Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
15,261 results · page 107 of 306
Jan 17, 2024A vulnerability in the web-based management interface of Cisco BroadWorks Application Delivery Platform and Cisco BroadWorks Xtended Services Platform could allCVE-2024-20270 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4.8
A vulnerability in the web-based management interface of Cisco BroadWorks Application Delivery Platform and Cisco BroadWorks Xtended Services Platform could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
- Product
- Cisco BroadWorks
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.comsec.cloudapps.cisco.com
Jan 17, 2024A vulnerability in the application CLI of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager could allow an authenticated, local attackerCVE-2023-20260 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6
A vulnerability in the application CLI of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager could allow an authenticated, local attacker to gain escalated privileges. This vulnerability is due to improper processing of command line arguments to application scripts. An attacker could exploit this vulnerability by issuing a command on the CLI with malicious options. A successful exploit could allow the attacker to gain the escalated privileges of the root user on the underlying operating system.
- Product
- Cisco Prime Infrastructure
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.comsec.cloudapps.cisco.com
Jan 16, 2024Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: InfrastructuCVE-2023-21901 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.4
Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Infrastructure). Supported versions that are affected are 8.0.7, 8.0.8, 8.0.9, 8.1.0, 8.1.1 and 8.1.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Financial Services Analytical Applications Infrastructure. While the vulnerability is in Oracle Financial Services Analytical Applications Infrastructure, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Financial Services Analytical Applications Infrastructure accessible data as well as unauthorized read access to a subset of Oracle Financial Services Analytical Applications Infrastructure accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Financial Services Analytical Applications Infrastructure. CVSS 3.1 Base Score 7.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A
- Product
- Financial Services Analytical Applications Infrastructure
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2024XSS vulnerability in FireEye Central Management affecting version 9.1.1.956704, which could allow an attacker to modify special HTML elements in the applicationCVE-2024-0314 · Other software · FireEye · reported by cve-coordination@incibe.esMedium 5.4
XSS vulnerability in FireEye Central Management affecting version 9.1.1.956704, which could allow an attacker to modify special HTML elements in the application and cause a reflected XSS, leading to a session hijacking.
- Product
- FireEye Central Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2024Chromium Embedded Framework (CEF) is a simple framework for embedding Chromium-based browsers in other applications.`CefVideoConsumerOSR::OnFrameCaptured` does CVE-2024-21640 · Computers, phones & browsers · chromiumembedded · reported by GitHubMedium 5.4
Chromium Embedded Framework (CEF) is a simple framework for embedding Chromium-based browsers in other applications.`CefVideoConsumerOSR::OnFrameCaptured` does not check `pixel_format` properly, which leads to out-of-bounds read out of the sandbox. This vulnerability was patched in commit 1f55d2e.
- Product
- cef
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2024CEF (Chromium Embedded Framework ) is a simple framework for embedding Chromium-based browsers in other applications.CVE-2024-21639 · Computers, phones & browsers · chromiumembedded · reported by GitHubMedium 5.3
CEF (Chromium Embedded Framework ) is a simple framework for embedding Chromium-based browsers in other applications. `CefLayeredWindowUpdaterOSR::OnAllocatedSharedMemory` does not check the size of the shared memory, which leads to out-of-bounds read outside the sandbox. This vulnerability was patched in commit 1f55d2e.
- Product
- cef
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2024The application is vulnerable to Stored Cross-Site Scripting (XSS) in the endpoint /sofer/DocumentService.asc/SaveAnnotation, where input data transmitted via tCVE-2023-5118 · Other software · Kofax · reported by cvd@cert.plMedium 5.4
The application is vulnerable to Stored Cross-Site Scripting (XSS) in the endpoint /sofer/DocumentService.asc/SaveAnnotation, where input data transmitted via the POST method in the parameters author and text are not adequately sanitized and validated. This allows for the injection of malicious JavaScript code. The vulnerability was identified in the function for adding new annotations while editing document content. Reporters inform that the vulnerability has been removed in software versions above 11.1.x. Previous versions may also be vulnerable, but this has not been confirmed.
- Product
- Capture
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2024ScaleFusion 10.5.2 does not properly limit users to the Edge application because Alt-F4 can be used.CVE-2023-51751 · Other software · Scalefusion · reported by MITREMedium 6.8
ScaleFusion 10.5.2 does not properly limit users to the Edge application because Alt-F4 can be used. This is fixed in 10.5.7 by preventing the launching of the file explorer in Agent-based Multi-App and Single App Kiosk mode.
- Product
- Scalefusion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.scalefusion.commedium.com
Jan 11, 2024ScaleFusion 10.5.2 does not properly limit users to the Edge application because file downloads can occur.CVE-2023-51750 · Other software · scalefusion · reported by MITREMedium 4.6
ScaleFusion 10.5.2 does not properly limit users to the Edge application because file downloads can occur. NOTE: the vendor's position is "Not vulnerable if the default Windows device profile configuration is used which utilizes modern management with website allow-listing rules."
- Product
- scalefusion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.scalefusion.commedium.com
Jan 11, 2024ScaleFusion 10.5.2 does not properly limit users to the Edge application because a search can be made from a tooltip.CVE-2023-51749 · Other software · Scalefusion · reported by MITREHigh 8.8
ScaleFusion 10.5.2 does not properly limit users to the Edge application because a search can be made from a tooltip. NOTE: the vendor's position is "Not vulnerable if the default Windows device profile configuration is used which utilizes modern management with website allow-listing rules."
- Product
- Scalefusion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.scalefusion.commedium.com
Jan 11, 2024ScaleFusion 10.5.2 does not properly limit users to the Edge application because Ctrl-O and Ctrl-S can be used.CVE-2023-51748 · Other software · Scalefusion · reported by MITREHigh 8.8
ScaleFusion 10.5.2 does not properly limit users to the Edge application because Ctrl-O and Ctrl-S can be used. This is fixed in 10.5.7 by preventing the launching of the file explorer in Agent-based Multi-App and Single App Kiosk mode.
- Product
- Scalefusion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.scalefusion.commedium.com
Jan 11, 2024In ScaleFusion (Windows Desktop App) agent 10.5.2, Kiosk mode application restrictions can be bypassed allowing arbitrary code to be executed.CVE-2023-50159 · Other software · Scalefusion · reported by MITREHigh 8.8
In ScaleFusion (Windows Desktop App) agent 10.5.2, Kiosk mode application restrictions can be bypassed allowing arbitrary code to be executed. This is fixed in 10.5.7 by preventing the launching of the file explorer in Agent-based Multi-App and Single App Kiosk mode.
- Product
- Scalefusion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.scalefusion.commedium.com
Jan 11, 2024Hyperledger Aries Cloud Agent Python (ACA-Py) is a foundation for building decentralized identity applications and services running in non-mobile environments.CVE-2024-21669 · Other software · hyperledger · reported by GitHubCritical 9.9
Hyperledger Aries Cloud Agent Python (ACA-Py) is a foundation for building decentralized identity applications and services running in non-mobile environments. When verifying W3C Format Verifiable Credentials using JSON-LD with Linked Data Proofs (LDP-VCs), the result of verifying the presentation `document.proof` was not factored into the final `verified` value (`true`/`false`) on the presentation record. The flaw enables holders of W3C Format Verifiable Credentials using JSON-LD with Linked Data Proofs (LDPs) to present incorrectly constructed proofs, and allows malicious verifiers to save and replay a presentation from such holders as their own. This vulnerability has been present since version 0.7.0 and fixed in version 0.10.5.
- Product
- aries-cloudagent-python
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2024The vulnerability allows a remote attacker to authenticate to the web application with high privileges through multiple hidden hard-coded accounts.CVE-2023-48250 · Other software · Rexroth · reported by psirt@bosch.comHigh 8.1
The vulnerability allows a remote attacker to authenticate to the web application with high privileges through multiple hidden hard-coded accounts.
- Product
- Nexo cordless nutrunner NXA015S-36V (0608842001)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.bosch.compsirt.bosch.com
Jan 10, 2024The vulnerability allows an authenticated remote attacker to list arbitrary folders in all paths of the system under the context of the application OS user (“roCVE-2023-48249 · Other software · Rexroth · reported by psirt@bosch.comMedium 6.5
The vulnerability allows an authenticated remote attacker to list arbitrary folders in all paths of the system under the context of the application OS user (“root”) via a crafted HTTP request. By abusing this vulnerability, it is possible to steal session cookies of other active users.
- Product
- Nexo cordless nutrunner NXA015S-36V (0608842001)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.bosch.compsirt.bosch.com
Jan 10, 2024The vulnerability allows an unauthenticated remote attacker to read arbitrary files under the context of the application OS user (“root”) via a crafted HTTP reqCVE-2023-48247 · Other software · Rexroth · reported by psirt@bosch.comMedium 5.3
The vulnerability allows an unauthenticated remote attacker to read arbitrary files under the context of the application OS user (“root”) via a crafted HTTP request.
- Product
- Nexo cordless nutrunner NXA015S-36V (0608842001)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.bosch.compsirt.bosch.com
Jan 10, 2024The vulnerability allows a remote attacker to download arbitrary files in all paths of the system under the context of the application OS user (“root”) via a crCVE-2023-48246 · Other software · Rexroth · reported by psirt@bosch.comMedium 6.5
The vulnerability allows a remote attacker to download arbitrary files in all paths of the system under the context of the application OS user (“root”) via a crafted HTTP request.
- Product
- Nexo cordless nutrunner NXA015S-36V (0608842001)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.bosch.compsirt.bosch.com
Jan 10, 2024The vulnerability allows an unauthenticated remote attacker to upload arbitrary files under the context of the application OS user (“root”) via a crafted HTTP rCVE-2023-48245 · Other software · Rexroth · reported by psirt@bosch.comMedium 6.5
The vulnerability allows an unauthenticated remote attacker to upload arbitrary files under the context of the application OS user (“root”) via a crafted HTTP request.
- Product
- Nexo cordless nutrunner NXA015S-36V (0608842001)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.bosch.compsirt.bosch.com
Jan 10, 2024The vulnerability allows a remote attacker to upload arbitrary files in all paths of the system under the context of the application OS user (“root”) via a crafCVE-2023-48243 · Other software · Rexroth · reported by psirt@bosch.comHigh 8.1
The vulnerability allows a remote attacker to upload arbitrary files in all paths of the system under the context of the application OS user (“root”) via a crafted HTTP request. By abusing this vulnerability, it is possible to obtain remote code execution (RCE) with root privileges on the device.
- Product
- Nexo cordless nutrunner NXA015S-36V (0608842001)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.bosch.compsirt.bosch.com
Jan 10, 2024The vulnerability allows an authenticated remote attacker to download arbitrary files in all paths of the system under the context of the application OS user (“CVE-2023-48242 · Other software · Rexroth · reported by psirt@bosch.comMedium 6.5
The vulnerability allows an authenticated remote attacker to download arbitrary files in all paths of the system under the context of the application OS user (“root”) via a crafted HTTP request.
- Product
- Nexo cordless nutrunner NXA015S-36V (0608842001)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.bosch.compsirt.bosch.com
Jan 9, 2024react-native-mmkv is a library that allows easy use of MMKV inside React Native applications.CVE-2024-21668 · Other software · mrousavy · reported by GitHubMedium 4.4
react-native-mmkv is a library that allows easy use of MMKV inside React Native applications. Before version 2.11.0, the react-native-mmkv logged the optional encryption key for the MMKV database into the Android system log. The key can be obtained by anyone with access to the Android Debugging Bridge (ADB) if it is enabled in the phone settings. This bug is not present on iOS devices. By logging the encryption secret to the system logs, attackers can trivially recover the secret by enabling ADB and undermining an app's thread model. This issue has been patched in version 2.11.0.
- Product
- react-native-mmkv
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2024Issue summary: The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the internal state of applications running on PowCVE-2023-6129 · Websites & servers · OpenSSL · reported by openssl-security@openssl.orgMedium 6.5
Issue summary: The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the internal state of applications running on PowerPC CPU based platforms if the CPU provides vector instructions. Impact summary: If an attacker can influence whether the POLY1305 MAC algorithm is used, the application state might be corrupted with various application dependent consequences. The POLY1305 MAC (message authentication code) implementation in OpenSSL for PowerPC CPUs restores the contents of vector registers in a different order than they are saved. Thus the contents of some of these vector registers are corrupted when returning to the caller. The vulnerable code is used only on newer PowerPC processors supporting the PowerISA 2.07 instructions. The consequences of this kind of internal application state corruption can be various - from no consequences, if the calling application does not depend on the contents of non-volatile XMM registers at all, to the worst consequences, where the attacker could get complete control of the application process. However unless the compiler uses the vector registers for storing pointers, the most likely consequence, if an
- Product
- OpenSSL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2024SAP NetWeaver ABAP Application Server and ABAP Platform do not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerabilityCVE-2024-21738 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.1
SAP NetWeaver ABAP Application Server and ABAP Platform do not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. An attacker with low privileges can cause limited impact to confidentiality of the application data after successful exploitation.
- Product
- SAP NetWeaver ABAP Application Server and ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2024In SAP Application Interface Framework File Adapter - version 702, a high privilege user can use a function module to traverse through various layers and executCVE-2024-21737 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 8.4
In SAP Application Interface Framework File Adapter - version 702, a high privilege user can use a function module to traverse through various layers and execute OS commands directly. By this, such user can control the behaviour of the application. This leads to considerable impact on confidentiality, integrity and availability.
- Product
- SAP Application Interface Framework (File Adapter)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2024juzaweb <= 3.4 is vulnerable to Incorrect Access Control, resulting in an application outage after a 500 HTTP status code.CVE-2023-46906 · Other software · Juzaweb · reported by MITREMedium 4.9
juzaweb <= 3.4 is vulnerable to Incorrect Access Control, resulting in an application outage after a 500 HTTP status code. The payload in the timezone field was not correctly validated.
- Product
- CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2024XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it.CVE-2024-21651 · Other software · xwiki · reported by GitHubHigh 7.5
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A user able to attach a file to a page can post a malformed TAR file by manipulating file modification times headers, which when parsed by Tika, could cause a denial of service issue via CPU consumption. This vulnerability has been patched in XWiki 14.10.18, 15.5.3 and 15.8 RC1.
- Product
- xwiki-platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comjira.xwiki.org
Jan 8, 2024XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it.CVE-2024-21648 · Other software · xwiki · reported by GitHubHigh 8
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The rollback action is missing a right protection, a user can rollback to a previous version of the page to gain rights they don't have anymore. The problem has been patched in XWiki 14.10.17, 15.5.3 and 15.8-rc-1 by ensuring that the rights are checked before performing the rollback.
- Product
- xwiki-platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2024XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it.CVE-2024-21650 · Other software · xwiki · reported by GitHubCritical 10
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki is vulnerable to a remote code execution (RCE) attack through its user registration feature. This issue allows an attacker to execute arbitrary code by crafting malicious payloads in the "first name" or "last name" fields during user registration. This impacts all installations that have user registration enabled for guests. This vulnerability has been patched in XWiki 14.10.17, 15.5.3 and 15.8 RC1.
- Product
- xwiki-platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2024Puma is a web server for Ruby/Rack applications built for parallelism.CVE-2024-21647 · Other software · puma · reported by GitHubMedium 5.9
Puma is a web server for Ruby/Rack applications built for parallelism. Prior to version 6.4.2, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies in a way that allowed HTTP request smuggling. Fixed versions limits the size of chunk extensions. Without this limit, an attacker could cause unbounded resource (CPU, network bandwidth) consumption. This vulnerability has been fixed in versions 6.4.2 and 5.6.8.
- Product
- puma
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 5, 2024Cross Site Scripting (XSS) vulnerability in AVA teaching video application service platform version 3.1, allows remote attackers to execute arbitrary code via aCVE-2023-50609 · Other software · AVA · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability in AVA teaching video application service platform version 3.1, allows remote attackers to execute arbitrary code via a crafted script to ajax.aspx.
- Product
- Teaching Video Application Service Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jan 4, 2024SideQuest is a place to get virtual reality applications for Oculus Quest.CVE-2024-21625 · Other software · SideQuestVR · reported by GitHubHigh 8.8
SideQuest is a place to get virtual reality applications for Oculus Quest. The SideQuest desktop application uses deep links with a custom protocol (`sidequest://`) to trigger actions in the application from its web contents. Because, prior to version 0.10.35, the deep link URLs were not sanitized properly in all cases, a one-click remote code execution can be achieved in cases when a device is connected, the user is presented with a malicious link and clicks it from within the application. As of version 0.10.35, the custom protocol links within the electron application are now being parsed and sanitized properly.
- Product
- SideQuest
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 3, 2024Users’ product account authentication data was stored in clear text in The Genie Company Aladdin Connect Mobile Application Version 5.65 Build 2075 (and below) CVE-2023-5879 · Other software · The Genie Company · reported by cve@rapid7.comMedium 6.8
Users’ product account authentication data was stored in clear text in The Genie Company Aladdin Connect Mobile Application Version 5.65 Build 2075 (and below) on Android Devices. This allows the attacker, with access to the android device, to potentially retrieve users' clear text authentication credentials.
- Product
- Aladdin Connect Mobile Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 3, 2024Kruise provides automated management of large-scale applications on Kubernetes.CVE-2023-30617 · Other software · openkruise · reported by GitHubMedium 6.5
Kruise provides automated management of large-scale applications on Kubernetes. Starting in version 0.8.0 and prior to versions 1.3.1, 1.4.1, and 1.5.2, an attacker who has gained root privilege of the node that kruise-daemon run can leverage the kruise-daemon pod to list all secrets in the entire cluster. After that, the attacker can leverage the "captured" secrets (e.g. the kruise-manager service account token) to gain extra privileges such as pod modification. Versions 1.3.1, 1.4.1, and 1.5.2 fix this issue. A workaround is available. For users that do not require imagepulljob functions, they can modify kruise-daemon-role to drop the cluster level secret get/list privilege.
- Product
- kruise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 30, 2023Royal RoyalTSX before 6.0.2.1 allows attackers to cause a denial of service (Heap Memory Corruption and application crash) or possibly have unspecified other imCVE-2023-52277 · Other software · Royalapps · reported by MITREHigh 7.8
Royal RoyalTSX before 6.0.2.1 allows attackers to cause a denial of service (Heap Memory Corruption and application crash) or possibly have unspecified other impact via a long hostname in an RTSZ file, if the victim clicks on Test Connection. This occurs during SecureGatewayHost object processing in RAPortCheck.createNWConnection.
- Product
- Royaltsx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzeroscience.mkzeroscience.mk
Dec 30, 2023Improper privilege management vulnerability in CoolKit Technology eWeLink on Android and iOS allows application lockscreen bypass.This issue affects eWeLink befCVE-2023-6998 · Other software · CoolKit Technology · reported by cvd@cert.plHigh 7.7
Improper privilege management vulnerability in CoolKit Technology eWeLink on Android and iOS allows application lockscreen bypass.This issue affects eWeLink before 5.2.0.
- Product
- eWeLink - Smart Home
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2023A vulnerability classified as critical has been found in Netentsec NS-ASG Application Security Gateway 6.3.1.CVE-2023-7161 · Other software · Netentsec · reported by VulDBHigh 7.3
A vulnerability classified as critical has been found in Netentsec NS-ASG Application Security Gateway 6.3.1. This affects an unknown part of the file index.php?para=index of the component Login. The manipulation of the argument check_VirtualSiteId leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249183.
- Product
- NS-ASG Application Security Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2023mupnp/net/uri.c in mUPnP for C through 3.0.2 has an out-of-bounds read and application crash because it lacks a certain host length recalculation.CVE-2023-52152 · Other software · Cybergarage · reported by MITREHigh 7.5
mupnp/net/uri.c in mUPnP for C through 3.0.2 has an out-of-bounds read and application crash because it lacks a certain host length recalculation.
- Product
- Mupnp For C
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2023The com.altamirano.fabricio.tvbrowser TV browser application through 4.5.1 for Android is vulnerable to JavaScript code execution via an explicit intent due to CVE-2023-47883 · Other software · Vladymix · reported by MITRECritical 9.8
The com.altamirano.fabricio.tvbrowser TV browser application through 4.5.1 for Android is vulnerable to JavaScript code execution via an explicit intent due to an exposed MainActivity.
- Product
- TV Browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2023The Kami Vision YI IoT com.yunyi.smartcamera application through 4.1.9_20231127 for Android allows a remote attacker to execute arbitrary JavaScript code via anCVE-2023-47882 · Other software · Kamivision · reported by MITREHigh 7.1
The Kami Vision YI IoT com.yunyi.smartcamera application through 4.1.9_20231127 for Android allows a remote attacker to execute arbitrary JavaScript code via an implicit intent to the com.ants360.yicamera.activity.WebViewActivity component.
- Product
- YI IOT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.complay.google.com
Dec 27, 2023The com.phlox.tvwebbrowser TV Bro application through 2.0.0 for Android mishandles external intents through WebView.CVE-2023-43955 · Other software · Fedirtsapana · reported by MITRECritical 9.8
The com.phlox.tvwebbrowser TV Bro application through 2.0.0 for Android mishandles external intents through WebView. This allows attackers to execute arbitrary code, create arbitrary files. and perform arbitrary downloads via JavaScript that uses takeBlobDownloadData.
- Product
- TV BRO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2023SteVe Community ocpp-jaxb before 0.0.8 generates invalid timestamps such as ones with month 00 in certain situations (such as when an application receives a StaCVE-2023-52096 · Other software · Steve-community · reported by MITREHigh 7.5
SteVe Community ocpp-jaxb before 0.0.8 generates invalid timestamps such as ones with month 00 in certain situations (such as when an application receives a StartTransaction Open Charge Point Protocol message with a timestamp parameter of 1000000). This may lead to a SQL exception in applications, and may undermine the integrity of transaction records.
- Product
- Ocpp-jaxb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 25, 2023The workflow-engine of ILIAS before 7.23 and 8 before 8.3 allows remote authenticated users to run arbitrary system commands on the application server as the apCVE-2023-36486 · Other software · Ilias · reported by MITREHigh 7.2
The workflow-engine of ILIAS before 7.23 and 8 before 8.3 allows remote authenticated users to run arbitrary system commands on the application server as the application user by uploading a workflow definition file with a malicious filename.
- Product
- Ilias
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocu.ilias.degithub.com
Dec 25, 2023The workflow-engine of ILIAS before 7.23 and 8 before 8.3 allows remote authenticated users to run arbitrary system commands on the application server as the apCVE-2023-36485 · Other software · Ilias · reported by MITREHigh 7.2
The workflow-engine of ILIAS before 7.23 and 8 before 8.3 allows remote authenticated users to run arbitrary system commands on the application server as the application user via a malicious BPMN2 workflow definition file.
- Product
- Ilias
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocu.ilias.degithub.com
Dec 24, 2023A vulnerability classified as problematic was found in Netentsec NS-ASG Application Security Gateway 6.3.CVE-2023-7094 · Other software · Netentsec · reported by VulDBMedium 5.3
A vulnerability classified as problematic was found in Netentsec NS-ASG Application Security Gateway 6.3. Affected by this vulnerability is an unknown functionality of the file /protocol/nsasg6.0.tgz. The manipulation leads to information disclosure. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-248941 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- NS-ASG Application Security Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2023Gradio is an open-source Python package that allows you to quickly build a demo or web application for your machine learning model, API, or any arbitary Python CVE-2023-51449 · Other software · gradio-app · reported by GitHubMedium 5.6
Gradio is an open-source Python package that allows you to quickly build a demo or web application for your machine learning model, API, or any arbitary Python function. Versions of `gradio` prior to 4.11.0 contained a vulnerability in the `/file` route which made them susceptible to file traversal attacks in which an attacker could access arbitrary files on a machine running a Gradio app with a public URL (e.g. if the demo was created with `share=True`, or on Hugging Face Spaces) if they knew the path of files to look for. This issue has been patched in version 4.11.0.
- Product
- gradio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2023The Snowflake .NET driver provides an interface to the Microsoft .NET open source software framework for developing applications.CVE-2023-51662 · Other software · snowflakedb · reported by GitHubMedium 6
The Snowflake .NET driver provides an interface to the Microsoft .NET open source software framework for developing applications. Snowflake recently received a report about a vulnerability in the Snowflake Connector .NET where the checks against the Certificate Revocation List (CRL) were not performed where the insecureMode flag was set to false, which is the default setting. The vulnerability affects versions between 2.0.25 and 2.1.4 (inclusive). Snowflake fixed the issue in version 2.1.5.
- Product
- snowflake-connector-net
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.snowflake.comgithub.com
Dec 22, 2023Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL datCVE-2023-51649 · Other software · nautobot · reported by GitHubLow 3.5
Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. When submitting a Job to run via a Job Button, only the model-level `extras.run_job` permission is checked (i.e., does the user have permission to run Jobs in general). Object-level permissions (i.e., does the user have permission to run this specific Job?) are not enforced by the URL/view used in this case. A user with permissions to run even a single Job can actually run all configured JobButton Jobs. Fix will be available in Nautobot 1.6.8 and 2.1.0
- Product
- nautobot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2023Sudo before 1.9.15 might allow row hammer attacks (for authentication bypass or privilege escalation) because application logic sometimes is based on not equaliCVE-2023-42465 · Other software · Sudo Project · reported by MITREHigh 7
Sudo before 1.9.15 might allow row hammer attacks (for authentication bypass or privilege escalation) because application logic sometimes is based on not equaling an error value (instead of equaling a success value), and because the values do not resist flips of a single bit.
- Product
- Sudo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 21, 2023Bentley eB System Management Console applications within Assetwise Integrity Information Server allow an unauthenticated user to view configuration options via CVE-2023-51708 · Other software · Bentley · reported by MITREHigh 8.6
Bentley eB System Management Console applications within Assetwise Integrity Information Server allow an unauthenticated user to view configuration options via a crafted request, leading to information disclosure. This affects eB System management Console before 23.00.02.03 and Assetwise ALIM For Transportation before 23.00.01.25.
- Product
- Assetwise Alim For Transportation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbentley.combentley.com
Dec 21, 2023XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it.CVE-2023-50732 · Other software · xwiki · reported by GitHubHigh 8.3
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to execute a Velocity script without script right through the document tree. This has been patched in XWiki 14.10.7 and 15.2RC1.
- Product
- xwiki-platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.