Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,899 results · page 16 of 58
Nov 14, 2024A malicious server can crash the OpenAFS cache manager and other client utilities, and possibly execute arbitrary code.CVE-2024-10397 · Other software · The OpenAFS Foundation · reported by patrick@puiterwijk.orgHigh 7.7
A malicious server can crash the OpenAFS cache manager and other client utilities, and possibly execute arbitrary code.
- Product
- OpenAFS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenafs.orglists.debian.org
Nov 13, 2024In validate of WifiConfigurationUtil.java , there is a possible persistent denial of service due to resource exhaustion.CVE-2024-43083 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In validate of WifiConfigurationUtil.java , there is a possible persistent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comsource.android.com
Nov 13, 2024In mayAdminGrantPermission of AdminRestrictedPermissionsUtils.java, there is a possible way to access the microphone due to a missing permission check.CVE-2024-40661 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In mayAdminGrantPermission of AdminRestrictedPermissionsUtils.java, there is a possible way to access the microphone due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comsource.android.com
Nov 12, 2024Sercomm Router Etisalat Model S3- AC2100 is affected by Incorrect Access Control via the diagnostic utility in the router dashboard.CVE-2021-27702 · Other software · sercomm · reported by MITREHigh 7.3
Sercomm Router Etisalat Model S3- AC2100 is affected by Incorrect Access Control via the diagnostic utility in the router dashboard.
- Product
- s3-ac2100_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024XSS Attack in mar.jar, Monitoring Archive Utility (MAR Utility), monitoringconsolecommon.jar in TIBCO Software Inc TIBCO Hawk and TIBCO Operational IntelligenceCVE-2024-10218 · Other software · TIBCO Software Inc · reported by security@tibco.comCritical 9.2
XSS Attack in mar.jar, Monitoring Archive Utility (MAR Utility), monitoringconsolecommon.jar in TIBCO Software Inc TIBCO Hawk and TIBCO Operational Intelligence
- Product
- TIBCO Hawk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024XSS Attack in mar.jar, Monitoring Archive Utility (MAR Utility), monitoringconsolecommon.jar in TIBCO Software Inc TIBCO Hawk and TIBCO Operational IntelligenceCVE-2024-10217 · Other software · TIBCO Software Inc · reported by security@tibco.comCritical 9.2
XSS Attack in mar.jar, Monitoring Archive Utility (MAR Utility), monitoringconsolecommon.jar in TIBCO Software Inc TIBCO Hawk and TIBCO Operational Intelligence
- Product
- TIBCO Hawk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024Incorrect default permissions in the AMD RyzenTM Master Utility installation directory could allow an attacker to achieve privilege escalation potentially resulCVE-2024-21946 · Other software · AMD · reported by psirt@amd.comHigh 7.3
Incorrect default permissions in the AMD RyzenTM Master Utility installation directory could allow an attacker to achieve privilege escalation potentially resulting in arbitrary code execution.
- Product
- AMD Ryzen Master Utility for Overclocking Control
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2024A maliciously crafted binary file when downloaded could lead to escalation of privileges to NT AUTHORITY/SYSTEM due to an untrusted search path being utilized iCVE-2024-7995 · Other software · Autodesk · reported by psirt@autodesk.comHigh 7.8
A maliciously crafted binary file when downloaded could lead to escalation of privileges to NT AUTHORITY/SYSTEM due to an untrusted search path being utilized in the VRED Design application. Exploitation of this vulnerability may lead to code execution.
- Product
- VRED Design
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2024In agentscope <=v0.0.4, the file agentscope\web\workstation\workflow_utils.py has the function is_callable_expression.CVE-2024-48050 · Other software · modelscope · reported by MITRECritical 9.8
In agentscope <=v0.0.4, the file agentscope\web\workstation\workflow_utils.py has the function is_callable_expression. Within this function, the line result = eval(s) poses a security risk as it can directly execute user-provided commands.
- Product
- agentscope
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comrumbling-slice-eb0.notion.site
Oct 30, 2024icecms <=3.4.7 has a File Upload vulnerability in FileUtils.java,uploadFile.CVE-2024-48202 · Other software · thecosy · reported by MITRECritical 9.8
icecms <=3.4.7 has a File Upload vulnerability in FileUtils.java,uploadFile.
- Product
- icecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2024ICG.AspNetCore.Utilities.CloudStorage is a collection of cloud storage utilities to assist with the management of files for cloud upload.CVE-2024-50353 · Other software · IowaComputerGurus · reported by GitHubMedium 5.3
ICG.AspNetCore.Utilities.CloudStorage is a collection of cloud storage utilities to assist with the management of files for cloud upload. Users of this library that set a duration for a SAS Uri with a value other than 1 hour may have generated a URL with a duration that is longer, or shorter than desired. Users not implemented SAS Uri's are unaffected. This issue was resolved in version 8.0.0 of the library.
- Product
- aspnetcore.utilities.cloudstorage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2024CyberPanel (aka Cyber Panel) before 2.3.5 allows Command Injection via completePath in the ProcessUtilities.outputExecutioner() sink.CVE-2024-51568 · Other software · cyber_panel · reported by MITRECritical 10
CyberPanel (aka Cyber Panel) before 2.3.5 allows Command Injection via completePath in the ProcessUtilities.outputExecutioner() sink. There is /filemanager/upload (aka File Manager upload) unauthenticated remote code execution via shell metacharacters.
- Product
- cyber_panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcwe.mitre.orgcyberpanel.net
Oct 29, 2024The Vagrant VMWare Utility Windows installer targeted a custom location with a non-protected path that could be modified by an unprivileged user, introducing poCVE-2024-10228 · Other software · HashiCorp · reported by security@hashicorp.comLow 3.8
The Vagrant VMWare Utility Windows installer targeted a custom location with a non-protected path that could be modified by an unprivileged user, introducing potential for unauthorized file system writes. This vulnerability, CVE-2024-10228, was fixed in Vagrant VMWare Utility 1.0.23
- Product
- Vagrant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2024Focus was incorrectly allowing internal links to utilize the app scheme used for deeplinking, which could result in links potentially circumventing some URL safCVE-2024-10474 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.5
Focus was incorrectly allowing internal links to utilize the app scheme used for deeplinking, which could result in links potentially circumventing some URL safety checks This vulnerability affects Focus for iOS < 132.
- Product
- Focus for iOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Oct 27, 2024TinyXML2 through 10.0.0 has a reachable assertion for UINT_MAX/digit, that may lead to application exit, in tinyxml2.cpp XMLUtil::GetCharacterRef.CVE-2024-50615 · Other software · tinyxml2_project · reported by MITREMedium 6.5
TinyXML2 through 10.0.0 has a reachable assertion for UINT_MAX/digit, that may lead to application exit, in tinyxml2.cpp XMLUtil::GetCharacterRef.
- Product
- tinyxml2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2024TinyXML2 through 10.0.0 has a reachable assertion for UINT_MAX/16, that may lead to application exit, in tinyxml2.cpp XMLUtil::GetCharacterRef.CVE-2024-50614 · Other software · tinyxml2_project · reported by MITREMedium 6.5
TinyXML2 through 10.0.0 has a reachable assertion for UINT_MAX/16, that may lead to application exit, in tinyxml2.cpp XMLUtil::GetCharacterRef.
- Product
- tinyxml2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 24, 2024EnGenius ENH1350EXT A8J-ENH1350EXT devices through 3.9.3.2_c1.9.51 allow (blind) OS Command Injection via shell metacharacters to the Ping or Speed Test utilityCVE-2024-45242 · Other software · engeniustech · reported by MITREHigh 7.8
EnGenius ENH1350EXT A8J-ENH1350EXT devices through 3.9.3.2_c1.9.51 allow (blind) OS Command Injection via shell metacharacters to the Ping or Speed Test utility. During the time of initial setup, the device creates an open unsecured network whose admin panel is configured with the default credentials of admin/admin. An unauthorized attacker in proximity to the Wi-Fi network can exploit this window of time to execute arbitrary OS commands with root-level permissions.
- Product
- enh1350ext_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2024Botan before 3.6.0, when certain GCC versions are used, has a compiler-induced secret-dependent operation in lib/utils/donna128.h in donna128 (used in Chacha-PoCVE-2024-50383 · Other software · botan_project · reported by MITREMedium 5.9
Botan before 3.6.0, when certain GCC versions are used, has a compiler-induced secret-dependent operation in lib/utils/donna128.h in donna128 (used in Chacha-Poly1305 and x25519). An addition can be skipped if a carry is not set. This was observed for GCC 11.3.0 with -O2 on MIPS, and GCC on x86-i386. (Only 32-bit processors can be affected.)
- Product
- botan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2024Botan before 3.6.0, when certain LLVM versions are used, has compiler-induced secret-dependent control flow in lib/utils/ghash/ghash.cpp in GHASH in AES-GCM.CVE-2024-50382 · Other software · botan_project · reported by MITREMedium 5.9
Botan before 3.6.0, when certain LLVM versions are used, has compiler-induced secret-dependent control flow in lib/utils/ghash/ghash.cpp in GHASH in AES-GCM. There is a branch instead of an XOR with carry. This was observed for Clang in LLVM 15 on RISC-V.
- Product
- botan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2024A stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IQ Configuration utility that allows an attacker with the AdministratCVE-2024-47139 · Network & remote access · F5 · reported by f5sirt@f5.comMedium 4.8
A stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IQ Configuration utility that allows an attacker with the Administrator role to run JavaScript in the context of the currently logged-in user. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- Product
- BIG-IQ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2024An issue in the getcolor function in utils.py of xhtml2pdf v0.2.13 allows attackers to cause a Regular expression Denial of Service (ReDOS) via supplying a crafCVE-2024-25885 · Other software · xhtml2pdf · reported by MITREHigh 7.5
An issue in the getcolor function in utils.py of xhtml2pdf v0.2.13 allows attackers to cause a Regular expression Denial of Service (ReDOS) via supplying a crafted string.
- Product
- xhtml2pdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2024In utf8_trunc in zephyr/lib/utils/utf8.c, last_byte_p can point to one byte before the string pointer if the string is empty.CVE-2024-6443 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgMedium 6.3
In utf8_trunc in zephyr/lib/utils/utf8.c, last_byte_p can point to one byte before the string pointer if the string is empty.
- Product
- Zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2024util/JSONTokener.java in JSON-lib before 3.1.0 mishandles an unbalanced comment string.CVE-2024-47855 · Other software · reported by MITREMedium 5.3
util/JSONTokener.java in JSON-lib before 3.1.0 mishandles an unbalanced comment string.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2024XZ Utils provide a general-purpose data-compression library plus command-line tools.CVE-2024-47611 · Other software · tukaani-project · reported by GitHubMedium 6.3
XZ Utils provide a general-purpose data-compression library plus command-line tools. When built for native Windows (MinGW-w64 or MSVC), the command line tools from XZ Utils 5.6.2 and older have a command line argument injection vulnerability. If a command line contains Unicode characters (for example, filenames) that don't exist in the current legacy code page, the characters are converted to similar-looking characters with best-fit mapping. Some best-fit mappings result in ASCII characters that change the meaning of the command line, which can be exploited with malicious filenames to do argument injection or directory traversal attacks. This vulnerability is fixed in 5.6.3. Command line tools built for Cygwin or MSYS2 are unaffected. liblzma is unaffected.
- Product
- xz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2024WP MultiTasking – WP Utilities: Stored Cross-Site ScriptingCVE-2024-8189 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The WP MultiTasking – WP Utilities plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wpmt_menu_name’ parameter in all versions up to, and including, 0.1.17 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- WP MultiTasking – WP Utilities
- Affected
- up to 0.1.17
- What to do
- Affects up to 0.1.17. Update WP MultiTasking – WP Utilities to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 27, 2024An arbitrary file upload vulnerability in YPay 1.2.0 allows attackers to execute arbitrary code via a ZIP archive to themePutFile in app/common/util/Upload.php CVE-2024-46441 · Other software · kacins · reported by MITREHigh 8.8
An arbitrary file upload vulnerability in YPay 1.2.0 allows attackers to execute arbitrary code via a ZIP archive to themePutFile in app/common/util/Upload.php (called from app/admin/controller/ypay/Home.php). The file extension of an uncompressed file is not checked.
- Product
- ypay
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2024A specially crafted POST request to the ProGauge MAGLINK LX CONSOLE UTILITY sub-menu can allow a remote attacker to inject arbitrary commands.CVE-2024-43693 · Other software · Dover Fueling Solutions (DFS) · reported by ics-cert@hq.dhs.govCritical 10
A specially crafted POST request to the ProGauge MAGLINK LX CONSOLE UTILITY sub-menu can allow a remote attacker to inject arbitrary commands.
- Product
- ProGauge MAGLINK LX CONSOLE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2024A flaw exists in the SAML signature validation method within the Keycloak XMLSignatureUtil class.CVE-2024-8698 · Other software · Red Hat · reported by Red HatHigh 7.7
A flaw exists in the SAML signature validation method within the Keycloak XMLSignatureUtil class. The method incorrectly determines whether a SAML signature is for the full document or only for specific assertions based on the position of the signature in the XML document, rather than the Reference element used to specify the signed element. This flaw allows attackers to create crafted responses that can bypass the validation, potentially leading to privilege escalation or impersonation attacks.
- Product
- Red Hat Build of Keycloak
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Sep 13, 2024The H2-DM1E PLC's authentication protocol appears to utilize either a custom encoding scheme or a challenge-response protocol.CVE-2024-45368 · Other software · AutomationDirect · reported by ics-cert@hq.dhs.govHigh 8.7
The H2-DM1E PLC's authentication protocol appears to utilize either a custom encoding scheme or a challenge-response protocol. However, there's an observed anomaly in the H2-DM1E PLC's protocol execution, namely its acceptance of multiple distinct packets as valid authentication responses. This behavior deviates from standard security practices where a single, specific response or encoding pattern is expected for successful authentication.
- Product
- DirectLogic H2-DM1E
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2024The HL7 FHIR Core Artifacts repository provides the java core object handling code, with utilities (including validator), for the Fast Healthcare InteroperabiliCVE-2024-45294 · Other software · hapifhir · reported by GitHubHigh 8.6
The HL7 FHIR Core Artifacts repository provides the java core object handling code, with utilities (including validator), for the Fast Healthcare Interoperability Resources (FHIR) specification. Prior to version 6.3.23, XSLT transforms performed by various components are vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag could produce XML containing data from the host system. This impacts use cases where org.hl7.fhir.core is being used to within a host where external clients can submit XML. This issue has been patched in release 6.3.23. No known workarounds are available.
- Product
- org.hl7.fhir.core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2024A vulnerability in Cisco Smart Licensing Utility could allow an unauthenticated, remote attacker to access sensitive information.CVE-2024-20440 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.5
A vulnerability in Cisco Smart Licensing Utility could allow an unauthenticated, remote attacker to access sensitive information. This vulnerability is due to excessive verbosity in a debug log file. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to obtain log files that contain sensitive data, including credentials that can be used to access the API.
- Product
- Cisco Smart License Utility
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Sep 4, 2024Cisco Smart Licensing Utility Static Credential VulnerabilityCVE-2024-20439 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedCritical 9.8
Cisco Smart Licensing Utility contains a static credential vulnerability that allows an unauthenticated, remote attacker to log in to an affected system and gain administrative credentials.
- Product
- Smart Licensing Utility
- On CISA’s list since
- Mar 31, 2025 (federal fix deadline Apr 21, 2025)
- What to do
- Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogsec.cloudapps.cisco.comcisa.gov
Sep 3, 2024Websites could utilize Javascript links to spoof URL addresses in the Focus navigation bar This vulnerability affects Focus for iOS < 130.CVE-2024-8399 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 4.7
Websites could utilize Javascript links to spoof URL addresses in the Focus navigation bar This vulnerability affects Focus for iOS < 130.
- Product
- Focus for iOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Aug 20, 2024An XML signature wrapping vulnerability was present in GitHub Enterprise Server (GHES) when using SAML authentication with specific identity providers utilizingCVE-2024-6800 · Other software · GitHub · reported by product-cna@github.comCritical 9.5
An XML signature wrapping vulnerability was present in GitHub Enterprise Server (GHES) when using SAML authentication with specific identity providers utilizing publicly exposed signed federation metadata XML. This vulnerability allowed an attacker with direct network access to GitHub Enterprise Server to forge a SAML response to provision and/or gain access to a user with site administrator privileges. Exploitation of this vulnerability would allow unauthorized access to the instance without requiring prior authentication. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.14 and was fixed in versions 3.13.3, 3.12.8, 3.11.14, and 3.10.16. This vulnerability was reported via the GitHub Bug Bounty program.
- Product
- GitHub Enterprise Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.github.comdocs.github.com
Aug 16, 2024Authorization Bypass Through User-Controlled Key vulnerability in upKeeper Solutions product upKeeper Manager allows Utilizing REST's Trust in the System ResourCVE-2024-42464 · Other software · upKeeper Solutions · reported by 80f39f49-2521-4ee7-9e17-af5d55e8032fHigh 7.6
Authorization Bypass Through User-Controlled Key vulnerability in upKeeper Solutions product upKeeper Manager allows Utilizing REST's Trust in the System Resource to Obtain Sensitive Data.This issue affects upKeeper Manager: through 5.1.9.
- Product
- upKeeper Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 16, 2024Authorization Bypass Through User-Controlled Key vulnerability in upKeeper Solutions product upKeeper Manager allows Utilizing REST's Trust in the System ResourCVE-2024-42463 · Other software · upKeeper Solutions · reported by 80f39f49-2521-4ee7-9e17-af5d55e8032fHigh 8.6
Authorization Bypass Through User-Controlled Key vulnerability in upKeeper Solutions product upKeeper Manager allows Utilizing REST's Trust in the System Resource to Obtain Sensitive Data.This issue affects upKeeper Manager: through 5.1.9.
- Product
- upKeeper Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 15, 2024In sdpu_compare_uuid_with_attr of sdp_utils.cc, there is a possible out of bounds read due to a heap buffer overflow.CVE-2024-34727 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.5
In sdpu_compare_uuid_with_attr of sdp_utils.cc, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comsource.android.com
Aug 14, 2024When the NGINX Plus is configured to use the MQTT pre-read module, undisclosed requests can cause an increase in memory resource utilization.CVE-2024-39792 · Network & remote access · F5 · reported by f5sirt@f5.comHigh 8.7
When the NGINX Plus is configured to use the MQTT pre-read module, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- Product
- NGINX Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2024An insufficient bounds check in PMFW (Power Management Firmware) may allow an attacker to utilize a malicious VF (virtualization function) to send a malformed mCVE-2023-20513 · Other software · AMD · reported by psirt@amd.comLow 3.3
An insufficient bounds check in PMFW (Power Management Firmware) may allow an attacker to utilize a malicious VF (virtualization function) to send a malformed message, potentially resulting in a denial of service.
- Product
- AMD Radeon™ RX 6000 Series Graphics Cards
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2024Nagios NDOUtils before 2.1.4 allows privilege escalation from nagios to root because certain executable files are owned by the nagios user.CVE-2024-43199 · Other software · nagios · reported by MITREHigh 7.8
Nagios NDOUtils before 2.1.4 allows privilege escalation from nagios to root because certain executable files are owned by the nagios user.
- Product
- ndoutils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2024WD Discovery versions prior to 5.0.589 contain a misconfiguration in the Node.js environment settings that could allow code execution by utilizing the 'ELECTRONCVE-2024-22169 · Network & remote access · Western Digital · reported by psirt@wdc.comHigh 7.1
WD Discovery versions prior to 5.0.589 contain a misconfiguration in the Node.js environment settings that could allow code execution by utilizing the 'ELECTRON_RUN_AS_NODE' environment variable. Any malicious application operating with standard user permissions can exploit this vulnerability, enabling code execution within WD Discovery application's context. WD Discovery version 5.0.589 addresses this issue by disabling certain features and fuses in Electron. The attack vector for this issue requires the victim to have the WD Discovery app installed on their device.
- Product
- WD Discovery
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 1, 2024The 1E Platform's component utilized the third-party Duende Identity Server, which suffered from an open redirect vulnerability, permitting an attacker to contrCVE-2024-7211 · Other software · 1E · reported by security@1e.comMedium 4.7
The 1E Platform's component utilized the third-party Duende Identity Server, which suffered from an open redirect vulnerability, permitting an attacker to control the redirection path of end users. Note: 1E Platform's component utilizing the third-party Duende Identity Server has been updated with the patch that includes the fix.
- Product
- 1E Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2024It was discovered by Elastic engineering that when elasticsearch-certutil CLI tool is used with the csr option in order to create a new Certificate Signing RequCVE-2024-23444 · Other software · Elastic · reported by security@elastic.coMedium 4.9
It was discovered by Elastic engineering that when elasticsearch-certutil CLI tool is used with the csr option in order to create a new Certificate Signing Requests, the associated private key that is generated is stored on disk unencrypted even if the --pass parameter is passed in the command invocation.
- Product
- Elasticsearch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.elastic.cosecurity.netapp.com
Jul 19, 2024Puncia is the Official CLI utility for Subdomain Center & Exploit Observer.CVE-2024-41124 · Other software · ARPSyndicate · reported by GitHubMedium 6.3
Puncia is the Official CLI utility for Subdomain Center & Exploit Observer. `API_URLS` is utilizing HTTP instead of HTTPS for communication that can lead to issues like Eavesdropping, Data Tampering, Unauthorized Data Access & MITM Attacks. This issue has been addressed in release version 0.21 by using https rather than http connections. All users are advised to upgrade. There is no known workarounds for this vulnerability.
- Product
- puncia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2024An exposure of sensitive information vulnerability in GitHub Enterprise Server would allow an attacker to enumerate the names of private repositories that utiliCVE-2024-6395 · Other software · GitHub · reported by product-cna@github.comMedium 6.3
An exposure of sensitive information vulnerability in GitHub Enterprise Server would allow an attacker to enumerate the names of private repositories that utilize deploy keys. This vulnerability did not allow unauthorized access to any repository content besides the name. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.14 and was fixed in versions 3.13.1, 3.12.6, 3.11.12, 3.10.14, and 3.9.17. This vulnerability was reported via the GitHub Bug Bounty program.
- Product
- GitHub Enterprise Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.github.comdocs.github.com
Jul 16, 2024Under certain circumstances the impacted Software House C•CURE 9000 installer will utilize unnecessarily wide permissions.CVE-2024-32861 · Other software · Johnson Controls · reported by productsecurity@jci.comHigh 7.8
Under certain circumstances the impacted Software House C•CURE 9000 installer will utilize unnecessarily wide permissions.
- Product
- Software House C•CURE 9000 Installer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcisa.govjohnsoncontrols.com
Jul 15, 2024@jmondi/url-to-png is an open source URL to PNG utility featuring parallel rendering using Playwright for screenshots and with storage caching via Local, S3, orCVE-2024-39919 · Other software · jasonraimondi · reported by GitHubLow 3.1
@jmondi/url-to-png is an open source URL to PNG utility featuring parallel rendering using Playwright for screenshots and with storage caching via Local, S3, or CouchDB. The package includes an `ALLOW_LIST` where the host can specify which services the user is permitted to capture screenshots of. By default, capturing screenshots of web services running on localhost, 127.0.0.1, or the [::] is allowed. If someone hosts this project on a server, users could then capture screenshots of other web services running locally. This issue has been addressed in version 2.1.1 with the addition of a blocklist. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- url-to-png
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2024@jmondi/url-to-png is an open source URL to PNG utility featuring parallel rendering using Playwright for screenshots and with storage caching via Local, S3, orCVE-2024-39918 · Other software · jasonraimondi · reported by GitHubMedium 4.3
@jmondi/url-to-png is an open source URL to PNG utility featuring parallel rendering using Playwright for screenshots and with storage caching via Local, S3, or CouchDB. Input of the `ImageId` in the code is not sanitized and may lead to path traversal. This allows an attacker to store an image in an arbitrary location that the server has permission to access. This issue has been addressed in version 2.1.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- url-to-png
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2024In the Linux kernel, the following vulnerability has been resolved: io_uring/io-wq: Use set_bit() and test_bit() at worker->flags Utilize set_bit() and test_bCVE-2024-39508 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: io_uring/io-wq: Use set_bit() and test_bit() at worker->flags Utilize set_bit() and test_bit() on worker->flags within io_uring/io-wq to address potential data races. The structure io_worker->flags may be accessed through various data paths, leading to concurrency issues. When KCSAN is enabled, it reveals data races occurring in io_worker_handle_work and io_wq_activate_free_worker functions. BUG: KCSAN: data-race in io_worker_handle_work / io_wq_activate_free_worker write to 0xffff8885c4246404 of 4 bytes by task 49071 on cpu 28: io_worker_handle_work (io_uring/io-wq.c:434 io_uring/io-wq.c:569) io_wq_worker (io_uring/io-wq.c:?) <snip> read to 0xffff8885c4246404 of 4 bytes by task 49024 on cpu 5: io_wq_activate_free_worker (io_uring/io-wq.c:? io_uring/io-wq.c:285) io_wq_enqueue (io_uring/io-wq.c:947) io_queue_iowq (io_uring/io_uring.c:524) io_req_task_submit (io_uring/io_uring.c:1511) io_handle_tw_list (io_uring/io_uring.c:1198) <snip> Line numbers against commit 18daea77cca6 ("Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm"). These races involve writes and reads to the
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jul 10, 2024Under certain circumstances the Software House C●CURE 9000 installer will utilize weak credentials.CVE-2024-32759 · Other software · Johnson Controls · reported by productsecurity@jci.comHigh 7.7
Under certain circumstances the Software House C●CURE 9000 installer will utilize weak credentials.
- Product
- Software House C•CURE 9000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcisa.govjohnsoncontrols.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.