Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,732 results · page 10 of 35
May 15, 2025An error-based SQL Injection (SQLi) vulnerability in WebERP v4.15.2 allows attackers to execute arbitrary SQL command and extract sensitive data by injecting a CVE-2025-46052 · Other software · Weberp · reported by MITRECritical 9.8
An error-based SQL Injection (SQLi) vulnerability in WebERP v4.15.2 allows attackers to execute arbitrary SQL command and extract sensitive data by injecting a crafted payload into the DEL form field in a POST request to /StockCounts.php
- Product
- Weberp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2025ADOdb is a PHP database class library that provides abstractions for performing queries and managing databases.CVE-2025-46337 · Other software · ADOdb · reported by GitHubCritical 10
ADOdb is a PHP database class library that provides abstractions for performing queries and managing databases. Prior to version 5.22.9, improper escaping of a query parameter may allow an attacker to execute arbitrary SQL statements when the code using ADOdb connects to a PostgreSQL database and calls pg_insert_id() with user-supplied data. This issue has been patched in version 5.22.9.
- Product
- ADOdb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2025An issue in Coresmartcontracts Uniswap v.3.0 and fixed in v.4.0 allows a remote attacker to escalate privileges via the _modifyPosition functionCVE-2025-25962 · Other software · reported by MITRECritical 9.8
An issue in Coresmartcontracts Uniswap v.3.0 and fixed in v.4.0 allows a remote attacker to escalate privileges via the _modifyPosition function
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2025The device’s passwords have not been adequately salted, making them vulnerable to password extraction attacks.CVE-2025-32471 · Other software · SICK AG · reported by psirt@sick.deLow 3.7
The device’s passwords have not been adequately salted, making them vulnerable to password extraction attacks.
- Product
- SICK FLX3-CPUC200
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2025This vulnerability allows any authenticated user to cause the server to consume very large amounts of disk space when extracting a Zip Bomb.CVE-2025-32949 · Other software · Framasoft · reported by reefs@jfrog.comMedium 6.5
This vulnerability allows any authenticated user to cause the server to consume very large amounts of disk space when extracting a Zip Bomb. If user import is enabled (which is the default setting), any registered user can upload an archive for importing. The code uses the yauzl library for reading the archive. The yauzl library does not contain any mechanism to detect or prevent extraction of a Zip Bomb https://en.wikipedia.org/wiki/Zip_bomb . Therefore, when using the User Import functionality with a Zip Bomb, PeerTube will try extracting the archive which will cause a disk space resource exhaustion.
- Product
- Peertube
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comresearch.jfrog.com
Apr 11, 2025WPSmartContracts: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-31565 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Lisandro Martinez WPSmartContracts wp-smart-contracts allows Blind SQL Injection.This issue affects WPSmartContracts: from n/a through <= 2.0.12.
- Product
- WPSmartContracts
- Affected
- up to 2.0.12
- What to do
- Affects up to 2.0.12. Update WPSmartContracts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 9, 2025WP Abstracts: Cross-Site Request Forgery (CSRF)CVE-2025-32591 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Kevon Adonis WP Abstracts wp-abstracts-manuscripts-manager allows Cross Site Request Forgery.This issue affects WP Abstracts: from n/a through <= 2.7.5.
- Product
- WP Abstracts
- Affected
- up to 2.7.5
- What to do
- Affects up to 2.7.5. Update WP Abstracts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2025SOOP-CLM from PiExtract has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and deletCVE-2025-3011 · Other software · PiExtract · reported by twcert@cert.org.twCritical 9.8
SOOP-CLM from PiExtract has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents.
- Product
- SOOP-CLM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Mar 20, 2025A vulnerability in aimhubio/aim version 3.19.3 allows an attacker to exploit the `tarfile.extractall()` function to extract the contents of a maliciously crafteCVE-2024-6829 · Other software · aimhubio · reported by security@huntr.devCritical 9.1
A vulnerability in aimhubio/aim version 3.19.3 allows an attacker to exploit the `tarfile.extractall()` function to extract the contents of a maliciously crafted tarfile to arbitrary locations on the host server. The attacker can control `repo.path` and `run_hash` to bypass directory existence checks and extract files to unintended locations, potentially overwriting critical files. This can lead to arbitrary data being written to arbitrary locations on the remote tracking server, which could be used for further attacks such as writing a new SSH key to the target server.
- Product
- aimhubio/aim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025In kedro-org/kedro version 0.19.8, the `pull_package()` API function allows users to download and extract micro packages from the Internet.CVE-2024-12215 · Other software · kedro-org · reported by security@huntr.devHigh 8.8
In kedro-org/kedro version 0.19.8, the `pull_package()` API function allows users to download and extract micro packages from the Internet. However, the function `project_wheel_metadata()` within the code path can execute the `setup.py` file inside the tar file, leading to remote code execution (RCE) by running arbitrary commands on the victim's machine.
- Product
- kedro-org/kedro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2025picklescan before 0.0.23 is vulnerable to a ZIP archive manipulation attack that causes it to crash when attempting to extract and scan PyTorch model archives.CVE-2025-1944 · Other software · mmaitre314 · reported by 103e4ec9-0a87-450b-af77-479448ddef11Medium 5.3
picklescan before 0.0.23 is vulnerable to a ZIP archive manipulation attack that causes it to crash when attempting to extract and scan PyTorch model archives. By modifying the filename in the ZIP header while keeping the original filename in the directory listing, an attacker can make PickleScan raise a BadZipFile error. However, PyTorch's more forgiving ZIP implementation still allows the model to be loaded, enabling malicious payloads to bypass detection.
- Product
- picklescan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2025WP Online Contract: Unauthorized accessCVE-2025-0954 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP Online Contract plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the json_import() and json_export() functions in all versions up to, and including, 5.1.4. This makes it possible for unauthenticated attackers to import and export the plugin's settings.
- Product
- WP Online Contract
- Affected
- up to 5.1.4
- What to do
- Affects up to 5.1.4. Update WP Online Contract to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Feb 28, 2025Cryptographic key extraction from internal flash in Minut M2 with firmware version #15142 allows physically proximate attackers to inject modified firmware intoCVE-2024-44754 · Other software · reported by MITREMedium 6.8
Cryptographic key extraction from internal flash in Minut M2 with firmware version #15142 allows physically proximate attackers to inject modified firmware into any other Minut M2 product via USB.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2025In the Linux kernel, the following vulnerability has been resolved: drm/i915/selftests: fix subtraction overflow bug On some machines hole_end can be small enCVE-2022-49635 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: drm/i915/selftests: fix subtraction overflow bug On some machines hole_end can be small enough to cause subtraction overflow. On the other side (addr + 2 * min_alignment) can overflow in case of mock tests. This patch should handle both cases. (cherry picked from commit ab3edc679c552a466e4bf0b11af3666008bd65a2)
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Feb 25, 2025A Credential Disclosure vulnerability exists where an administrator could extract the stored SMTP account credentials due to lack of encryption.CVE-2025-0760 · Other software · Tenable · reported by vulnreport@tenable.comLow 2.7
A Credential Disclosure vulnerability exists where an administrator could extract the stored SMTP account credentials due to lack of encryption.
- Product
- Tenable Identity Exposure
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2025Improper access control in mail module of Odoo Community 17.0 and Odoo Enterprise 17.0 allows remote authenticated attackers to extract sensitive information viCVE-2024-36259 · Other software · Odoo · reported by security@odoo.comHigh 7.5
Improper access control in mail module of Odoo Community 17.0 and Odoo Enterprise 17.0 allows remote authenticated attackers to extract sensitive information via an oracle-based (yes/no response) crafted attack.
- Product
- Odoo Community
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2025vyper is a Pythonic Smart Contract Language for the EVM.CVE-2025-27105 · Other software · vyperlang · reported by GitHubLow 2.3
vyper is a Pythonic Smart Contract Language for the EVM. Vyper handles AugAssign statements by first caching the target location to avoid double evaluation. However, in the case when target is an access to a DynArray and the rhs modifies the array, the cached target will evaluate first, and the bounds check will not be re-evaluated during the write portion of the statement. This issue has been addressed in version 0.4.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2025vyper is a Pythonic Smart Contract Language for the EVM.CVE-2025-27104 · Other software · vyperlang · reported by GitHubLow 2.3
vyper is a Pythonic Smart Contract Language for the EVM. Multiple evaluation of a single expression is possible in the iterator target of a for loop. While the iterator expression cannot produce multiple writes, it can consume side effects produced in the loop body (e.g. read a storage variable updated in the loop body) and thus lead to unexpected program behavior. Specifically, reads in iterators which contain an ifexp (e.g. `for s: uint256 in ([read(), read()] if True else [])`) may interleave reads with writes in the loop body. Vyper for loops allow two kinds of iterator targets, namely the `range()` builtin and an iterable type, like SArray and DArray. During codegen, iterable lists are required to not produce any side-effects (in the following code, `range_scope` forces `iter_list` to be parsed in a constant context, which is checked against `is_constant`). However, this does not prevent the iterator from consuming side effects provided by the body of the loop. For SArrays on the other hand, `iter_list` is instantiated in the body of a `repeat` ir, so it can be evaluated several times. This issue is being addressed and is expected to be available in version 0.4.1. Users are ad
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2025vyper is a Pythonic Smart Contract Language for the EVM.CVE-2025-26622 · Other software · vyperlang · reported by GitHubLow 2.3
vyper is a Pythonic Smart Contract Language for the EVM. Vyper `sqrt()` builtin uses the babylonian method to calculate square roots of decimals. Unfortunately, improper handling of the oscillating final states may lead to sqrt incorrectly returning rounded up results. This issue is being addressed and a fix is expected in version 0.4.1. Users are advised to upgrade as soon as the patched release is available. There are no known workarounds for this vulnerability.
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025WP Abstracts: Cross-Site Request ForgeryCVE-2024-12386 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The WP Abstracts plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.3. This is due to missing nonce validation on multiple functions. This makes it possible for unauthenticated attackers to delete arbitrary accounts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- WP Abstracts
- Affected
- up to 2.7.3
- What to do
- Affects up to 2.7.3. Update WP Abstracts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Feb 3, 2025libarchiveplugin.cpp in KDE ark before 24.12.0 can extract to an absolute path from an archive.CVE-2024-57966 · Other software · KDE · reported by MITREMedium 5
libarchiveplugin.cpp in KDE ark before 24.12.0 can extract to an absolute path from an archive.
- Product
- ark
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2025Fedora Repository 3.8.1 allows path traversal when extracting uploaded archives ("Zip Slip").CVE-2025-23011 · Other software · Fedora Repository · reported by 9119a7d8-5eab-497f-8521-727c672e3725High 8.7
Fedora Repository 3.8.1 allows path traversal when extracting uploaded archives ("Zip Slip"). A remote, authenticated attacker can upload a specially crafted archive that will extract an arbitrary JSP file to a location that can be executed by an unauthenticated GET request. Fedora Repository 3.8.1 was released on 2015-06-11 and is no longer maintained. Migrate to a currently supported version (6.5.1 as of 2025-01-23).
- Product
- Fedora Repository
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2025An issue in RAR Extractor - Unarchiver Free and Pro v.6.4.0 allows local attackers to inject arbitrary code potentially leading to remote control and unauthorizCVE-2024-55504 · Other software · reported by MITREMedium 5.5
An issue in RAR Extractor - Unarchiver Free and Pro v.6.4.0 allows local attackers to inject arbitrary code potentially leading to remote control and unauthorized access to sensitive user data via the exploit_combined.dylib component on MacOS.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordapps.apple.comgithub.com
Jan 21, 2025HashiCorp’s go-slug library is vulnerable to a zip-slip style attack when a non-existing user-provided path is extracted from the tar entry.CVE-2025-0377 · Other software · HashiCorp · reported by security@hashicorp.comHigh 7.5
HashiCorp’s go-slug library is vulnerable to a zip-slip style attack when a non-existing user-provided path is extracted from the tar entry.
- Product
- Shared library
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2025WP Abstracts: Cross-Site Request ForgeryCVE-2024-12385 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Abstracts plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.2. This is due to missing nonce validation on the wpabstracts_load_status() and wpabstracts_delete_abstracts() functions. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- WP Abstracts
- Affected
- up to 2.7.2
- What to do
- Affects up to 2.7.2. Update WP Abstracts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 16, 2025JFinalOA before v2025.01.01 was discovered to contain a SQL injection vulnerability via the component apply/save#oaContractApply.id.CVE-2024-57770 · Other software · Jfinaloa Project · reported by MITREHigh 8.8
JFinalOA before v2025.01.01 was discovered to contain a SQL injection vulnerability via the component apply/save#oaContractApply.id.
- Product
- Jfinaloa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2025Vyper is a Pythonic Smart Contract Language for the EVM.CVE-2025-21607 · Other software · vyperlang · reported by GitHubLow 2.3
Vyper is a Pythonic Smart Contract Language for the EVM. When the Vyper Compiler uses the precompiles EcRecover (0x1) and Identity (0x4), the success flag of the call is not checked. As a consequence an attacker can provide a specific amount of gas to make these calls fail but let the overall execution continue. Then the execution result can be incorrect. Based on EVM's rules, after the failed precompile the remaining code has only 1/64 of the pre-call-gas left (as 63/64 were forwarded and spent). Hence, only fairly simple executions can follow the failed precompile calls. Therefore, we found no significantly impacted real-world contracts. None the less an advisory has been made out of an abundance of caution. This issue is fixed in 0.4.1.
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 30, 2024iXsystems TrueNAS CORE tarfile.extractall Directory Traversal Remote Code Execution Vulnerability.CVE-2024-11944 · Other software · iXsystems · reported by zdi-disclosures@trendmicro.comHigh 8.8
iXsystems TrueNAS CORE tarfile.extractall Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of iXsystems TrueNAS devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the tarfile.extractall method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. Was ZDI-CAN-25626.
- Product
- TrueNAS CORE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtruenas.comzerodayinitiative.com
Dec 30, 2024Firecrawl is a web scraper that allows users to extract the content of a webpage for a large language model.CVE-2024-56800 · Other software · mendableai · reported by GitHubHigh 7.4
Firecrawl is a web scraper that allows users to extract the content of a webpage for a large language model. Versions prior to 1.1.1 contain a server-side request forgery (SSRF) vulnerability. The scraping engine could be exploited by crafting a malicious site that redirects to a local IP address. This allowed exfiltration of local network resources through the API. The cloud service was patched on December 27th, 2024, and the maintainers have checked that no user data was exposed by this vulnerability. Scraping engines used in the open sourced version of Firecrawl were patched on December 29th, 2024, except for the playwright services which the maintainers have determined to be un-patchable. All users of open-source software (OSS) Firecrawl should upgrade to v1.1.1. As a workaround, OSS Firecrawl users should supply the playwright services with a secure proxy. A proxy can be specified through the `PROXY_SERVER` env in the environment variables. Please refer to the documentation for instructions. Ensure that the proxy server one is using is setup to block all traffic going to link-local IP addresses.
- Product
- firecrawl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2024python-libarchive through 4.2.1 allows directory traversal (to create files) in extract in zip.py for ZipFile.extractall and ZipFile.extract.CVE-2024-55587 · Other software · reported by MITREHigh 8.8
python-libarchive through 4.2.1 allows directory traversal (to create files) in extract in zip.py for ZipFile.extractall and ZipFile.extract.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024Artifex Software mupdf v1.24.9 was discovered to contain a segmentation fault via the component /tools/pdfextract.c.CVE-2024-46657 · Other software · Artifex · reported by MITREMedium 5.5
Artifex Software mupdf v1.24.9 was discovered to contain a segmentation fault via the component /tools/pdfextract.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted PDF file.
- Product
- Mupdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcgit.ghostscript.comgist.github.com
Dec 10, 2024Versions of the package luigi before 3.6.0 are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) due to improper destination file path validaCVE-2024-21542 · Other software · reported by report@snyk.ioMedium 6.6
Versions of the package luigi before 3.6.0 are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) due to improper destination file path validation in the _extract_packages_archive function.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2024Out-of-bounds write in libswmfextractor.so prior to SMR Dec-2024 Release 1 allows local attackers to execute arbitrary code.CVE-2024-49410 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5.9
Out-of-bounds write in libswmfextractor.so prior to SMR Dec-2024 Release 1 allows local attackers to execute arbitrary code.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.com
Dec 2, 2024unzip-bot is a Telegram bot to extract various types of archives.CVE-2024-53992 · Other software · EDM115 · reported by GitHubHigh 8.8
unzip-bot is a Telegram bot to extract various types of archives. Users could exploit unsanitized inputs to inject malicious commands that are executed through subprocess.Popen with shell=True. Attackers can exploit this vulnerability using a crafted archive name, password, or video name. This vulnerability is fixed in 7.0.3a.
- Product
- unzip-bot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024Visteon Infotainment REFLASH_DDU_ExtractFile Command Injection Remote Code Execution Vulnerability.CVE-2024-8360 · Other software · Visteon · reported by zdi-disclosures@trendmicro.comMedium 6.8
Visteon Infotainment REFLASH_DDU_ExtractFile Command Injection Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Visteon Infotainment systems. Authentication is not required to exploit this vulnerability. The specific flaw exists within the REFLASH_DDU_ExtractFile function. A crafted software update file can trigger execution of a system call composed from a user-supplied string. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-23421.
- Product
- Infotainment
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024Visteon Infotainment UPDATES_ExtractFile Command Injection Remote Code Execution Vulnerability.CVE-2024-8358 · Other software · Visteon · reported by zdi-disclosures@trendmicro.comMedium 6.8
Visteon Infotainment UPDATES_ExtractFile Command Injection Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Visteon Infotainment systems. Authentication is not required to exploit this vulnerability. The specific flaw exists within the UPDATES_ExtractFile function. A crafted software update file can trigger execution of a system call composed from a user-supplied string. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-23422.
- Product
- Infotainment
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2024In sdpu_extract_attr_seq of sdp_utils.cc, there is a possible out of bounds read due to an incorrect bounds check.CVE-2018-9456 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.5
In sdpu_extract_attr_seq of sdp_utils.cc, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2024Directory Traversal vulnerability in DotNetZip v.1.16.0 and before allows a remote attacker to execute arbitrary code via the src/Zip.Shared/ZipEntry.Extract.csCVE-2024-48510 · Other software · nuget · reported by MITRECritical 9.8
Directory Traversal vulnerability in DotNetZip v.1.16.0 and before allows a remote attacker to execute arbitrary code via the src/Zip.Shared/ZipEntry.Extract.cs component NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- dotnetzip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Nov 8, 2024A data.all admin team member who has access to the customer-owned AWS Account where data.all is deployed may be able to extract user data from data.all applicatCVE-2024-52314 · Other software · amazon · reported by ff89ba41-3aa1-4d27-914a-91399e9639e5Medium 6.9
A data.all admin team member who has access to the customer-owned AWS Account where data.all is deployed may be able to extract user data from data.all application logs in data.all via CloudWatch log scanning for particular operations that interact with customer producer teams data.
- Product
- data.all
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaws.amazon.comgithub.com
Nov 5, 2024Out-of-bounds write in libsapeextractor.so prior to SMR Nov-2024 Release 1 allows local attackers to cause memory corruption.CVE-2024-34678 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5.9
Out-of-bounds write in libsapeextractor.so prior to SMR Nov-2024 Release 1 allows local attackers to cause memory corruption.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.com
Nov 5, 2024Out-of-bounds write in parsing subtitle file in libsubextractor.so prior to SMR Nov-2024 Release 1 allows local attackers to cause memory corruption.CVE-2024-34676 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4.4
Out-of-bounds write in parsing subtitle file in libsubextractor.so prior to SMR Nov-2024 Release 1 allows local attackers to cause memory corruption. User interaction is required for triggering this vulnerability.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.com
Oct 30, 2024An issue in the PepeGxng smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact via the mint functioCVE-2024-51427 · Other software · ethereum · reported by MITRECritical 9.8
An issue in the PepeGxng smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact via the mint function. NOTE: this is disputed by third parties because the impact is limited to function calls.
- Product
- ethereum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2024An issue in the PepeGxng smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact via the _transfer fuCVE-2024-51426 · Other software · ethereum · reported by MITREHigh 8.8
An issue in the PepeGxng smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact via the _transfer function. NOTE: this is disputed by third parties because the impact is limited to function calls.
- Product
- ethereum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2024An issue in the WaterToken smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact.CVE-2024-51425 · Other software · ethereum · reported by MITREHigh 8.8
An issue in the WaterToken smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact. NOTE: this is disputed by third parties because the impact is limited to function calls.
- Product
- ethereum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2024An issue in the PepeGxng smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact via the Owned.setOwnCVE-2024-51424 · Other software · ethereum · reported by MITRECritical 9.8
An issue in the PepeGxng smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact via the Owned.setOwner function. NOTE: this is disputed by third parties because the impact is limited to function calls.
- Product
- ethereum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2024mudler/LocalAI version 2.17.1 allows for arbitrary file write due to improper handling of automatic archive extraction.CVE-2024-6868 · Other software · mudler · reported by security@huntr.devCritical 9.8
mudler/LocalAI version 2.17.1 allows for arbitrary file write due to improper handling of automatic archive extraction. When model configurations specify additional files as archives (e.g., .tar), these archives are automatically extracted after downloading. This behavior can be exploited to perform a 'tarslip' attack, allowing files to be written to arbitrary locations on the server, bypassing checks that normally restrict files to the models directory. This vulnerability can lead to remote code execution (RCE) by overwriting backend assets used by the server.
- Product
- mudler/localai
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2024Profile files from TRO600 series radios are extracted in plain-text and encrypted file formats.CVE-2024-41156 · Other software · Hitachi Energy · reported by cybersecurity@hitachienergy.comLow 2.7
Profile files from TRO600 series radios are extracted in plain-text and encrypted file formats. Profile files provide potential attackers valuable configuration information about the Tropos network. Profiles can only be exported by authenticated users with higher privilege of write access.
- Product
- TRO600
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpublisher.hitachienergy.com
Oct 29, 2024WP Abstracts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50411 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevon Adonis WP Abstracts wp-abstracts-manuscripts-manager allows Stored XSS.This issue affects WP Abstracts: from n/a through <= 2.7.1.
- Product
- WP Abstracts
- Affected
- up to 2.7.1
- What to do
- Affects up to 2.7.1. Update WP Abstracts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 25, 2024In sms_ExtractCbLanguage of sms_CellBroadcast.c, there is a possible out of bounds read due to a missing bounds check.CVE-2024-47021 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comHigh 7.5
In sms_ExtractCbLanguage of sms_CellBroadcast.c, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2024In the Linux kernel, the following vulnerability has been resolved: mm/mremap: fix move_normal_pmd/retract_page_tables race In mremap(), move_page_tables() loCVE-2024-50066 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: mm/mremap: fix move_normal_pmd/retract_page_tables race In mremap(), move_page_tables() looks at the type of the PMD entry and the specified address range to figure out by which method the next chunk of page table entries should be moved. At that point, the mmap_lock is held in write mode, but no rmap locks are held yet. For PMD entries that point to page tables and are fully covered by the source address range, move_pgt_entry(NORMAL_PMD, ...) is called, which first takes rmap locks, then does move_normal_pmd(). move_normal_pmd() takes the necessary page table locks at source and destination, then moves an entire page table from the source to the destination. The problem is: The rmap locks, which protect against concurrent page table removal by retract_page_tables() in the THP code, are only taken after the PMD entry has been read and it has been decided how to move it. So we can race as follows (with two processes that have mappings of the same tmpfs file that is stored on a tmpfs mount with huge=advise); note that process A accesses page tables through the MM while process B does it through the file rmap:
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.