{"vulnerability": "cve-2024-4894", "sightings": [{"uuid": "2bc882f8-0d91-4d20-b7be-b2391d2d9013", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-48948", "type": "seen", "source": "https://t.me/cvedetector/7923", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-48948 - Elliptic Node.js ECDSA Signature Validation Bypass\", \n  \"Content\": \"CVE ID : CVE-2024-48948 \nPublished : Oct. 15, 2024, 2:15 p.m. | 38\u00a0minutes ago \nDescription : The Elliptic package 6.5.7 for Node.js, in its for ECDSA implementation, does not correctly verify valid signatures if the hash contains at least four leading 0 bytes and when the order of the elliptic curve's base point is smaller than the hash, because of an _truncateToN anomaly. This leads to valid signatures being rejected. Legitimate transactions or communications may be incorrectly flagged as invalid. \nSeverity: 0.0 | NA \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"15 Oct 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-10-15T16:56:28.000000Z"}, {"uuid": "b49b7877-77a6-45b9-aa65-91288335f1f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-48944", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/9139", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2024-48944\n\ud83d\udd25 CVSS Score: N/A\n\ud83d\udd39 Description: Server-Side Request Forgery (SSRF) vulnerability in Apache Kylin. Through a kylin server, an attacker may forge a request to invoke \"/kylin/api/xxx/diag\" api on another internal host and possibly get leaked information. There are two preconditions: 1) The attacker has got admin access to a kylin server; 2) Another internal host has the \"/kylin/api/xxx/diag\" api\n\nendpoint open for service.\n\n\nThis issue affects Apache Kylin: from 5.0.0 \nthrough \n\n5.0.1.\n\nUsers are recommended to upgrade to version 5.0.2, which fixes the issue.\n\ud83d\udccf Published: 2025-03-27T15:05:57.302Z\n\ud83d\udccf Modified: 2025-03-27T16:04:00.577Z\n\ud83d\udd17 References:\n1. https://lists.apache.org/thread/1xxxtdfh9hzqsqgb1pd9grb8hvqdyc9x", "creation_timestamp": "2025-03-27T16:27:05.000000Z"}, {"uuid": "64f2429a-1c32-41d7-b8ba-9bae489382ff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-48949", "type": "seen", "source": "https://t.me/cvedetector/7540", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-48949 - Elliptic EDDSA Signature Validation Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2024-48949 \nPublished : Oct. 10, 2024, 1:15 a.m. | 43\u00a0minutes ago \nDescription : The verify function in lib/elliptic/eddsa/index.js in the Elliptic package before 6.5.6 for Node.js omits \"sig.S().gte(sig.eddsa.curve.n) || sig.S().isNeg()\" validation. \nSeverity: 0.0 | NA \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"10 Oct 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-10-10T04:12:14.000000Z"}, {"uuid": "6f807265-71c2-4ca4-87bc-b2af6316a621", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-48942", "type": "seen", "source": "https://t.me/cvedetector/7539", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-48942 - Syracom Secure Login for Jira Confluence and Bitbucket Two-Factor Authentication Pin Brute Force Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2024-48942 \nPublished : Oct. 10, 2024, 12:15 a.m. | 44\u00a0minutes ago \nDescription : The Syracom Secure Login (2FA) plugin for Jira, Confluence, and Bitbucket through 3.1.4.5 allows remote attackers to easily brute-force the 2FA PIN via the plugins/servlet/twofactor/public/pinvalidation endpoint. The last 30 and the next 30 tokens are valid. \nSeverity: 0.0 | NA \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"10 Oct 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-10-10T03:22:04.000000Z"}, {"uuid": "eb0f6098-cdd8-4193-b93b-94ffc0258550", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-48941", "type": "seen", "source": "https://t.me/cvedetector/7538", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-48941 - \"Jira Confluence Bitbucket Syracom Secure Login 2FA Bypass Vulnerability\"\", \n  \"Content\": \"CVE ID : CVE-2024-48941 \nPublished : Oct. 10, 2024, 12:15 a.m. | 44\u00a0minutes ago \nDescription : The Syracom Secure Login (2FA) plugin for Jira, Confluence, and Bitbucket through 3.1.4.5 allows remote attackers to bypass 2FA by interacting with the /rest endpoint of Jira, Confluence, or Bitbucket. In the default configuration, /rest is allowlisted. \nSeverity: 0.0 | NA \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"10 Oct 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-10-10T03:22:03.000000Z"}, {"uuid": "54cf0bca-4cf7-4b14-80c6-8ba6e69aedae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-48944", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3lld7ipbs3y2k", "content": "", "creation_timestamp": "2025-03-27T02:03:49.196359Z"}]}