#ExploitObserverAlert
CVE-2024-27970
DESCRIPTION: Exploit Observer has 6 entries in 2 file formats related to CVE-2024-27970. Missing Authorization vulnerability in BogdanFix WP SendFox.This issue affects WP SendFox: from n/a through 1.3.0.
FIRST-EPSS: 0.000430000
ARPS-EXPLOITABILITY: 0.5986263
CVE-2024-27970
DESCRIPTION: Exploit Observer has 6 entries in 2 file formats related to CVE-2024-27970. Missing Authorization vulnerability in BogdanFix WP SendFox.This issue affects WP SendFox: from n/a through 1.3.0.
FIRST-EPSS: 0.000430000
ARPS-EXPLOITABILITY: 0.5986263
#ExploitObserverAlert
CVE-2024-27990
DESCRIPTION: Exploit Observer has 6 entries in 2 file formats related to CVE-2024-27990. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in The Moneytizer allows Stored XSS.This issue affects The Moneytizer: from n/a through 9.5.20.
FIRST-EPSS: 0.000430000
ARPS-EXPLOITABILITY: 0.5986263
CVE-2024-27990
DESCRIPTION: Exploit Observer has 6 entries in 2 file formats related to CVE-2024-27990. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in The Moneytizer allows Stored XSS.This issue affects The Moneytizer: from n/a through 9.5.20.
FIRST-EPSS: 0.000430000
ARPS-EXPLOITABILITY: 0.5986263
#ExploitObserverAlert
CVE-2023-46604
DESCRIPTION: Exploit Observer has 154 entries in 17 file formats related to CVE-2023-46604. The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath. Users are recommended to upgrade both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue.
FIRST-EPSS: 0.972480000
NVD-IS: 5.9
NVD-ES: 3.9
ARPS-EXPLOITABILITY: 0.7831866
CVE-2023-46604
DESCRIPTION: Exploit Observer has 154 entries in 17 file formats related to CVE-2023-46604. The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath. Users are recommended to upgrade both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue.
FIRST-EPSS: 0.972480000
NVD-IS: 5.9
NVD-ES: 3.9
ARPS-EXPLOITABILITY: 0.7831866
#ExploitObserverAlert
CVE-2024-23638
DESCRIPTION: Exploit Observer has 16 entries in 4 file formats related to CVE-2024-23638. Squid is a caching proxy for the Web. Due to an expired pointer reference bug, Squid prior to version 6.6 is vulnerable to a Denial of Service attack against Cache Manager error responses. This problem allows a trusted client to perform Denial of Service when generating error pages for Client Manager reports. Squid older than 5.0.5 have not been tested and should be assumed to be vulnerable. All Squid-5.x up to and including 5.9 are vulnerable. All Squid-6.x up to and including 6.5 are vulnerable. This bug is fixed by Squid version 6.6. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives. As a workaround, prevent access to Cache Manager using Squid's main access control: `http_access deny manager`.
FIRST-EPSS: 0.008120000
NVD-IS: 3.6
NVD-ES: 2.8
ARPS-EXPLOITABILITY: 0.6641166
CVE-2024-23638
DESCRIPTION: Exploit Observer has 16 entries in 4 file formats related to CVE-2024-23638. Squid is a caching proxy for the Web. Due to an expired pointer reference bug, Squid prior to version 6.6 is vulnerable to a Denial of Service attack against Cache Manager error responses. This problem allows a trusted client to perform Denial of Service when generating error pages for Client Manager reports. Squid older than 5.0.5 have not been tested and should be assumed to be vulnerable. All Squid-5.x up to and including 5.9 are vulnerable. All Squid-6.x up to and including 6.5 are vulnerable. This bug is fixed by Squid version 6.6. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives. As a workaround, prevent access to Cache Manager using Squid's main access control: `http_access deny manager`.
FIRST-EPSS: 0.008120000
NVD-IS: 3.6
NVD-ES: 2.8
ARPS-EXPLOITABILITY: 0.6641166
#ExploitObserverAlert
CVE-2022-0424
DESCRIPTION: Exploit Observer has 8 entries in 3 file formats related to CVE-2022-0424. The Popup by Supsystic WordPress plugin before 1.10.9 does not have any authentication and authorisation in an AJAX action, allowing unauthenticated attackers to call it and get the email addresses of subscribed users
FIRST-EPSS: 0.014880000
NVD-IS: 1.4
NVD-ES: 3.9
ARPS-EXPLOITABILITY: 0.7484797
CVE-2022-0424
DESCRIPTION: Exploit Observer has 8 entries in 3 file formats related to CVE-2022-0424. The Popup by Supsystic WordPress plugin before 1.10.9 does not have any authentication and authorisation in an AJAX action, allowing unauthenticated attackers to call it and get the email addresses of subscribed users
FIRST-EPSS: 0.014880000
NVD-IS: 1.4
NVD-ES: 3.9
ARPS-EXPLOITABILITY: 0.7484797
#ExploitObserverAlert
CVE-2024-24883
DESCRIPTION: Exploit Observer has 6 entries in 2 file formats related to CVE-2024-24883. Missing Authorization vulnerability in BdThemes Prime Slider – Addons For Elementor.This issue affects Prime Slider – Addons For Elementor: from n/a through 3.11.10.
FIRST-EPSS: 0.000430000
ARPS-EXPLOITABILITY: 0.5986263
CVE-2024-24883
DESCRIPTION: Exploit Observer has 6 entries in 2 file formats related to CVE-2024-24883. Missing Authorization vulnerability in BdThemes Prime Slider – Addons For Elementor.This issue affects Prime Slider – Addons For Elementor: from n/a through 3.11.10.
FIRST-EPSS: 0.000430000
ARPS-EXPLOITABILITY: 0.5986263
#ExploitObserverAlert
CVE-2023-3750
DESCRIPTION: Exploit Observer has 13 entries in 3 file formats related to CVE-2023-3750. A flaw was found in libvirt. The virStoragePoolObjListSearch function does not return a locked pool as expected, resulting in a race condition and denial of service when attempting to lock the same object from another thread. This issue could allow clients connecting to the read-only socket to crash the libvirt daemon.
FIRST-EPSS: 0.000680000
NVD-IS: 3.6
NVD-ES: 1.6
ARPS-EXPLOITABILITY: 0.6913015
CVE-2023-3750
DESCRIPTION: Exploit Observer has 13 entries in 3 file formats related to CVE-2023-3750. A flaw was found in libvirt. The virStoragePoolObjListSearch function does not return a locked pool as expected, resulting in a race condition and denial of service when attempting to lock the same object from another thread. This issue could allow clients connecting to the read-only socket to crash the libvirt daemon.
FIRST-EPSS: 0.000680000
NVD-IS: 3.6
NVD-ES: 1.6
ARPS-EXPLOITABILITY: 0.6913015
#ExploitObserverAlert
CVE-2024-24747
DESCRIPTION: Exploit Observer has 13 entries in 4 file formats related to CVE-2024-24747. MinIO is a High Performance Object Storage. When someone creates an access key, it inherits the permissions of the parent key. Not only for `s3:*` actions, but also `admin:*` actions. Which means unless somewhere above in the access-key hierarchy, the `admin` rights are denied, access keys will be able to simply override their own `s3` permissions to something more permissive. The vulnerability is fixed in RELEASE.2024-01-31T20-20-33Z.
FIRST-EPSS: 0.000580000
NVD-IS: 5.9
NVD-ES: 2.8
ARPS-EXPLOITABILITY: 0.7162829
CVE-2024-24747
DESCRIPTION: Exploit Observer has 13 entries in 4 file formats related to CVE-2024-24747. MinIO is a High Performance Object Storage. When someone creates an access key, it inherits the permissions of the parent key. Not only for `s3:*` actions, but also `admin:*` actions. Which means unless somewhere above in the access-key hierarchy, the `admin` rights are denied, access keys will be able to simply override their own `s3` permissions to something more permissive. The vulnerability is fixed in RELEASE.2024-01-31T20-20-33Z.
FIRST-EPSS: 0.000580000
NVD-IS: 5.9
NVD-ES: 2.8
ARPS-EXPLOITABILITY: 0.7162829
#ExploitObserverAlert
CVE-2024-2279
DESCRIPTION: Exploit Observer has 3 entries in 1 file formats related to CVE-2024-2279. An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.7 to 16.8.6 all versions starting from 16.9 before 16.9.4, all versions starting from 16.10 before 16.10.2. Using the autocomplete for issues references feature a crafted payload may lead to a stored XSS, allowing attackers to perform arbitrary actions on behalf of victims.
FIRST-EPSS: 0.000430000
ARPS-EXPLOITABILITY: 0.775
CVE-2024-2279
DESCRIPTION: Exploit Observer has 3 entries in 1 file formats related to CVE-2024-2279. An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.7 to 16.8.6 all versions starting from 16.9 before 16.9.4, all versions starting from 16.10 before 16.10.2. Using the autocomplete for issues references feature a crafted payload may lead to a stored XSS, allowing attackers to perform arbitrary actions on behalf of victims.
FIRST-EPSS: 0.000430000
ARPS-EXPLOITABILITY: 0.775
#ExploitObserverAlert
CVE-2024-28834
DESCRIPTION: Exploit Observer has 6 entries in 3 file formats related to CVE-2024-28834. A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag, it can result in a noticeable step in nonce size from 513 to 512 bits, exposing a potential timing side-channel.
FIRST-EPSS: 0.000450000
ARPS-EXPLOITABILITY: 0.723201
CVE-2024-28834
DESCRIPTION: Exploit Observer has 6 entries in 3 file formats related to CVE-2024-28834. A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag, it can result in a noticeable step in nonce size from 513 to 512 bits, exposing a potential timing side-channel.
FIRST-EPSS: 0.000450000
ARPS-EXPLOITABILITY: 0.723201
#ExploitObserverAlert
CVE-2024-24576
DESCRIPTION: Exploit Observer has 67 entries in 13 file formats related to CVE-2024-24576. Rust is a programming language. The Rust Security Response WG was notified that the Rust standard library prior to version 1.77.2 did not properly escape arguments when invoking batch files (with the `bat` and `cmd` extensions) on Windows using the `Command`. An attacker able to control the arguments passed to the spawned process could execute arbitrary shell commands by bypassing the escaping. The severity of this vulnerability is critical for those who invoke batch files on Windows with untrusted arguments. No other platform or use is affected. The `Command::arg` and `Command::args` APIs state in their documentation that the arguments will be passed to the spawned process as-is, regardless of the content of the arguments, and will not be evaluated by a shell. This means it should be safe to pass untrusted input as an argument. On Windows, the implementation of this is more complex than other platforms, because the Windows API only provides a single string containing all the arguments to the spawned process, and it's up to the spawned process to split them. Most programs use the standard C run-time argv, which in practice results in a mostly consistent way arguments are splitted. One exception though is `cmd.exe` (used among other things to execute batch files), which has its own argument splitting logic. That forces the standard library to implement custom escaping for arguments passed to batch files. Unfortunately it was reported that our escaping logic was not thorough enough, and it was possible to pass malicious arguments that would result in arbitrary shell execution. Due to the complexity of `cmd.exe`, we didn't identify a solution that would correctly escape arguments in all cases. To maintain our API guarantees, we improved the robustness of the escaping code, and changed the `Command` API to return an `InvalidInput` error when it cannot safely escape an argument. This error will be emitted when spawning the process. The fix is included in Rust 1.77.2. Note that the new escaping logic for batch files errs on the conservative side, and could reject valid arguments. Those who implement the escaping themselves or only handle trusted inputs on Windows can also use the `CommandExt::raw_arg` method to bypass the standard library's escaping logic.
FIRST-EPSS: 0.000440000
ARPS-EXPLOITABILITY: 0.6898125
CVE-2024-24576
DESCRIPTION: Exploit Observer has 67 entries in 13 file formats related to CVE-2024-24576. Rust is a programming language. The Rust Security Response WG was notified that the Rust standard library prior to version 1.77.2 did not properly escape arguments when invoking batch files (with the `bat` and `cmd` extensions) on Windows using the `Command`. An attacker able to control the arguments passed to the spawned process could execute arbitrary shell commands by bypassing the escaping. The severity of this vulnerability is critical for those who invoke batch files on Windows with untrusted arguments. No other platform or use is affected. The `Command::arg` and `Command::args` APIs state in their documentation that the arguments will be passed to the spawned process as-is, regardless of the content of the arguments, and will not be evaluated by a shell. This means it should be safe to pass untrusted input as an argument. On Windows, the implementation of this is more complex than other platforms, because the Windows API only provides a single string containing all the arguments to the spawned process, and it's up to the spawned process to split them. Most programs use the standard C run-time argv, which in practice results in a mostly consistent way arguments are splitted. One exception though is `cmd.exe` (used among other things to execute batch files), which has its own argument splitting logic. That forces the standard library to implement custom escaping for arguments passed to batch files. Unfortunately it was reported that our escaping logic was not thorough enough, and it was possible to pass malicious arguments that would result in arbitrary shell execution. Due to the complexity of `cmd.exe`, we didn't identify a solution that would correctly escape arguments in all cases. To maintain our API guarantees, we improved the robustness of the escaping code, and changed the `Command` API to return an `InvalidInput` error when it cannot safely escape an argument. This error will be emitted when spawning the process. The fix is included in Rust 1.77.2. Note that the new escaping logic for batch files errs on the conservative side, and could reject valid arguments. Those who implement the escaping themselves or only handle trusted inputs on Windows can also use the `CommandExt::raw_arg` method to bypass the standard library's escaping logic.
FIRST-EPSS: 0.000440000
ARPS-EXPLOITABILITY: 0.6898125
#ExploitObserverAlert
CVE-2024-22667
DESCRIPTION: Exploit Observer has 9 entries in 3 file formats related to CVE-2024-22667. Vim before 9.0.2142 has a stack-based buffer overflow because did_set_langmap in map.c calls sprintf to write to the error buffer that is passed down to the option callback functions.
FIRST-EPSS: 0.000420000
NVD-IS: 5.9
NVD-ES: 1.8
ARPS-EXPLOITABILITY: 0.688607
CVE-2024-22667
DESCRIPTION: Exploit Observer has 9 entries in 3 file formats related to CVE-2024-22667. Vim before 9.0.2142 has a stack-based buffer overflow because did_set_langmap in map.c calls sprintf to write to the error buffer that is passed down to the option callback functions.
FIRST-EPSS: 0.000420000
NVD-IS: 5.9
NVD-ES: 1.8
ARPS-EXPLOITABILITY: 0.688607
#ExploitObserverAlert
CVE-2023-6019
DESCRIPTION: Exploit Observer has 16 entries in 3 file formats related to CVE-2023-6019. A command injection existed in Ray's cpu_profile URL parameter allowing attackers to execute os commands on the system running the ray dashboard remotely without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here: https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023
FIRST-EPSS: 0.000970000
NVD-IS: 5.9
NVD-ES: 3.9
ARPS-EXPLOITABILITY: 0.9157136
CVE-2023-6019
DESCRIPTION: Exploit Observer has 16 entries in 3 file formats related to CVE-2023-6019. A command injection existed in Ray's cpu_profile URL parameter allowing attackers to execute os commands on the system running the ray dashboard remotely without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here: https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023
FIRST-EPSS: 0.000970000
NVD-IS: 5.9
NVD-ES: 3.9
ARPS-EXPLOITABILITY: 0.9157136
#ExploitObserverAlert
CVE-2023-6678
DESCRIPTION: Exploit Observer has 3 entries in 1 file formats related to CVE-2023-6678. An issue has been discovered in GitLab EE affecting all versions before 16.8.6, all versions starting from 16.9 before 16.9.4, all versions starting from 16.10 before 16.10.2. It was possible for an attacker to cause a denial of service using malicious crafted content in a junit test report file.
FIRST-EPSS: 0.000430000
ARPS-EXPLOITABILITY: 0.775
CVE-2023-6678
DESCRIPTION: Exploit Observer has 3 entries in 1 file formats related to CVE-2023-6678. An issue has been discovered in GitLab EE affecting all versions before 16.8.6, all versions starting from 16.9 before 16.9.4, all versions starting from 16.10 before 16.10.2. It was possible for an attacker to cause a denial of service using malicious crafted content in a junit test report file.
FIRST-EPSS: 0.000430000
ARPS-EXPLOITABILITY: 0.775
#ExploitObserverAlert
CVE-2023-6129
DESCRIPTION: Exploit Observer has 13 entries in 5 file formats related to CVE-2023-6129. Issue summary: The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the internal state of applications running on PowerPC CPU based platforms if the CPU provides vector instructions. Impact summary: If an attacker can influence whether the POLY1305 MAC algorithm is used, the application state might be corrupted with various application dependent consequences. The POLY1305 MAC (message authentication code) implementation in OpenSSL for PowerPC CPUs restores the contents of vector registers in a different order than they are saved. Thus the contents of some of these vector registers are corrupted when returning to the caller. The vulnerable code is used only on newer PowerPC processors supporting the PowerISA 2.07 instructions. The consequences of this kind of internal application state corruption can be various - from no consequences, if the calling application does not depend on the contents of non-volatile XMM registers at all, to the worst consequences, where the attacker could get complete control of the application process. However unless the compiler uses the vector registers for storing pointers, the most likely consequence, if any, would be an incorrect result of some application dependent calculations or a crash leading to a denial of service. The POLY1305 MAC algorithm is most frequently used as part of the CHACHA20-POLY1305 AEAD (authenticated encryption with associated data) algorithm. The most common usage of this AEAD cipher is with TLS protocol versions 1.2 and 1.3. If this cipher is enabled on the server a malicious client can influence whether this AEAD cipher is used. This implies that TLS server applications using OpenSSL can be potentially impacted. However we are currently not aware of any concrete application that would be affected by this issue therefore we consider this a Low severity security issue.
FIRST-EPSS: 0.000610000
NVD-IS: 4.2
NVD-ES: 2.2
ARPS-EXPLOITABILITY: 0.7505797
CVE-2023-6129
DESCRIPTION: Exploit Observer has 13 entries in 5 file formats related to CVE-2023-6129. Issue summary: The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the internal state of applications running on PowerPC CPU based platforms if the CPU provides vector instructions. Impact summary: If an attacker can influence whether the POLY1305 MAC algorithm is used, the application state might be corrupted with various application dependent consequences. The POLY1305 MAC (message authentication code) implementation in OpenSSL for PowerPC CPUs restores the contents of vector registers in a different order than they are saved. Thus the contents of some of these vector registers are corrupted when returning to the caller. The vulnerable code is used only on newer PowerPC processors supporting the PowerISA 2.07 instructions. The consequences of this kind of internal application state corruption can be various - from no consequences, if the calling application does not depend on the contents of non-volatile XMM registers at all, to the worst consequences, where the attacker could get complete control of the application process. However unless the compiler uses the vector registers for storing pointers, the most likely consequence, if any, would be an incorrect result of some application dependent calculations or a crash leading to a denial of service. The POLY1305 MAC algorithm is most frequently used as part of the CHACHA20-POLY1305 AEAD (authenticated encryption with associated data) algorithm. The most common usage of this AEAD cipher is with TLS protocol versions 1.2 and 1.3. If this cipher is enabled on the server a malicious client can influence whether this AEAD cipher is used. This implies that TLS server applications using OpenSSL can be potentially impacted. However we are currently not aware of any concrete application that would be affected by this issue therefore we consider this a Low severity security issue.
FIRST-EPSS: 0.000610000
NVD-IS: 4.2
NVD-ES: 2.2
ARPS-EXPLOITABILITY: 0.7505797
#ExploitObserverAlert
CVE-2024-24795
DESCRIPTION: Exploit Observer has 4 entries in 1 file formats related to CVE-2024-24795. HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker that can inject malicious response headers into backend applications to cause an HTTP desynchronization attack. Users are recommended to upgrade to version 2.4.59, which fixes this issue.
FIRST-EPSS: 0.000430000
ARPS-EXPLOITABILITY: 0.7214286
CVE-2024-24795
DESCRIPTION: Exploit Observer has 4 entries in 1 file formats related to CVE-2024-24795. HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker that can inject malicious response headers into backend applications to cause an HTTP desynchronization attack. Users are recommended to upgrade to version 2.4.59, which fixes this issue.
FIRST-EPSS: 0.000430000
ARPS-EXPLOITABILITY: 0.7214286
#ExploitObserverAlert
CVE-2024-21508
DESCRIPTION: Exploit Observer has 9 entries in 3 file formats related to CVE-2024-21508. Versions of the package mysql2 before 3.9.4 are vulnerable to Remote Code Execution (RCE) via the readCodeFor function due to improper validation of the supportBigNumbers and bigNumberStrings values.
FIRST-EPSS: 0.000440000
ARPS-EXPLOITABILITY: 0.7512425
CVE-2024-21508
DESCRIPTION: Exploit Observer has 9 entries in 3 file formats related to CVE-2024-21508. Versions of the package mysql2 before 3.9.4 are vulnerable to Remote Code Execution (RCE) via the readCodeFor function due to improper validation of the supportBigNumbers and bigNumberStrings values.
FIRST-EPSS: 0.000440000
ARPS-EXPLOITABILITY: 0.7512425
#ExploitObserverAlert
CVE-2023-0342
DESCRIPTION: Exploit Observer has 7 entries in 3 file formats related to CVE-2023-0342. MongoDB Ops Manager Diagnostics Archive may not redact sensitive PEM key file password app settings. Archives do not include the PEM files themselves. This issue affects MongoDB Ops Manager v5.0 prior to 5.0.21 and MongoDB Ops Manager v6.0 prior to 6.0.12
FIRST-EPSS: 0.000460000
NVD-IS: 1.4
NVD-ES: 3.9
ARPS-EXPLOITABILITY: 0.9205301
CVE-2023-0342
DESCRIPTION: Exploit Observer has 7 entries in 3 file formats related to CVE-2023-0342. MongoDB Ops Manager Diagnostics Archive may not redact sensitive PEM key file password app settings. Archives do not include the PEM files themselves. This issue affects MongoDB Ops Manager v5.0 prior to 5.0.21 and MongoDB Ops Manager v6.0 prior to 6.0.12
FIRST-EPSS: 0.000460000
NVD-IS: 1.4
NVD-ES: 3.9
ARPS-EXPLOITABILITY: 0.9205301
#ExploitObserverAlert
CVE-2024-1441
DESCRIPTION: Exploit Observer has 11 entries in 3 file formats related to CVE-2024-1441. An off-by-one error flaw was found in the udevListInterfacesByStatus() function in libvirt when the number of interfaces exceeds the size of the `names` array. This issue can be reproduced by sending specially crafted data to the libvirt daemon, allowing an unprivileged client to perform a denial of service attack by causing the libvirt daemon to crash.
FIRST-EPSS: 0.000450000
ARPS-EXPLOITABILITY: 0.6969988
CVE-2024-1441
DESCRIPTION: Exploit Observer has 11 entries in 3 file formats related to CVE-2024-1441. An off-by-one error flaw was found in the udevListInterfacesByStatus() function in libvirt when the number of interfaces exceeds the size of the `names` array. This issue can be reproduced by sending specially crafted data to the libvirt daemon, allowing an unprivileged client to perform a denial of service attack by causing the libvirt daemon to crash.
FIRST-EPSS: 0.000450000
ARPS-EXPLOITABILITY: 0.6969988
#ExploitObserverAlert
CVE-2023-2700
DESCRIPTION: Exploit Observer has 13 entries in 3 file formats related to CVE-2023-2700. A vulnerability was found in libvirt. This security flaw ouccers due to repeatedly querying an SR-IOV PCI device's capabilities that exposes a memory leak caused by a failure to free the virPCIVirtualFunction array within the parent struct's g_autoptr cleanup.
FIRST-EPSS: 0.000420000
NVD-IS: 3.6
NVD-ES: 1.8
ARPS-EXPLOITABILITY: 0.7000953
CVE-2023-2700
DESCRIPTION: Exploit Observer has 13 entries in 3 file formats related to CVE-2023-2700. A vulnerability was found in libvirt. This security flaw ouccers due to repeatedly querying an SR-IOV PCI device's capabilities that exposes a memory leak caused by a failure to free the virPCIVirtualFunction array within the parent struct's g_autoptr cleanup.
FIRST-EPSS: 0.000420000
NVD-IS: 3.6
NVD-ES: 1.8
ARPS-EXPLOITABILITY: 0.7000953
#ExploitObserverAlert
CVE-2024-31080
DESCRIPTION: Exploit Observer has 21 entries in 6 file formats related to CVE-2024-31080. A heap-based buffer over-read vulnerability was found in the X.org server's ProcXIGetSelectedEvents() function. This issue occurs when byte-swapped length values are used in replies, potentially leading to memory leakage and segmentation faults, particularly when triggered by a client with a different endianness. This vulnerability could be exploited by an attacker to cause the X server to read heap memory values and then transmit them back to the client until encountering an unmapped page, resulting in a crash. Despite the attacker's inability to control the specific memory copied into the replies, the small length values typically stored in a 32-bit integer can result in significant attempted out-of-bounds reads.
FIRST-EPSS: 0.000450000
ARPS-EXPLOITABILITY: 0.7065507
CVE-2024-31080
DESCRIPTION: Exploit Observer has 21 entries in 6 file formats related to CVE-2024-31080. A heap-based buffer over-read vulnerability was found in the X.org server's ProcXIGetSelectedEvents() function. This issue occurs when byte-swapped length values are used in replies, potentially leading to memory leakage and segmentation faults, particularly when triggered by a client with a different endianness. This vulnerability could be exploited by an attacker to cause the X server to read heap memory values and then transmit them back to the client until encountering an unmapped page, resulting in a crash. Despite the attacker's inability to control the specific memory copied into the replies, the small length values typically stored in a 32-bit integer can result in significant attempted out-of-bounds reads.
FIRST-EPSS: 0.000450000
ARPS-EXPLOITABILITY: 0.7065507