Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
17,376 results · page 129 of 348
Jan 30, 2025A vulnerability was found in Codezips Gym Management System 1.0.CVE-2025-0881 · Other software · Codezips · reported by VulDBMedium 5.3
A vulnerability was found in Codezips Gym Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /dashboard/admin/saveroutine.php. The manipulation of the argument rname leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Gym Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2025A vulnerability was found in Codezips Gym Management System 1.0 and classified as critical.CVE-2025-0880 · Other software · Codezips · reported by VulDBMedium 5.3
A vulnerability was found in Codezips Gym Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /dashboard/admin/updateplan.php. The manipulation of the argument planid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Gym Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2025This vulnerability allows appliance compromise at boot time.CVE-2025-24507 · Other software · Broadcom · reported by secure@symantec.comHigh 8.9
This vulnerability allows appliance compromise at boot time.
- Product
- Symantec Privileged Access Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2025A specific authentication strategy allows to learn ids of PAM users associated with certain authentication types.CVE-2025-24506 · Other software · Broadcom · reported by secure@symantec.comMedium 5.3
A specific authentication strategy allows to learn ids of PAM users associated with certain authentication types.
- Product
- Symantec Privileged Access Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2025This vulnerability allows a high-privileged authenticated PAM user to achieve remote command execution on the affected PAM system by uploading a specially craftCVE-2025-24505 · Other software · Broadcom · reported by secure@symantec.comHigh 8.8
This vulnerability allows a high-privileged authenticated PAM user to achieve remote command execution on the affected PAM system by uploading a specially crafted upgrade file.
- Product
- Symantec Privileged Access Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2025An improper input validation the CSRF filter results in unsanitized user input written to the application logs.CVE-2025-24504 · Other software · Broadcom · reported by secure@symantec.comMedium 5.3
An improper input validation the CSRF filter results in unsanitized user input written to the application logs.
- Product
- Symantec Privileged Access Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2025A malicious actor can fix the session of a PAM user by tricking the user to click on a specially crafted link to the PAM server.CVE-2025-24503 · Other software · Broadcom · reported by secure@symantec.comCritical 9.3
A malicious actor can fix the session of a PAM user by tricking the user to click on a specially crafted link to the PAM server.
- Product
- Symantec Privileged Access Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2025An improper session validation allows an unauthenticated attacker to cause certain request notifications to be executed in the context of an incorrect user by sCVE-2025-24502 · Other software · Broadcom · reported by secure@symantec.comMedium 5.3
An improper session validation allows an unauthenticated attacker to cause certain request notifications to be executed in the context of an incorrect user by spoofing the client IP address.
- Product
- Symantec Privileged Access Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2025An improper input validation allows an unauthenticated attacker to alter PAM logs by sending a specially crafted HTTP request.CVE-2025-24501 · Other software · Broadcom · reported by secure@symantec.comMedium 5.3
An improper input validation allows an unauthenticated attacker to alter PAM logs by sending a specially crafted HTTP request.
- Product
- Symantec Privileged Access Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2025The vulnerability allows an unauthenticated attacker to access information in PAM database.CVE-2025-24500 · Other software · Broadcom · reported by secure@symantec.comHigh 8.7
The vulnerability allows an unauthenticated attacker to access information in PAM database.
- Product
- Symantec Privileged Access Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2025Password Vulnerability in Safety production process management system v1.0 allows a remote attacker to escalate privileges, execute arbitrary code and obtain seCVE-2024-57395 · Other software · reported by MITRECritical 9.8
Password Vulnerability in Safety production process management system v1.0 allows a remote attacker to escalate privileges, execute arbitrary code and obtain sensitive information via the password and account number parameters.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2025A vulnerability, which was classified as critical, has been found in Codezips Gym Management System 1.0.CVE-2025-0803 · Other software · Codezips · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, has been found in Codezips Gym Management System 1.0. Affected by this issue is some unknown functionality of the file /dashboard/admin/submit_plan_new.php. The manipulation of the argument planid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Gym Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2025A vulnerability in the web management interface of HPE Aruba Networking Fabric Composer could allow an authenticated remote attacker to conduct a stored cross-sCVE-2025-23057 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comMedium 5.5
A vulnerability in the web management interface of HPE Aruba Networking Fabric Composer could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack. If successfully exploited, a threat actor could run arbitrary script code in a victim's web browser within the context of the compromised interface.
- Product
- HPE Aruba Networking Fabric Composer (AFC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2025A vulnerability in the web management interface of HPE Aruba Networking Fabric Composer could allow an authenticated remote attacker to conduct a stored cross-sCVE-2025-23056 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comMedium 5.5
A vulnerability in the web management interface of HPE Aruba Networking Fabric Composer could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack. If successfully exploited, a threat actor could run arbitrary script code in a victim's web browser within the context of the compromised interface.
- Product
- HPE Aruba Networking Fabric Composer (AFC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2025A vulnerability in the web management interface of HPE Aruba Networking Fabric Composer could allow an authenticated remote attacker to conduct a stored cross-sCVE-2025-23055 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comMedium 5.5
A vulnerability in the web management interface of HPE Aruba Networking Fabric Composer could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack. If successfully exploited, a threat actor could run arbitrary script code in a victim's web browser within the context of the compromised interface.
- Product
- HPE Aruba Networking Fabric Composer (AFC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2025A vulnerability in the web-based management interface of HPE Aruba Networking Fabric Composer could allow an authenticated low privilege operator user to perforCVE-2025-23054 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comMedium 6.5
A vulnerability in the web-based management interface of HPE Aruba Networking Fabric Composer could allow an authenticated low privilege operator user to perform operations not allowed by their privilege level. Successful exploitation could allow an attacker to manipulate user generated files, potentially leading to unauthorized changes in critical system configurations.
- Product
- HPE Aruba Networking Fabric Composer (AFC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2025A privilege escalation vulnerability exists in the web-based management interface of HPE Aruba Networking Fabric Composer.CVE-2025-23053 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comMedium 6.5
A privilege escalation vulnerability exists in the web-based management interface of HPE Aruba Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user to change the state of certain settings of a vulnerable system.
- Product
- HPE Aruba Networking Fabric Composer (AFC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2025Philantro – Donations and Donor Management: Stored Cross-Site ScriptingCVE-2024-13527 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Philantro – Donations and Donor Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes like 'donate' in all versions up to, and including, 5.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Philantro – Donations and Donor Management
- Affected
- up to 5.3
- What to do
- Affects up to 5.3. Update Philantro – Donations and Donor Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 27, 2025This issue was addressed through improved state management.CVE-2025-24162 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 6.5
This issue was addressed through improved state management. This issue is fixed in Safari 18.3, iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, tvOS 18.3, visionOS 2.3, watchOS 11.3. Processing maliciously crafted web content may lead to an unexpected process crash.
- Product
- Safari
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Jan 27, 2025An authentication issue was addressed with improved state management.CVE-2025-24141 · Computers, phones & browsers · Apple · reported by product-security@apple.comLow 3.3
An authentication issue was addressed with improved state management. This issue is fixed in iOS 18.3 and iPadOS 18.3. An attacker with physical access to an unlocked device may be able to access Photos while the app is locked.
- Product
- iOS and iPadOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comseclists.org
Jan 27, 2025This issue was addressed through improved state management.CVE-2025-24140 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.3
This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.3. Files downloaded from the internet may not have the quarantine flag applied.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comseclists.org
Jan 27, 2025This issue was addressed through improved state management.CVE-2025-24138 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3. A malicious application may be able to leak sensitive user information.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Jan 27, 2025This issue was addressed by improved management of object lifetimes.CVE-2025-24120 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.5
This issue was addressed by improved management of object lifetimes. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3. An attacker may be able to cause unexpected app termination.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Jan 27, 2025This issue was addressed through improved state management.CVE-2025-24096 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.3. A malicious app may be able to access arbitrary files.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comseclists.org
Jan 27, 2025An authentication issue was addressed with improved state management.CVE-2024-54542 · Computers, phones & browsers · Apple · reported by product-security@apple.comCritical 9.1
An authentication issue was addressed with improved state management. This issue is fixed in Safari 18.2, iOS 18.2 and iPadOS 18.2, macOS Sequoia 15.2, watchOS 11.2. Private Browsing tabs may be accessed without authentication.
- Product
- Safari
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Jan 27, 2025This issue was addressed through improved state management.CVE-2024-54541 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
This issue was addressed through improved state management. This issue is fixed in iOS 18.2 and iPadOS 18.2, macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2, tvOS 18.2, visionOS 2.2, watchOS 11.2. An app may be able to access user-sensitive data.
- Product
- iOS and iPadOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Jan 27, 2025This issue was addressed through improved state management.CVE-2024-54539 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2. An app may be able to capture keyboard events from the lock screen.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Jan 27, 2025A use-after-free issue was addressed with improved memory management.CVE-2024-54499 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 8.8
A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 18.2 and iPadOS 18.2, macOS Sequoia 15.2, tvOS 18.2, visionOS 2.2, watchOS 11.2. Processing a maliciously crafted image may lead to arbitrary code execution.
- Product
- iOS and iPadOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Jan 27, 2025Cacti is an open source performance and fault management framework.CVE-2025-24368 · Other software · Cacti · reported by GitHubMedium 6.9
Cacti is an open source performance and fault management framework. Some of the data stored in automation_tree_rules.php is not thoroughly checked and is used to concatenate the SQL statement in build_rule_item_filter() function from lib/api_automation.php, resulting in SQL injection. This vulnerability is fixed in 1.2.29.
- Product
- cacti
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2025Cacti is an open source performance and fault management framework.CVE-2025-24367 · Other software · Cacti · reported by GitHubHigh 8.7
Cacti is an open source performance and fault management framework. An authenticated Cacti user can abuse graph creation and graph template functionality to create arbitrary PHP scripts in the web root of the application, leading to remote code execution on the server. This vulnerability is fixed in 1.2.29.
- Product
- cacti
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2025Cacti is an open source performance and fault management framework.CVE-2025-22604 · Other software · Cacti · reported by GitHubCritical 9.1
Cacti is an open source performance and fault management framework. Due to a flaw in multi-line SNMP result parser, authenticated users can inject malformed OIDs in the response. When processed by ss_net_snmp_disk_io() or ss_net_snmp_disk_bytes(), a part of each OID will be used as a key in an array that is used as part of a system command, causing a command execution vulnerability. This vulnerability is fixed in 1.2.29.
- Product
- cacti
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2025Cacti is an open source performance and fault management framework.CVE-2024-54146 · Other software · Cacti · reported by GitHubHigh 7.6
Cacti is an open source performance and fault management framework. Cacti has a SQL injection vulnerability in the template function of host_templates.php using the graph_template parameter. This vulnerability is fixed in 1.2.29.
- Product
- cacti
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2025Cacti is an open source performance and fault management framework.CVE-2024-54145 · Other software · Cacti · reported by GitHubMedium 6.3
Cacti is an open source performance and fault management framework. Cacti has a SQL injection vulnerability in the get_discovery_results function of automation_devices.php using the network parameter. This vulnerability is fixed in 1.2.29.
- Product
- cacti
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2025Cacti is an open source performance and fault management framework.CVE-2024-45598 · Other software · Cacti · reported by GitHubMedium 6
Cacti is an open source performance and fault management framework. Prior to 1.2.29, an administrator can change the `Poller Standard Error Log Path` parameter in either Installation Step 5 or in Configuration->Settings->Paths tab to a local file inside the server. Then simply going to Logs tab and selecting the name of the local file will show its content on the web UI. This vulnerability is fixed in 1.2.29.
- Product
- cacti
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2025LawPress – Law Firm Website Management: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23756 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ivanchernyakov LawPress – Law Firm Website Management lawpress allows Reflected XSS.This issue affects LawPress – Law Firm Website Management: from n/a through <= 1.4.5.
- Product
- LawPress – Law Firm Website Management
- Affected
- up to 1.4.5
- What to do
- Affects up to 1.4.5. Update LawPress – Law Firm Website Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 27, 2025An improper privilege management vulnerability in OTRS Generic Interface module allows change of the Ticket status even if the user only has ro permissions.CVE-2024-43446 · Other software · OTRS AG · reported by security@otrs.comLow 3.5
An improper privilege management vulnerability in OTRS Generic Interface module allows change of the Ticket status even if the user only has ro permissions. This issue affects: * OTRS 7.0.X * OTRS 8.0.X * OTRS 2023.X * OTRS 2024.X * ((OTRS)) Community Edition: 6.0.x Products based on the ((OTRS)) Community Edition also very likely to be affected
- Product
- OTRS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2025IBM InfoSphere Master Data Management 11.6, 12.0, and 14.0 is vulnerable to stored cross-site scripting.CVE-2023-46187 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.4
IBM InfoSphere Master Data Management 11.6, 12.0, and 14.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
- Product
- InfoSphere Master Data Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2025A vulnerability was found in Itechscripts School Management Software 2.75.CVE-2017-20196 · Other software · Itechscripts · reported by VulDBMedium 5.3
A vulnerability was found in Itechscripts School Management Software 2.75. It has been classified as critical. This affects an unknown part of the file /notice-edit.php. The manipulation of the argument aid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- School Management Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 25, 2025Local privilege escalation due to incorrect assignment of privileges of temporary files in the update mechanism of G DATA Management Server.CVE-2025-0542 · Other software · G DATA CyberDefense AG · reported by a341c0d1-ebf7-493f-a84e-38cf86618674High 7.3
Local privilege escalation due to incorrect assignment of privileges of temporary files in the update mechanism of G DATA Management Server. This vulnerability allows a local, unprivileged attacker to escalate privileges on affected installations by placing a crafted ZIP archive in a globally writable directory, which gets unpacked in the context of SYSTEM and results in arbitrary file write.
- Product
- G DATA Management Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 24, 2025RSVP and Event Management: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-24683 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Chill RSVP and Event Management rsvp allows SQL Injection.This issue affects RSVP and Event Management: from n/a through <= 2.7.14.
- Product
- RSVP and Event Management
- Affected
- up to 2.7.14
- What to do
- Affects up to 2.7.14. Update RSVP and Event Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025IBM Maximo Asset Management 7.6.1.3 MXAPIASSET API is vulnerable to unrestricted file upload which allows authenticated low privileged user to upload restrictedCVE-2024-45077 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM Maximo Asset Management 7.6.1.3 MXAPIASSET API is vulnerable to unrestricted file upload which allows authenticated low privileged user to upload restricted file types with a simple method of adding a dot to the end of the file name if Maximo is installed on Windows operating system.
- Product
- Maximo Asset Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2025BigFix Patch Download Plug-ins are affected by path traversal vulnerability.CVE-2024-42187 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.3
BigFix Patch Download Plug-ins are affected by path traversal vulnerability. The application could allow operators to download files from a local repository which is vulnerable to path traversal attacks.
- Product
- BigFix Patch Management Download Plug-ins
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Jan 22, 2025BigFix Patch Download Plug-ins are affected by an insecure protocol support.CVE-2024-42186 · Other software · HCL Software · reported by psirt@hcl.comLow 2.8
BigFix Patch Download Plug-ins are affected by an insecure protocol support. The application can allow improper handling of SSL certificates validation.
- Product
- BigFix Patch Management Download Plug-ins
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Jan 22, 2025BigFix Patch Download Plug-ins are affected by an insecure package which is susceptible to XML injection attacks.CVE-2024-42185 · Other software · HCL Software · reported by psirt@hcl.comLow 2.5
BigFix Patch Download Plug-ins are affected by an insecure package which is susceptible to XML injection attacks. This allows an attacker to exploit this vulnerability by injecting malicious XML content, which can lead to various issues including denial of service and unauthorized access.
- Product
- BigFix Patch Management Download Plug-ins
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Jan 22, 2025BigFix Patch Download Plug-ins are affected by insecure support for file URI scheme.CVE-2024-42184 · Other software · HCL Software · reported by psirt@hcl.comLow 2.5
BigFix Patch Download Plug-ins are affected by insecure support for file URI scheme. It could allow a malicious operator to attempt to download files using the file:// URI scheme.
- Product
- BigFix Patch Management Download Plug-ins
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Jan 22, 2025BigFix Patch Download Plug-ins are affected by an arbitrary file download vulnerability.CVE-2024-42183 · Other software · HCL Software · reported by psirt@hcl.comLow 2.5
BigFix Patch Download Plug-ins are affected by an arbitrary file download vulnerability. It could allow a malicious operator to download files from arbitrary URLs without any proper validation or allowlist controls.
- Product
- BigFix Patch Management Download Plug-ins
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Jan 22, 2025BigFix Patch Download Plug-ins are affected by Server-Side Request Forgery (SSRF) vulnerability.CVE-2024-42182 · Other software · HCL Software · reported by psirt@hcl.comLow 2.5
BigFix Patch Download Plug-ins are affected by Server-Side Request Forgery (SSRF) vulnerability. It may allow the application to download files from an internally hosted server on localhost.
- Product
- BigFix Patch Management Download Plug-ins
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Jan 22, 2025Improper Privilege Management vulnerability in Cloudflare WARP on Windows allows File Manipulation.CVE-2025-0651 · Other software · Cloudflare · reported by cna@cloudflare.comMedium 6.1
Improper Privilege Management vulnerability in Cloudflare WARP on Windows allows File Manipulation. User with a low system privileges can create a set of symlinks inside the C:\ProgramData\Cloudflare\warp-diag-partials folder. After triggering the 'Reset all settings" option the WARP service will delete the files that the symlink was pointing to. Given the WARP service operates with System privileges this might lead to deleting files owned by the System user. This issue affects WARP: before 2024.12.492.0.
- Product
- WARP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevelopers.cloudflare.com
Jan 22, 2025A vulnerability in the REST API of Cisco Meeting Management could allow a remote, authenticated attacker with low privileges to elevate privileges to administraCVE-2025-20156 · Network & remote access · Cisco · reported by psirt@cisco.comCritical 9.9
A vulnerability in the REST API of Cisco Meeting Management could allow a remote, authenticated attacker with low privileges to elevate privileges to administrator on an affected device. This vulnerability exists because proper authorization is not enforced upon REST API users. An attacker could exploit this vulnerability by sending API requests to a specific endpoint. A successful exploit could allow the attacker to gain administrator-level control over edge nodes that are managed by Cisco Meeting Management.
- Product
- Cisco Meeting Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.clamav.netsec.cloudapps.cisco.com
Jan 22, 2025A SQL injection vulnerability exists in Synnefo Internet Management Software (IMS) version 2023 and earlier.CVE-2023-37777 · Other software · reported by MITRECritical 9.8
A SQL injection vulnerability exists in Synnefo Internet Management Software (IMS) version 2023 and earlier. This vulnerability occurs due to improper input validation in a specific API endpoint parameter allowing an attacker to manipulate SQL queries via crafted input. Successful exploitation could lead to unauthorized access to database records with DB administrator privileges which can be leveraged to escalate privileges further and execute arbitrary OS commands.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordinfosecwriteups.comsynnefoims.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.