Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,323 results · page 18 of 47
Mar 4, 2025Out of bounds read in PDFium in Google Chrome prior to 134.0.6998.35 allowed a remote attacker to potentially perform out of bounds memory access via a crafted CVE-2025-1918 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
Out of bounds read in PDFium in Google Chrome prior to 134.0.6998.35 allowed a remote attacker to potentially perform out of bounds memory access via a crafted PDF file. (Chromium security severity: Medium)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Feb 27, 2025Use of Hard-coded Credentials, Storage of Sensitive Data in a Mechanism without Access Control vulnerability in E-Kent Pallium Vehicle Tracking allows AuthenticCVE-2024-9334 · Other software · E-Kent · reported by iletisim@usom.gov.trHigh 8.2
Use of Hard-coded Credentials, Storage of Sensitive Data in a Mechanism without Access Control vulnerability in E-Kent Pallium Vehicle Tracking allows Authentication Bypass. This issue affects Pallium Vehicle Tracking: before 17.10.2024.
- Product
- Pallium Vehicle Tracking
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Feb 26, 2025In the Linux kernel, the following vulnerability has been resolved: jffs2: fix memory leak in jffs2_scan_medium If an error is returned in jffs2_scan_erasebloCVE-2022-49276 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: jffs2: fix memory leak in jffs2_scan_medium If an error is returned in jffs2_scan_eraseblock() and some memory has been added to the jffs2_summary *s, we can observe the following kmemleak report: -------------------------------------------- unreferenced object 0xffff88812b889c40 (size 64): comm "mount", pid 692, jiffies 4294838325 (age 34.288s) hex dump (first 32 bytes): 40 48 b5 14 81 88 ff ff 01 e0 31 00 00 00 50 00 @H........1...P. 00 00 01 00 00 00 01 00 00 00 02 00 00 00 09 08 ................ backtrace: [<ffffffffae93a3a3>] __kmalloc+0x613/0x910 [<ffffffffaf423b9c>] jffs2_sum_add_dirent_mem+0x5c/0xa0 [<ffffffffb0f3afa8>] jffs2_scan_medium.cold+0x36e5/0x4794 [<ffffffffb0f3dbe1>] jffs2_do_mount_fs.cold+0xa7/0x2267 [<ffffffffaf40acf3>] jffs2_do_fill_super+0x383/0xc30 [<ffffffffaf40c00a>] jffs2_fill_super+0x2ea/0x4c0 [<ffffffffb0315d64>] mtd_get_sb+0x254/0x400 [<ffffffffb0315f5f>] mtd_get_sb_by_nr+0x4f/0xd0 [<ffffffffb0316478>] get_tree_mtd+0x498/0x840 [<ffffffffaf40bd15>] jffs2_get_tree+0x25/0x30 [<ffffffffae9f358d>] vfs_get_tree+0x8d/0x2e0 [<ff
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Feb 26, 2025In the Linux kernel, the following vulnerability has been resolved: hwrng: cavium - fix NULL but dereferenced coccicheck error Fix following coccicheck warninCVE-2022-49177 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: hwrng: cavium - fix NULL but dereferenced coccicheck error Fix following coccicheck warning: ./drivers/char/hw_random/cavium-rng-vf.c:182:17-20: ERROR: pdev is NULL but dereferenced.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Feb 25, 2025Pie Register Premium: Missing AuthorizationCVE-2025-26948 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in NotFound Pie Register Premium. This issue affects Pie Register Premium: from n/a through 3.8.3.2.
- Product
- Pie Register Premium
- Affected
- up to 3.8.3.2
- What to do
- Affects up to 3.8.3.2. Update Pie Register Premium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 14, 2025Microsoft Edge (Chromium-based) Security Feature Bypass VulnerabilityCVE-2025-21401 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.5
Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2025Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityCVE-2025-21408 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2025Microsoft Edge (Chromium-based) Spoofing VulnerabilityCVE-2025-21404 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.3
Microsoft Edge (Chromium-based) Spoofing Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2025Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityCVE-2025-21342 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2025Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityCVE-2025-21283 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2025Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityCVE-2025-21279 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2025Microsoft Edge (Chromium-based) Spoofing VulnerabilityCVE-2025-21267 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.4
Microsoft Edge (Chromium-based) Spoofing Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2025Denial of service in DNS-over-QUIC in Technitium DNS Server <= v13.2.2 allows remote attackers to permanently stop the server from accepting new DNS-over-QUIC cCVE-2024-56946 · Other software · Technitium · reported by MITREMedium 5.3
Denial of service in DNS-over-QUIC in Technitium DNS Server <= v13.2.2 allows remote attackers to permanently stop the server from accepting new DNS-over-QUIC connections by triggering unhandled exceptions in listener threads.
- Product
- Dnsserver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2025A reflected cross-site scripting (XSS) vulnerability in Audemium ERP <=0.9.0 allows remote attackers to execute an arbitrary JavaScript payload in the web browsCVE-2025-22917 · Other software · reported by MITREMedium 5.4
A reflected cross-site scripting (XSS) vulnerability in Audemium ERP <=0.9.0 allows remote attackers to execute an arbitrary JavaScript payload in the web browser of a user by including a malicious payload into the 'type' parameter of list.php.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 24, 2025User Interface (UI) Misrepresentation of Critical Information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a netwCVE-2025-21262 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.4
User Interface (UI) Misrepresentation of Critical Information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 24, 2025WPDM – Premium Packages: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-24659 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shahjada WPDM – Premium Packages wpdm-premium-packages allows Blind SQL Injection.This issue affects WPDM – Premium Packages: from n/a through <= 5.9.6.
- Product
- WPDM – Premium Packages
- Affected
- up to 5.9.6
- What to do
- Affects up to 5.9.6. Update WPDM – Premium Packages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Paytium: Generation of Error Message Containing Sensitive InformationCVE-2025-24552 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Generation of Error Message Containing Sensitive Information vulnerability in paytiumsupport Paytium paytium allows Retrieve Embedded Sensitive Data.This issue affects Paytium: from n/a through <= 4.4.11.
- Product
- Paytium
- Affected
- up to 4.4.11
- What to do
- Affects up to 4.4.11. Update Paytium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2025Cilium is a networking, observability, and security solution with an eBPF-based dataplane.CVE-2025-23047 · Other software · cilium · reported by GitHubMedium 6.5
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. An insecure default `Access-Control-Allow-Origin` header value could lead to sensitive data exposure for users of Cilium versions 1.14.0 through 1.14.7, 1.15.0 through 1.15.11, and 1.16.0 through 1.16.4 who deploy Hubble UI using either Cilium CLI or via the Cilium Helm chart. A user with access to a Hubble UI instance affected by this issue could leak configuration details about the Kubernetes cluster which Hubble UI is monitoring, including node names, IP addresses, and other metadata about workloads and the cluster networking configuration. In order for this vulnerability to be exploited, a victim would have to first visit a malicious page. This issue is fixed in Cilium v1.14.18, v1.15.12, and v1.16.5. As a workaround, users who deploy Hubble UI using the Cilium Helm chart directly can remove the CORS headers from the Helm template as shown in the patch from commit a3489f190ba6e87b5336ee685fb6c80b1270d06d.
- Product
- cilium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2025Cilium is a networking, observability, and security solution with an eBPF-based dataplane.CVE-2025-23028 · Other software · cilium · reported by GitHubMedium 5.3
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. A denial of service vulnerability affects versions 1.14.0 through 1.14.7, 1.15.0 through 1.15.11, and 1.16.0 through 1.16.4. In a Kubernetes cluster where Cilium is configured to proxy DNS traffic, an attacker can crash Cilium agents by sending a crafted DNS response to workloads from outside the cluster. For traffic that is allowed but without using DNS-based policy, the dataplane will continue to pass traffic as configured at the time of the DoS. For workloads that have DNS-based policy configured, existing connections may continue to operate, and new connections made without relying on DNS resolution may continue to be established, but new connections which rely on DNS resolution may be disrupted. Any configuration changes that affect the impacted agent may not be applied until the agent is able to restart. This issue is fixed in Cilium v1.14.18, v1.15.12, and v1.16.5. No known workarounds are available.
- Product
- cilium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2025Microsoft Edge (Chromium-based) Update Elevation of Privilege VulnerabilityCVE-2025-21399 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.4
Microsoft Edge (Chromium-based) Update Elevation of Privilege Vulnerability
- Product
- Microsoft Edge Update Setup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comvicarius.io
Jan 17, 2025Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityCVE-2025-21185 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2025Teradata Vantage Editor 1.0.1 is mostly intended for SQL database access and docs.teradata.com access, but provides unintended functionality (including ChromiumCVE-2024-52870 · Other software · reported by MITREHigh 7.1
Teradata Vantage Editor 1.0.1 is mostly intended for SQL database access and docs.teradata.com access, but provides unintended functionality (including Chromium Developer Tools) that can result in a client user accessing arbitrary remote websites.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchrismanson.comteradata.com
Jan 16, 2025A null pointer dereference vulnerability in Macrium Reflect prior to 8.1.8017 allows a local attacker to cause a system crash or potentially elevate their priviCVE-2024-55511 · Other software · reported by MITREHigh 7.8
A null pointer dereference vulnerability in Macrium Reflect prior to 8.1.8017 allows a local attacker to cause a system crash or potentially elevate their privileges via executing a specially crafted executable.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comupdates.macrium.com
Jan 15, 2025A cross-site scripting (xss) vulnerability exists in the add_alert_check page of Observium CE 24.4.13528.CVE-2024-47140 · Other software · Observium · reported by talos-cna@cisco.comHigh 8.7
A cross-site scripting (xss) vulnerability exists in the add_alert_check page of Observium CE 24.4.13528. A specially crafted HTTP request can lead to a arbitrary javascript code execution. An authenticated user would need to click a malicious link provided by the attacker.
- Product
- Observium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Jan 15, 2025A html code injection vulnerability exists in the vlan management part of Observium CE 24.4.13528.CVE-2024-47002 · Other software · Observium · reported by talos-cna@cisco.comHigh 8.7
A html code injection vulnerability exists in the vlan management part of Observium CE 24.4.13528. A specially crafted HTTP request can lead to an arbitrary html code. An authenticated user would need to click a malicious link provided by the attacker.
- Product
- Observium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Jan 15, 2025A cross-site scripting (xss) vulnerability exists in the weather map editor functionality of Observium CE 24.4.13528.CVE-2024-45061 · Other software · Observium · reported by talos-cna@cisco.comHigh 8.7
A cross-site scripting (xss) vulnerability exists in the weather map editor functionality of Observium CE 24.4.13528. A specially crafted HTTP request can lead to a arbitrary javascript code execution. An authenticated user would need to click a malicious link provided by the attacker.
- Product
- Observium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Jan 9, 2025Surbma | Premium WP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22808 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Surbma Surbma | Premium WP surbma-premium-wp allows DOM-Based XSS.This issue affects Surbma | Premium WP: from n/a through <= 9.0.
- Product
- Surbma | Premium WP
- Affected
- up to 9.0
- What to do
- Affects up to 9.0. Update Surbma | Premium WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Elementor Addons AI Addons – 70 Widgets, Premium Templates, Ultimate Elements: Information ExposureCVE-2024-12140 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Elementor Addons AI Addons – 70 Widgets, Premium Templates, Ultimate Elements plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.2.1 via the render function due to insufficient restrictions on which templates can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft templates that they should not have access to.
- Product
- Elementor Addons AI Addons – 70 Widgets, Premium Templates, Ultimate Elements
- Affected
- up to 2.2.1
- What to do
- Affects up to 2.2.1. Update Elementor Addons AI Addons – 70 Widgets, Premium Templates, Ultimate Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 2, 2025ARMember Premium: Missing AuthorizationCVE-2023-39994 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Repute InfoSystems ARMember Premium allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ARMember Premium: from n/a through 5.9.2.
- Product
- ARMember Premium
- Affected
- up to 5.9.2
- What to do
- Affects up to 5.9.2. Update ARMember Premium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Premium Blocks – Gutenberg Blocks for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56245 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Leap13 Premium Blocks – Gutenberg Blocks for WordPress premium-blocks-for-gutenberg allows Stored XSS.This issue affects Premium Blocks – Gutenberg Blocks for WordPress: from n/a through <= 2.1.42.
- Product
- Premium Blocks – Gutenberg Blocks for
- Affected
- up to 2.1.42
- What to do
- Affects up to 2.1.42. Update Premium Blocks – Gutenberg Blocks for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024Paytium: Missing AuthorizationCVE-2024-51667 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in paytiumsupport Paytium paytium.This issue affects Paytium: from n/a through <= 4.4.10.
- Product
- Paytium
- Affected
- up to 4.4.10
- What to do
- Affects up to 4.4.10. Update Paytium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024Premium Addons for Elementor: Missing AuthorizationCVE-2024-56225 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Leap13 Premium Addons for Elementor premium-addons-for-elementor allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Premium Addons for Elementor: from n/a through <= 4.10.56.
- Product
- Premium Addons for Elementor
- Affected
- up to 4.10.56
- What to do
- Affects up to 4.10.56. Update Premium Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 19, 2024IBM Security Guardium 11.5 and 12.0 is vulnerable to server-side request forgery (SSRF).CVE-2024-49336 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM Security Guardium 11.5 and 12.0 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
- Product
- Security Guardium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2024External Control of File Name or Path vulnerability in Edgecross Basic Software for Windows versions 1.00 and later and Edgecross Basic Software for Developers CVE-2024-4230 · Other software · Edgecross Consortium · reported by Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jpHigh 7.8
External Control of File Name or Path vulnerability in Edgecross Basic Software for Windows versions 1.00 and later and Edgecross Basic Software for Developers versions 1.00 and later allows a malicious local attacker to execute an arbitrary malicious code, resulting in information disclosure, tampering with and deletion, or a denial-of-service (DoS) condition.
- Product
- Edgecross Basic Software for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2024Incorrect Default Permissions vulnerability in Edgecross Basic Software for Windows versions 1.00 and later and Edgecross Basic Software for Developers versionsCVE-2024-4229 · Other software · Edgecross Consortium · reported by Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jpHigh 7.8
Incorrect Default Permissions vulnerability in Edgecross Basic Software for Windows versions 1.00 and later and Edgecross Basic Software for Developers versions 1.00 and later allows a malicious local attacker to execute an arbitrary malicious code, resulting in information disclosure, tampering with and deletion, or a denial-of-service (DoS) condition, if the product is installed in a folder other than a folder that only users with administrative privilege have permission to modify.
- Product
- Edgecross Basic Software for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2024IBM Security Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2.0, and 4.2.1 could allow a remote attacker to obtain sensitive information, caused by the failure toCVE-2024-49820 · Other software · IBM · reported by psirt@us.ibm.comLow 3.7
IBM Security Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2.0, and 4.2.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques.
- Product
- Security Guardium Key Lifecycle Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2024IBM Security Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2.0, and 4.2.1 could allow a remote attacker to obtain sensitive information in cleartext in a communiCVE-2024-49819 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.1
IBM Security Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2.0, and 4.2.1 could allow a remote attacker to obtain sensitive information in cleartext in a communication channel that can be sniffed by unauthorized actors.
- Product
- Security Guardium Key Lifecycle Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2024IBM Security Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2.0, and 4.2.1 could allow a remote attacker to obtain sensitive information when a detailed technicCVE-2024-49818 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM Security Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2.0, and 4.2.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.
- Product
- Security Guardium Key Lifecycle Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2024IBM Security Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2.0, and 4.2.1 stores user credentials in configuration files which can be read by a local privileged CVE-2024-49817 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.4
IBM Security Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2.0, and 4.2.1 stores user credentials in configuration files which can be read by a local privileged user.
- Product
- Security Guardium Key Lifecycle Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2024IBM Security Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2.0, and 4.2.1 stores potentially sensitive information in log files that could be read by a local priCVE-2024-49816 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.9
IBM Security Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2.0, and 4.2.1 stores potentially sensitive information in log files that could be read by a local privileged user.
- Product
- Security Guardium Key Lifecycle Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2024Pie Register Premium: Missing AuthorizationCVE-2024-52391 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Genetech Pie Register Premium.This issue affects Pie Register Premium: from n/a before 3.8.3.3.
- Product
- Pie Register Premium
- Fixed in
- 3.8.3.3
- What to do
- Update Pie Register Premium to 3.8.3.3 or newer.
Dec 9, 2024Pie Register Premium: Unrestricted Upload of File with Dangerous TypeCVE-2024-53822 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in Genetech Pie Register Premium.This issue affects Pie Register Premium: from n/a before 3.8.3.3.
- Product
- Pie Register Premium
- Fixed in
- 3.8.3.3
- What to do
- Update Pie Register Premium to 3.8.3.3 or newer.
Dec 6, 2024Pie Register Premium: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53821 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Genetech Pie Register Premium allows Reflected XSS.This issue affects Pie Register Premium: from n/a before 3.8.3.3.
- Product
- Pie Register Premium
- Fixed in
- 3.8.3.3
- What to do
- Update Pie Register Premium to 3.8.3.3 or newer.
Dec 5, 2024Microsoft Edge (Chromium-based) Spoofing VulnerabilityCVE-2024-49041 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.3
Microsoft Edge (Chromium-based) Spoofing Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 27, 2024This Medium severity Security Misconfiguration vulnerability was introduced in version 8.8.1 of Confluence Data Center and Server for Windows installations.CVE-2024-21703 · Websites & servers · Atlassian · reported by security@atlassian.comMedium 6.4
This Medium severity Security Misconfiguration vulnerability was introduced in version 8.8.1 of Confluence Data Center and Server for Windows installations. This Security Misconfiguration vulnerability, with a CVSS Score of 6.4 allows an authenticated attacker of the Windows host to read sensitive information about the Confluence Data Center configuration which has high impact to confidentiality, high impact to integrity, high impact to availability, and no user interaction. Atlassian recommends that Confluence Data Center and Server customers upgrade to the latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: * Confluence Data Center and Server 7.19: Upgrade to a release greater than or equal to 7.19.18 * Confluence Data Center and Server 8.5: Upgrade to a release greater than or equal to 8.5.5 * Confluence Data Center and Server 8.7: Upgrade to a release greater than or equal to 8.7.2 * Confluence Data Center and Server 8.8: Upgrade to a release greater than or equal to 8.8.0 See the release notes (https://confluence.atlassian.com/conf88/confluence-release-notes-1354501008.html ). You can download the late
- Product
- Confluence Data Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 25, 2024Cilium is a networking, observability, and security solution with an eBPF-based dataplane.CVE-2024-52529 · Other software · cilium · reported by GitHubMedium 5.8
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For users with the following configuration: 1. An allow policy that selects a Layer 3 destination and a port range `AND` 2. A Layer 7 allow policy that selects a specific port within the first policy's range the Layer 7 enforcement would not occur for the traffic selected by the Layer 7 policy. This issue only affects users who use Cilium's port range functionality, which was introduced in Cilium v1.16. This issue is patched in PR #35150. This issue affects Cilium v1.16 between v1.16.0 and v1.16.3 inclusive. This issue is patched in Cilium v1.16.4. Users are advised to upgrade. Users with network policies that match the pattern described above can work around the issue by rewriting any policies that use port ranges to individually specify the ports permitted for traffic.
- Product
- cilium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024Avast Cleanup Premium Link Following Local Privilege Escalation Vulnerability.CVE-2024-7231 · Other software · Avast · reported by zdi-disclosures@trendmicro.comHigh 7.8
Avast Cleanup Premium Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Avast Cleanup Premium. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Avast Cleanup Service. By creating a symbolic link, an attacker can abuse the service to delete a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-22894.
- Product
- Cleanup Premium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024Avast Cleanup Premium Link Following Local Privilege Escalation Vulnerability.CVE-2024-7230 · Other software · Avast · reported by zdi-disclosures@trendmicro.comHigh 7.8
Avast Cleanup Premium Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Avast Cleanup Premium. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Avast Cleanup Service. By creating a symbolic link, an attacker can abuse the service to delete a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-22893.
- Product
- Cleanup Premium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024Avast Cleanup Premium Link Following Local Privilege Escalation Vulnerability.CVE-2024-7229 · Other software · Avast · reported by zdi-disclosures@trendmicro.comHigh 7.8
Avast Cleanup Premium Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Avast Cleanup Premium. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Avast Cleanup Service. By creating a symbolic link, an attacker can abuse the service to delete a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-22892.
- Product
- Cleanup Premium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024Microsoft Edge (Chromium-based) Spoofing VulnerabilityCVE-2024-49054 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.3
Microsoft Edge (Chromium-based) Spoofing Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.