazon...

Malicious PyPi package steals Discord auth tokens from devs

Malicious PyPi package steals Discord auth tokens from devs

2025-01-17 19:16

A malicious package named 'pycord-self' on the Python package index (PyPI) targets...

Fortinet: FortiGate config leaks are genuine but misleading

Fortinet: FortiGate config leaks are genuine but misleading

2025-01-17 18:32

Competition hots up with Ivanti over who can have the worst start to a year Fortinet has...

Vulnerabilities by Risk level (Last 12 months)

Risk level Last 12 months #
Critical 2464
High 6959
Medium 9787
Low 321

Vulnerabilities by Vendor (Last 12 months)

Vendor Last 12 months #
Linux 2734
Google 661
Apple 592
Microsoft 462
Adobe 456

Latest Vulnerabilities

  • CVE-2024-41746

    7.2

    IBM CICS TX Advanced 10.1, 11.1, and Standard 11.1 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the...

    network
    low complexity
    CWE-79
    7.2

  • CVE-2018-25108

    7.5

    An unauthenticated remote attacker can cause a DoS in the controller due to uncontrolled resource consumption.

    network
    low complexity
    CWE-770
    7.5

  • CVE-2024-12427

    5.3

    The Multi Step Form plugin for WordPress is vulnerable to unauthorized limited file upload due to a missing capability check on the fw_upload_file AJAX action in all versions up to, and including,...

    network
    low complexity
    CWE-862
    5.3

  • CVE-2024-12613

    7.5

    The Passwords Manager plugin for WordPress is vulnerable to SQL Injection via the $wpdb->prefix value in several AJAX fuctions in all versions up to, and including, 1.4.8 due to insufficient...

    network
    low complexity
    CWE-89
    7.5

  • CVE-2024-12614

    7.5

    The Passwords Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'pms_save_setting' and 'post_new_pass' AJAX actions in all...

    network
    low complexity
    CWE-89
    7.5

Latest Critical Vulnerabilities

  • CVE-2025-0455

    9.8

    The airPASS from NetVision Information has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents.

    network
    low complexity
    CWE-89
    critical
    9.8

  • CVE-2025-0456

    9.8

    The airPASS from NetVision Information has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to access the specific administrative functionality to retrieve * all...

    network
    low complexity
    CWE-306
    critical
    9.8

  • CVE-2024-12084

    9.8

    A heap-based buffer overflow flaw was found in the rsync daemon. This issue is due to improper handling of attacker-controlled checksum lengths (s2length) in the code. When MAX_DIGEST_LEN exceeds...

    network
    low complexity
    CWE-122
    critical
    9.8

  • CVE-2024-9636

    9.8

    The Post Grid and Gutenberg Blocks plugin for WordPress is vulnerable to privilege escalation in versions 2.2.85 to 2.3.3. This is due to the plugin not properly restricting what user meta can be...

    network
    low complexity
    CWE-269
    critical
    9.8

  • CVE-2025-21298

    9.8

    Windows OLE Remote Code Execution Vulnerability

    network
    low complexity
    CWE-416
    critical
    9.8

  • CVE-2025-21307

    9.8

    Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability

    network
    low complexity
    CWE-416
    critical
    9.8

  • CVE-2025-21311

    9.8

    Windows NTLM V1 Elevation of Privilege Vulnerability

    network
    low complexity
    CWE-303
    critical
    9.8

  • CVE-2024-13179 - Path Traversal vulnerability in Ivanti Avalanche

    9.8

    Path Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to bypass authentication.

    network
    low complexity
    ivanti CWE-22
    critical
    9.8