Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,242 results · page 10 of 25
Oct 1, 2024eLabFTW is an open source electronic lab notebook for research labs.CVE-2024-25632 · Other software · elabftw · reported by GitHubHigh 8.6
eLabFTW is an open source electronic lab notebook for research labs. In the context of eLabFTW, an administrator is a user account with certain privileges to manage users and content in their assigned team/teams. A user may be an administrator in one team and a regular user in another. The vulnerability allows a regular user to become administrator of a team where they are a member, under a reasonable configuration. Additionally, in eLabFTW versions subsequent to v5.0.0, the vulnerability may allow an initially unauthenticated user to gain administrative privileges over an arbitrary team. The vulnerability does not affect system administrator status. Users should upgrade to version 5.1.0. System administrators are advised to turn off local user registration, saml_team_create and not allow administrators to import users into teams, unless strictly required.
- Product
- elabftw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2024Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Ece Software Electronic Ticket System allows ReflecCVE-2024-7785 · Other software · Ece Software · reported by iletisim@usom.gov.trCritical 9.3
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Ece Software Electronic Ticket System allows Reflected XSS, Cross-Site Scripting (XSS). This issue affects Electronic Ticket System: before 2024.08.
- Product
- Electronic Ticket System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Sep 16, 2024Mattermost Desktop App versions <=5.8.0 fail to sufficiently configure Electron Fuses which allows an attacker to gather Chromium cookies or abuse other misconfCVE-2024-45835 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comLow 2.5
Mattermost Desktop App versions <=5.8.0 fail to sufficiently configure Electron Fuses which allows an attacker to gather Chromium cookies or abuse other misconfigurations via remote/local access.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024Improper Control of Generation of Code ('Code Injection') in Electron Fuses in Logitech Options Plus version 1.60.496306 on macOS allows attackers to execute arCVE-2024-8258 · Other software · Logitech · reported by cve-coordination@logitech.comLow 2
Improper Control of Generation of Code ('Code Injection') in Electron Fuses in Logitech Options Plus version 1.60.496306 on macOS allows attackers to execute arbitrary code via insecure Electron Fuses configuration.
- Product
- Logitech Options Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Sep 2, 2024The Electron desktop application of Rocket.Chat through 6.3.4 allows stored XSS via links in an uploaded file, related to failure to use a separate browser uponCVE-2024-45621 · Other software · Rocket.chat · reported by MITREMedium 5.4
The Electron desktop application of Rocket.Chat through 6.3.4 allows stored XSS via links in an uploaded file, related to failure to use a separate browser upon encountering third-party external actions from PDF documents.
- Product
- Rocket.chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comhackerone.com
Sep 2, 2024eLabFTW is an open source electronic lab notebook for research labs.CVE-2024-28100 · Other software · elabftw · reported by GitHubHigh 8.9
eLabFTW is an open source electronic lab notebook for research labs. By uploading specially crafted files, a regular user can create a circumstance where a visitor's browser runs arbitrary JavaScript code in the context of the eLabFTW application. This can be triggered by the visitor viewing a list of experiments. Viewing this allows the malicious script to act on behalf of the visitor in any way, including the creation of API keys for persistence, or other options normally available to the user. If the user viewing the page has the sysadmin role in eLabFTW, the script can act as a sysadmin (including system configuration and extensive user management roles). Users are advised to upgrade to at least version 5.0.0. There are no known workarounds for this vulnerability.
- Product
- elabftw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2024Delta Electronics DTN Soft version 2.0.1 and prior are vulnerable to an attacker achieving remote code execution through a deserialization of untrusted data vulCVE-2024-8255 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.4
Delta Electronics DTN Soft version 2.0.1 and prior are vulnerable to an attacker achieving remote code execution through a deserialization of untrusted data vulnerability.
- Product
- DTN Soft
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 15, 2024eLabFTW is an open source electronic lab notebook for research labs.CVE-2024-25633 · Other software · elabftw · reported by GitHubMedium 5.4
eLabFTW is an open source electronic lab notebook for research labs. In an eLabFTW system, one can configure who is allowed to create new user accounts. A vulnerability has been found starting in version 4.4.0 and prior to version 5.0.0 that allows regular users to create new, validated accounts in their team. If the system has anonymous access enabled (disabled by default) an unauthenticated user can create regular users in any team. This vulnerability has been fixed since version 5.0.0, released on February 17th 2024. Some workarounds are available. Disabling both options that allow *administrators* to create users will provide a mitigation. Additionally, disabling anonymous user access will stop anonymous access (including using existing access keys).
- Product
- elabftw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2024Authentication Bypass Using an Alternate Path or Channel vulnerability in GST Electronics inohom Nova Panel N7 allows Authentication Bypass.CVE-2024-6684 · Other software · GST Electronics · reported by iletisim@usom.gov.trCritical 9.9
Authentication Bypass Using an Alternate Path or Channel vulnerability in GST Electronics inohom Nova Panel N7 allows Authentication Bypass. This issue affects inohom Nova Panel N7: through 1.9.9.6. NOTE: The vendor was contacted and it was learned that the product is not supported.
- Product
- inohom Nova Panel N7
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Aug 6, 2024A crafted DPA file could force Delta Electronics DIAScreen to overflow a stack-based buffer, which could allow an attacker to execute arbitrary code.CVE-2024-7502 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.5
A crafted DPA file could force Delta Electronics DIAScreen to overflow a stack-based buffer, which could allow an attacker to execute arbitrary code.
- Product
- DIAScreen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2024WD Discovery versions prior to 5.0.589 contain a misconfiguration in the Node.js environment settings that could allow code execution by utilizing the 'ELECTRONCVE-2024-22169 · Network & remote access · Western Digital · reported by psirt@wdc.comHigh 7.1
WD Discovery versions prior to 5.0.589 contain a misconfiguration in the Node.js environment settings that could allow code execution by utilizing the 'ELECTRON_RUN_AS_NODE' environment variable. Any malicious application operating with standard user permissions can exploit this vulnerability, enabling code execution within WD Discovery application's context. WD Discovery version 5.0.589 addresses this issue by disabling certain features and fuses in Electron. The attack vector for this issue requires the victim to have the WD Discovery app installed on their device.
- Product
- WD Discovery
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2024Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mikafon Electronic Inc.CVE-2024-6699 · Other software · Mikafon Electronic Inc. · reported by iletisim@usom.gov.trCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mikafon Electronic Inc. Mikafon MA7 allows SQL Injection. This issue affects Mikafon MA7: from v3.0 before v3.1.
- Product
- Mikafon MA7
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Jul 14, 2024The access control in the Electronic Official Document Management System from 2100 TECHNOLOGY is not properly implemented, allowing remote attackers with regulCVE-2024-6737 · Other software · 2100 TECHNOLOGY · reported by twcert@cert.org.twHigh 8.8
The access control in the Electronic Official Document Management System from 2100 TECHNOLOGY is not properly implemented, allowing remote attackers with regular privileges to access the account settings functionality and create an administrator account.
- Product
- Electronic Official Document Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Jul 9, 2024Delta Electronics CNCSoft-G2 lacks proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer.CVE-2024-39883 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.4
Delta Electronics CNCSoft-G2 lacks proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. If a target visits a malicious page or opens a malicious file an attacker can leverage this vulnerability to execute code in the context of the current process.
- Product
- CNCSoft-G2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2024Delta Electronics CNCSoft-G2 lacks proper validation of user-supplied data, which can result in a read past the end of an allocated buffer.CVE-2024-39882 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.4
Delta Electronics CNCSoft-G2 lacks proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. If a target visits a malicious page or opens a malicious file an attacker can leverage this vulnerability to execute code in the context of the current process.
- Product
- CNCSoft-G2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2024Delta Electronics CNCSoft-G2 lacks proper validation of user-supplied data, which can result in a memory corruption condition.CVE-2024-39881 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.4
Delta Electronics CNCSoft-G2 lacks proper validation of user-supplied data, which can result in a memory corruption condition. If a target visits a malicious page or opens a malicious file an attacker can leverage this vulnerability to execute code in the context of the current process.
- Product
- CNCSoft-G2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2024Delta Electronics CNCSoft-G2 lacks proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer.CVE-2024-39880 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.4
Delta Electronics CNCSoft-G2 lacks proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. If a target visits a malicious page or opens a malicious file an attacker can leverage this vulnerability to execute code in the context of the current process.
- Product
- CNCSoft-G2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2024electron-updater allows for automatic updates for Electron apps.CVE-2024-39698 · Other software · electron-userland · reported by GitHubHigh 7.5
electron-updater allows for automatic updates for Electron apps. The file `packages/electron-updater/src/windowsExecutableCodeSignatureVerifier.ts` implements the signature validation routine for Electron applications on Windows. Because of the surrounding shell, a first pass by `cmd.exe` expands any environment variable found in command-line above. This creates a situation where `verifySignature()` can be tricked into validating the certificate of a different file than the one that was just downloaded. If the step is successful, the malicious update will be executed even if its signature is invalid. This attack assumes a compromised update manifest (server compromise, Man-in-the-Middle attack if fetched over HTTP, Cross-Site Scripting to point the application to a malicious updater server, etc.). The patch is available starting from 6.3.0-alpha.6.
- Product
- electron-builder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 5, 2024Lukas Bach yana =<1.0.16 is vulnerable to Cross Site Scripting (XSS) via src/electron-main.ts.CVE-2024-23997 · Other software · lukasbach · reported by MITRECritical 9.6
Lukas Bach yana =<1.0.16 is vulnerable to Cross Site Scripting (XSS) via src/electron-main.ts.
- Product
- yana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2024Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LG Electronics SuperSign CMS allows Reflected XSS.CVE-2024-6179 · Other software · LG Electronics · reported by product.security@lge.comMedium 4.8
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LG Electronics SuperSign CMS allows Reflected XSS. This issue affects SuperSign CMS: from 4.1.3 before < 4.3.1.
- Product
- SuperSign CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlgsecurity.lge.comlgsecurity.lge.com
Jun 19, 2024Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LG Electronics SuperSign CMS allows Reflected XSS.CVE-2024-6178 · Other software · LG Electronics · reported by product.security@lge.comMedium 4.8
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LG Electronics SuperSign CMS allows Reflected XSS. This issue affects SuperSign CMS: from 4.1.3 before < 4.3.1.
- Product
- SuperSign CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlgsecurity.lge.comlgsecurity.lge.com
Jun 19, 2024Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in LG Electronics SuperSign CMS allows Reflected XSS.CVE-2024-6177 · Other software · LG Electronics · reported by product.security@lge.comMedium 4.8
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in LG Electronics SuperSign CMS allows Reflected XSS. This issue affects SuperSign CMS: from 4.1.3 before < 4.3.1.
- Product
- SuperSign CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlgsecurity.lge.comlgsecurity.lge.com
Jun 19, 2024Allocation of Resources Without Limits or Throttling vulnerability in LG Electronics LG SuperSign CMS allows Port Scanning.This issue affects LG SuperSign CMS: CVE-2024-6176 · Other software · LG Electronics · reported by product.security@lge.comMedium 4.8
Allocation of Resources Without Limits or Throttling vulnerability in LG Electronics LG SuperSign CMS allows Port Scanning.This issue affects LG SuperSign CMS: from 4.1.3 before < 4.3.1.
- Product
- LG SuperSign CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlgsecurity.lge.comlgsecurity.lge.com
Jun 14, 2024A vulnerability was found in Guangdong Baolun Electronics IP Network Broadcasting Service Platform 2.0.CVE-2024-6003 · Other software · Guangdong Baolun Electronics · reported by VulDBMedium 6.9
A vulnerability was found in Guangdong Baolun Electronics IP Network Broadcasting Service Platform 2.0. It has been classified as critical. Affected is an unknown function of the file /api/v2/maps. The manipulation of the argument orderColumn leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-268692. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- IP Network Broadcasting Service Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2024Mattermost Desktop App versions <=5.7.0 fail to disable certain Electron debug flags which allows for bypassing TCC restrictions on macOS.CVE-2024-36287 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comLow 3.8
Mattermost Desktop App versions <=5.7.0 fail to disable certain Electron debug flags which allows for bypassing TCC restrictions on macOS.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jun 13, 2024Deep Sea Electronics DSE855 Restart Missing Authentication Denial-of-Service Vulnerability.CVE-2024-5952 · Other software · Deep Sea Electronics · reported by zdi-disclosures@trendmicro.comMedium 6.5
Deep Sea Electronics DSE855 Restart Missing Authentication Denial-of-Service Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Deep Sea Electronics DSE855 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web-based UI. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-23174.
- Product
- DSE855
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzerodayinitiative.comzerodayinitiative.com
Jun 13, 2024Deep Sea Electronics DSE855 Factory Reset Missing Authentication Denial-of-Service Vulnerability.CVE-2024-5951 · Other software · Deep Sea Electronics · reported by zdi-disclosures@trendmicro.comMedium 6.5
Deep Sea Electronics DSE855 Factory Reset Missing Authentication Denial-of-Service Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Deep Sea Electronics DSE855 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web-based UI. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-23173.
- Product
- DSE855
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzerodayinitiative.comzerodayinitiative.com
Jun 13, 2024Deep Sea Electronics DSE855 Multipart Value Handling Stack-Based Buffer Overflow Remote Code Execution Vulnerability.CVE-2024-5950 · Other software · Deep Sea Electronics · reported by zdi-disclosures@trendmicro.comHigh 8.8
Deep Sea Electronics DSE855 Multipart Value Handling Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Deep Sea Electronics DSE855 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of multipart form variables. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-23172.
- Product
- DSE855
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzerodayinitiative.comzerodayinitiative.com
Jun 13, 2024Deep Sea Electronics DSE855 Multipart Boundary Infinite Loop Denial-of-Service Vulnerability.CVE-2024-5949 · Other software · Deep Sea Electronics · reported by zdi-disclosures@trendmicro.comMedium 6.5
Deep Sea Electronics DSE855 Multipart Boundary Infinite Loop Denial-of-Service Vulnerability. This vulnerability allows network-adjacent attackers to create a denial-of-service condition on affected installations of Deep Sea Electronics DSE855 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of multipart boundaries. The issue results from a logic error that can lead to an infinite loop. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-23171.
- Product
- DSE855
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzerodayinitiative.comzerodayinitiative.com
Jun 13, 2024Deep Sea Electronics DSE855 Multipart Boundary Stack-Based Buffer Overflow Remote Code Execution Vulnerability.CVE-2024-5948 · Other software · Deep Sea Electronics · reported by zdi-disclosures@trendmicro.comHigh 8.8
Deep Sea Electronics DSE855 Multipart Boundary Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Deep Sea Electronics DSE855 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of multipart boundaries. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-23170.
- Product
- DSE855
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzerodayinitiative.comzerodayinitiative.com
Jun 13, 2024Deep Sea Electronics DSE855 Configuration Backup Missing Authentication Information Disclosure Vulnerability.CVE-2024-5947 · Other software · Deep Sea Electronics · reported by zdi-disclosures@trendmicro.comMedium 6.5
Deep Sea Electronics DSE855 Configuration Backup Missing Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Deep Sea Electronics DSE855 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web-based UI. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-22679.
- Product
- DSE855
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzerodayinitiative.comzerodayinitiative.com
May 6, 2024A denial of service vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior.CVE-2024-4549 · Other software · Delta Electronics · reported by vulnreport@tenable.comHigh 7.5
A denial of service vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior. When processing an 'ICS Restart!' message, CEBC.exe restarts the system.
- Product
- DIAEnergie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
May 6, 2024An SQLi vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior when CEBC.exe processes a 'RecalculateHDMWYC' message, which is split into 4CVE-2024-4548 · Other software · Delta Electronics · reported by vulnreport@tenable.comCritical 9.8
An SQLi vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior when CEBC.exe processes a 'RecalculateHDMWYC' message, which is split into 4 fields using the '~' character as the separator. An unauthenticated remote attacker can perform SQLi via the fourth field.
- Product
- DIAEnergie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
May 6, 2024A SQLi vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior when CEBC.exe processes a 'RecalculateScript' message, which is splitted intoCVE-2024-4547 · Other software · Delta Electronics · reported by vulnreport@tenable.comCritical 9.8
A SQLi vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior when CEBC.exe processes a 'RecalculateScript' message, which is splitted into 4 fields using the '~' character as the separator. An unauthenticated remote attacker can perform SQLi via the fourth field
- Product
- DIAEnergie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
May 2, 2024 Delta Electronics DIAEnergie has insufficient input validation which makes it possible to perform a path traversal attack and write outside of the intended dirCVE-2024-34033 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.8
Delta Electronics DIAEnergie has insufficient input validation which makes it possible to perform a path traversal attack and write outside of the intended directory. If a file name is specified that already exists on the file system, then the original file will be overwritten.
- Product
- DIAEnergie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2024 Delta Electronics DIAEnergie is vulnerable to an SQL injection vulnerability that exists in the GetDIACloudList endpoint.CVE-2024-34032 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.8
Delta Electronics DIAEnergie is vulnerable to an SQL injection vulnerability that exists in the GetDIACloudList endpoint. An authenticated attacker can exploit this issue to potentially compromise the system on which DIAEnergie is deployed.
- Product
- DIAEnergie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2024 Delta Electronics DIAEnergie is vulnerable to an SQL injection vulnerability that exists in the script Handler_CFG.ashx.CVE-2024-34031 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.8
Delta Electronics DIAEnergie is vulnerable to an SQL injection vulnerability that exists in the script Handler_CFG.ashx. An authenticated attacker can exploit this issue to potentially compromise the system on which DIAEnergie is deployed.
- Product
- DIAEnergie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2024 Delta Electronics CNCSoft-G2 lacks proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer.CVE-2024-4192 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 7.8
Delta Electronics CNCSoft-G2 lacks proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.
- Product
- CNCSoft-G2 DOPSoft
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2024Insecure Permissions vulnerability in Guangzhou Yingshi Electronic Technology Co.CVE-2024-33435 · Other software · guangzhou_yingshi_electronic_technology · reported by MITRECritical 9.8
Insecure Permissions vulnerability in Guangzhou Yingshi Electronic Technology Co. Ncast Yingshi high-definition intelligent recording and playback system 2007-2017 allows a remote attacker to execute arbitrary code via the /manage/IPSetup.php backend function
- Product
- ncast_yingshi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2024The Delta Electronics DVW-W02W2-E2 devices expose a web administration interface to users.CVE-2024-3871 · Other software · Deltra Electronics · reported by research@onekey.comCritical 9.8
The Delta Electronics DVW-W02W2-E2 devices expose a web administration interface to users. This interface implements multiple features that are affected by command injections and stack overflows vulnerabilities. Successful exploitation of these flaws would allow remote unauthenticated attackers to gain remote code execution with elevated privileges on the affected devices. This issue affects DVW-W02W2-E2 through version 2.5.2.
- Product
- DVW-W02W2-E2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2024Cross Site Scripting (XSS) vulnerability in Advanced REST Client v.17.0.9 allows a remote attacker to execute arbitrary code and obtain sensitive information viCVE-2024-25503 · Other software · advanced-rest-client · reported by MITREMedium 4.7
Cross Site Scripting (XSS) vulnerability in Advanced REST Client v.17.0.9 allows a remote attacker to execute arbitrary code and obtain sensitive information via a crafted script to the edit details parameter of the New Project function.
- Product
- arc-electron
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2024 SQL injection vulnerability exists in GetDIAE_usListParameters.CVE-2024-25574 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.8
SQL injection vulnerability exists in GetDIAE_usListParameters.
- Product
- DIAEnergie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 29, 2024Electron Packager bundles Electron-based application source code with a renamed Electron executable and supporting files into folders ready for distribution.CVE-2024-29900 · Other software · electron · reported by GitHubHigh 7.5
Electron Packager bundles Electron-based application source code with a renamed Electron executable and supporting files into folders ready for distribution. A random segment of ~1-10kb of Node.js heap memory allocated either side of a known buffer will be leaked into the final executable. This memory _could_ contain sensitive information such as environment variables, secrets files, etc. This issue is patched in 18.3.1.
- Product
- packager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2024This vulnerability allows remote attackers to traverse paths via file upload on the affected LG LED Assistant.CVE-2024-2863 · Other software · LG Electronics · reported by product.security@lge.comMedium 5.3
This vulnerability allows remote attackers to traverse paths via file upload on the affected LG LED Assistant.
- Product
- LG LED Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlgsecurity.lge.comlgsecurity.lge.com
Mar 25, 2024 This vulnerability allows remote attackers to reset the password of anonymous users without authorization on the affected LG LED Assistant.CVE-2024-2862 · Other software · LG Electronics · reported by product.security@lge.comCritical 9.1
This vulnerability allows remote attackers to reset the password of anonymous users without authorization on the affected LG LED Assistant.
- Product
- LG LED Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlgsecurity.lge.comlgsecurity.lge.com
Mar 23, 2024ClickUp Desktop before 3.3.77 on macOS and Windows allows code injection because of specific Electron Fuses.CVE-2024-23755 · Other software · clickup · reported by MITREHigh 8.8
ClickUp Desktop before 3.3.77 on macOS and Windows allows code injection because of specific Electron Fuses. There is inadequate protection against code injection through settings such as RunAsNode.
- Product
- desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordclickup.comclickup.com
Mar 21, 2024 It is possible to perform a path traversal attack and write outside of the intended directory.CVE-2024-28171 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.1
It is possible to perform a path traversal attack and write outside of the intended directory. If a file name is specified that already exists on the file system, then the original file will be overwritten.
- Product
- DIAEnergie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2024 Improper neutralization of input within the affected product could lead to cross-site scripting.CVE-2024-28045 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govMedium 4.6
Improper neutralization of input within the affected product could lead to cross-site scripting.
- Product
- DIAEnergie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2024 SQL injection vulnerability exists in GetDIAE_astListParameters.CVE-2024-28040 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.8
SQL injection vulnerability exists in GetDIAE_astListParameters.
- Product
- DIAEnergie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2024 Path traversal attack is possible and write outside of the intended directory and may access sensitive information.CVE-2024-25567 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.1
Path traversal attack is possible and write outside of the intended directory and may access sensitive information. If a file name is specified that already exists on the file system, then the original file will be overwritten.
- Product
- DIAEnergie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.