Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,235 results · page 15 of 45
Dec 14, 2024DocIO in Syncfusion Essential Studio for ASP.NET MVC before 27.1.55 throws XMLException during the resaving of a DOCX document with an external reference XML, aCVE-2024-55969 · Other software · reported by MITRECritical 9.1
DocIO in Syncfusion Essential Studio for ASP.NET MVC before 27.1.55 throws XMLException during the resaving of a DOCX document with an external reference XML, aka I640714.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2024Board Document Manager from CHUHPL: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54238 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cleveland Heights-University Heights Public Library Webdeveloper Board Document Manager from CHUHPL board-document-manager-from-chuhpl allows Reflected XSS.This issue affects Board Document Manager from CHUHPL: from n/a through <= 1.9.1.
- Product
- Board Document Manager from CHUHPL
- Affected
- up to 1.9.1
- What to do
- Affects up to 1.9.1. Update Board Document Manager from CHUHPL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024External Control of File Name or Path vulnerability in PlexTrac allows Local Code Inclusion through use of an undocumented API endpoint.This issue affects PlexTCVE-2024-11838 · Other software · PlexTrac · reported by 5fea7123-217b-4b2d-ada8-8892719b43cdHigh 8.6
External Control of File Name or Path vulnerability in PlexTrac allows Local Code Inclusion through use of an undocumented API endpoint.This issue affects PlexTrac: from 1.61.3 before 2.8.1.
- Product
- PlexTrac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2024An attacker authenticated as an administrator can use an exposed webservice to create a PDF with an embedded attachment.CVE-2024-47580 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.8
An attacker authenticated as an administrator can use an exposed webservice to create a PDF with an embedded attachment. By specifying the file to be an internal server file and subsequently downloading the generated PDF, the attacker can read any file on the server with no effect on integrity or availability.
- Product
- SAP NetWeaver AS for JAVA (Adobe Document Services)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2024An attacker authenticated as an administrator can use an exposed webservice to upload or download a custom PDF font file on the system server.CVE-2024-47579 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.8
An attacker authenticated as an administrator can use an exposed webservice to upload or download a custom PDF font file on the system server. Using the upload functionality to copy an internal file into a font file and subsequently using the download functionality to retrieve that file allows the attacker to read any file on the server with no effect on integrity or availability
- Product
- SAP NetWeaver AS for JAVA (Adobe Document Services)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2024Adobe Document Service allows an attacker with administrator privileges to send a crafted request from a vulnerable web application.CVE-2024-47578 · Network & remote access · SAP_SE · reported by cna@sap.comCritical 9.1
Adobe Document Service allows an attacker with administrator privileges to send a crafted request from a vulnerable web application. It is usually used to target internal systems behind firewalls that are normally inaccessible to an attacker from the external network, resulting in a Server-Side Request Forgery vulnerability. On successful exploitation, the attacker can read or modify any file and/or make the entire system unavailable.
- Product
- SAP NetWeaver AS for JAVA (Adobe Document Services)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2024RAGFlow 0.13.0 suffers from improper access control in document-hooks.ts, allowing unauthorized access to user documents.CVE-2024-53450 · Other software · Infiniflow · reported by MITREHigh 7.5
RAGFlow 0.13.0 suffers from improper access control in document-hooks.ts, allowing unauthorized access to user documents.
- Product
- Ragflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2024Inclusion of undocumented features or chicken bits issue exists in UD-LT1 firmware Ver.2.1.8 and earlier and UD-LT1/EX firmware Ver.2.1.8 and earlier.CVE-2024-52564 · Other software · I-O DATA DEVICE, INC. · reported by vultures@jpcert.or.jpHigh 7.5
Inclusion of undocumented features or chicken bits issue exists in UD-LT1 firmware Ver.2.1.8 and earlier and UD-LT1/EX firmware Ver.2.1.8 and earlier. A remote attacker may disable the firewall function of the affected products. As a result, an arbitrary OS command may be executed and/or configuration settings of the device may be altered.
- Product
- UD-LT1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2024Firepad through 1.5.11 allows remote attackers, who have knowledge of a pad ID, to retrieve both the current text of a document and all content that has previouCVE-2024-51210 · Other software · firepad · reported by MITREMedium 5.3
Firepad through 1.5.11 allows remote attackers, who have knowledge of a pad ID, to retrieve both the current text of a document and all content that has previously been pasted into the document. NOTE: in several similar products, this is the intentional behavior for anyone who knows the full document ID and corresponding URL. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- firepad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfirebase.bloggithub.com
Dec 4, 2024Knowledge Base documentation & wiki plugin – BasePress Docs: Unauthorized modification of dataCVE-2024-10664 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Knowledge Base documentation & wiki plugin – BasePress Docs plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the basepress_db_posts_update() function in all versions up to, and including, 2.16.3.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the database.
- Product
- Knowledge Base documentation & wiki plugin – BasePress Docs
- Affected
- up to 2.16.3.3
- What to do
- Affects up to 2.16.3.3. Update Knowledge Base documentation & wiki plugin – BasePress Docs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 3, 2024An authenticated arbitrary file upload vulnerability in the /documentCache/upload endpoint of InfoDom Performa 365 v4.0.1 allows attackers to execute arbitrary CVE-2024-46625 · Other software · reported by MITREHigh 8.8
An authenticated arbitrary file upload vulnerability in the /documentCache/upload endpoint of InfoDom Performa 365 v4.0.1 allows attackers to execute arbitrary code via uploading a crafted SVG file.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2024Document & Data Automation: Cross-Site Request Forgery (CSRF)CVE-2024-52477 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in docxpresso Document & Data Automation document-data-automation allows Stored XSS.This issue affects Document & Data Automation: from n/a through <= 1.6.1.
- Product
- Document & Data Automation
- Affected
- up to 1.6.1
- What to do
- Affects up to 1.6.1. Update Document & Data Automation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 28, 2024Backdrop CMS before 1.28.4 and 1.29.x before 1.29.2 allows XSS via an SVG document, if the SVG tag is allowed for a text format.CVE-2024-54123 · Other software · Backdropcms · reported by MITREMedium 6.1
Backdrop CMS before 1.28.4 and 1.29.x before 1.29.2 allows XSS via an SVG document, if the SVG tag is allowed for a text format.
- Product
- Backdrop CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 26, 2024An authenticated arbitrary file upload vulnerability in the Documents module of SPIP v4.3.3 allows attackers to execute arbitrary code via uploading a crafted PCVE-2024-53619 · Other software · spip · reported by MITREMedium 6.3
An authenticated arbitrary file upload vulnerability in the Documents module of SPIP v4.3.3 allows attackers to execute arbitrary code via uploading a crafted PDF file.
- Product
- spip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgrimthereaperteam.medium.com
Nov 25, 2024An issue in the upload_documents method of libre-chat v0.0.6 allows attackers to execute a path traversal via supplying a crafted filename in an uploaded file.CVE-2024-52787 · Other software · librechat · reported by MITRECritical 9.1
An issue in the upload_documents method of libre-chat v0.0.6 allows attackers to execute a path traversal via supplying a crafted filename in an uploaded file.
- Product
- librechat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Nov 23, 2024HIPAA Compliant Forms with Drag’n’Drop HIPAA Form Builder. Sign HIPAA documents: Stored Cross-Site ScriptingCVE-2024-11332 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The HIPAA Compliant Forms with Drag’n’Drop HIPAA Form Builder. Sign HIPAA documents plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'hipaatizer' shortcode in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- HIPAA Compliant Forms with Drag’n’Drop HIPAA Form Builder. Sign HIPAA documents
- Affected
- up to 1.3.4
- What to do
- Affects up to 1.3.4. Update HIPAA Compliant Forms with Drag’n’Drop HIPAA Form Builder. Sign HIPAA documents to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 19, 2024Embed documents shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51904 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Joan Boluda Embed documents shortcode embed-documents-shortcode allows Stored XSS.This issue affects Embed documents shortcode: from n/a through <= 1.5.
- Product
- Embed documents shortcode
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update Embed documents shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 16, 2024In Flagsmith before 2.134.1, the get_document endpoint is not correctly protected by permissions.CVE-2024-52872 · Other software · flagsmith · reported by MITREHigh 7.5
In Flagsmith before 2.134.1, the get_document endpoint is not correctly protected by permissions.
- Product
- flagsmith
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2024An unclaimed Amazon S3 bucket, 'codeconf', is referenced in an audio file link within the .rst documentation file.CVE-2024-1682 · Other software · psf · reported by security@huntr.devMedium 4.3
An unclaimed Amazon S3 bucket, 'codeconf', is referenced in an audio file link within the .rst documentation file. This bucket has been claimed by an external party. The use of this unclaimed S3 bucket could lead to data integrity issues, data leakage, availability problems, loss of trustworthiness, and potential further attacks if the bucket is used to host malicious content or as a pivot point for further attacks.
- Product
- psf/requests
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2024A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload.CVE-2024-37285 · Other software · Elastic · reported by security@elastic.coCritical 9.1
A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. A successful attack requires a malicious user to have a combination of both specific Elasticsearch indices privileges https://www.elastic.co/guide/en/elasticsearch/reference/current/defining-roles.html#roles-indices-priv and Kibana privileges https://www.elastic.co/guide/en/fleet/current/fleet-roles-and-privileges.html assigned to them. The following Elasticsearch indices permissions are required * write privilege on the system indices .kibana_ingest* * The allow_restricted_indices flag is set to true Any of the following Kibana privileges are additionally required * Under Fleet the All privilege is granted * Under Integration the Read or All privilege is granted * Access to the fleet-setup privilege is gained through the Fleet Server’s service account token
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2024In Progress Telerik Document Processing Libraries, versions prior to 2024 Q4 (2024.4.1106), importing a document with unsupported features can lead to excessiveCVE-2024-8049 · Other software · Progress Software · reported by security@progress.comMedium 6.5
In Progress Telerik Document Processing Libraries, versions prior to 2024 Q4 (2024.4.1106), importing a document with unsupported features can lead to excessive processing, leading to excessive use of computing resources leaving the application process unavailable.
- Product
- Telerik Document Processing Libraries
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2024An XML External Entity (XXE) vulnerability in the component DocumentBuilderFactory of powertac-server v1.9.0 allows attackers to access sensitive information orCVE-2024-51135 · Other software · powertac-server · reported by MITRECritical 9.8
An XML External Entity (XXE) vulnerability in the component DocumentBuilderFactory of powertac-server v1.9.0 allows attackers to access sensitive information or execute arbitrary code via supplying a crafted request containing malicious XML entities.
- Product
- powertac-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpowertac.orggithub.com
Nov 6, 2024Portabilis i-Educar 2.8.0 is vulnerable to SQL Injection in the "getDocuments" function of the "InstituicaoDocumentacaoController" class.CVE-2024-48325 · Other software · portabilis · reported by MITREHigh 8.1
Portabilis i-Educar 2.8.0 is vulnerable to SQL Injection in the "getDocuments" function of the "InstituicaoDocumentacaoController" class. The "instituicao_id" parameter in "/module/Api/InstituicaoDocumentacao?oper=get&resource=getDocuments&instituicao_id" is not properly sanitized, allowing an unauthenticated remote attacker to inject malicious SQL commands.
- Product
- i-educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2024DocumentPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49656 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fifthsegment DocumentPress documentpress-display-any-document-on-your-site allows Reflected XSS.This issue affects DocumentPress: from n/a through <= 2.1.
- Product
- DocumentPress
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update DocumentPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 14, 2024When the XML is read from the codes in the PDF and parsed using a DocumentBuilder, the default settings of the DocumentBuilder allow for an XXE (XML External EnCVE-2024-8602 · Other software · Schweizerische Steuerkonferenz · reported by vulnerability@ncsc.chMedium 6.3
When the XML is read from the codes in the PDF and parsed using a DocumentBuilder, the default settings of the DocumentBuilder allow for an XXE (XML External Entity) attack. Further information on this can be found on the website of the Open Worldwide Application Security Project (OWASP). An attacker could theoretically leverage this by delivering a manipulated PDF file to the target, and depending on the environment, various actions can be executed. These actions include: * Reading files from the operating system * Crashing the thread handling the parsing or causing it to enter an infinite loop * Executing HTTP requests * Loading additional DTDs or XML files * Under certain conditions, executing OS commands
- Product
- Library taxstatement.jar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordesteuer.ewv-ete.chmkiesel.ch
Oct 9, 2024In version v0.3.8 of open-webui, an improper privilege management vulnerability exists in the API endpoints GET /api/v1/documents/ and POST /rag/api/v1/doc.CVE-2024-7048 · Other software · open-webui · reported by security@huntr.devMedium 5.4
In version v0.3.8 of open-webui, an improper privilege management vulnerability exists in the API endpoints GET /api/v1/documents/ and POST /rag/api/v1/doc. This vulnerability allows a lower-privileged user to access and overwrite files managed by a higher-privileged admin. By exploiting this vulnerability, an attacker can view metadata of files uploaded by an admin and overwrite these files, compromising the integrity and availability of the RAG models.
- Product
- open-webui/open-webui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2024An integer overflow vulnerability exists in the Compound Document Binary File format parser of v1.14.52 of the GNOME Project G Structured File Library (libgsf).CVE-2024-42415 · Other software · GNOME Project · reported by talos-cna@cisco.comHigh 8.4
An integer overflow vulnerability exists in the Compound Document Binary File format parser of v1.14.52 of the GNOME Project G Structured File Library (libgsf). A specially crafted file can result in an integer overflow that allows for a heap-based buffer overflow when processing the sector allocation table. This can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
- Product
- G Structured File Library (libgsf)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.gnome.orgtalosintelligence.com
Oct 3, 2024An integer overflow vulnerability exists in the Compound Document Binary File format parser of the GNOME Project G Structured File Library (libgsf) version v1.1CVE-2024-36474 · Other software · GNOME Project · reported by talos-cna@cisco.comHigh 8.4
An integer overflow vulnerability exists in the Compound Document Binary File format parser of the GNOME Project G Structured File Library (libgsf) version v1.14.52. A specially crafted file can result in an integer overflow when processing the directory from the file that allows for an out-of-bounds index to be used when reading and writing to an array. This can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
- Product
- G Structured File Library (libgsf)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.gnome.orgtalosintelligence.com
Oct 2, 2024Contao before 5.5.6 allows XSS via an SVG document.CVE-2024-45965 · Other software · Contao · reported by MITREMedium 6.4
Contao before 5.5.6 allows XSS via an SVG document. This affects (in contao/core-bundle in Composer) 4.x before 4.13.54, 5.0.x through 5.3.x before 5.3.30, and 5.4.x and 5.5..x before 5.5.6.
- Product
- Contao
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcontao.orggrimthereaperteam.medium.com
Oct 2, 2024Permissions bypass in M-Files Connector for Copilot before version 24.9.3 allows authenticated user to access limited amount of documents via incorrect access cCVE-2024-9333 · Other software · M-Files Corporation · reported by security@m-files.comMedium 5.3
Permissions bypass in M-Files Connector for Copilot before version 24.9.3 allows authenticated user to access limited amount of documents via incorrect access control list calculation
- Product
- M-Files Connector for Copilot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordempower.m-files.comproduct.m-files.com
Sep 23, 2024New Cloud MyOffice SDK Collaborative Editing Server 2.2.2 through 2.8 allows SSRF via manipulation of requests from external document storage via the MS-WOPI prCVE-2024-47222 · Other software · Myoffice · reported by MITRECritical 9.8
New Cloud MyOffice SDK Collaborative Editing Server 2.2.2 through 2.8 allows SSRF via manipulation of requests from external document storage via the MS-WOPI protocol.
- Product
- MY Office SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmyoffice.rusupport.myoffice.ru
Sep 23, 2024An issue in Doccano Open source annotation tools for machine learning practitioners v.1.8.4 and Doccano Auto Labeling Pipeline module to annotate a document autCVE-2024-40442 · Other software · doccano · reported by MITREHigh 7.2
An issue in Doccano Open source annotation tools for machine learning practitioners v.1.8.4 and Doccano Auto Labeling Pipeline module to annotate a document automatically v.0.1.23 allows a remote attacker to escalate privileges via a crafted REST Request.
- Product
- doccano
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2024An issue in Doccano Open source annotation tools for machine learning practitioners v.1.8.4 and Doccano Auto Labeling Pipeline module to annotate a document autCVE-2024-40441 · Other software · doccano · reported by MITREMedium 6.6
An issue in Doccano Open source annotation tools for machine learning practitioners v.1.8.4 and Doccano Auto Labeling Pipeline module to annotate a document automatically v.0.1.23 allows a remote attacker to escalate privileges via the model_attribs parameter.
- Product
- doccano
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2024Improper Digital Signature Invalidation vulnerability in Zip Repair Mode of The Document Foundation LibreOffice allows Signature forgery vulnerability in LibreCVE-2024-7788 · Other software · The Document Foundation · reported by security@documentfoundation.orgHigh 7.8
Improper Digital Signature Invalidation vulnerability in Zip Repair Mode of The Document Foundation LibreOffice allows Signature forgery vulnerability in LibreOfficeThis issue affects LibreOffice: from 24.2 before < 24.2.5.
- Product
- LibreOffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlibreoffice.orglists.debian.org
Sep 9, 2024A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload.CVE-2024-37288 · Other software · Elastic · reported by security@elastic.coCritical 9.9
A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. This issue only affects users that use Elastic Security’s built-in AI tools https://www.elastic.co/guide/en/security/current/ai-for-security.html and have configured an Amazon Bedrock connector https://www.elastic.co/guide/en/security/current/assistant-connect-to-bedrock.html .
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2024Discourse Placeholder Forms will let you build dynamic documentation.CVE-2024-43408 · Other software · discourse · reported by GitHubMedium 6.3
Discourse Placeholder Forms will let you build dynamic documentation. Unsanitized and stored user input was injected in the html of the post. The vulnerability is fixed in commit a62f711d5600e4e5d86f342d52932cb6221672e7.
- Product
- discourse-placeholder-theme-component
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2024SAP Document Builder does not perform necessary authorization checks for one of the function modules resulting in escalation of privileges causing low impact onCVE-2024-39591 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
SAP Document Builder does not perform necessary authorization checks for one of the function modules resulting in escalation of privileges causing low impact on confidentiality of the application.
- Product
- SAP Document Builder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2024BEx Web Java Runtime Export Web Service does not sufficiently validate an XML document accepted from an untrusted source.CVE-2024-42374 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 8.2
BEx Web Java Runtime Export Web Service does not sufficiently validate an XML document accepted from an untrusted source. An attacker can retrieve information from the SAP ADS system and exhaust the number of XMLForm service which makes the SAP ADS rendering (PDF creation) unavailable. This affects the confidentiality and availability of the application.
- Product
- SAP BEx Web Java Runtime Export Web Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2024Certificate Validation user interface in LibreOffice allows potential vulnerability.CVE-2024-6472 · Other software · The Document Foundation · reported by security@documentfoundation.orgHigh 7.8
Certificate Validation user interface in LibreOffice allows potential vulnerability. Signed macros are scripts that have been digitally signed by the developer using a cryptographic signature. When a document with a signed macro is opened a warning is displayed by LibreOffice before the macro is executed. Previously if verification failed the user could fail to understand the failure and choose to enable the macros anyway. This issue affects LibreOffice: from 24.2 before 24.2.5.
- Product
- LibreOffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2024APM server logs contain document body from a partially failed bulk index request.CVE-2024-37286 · Other software · Elastic · reported by security@elastic.coMedium 5.7
APM server logs contain document body from a partially failed bulk index request. For example, in case of unavailable_shards_exception for a specific document, since the ES response line contains the document body, and that APM server logs the ES response line on error, the document is effectively logged.
- Product
- APM Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2024Unprotected Transport of Credentials vulnerability in OpenText™ Documentum™ Server could allow Credential Stuffing.This issue affects Documentum™ Server: from 1CVE-2024-4188 · Other software · OpenText™ · reported by security@opentext.comHigh 7.1
Unprotected Transport of Credentials vulnerability in OpenText™ Documentum™ Server could allow Credential Stuffing.This issue affects Documentum™ Server: from 16.7 through 23.4.
- Product
- Documentum™ Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.opentext.comsupport.opentext.com
Jul 24, 2024AdTran 834-5 HDC17600021F1 (SmartOS 11.1.1.1) devices enable the SSH service by default and have a hidden, undocumented, hard-coded support account whose passwoCVE-2024-39345 · Other software · adtran · reported by MITREHigh 7.2
AdTran 834-5 HDC17600021F1 (SmartOS 11.1.1.1) devices enable the SSH service by default and have a hidden, undocumented, hard-coded support account whose password is based on the devices MAC address. All of the devices internet interfaces share a similar MAC address that only varies in their final octet. This allows network-adjacent attackers to derive the support user's SSH password by decrementing the final octet of the connected gateway address or via the BSSID. An attacker can then execute arbitrary OS commands with root-level privileges. NOTE: The vendor states that there is no intended functionality allowing an attacker to execute arbitrary OS Commands with root-level privileges. The vendor also states that this issue was fixed in SmartOS 12.5.5.1.
- Product
- 834-5_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2024RAIL documents are an XML-based format invented by Guardrails AI to enforce formatting checks on LLM outputs.CVE-2024-6961 · Other software · guardrailsai · reported by reefs@jfrog.comMedium 5.9
RAIL documents are an XML-based format invented by Guardrails AI to enforce formatting checks on LLM outputs. Guardrails users that consume RAIL documents from external sources are vulnerable to XXE, which may cause leakage of internal file data via the SYSTEM entity.
- Product
- guardrails
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordresearch.jfrog.comresearch.jfrog.com
Jul 17, 2024Roundup before 2.4.0 allows XSS via JavaScript in PDF, XML, and SVG documents.CVE-2024-39126 · Other software · Roundup-tracker · reported by MITREMedium 5.4
Roundup before 2.4.0 allows XSS via JavaScript in PDF, XML, and SVG documents.
- Product
- Roundup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordroundup-tracker.orgroundup-tracker.org
Jul 17, 2024In Eclipse Parsson before 1.0.4 and 1.1.3, a document with a large depth of nested objects can allow an attacker to cause a Java stack overflow exception and deCVE-2023-7272 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 8.6
In Eclipse Parsson before 1.0.4 and 1.1.3, a document with a large depth of nested objects can allow an attacker to cause a Java stack overflow exception and denial of service. Eclipse Parsson allows processing (e.g. parse, generate, transform and query) JSON documents.
- Product
- Parsson
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.eclipse.orggitlab.eclipse.org
Jul 16, 2024Outline is an open source, collaborative document editor.CVE-2024-40626 · Other software · outline · reported by GitHubHigh 7.3
Outline is an open source, collaborative document editor. A type confusion issue was found in ProseMirror’s rendering process that leads to a Stored Cross-Site Scripting (XSS) vulnerability in Outline. An authenticated user can create a document containing a malicious JavaScript payload. When other users view this document, the malicious Javascript can execute in the origin of Outline. Outline includes CSP rules to prevent third-party code execution, however in the case of self-hosting and having your file storage on the same domain as Outline a malicious payload can be uploaded as a file attachment and bypass those CSP restrictions. This issue has been addressed in release version 0.77.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- outline
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2024The access control in the Electronic Official Document Management System from 2100 TECHNOLOGY is not properly implemented, allowing remote attackers with regulCVE-2024-6737 · Other software · 2100 TECHNOLOGY · reported by twcert@cert.org.twHigh 8.8
The access control in the Electronic Official Document Management System from 2100 TECHNOLOGY is not properly implemented, allowing remote attackers with regular privileges to access the account settings functionality and create an administrator account.
- Product
- Electronic Official Document Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Jul 10, 2024FileBird Document Library: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-37504 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Ninja Team FileBird Document Library.This issue affects FileBird Document Library: from n/a through 2.0.6.
- Product
- FileBird Document Library
- Affected
- up to 2.0.6
- What to do
- Affects up to 2.0.6. Update FileBird Document Library to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 9, 2024SP Project & Document Manager: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-37224 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in smartypants SP Project & Document Manager.This issue affects SP Project & Document Manager: from n/a through 4.71.
- Product
- SP Project & Document Manager
- Affected
- up to 4.71
- What to do
- Affects up to 4.71. Update SP Project & Document Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 2, 2024Command go env is documented as outputting a shell script containing the Go environment.CVE-2023-24531 · Other software · Go toolchain · reported by security@golang.orgCritical 9.8
Command go env is documented as outputting a shell script containing the Go environment. However, go env doesn't sanitize values, so executing its output as a shell script can cause various bad bahaviors, including executing arbitrary commands or inserting new environment variables. This issue is relatively minor because, in general, if an attacker can set arbitrary environment variables on a system, they have better attack vectors than making "go env" print them out.
- Product
- cmd/go
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.