NVD disclosure day

Published threat advisories for December 12, 2024

CVE-2024-55875

http4k XXE Vulnerability Allows Sensitive Data Disclosure and Server-Side Request Forgery

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

A vulnerability in the http4k toolkit for Kotlin HTTP applications allows for denial-of-service attacks when processing untrusted XML. Attackers can exploit this by sending specially crafted XML with doctype declarations, potentially exhausting server resources. Readers should verify if their Kotlin HTTP applications u

NVD modified: NVD date unavailable

CVE advisoryKnown Exploit

CVE-2024-49138

Windows CLFS Driver Elevation of Privilege Vulnerability.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

A vulnerability in the Windows Common Log File System Driver allows an attacker with local access to escalate privileges. This could impact system integrity and data confidentiality, posing a significant business risk. Prompt application of vendor updates is recommended.

NVD modified: NVD date unavailable • CISA KEV