Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,933 results · page 12 of 39
Nov 17, 2024Spring MVC controller methods with an @RequestBody byte[] method parameter are vulnerable to a DoS attack.CVE-2024-38828 · Other software · Spring · reported by security@vmware.comMedium 5.3
Spring MVC controller methods with an @RequestBody byte[] method parameter are vulnerable to a DoS attack.
- Product
- Spring
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordspring.iosecurity.netapp.com
Nov 15, 2024By default, dedicated folders of CRYHOD for Windows up to 2024.3 can be accessed by other users to misuse technical files and make them perform tasks with higheCVE-2024-46465 · Other software · Primx · reported by MITREHigh 7.8
By default, dedicated folders of CRYHOD for Windows up to 2024.3 can be accessed by other users to misuse technical files and make them perform tasks with higher privileges. Configuration of CRYHOD has to be modified to prevent this vulnerability.
- Product
- Cryhod
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2024A Python command injection vulnerability exists in the `SagemakerLLM` class's `complete()` method within `./private_gpt/components/llm/custom/sagemaker.py` of tCVE-2024-4343 · Other software · imartinez · reported by security@huntr.devCritical 9.8
A Python command injection vulnerability exists in the `SagemakerLLM` class's `complete()` method within `./private_gpt/components/llm/custom/sagemaker.py` of the imartinez/privategpt application, versions up to and including 0.3.0. The vulnerability arises due to the use of the `eval()` function to parse a string received from a remote AWS SageMaker LLM endpoint into a dictionary. This method of parsing is unsafe as it can execute arbitrary Python code contained within the response. An attacker can exploit this vulnerability by manipulating the response from the AWS SageMaker LLM endpoint to include malicious Python code, leading to potential execution of arbitrary commands on the system hosting the application. The issue is fixed in version 0.6.0.
- Product
- imartinez/privategpt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2024In handleMessage of UsbDeviceManager.java, there is a possible method to access device contents over USB without unlocking the device due to a logic error in thCVE-2024-43085 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In handleMessage of UsbDeviceManager.java, there is a possible method to access device contents over USB without unlocking the device due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comsource.android.com
Nov 11, 2024Kanboard is project management software that focuses on the Kanban methodology.CVE-2024-51748 · Other software · kanboard · reported by GitHubCritical 9.1
Kanboard is project management software that focuses on the Kanban methodology. An authenticated Kanboard admin can run arbitrary php code on the server in combination with a file write possibility. The user interface language is determined and loaded by the setting `application_language` in the `settings` table. Thus, an attacker who can upload a modified sqlite.db through the dedicated feature, has control over the filepath, which is loaded. Exploiting this vulnerability has one constraint: the attacker must be able to place a file (called translations.php) on the system. However, this is not impossible, think of anonymous FTP server or another application that allows uploading files. Once the attacker has placed its file with the actual php code as the payload, the attacker can craft a sqlite db settings, which uses path traversal to point to the directory, where the `translations.php` file is stored. Then gaining code execution after importing the crafted sqlite.db. This issue has been addressed in version 1.2.42 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- kanboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2024Kanboard is project management software that focuses on the Kanban methodology.CVE-2024-51747 · Other software · kanboard · reported by GitHubCritical 9.1
Kanboard is project management software that focuses on the Kanban methodology. An authenticated Kanboard admin can read and delete arbitrary files from the server. File attachments, that are viewable or downloadable in Kanboard are resolved through its `path` entry in the `project_has_files` SQLite db. Thus, an attacker who can upload a modified sqlite.db through the dedicated feature, can set arbitrary file links, by abusing path traversals. Once the modified db is uploaded and the project page is accessed, a file download can be triggered and all files, readable in the context of the Kanboard application permissions, can be downloaded. This issue has been addressed in version 1.2.42 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- kanboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2024A flaw was found in hibernate-validator's 'isValid' method in the org.hibernate.validator.internal.constraintvalidators.hv.SafeHtmlValidator class, which can beCVE-2023-1932 · Other software · Red Hat · reported by Red HatMedium 6.1
A flaw was found in hibernate-validator's 'isValid' method in the org.hibernate.validator.internal.constraintvalidators.hv.SafeHtmlValidator class, which can be bypassed by omitting the tag ending in a less-than character. Browsers may render an invalid html, allowing HTML injection or Cross-Site-Scripting (XSS) attacks.
- Product
- A-MQ Clients 2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Nov 6, 2024symfony/http-client is a module for the Symphony PHP framework which provides powerful methods to fetch HTTP resources synchronously or asynchronously.CVE-2024-50342 · Other software · symfony · reported by GitHubLow 3.1
symfony/http-client is a module for the Symphony PHP framework which provides powerful methods to fetch HTTP resources synchronously or asynchronously. When using the `NoPrivateNetworkHttpClient`, some internal information is still leaking during host resolution, which leads to possible IP/port enumeration. As of versions 5.4.46, 6.4.14, and 7.1.7 the `NoPrivateNetworkHttpClient` now filters blocked IPs earlier to prevent such leaks. All users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- symfony
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2024In the Linux kernel, the following vulnerability has been resolved: drm/amd: Guard against bad data for ATIF ACPI method If a BIOS provides bad data in responCVE-2024-50117 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.3
In the Linux kernel, the following vulnerability has been resolved: drm/amd: Guard against bad data for ATIF ACPI method If a BIOS provides bad data in response to an ATIF method call this causes a NULL pointer dereference in the caller. ``` ? show_regs (arch/x86/kernel/dumpstack.c:478 (discriminator 1)) ? __die (arch/x86/kernel/dumpstack.c:423 arch/x86/kernel/dumpstack.c:434) ? page_fault_oops (arch/x86/mm/fault.c:544 (discriminator 2) arch/x86/mm/fault.c:705 (discriminator 2)) ? do_user_addr_fault (arch/x86/mm/fault.c:440 (discriminator 1) arch/x86/mm/fault.c:1232 (discriminator 1)) ? acpi_ut_update_object_reference (drivers/acpi/acpica/utdelete.c:642) ? exc_page_fault (arch/x86/mm/fault.c:1542) ? asm_exc_page_fault (./arch/x86/include/asm/idtentry.h:623) ? amdgpu_atif_query_backlight_caps.constprop.0 (drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c:387 (discriminator 2)) amdgpu ? amdgpu_atif_query_backlight_caps.constprop.0 (drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c:386 (discriminator 1)) amdgpu ``` It has been encountered on at least one system, so guard for it. (cherry picked from commit c9b7c809b89f24e9372a4e7f02d64c950b07fdee)
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Nov 4, 2024An issue in the createTempFile method of hornetq v2.4.9 allows attackers to arbitrarily overwrite files or access sensitive information.CVE-2024-51127 · Other software · redhat · reported by MITREHigh 7.1
An issue in the createTempFile method of hornetq v2.4.9 allows attackers to arbitrarily overwrite files or access sensitive information.
- Product
- hornetq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2024IBM TXSeries for Multiplatforms 10.1 could allow an attacker to obtain sensitive information from the query string of an HTTP GET method to process a request whCVE-2024-41738 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.9
IBM TXSeries for Multiplatforms 10.1 could allow an attacker to obtain sensitive information from the query string of an HTTP GET method to process a request which could be obtained using man in the middle techniques.
- Product
- TXSeries for Multiplatforms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2024A path traversal vulnerability exists in the `getFullPath` method of langchain-ai/langchainjs version 0.2.5.CVE-2024-7774 · Other software · langchain-ai · reported by security@huntr.devCritical 9.1
A path traversal vulnerability exists in the `getFullPath` method of langchain-ai/langchainjs version 0.2.5. This vulnerability allows attackers to save files anywhere in the filesystem, overwrite existing text files, read `.txt` files, and delete files. The vulnerability is exploited through the `setFileContent`, `getParsedFile`, and `mdelete` methods, which do not properly sanitize user input.
- Product
- langchain-ai/langchainjs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2024WTCMS 1.0 is vulnerable to SQL Injection in the edit_post method of /Admin\Controller\NavControl.class.php via the parentid parameter.CVE-2024-48238 · Other software · wtcms_project · reported by MITREMedium 4.7
WTCMS 1.0 is vulnerable to SQL Injection in the edit_post method of /Admin\Controller\NavControl.class.php via the parentid parameter.
- Product
- wtcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2024An issue in ofcms 1.1.2 allows a remote attacker to execute arbitrary code via the FileOutputStream function in the write String method of the ofcms-admin\src\mCVE-2024-48236 · Other software · ofcms_project · reported by MITREMedium 6.5
An issue in ofcms 1.1.2 allows a remote attacker to execute arbitrary code via the FileOutputStream function in the write String method of the ofcms-admin\src\main\java\com\ofsoft\cms\core\uitle\FileUtils.java file
- Product
- ofcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2024An issue in ofcms 1.1.2 allows a remote attacker to execute arbitrary code via the save method of the TemplateController.java file.CVE-2024-48235 · Other software · ofcms_project · reported by MITREMedium 6.5
An issue in ofcms 1.1.2 allows a remote attacker to execute arbitrary code via the save method of the TemplateController.java file.
- Product
- ofcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2024funadmin 5.0.2 is vulnerable to SQL Injection via the parentField parameter in the index method of \backend\controller\auth\Auth.php.CVE-2024-48230 · Other software · funadmin · reported by MITREHigh 7.2
funadmin 5.0.2 is vulnerable to SQL Injection via the parentField parameter in the index method of \backend\controller\auth\Auth.php.
- Product
- funadmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2024IBM CICS Transaction Gateway for Multiplatforms 9.2 and 9.3 transmits or stores authentication credentials, but it uses an insecure method that is susceptible tCVE-2023-50310 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.9
IBM CICS Transaction Gateway for Multiplatforms 9.2 and 9.3 transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
- Product
- CICS Transaction Gateway for Multiplatforms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2024In the Linux kernel, the following vulnerability has been resolved: can: m_can: pci: add missing m_can_class_free_dev() in probe/remove methods In m_can_pci_rCVE-2022-49024 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: can: m_can: pci: add missing m_can_class_free_dev() in probe/remove methods In m_can_pci_remove() and error handling path of m_can_pci_probe(), m_can_class_free_dev() should be called to free resource allocated by m_can_class_allocate_dev(), otherwise there will be memleak.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Oct 21, 2024In the Linux kernel, the following vulnerability has been resolved: ACPI: sysfs: validate return type of _STR method Only buffer objects are valid return valuCVE-2024-49860 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.3
In the Linux kernel, the following vulnerability has been resolved: ACPI: sysfs: validate return type of _STR method Only buffer objects are valid return values of _STR. If something else is returned description_show() will access invalid memory.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Oct 21, 2024Funadmin 5.0.2 is vulnerable to SQL Injection via the selectFields parameter in the index method of \backend\controller\auth\Auth.php.CVE-2024-48231 · Other software · funadmin · reported by MITREHigh 7.2
Funadmin 5.0.2 is vulnerable to SQL Injection via the selectFields parameter in the index method of \backend\controller\auth\Auth.php.
- Product
- funadmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2024The EWON FLEXY 202 transmits credentials using a weak encoding method base64.CVE-2024-7755 · Other software · HMS Networks · reported by ics-cert@hq.dhs.govHigh 7.1
The EWON FLEXY 202 transmits credentials using a weak encoding method base64. An attacker who is present in the network can sniff the traffic and decode the credentials.
- Product
- EWON FLEXY 202
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2024ClassCMS <=4.8 is vulnerable to file inclusion in the nowView method in/class/cms/cms.php, which can include a file uploaded to the/class/template directory to CVE-2024-48180 · Other software · classcms · reported by MITRECritical 9.8
ClassCMS <=4.8 is vulnerable to file inclusion in the nowView method in/class/cms/cms.php, which can include a file uploaded to the/class/template directory to execute PHP code.
- Product
- classcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2024Fields which are in 'read only' state in Bank Statement Draft in Manage Bank Statements application, could be modified by MERGE method.CVE-2024-45282 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
Fields which are in 'read only' state in Bank Statement Draft in Manage Bank Statements application, could be modified by MERGE method. The property of an OData entity representing assumably immutable method is not protected against external modifications leading to integrity violations. Confidentiality and Availability are not impacted.
- Product
- SAP S/4 HANA (Manage Bank Statements)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2024FlatPress CMS v1.3.1 1.3 was discovered to use insecure methods to store authentication data via the cookie's component.CVE-2024-41290 · Other software · flatpress · reported by MITREHigh 8.1
FlatPress CMS v1.3.1 1.3 was discovered to use insecure methods to store authentication data via the cookie's component.
- Product
- flatpress
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2024An issue in Plasmoapp RPShare Fabric mod v.1.0.0 allows a remote attacker to execute arbitrary code via the build method in DonwloadPromptScreenCVE-2024-33368 · Other software · plasmoapp · reported by MITREHigh 8.8
An issue in Plasmoapp RPShare Fabric mod v.1.0.0 allows a remote attacker to execute arbitrary code via the build method in DonwloadPromptScreen
- Product
- rpshare
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Sep 27, 2024Access permission verification vulnerability in the input method framework module Impact: Successful exploitation of this vulnerability may affect availability.CVE-2024-47294 · Other software · Huawei · reported by psirt@huawei.comMedium 4.4
Access permission verification vulnerability in the input method framework module Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 26, 2024The goTenna Pro App uses a weak password for sharing encryption keys via the key broadcast method.CVE-2024-47121 · Other software · goTenna · reported by ics-cert@hq.dhs.govMedium 6
The goTenna Pro App uses a weak password for sharing encryption keys via the key broadcast method. If the broadcasted encryption key is captured over RF, and password is cracked via brute force attack, it is possible to decrypt it and use it to decrypt all future and past messages sent via encrypted broadcast with that particular key. This only applies when the key is broadcasted over RF. This is an optional feature, so it is recommended to use local QR encryption key sharing for additional security on this and previous versions.
- Product
- Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 26, 2024The goTenna Pro ATAK plugin uses a weak password for sharing encryption keys via the key broadcast method.CVE-2024-45374 · Other software · goTenna · reported by ics-cert@hq.dhs.govMedium 6
The goTenna Pro ATAK plugin uses a weak password for sharing encryption keys via the key broadcast method. If the broadcasted encryption key is captured over RF, and password is cracked via brute force attack, it is possible to decrypt it and use it to decrypt all future and past messages sent via encrypted broadcast with that particular key. This only applies when the key is broadcasted over RF. This is an optional feature, so it is advised to use local QR encryption key sharing for additional security on this and previous versions.
- Product
- Pro ATAK Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2024A flaw exists in the SAML signature validation method within the Keycloak XMLSignatureUtil class.CVE-2024-8698 · Other software · Red Hat · reported by Red HatHigh 7.7
A flaw exists in the SAML signature validation method within the Keycloak XMLSignatureUtil class. The method incorrectly determines whether a SAML signature is for the full document or only for specific assertions based on the position of the signature in the XML document, rather than the Reference element used to specify the signed element. This flaw allows attackers to create crafted responses that can bypass the validation, potentially leading to privilege escalation or impersonation attacks.
- Product
- Red Hat Build of Keycloak
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Sep 11, 2024A vulnerability in the storage method of the PON Controller configuration file could allow an authenticated, local attacker with low privileges to obtain the MoCVE-2024-20489 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 8.4
A vulnerability in the storage method of the PON Controller configuration file could allow an authenticated, local attacker with low privileges to obtain the MongoDB credentials. This vulnerability is due to improper storage of the unencrypted database credentials on the device that is running Cisco IOS XR Software. An attacker could exploit this vulnerability by accessing the configuration files on an affected system. A successful exploit could allow the attacker to view MongoDB credentials.
- Product
- Cisco IOS XR Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Sep 11, 2024In the Linux kernel, the following vulnerability has been resolved: bpf: Fix a kernel verifier crash in stacksafe() Daniel Hodges reported a kernel verifier cCVE-2024-45020 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix a kernel verifier crash in stacksafe() Daniel Hodges reported a kernel verifier crash when playing with sched-ext. Further investigation shows that the crash is due to invalid memory access in stacksafe(). More specifically, it is the following code: if (exact != NOT_EXACT && old->stack[spi].slot_type[i % BPF_REG_SIZE] != cur->stack[spi].slot_type[i % BPF_REG_SIZE]) return false; The 'i' iterates old->allocated_stack. If cur->allocated_stack < old->allocated_stack the out-of-bound access will happen. To fix the issue add 'i >= cur->allocated_stack' check such that if the condition is true, stacksafe() should fail. Otherwise, cur->stack[spi].slot_type[i % BPF_REG_SIZE] memory access is legal.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Sep 5, 2024When a canister method is called via ic_cdk::call* , a new Future CallFuture is created and can be awaited by the caller to get the execution result.CVE-2024-7884 · Other software · Internet Computer · reported by 6b35d637-e00f-4228-858c-b20ad6e1d07bHigh 7.5
When a canister method is called via ic_cdk::call* , a new Future CallFuture is created and can be awaited by the caller to get the execution result. Internally, the state of the Future is tracked and stored in a struct called CallFutureState. A bug in the polling implementation of the CallFuture allows multiple references to be held for this internal state and not all references were dropped before the Future is resolved. Since we have unaccounted references held, a copy of the internal state ended up being persisted in the canister's heap and thus causing a memory leak. Impact Canisters built in Rust with ic_cdk and ic_cdk_timers are affected. If these canisters call a canister method, use timers or heartbeat, they will likely leak a small amount of memory on every such operation. In the worst case, this could lead to heap memory exhaustion triggered by an attacker. Motoko based canisters are not affected by the bug. PatchesThe patch has been backported to all minor versions between >= 0.8.0, <= 0.15.0. The patched versions available are 0.8.2, 0.9.3, 0.10.1, 0.11.6, 0.12.2, 0.13.5, 0.14.1, 0.15.1 and their previous versions have been yanked. WorkaroundsThere are no known work
- Product
- ic-cdk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2024IBM webMethods Integration 10.15 could allow an authenticated user to upload and execute arbitrary files which could be executed on the underlying operating sysCVE-2024-45076 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.9
IBM webMethods Integration 10.15 could allow an authenticated user to upload and execute arbitrary files which could be executed on the underlying operating system.
- Product
- webMethods Integration
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2024IBM webMethods Integration 10.15 could allow an authenticated user to create scheduler tasks that would allow them to escalate their privileges to administratorCVE-2024-45075 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.8
IBM webMethods Integration 10.15 could allow an authenticated user to create scheduler tasks that would allow them to escalate their privileges to administrator due to missing authentication.
- Product
- webMethods Integration
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2024IBM webMethods Integration 10.15 could allow an authenticated user to traverse directories on the system.CVE-2024-45074 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM webMethods Integration 10.15 could allow an authenticated user to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.
- Product
- webMethods Integration
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2024The stripImages and stripIframes methods didn't properly process inputs, leading to XSS vectors.CVE-2024-40743 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 6.1
The stripImages and stripIframes methods didn't properly process inputs, leading to XSS vectors.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2024Dell Command | Update, Dell Update, and Alienware Update UWP, versions prior to 5.4, contain an Exposed Dangerous Method or Function vulnerability.CVE-2024-28962 · Other software · Dell · reported by security_alert@emc.comMedium 6.5
Dell Command | Update, Dell Update, and Alienware Update UWP, versions prior to 5.4, contain an Exposed Dangerous Method or Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to denial of service.
- Product
- Dell Update (DU)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 1, 2024An issue discovered in casdoor v1.636.0 allows attackers to obtain sensitive information via the ssh.InsecureIgnoreHostKey() method.CVE-2024-41264 · Other software · casbin · reported by MITREHigh 7.5
An issue discovered in casdoor v1.636.0 allows attackers to obtain sensitive information via the ssh.InsecureIgnoreHostKey() method.
- Product
- casdoor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 19, 2024Cross Site Scripting vulnerability in RuoYi v.4.7.9 and before allows a remote attacker to execute arbitrary code via the file upload methodCVE-2024-41599 · Other software · Ruoyi · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in RuoYi v.4.7.9 and before allows a remote attacker to execute arbitrary code via the file upload method
- Product
- Ruoyi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 19, 2024Insecure Permissions vulnerability in lin-CMS Springboot v.0.2.1 and before allows a remote attacker to obtain sensitive information via the login method in theCVE-2024-41600 · Other software · Talelin · reported by MITREHigh 7.5
Insecure Permissions vulnerability in lin-CMS Springboot v.0.2.1 and before allows a remote attacker to obtain sensitive information via the login method in the UserController.java component.
- Product
- Lin-cms-spring-boot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 19, 2024Insecure Permissions vulnerability in lin-CMS v.0.2.0 and before allows a remote attacker to obtain sensitive information via the login method in the UserControCVE-2024-41601 · Other software · talelin · reported by MITREHigh 7.5
Insecure Permissions vulnerability in lin-CMS v.0.2.0 and before allows a remote attacker to obtain sensitive information via the login method in the UserController.java component.
- Product
- lin-cms-java-core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2024A flaw exists in FlashBlade whereby a local account is permitted to authenticate to the management interface using an unintended method that allows an attacker CVE-2023-4976 · Other software · PureStorage · reported by psirt@purestorage.comCritical 9.3
A flaw exists in FlashBlade whereby a local account is permitted to authenticate to the management interface using an unintended method that allows an attacker to gain privileged access to the array.
- Product
- FlashBlade
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpurestorage.compurestorage.com
Jul 9, 2024A potential JSON injection attack vector exists in PingFederate REST API data stores using the POST method and a JSON request body.CVE-2024-21832 · Other software · Ping Identity · reported by responsible-disclosure@pingidentity.comLow 3.5
A potential JSON injection attack vector exists in PingFederate REST API data stores using the POST method and a JSON request body.
- Product
- PingFederate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pingidentity.comdocs.pingidentity.com
Jul 9, 2024In com_android_internal_os_ZygoteCommandBuffer_nativeForkRepeatedly of com_android_internal_os_ZygoteCommandBuffer.cpp, there is a possible method to perform arCVE-2024-34720 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In com_android_internal_os_ZygoteCommandBuffer_nativeForkRepeatedly of com_android_internal_os_ZygoteCommandBuffer.cpp, there is a possible method to perform arbitrary code execution in any app zygote processes due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comsource.android.com
Jul 9, 2024Improper handling of input could lead to an XSS vector in the StringHelper::truncate method.CVE-2024-21731 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 6.1
Improper handling of input could lead to an XSS vector in the StringHelper::truncate method.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.joomla.orgdeveloper.joomla.org
Jul 1, 2024phpok 6.4.003 contains a Cross Site Scripting (XSS) vulnerability in the ok_f() method under the framework/api/upload_control.php file.CVE-2024-38953 · Websites & servers · Phpok · reported by MITREMedium 6.1
phpok 6.4.003 contains a Cross Site Scripting (XSS) vulnerability in the ok_f() method under the framework/api/upload_control.php file.
- Product
- Phpok
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2024cafebazaar hod v0.4.14 was discovered to contain a prototype pollution via the function request.CVE-2024-39015 · Other software · cafebazaar · reported by MITRECritical 9.8
cafebazaar hod v0.4.14 was discovered to contain a prototype pollution via the function request. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
- Product
- hod
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jun 28, 2024Buffer Overflow vulnerability in DCMTK v.3.6.8 allows an attacker to execute arbitrary code via the EctEnhancedCT method component.CVE-2024-27628 · Other software · offis · reported by MITREHigh 8.1
Buffer Overflow vulnerability in DCMTK v.3.6.8 allows an attacker to execute arbitrary code via the EctEnhancedCT method component.
- Product
- dcmtk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsupport.dcmtk.org
Jun 26, 2024The W3C XML Signature Syntax and Processing (XMLDsig) specification, starting with 1.0, was originally published with a "RetrievalMethod is a URI ...CVE-2024-34581 · Other software · w3c · reported by MITREHigh 7.3
The W3C XML Signature Syntax and Processing (XMLDsig) specification, starting with 1.0, was originally published with a "RetrievalMethod is a URI ... that may be used to obtain key and/or certificate information" statement and no accompanying information about SSRF risks, and this may have contributed to vulnerable implementations such as those discussed in CVE-2023-36661 and CVE-2024-21893. NOTE: this was mitigated in 1.1 and 2.0 via a directly referenced Best Practices document that calls on implementers to be wary of SSRF.
- Product
- xml_signature_syntax_and_processing
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2024Bludit uses predictable methods in combination with the MD5 hashing algorithm to generate sensitive tokens such as the API token and the user token.CVE-2024-24554 · Other software · Bludit · reported by vulnerability@ncsc.chMedium 6
Bludit uses predictable methods in combination with the MD5 hashing algorithm to generate sensitive tokens such as the API token and the user token. This allows attackers to authenticate against the Bludit API.
- Product
- Bludit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordredguard.chredguard.ch
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.