Skip to the content.
Home /

DIVD CSIRT

Making the internet safer through Coordinated Vulnerability Disclosure

Menu
  • Home
    • DIVD
    • CSIRT
  • Cases
    • DIVD-2024-00047 - Multiple critical vulnerablilties in Palo Alto Networks P
      An authentication bypass in Palo Alto Networks PAN-OS software (CVE-2024-00...
    • DIVD-2024-00046 - Multiple critical vulnerablilties in Ivanti Cloud Service
      Ivanti CSA is affected by two critical vulnerabilities, allowing a remote u...
    • DIVD-2024-00045 - SysAid ITSM SQL Injection vulnerability
      In May 2024, a SQL Injection vulnerability has been discovered in SysAid IT...
    • DIVD-2024-00044 - Missing authentication in Fortinet FortiManager fgfmsd
      A missing authentication for critical function vulnerability [CWE-306] in F...
    • DIVD-2024-00042 - Multiple critical vulnerabilities in Solarwinds Web Help
      The SolarWinds Web Help Desk software is affected by three critical vulnera...
    • DIVD-2024-00041 - Progress Software WhatsUp Gold SQL Injection Authenticati
      A SQL Injection vulnerability allows an unauthenticated attacker to retriev...
    • DIVD-2024-00040 - Zimbra Collaboration (ZCS) vulnerable for RCE under speci
      The postjournal in Zimbra Collaboration (ZCS) sometimes allows unauthentica...
    • DIVD-2024-00039 - Incorrect authorization vulnerability in Apache OFBiz res
      In Apache OFBiz, version 18.12.14 and below, an Incorrect Authorization vul...
    • DIVD-2024-00038 - Remote Code Execution CUPS
      A remote attacker can replace or install printers with malicious IPP URLs, ...
    • DIVD-2024-00033 - ServiceNow - unauthenticated remote code execution (RCE)
      Multiple vulnerabilities have been found in ServiceNow. Combining these vul...
    • DIVD-2024-00032 - Unauthenticated Remote Code Execution (RCE) vulnerability
      Geoserver has a Remote Code Execution (RCE) vulnerability in evaluating pro...
    • DIVD-2024-00031 - Unauthenticated Local File Inclusion vulnerability in Com
      A Local File Inclusion vulnerability has been found in ComfortKey, a produc...
    • DIVD-2024-00030 - Zyxel NAS - unauthenticated OS command injection
      Multiple vulnerabilities have been found in the firmware of the Zyxel NAS d...
    • DIVD-2024-00029 - VMware vCenter Server multiple heap-overflow vulnerabilit
      The vCenter Server contains multiple heap-overflow vulnerabilities in the i...
    • DIVD-2024-00028 - Local File Inclusion in SolarWinds U-Serv
      SolarWinds U-Serv was susceptible to a Path Traversal vulnerability, result...
    • DIVD-2024-00026 - Unauthenticated RCE in Rejetto HTTP File Server
      In Rejetto HTTP File Server, version 2.3x up to 2.4 RC07, a vulnerability e...
    • DIVD-2024-00025 - QNAP - OS command injection as Admin user possible via qu
      Two OS command injection vulnerabilities via quick.cgi file are found in QN...
    • DIVD-2024-00024 - Multiple vulnerabilities found in the SOPlanning tool
      In the SOPlanning Online Planning tool, multiple critical vulnerabilities w...
    • DIVD-2024-00023 - Authentication Bypass Vulnerability in Progress Telerik R
      In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier...
    • DIVD-2024-00022 - Millions of credentials scraped from Telegram
      DIVD was contacted by a source, who scraped millions of credentials from Te...
    • All cases
  • CVEs
    • CVE-2024-27120 - Local File Inclusion in ComfortKey before version 24.1.2...
    • CVE-2024-27115 - Remote Code Execution through File Upload in SOPlanning befo...
    • CVE-2024-27114 - Remote Code Execution through File Upload in SOPlanning befo...
    • CVE-2024-27113 - Insecure Direct Object Reference to export Database in SOPla...
    • CVE-2024-27112 - SQL Injection in SOPlanning before 1.52.02...
    • CVE-2024-21881 - Upload of encrypted packages allows authenticated command ex...
    • CVE-2024-21880 - URL parameter manipulations allows an authenticated attacker...
    • CVE-2024-21879 - URL parameter manipulations allows an authenticated attacker...
    • CVE-2024-21878 - Command Injection through Unsafe File Name Evaluation in int...
    • CVE-2024-21877 - Insecure File Generation Based on User Input in Enphase IQ G...
    • More...
  • CNA
  • Stolen credentials
  • Blog
    • 2024-08-12 : Research of Wietse Boonstra and Hidde Smit featured in Follow the Money and...
    • 2024-05-30 : DIVD CSIRT performs victim notification for Operation Endgame...
    • 2024-04-25 : DIVD CSIRT Congratulates Project Melissa...
    • 2023-07-10 : Limited disclosure of 6 vulnerabilities in OSNexus Quantastor...
    • 2023-02-24 : DIVD’s response regard the involvement of a DIVD volunteer in a major data ...
    • 2023-01-18 : Fox-IT and DIVD cooperate to warn owners of vulnerable Citrix servers...
    • 2022-12-14 : Fortinet sslvpnd vulnerability - update...
    • 2022-12-13 : Fortinet SSL VPN Vulnerability...
    • 2022-08-15 : Closing GeyNoise Ukraine Only case...
    • 2022-08-10 : Itarian Full disclosure...
    • More...
  • Donate
  • Search...
  • RSS
  • Contact

    •  Twitter
    •  LinkedIn