Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

mipjz

An issue was discovered in mipjz 5.0.5. In the push method of app\tag\controller\ApiAdminTag.php the value of the postAddress parameter is not processed and is directly passed into curl_exec execution and output, resulting in Server-side request forgery (SSRF) vulnerability that can read server files.

CVE-2024-48234 is a Server-Side Request Forgery (SSRF) vulnerability identified in mipjz version 5.0.5, located in the push method of the ApiAdminTag.php controller file. The vulnerability stems from improper handling of the postAddress parameter, which is accepted from user input and directly passed into the curl_exec function without any validation or sanitization. This allows an attacker with sufficient privileges to craft malicious requests that the server executes internally, potentially accessing internal resources or reading sensitive files on the server. SSRF vulnerabilities like this exploit the trust relationship between the vulnerable server and internal or external resources, enabling attackers to bypass network restrictions and access otherwise protected data. The vulnerability is classified under CWE-918 (Server-Side Request Forgery). The CVSS 3.1 base score is 4.9, indicating a medium severity level, with the vector showing network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact. No public exploits or patches have been reported at the time of publication, which suggests that organizations should proactively assess their exposure and implement mitigations. The lack of input validation on postAddress is the root cause, and the vulnerability could be exploited by authenticated users with elevated privileges to read sensitive server files, potentially leading to information disclosure.

Detailed information about CVE-2024-48234: n/a. Get real-time updates, technical details, and mitigation strategies.

CVE-2024-48234: n/a - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2024-48234: n/a

mipjz 5.0.5 is vulnerable to Cross Site Scripting (XSS) in \app\setting\controller\ApiAdminSetting.php via the ICP parameter.

CVE-2024-48233 identifies a Cross Site Scripting (XSS) vulnerability in the mipjz 5.0.5 web application, specifically within the \app\setting\controller\ApiAdminSetting.php component. The vulnerability arises from insufficient sanitization or validation of the ICP parameter, allowing attackers to inject malicious scripts. This flaw is categorized under CWE-79, which pertains to improper neutralization of input leading to XSS attacks. The CVSS 3.1 vector indicates that the attack can be executed remotely (AV:N) with low attack complexity (AC:L), but requires high privileges (PR:H) and user interaction (UI:R). The scope is changed (S:C), meaning the vulnerability can affect resources beyond the initially vulnerable component. The impact affects confidentiality and integrity to a limited extent (C:L/I:L) but does not impact availability (A:N). No patches or known exploits are currently available, suggesting the vulnerability is newly disclosed. Exploitation would typically require an authenticated administrator to interact with a crafted payload, potentially enabling script execution in the admin context, which could lead to session hijacking, unauthorized configuration changes, or further attacks within the application environment.

Detailed information about CVE-2024-48233: n/a. Get real-time updates, technical details, and mitigation strategies.

CVE-2024-48233: n/a - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2024-48233: n/a

An issue was found in mipjz 5.0.5. In the mipPost method of \app\setting\controller\ApiAdminTool.php, the value of the postAddress parameter is not processed and is directly passed into curl_exec execution and output, resulting in a Server-side request forgery (SSRF) vulnerability that can read server files.

CVE-2024-48232 is a medium-severity SSRF vulnerability identified in mipjz version 5.0.5, located in the mipPost method of the ApiAdminTool.php file. The vulnerability stems from the lack of input validation or sanitization of the postAddress parameter, which is directly passed to the curl_exec function. curl_exec is used to execute HTTP requests, and by controlling the postAddress parameter, an attacker can manipulate the server to make arbitrary HTTP requests to internal or external resources. This can lead to unauthorized reading of server files or internal services that are otherwise inaccessible externally. The vulnerability requires an attacker to have high-level privileges (PR:H) and does not require user interaction (UI:N). The CVSS vector indicates network attack vector (AV:N), low attack complexity (AC:L), and no impact on integrity or availability but a high impact on confidentiality (C:H/I:N/A:N). The flaw is categorized under CWE-918 (Server-Side Request Forgery). No patches or known exploits are currently available, but the vulnerability poses a risk to confidentiality by enabling attackers to access sensitive internal resources or files through SSRF.

Detailed information about CVE-2024-48232: n/a. Get real-time updates, technical details, and mitigation strategies.


CVE-2024-48234: n/aCVE-2024-48234 0 An issue was discovered in mipjz 5.0.5. In the push method of app\tag\controller\ApiAdminTag.php the value of the postAddress parameter is not processed and is directly passed into curl_exec execution and output, resulting in Server-side request forgery (SSRF) vulnerability that can read server files. MediumVulnerabilityChinaUnited StatesIndia+7#cve #cve-2024-48234 Join the discussion	CVE Database V5	10/25/2024, 00:00:00 UTC Added: 02/25/2026, 21:43:43 UTC
CVE-2024-48233: n/aCVE-2024-48233 0 mipjz 5.0.5 is vulnerable to Cross Site Scripting (XSS) in \app\setting\controller\ApiAdminSetting.php via the ICP parameter. MediumVulnerabilityChinaUnited StatesIndia+7#cve #cve-2024-48233 Join the discussion	CVE Database V5	10/25/2024, 00:00:00 UTC Added: 02/25/2026, 21:43:43 UTC
CVE-2024-48232: n/aCVE-2024-48232 0 An issue was found in mipjz 5.0.5. In the mipPost method of \app\setting\controller\ApiAdminTool.php, the value of the postAddress parameter is not processed and is directly passed into curl_exec execution and output, resulting in a Server-side request forgery (SSRF) vulnerability that can read server files. MediumVulnerabilityChinaUnited StatesIndia+7#cve #cve-2024-48232 Join the discussion	CVE Database V5	10/25/2024, 00:00:00 UTC Added: 02/25/2026, 21:43:43 UTC

Threat Intelligence Database

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threat Intelligence

Lead Pen Test Professional