Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

Tenable Research

CERT/CC

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit BlueTeam

Reddit ThreatIntel

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

librechat

A vulnerability in danny-avila/librechat version git a1647d7 allows an unauthenticated attacker to cause a denial of service by sending a crafted payload to the server. The middleware `checkBan` is not surrounded by a try-catch block, and an unhandled exception will cause the server to crash. This issue is fixed in version 0.7.6.

CVE-2024-11172 is a vulnerability identified in the open-source project danny-avila/librechat, specifically in the middleware function named 'checkBan'. The vulnerability is classified under CWE-248, which pertains to uncaught exceptions. In this case, the middleware does not implement a try-catch block around its logic, so when it encounters a crafted malicious payload, it throws an unhandled exception. This unhandled exception causes the entire server process to crash, resulting in a denial of service (DoS) condition. The vulnerability can be exploited remotely by an unauthenticated attacker, as no privileges or user interaction are required. The CVSS v3.0 base score is 7.5, reflecting a high severity due to the ease of exploitation and the complete loss of availability. The vulnerability affects unspecified versions prior to 0.7.6, where the issue has been addressed by adding proper exception handling. Although there are no reports of active exploitation in the wild, the nature of the vulnerability makes it a significant risk for any deployment of librechat, especially in production environments. The lack of confidentiality or integrity impact means data is not exposed or altered, but the service disruption can affect business continuity and user experience. The vulnerability highlights the importance of defensive programming practices, such as comprehensive exception handling in middleware components that process external input.

Detailed information about CVE-2024-11172: CWE-248 Uncaught Exception in danny-avila danny-avila/librechat affecting danny-avila danny-avila/librechat. Get real

CVE-2024-11172: CWE-248 Uncaught Exception in danny-avila danny-avila/librechat - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2024-11172: CWE-248 Uncaught Exception in danny-avila danny-avila/librechat

Threats Tagged 'cve-2024-11172'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'cve-2024-11172'

Lead Pen Test Professional