Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,235 results · page 14 of 45
Apr 16, 2025VisiCut 2.1 allows stack consumption via an XML document with nested set elements, as demonstrated by a java.util.HashMap StackOverflowError when reference='../CVE-2025-43708 · Other software · VisiCut · reported by MITRELow 3.3
VisiCut 2.1 allows stack consumption via an XML document with nested set elements, as demonstrated by a java.util.HashMap StackOverflowError when reference='../../../set/set[2]' is used, aka an "insecure deserialization" issue.
- Product
- VisiCut
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2025Overview XML documents optionally contain a Document Type Definition (DTD), which, among other features, enables the definition of XML entities.CVE-2025-24911 · Other software · Hitachi Vantara · reported by security.vulnerabilities@hitachivantara.comMedium 4.9
Overview XML documents optionally contain a Document Type Definition (DTD), which, among other features, enables the definition of XML entities. It is possible to define an entity by providing a substitution string in the form of a URI. Once the content of the URI is read, it is fed back into the application that is processing the XML. This application may echo back the data (e.g. in an error message), thereby exposing the file contents. (CWE-611) Description Hitachi Vantara Pentaho Business Analytics Server versions before 10.2.0.2, including 9.3.x and 8.3.x, do not correctly protect Data Access XMLParserFactoryProducer against out-of-band XML External Entity Reference. Impact By submitting an XML file that defines an external entity with a file:// URI, an attacker can cause the processing application to read the contents of a local file. Using URIs with other schemes such as http://, the attacker can force the application to make outgoing requests to servers that the attacker cannot reach directly, which can be used to bypass firewall restrictions or hide the source of attacks such as port scanning.
- Product
- Pentaho Business Analytics Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2025Overview XML documents optionally contain a Document Type Definition (DTD), which, among other features, enables the definition of XML entities.CVE-2025-24910 · Other software · Hitachi Vantara · reported by security.vulnerabilities@hitachivantara.comMedium 4.9
Overview XML documents optionally contain a Document Type Definition (DTD), which, among other features, enables the definition of XML entities. It is possible to define an entity by providing a substitution string in the form of a URI. Once the content of the URI is read, it is fed back into the application that is processing the XML. This application may echo back the data (e.g. in an error message), thereby exposing the file contents. (CWE-611) Description Hitachi Vantara Pentaho Business Analytics Server versions before 10.2.0.2, including 9.3.x and 8.3.x, do not correctly protect Pentaho Data Integration MessageSourceCrawler against out-of-band XML External Entity Reference. Impact By submitting an XML file that defines an external entity with a file:// URI, an attacker can cause the processing application to read the contents of a local file. Using URIs with other schemes such as http://, the attacker can force the application to make outgoing requests to servers that the attacker cannot reach directly, which can be used to bypass firewall restrictions or hide the source of attacks such as port scanning.
- Product
- Pentaho Business Analytics Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2025In sshd in OpenSSH before 10.0, the DisableForwarding directive does not adhere to the documentation stating that it disables X11 and agent forwarding.CVE-2025-32728 · Other software · OpenBSD · reported by MITREMedium 4.3
In sshd in OpenSSH before 10.0, the DisableForwarding directive does not adhere to the documentation stating that it disables X11 and agent forwarding.
- Product
- OpenSSH
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordftp.openbsd.orggithub.com
Apr 8, 2025Due to a missing authorization check, an authenticated attacker could upload a file as a template for solution documentation in SAP Solution Manager 7.1.CVE-2025-30017 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.4
Due to a missing authorization check, an authenticated attacker could upload a file as a template for solution documentation in SAP Solution Manager 7.1. After successful exploitation, an attacker can cause limited impact on the integrity and availability of the application.
- Product
- SAP Solution Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2025Path Traversal vulnerability in ONLYOFFICE Document Server before v8.0.1 allows a remote attacker to copy arbitrary files by manipulating the fileExt parameter CVE-2023-46988 · Other software · Onlyoffice · reported by MITREMedium 6.7
Path Traversal vulnerability in ONLYOFFICE Document Server before v8.0.1 allows a remote attacker to copy arbitrary files by manipulating the fileExt parameter in the /example/editor endpoint, leading to unauthorized access to sensitive files and potential Denial of Service (DoS).
- Product
- Document Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2025By first using the AI chatbot in one tab and later activating it in another tab, the document title of the previous tab would leak into the chat prompt.CVE-2025-3035 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 5.3
By first using the AI chatbot in one tab and later activating it in another tab, the document title of the previous tab would leak into the chat prompt. This vulnerability was fixed in Firefox 137.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Apr 1, 2025JavaScript code running while transforming a document with the XSLTProcessor could lead to a use-after-free.CVE-2025-3028 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.5
JavaScript code running while transforming a document with the XSLTProcessor could lead to a use-after-free. This vulnerability was fixed in Firefox 137, Firefox ESR 115.22, Firefox ESR 128.9, Thunderbird 137, and Thunderbird 128.9.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Mar 27, 2025The Go1 also known as "The World's First Intelligence Bionic Quadruped Robot Companion of Consumer Level," contains an undocumented backdoor that can enable theCVE-2025-2894 · Other software · Unitree · reported by cve@takeonme.orgMedium 6.6
The Go1 also known as "The World's First Intelligence Bionic Quadruped Robot Companion of Consumer Level," contains an undocumented backdoor that can enable the manufacturer, and anyone in possession of the correct API key, complete remote control over the affected robotic device using the CloudSail remote access service.
- Product
- Go1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2025An Improper Certificate Validation vulnerability in LibreOffice allowed an attacker to self sign an ODF document, with a signature untrusted by the target, thCVE-2021-25635 · Other software · The Document Foundation · reported by security@documentfoundation.orgMedium 5.2
An Improper Certificate Validation vulnerability in LibreOffice allowed an attacker to self sign an ODF document, with a signature untrusted by the target, then modify it to change the signature algorithm to an invalid (or unknown to LibreOffice) algorithm and LibreOffice would incorrectly present such a signature with an unknown algorithm as a valid signature issued by a trusted person This issue affects LibreOffice: from 7.0 before 7.0.5, from 7.1 before 7.1.1.
- Product
- LibreOffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025In infiniflow/ragflow versions 0.12.0, the `web_crawl` function in `document_app.py` contains multiple vulnerabilities.CVE-2024-12450 · Other software · infiniflow · reported by security@huntr.devCritical 9.8
In infiniflow/ragflow versions 0.12.0, the `web_crawl` function in `document_app.py` contains multiple vulnerabilities. The function does not filter URL parameters, allowing attackers to exploit Full Read SSRF by accessing internal network addresses and viewing their content through the generated PDF files. Additionally, the lack of restrictions on the file protocol enables Arbitrary File Read, allowing attackers to read server files. Furthermore, the use of an outdated Chromium headless version with --no-sandbox mode enabled makes the application susceptible to Remote Code Execution (RCE) via known Chromium v8 vulnerabilities. These issues are resolved in version 0.14.0.
- Product
- infiniflow/ragflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025A path traversal vulnerability exists in the 'document uploads manager' feature of mintplex-labs/anything-llm, affecting the latest version prior to 1.2.2.CVE-2024-10513 · Other software · mintplex-labs · reported by security@huntr.devHigh 7.2
A path traversal vulnerability exists in the 'document uploads manager' feature of mintplex-labs/anything-llm, affecting the latest version prior to 1.2.2. This vulnerability allows users with the 'manager' role to access and manipulate the 'anythingllm.db' database file. By exploiting the vulnerable endpoint '/api/document/move-files', an attacker can move the database file to a publicly accessible directory, download it, and subsequently delete it. This can lead to unauthorized access to sensitive data, privilege escalation, and potential data loss.
- Product
- mintplex-labs/anything-llm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2025A stored Cross-site Scripting (XSS) vulnerability affecting Document Management in ENOVIA Collaborative Industry Innovator on Release 3DEXPERIENCE R2024x allowsCVE-2025-0599 · Other software · Dassault Systèmes · reported by 3DS.Information-Security@3ds.comHigh 8.7
A stored Cross-site Scripting (XSS) vulnerability affecting Document Management in ENOVIA Collaborative Industry Innovator on Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
- Product
- ENOVIA Collaborative Industry Innovator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 14, 2025The API used to interact with documents in the application contains two endpoints with a flaw that allows an authenticated attacker to write a file with controlCVE-2024-54449 · Other software · LogicalDOC · reported by disclosure@synopsys.comHigh 8.7
The API used to interact with documents in the application contains two endpoints with a flaw that allows an authenticated attacker to write a file with controlled contents to an arbitrary location on the underlying file system. This can be used to facilitate RCE. An account with ‘read’ and ‘write’ privileges on at least one existing document in the application is required to exploit the vulnerability. Exploitation of this vulnerability would allow an attacker to run commands of their choosing on the underlying operating system of the web server running LogicalDOC.
- Product
- LogicalDOC Community
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 14, 2025Document history functionality contains a blind SQL injection that can be exploited by authenticated attackers.CVE-2024-54446 · Other software · LogicalDOC · reported by disclosure@synopsys.comHigh 7.1
Document history functionality contains a blind SQL injection that can be exploited by authenticated attackers. Using a time-based blind SQLi technique the attacker can disclose all database contents. Account takeover is a potential outcome depending on the presence or lack thereof entries in certain database tables.
- Product
- LogicalDOC Community
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 14, 2025The API used to interact with documents in the application contains a flaw that allows an authenticated attacker to read the contents of files on the underlyingCVE-2024-12019 · Other software · LogicalDOC · reported by disclosure@synopsys.comHigh 7.1
The API used to interact with documents in the application contains a flaw that allows an authenticated attacker to read the contents of files on the underlying operating system. An account with ‘read’ and ‘download’ privileges on at least one existing document in the application is required to exploit the vulnerability. Exploitation of this vulnerability would allow an attacker to read the contents of any file available within the privileges of the system user running the application.
- Product
- LogicalDOC Community
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 14, 2025A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML documents.CVE-2024-8176 · Other software · Red Hat · reported by Red HatHigh 7.5
A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML documents. When parsing an XML document with deeply nested entity references, libexpat can be forced to recurse indefinitely, exhausting the stack space and causing a crash. This issue could lead to denial of service (DoS) or, in some cases, exploitable memory corruption, depending on the environment and library usage.
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Mar 10, 2025The eDocument Cockpit (Inbound NF-e) in SAP Electronic Invoicing for Brazil allows an authenticated attacker with certain privileges to gain unauthorized accessCVE-2025-27432 · Network & remote access · SAP_SE · reported by cna@sap.comLow 2.4
The eDocument Cockpit (Inbound NF-e) in SAP Electronic Invoicing for Brazil allows an authenticated attacker with certain privileges to gain unauthorized access to each transaction. By executing the specific ABAP method within the ABAP system, an unauthorized attacker could call each transaction and view the inbound delivery details. This vulnerability has a low impact on the confidentiality with no effect on the integrity and the availability of the application.
- Product
- SAP Electronic Invoicing for Brazil (eDocument Cockpit)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2025Advanced File Manager — Ultimate WordPress File Manager and Document Library: Stored Cross-Site ScriptingCVE-2024-13805 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Advanced File Manager — Ultimate WordPress File Manager and Document Library Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 5.2.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, and granted permissions by an Administrator, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
- Product
- Advanced File Manager — Ultimate WordPress File Manager and Document Library
- Affected
- up to 5.2.14
- What to do
- Affects up to 5.2.14. Update Advanced File Manager — Ultimate WordPress File Manager and Document Library to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 6, 2025In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: mediatek: Add locks for usb_driver_claim_interface() The documentation fCVE-2025-21827 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: mediatek: Add locks for usb_driver_claim_interface() The documentation for usb_driver_claim_interface() says that "the device lock" is needed when the function is called from places other than probe(). This appears to be the lock for the USB interface device. The Mediatek btusb code gets called via this path: Workqueue: hci0 hci_power_on [bluetooth] Call trace: usb_driver_claim_interface btusb_mtk_claim_iso_intf btusb_mtk_setup hci_dev_open_sync hci_power_on process_scheduled_works worker_thread kthread With the above call trace the device lock hasn't been claimed. Claim it. Without this fix, we'd sometimes see the error "Failed to claim iso interface". Sometimes we'd even see worse errors, like a NULL pointer dereference (where `intf->dev.driver` was NULL) with a trace like: Call trace: usb_suspend_both usb_runtime_suspend __rpm_callback rpm_suspend pm_runtime_work process_scheduled_works Both errors appear to be fixed with the proper locking.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Mar 4, 2025LibreOffice supports Office URI Schemes to enable browser integration of LibreOffice with MS SharePoint server.CVE-2025-1080 · Other software · The Document Foundation · reported by security@documentfoundation.orgHigh 7.2
LibreOffice supports Office URI Schemes to enable browser integration of LibreOffice with MS SharePoint server. An additional scheme 'vnd.libreoffice.command' specific to LibreOffice was added. In the affected versions of LibreOffice a link in a browser using that scheme could be constructed with an embedded inner URL that when passed to LibreOffice could call internal macros with arbitrary arguments. This issue affects LibreOffice: from 24.8 before < 24.8.5, from 25.2 before < 25.2.1.
- Product
- LibreOffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlibreoffice.orglists.debian.org
Mar 3, 2025A DOM Clobbering vulnerability in tsup v8.3.4 allows attackers to execute arbitrary code via a crafted script in the import.meta.url to document.currentScript iCVE-2024-53384 · Other software · Egoist · reported by MITREMedium 5.1
A DOM Clobbering vulnerability in tsup v8.3.4 allows attackers to execute arbitrary code via a crafted script in the import.meta.url to document.currentScript in cjs_shims.js components
- Product
- Tsup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2025In the Linux kernel, the following vulnerability has been resolved: net: dsa: qca8k: reset cpu port on MTU change It was discovered that the Documentation lacCVE-2022-49654 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: net: dsa: qca8k: reset cpu port on MTU change It was discovered that the Documentation lacks of a fundamental detail on how to correctly change the MAX_FRAME_SIZE of the switch. In fact if the MAX_FRAME_SIZE is changed while the cpu port is on, the switch panics and cease to send any packet. This cause the mgmt ethernet system to not receive any packet (the slow fallback still works) and makes the device not reachable. To recover from this a switch reset is required. To correctly handle this, turn off the cpu ports before changing the MAX_FRAME_SIZE and turn on again after the value is applied.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Feb 26, 2025In the Linux kernel, the following vulnerability has been resolved: IB/rdmavt: add lock to call to rvt_error_qp to prevent a race condition The documentation CVE-2022-49089 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: IB/rdmavt: add lock to call to rvt_error_qp to prevent a race condition The documentation of the function rvt_error_qp says both r_lock and s_lock need to be held when calling that function. It also asserts using lockdep that both of those locks are held. However, the commit I referenced in Fixes accidentally makes the call to rvt_error_qp in rvt_ruc_loopback no longer covered by r_lock. This results in the lockdep assertion failing and also possibly in a race condition.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Feb 25, 2025Improper Input Validation vulnerability in The Document Foundation LibreOffice allows Windows Executable hyperlink targets to be executed unconditionally on acCVE-2025-0514 · Other software · The Document Foundation · reported by security@documentfoundation.orgHigh 7.2
Improper Input Validation vulnerability in The Document Foundation LibreOffice allows Windows Executable hyperlink targets to be executed unconditionally on activation.This issue affects LibreOffice: from 24.8 before < 24.8.5.
- Product
- LibreOffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2025RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine based on deep document understanding.CVE-2025-25282 · Other software · infiniflow · reported by GitHubHigh 8.1
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine based on deep document understanding. An authenticated user can exploit the Insecure Direct Object Reference (IDOR) vulnerability that may lead to unauthorized cross-tenant access (list tenant user accounts, add user account into other tenant). Unauthorized cross-tenant access: list user from other tenant (e.g., via GET /<tenant_id>/user/list), add user account to other tenant (POST /<tenant_id>/user). This issue has not yet been patched. Users are advised to reach out to the project maintainers to coordinate a fix.
- Product
- ragflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2025Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files: Server-Side Request ForgeryCVE-2025-1043 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.7.5 via the 'embeddoc' shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
- Product
- Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files
- Affected
- up to 2.7.5
- What to do
- Affects up to 2.7.5. Update Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 13, 2025Simple Documentation: Cross-Site Request Forgery (CSRF)CVE-2025-26578 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in mathieuhays Simple Documentation client-documentation allows Stored XSS.This issue affects Simple Documentation: from n/a through <= 1.2.8.
- Product
- Simple Documentation
- Affected
- up to 1.2.8
- What to do
- Affects up to 1.2.8. Update Simple Documentation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 12, 2025In Progress® Telerik® Document Processing Libraries, versions prior to 2025 Q1 (2025.1.205), using .NET Standard 2.0, the contents of a file at an arbitrary patCVE-2024-11629 · Other software · Progress Software · reported by security@progress.comHigh 7.1
In Progress® Telerik® Document Processing Libraries, versions prior to 2025 Q1 (2025.1.205), using .NET Standard 2.0, the contents of a file at an arbitrary path can be exported to RTF.
- Product
- Progress® Telerik® Document Processing Libraries
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025In Progress® Telerik® Document Processing Libraries, versions prior to 2025 Q1 (2025.1.205), unzipping an archive can lead to arbitrary file system access.CVE-2024-11343 · Other software · Progress Software · reported by security@progress.comHigh 8.3
In Progress® Telerik® Document Processing Libraries, versions prior to 2025 Q1 (2025.1.205), unzipping an archive can lead to arbitrary file system access.
- Product
- Telerik Document Processing Libraries
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2025MDC is a tool to take regular Markdown and write documents interacting deeply with a Vue component.CVE-2025-24981 · Other software · nuxt-modules · reported by GitHubCritical 9.3
MDC is a tool to take regular Markdown and write documents interacting deeply with a Vue component. In affected versions unsafe parsing logic of the URL from markdown can lead to arbitrary JavaScript code due to a bypass to the existing guards around the `javascript:` protocol scheme in the URL. The parsing logic implement in `props.ts` maintains a deny-list approach to filtering potential malicious payload. It does so by matching protocol schemes like `javascript:` and others. These security guards can be bypassed by an adversarial that provides JavaScript URLs with HTML entities encoded via hex string. Users who consume this library and perform markdown parsing from unvalidated sources could result in rendering vulnerable XSS anchor links. This vulnerability has been addressed in version 0.13.3 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- mdc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2025Document Block – Upload & Embed Docs: Missing AuthorizationCVE-2025-22696 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WPDeveloper Document Block – Upload & Embed Docs document.This issue affects Document Block – Upload & Embed Docs: from n/a through <= 1.1.0.
- Product
- Document Block – Upload & Embed Docs
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Document Block – Upload & Embed Docs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 29, 2025The file names constructed within image_picker are missing sanitization checks leaving them vulnerable to malicious document providers.CVE-2024-54462 · Other software · Flutter · reported by cve-coordination@google.comLow 2.1
The file names constructed within image_picker are missing sanitization checks leaving them vulnerable to malicious document providers. This may result in cases where a user with a malicious document provider installed can select an image file from that provider while using your app and could potentially override internal files in your app cache. Issue patched in 0.8.12+18. It is recommended to update to the latest version of image_picker_android that contains the changes to address this vulnerability.
- Product
- image_picker_android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2025The file names constructed within file_selector are missing sanitization checks leaving them vulnerable to malicious document providers.CVE-2024-54461 · Other software · Flutter · reported by cve-coordination@google.comLow 2.1
The file names constructed within file_selector are missing sanitization checks leaving them vulnerable to malicious document providers. This may result in cases where a user with a malicious document provider installed can select a document file from that provider while using your app and could potentially override internal files in your app cache. Issue patched in 0.5.1+12. It is recommended to update to the latest version of file_selector_android that contains the changes to address this vulnerability.
- Product
- file_selector_android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2025Inclusion of undocumented features issue exists in UD-LT2 firmware Ver.1.00.008_SE and earlier.CVE-2025-22450 · Other software · I-O DATA DEVICE, INC. · reported by vultures@jpcert.or.jpHigh 7.5
Inclusion of undocumented features issue exists in UD-LT2 firmware Ver.1.00.008_SE and earlier. A remote attacker may disable the LAN-side firewall function of the affected products, and open specific ports.
- Product
- UD-LT2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2025In the Linux kernel, the following vulnerability has been resolved: dm thin: make get_first_thin use rcu-safe list first function The documentation in rculistCVE-2025-21664 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: dm thin: make get_first_thin use rcu-safe list first function The documentation in rculist.h explains the absence of list_empty_rcu() and cautions programmers against relying on a list_empty() -> list_first() sequence in RCU safe code. This is because each of these functions performs its own READ_ONCE() of the list head. This can lead to a situation where the list_empty() sees a valid list entry, but the subsequent list_first() sees a different view of list head state after a modification. In the case of dm-thin, this author had a production box crash from a GP fault in the process_deferred_bios path. This function saw a valid list head in get_first_thin() but when it subsequently dereferenced that and turned it into a thin_c, it got the inside of the struct pool, since the list was now empty and referring to itself. The kernel on which this occurred printed both a warning about a refcount_t being saturated, and a UBSAN error for an out-of-bounds cpuid access in the queued spinlock, prior to the fault itself. When the resulting kdump was examined, it was possible to see another thread patiently waiting in t
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jan 17, 2025WeGIA < 3.2.0 is vulnerable to Cross Site Scripting (XSS) via the dados_addInfo parameter of documentos_funcionario.php.CVE-2024-57033 · Other software · Wegia · reported by MITREMedium 6.1
WeGIA < 3.2.0 is vulnerable to Cross Site Scripting (XSS) via the dados_addInfo parameter of documentos_funcionario.php.
- Product
- Wegia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2025Wegia < 3.2.0 is vulnerable to Cross Site Scripting (XSS) in /geral/documentos_funcionario.php via the id parameter.CVE-2024-57030 · Other software · Wegia · reported by MITREHigh 8.1
Wegia < 3.2.0 is vulnerable to Cross Site Scripting (XSS) in /geral/documentos_funcionario.php via the id parameter.
- Product
- Wegia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2025In the Linux kernel, the following vulnerability has been resolved: stackdepot: fix stack_depot_save_flags() in NMI context Per documentation, stack_depot_savCVE-2024-48876 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: stackdepot: fix stack_depot_save_flags() in NMI context Per documentation, stack_depot_save_flags() was meant to be usable from NMI context if STACK_DEPOT_FLAG_CAN_ALLOC is unset. However, it still would try to take the pool_lock in an attempt to save a stack trace in the current pool (if space is available). This could result in deadlock if an NMI is handled while pool_lock is already held. To avoid deadlock, only try to take the lock in NMI context and give up if unsuccessful. The documentation is fixed to clearly convey this.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jan 10, 2025Vtiger CRM v.6.1 and before is vulnerable to Cross Site Scripting (XSS) via the Documents module and function uploadAndSaveFile in CRMEntity.php.CVE-2024-54687 · Other software · Vtiger · reported by MITREMedium 6.1
Vtiger CRM v.6.1 and before is vulnerable to Cross Site Scripting (XSS) via the Documents module and function uploadAndSaveFile in CRMEntity.php.
- Product
- Vtiger CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandrea0.medium.comandrea0.medium.com
Jan 8, 2025cpdf through 2.8 allows stack consumption via a crafted PDF document.CVE-2024-54731 · Other software · Coherent Graphics · reported by MITREMedium 4
cpdf through 2.8 allows stack consumption via a crafted PDF document.
- Product
- CPDF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025In versions 1.0.67 and lower of the Splunk App for SOAR, the Splunk documentation for that app recommended adding the `admin_all_objects` capability to the `splCVE-2025-22621 · Other software · Splunk · reported by prodsec@splunk.comMedium 6.4
In versions 1.0.67 and lower of the Splunk App for SOAR, the Splunk documentation for that app recommended adding the `admin_all_objects` capability to the `splunk_app_soar` role. This addition could lead to improper access control for a low-privileged user that does not hold the "admin" Splunk roles.
- Product
- Splunk App for SOAR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025Exposure of Environmental Variables and arbitrary INI file values to an Unauthorized Actor vulnerability in The Document Foundation LibreOffice.CVE-2024-12426 · Other software · The Document Foundation · reported by security@documentfoundation.orgMedium 6.7
Exposure of Environmental Variables and arbitrary INI file values to an Unauthorized Actor vulnerability in The Document Foundation LibreOffice. URLs could be constructed which expanded environmental variables or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document containing such links. This issue affects LibreOffice: from 24.8 before < 24.8.4.
- Product
- LibreOffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlibreoffice.orglists.debian.org
Jan 7, 2025Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The Document Foundation LibreOffice allows Absolute Path TraversCVE-2024-12425 · Other software · The Document Foundation · reported by security@documentfoundation.orgLow 2.4
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The Document Foundation LibreOffice allows Absolute Path Traversal. An attacker can write to arbitrary locations, albeit suffixed with ".ttf", by supplying a file in a format that supports embedded font files. This issue affects LibreOffice: from 24.8 before < 24.8.4.
- Product
- LibreOffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlibreoffice.orglists.debian.org
Dec 31, 2024The Electronic Official Document Management System from 2100 Technology has an Authentication Bypass vulnerability.CVE-2024-13061 · Other software · 2100 Technology Electronic · reported by twcert@cert.org.twCritical 9.8
The Electronic Official Document Management System from 2100 Technology has an Authentication Bypass vulnerability. Although the product enforces an IP whitelist for the API used to query user tokens, unauthenticated remote attackers can still deceive the server to obtain tokens of arbitrary users, which can then be used to log into the system.
- Product
- Official Document Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchtsecurity.comchtsecurity.com
Dec 18, 2024A reflected Cross-Site Scripting vulnerability in the standard documentation upload functionality in Portabilis i-Educar 2.9 allows attacker to craft malicious CVE-2024-55239 · Other software · Portabilis · reported by MITREMedium 5.4
A reflected Cross-Site Scripting vulnerability in the standard documentation upload functionality in Portabilis i-Educar 2.9 allows attacker to craft malicious urls with arbitrary javascript in the 'titulo_documento' parameter.
- Product
- I-educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2024Rhymix before 2.1.24 is vulnerable to Server-Side Request Forgery (SSRF) in the background import data function because XML documents may contain external entitCVE-2024-55089 · Other software · Rhymix · reported by MITREMedium 4.1
Rhymix before 2.1.24 is vulnerable to Server-Side Request Forgery (SSRF) in the background import data function because XML documents may contain external entities.
- Product
- Rhymix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2024Inclusion of undocumented features or chicken bits issue exists in AE1021 firmware versions 2.0.10 and earlier and AE1021PE firmware versions 2.0.10 and earlierCVE-2024-54457 · Other software · FXC Inc. · reported by vultures@jpcert.or.jpHigh 7.2
Inclusion of undocumented features or chicken bits issue exists in AE1021 firmware versions 2.0.10 and earlier and AE1021PE firmware versions 2.0.10 and earlier, which may allow a logged-in user to enable telnet service.
- Product
- AE1021
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2024An issue was discovered where improper authorization controls affected certain queries that could allow a malicious actor to circumvent Document Level Security CVE-2024-12539 · Other software · Elastic · reported by security@elastic.coMedium 6
An issue was discovered where improper authorization controls affected certain queries that could allow a malicious actor to circumvent Document Level Security in Elasticsearch and get access to documents that their roles would normally not allow.
- Product
- Elasticsearch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2024DTC Documents: Cross-Site Request Forgery (CSRF)CVE-2024-54418 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Diversified Technology Corp. DTC Documents dtc-documents allows Cross Site Request Forgery.This issue affects DTC Documents: from n/a through <= 1.1.05.
- Product
- DTC Documents
- Affected
- up to 1.1.05
- What to do
- Affects up to 1.1.05. Update DTC Documents to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.