Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,222 results · page 16 of 45
Dec 2, 2024The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses.CVE-2024-53990 · Other software · AsyncHttpClient · reported by GitHubCritical 9.2
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. When making any HTTP request, the automatically enabled and self-managed CookieStore (aka cookie jar) will silently replace explicitly defined Cookies with any that have the same name from the cookie jar. For services that operate with multiple users, this can result in one user's Cookie being used for another user's requests.
- Product
- async-http-client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2024A vulnerability exists in Snap One OVRC cloud where an attacker can impersonate a Hub device and send requests to claim and unclaim devices.CVE-2024-50381 · Other software · Snap One · reported by ics-cert@hq.dhs.govHigh 8.8
A vulnerability exists in Snap One OVRC cloud where an attacker can impersonate a Hub device and send requests to claim and unclaim devices. The attacker only needs to provide the MAC address of the targeted device and can make a request to unclaim it from its original connection and make a request to claim it.
- Product
- OVRC cloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 27, 2024Inconsistent interpretation of HTTP requests ('HTTP Request/Response Smuggling') issue exists in HAProxy.CVE-2024-53008 · Other software · HAProxy Project · reported by vultures@jpcert.or.jpMedium 5.3
Inconsistent interpretation of HTTP requests ('HTTP Request/Response Smuggling') issue exists in HAProxy. If this vulnerability is exploited, a remote attacker may access a path that is restricted by ACL (Access Control List) set on the product. As a result, the attacker may obtain sensitive information.
- Product
- HAProxy 2.6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.haproxy.orggit.haproxy.org
Nov 26, 2024The web interface of the affected devices process some crafted HTTP requests improperly, leading to a device crash.CVE-2024-36251 · Other software · Sharp Corporation · reported by vultures@jpcert.or.jpHigh 7.5
The web interface of the affected devices process some crafted HTTP requests improperly, leading to a device crash. More precisely, a crafted parameter to billcodedef_sub_sel.html is not processed properly and device-crash happens. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].
- Product
- Multiple MFPs (multifunction printers)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 18, 2024A flaw was found within the handling of SMB2 read requests in the kernel ksmbd module.CVE-2023-39179 · Other software · Red Hat · reported by patrick@puiterwijk.orgHigh 7.5
A flaw was found within the handling of SMB2 read requests in the kernel ksmbd module. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this to disclose sensitive information on affected installations of Linux. Only systems with ksmbd enabled are vulnerable to this CVE.
- Product
- Red Hat Enterprise Linux 6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Nov 18, 2024A flaw was found within the parsing of SMB2 requests that have a transform header in the kernel ksmbd module.CVE-2023-39176 · Other software · Red Hat · reported by patrick@puiterwijk.orgMedium 5.8
A flaw was found within the parsing of SMB2 requests that have a transform header in the kernel ksmbd module. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this to disclose sensitive information on affected installations of Linux. Only systems with ksmbd enabled are vulnerable to this CVE.
- Product
- Red Hat Enterprise Linux 6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Nov 17, 2024In Bitcoin Core before 0.21.0, an attacker could prevent a node from seeing a specific unconfirmed transaction, because transaction re-requests are mishandled.CVE-2024-52913 · Other software · bitcoin · reported by MITREMedium 5.3
In Bitcoin Core before 0.21.0, an attacker could prevent a node from seeing a specific unconfirmed transaction, because transaction re-requests are mishandled.
- Product
- bitcoin_core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbitcoincore.orgen.bitcoin.it
Nov 17, 2024A flaw was found in Undertow, which incorrectly parses cookies with certain value-delimiting characters in incoming requests.CVE-2023-4639 · Other software · Red Hat · reported by Red HatHigh 7.4
A flaw was found in Undertow, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values, leading to unauthorized data access or modification. The main threat from this flaw impacts data confidentiality and integrity.
- Product
- Migration Toolkit for Runtimes 1 on RHEL 8
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Nov 15, 2024Budget Control Gateway acts as an entry point for incoming requests and routes them to the appropriate microservices for Budget Control.CVE-2024-52528 · Other software · BudgetControl · reported by GitHubCritical 9.3
Budget Control Gateway acts as an entry point for incoming requests and routes them to the appropriate microservices for Budget Control. Budget Control Gateway does not properly validate auth tokens, which allows attackers to bypass intended restrictions. This vulnerability is fixed in 1.5.2.
- Product
- Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2024An unclaimed Amazon S3 bucket, 'codeconf', is referenced in an audio file link within the .rst documentation file.CVE-2024-1682 · Other software · psf · reported by security@huntr.devMedium 4.3
An unclaimed Amazon S3 bucket, 'codeconf', is referenced in an audio file link within the .rst documentation file. This bucket has been claimed by an external party. The use of this unclaimed S3 bucket could lead to data integrity issues, data leakage, availability problems, loss of trustworthiness, and potential further attacks if the bucket is used to host malicious content or as a pivot point for further attacks.
- Product
- psf/requests
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2024An authorized user may trigger crashes or receive the contents of buffer over-reads of Server memory by issuing specially crafted requests that construct malforCVE-2024-10921 · Other software · MongoDB Inc · reported by cna@mongodb.comMedium 6.8
An authorized user may trigger crashes or receive the contents of buffer over-reads of Server memory by issuing specially crafted requests that construct malformed BSON in the MongoDB Server. This issue affects MongoDB Server v5.0 versions prior to 5.0.30 , MongoDB Server v6.0 versions prior to 6.0.19, MongoDB Server v7.0 versions prior to 7.0.15 and MongoDB Server v8.0 versions prior to and including 8.0.2.
- Product
- MongoDB Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2024Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1, 9.5.x <= 9.5.9 and 10.0.x <= 10.0.0 fail to properly authorize the requests to /api/v4/channels which aCVE-2024-42000 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comLow 2.7
Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1, 9.5.x <= 9.5.9 and 10.0.x <= 10.0.0 fail to properly authorize the requests to /api/v4/channels which allows a User or System Manager, with "Read Groups" permission but with no access for channels to retrieve details about private channels that they were not a member of by sending a request to /api/v4/channels.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2024Authenticated Gaia users can inject code or commands by global variables through special HTTP requests.CVE-2024-24914 · Other software · checkpoint · reported by cve@checkpoint.comHigh 8
Authenticated Gaia users can inject code or commands by global variables through special HTTP requests. A Security fix that mitigates this vulnerability is available.
- Product
- ClusterXL, Multi-Domain Security Management, Quantum Appliances, Quantum Maestro, Quantum Scalable Chassis, Quantum Security Gateways, Quantum Security Manageme
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.checkpoint.com
Nov 5, 2024Waybox Enel X web management application could execute arbitrary requests on the internal database via /admin/dbstore.php.CVE-2023-29119 · Other software · Enel X · reported by cve@asrg.ioCritical 9.6
Waybox Enel X web management application could execute arbitrary requests on the internal database via /admin/dbstore.php.
- Product
- JuiceBox Pro 3.0 22kW Cellular
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport-emobility.enelx.com
Nov 5, 2024Waybox Enel X web management application could execute arbitrary requests on the internal database via /admin/versions.php.CVE-2023-29118 · Other software · Enel X · reported by cve@asrg.ioCritical 9.6
Waybox Enel X web management application could execute arbitrary requests on the internal database via /admin/versions.php.
- Product
- JuiceBox Pro 3.0 22kW Cellular
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport-emobility.enelx.com
Nov 4, 2024AppSmith Community 1.8.3 before 1.46 allows SSRF via New DataSource for application/json requests to 169.254.169.254 to retrieve AWS metadata credentials.CVE-2024-51408 · Other software · appsmith · reported by MITREHigh 8.5
AppSmith Community 1.8.3 before 1.46 allows SSRF via New DataSource for application/json requests to 169.254.169.254 to retrieve AWS metadata credentials.
- Product
- appsmith
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2024This vulnerability exists in the Wave 2.0 due to missing rate limiting on OTP requests in an API endpoint.CVE-2024-51557 · Other software · Brokerage Technology Solutions · reported by vdisclose@cert-in.org.inHigh 7.1
This vulnerability exists in the Wave 2.0 due to missing rate limiting on OTP requests in an API endpoint. An authenticated remote attacker could exploit this vulnerability by sending multiple OTP request through vulnerable API endpoint which could lead to the OTP bombing/flooding on the targeted system.
- Product
- Wave 2.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2024An Open-Redirect vulnerability exists in PingAM where well-crafted requests may cause improper validation of redirect URLs.CVE-2024-25566 · Other software · Ping Identity · reported by responsible-disclosure@pingidentity.comMedium 5.1
An Open-Redirect vulnerability exists in PingAM where well-crafted requests may cause improper validation of redirect URLs. This could allow an attacker to redirect end-users to malicious sites under their control, simplifying phishing attacks
- Product
- PingAM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbackstage.forgerock.combackstage.forgerock.com
Oct 25, 2024Sharp and Toshiba Tec MFPs improperly process query parameters in HTTP requests, resulting in a reflected cross-site scripting vulnerability.CVE-2024-47801 · Other software · Sharp Corporation · reported by vultures@jpcert.or.jpHigh 7.4
Sharp and Toshiba Tec MFPs improperly process query parameters in HTTP requests, resulting in a reflected cross-site scripting vulnerability. Accessing a crafted URL which points to an affected product may cause malicious script executed on the web browser.
- Product
- Sharp Digital Full-color MFPs and Monochrome MFPs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2024Sharp and Toshiba Tec MFPs improperly process query parameters in HTTP requests, which may allow contamination of unintended data to HTTP response headers.CVE-2024-47549 · Other software · Sharp Corporation · reported by vultures@jpcert.or.jpHigh 7.4
Sharp and Toshiba Tec MFPs improperly process query parameters in HTTP requests, which may allow contamination of unintended data to HTTP response headers. Accessing a crafted URL which points to an affected product may cause malicious script executed on the web browser.
- Product
- Sharp Digital Full-color MFPs and Monochrome MFPs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2024Sharp and Toshiba Tec MFPs improperly process HTTP authentication requests, resulting in an authentication bypass vulnerability.CVE-2024-47406 · Other software · Sharp Corporation · reported by vultures@jpcert.or.jpCritical 9.1
Sharp and Toshiba Tec MFPs improperly process HTTP authentication requests, resulting in an authentication bypass vulnerability.
- Product
- Sharp Digital Full-color MFPs and Monochrome MFPs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2024Sharp and Toshiba Tec MFPs improperly process URI data in HTTP PUT requests resulting in a path Traversal vulnerability.CVE-2024-45842 · Other software · Sharp Corporation · reported by vultures@jpcert.or.jpMedium 5.3
Sharp and Toshiba Tec MFPs improperly process URI data in HTTP PUT requests resulting in a path Traversal vulnerability. Unintended internal files may be retrieved when processing crafted HTTP requests.
- Product
- Sharp Digital Full-color MFPs and Monochrome MFPs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2024Sharp and Toshiba Tec MFPs provide the web page to download data, where query parameters in HTTP requests are improperly processed and resulting in an Out-of-boCVE-2024-45829 · Other software · Sharp Corporation · reported by vultures@jpcert.or.jpMedium 4.9
Sharp and Toshiba Tec MFPs provide the web page to download data, where query parameters in HTTP requests are improperly processed and resulting in an Out-of-bounds Read vulnerability. Crafted HTTP requests may cause affected products crashed.
- Product
- Sharp Digital Full-color MFPs and Monochrome MFPs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2024In JetBrains YouTrack before 2024.3.47197 insecure plugin iframe allowed arbitrary JavaScript execution and unauthorized API requestsCVE-2024-49579 · Other software · JetBrains · reported by cve@jetbrains.comHigh 8.1
In JetBrains YouTrack before 2024.3.47197 insecure plugin iframe allowed arbitrary JavaScript execution and unauthorized API requests
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2024Action Pack is a framework for handling and responding to web requests.CVE-2024-47887 · Other software · rails · reported by GitHubMedium 6.6
Action Pack is a framework for handling and responding to web requests. Starting in version 4.0.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, and 7.2.1.1, there is a possible ReDoS vulnerability in Action Controller's HTTP Token authentication. For applications using HTTP Token authentication via `authenticate_or_request_with_http_token` or similar, a carefully crafted header may cause header parsing to take an unexpected amount of time, possibly resulting in a DoS vulnerability. All users running an affected release should either upgrade to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, or 7.2.1.1 or apply the relevant patch immediately. One may choose to use Ruby 3.2 as a workaround.Ruby 3.2 has mitigations for this problem, so Rails applications using Ruby 3.2 or newer are unaffected. Rails 8.0.0.beta1 depends on Ruby 3.2 or greater so is unaffected.
- Product
- rails
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2024Action Pack is a framework for handling and responding to web requests.CVE-2024-41128 · Other software · rails · reported by GitHubMedium 6.6
Action Pack is a framework for handling and responding to web requests. Starting in version 3.1.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, and 7.2.1.1, there is a possible ReDoS vulnerability in the query parameter filtering routines of Action Dispatch. Carefully crafted query parameters can cause query parameter filtering to take an unexpected amount of time, possibly resulting in a DoS vulnerability. All users running an affected release should either upgrade to version 6.1.7.9, 7.0.8.5, 7.1.4.1, or 7.2.1.1 or apply the relevant patch immediately. One may use Ruby 3.2 as a workaround. Ruby 3.2 has mitigations for this problem, so Rails applications using Ruby 3.2 or newer are unaffected. Rails 8.0.0.beta1 depends on Ruby 3.2 or greater so is unaffected.
- Product
- rails
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Oct 16, 2024Users logged into the Apache CloudStack's web interface can be tricked to submit malicious CSRF requests due to missing validation of the origin of the requestsCVE-2024-45693 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8
Users logged into the Apache CloudStack's web interface can be tricked to submit malicious CSRF requests due to missing validation of the origin of the requests. This can allow an attacker to gain privileges and access to resources of the authenticated users and may lead to account takeover, disruption, exposure of sensitive data and compromise integrity of the resources owned by the user account that are managed by the platform. This issue affects Apache CloudStack from 4.15.1.0 through 4.18.2.3 and 4.19.0.0 through 4.19.1.1 Users are recommended to upgrade to Apache CloudStack 4.18.2.4 or 4.19.1.2, or later, which addresses this issue.
- Product
- Apache CloudStack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcloudstack.apache.orgcloudstack.apache.org
Oct 15, 2024SHIRASAGI prior to v1.19.1 processes URLs in HTTP requests improperly, resulting in a path traversal vulnerability.CVE-2024-46898 · Other software · SHIRASAGI Project · reported by vultures@jpcert.or.jpHigh 7.5
SHIRASAGI prior to v1.19.1 processes URLs in HTTP requests improperly, resulting in a path traversal vulnerability. If this vulnerability is exploited, arbitrary files on the server may be retrieved when processing crafted HTTP requests.
- Product
- SHIRASAGI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2024Exposure of CSRF tokens in query parameters on specific requests in Checkmk GmbH's Checkmk versions <2.3.0p18, <2.2.0p35 and <2.1.0p48 could lead to a leak of tCVE-2024-38863 · Other software · Checkmk GmbH · reported by security@checkmk.comMedium 5.1
Exposure of CSRF tokens in query parameters on specific requests in Checkmk GmbH's Checkmk versions <2.3.0p18, <2.2.0p35 and <2.1.0p48 could lead to a leak of the token to facilitate targeted phishing attacks.
- Product
- Checkmk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2024ImportDump is a mediawiki extension designed to automate user import requests.CVE-2024-47816 · Other software · miraheze · reported by GitHubMedium 6.4
ImportDump is a mediawiki extension designed to automate user import requests. A user's local actor ID is stored in the database to tell who made what requests. Therefore, if a user on another wiki happens to have the same actor ID as someone on the central wiki, the user on the other wiki can act as if they're the original wiki requester. This can be abused to create new comments, edit the request, and view the request if it's marked private. This issue has been addressed in commit `5c91dfc` and all users are advised to update. Users unable to update may disable the special page outside of their global wiki. See `miraheze/mw-config@e566499` for details on that.
- Product
- ImportDump
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2024ImportDump is an extension for mediawiki designed to automate user import requests.CVE-2024-47812 · Other software · miraheze · reported by GitHubMedium 6
ImportDump is an extension for mediawiki designed to automate user import requests. Anyone who can edit the interface strings of a wiki (typically administrators and interface admins) can embed XSS payloads in the messages for dates, and thus XSS anyone who views Special:RequestImportQueue. This issue has been patched in commit `d054b95` and all users are advised to apply this commit to their branch. Users unable to upgrade may either Prevent access to Special:RequestImportQueue on all wikis, except for the global wiki; and If an interface administrator (or equivalent) level protection is available (which is not provided by default) on the global wiki, protect the affected messages up to that level. This causes the XSS to be virtually useless as users with those rights can already edit Javascript pages. Or Prevent access to Special:RequestImportQueue altogether.
- Product
- ImportDump
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2024A vulnerability was found in the resteasy-netty4 library arising from improper handling of HTTP requests using smuggling techniques.CVE-2024-9622 · Other software · Red Hat · reported by Red HatMedium 5.3
A vulnerability was found in the resteasy-netty4 library arising from improper handling of HTTP requests using smuggling techniques. When an HTTP smuggling request with an ASCII control character is sent, it causes the Netty HttpObjectDecoder to transition into a BAD_MESSAGE state. As a result, any subsequent legitimate requests on the same connection are ignored, leading to client timeouts, which may impact systems using load balancers and expose them to risk.
- Product
- Red Hat JBoss Data Grid 7
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Oct 4, 2024This vulnerability exists in Shilpi Client Dashboard due to lack of rate limiting and Captcha protection for OTP requests in certain API endpoint.CVE-2024-47654 · Other software · Shilpi Computers · reported by vdisclose@cert-in.org.inHigh 7.1
This vulnerability exists in Shilpi Client Dashboard due to lack of rate limiting and Captcha protection for OTP requests in certain API endpoint. An unauthenticated remote attacker could exploit this vulnerability by sending multiple OTP request through vulnerable API endpoints, which could lead to the OTP bombing on the targeted system.
- Product
- Client Dashboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2024This vulnerability exists in Shilpi Client Dashboard due to lack of authorization for modification and cancellation requests through certain API endpoints.CVE-2024-47653 · Other software · Shilpi Computers · reported by vdisclose@cert-in.org.inHigh 7.1
This vulnerability exists in Shilpi Client Dashboard due to lack of authorization for modification and cancellation requests through certain API endpoints. An authenticated remote attacker could exploit this vulnerability by placing or cancelling requests through API request body leading to unauthorized modification of requests belonging to the other users.
- Product
- Client Dashboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2024Several CGI endpoints are vulnerable to buffer overflows, by authenticated users, because of missing bounds checking on parameters passed through POST requests CVE-2024-41590 · Network & remote access · draytek · reported by MITREHigh 8
Several CGI endpoints are vulnerable to buffer overflows, by authenticated users, because of missing bounds checking on parameters passed through POST requests to the strcpy function on DrayTek Vigor310 devices through 4.3.2.6.
- Product
- vigor3910_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforescout.comforescout.com
Oct 3, 2024DrayTek Vigor310 devices through 4.3.2.6 use unencrypted HTTP for authentication requests.CVE-2024-41589 · Network & remote access · draytek · reported by MITREHigh 8.8
DrayTek Vigor310 devices through 4.3.2.6 use unencrypted HTTP for authentication requests.
- Product
- vigor3910_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforescout.comforescout.com
Oct 3, 2024The TEM Opera Plus FM Family Transmitter application interface allows users to perform certain actions via HTTP requests without performing any validity checks CVE-2024-41987 · Other software · TEM · reported by ics-cert@hq.dhs.govHigh 8.6
The TEM Opera Plus FM Family Transmitter application interface allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain actions with administrative privileges if a logged-in user visits a malicious web site.
- Product
- Opera Plus FM Family Transmitter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2024Cross site request forgery in Kiteworks OwnCloud allows an unauthenticated attacker to forge requests.CVE-2023-7273 · Other software · Kiteworks · reported by a341c0d1-ebf7-493f-a84e-38cf86618674Medium 6.8
Cross site request forgery in Kiteworks OwnCloud allows an unauthenticated attacker to forge requests. If a request has no Authorization header, it is created with an empty string as value by a rewrite rule. The CSRF check is done by comparing the header value to null, meaning that the existing CSRF check is bypassed in this case. An attacker can, for example, create a new administrator account if the request is executed in the browser of an authenticated victim.
- Product
- OwnCloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcirosec.dehackerone.com
Sep 30, 2024Certain switch models from PLANET Technology have an SSH service that improperly handles insufficiently authenticated connection requests, allowing unauthorizedCVE-2024-8451 · Other software · PLANET Technology · reported by twcert@cert.org.twHigh 7.5
Certain switch models from PLANET Technology have an SSH service that improperly handles insufficiently authenticated connection requests, allowing unauthorized remote attackers to exploit this weakness to occupy connection slots and prevent legitimate users from accessing the SSH service.
- Product
- GS-4210-24PL4C hardware 2.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Sep 27, 2024Advantech ADAM 5550's web application includes a "logs" page where all the HTTP requests received are displayed to the user.CVE-2024-38308 · Other software · Advantech · reported by ics-cert@hq.dhs.govHigh 8.7
Advantech ADAM 5550's web application includes a "logs" page where all the HTTP requests received are displayed to the user. The device doesn't correctly neutralize malicious code when parsing HTTP requests to generate page output.
- Product
- ADAM 5550
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2024A null-dereference vulnerability involving parsing requests specifying invalid protocols can cause the application to crash or potentially result in other undesCVE-2024-45863 · Other software · Facebook · reported by cve-assign@fb.comMedium 5.3
A null-dereference vulnerability involving parsing requests specifying invalid protocols can cause the application to crash or potentially result in other undesirable effects. This issue affects Facebook Thrift from v2024.09.09.00 until v2024.09.23.00.
- Product
- Facebook Thrift
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2024A use-after-free vulnerability involving upgradeToRocket requests can cause the application to crash or potentially result in code execution or other undesirablCVE-2024-45773 · Other software · Facebook · reported by cve-assign@fb.comHigh 7.5
A use-after-free vulnerability involving upgradeToRocket requests can cause the application to crash or potentially result in code execution or other undesirable effects. This issue affects Facebook Thrift prior to v2024.09.09.00.
- Product
- Facebook Thrift
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 26, 2024Incorrect access control in BECN DATAGERRY v2.2 allows attackers to execute arbitrary commands via crafted web requests.CVE-2024-46627 · Other software · becn · reported by MITRECritical 9.1
Incorrect access control in BECN DATAGERRY v2.2 allows attackers to execute arbitrary commands via crafted web requests.
- Product
- datagerry
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 26, 2024Mattermost versions 9.11.x <= 9.11.0, 9.10.x <= 9.10.1, 9.9.x <= 9.9.2 and 9.5.x <= 9.5.8 fail to properly authorize requests when viewing archived channels is CVE-2024-42406 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 5.4
Mattermost versions 9.11.x <= 9.11.0, 9.10.x <= 9.10.1, 9.9.x <= 9.9.2 and 9.5.x <= 9.5.8 fail to properly authorize requests when viewing archived channels is disabled, which allows an attacker to retrieve post and file information about archived channels. Examples are flagged or unread posts as well as files.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2024New Cloud MyOffice SDK Collaborative Editing Server 2.2.2 through 2.8 allows SSRF via manipulation of requests from external document storage via the MS-WOPI prCVE-2024-47222 · Other software · Myoffice · reported by MITRECritical 9.8
New Cloud MyOffice SDK Collaborative Editing Server 2.2.2 through 2.8 allows SSRF via manipulation of requests from external document storage via the MS-WOPI protocol.
- Product
- MY Office SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmyoffice.rusupport.myoffice.ru
Sep 18, 2024In the Linux kernel, the following vulnerability has been resolved: Input: uinput - reject requests with unreasonable number of slots When exercising uinput CVE-2024-46745 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: Input: uinput - reject requests with unreasonable number of slots When exercising uinput interface syzkaller may try setting up device with a really large number of slots, which causes memory allocation failure in input_mt_init_slots(). While this allocation failure is handled properly and request is rejected, it results in syzkaller reports. Additionally, such request may put undue burden on the system which will try to free a lot of memory for a bogus request. Fix it by limiting allowed number of slots to 100. This can easily be extended if we see devices that can track more than 100 contacts.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Sep 12, 2024A mishandling of IRP requests vulnerability exists in the HDAudBus_DMA interface of Microsoft High Definition Audio Bus Driver 10.0.19041.3636 (WinBuild.160101.CVE-2024-45383 · Computers, phones & browsers · Microsoft · reported by talos-cna@cisco.comMedium 5
A mishandling of IRP requests vulnerability exists in the HDAudBus_DMA interface of Microsoft High Definition Audio Bus Driver 10.0.19041.3636 (WinBuild.160101.0800). A specially crafted application can issue multiple IRP Complete requests which leads to a local denial-of-service. An attacker can execute malicious script/application to trigger this vulnerability.
- Product
- HDAudBus.sys
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Sep 12, 2024Music Request Manager: Does not sanitise and escape incoming music requestsCVE-2024-6019 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Music Request Manager WordPress plugin through 1.3 does not sanitise and escape incoming music requests, which could allow unauthenticated users to perform Cross-Site Scripting attacks against administrators
- Product
- Music Request Manager
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update Music Request Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 11, 2024This vulnerability exists in Reedos aiM-Star version 2.0.1 due to missing rate limiting on OTP requests in certain API endpoints.CVE-2024-45788 · Other software · Reedos Software Solutions · reported by vdisclose@cert-in.org.inHigh 8.7
This vulnerability exists in Reedos aiM-Star version 2.0.1 due to missing rate limiting on OTP requests in certain API endpoints. An authenticated remote attacker could exploit this vulnerability by sending multiple OTP request through vulnerable API endpoints which could lead to the OTP bombing/flooding on the targeted system.
- Product
- Mutual Fund Distribution Product (aiM-Star)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024A denial of service vulnerability was found in keycloak where the amount of attributes per object is not limited,an attacker by sending repeated HTTP requests cCVE-2023-6841 · Other software · Red Hat · reported by Red HatHigh 7.5
A denial of service vulnerability was found in keycloak where the amount of attributes per object is not limited,an attacker by sending repeated HTTP requests could cause a resource exhaustion when the application send back rows with long attribute values.
- Product
- Red Hat build of Quarkus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.