Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,845 results · page 10 of 37
Nov 13, 2024macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js.CVE-2024-52300 · Other software · xwikisas · reported by GitHubCritical 9
macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. The width parameter of the PDF viewer macro isn't properly escaped, allowing XSS for any user who can edit a page. XSS can impact the confidentiality, integrity and availability of the whole XWiki installation when an admin visits the page with the malicious code. This is fixed in 2.5.6.
- Product
- macro-pdfviewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2024macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js.CVE-2024-52299 · Other software · xwikisas · reported by GitHubHigh 7.5
macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. Any user with view right on XWiki.PDFViewerService can access any attachment stored in the wiki as the "key" that is passed to prevent this is computed incorrectly, calling skip on the digest stream doesn't update the digest. This is fixed in 2.5.6.
- Product
- macro-pdfviewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2024macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js.CVE-2024-52298 · Other software · xwikisas · reported by GitHubHigh 7.5
macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. The PDF Viewer macro allows an attacker to view any attachment using the "Delegate my view right" feature as long as the attacker can view a page whose last author has access to the attachment. For this, the attacker only needs to provide the reference to a PDF file to the macro. To obtain the reference of the desired attachment, the attacker can access the Page Index, Attachments tab. Even if the UI shows N/A, the user can inspect the page and check the HTTP request that fetches the live data entries. The attachment URL is available in the returned JSON for all attachments, including protected ones and allows getting the necessary values. This vulnerability is fixed in version 2.5.6.
- Product
- macro-pdfviewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2024Insecure creation of temporary files allows local users on systems with non-default configurations to cause denial of service or set the encryption key for a fiCVE-2024-49506 · Other software · openSUSE · reported by meissner@suse.deHigh 7.3
Insecure creation of temporary files allows local users on systems with non-default configurations to cause denial of service or set the encryption key for a filesystem
- Product
- Tumbleweed
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2024A Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in openSUSE Tumbleweed MirrorCache allows the execution of CVE-2024-49505 · Other software · openSUSE · reported by meissner@suse.deMedium 5.3
A Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in openSUSE Tumbleweed MirrorCache allows the execution of arbitrary JS via reflected XSS in the REGEX and P parameters. This issue affects MirrorCache before 1.083.
- Product
- Tumbleweed
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2024grub2 allowed attackers with access to the grub shell to access files on the encrypted disks.CVE-2024-49504 · Other software · SUSE · reported by meissner@suse.deHigh 7
grub2 allowed attackers with access to the grub shell to access files on the encrypted disks.
- Product
- openSUSE Tumbleweed
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024GPX Viewer: Arbitrary file creationCVE-2024-10629 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The GPX Viewer plugin for WordPress is vulnerable to arbitrary file creation due to a missing capability check and file type validation in the gpxv_file_upload() function in all versions up to, and including, 2.2.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to create arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- GPX Viewer
- Affected
- up to 2.2.9
- What to do
- Affects up to 2.2.9. Update GPX Viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 9, 2024eewee admin custom: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51780 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eewee eewee admin custom eewee-admincustom allows Reflected XSS.This issue affects eewee admin custom: from n/a through <= 1.8.2.4.
- Product
- eewee admin custom
- Affected
- up to 1.8.2.4
- What to do
- Affects up to 1.8.2.4. Update eewee admin custom to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 9, 2024Market 360 Viewer: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-51619 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in market360 Market 360 Viewer market-360-viewer allows Blind SQL Injection.This issue affects Market 360 Viewer: from n/a through <= 1.01.
- Product
- Market 360 Viewer
- Affected
- up to 1.01
- What to do
- Affects up to 1.01. Update Market 360 Viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2024CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy.CVE-2024-10082 · Other software · Ericsson · reported by 85b1779b-6ecd-4f52-bcc5-73eac4659dcfHigh 8.7
CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Authentication method confusion allows logging in as the built-in root user from an external service. The built-in root user up until 6.24.1 is generated in a weak manner, cannot be disabled, and has universal access.This vulnerability allows an attacker who can create an account on an enabled external authentication service, to log in as the root user, and access and control everything that can be controlled via the web interface. The attacker needs to acquire the username of the root user to be successful. This issue affects CodeChecker: through 6.24.1.
- Product
- CodeChecker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2024CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy.CVE-2024-10081 · Other software · Ericsson · reported by 85b1779b-6ecd-4f52-bcc5-73eac4659dcfCritical 10
CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Authentication bypass occurs when the API URL ends with Authentication. This bypass allows superuser access to all API endpoints other than Authentication. These endpoints include the ability to add, edit, and remove products, among others. All endpoints, apart from the /Authentication is affected by the vulnerability. This issue affects CodeChecker: through 6.24.1.
- Product
- CodeChecker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2024Bruno before 1.29.1 uses Electron shell.openExternal without validation (of http or https) for opening windows within the Markdown docs viewer.CVE-2024-48463 · Other software · usebruno · reported by MITREMedium 6.5
Bruno before 1.29.1 uses Electron shell.openExternal without validation (of http or https) for opening windows within the Markdown docs viewer.
- Product
- bruno
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Oct 24, 2024PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer – DearFlip: Reflected Cross-Site ScriptingCVE-2024-8717 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer – DearFlip plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'pdf_source' parameter in all versions up to, and including, 2.3.32 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer – DearFlip
- Affected
- up to 2.3.32
- What to do
- Affects up to 2.3.32. Update PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer – DearFlip to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 16, 2024mlocate's %post script allows RUN_UPDATEDB_AS user to make arbitrary files world readable by abusing insecure file operations that run with root privileges.CVE-2023-32190 · Other software · SUSE · reported by meissner@suse.deHigh 8.5
mlocate's %post script allows RUN_UPDATEDB_AS user to make arbitrary files world readable by abusing insecure file operations that run with root privileges.
- Product
- openSUSE Tumbleweed
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2024Embed PDF Viewer: Stored Cross-Site ScriptingCVE-2024-9451 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Embed PDF Viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'height' and 'width' parameters in all versions up to, and including, 2.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Embed PDF Viewer
- Affected
- up to 2.4.4
- What to do
- Affects up to 2.4.4. Update Embed PDF Viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 8, 2024SSL Pinning Bypass in eWeLink Some hardware products allows local ATTACKER to Decrypt TLS communication and Extract secrets to clone the device via Flash the moCVE-2024-7206 · Other software · eWeLink · reported by 68870bb1-d075-4169-957d-e580b18692b9High 7
SSL Pinning Bypass in eWeLink Some hardware products allows local ATTACKER to Decrypt TLS communication and Extract secrets to clone the device via Flash the modified firmware
- Product
- Zigbee Bridge Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2024TNC PDF viewer: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-47372 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ThemeNcode LLC TNC PDF viewer allows Stored XSS.This issue affects TNC PDF viewer: from n/a through 3.1.0.
- Product
- TNC PDF viewer
- Affected
- up to 3.1.0
- What to do
- Affects up to 3.1.0. Update TNC PDF viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 27, 2024Dozzle is a realtime log viewer for docker containers.CVE-2024-47182 · Other software · amir20 · reported by GitHubMedium 4.8
Dozzle is a realtime log viewer for docker containers. Before version 8.5.3, the app uses sha-256 as the hash for passwords, which leaves users susceptible to rainbow table attacks. The app switches to bcrypt, a more appropriate hash for passwords, in version 8.5.3.
- Product
- dozzle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2024Improper verification of cryptographic signature during installation of a Printer driver via the TeamViewer_service.exe component of TeamViewer Remote Clients pCVE-2024-7481 · Other software · TeamViewer · reported by psirt@teamviewer.comHigh 8.8
Improper verification of cryptographic signature during installation of a Printer driver via the TeamViewer_service.exe component of TeamViewer Remote Clients prior version 15.58.4 for Windows allows an attacker with local unprivileged access on a Windows system to elevate their privileges and install drivers.
- Product
- Remote Full Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2024Improper verification of cryptographic signature during installation of a VPN driver via the TeamViewer_service.exe component of TeamViewer Remote Clients priorCVE-2024-7479 · Other software · TeamViewer · reported by psirt@teamviewer.comHigh 8.8
Improper verification of cryptographic signature during installation of a VPN driver via the TeamViewer_service.exe component of TeamViewer Remote Clients prior version 15.58.4 for Windows allows an attacker with local unprivileged access on a Windows system to elevate their privileges and install drivers.
- Product
- Remote Full Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2024Deserialization of untrusted data can occur in versions 2.4.0 or newer of the Cleanlab project, enabling a maliciously crafted datalab.pkl file to run arbitraryCVE-2024-45857 · Other software · Cleanlab · reported by 6f8de1f0-f67e-45a6-b68f-98777fdb759cHigh 7.8
Deserialization of untrusted data can occur in versions 2.4.0 or newer of the Cleanlab project, enabling a maliciously crafted datalab.pkl file to run arbitrary code on an end user’s system when the data directory is loaded.
- Product
- cleanlab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2024Deserialization of untrusted data can occur in versions 23.10.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run arbiCVE-2024-45855 · Other software · mindsdb · reported by 6f8de1f0-f67e-45a6-b68f-98777fdb759cHigh 7.1
Deserialization of untrusted data can occur in versions 23.10.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run arbitrary code on the server when using ‘finetune’ on it.
- Product
- mindsdb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2024Deserialization of untrusted data can occur in versions 23.10.3.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run arbiCVE-2024-45854 · Other software · mindsdb · reported by 6f8de1f0-f67e-45a6-b68f-98777fdb759cHigh 7.1
Deserialization of untrusted data can occur in versions 23.10.3.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run arbitrary code on the server when a ‘describe’ query is run on it.
- Product
- mindsdb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2024Deserialization of untrusted data can occur in versions 23.10.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run arbiCVE-2024-45853 · Other software · mindsdb · reported by 6f8de1f0-f67e-45a6-b68f-98777fdb759cHigh 7.1
Deserialization of untrusted data can occur in versions 23.10.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run arbitrary code on the server when used for a prediction.
- Product
- mindsdb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2024Deserialization of untrusted data can occur in versions 23.3.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded model to run arbitrary code CVE-2024-45852 · Other software · mindsdb · reported by 6f8de1f0-f67e-45a6-b68f-98777fdb759cHigh 8.8
Deserialization of untrusted data can occur in versions 23.3.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded model to run arbitrary code on the server when interacted with.
- Product
- mindsdb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2024An arbitrary code execution vulnerability exists in versions 0.0.8 and newer of the Refuel Autolabel library because of the way its multilabel classification taCVE-2024-27321 · Other software · Refuel · reported by 6f8de1f0-f67e-45a6-b68f-98777fdb759cHigh 7.8
An arbitrary code execution vulnerability exists in versions 0.0.8 and newer of the Refuel Autolabel library because of the way its multilabel classification tasks handle provided CSV files. If a user creates a multilabel classification task using a maliciously crafted CSV file containing Python code, the code will be passed to an eval function which executes it.
- Product
- autolabel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2024An arbitrary code execution vulnerability exists in versions 0.0.8 and newer of the Refuel Autolabel library because of the way its classification tasks handle CVE-2024-27320 · Other software · Refuel · reported by 6f8de1f0-f67e-45a6-b68f-98777fdb759cHigh 7.8
An arbitrary code execution vulnerability exists in versions 0.0.8 and newer of the Refuel Autolabel library because of the way its classification tasks handle provided CSV files. If a victim user creates a classification task using a maliciously crafted CSV file containing Python code, the code will be passed to an eval function which executes it.
- Product
- autolabel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024Arbitrary File Read vulnerability in Xi'an Daxi Information Technology Co., Ltd OfficeWeb365 v.7.18.23.0 and v8.6.1.0 allows a remote attacker to obtain sensitiCVE-2024-37728 · Other software · officeweb365 · reported by MITREHigh 7.5
Arbitrary File Read vulnerability in Xi'an Daxi Information Technology Co., Ltd OfficeWeb365 v.7.18.23.0 and v8.6.1.0 allows a remote attacker to obtain sensitive information via the "Pic/Indexes" interface
- Product
- officeweb365
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024An unauthenticated remote attacker can run malicious c# code included in curve files and execute commands in the users context.CVE-2024-6596 · Other software · Endress+Hauser · reported by info@cert.vde.comCritical 9.8
An unauthenticated remote attacker can run malicious c# code included in curve files and execute commands in the users context.
- Product
- Echo Curve Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024Amin Aliakbari, member of the AXIS OS Bug Bounty Program, has found a broken access control which would lead to less-privileged operator- and/or viewer accountsCVE-2024-6979 · Other software · Axis Communications AB · reported by product-security@axis.comMedium 6.8
Amin Aliakbari, member of the AXIS OS Bug Bounty Program, has found a broken access control which would lead to less-privileged operator- and/or viewer accounts having more privileges than designed. The risk of exploitation is very low as it requires complex steps to execute, including knowing of account passwords and social engineering attacks in tricking the administrator to perform specific configurations on operator- and/or viewer-privileged accounts. Axis has released patched AXIS OS a version for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.
- Product
- AXIS OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2024Improper access control in the clipboard synchronization feature in TeamViewer Full Client prior version 15.57 and TeamViewer Meeting prior version 15.55.3 can CVE-2024-6053 · Other software · TeamViewer · reported by psirt@teamviewer.comMedium 4.3
Improper access control in the clipboard synchronization feature in TeamViewer Full Client prior version 15.57 and TeamViewer Meeting prior version 15.55.3 can lead to unintentional sharing of the clipboard with the current presenter of a meeting.
- Product
- Meeting
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 23, 2024Mage AI allows remote users with the "Viewer" role to leak arbitrary files from the Mage server due to a path traversal in the "Pipeline Interaction" requestCVE-2024-45190 · Other software · mage · reported by reefs@jfrog.comMedium 6.5
Mage AI allows remote users with the "Viewer" role to leak arbitrary files from the Mage server due to a path traversal in the "Pipeline Interaction" request
- Product
- mage-ai
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 23, 2024Mage AI allows remote users with the "Viewer" role to leak arbitrary files from the Mage server due to a path traversal in the "Git Content" requestCVE-2024-45189 · Other software · Mage · reported by reefs@jfrog.comMedium 6.5
Mage AI allows remote users with the "Viewer" role to leak arbitrary files from the Mage server due to a path traversal in the "Git Content" request
- Product
- Mage-ai
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 23, 2024Mage AI allows remote users with the "Viewer" role to leak arbitrary files from the Mage server due to a path traversal in the "File Content" requestCVE-2024-45188 · Other software · mage · reported by reefs@jfrog.comMedium 6.5
Mage AI allows remote users with the "Viewer" role to leak arbitrary files from the Mage server due to a path traversal in the "File Content" request
- Product
- mage-ai
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2024Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Forcepoint Web Security (Transaction Viewer) allows StoredCVE-2023-6452 · Other software · Forcepoint · reported by psirt@forcepoint.comCritical 9.6
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Forcepoint Web Security (Transaction Viewer) allows Stored XSS. The Forcepoint Web Security portal allows administrators to generate detailed reports on user requests made through the Web proxy. It has been determined that the "user agent" field in the Transaction Viewer is vulnerable to a persistent Cross-Site Scripting (XSS) vulnerability, which can be exploited by any user who can route traffic through the Forcepoint Web proxy. This vulnerability enables unauthorized attackers to execute JavaScript within the browser context of a Forcepoint administrator, thereby allowing them to perform actions on the administrator's behalf. Such a breach could lead to unauthorized access or modifications, posing a significant security risk. This issue affects Web Security: before 8.5.6.
- Product
- Web Security
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.forcepoint.com
Aug 21, 2024In the Linux kernel, the following vulnerability has been resolved: sched/fair: Fix fault in reweight_entity Syzbot found a GPF in reweight_entity.CVE-2022-48921 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 4.7
In the Linux kernel, the following vulnerability has been resolved: sched/fair: Fix fault in reweight_entity Syzbot found a GPF in reweight_entity. This has been bisected to commit 4ef0c5c6b5ba ("kernel/sched: Fix sched_fork() access an invalid sched_task_group") There is a race between sched_post_fork() and setpriority(PRIO_PGRP) within a thread group that causes a null-ptr-deref in reweight_entity() in CFS. The scenario is that the main process spawns number of new threads, which then call setpriority(PRIO_PGRP, 0, -20), wait, and exit. For each of the new threads the copy_process() gets invoked, which adds the new task_struct and calls sched_post_fork() for it. In the above scenario there is a possibility that setpriority(PRIO_PGRP) and set_one_prio() will be called for a thread in the group that is just being created by copy_process(), and for which the sched_post_fork() has not been executed yet. This will trigger a null pointer dereference in reweight_entity(), as it will try to access the run queue pointer, which hasn't been set. Before the mentioned change the cfs_rq pointer for the task has been set in sched_fork(), which is called much earlier in copy_process(), be
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Aug 20, 2024In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_erp: Fix object nesting warning ACLs in Spectrum-2 and newer ASICs canCVE-2024-43880 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_erp: Fix object nesting warning ACLs in Spectrum-2 and newer ASICs can reside in the algorithmic TCAM (A-TCAM) or in the ordinary circuit TCAM (C-TCAM). The former can contain more ACLs (i.e., tc filters), but the number of masks in each region (i.e., tc chain) is limited. In order to mitigate the effects of the above limitation, the device allows filters to share a single mask if their masks only differ in up to 8 consecutive bits. For example, dst_ip/25 can be represented using dst_ip/24 with a delta of 1 bit. The C-TCAM does not have a limit on the number of masks being used (and therefore does not support mask aggregation), but can contain a limited number of filters. The driver uses the "objagg" library to perform the mask aggregation by passing it objects that consist of the filter's mask and whether the filter is to be inserted into the A-TCAM or the C-TCAM since filters in different TCAMs cannot share a mask. The set of created objects is dependent on the insertion order of the filters and is not necessarily optimal. Therefore, the driver will periodically ask the library to compute
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Aug 12, 20243D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43152 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in iberezansky 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery allows Stored XSS.This issue affects 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery: from n/a through 1.15.6.
- Product
- 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery
- Affected
- up to 1.15.6
- What to do
- Affects up to 1.15.6. Update 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 31, 2024When the device is shared, the homepage module are before 2.19.0 in eWeLink Cloud Service allows Secondary user to take over devices as primary user via sharinCVE-2024-7205 · Other software · CoolKit · reported by 68870bb1-d075-4169-957d-e580b18692b9Critical 9.4
When the device is shared, the homepage module are before 2.19.0 in eWeLink Cloud Service allows Secondary user to take over devices as primary user via sharing unnecessary device-sensitive information.
- Product
- eWeLink Cloud Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2024An issue was discovered in Kibana where a user with Viewer role could cause a Kibana instance to crash by sending a large number of maliciously crafted requestsCVE-2024-37281 · Other software · Elastic · reported by security@elastic.coMedium 6.5
An issue was discovered in Kibana where a user with Viewer role could cause a Kibana instance to crash by sending a large number of maliciously crafted requests to a specific endpoint.
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.elastic.codiscuss.elastic.co
Jul 7, 2024A vulnerability classified as problematic has been found in heyewei SpringBootCMS up to 2024-05-28.CVE-2024-6539 · Other software · heyewei · reported by VulDBMedium 5.3
A vulnerability classified as problematic has been found in heyewei SpringBootCMS up to 2024-05-28. Affected is an unknown function of the file /guestbook of the component Guestbook Handler. The manipulation of the argument Content leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-270450 is the identifier assigned to this vulnerability.
- Product
- SpringBootCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2024CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy.CVE-2023-49793 · Other software · Ericsson · reported by GitHubMedium 6.5
CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Zip files uploaded to the server endpoint of `CodeChecker store` are not properly sanitized. An attacker, using a path traversal attack, can load and display files on the machine of `CodeChecker server`. The vulnerable endpoint is `/Default/v6.53/CodeCheckerService@massStoreRun`. The path traversal vulnerability allows reading data on the machine of the `CodeChecker server`, with the same permission level as the `CodeChecker server`. The attack requires a user account on the `CodeChecker server`, with permission to store to a server, and view the stored report. This vulnerability has been patched in version 6.23.
- Product
- codechecker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2024PDF Viewer for Elementor: Stored Cross-Site ScriptingCVE-2024-0845 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The PDF Viewer for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the render function in all versions up to, and including, 2.9.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- PDF Viewer for Elementor
- Affected
- up to 2.9.3
- What to do
- Affects up to 2.9.3. Update PDF Viewer for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 11, 2024An attacker could retrieve sensitive files (medical images) as well as plant new medical images or overwrite existing medical images on a MicroDicom DICOM VieweCVE-2024-33606 · Other software · MicroDicom · reported by ics-cert@hq.dhs.govHigh 8.6
An attacker could retrieve sensitive files (medical images) as well as plant new medical images or overwrite existing medical images on a MicroDicom DICOM Viewer system. User interaction is required to exploit this vulnerability.
- Product
- DICOM Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2024MicroDicom DICOM Viewer is vulnerable to a stack-based buffer overflow, which may allow an attacker to execute arbitrary code on affected installations of DICOMCVE-2024-28877 · Other software · MicroDicom · reported by ics-cert@hq.dhs.govHigh 8.7
MicroDicom DICOM Viewer is vulnerable to a stack-based buffer overflow, which may allow an attacker to execute arbitrary code on affected installations of DICOM Viewer. User interaction is required to exploit this vulnerability.
- Product
- DICOM Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2024Luxion KeyShot Viewer KSP File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.CVE-2024-5508 · Other software · Luxion · reported by zdi-disclosures@trendmicro.comHigh 7.8
Luxion KeyShot Viewer KSP File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of KSP files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22267.
- Product
- KeyShot Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkeyshot.comzerodayinitiative.com
Jun 6, 2024Luxion KeyShot Viewer KSP File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability.CVE-2024-5507 · Other software · Luxion · reported by zdi-disclosures@trendmicro.comHigh 7.8
Luxion KeyShot Viewer KSP File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of KSP files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22266.
- Product
- KeyShot Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkeyshot.comzerodayinitiative.com
Jun 6, 2024Luxion KeyShot Viewer KSP File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.CVE-2024-5506 · Other software · Luxion · reported by zdi-disclosures@trendmicro.comHigh 7.8
Luxion KeyShot Viewer KSP File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of KSP files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22514.
- Product
- KeyShot Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkeyshot.comzerodayinitiative.com
Jun 6, 2024Luxion KeyShot Viewer KSP File Parsing Use-After-Free Remote Code Execution Vulnerability.CVE-2024-30375 · Other software · Luxion · reported by zdi-disclosures@trendmicro.comHigh 7.8
Luxion KeyShot Viewer KSP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of KSP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22515.
- Product
- KeyShot Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzerodayinitiative.comzerodayinitiative.com
Jun 6, 2024Luxion KeyShot Viewer KSP File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.CVE-2024-30374 · Other software · Luxion · reported by zdi-disclosures@trendmicro.comHigh 7.8
Luxion KeyShot Viewer KSP File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of KSP files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22449.
- Product
- KeyShot Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzerodayinitiative.comzerodayinitiative.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.