{"vulnerability": "CVE-2024-5199", "sightings": [{"uuid": "09814a25-db85-49e0-b2f9-b9c283edf2d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-51990", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/113438853912158188", "content": "", "creation_timestamp": "2024-11-07T00:32:24.579544Z"}, {"uuid": "85329d00-be6a-4f87-848a-12db67560bf9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-51993", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/113443005858730142", "content": "", "creation_timestamp": "2024-11-07T18:08:17.520637Z"}, {"uuid": "06d457f8-bdfc-48ad-ae3b-ad8864625fd7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-51994", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/113443005872447427", "content": "", "creation_timestamp": "2024-11-07T18:08:17.810195Z"}, {"uuid": "e98804cc-1729-4ee0-8884-8017a06c8690", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-51998", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/113444304452588220", "content": "", "creation_timestamp": "2024-11-07T23:38:32.660190Z"}, {"uuid": "7830464f-9c49-49fa-a3e1-e8b693bd9971", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-51997", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/113448802607915052", "content": "", "creation_timestamp": "2024-11-08T18:42:28.845876Z"}, {"uuid": "7881cb93-0e6f-4f98-835a-60d7c5a640cb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-51992", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/113465940862819309", "content": "", "creation_timestamp": "2024-11-11T19:20:58.022222Z"}, {"uuid": "687379e9-a09f-4474-a553-f91aa7b910ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-51996", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/113476554727172279", "content": "", "creation_timestamp": "2024-11-13T16:20:12.613653Z"}, {"uuid": "81084698-b99f-47a3-8de9-c6afa1001bc2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-51991", "type": "seen", "source": "https://bsky.app/profile/cyberalerts.bsky.social/post/3logzeg2pcg2x", "content": "", "creation_timestamp": "2025-05-05T18:40:16.657856Z"}, {"uuid": "0e7a2dbd-7005-4629-81ae-2e3bf1db1ece", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-51999", "type": "seen", "source": "https://bsky.app/profile/ulisesgascon.com/post/3m6wufigsy22l", "content": "", "creation_timestamp": "2025-12-01T16:37:07.673979Z"}, {"uuid": "e49efdfd-bbe3-4e55-abc1-af4d7f365e6a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-51999", "type": "seen", "source": "https://bsky.app/profile/ulisesgascon.com/post/3m6wuhn4oz22l", "content": "", "creation_timestamp": "2025-12-01T16:38:20.125005Z"}, {"uuid": "34844961-a65a-4b5c-8ab7-147a98acbe09", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-51996", "type": "seen", "source": "MISP/1c5c38d6-3401-41ac-be0e-4cf361fa6f51", "content": "", "creation_timestamp": "2025-09-25T00:36:29.000000Z"}, {"uuid": "9c415b4d-1151-44b6-838d-fb757582739e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-51999", "type": "seen", "source": "https://bsky.app/profile/azu.bsky.social/post/3m6yrhzgjv42k", "content": "", "creation_timestamp": "2025-12-02T10:50:09.149106Z"}, {"uuid": "7f44f5ee-f2ca-4217-a211-b490bc177979", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-51991", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/14947", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2024-51991\n\ud83d\udd25 CVSS Score: 1.1 (cvssV4_0, Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U)\n\ud83d\udd39 Description: October is a Content Management System (CMS) and web platform. A vulnerability in versions prior to 3.7.5 affects authenticated administrators with sites that have the `media.clean_vectors` configuration enabled. This configuration will sanitize SVG files uploaded using the media manager. This vulnerability allows an authenticated user to bypass this protection by uploading it with a permitted extension (for example, .jpg or .png) and later modifying it to the .svg extension. This vulnerability assumes a trusted user will attack another trusted user and cannot be actively exploited without access to the administration panel and interaction from the other user. This issue has been patched in v3.7.5.\n\ud83d\udccf Published: 2025-05-05T17:04:53.615Z\n\ud83d\udccf Modified: 2025-05-05T18:06:18.685Z\n\ud83d\udd17 References:\n1. https://github.com/octobercms/october/security/advisories/GHSA-96hh-8hx5-cpw7", "creation_timestamp": "2025-05-05T18:19:32.000000Z"}, {"uuid": "59fc1ff9-ee35-43b6-afd9-d431390107cb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-51992", "type": "seen", "source": "https://t.me/cvedetector/10527", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-51992 - Orchid Platform Exposed Arbitrary Method Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2024-51992 \nPublished : Nov. 11, 2024, 8:15 p.m. | 37\u00a0minutes ago \nDescription : Orchid is a @laravel package that allows for rapid application development of back-office applications, admin/user panels, and dashboards. This vulnerability is a method exposure issue (CWE-749: Exposed Dangerous Method or Function) in the Orchid Platform\u2019s asynchronous modal functionality, affecting users of Orchid Platform version 8 through 14.42.x. Attackers could exploit this vulnerability to call arbitrary methods within the `Screen` class, leading to potential brute force of database tables, validation checks against user credentials, and disclosure of the server\u2019s real IP address. The issue has been patched in the latest release, version 14.43.0, released on November 6, 2024. Users should upgrade to version 14.43.0 or later to address this vulnerability. If upgrading to version 14.43.0 is not immediately possible, users can mitigate the vulnerability by implementing middleware to intercept and validate requests to asynchronous modal endpoints, allowing only approved methods and parameters. \nSeverity: 4.1 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"11 Nov 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-11-11T21:57:42.000000Z"}, {"uuid": "3311e782-a71e-4eb5-a6f7-71ab4bfd2d6a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-51996", "type": "seen", "source": "https://t.me/cvedetector/10850", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-51996 - Symphony Remote Code Execution through Authentication Bypass\", \n  \"Content\": \"CVE ID : CVE-2024-51996 \nPublished : Nov. 13, 2024, 5:15 p.m. | 38\u00a0minutes ago \nDescription : Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. When consuming a persisted remember-me cookie, Symfony does not check if the username persisted in the database matches the username attached with the cookie, leading to authentication bypass. This vulnerability is fixed in 5.4.47, 6.4.15, and 7.1.8. \nSeverity: 7.5 | HIGH \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"13 Nov 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-11-13T18:54:23.000000Z"}, {"uuid": "6cc81298-d1b0-4c4f-a22c-f7e006014e29", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-51990", "type": "seen", "source": "https://t.me/cvedetector/10053", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-51990 - \"jj Git Write Outside Directory Vulnerability\"\", \n  \"Content\": \"CVE ID : CVE-2024-51990 \nPublished : Nov. 7, 2024, 1:15 a.m. | 25\u00a0minutes ago \nDescription : jj, or Jujutsu, is a Git-compatible VCS written in rust. In affected versions specially crafted Git repositories can cause `jj` to write files outside the clone. This issue has been addressed in version 0.23.0. Users are advised to upgrade. Users unable to upgrade should avoid cloning repos from unknown sources. \nSeverity: 0.0 | NA \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"07 Nov 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-11-07T02:42:17.000000Z"}, {"uuid": "dddd0eb7-26d8-4c96-869e-66a64db58400", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-51997", "type": "seen", "source": "https://t.me/cvedetector/10219", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-51997 - Apache Trustee JWT Tampering Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2024-51997 \nPublished : Nov. 8, 2024, 7:15 p.m. | 39\u00a0minutes ago \nDescription : Trustee is a set of tools and components for attesting confidential guests and providing secrets to them. The ART (**Attestation Results Token**) token, generated by AS, could be manipulated by MITM attacker, but the verifier (CoCo Verification Demander like KBS) could still verify it successfully. In the payload of ART token, the \u2018jwk\u2019 could be replaced by attacker with his own pub key. Then attacker can use his own corresponding private key to sign the crafted ART token. Based on current code implementation (v0.8.0), such replacement and modification can not be detected. This issue has been addressed in version 0.8.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability. \nSeverity: 8.1 | HIGH \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"08 Nov 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-11-08T21:23:29.000000Z"}, {"uuid": "a7c1a5b3-3dcb-42a7-9fcc-dbee76e76f15", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-51998", "type": "seen", "source": "https://t.me/cvedetector/10148", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-51998 - changedetection.io allowing read access to arbitrary system files via file URI scheme.\", \n  \"Content\": \"CVE ID : CVE-2024-51998 \nPublished : Nov. 8, 2024, 12:15 a.m. | 35\u00a0minutes ago \nDescription : changedetection.io is a free open source web page change detection tool. The validation for the file URI scheme falls short, and results in an attacker being able to read any file on the system. This issue only affects instances with a webdriver enabled, and `ALLOW_FILE_URI` false or not defined. The check used for URL protocol, `is_safe_url`, allows `file:` as a URL scheme. It later checks if local files are permitted, but one of the preconditions for the check is that the URL starts with `file://`. The issue comes with the fact that the file URI scheme is not required to have double slashes. This issue has been addressed in version 0.47.06 and all users are advised to upgrade. There are no known workarounds for this vulnerability. \nSeverity: 8.6 | HIGH \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"08 Nov 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-11-08T02:08:16.000000Z"}, {"uuid": "35f94170-bf87-479d-93b6-e66a8e22b98a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-51995", "type": "seen", "source": "https://t.me/cvedetector/10108", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-51995 - Combodo iTop Route-Traversing Web Application Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2024-51995 \nPublished : Nov. 7, 2024, 6:15 p.m. | 45\u00a0minutes ago \nDescription : Combodo iTop is a web based IT Service Management tool. An attacker can request any `route` we want as long as we specify an `operation` that is allowed. This issue has been addressed in version 3.2.0 by applying the same access control pattern as in `UI.php` to the `ajax.render.php` page which does not allow arbitrary `routes` to be dispatched. All users are advised to upgrade. There are no known workarounds for this vulnerability. \nSeverity: 7.1 | HIGH \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"07 Nov 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-11-07T20:16:51.000000Z"}, {"uuid": "9199a89a-3523-41b9-bee8-d996dcff7aa0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-51993", "type": "seen", "source": "https://t.me/cvedetector/10107", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-51993 - Combodo iTop Clear Text Password Storage\", \n  \"Content\": \"CVE ID : CVE-2024-51993 \nPublished : Nov. 7, 2024, 6:15 p.m. | 45\u00a0minutes ago \nDescription : Combodo iTop is a web based IT Service Management tool. An attacker accessing a backup file or the database can read some passwords for misconfigured Users. This issue has been addressed in version 3.2.0 and all users are advised to upgrade. Users unable to upgrade are advised to encrypt their backups independently of the iTop application.  \n  \n### Patches  \nSanitize parameter  \n  \n### References  \nN\u00b07631 - Password is stored in clear in the database. \nSeverity: 3.4 | LOW \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"07 Nov 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-11-07T20:16:50.000000Z"}, {"uuid": "52219c69-3f9a-4659-8fd9-e57c1035fb95", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-51994", "type": "seen", "source": "https://t.me/cvedetector/10106", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-51994 - iTop Cross-Site Scripting (XSS)\", \n  \"Content\": \"CVE ID : CVE-2024-51994 \nPublished : Nov. 7, 2024, 6:15 p.m. | 45\u00a0minutes ago \nDescription : Combodo iTop is a web based IT Service Management tool. In affected versions uploading a text file containing some java script in the portal will trigger an Cross-site Scripting (XSS) vulnerability. This issue has been addressed in version 3.2.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability. \nSeverity: 7.1 | HIGH \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"07 Nov 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-11-07T20:16:49.000000Z"}, {"uuid": "81fb2f67-0bfb-4493-ba81-b57651c76c8f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-51996", "type": "published-proof-of-concept", "source": "Telegram/ZJp_VCEhaga9OM9NBvz45K3ssC6nL69JeV_dGqoHwNSpsGU", "content": "", "creation_timestamp": "2025-04-15T05:00:08.000000Z"}, {"uuid": "ed172417-c869-4b87-b261-e3e3c20fd62a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-51996", "type": "published-proof-of-concept", "source": "Telegram/mIQYUSqdZG0qC4ccPPwRpa360xwamTmZCIxoO7vEILe4Sa0", "content": "", "creation_timestamp": "2025-04-15T05:00:10.000000Z"}, {"uuid": "c1750866-1d22-4548-8874-dcf71c8011a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-51991", "type": "seen", "source": "https://t.me/cvedetector/24471", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-51991 - October Media Manager SVG Upload Bypass\", \n  \"Content\": \"CVE ID : CVE-2024-51991 \nPublished : May 5, 2025, 5:18 p.m. | 16\u00a0minutes ago \nDescription : October is a Content Management System (CMS) and web platform. A vulnerability in versions prior to 3.7.5 affects authenticated administrators with sites that have the `media.clean_vectors` configuration enabled. This configuration will sanitize SVG files uploaded using the media manager. This vulnerability allows an authenticated user to bypass this protection by uploading it with a permitted extension (for example, .jpg or .png) and later modifying it to the .svg extension. This vulnerability assumes a trusted user will attack another trusted user and cannot be actively exploited without access to the administration panel and interaction from the other user. This issue has been patched in v3.7.5. \nSeverity: 0.0 | NA \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"05 May 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-05-05T20:03:52.000000Z"}, {"uuid": "5ea8262b-8669-4d09-9682-b790cef8d23c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "4f29edb9-4c4b-44ca-b041-9b050656b6ae", "vulnerability": "CVE-2024-51999", "type": "seen", "source": "https://gist.github.com/Adcbda/3e82259b6deb6a426fbb5c89ed5ded87", "content": "", "creation_timestamp": "2026-05-08T07:36:05.000000Z"}, {"uuid": "d742d18d-5ee5-45f3-80c9-5c28b3d3d108", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "4f29edb9-4c4b-44ca-b041-9b050656b6ae", "vulnerability": "CVE-2024-51999", "type": "seen", "source": "https://gist.github.com/Adcbda/1903b9267561971f4b148df4c6e3182f", "content": "", "creation_timestamp": "2026-05-09T02:43:21.000000Z"}, {"uuid": "62d8d437-f1d2-437c-81a2-d18e0ca88f13", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "4f29edb9-4c4b-44ca-b041-9b050656b6ae", "vulnerability": "CVE-2024-51999", "type": "seen", "source": "https://gist.github.com/Adcbda/8715cb3a2a149d295bc127dde35f13d6", "content": "", "creation_timestamp": "2026-05-09T02:54:50.000000Z"}]}