Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,578 results · page 18 of 52
Jan 21, 2025Vulnerability in the Oracle Analytics Desktop product of Oracle Analytics (component: Install).CVE-2025-21532 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.8
Vulnerability in the Oracle Analytics Desktop product of Oracle Analytics (component: Install). Supported versions that are affected are Prior to 8.1.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Analytics Desktop executes to compromise Oracle Analytics Desktop. Successful attacks of this vulnerability can result in takeover of Oracle Analytics Desktop. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
- Product
- Oracle Analytics Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2025On most desktop platforms, Brave Browser versions 1.70.x-1.73.x included a feature to show a site's origin on the OS-provided file selector dialog when a site pCVE-2025-23086 · Other software · Brave · reported by support@hackerone.comMedium 6.1
On most desktop platforms, Brave Browser versions 1.70.x-1.73.x included a feature to show a site's origin on the OS-provided file selector dialog when a site prompts the user to upload or download a file. However the origin was not correctly inferred in some cases. When combined with an open redirector vulnerability on a trusted site, this could allow a malicious site to initiate a download whose origin in the file select dialog appears as the trusted site which initiated the redirect.
- Product
- Desktop Browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2025Belledonne Communications Linphone-Desktop is vulnerable to a NULL Dereference vulnerability, which could allow a remote attacker to create a denial-of-servicCVE-2025-0430 · Other software · Belledonne Communications · reported by ics-cert@hq.dhs.govHigh 8.7
Belledonne Communications Linphone-Desktop is vulnerable to a NULL Dereference vulnerability, which could allow a remote attacker to create a denial-of-service condition.
- Product
- Linphone-Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2025GitHub Desktop is an open-source Electron-based GitHub app designed for git development.CVE-2025-23040 · Other software · desktop · reported by GitHubMedium 6.6
GitHub Desktop is an open-source Electron-based GitHub app designed for git development. An attacker convincing a user to clone a repository directly or through a submodule can allow the attacker access to the user's credentials through the use of maliciously crafted remote URL. GitHub Desktop relies on Git to perform all network related operations (such as cloning, fetching, and pushing). When a user attempts to clone a repository GitHub Desktop will invoke `git clone` and when Git encounters a remote which requires authentication it will request the credentials for that remote host from GitHub Desktop using the git-credential protocol. Using a maliciously crafted URL it's possible to cause the credential request coming from Git to be misinterpreted by Github Desktop such that it will send credentials for a different host than the host that Git is currently communicating with thereby allowing for secret exfiltration. GitHub username and OAuth token, or credentials for other Git remote hosts stored in GitHub Desktop could be improperly transmitted to an unrelated host. Users should update to GitHub Desktop 3.4.12 or greater which fixes this vulnerability. Users who suspect they may
- Product
- desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.github.comgit-scm.com
Jan 14, 2025Photoshop Desktop versions 25.12, 26.1 and earlier are affected by an Uncontrolled Search Path Element vulnerability that could lead to arbitrary code executionCVE-2025-21127 · Other software · Adobe · reported by AdobeHigh 7.8
Photoshop Desktop versions 25.12, 26.1 and earlier are affected by an Uncontrolled Search Path Element vulnerability that could lead to arbitrary code execution. An attacker could manipulate the search path environment variable to point to a malicious library, resulting in the execution of arbitrary code when the application loads. Exploitation of this issue requires user interaction in that a victim must run the vulnerable application.
- Product
- Photoshop Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2025Photoshop Desktop versions 25.12, 26.1 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code eCVE-2025-21122 · Other software · Adobe · reported by AdobeHigh 7.8
Photoshop Desktop versions 25.12, 26.1 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Photoshop Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2025Windows Remote Desktop Services Denial of Service VulnerabilityCVE-2025-21330 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Windows Remote Desktop Services Denial of Service Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2025Windows Remote Desktop Services Remote Code Execution VulnerabilityCVE-2025-21309 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.1
Windows Remote Desktop Services Remote Code Execution Vulnerability
- Product
- Windows Server 2012
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2025Windows Remote Desktop Services Remote Code Execution VulnerabilityCVE-2025-21297 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.1
Windows Remote Desktop Services Remote Code Execution Vulnerability
- Product
- Windows Server 2008 R2 Service Pack 1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2025Windows Remote Desktop Gateway (RD Gateway) Denial of Service VulnerabilityCVE-2025-21278 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.2
Windows Remote Desktop Gateway (RD Gateway) Denial of Service Vulnerability
- Product
- Windows 10 Version 1507
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2025Windows Remote Desktop Gateway (RD Gateway) Denial of Service VulnerabilityCVE-2025-21225 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.9
Windows Remote Desktop Gateway (RD Gateway) Denial of Service Vulnerability
- Product
- Windows Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2025Microsoft Power Automate Remote Code Execution VulnerabilityCVE-2025-21187 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Power Automate Remote Code Execution Vulnerability
- Product
- Power Automate for Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2024libpoppler.so in Poppler through 24.12.0 has an out-of-bounds read vulnerability within the JBIG2Bitmap::combine function in JBIG2Stream.cc.CVE-2024-56378 · Other software · Freedesktop · reported by MITREMedium 4.3
libpoppler.so in Poppler through 24.12.0 has an out-of-bounds read vulnerability within the JBIG2Bitmap::combine function in JBIG2Stream.cc.
- Product
- Poppler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.freedesktop.orggitlab.freedesktop.org
Dec 20, 2024Stardust is a platform for streaming isolated desktop containers.CVE-2024-56330 · Other software · spaceness · reported by GitHubCritical 9.3
Stardust is a platform for streaming isolated desktop containers. With this exploit, inter container communication (ICC) is not disabled. This would allow users within a container to access another containers agent, therefore compromising access.The problem has been patched in any Stardust build past 12/20/24. Users are advised to upgrade. Users may also manually disable ICC if they are unable to upgrade.
- Product
- stardust
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2024Use of a hard-coded password for a database administrator account created during Wapro ERP installation allows an attacker to retrieve embedded sensitive data sCVE-2024-4996 · Other software · Asseco Business Solutions S.A. · reported by cvd@cert.plCritical 9.3
Use of a hard-coded password for a database administrator account created during Wapro ERP installation allows an attacker to retrieve embedded sensitive data stored in the database. The password is same among all Wapro ERP installations. This issue affects Wapro ERP Desktop versions before 8.90.0.
- Product
- Wapro ERP Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2024Wapro ERP Desktop is vulnerable to MS SQL protocol downgrade request from a server side, what could lead to an unencrypted communication vulnerable to data inteCVE-2024-4995 · Other software · Asseco Business Solutions S.A. · reported by cvd@cert.plCritical 9.1
Wapro ERP Desktop is vulnerable to MS SQL protocol downgrade request from a server side, what could lead to an unencrypted communication vulnerable to data interception and modification. This issue affects Wapro ERP Desktop versions before 9.00.0.
- Product
- Wapro ERP Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2024In the Mullvad VPN client 2024.6 (Desktop), 2024.8 (iOS), and 2024.8-beta1 (Android), the exception-handling alternate stack can be exhausted, leading to heap-bCVE-2024-55884 · Other software · reported by MITRECritical 9
In the Mullvad VPN client 2024.6 (Desktop), 2024.8 (iOS), and 2024.8-beta1 (Android), the exception-handling alternate stack can be exhausted, leading to heap-based out-of-bounds writes in enable() in exception_logging/unix.rs, aka MLLVD-CR-24-01. NOTE: achieving code execution is considered non-trivial.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnews.ycombinator.com
Dec 11, 2024Windows Remote Desktop Services Remote Code Execution VulnerabilityCVE-2024-49132 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.1
Windows Remote Desktop Services Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2024Windows Remote Desktop Gateway (RD Gateway) Denial of Service VulnerabilityCVE-2024-49129 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Windows Remote Desktop Gateway (RD Gateway) Denial of Service Vulnerability
- Product
- Windows Server 2012
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2024Sensitive data storage in improperly locked memory in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network.CVE-2024-49128 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.1
Sensitive data storage in improperly locked memory in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network.
- Product
- Windows Server 2012
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2024Windows Remote Desktop Services Remote Code Execution VulnerabilityCVE-2024-49123 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.1
Windows Remote Desktop Services Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2024Windows Remote Desktop Services Remote Code Execution VulnerabilityCVE-2024-49120 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.1
Windows Remote Desktop Services Remote Code Execution Vulnerability
- Product
- Windows Server 2012
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2024Windows Remote Desktop Services Remote Code Execution VulnerabilityCVE-2024-49119 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.1
Windows Remote Desktop Services Remote Code Execution Vulnerability
- Product
- Windows Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2024Windows Remote Desktop Services Remote Code Execution VulnerabilityCVE-2024-49116 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.1
Windows Remote Desktop Services Remote Code Execution Vulnerability
- Product
- Windows Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2024Windows Remote Desktop Services Remote Code Execution VulnerabilityCVE-2024-49115 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.1
Windows Remote Desktop Services Remote Code Execution Vulnerability
- Product
- Windows Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2024Windows Remote Desktop Services Remote Code Execution VulnerabilityCVE-2024-49108 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.1
Windows Remote Desktop Services Remote Code Execution Vulnerability
- Product
- Windows Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2024Windows Remote Desktop Services Remote Code Execution VulnerabilityCVE-2024-49106 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.1
Windows Remote Desktop Services Remote Code Execution Vulnerability
- Product
- Windows Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2024Remote Desktop Client Remote Code Execution VulnerabilityCVE-2024-49105 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.4
Remote Desktop Client Remote Code Execution Vulnerability
- Product
- Remote Desktop client for Windows Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2024Windows Remote Desktop Services Denial of Service VulnerabilityCVE-2024-49075 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Windows Remote Desktop Services Denial of Service Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024InDesign Desktop versions ID19.5, ID18.5.4 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-seCVE-2024-53952 · Other software · Adobe · reported by AdobeMedium 5.5
InDesign Desktop versions ID19.5, ID18.5.4 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial of service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- InDesign Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024InDesign Desktop versions ID19.5, ID18.5.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory.CVE-2024-53951 · Other software · Adobe · reported by AdobeMedium 5.5
InDesign Desktop versions ID19.5, ID18.5.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- InDesign Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024Photoshop Desktop versions 26.0 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the cCVE-2024-52997 · Other software · Adobe · reported by AdobeHigh 7.8
Photoshop Desktop versions 26.0 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Photoshop Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024InDesign Desktop versions ID19.5, ID18.5.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory.CVE-2024-49549 · Other software · Adobe · reported by AdobeMedium 5.5
InDesign Desktop versions ID19.5, ID18.5.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- InDesign Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024InDesign Desktop versions ID19.5, ID18.5.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory.CVE-2024-49548 · Other software · Adobe · reported by AdobeMedium 5.5
InDesign Desktop versions ID19.5, ID18.5.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- InDesign Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024InDesign Desktop versions ID19.5, ID18.5.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory.CVE-2024-49547 · Other software · Adobe · reported by AdobeMedium 5.5
InDesign Desktop versions ID19.5, ID18.5.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- InDesign Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024InDesign Desktop versions ID19.5, ID18.5.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory.CVE-2024-49546 · Other software · Adobe · reported by AdobeMedium 5.5
InDesign Desktop versions ID19.5, ID18.5.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- InDesign Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024InDesign Desktop versions ID19.5, ID18.5.4 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution CVE-2024-49545 · Other software · Adobe · reported by AdobeHigh 7.8
InDesign Desktop versions ID19.5, ID18.5.4 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- InDesign Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024InDesign Desktop versions ID19.5, ID18.5.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in theCVE-2024-49544 · Other software · Adobe · reported by AdobeHigh 7.8
InDesign Desktop versions ID19.5, ID18.5.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- InDesign Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024InDesign Desktop versions ID19.5, ID18.5.4 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code executionCVE-2024-49543 · Other software · Adobe · reported by AdobeHigh 7.8
InDesign Desktop versions ID19.5, ID18.5.4 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- InDesign Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024Insufficient permissions in Ivanti DSM before version 2024.3.5740 allows a local authenticated attacker to delete arbitrary files.CVE-2024-7572 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75High 7.1
Insufficient permissions in Ivanti DSM before version 2024.3.5740 allows a local authenticated attacker to delete arbitrary files.
- Product
- Desktop and Server Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2024Incorrect permission assignment in temporary access requests component in Devolutions Remote Desktop Manager 2024.3.19.0 and earlier on Windows allows an authenCVE-2024-12149 · Other software · Devolutions · reported by security@devolutions.netHigh 8.1
Incorrect permission assignment in temporary access requests component in Devolutions Remote Desktop Manager 2024.3.19.0 and earlier on Windows allows an authenticated user that request temporary permissions on an entry to obtain more privileges than requested.
- Product
- Remote Desktop Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 25, 2024Incorrect authorization in the add permission component in Devolutions Remote Desktop Manager 2024.2.21 and earlier on Windows allows an authenticated maliciousCVE-2024-11672 · Other software · Devolutions · reported by security@devolutions.netMedium 4.3
Incorrect authorization in the add permission component in Devolutions Remote Desktop Manager 2024.2.21 and earlier on Windows allows an authenticated malicious user to bypass the "Add" permission via the import in vault feature.
- Product
- Remote Desktop Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 25, 2024Improper authentication in SQL data source MFA validation in Devolutions Remote Desktop Manager 2024.3.17 and earlier on Windows allows an authenticated user toCVE-2024-11671 · Other software · Devolutions · reported by security@devolutions.netMedium 5.4
Improper authentication in SQL data source MFA validation in Devolutions Remote Desktop Manager 2024.3.17 and earlier on Windows allows an authenticated user to bypass the MFA validation via data source switching.
- Product
- Remote Desktop Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 25, 2024Incorrect authorization in the permission validation component of Devolutions Remote Desktop Manager 2024.2.21 and earlier on Windows allows a malicious authentCVE-2024-11670 · Other software · Devolutions · reported by security@devolutions.netMedium 5.4
Incorrect authorization in the permission validation component of Devolutions Remote Desktop Manager 2024.2.21 and earlier on Windows allows a malicious authenticated user to bypass the "View Password" permission via specific actions.
- Product
- Remote Desktop Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2024InDesign Desktop versions 19.0, 20.0 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory.CVE-2024-49529 · Other software · Adobe · reported by AdobeMedium 5.5
InDesign Desktop versions 19.0, 20.0 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- InDesign Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2024The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with your computer.CVE-2024-52510 · Other software · nextcloud · reported by GitHubMedium 4.2
The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with your computer. The Desktop client did not stop with an error but allowed by-passing the signature validation, if a manipulated server sends an empty initial signature. It is recommended that the Nextcloud Desktop client is upgraded to 3.14.2 or later.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024InDesign Desktop versions ID18.5.3, ID19.5 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory.CVE-2024-49512 · Other software · Adobe · reported by AdobeMedium 5.5
InDesign Desktop versions ID18.5.3, ID19.5 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- InDesign Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024InDesign Desktop versions ID18.5.3, ID19.5 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory.CVE-2024-49511 · Other software · Adobe · reported by AdobeMedium 5.5
InDesign Desktop versions ID18.5.3, ID19.5 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- InDesign Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024InDesign Desktop versions ID18.5.3, ID19.5 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory.CVE-2024-49510 · Other software · Adobe · reported by AdobeMedium 5.5
InDesign Desktop versions ID18.5.3, ID19.5 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- InDesign Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024InDesign Desktop versions ID18.5.3, ID19.5 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution CVE-2024-49509 · Other software · Adobe · reported by AdobeHigh 7.8
InDesign Desktop versions ID18.5.3, ID19.5 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- InDesign Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.