Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,578 results · page 19 of 52
Nov 12, 2024InDesign Desktop versions ID18.5.2, ID19.5 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution CVE-2024-49508 · Other software · Adobe · reported by AdobeHigh 7.8
InDesign Desktop versions ID18.5.2, ID19.5 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- InDesign Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024InDesign Desktop versions ID18.5.2, ID19.5 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution CVE-2024-49507 · Other software · Adobe · reported by AdobeHigh 7.8
InDesign Desktop versions ID18.5.2, ID19.5 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- InDesign Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024Photoshop Desktop versions 24.7.3, 25.11 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary codeCVE-2024-49514 · Other software · Adobe · reported by AdobeHigh 7.8
Photoshop Desktop versions 24.7.3, 25.11 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Photoshop Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2024Mattermost versions 9.11.X <= 9.11.1, 9.5.x <= 9.5.9 icorrectly issues two sessions when using desktop SSO - one in the browser and one in desktop with incorrecCVE-2024-10214 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comLow 3.5
Mattermost versions 9.11.X <= 9.11.1, 9.5.x <= 9.5.9 icorrectly issues two sessions when using desktop SSO - one in the browser and one in desktop with incorrect settings.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2024Use of potentially dangerous function issue exists in Chatwork Desktop Application (Windows) versions prior to 2.9.2.CVE-2024-50307 · Other software · kubell Co., Ltd. · reported by vultures@jpcert.or.jpMedium 5.5
Use of potentially dangerous function issue exists in Chatwork Desktop Application (Windows) versions prior to 2.9.2. If a user clicks a specially crafted link in the application, an arbitrary file may be downloaded from an external website and executed. As a result, arbitrary code may be executed on the device that runs Chatwork Desktop Application (Windows).
- Product
- Chatwork Desktop Application (Windows)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2024An issue in Helakuru Desktop Application v1.1 allows a local attacker to execute arbitrary code via the lack of proper validation of the wow64log.dll file.CVE-2024-48605 · Other software · helakuru · reported by MITREHigh 7.8
An issue in Helakuru Desktop Application v1.1 allows a local attacker to execute arbitrary code via the lack of proper validation of the wow64log.dll file.
- Product
- helakuru
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordclement.notin.orggithub.com
Oct 21, 2024A vulnerability in the Desktop Client of Mitel MiCollab through 9.7.1.110, and MiVoice Business Solution Virtual Instance (MiVB SVI) 1.0.0.25, could allow an auCVE-2024-35315 · Email & office · mitel · reported by MITREMedium 5.6
A vulnerability in the Desktop Client of Mitel MiCollab through 9.7.1.110, and MiVoice Business Solution Virtual Instance (MiVB SVI) 1.0.0.25, could allow an authenticated attacker to conduct a privilege escalation attack due to improper file validation. A successful exploit could allow an attacker to run arbitrary code with elevated privileges.
- Product
- micollab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2024A vulnerability in the Desktop Client of Mitel MiCollab through 9.7.1.110, and MiVoice Business Solution Virtual Instance (MiVB SVI) 1.0.0.25, could allow an unCVE-2024-35314 · Email & office · mitel · reported by MITRECritical 9.8
A vulnerability in the Desktop Client of Mitel MiCollab through 9.7.1.110, and MiVoice Business Solution Virtual Instance (MiVB SVI) 1.0.0.25, could allow an unauthenticated attacker to conduct a command injection attack due to insufficient parameter sanitization. A successful exploit requires user interaction and could allow an attacker to execute arbitrary scripts.
- Product
- micollab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2024Docker Desktop before v4.34.3 allows RCE via unsanitized GitHub source link in Build view.CVE-2024-9348 · Other software · Docker · reported by security@docker.comHigh 8.9
Docker Desktop before v4.34.3 allows RCE via unsanitized GitHub source link in Build view.
- Product
- Docker Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2024Attackers could put the special files in .osc into the actual package sources (e.g.CVE-2024-22034 · Other software · SUSE · reported by meissner@suse.deMedium 5.5
Attackers could put the special files in .osc into the actual package sources (e.g. _apiurl). This allows the attacker to change the configuration of osc for the victim
- Product
- SUSE Linux Enterprise Desktop 15 SP5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2024Element Desktop is a Matrix client for desktop platforms.CVE-2024-47771 · Other software · element-hq · reported by GitHubHigh 7
Element Desktop is a Matrix client for desktop platforms. Element Desktop versions 1.11.70 through 1.11.80 contain a vulnerability which can, under specially crafted conditions, lead to the access token becoming exposed to third parties. At least one vector has been identified internally, involving malicious widgets, but other vectors may exist. Users are strongly advised to upgrade to version 1.11.81 to remediate the issue. As a workaround, avoid granting permissions to untrusted widgets.
- Product
- element-desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2024InDesign Desktop versions 19.4, 18.5.3 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitraCVE-2024-45137 · Other software · Adobe · reported by AdobeHigh 7.8
InDesign Desktop versions 19.4, 18.5.3 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by uploading a malicious file which, when executed, could run arbitrary code in the context of the server. Exploitation of this issue requires user interaction.
- Product
- InDesign Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2024Lightroom Desktop versions 7.4.1, 13.5, 12.5.1 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memoryCVE-2024-45145 · Other software · Adobe · reported by AdobeMedium 5.5
Lightroom Desktop versions 7.4.1, 13.5, 12.5.1 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Lightroom Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2024Remote Desktop Client Remote Code Execution VulnerabilityCVE-2024-43599 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Remote Desktop Client Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1507
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2024Remote Desktop Protocol Server Remote Code Execution VulnerabilityCVE-2024-43582 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.1
Remote Desktop Protocol Server Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2024Remote Desktop Client Remote Code Execution VulnerabilityCVE-2024-43533 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Remote Desktop Client Remote Code Execution Vulnerability
- Product
- Remote Desktop client for Windows Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2024Windows Remote Desktop Services Tampering VulnerabilityCVE-2024-43456 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.8
Windows Remote Desktop Services Tampering Vulnerability
- Product
- Windows Server 2008 R2 Service Pack 1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2024Windows Remote Desktop Licensing Service Remote Code Execution VulnerabilityCVE-2024-38262 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability
- Product
- Windows Server 2008 Service Pack 2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2024In Infinera TNMS (Transcend Network Management System) 19.10.3, cleartext storage of sensitive information in memory of the desktop application TNMS Client alloCVE-2024-25661 · Other software · infinera · reported by MITREHigh 7.7
In Infinera TNMS (Transcend Network Management System) 19.10.3, cleartext storage of sensitive information in memory of the desktop application TNMS Client allows guest OS administrators to obtain various users' passwords by reading memory dumps of the desktop application.
- Product
- tnms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 26, 2024Monica AI Assistant desktop application v2.3.0 is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor.CVE-2024-45989 · Other software · butterflyeffectpte · reported by MITREMedium 4
Monica AI Assistant desktop application v2.3.0 is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor. A prompt injection allows an attacker to modify chatbot answer with an unloaded image that exfiltrates the user's sensitive chat data of the current session to a malicious third-party or attacker-controlled server.
- Product
- monica
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2024An information exposure in Devolutions Remote Desktop Manager 2024.2.20.0 and earlier on Windows allows local attackers with access to system logs to obtain sesCVE-2024-7421 · Other software · Devolutions · reported by security@devolutions.netMedium 5.5
An information exposure in Devolutions Remote Desktop Manager 2024.2.20.0 and earlier on Windows allows local attackers with access to system logs to obtain session credentials via passwords included in command-line arguments when launching WinSCP sessions
- Product
- Remote Desktop Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2024A lack of code signature verification in Parallels Desktop for Mac v19.3.0 and below allows attackers to escalate privileges via a crafted macOS installer, becaCVE-2024-34331 · Other software · parallels · reported by MITRECritical 9.8
A lack of code signature verification in Parallels Desktop for Mac v19.3.0 and below allows attackers to escalate privileges via a crafted macOS installer, because Parallels Service is setuid root.
- Product
- parallels_desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.parallels.comkhronokernel.com
Sep 16, 2024Mattermost Desktop App versions <=5.8.0 fail to sufficiently configure Electron Fuses which allows an attacker to gather Chromium cookies or abuse other misconfCVE-2024-45835 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comLow 2.5
Mattermost Desktop App versions <=5.8.0 fail to sufficiently configure Electron Fuses which allows an attacker to gather Chromium cookies or abuse other misconfigurations via remote/local access.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2024Mattermost Desktop App versions <=5.8.0 fail to safeguard screen capture functionality which allows an attacker to silently capture high-quality screenshots viaCVE-2024-39772 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comLow 3.7
Mattermost Desktop App versions <=5.8.0 fail to safeguard screen capture functionality which allows an attacker to silently capture high-quality screenshots via JavaScript APIs.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2024Mattermost Desktop App versions <=5.8.0 fail to specify an absolute path when searching the cmd.exe file, which allows a local attacker who is able to put an cCVE-2024-39613 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 5.3
Mattermost Desktop App versions <=5.8.0 fail to specify an absolute path when searching the cmd.exe file, which allows a local attacker who is able to put an cmd.exe file in the Downloads folder of a user's machine to cause remote code execution on that machine.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2024In Nextcloud Desktop Client 3.13.1 through 3.13.3 on Linux, synchronized files (between the server and client) may become world writable or world readable.CVE-2024-46958 · Other software · Nextcloud · reported by MITRECritical 9.1
In Nextcloud Desktop Client 3.13.1 through 3.13.3 on Linux, synchronized files (between the server and client) may become world writable or world readable. This is fixed in 3.13.4.
- Product
- Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2024Photoshop Desktop versions 24.7.4, 25.11 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the cCVE-2024-45109 · Other software · Adobe · reported by AdobeHigh 7.8
Photoshop Desktop versions 24.7.4, 25.11 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Photoshop Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2024Photoshop Desktop versions 24.7.4, 25.11 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the cCVE-2024-45108 · Other software · Adobe · reported by AdobeHigh 7.8
Photoshop Desktop versions 24.7.4, 25.11 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Photoshop Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2024Photoshop Desktop versions 24.7.4, 25.11 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the cCVE-2024-43760 · Other software · Adobe · reported by AdobeHigh 7.8
Photoshop Desktop versions 24.7.4, 25.11 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Photoshop Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2024Photoshop Desktop versions 24.7.4, 25.11 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution inCVE-2024-43756 · Other software · Adobe · reported by AdobeHigh 7.8
Photoshop Desktop versions 24.7.4, 25.11 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Photoshop Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2024A remote code execution (RCE) vulnerability via crafted extension publisher-url/additional-urls could be abused by a malicious extension in Docker Desktop beforCVE-2024-8696 · Other software · Docker · reported by security@docker.comHigh 8.9
A remote code execution (RCE) vulnerability via crafted extension publisher-url/additional-urls could be abused by a malicious extension in Docker Desktop before 4.34.2.
- Product
- Docker Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2024A remote code execution (RCE) vulnerability via crafted extension description/changelog could be abused by a malicious extension in Docker Desktop before 4.34.2CVE-2024-8695 · Other software · Docker · reported by security@docker.comCritical 9
A remote code execution (RCE) vulnerability via crafted extension description/changelog could be abused by a malicious extension in Docker Desktop before 4.34.2.
- Product
- Docker Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024Microsoft Power Automate Desktop Remote Code Execution VulnerabilityCVE-2024-43479 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.5
Microsoft Power Automate Desktop Remote Code Execution Vulnerability
- Product
- Power Automate for Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024Windows Remote Desktop Licensing Service Remote Code Execution VulnerabilityCVE-2024-43467 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability
- Product
- Windows Server 2008 Service Pack 2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024Windows Remote Desktop Licensing Service Spoofing VulnerabilityCVE-2024-43455 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Windows Remote Desktop Licensing Service Spoofing Vulnerability
- Product
- Windows Server 2008 Service Pack 2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024Windows Remote Desktop Licensing Service Remote Code Execution VulnerabilityCVE-2024-43454 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.1
Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability
- Product
- Windows Server 2008 Service Pack 2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024Windows Remote Desktop Licensing Service Remote Code Execution VulnerabilityCVE-2024-38263 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability
- Product
- Windows Server 2008 Service Pack 2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024Windows Remote Desktop Licensing Service Remote Code Execution VulnerabilityCVE-2024-38260 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability
- Product
- Windows Server 2008 R2 Service Pack 1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024Windows Remote Desktop Licensing Service Information Disclosure VulnerabilityCVE-2024-38258 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Windows Remote Desktop Licensing Service Information Disclosure Vulnerability
- Product
- Windows Server 2008 Service Pack 2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024Windows Remote Desktop Licensing Service Denial of Service VulnerabilityCVE-2024-38231 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Windows Remote Desktop Licensing Service Denial of Service Vulnerability
- Product
- Windows Server 2008 Service Pack 2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024SAP BusinessObjects Business Intelligence Platform allows a high privilege user to run client desktop applications even if some of the DLLs are not digitally siCVE-2024-45281 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.8
SAP BusinessObjects Business Intelligence Platform allows a high privilege user to run client desktop applications even if some of the DLLs are not digitally signed or if the signature is broken. The attacker needs to have local access to the vulnerable system to perform DLL related tasks. This could result in a high impact on confidentiality and integrity of the application.
- Product
- SAP BusinessObjects Business Intelligence Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2024Yandex Browser for Desktop before 24.7.1.380 has a DLL Hijacking Vulnerability because an untrusted search path is used.CVE-2024-6473 · Other software · Yandex · reported by browser-security@yandex-team.ruHigh 8.4
Yandex Browser for Desktop before 24.7.1.380 has a DLL Hijacking Vulnerability because an untrusted search path is used.
- Product
- Browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2024The Electron desktop application of Rocket.Chat through 6.3.4 allows stored XSS via links in an uploaded file, related to failure to use a separate browser uponCVE-2024-45621 · Other software · Rocket.chat · reported by MITREMedium 5.4
The Electron desktop application of Rocket.Chat through 6.3.4 allows stored XSS via links in an uploaded file, related to failure to use a separate browser upon encountering third-party external actions from PDF documents.
- Product
- Rocket.chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comhackerone.com
Sep 2, 2024A flaw was found in the gnome-remote-desktop package.CVE-2024-5148 · Other software · Red Hat · reported by Red HatHigh 7.5
A flaw was found in the gnome-remote-desktop package. The gnome-remote-desktop system daemon performs inadequate validation of session agents using D-Bus methods related to transitioning a client connection from the login screen to the user session. As a result, the system RDP TLS certificate and key can be exposed to unauthorized users. This flaw allows a malicious user on the system to take control of the RDP client connection during the login screen-to-user session transition.
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Aug 16, 2024CraftOS-PC 2 is a rewrite of the desktop port of CraftOS from the popular Minecraft mod ComputerCraft using C++ and a modified version of PUC Lua, as well as SDCVE-2024-43395 · Other software · MCJack123 · reported by GitHubHigh 8.2
CraftOS-PC 2 is a rewrite of the desktop port of CraftOS from the popular Minecraft mod ComputerCraft using C++ and a modified version of PUC Lua, as well as SDL for drawing. Prior to version 2.8.3, users of CraftOS-PC 2 on Windows can escape the computer folder and access files anywhere without permission or notice by obfuscating `..`s to bypass the internal check preventing parent directory traversal. Version 2.8.3 contains a patch for this issue.
- Product
- craftos2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2024Incorrect privilege assignment in the installer for Zoom Workplace Desktop App for macOS, Zoom Meeting SDK for macOS and Zoom Rooms Client for macOS before 6.1.CVE-2024-42441 · Other software · Zoom Communications Inc. · reported by security@zoom.usMedium 6.2
Incorrect privilege assignment in the installer for Zoom Workplace Desktop App for macOS, Zoom Meeting SDK for macOS and Zoom Rooms Client for macOS before 6.1.5 may allow a privileged user to conduct an escalation of privilege via local access.
- Product
- Zoom Workplace Desktop App for macOS, Zoom Meeting SDK for macOS, Zoom Rooms Client for macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2024Improper privilege management in the installer for Zoom Workplace Desktop App for macOS, Zoom Meeting SDK for macOS and Zoom Rooms Client for macOS before 6.1.5CVE-2024-42440 · Other software · Zoom Communications Inc. · reported by security@zoom.usMedium 6.2
Improper privilege management in the installer for Zoom Workplace Desktop App for macOS, Zoom Meeting SDK for macOS and Zoom Rooms Client for macOS before 6.1.5 may allow a privileged user to conduct an escalation of privilege via local access.
- Product
- Zoom Workplace Desktop App for macOS, Zoom Meeting SDK for macOS, Zoom Rooms Client for macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2024Untrusted search path in the installer for Zoom Workplace Desktop App for macOS and Zoom Meeting SDK for macOS before 6.1.0 may allow a privileged user to conduCVE-2024-42439 · Other software · Zoom Communications Inc. · reported by security@zoom.usMedium 6.5
Untrusted search path in the installer for Zoom Workplace Desktop App for macOS and Zoom Meeting SDK for macOS before 6.1.0 may allow a privileged user to conduct an escalation of privilege via local access.
- Product
- Zoom Workplace Desktop App for macOS and Zoom Meeting SDK for macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2024InDesign Desktop versions ID19.4, ID18.5.2 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to an application denial-of-servCVE-2024-41866 · Other software · Adobe · reported by AdobeMedium 5.5
InDesign Desktop versions ID19.4, ID18.5.2 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to an application denial-of-service (DoS). An attacker could exploit this vulnerability to crash the application, resulting in a denial of service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- InDesign Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2024InDesign Desktop versions ID19.4, ID18.5.2 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory.CVE-2024-41854 · Other software · Adobe · reported by AdobeMedium 5.5
InDesign Desktop versions ID19.4, ID18.5.2 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- InDesign Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.