Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
292 results · page 2 of 6
Sep 1, 2025IBM Concert Software 1.0.0 through 1.1.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive informationCVE-2025-33102 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.9
IBM Concert Software 1.0.0 through 1.1.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
- Product
- Concert Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2025HCL BigFix SM is affected by cryptographic weakness due to weak or outdated encryption algorithms.CVE-2025-31977 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.3
HCL BigFix SM is affected by cryptographic weakness due to weak or outdated encryption algorithms. An attacker with network access could exploit this weakness to decrypt or manipulate encrypted communications under certain conditions.
- Product
- BigFix Service Management (SM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Jul 28, 2025In JetBrains TeamCity before 2025.07 password reset and email verification tokens were using weak hashing algorithmsCVE-2025-54535 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.8
In JetBrains TeamCity before 2025.07 password reset and email verification tokens were using weak hashing algorithms
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2025Brocade ASCG before 3.3.0 allows for the use of medium strength cryptography algorithms on internal ports ports 9000 and 8036.CVE-2025-7398 · Other software · Broadcom · reported by sirt@brocade.comHigh 8.6
Brocade ASCG before 3.3.0 allows for the use of medium strength cryptography algorithms on internal ports ports 9000 and 8036.
- Product
- Brocade ASCG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2025liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms.CVE-2025-52473 · Other software · open-quantum-safe · reported by GitHubMedium 5.9
liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. Multiple secret-dependent branches have been identified in the reference implementation of the HQC key encapsulation mechanism when it is compiled with Clang for optimization levels above -O0 (-O1, -O2, etc). A proof-of-concept local attack exploits this secret-dependent information to recover the entire secret key. This vulnerability is fixed in 0.14.0.
- Product
- liboqs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2025The GuiXT application, which is integrated with SAP GUI for Windows, uses obfuscation algorithms instead of secure symmetric ciphers for storing the credentialsCVE-2025-42979 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.6
The GuiXT application, which is integrated with SAP GUI for Windows, uses obfuscation algorithms instead of secure symmetric ciphers for storing the credentials of an RFC user on the client PC. This leads to a high impact on confidentiality because any attacker who gains access to the user hive of this user�s windows registry could recreate the original password. There is no impact on integrity or availability of the application
- Product
- SAP GUI for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2025liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms.CVE-2025-48946 · Other software · open-quantum-safe · reported by GitHubLow 3.7
liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. liboqs prior to version 0.13.0 supports the HQC algorithm, an algorithm with a theoretical design flaw which leads to large numbers of malformed ciphertexts sharing the same implicit rejection value. Currently, no concrete attack on the algorithm is known. However, prospective users of HQC must take extra care when using the algorithm in protocols involving key derivation. In particular, HQC does not provide the same security guarantees as Kyber or ML-KEM. There is currently no patch for the HQC flaw available in liboqs, so HQC is disabled by default in liboqs starting from version 0.13.0. OQS will update its implementation after the HQC team releases an updated algorithm specification.
- Product
- liboqs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddurumcrustulum.comgithub.com
May 28, 2025IBM Sterling Secure Proxy 6.0.0.0 through 6.0.3.1, 6.1.0.0 through 6.1.0.0, and 6.2.0.0 through 6.2.0.1 uses weaker than expected cryptographic algorithms that CVE-2024-38341 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.9
IBM Sterling Secure Proxy 6.0.0.0 through 6.0.3.1, 6.1.0.0 through 6.1.0.0, and 6.2.0.0 through 6.2.0.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
- Product
- Sterling Secure Proxy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2025An issue in Hospital Management System In PHP V4.0 allows a remote attacker to execute arbitrary code via the hms/doctor/edit-profile.php fileCVE-2024-51360 · Websites & servers · Phpgurukul · reported by MITRECritical 9.8
An issue in Hospital Management System In PHP V4.0 allows a remote attacker to execute arbitrary code via the hms/doctor/edit-profile.php file
- Product
- Hospital Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2025SAP GUI for Windows allows an unauthenticated attacker to exploit insecure obfuscation algorithms used by the GuiXT application to store user credentials.CVE-2025-43005 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
SAP GUI for Windows allows an unauthenticated attacker to exploit insecure obfuscation algorithms used by the GuiXT application to store user credentials. While this issue does not impact the Integrity or Availability of the application, it may have a Low impact on the Confidentiality of data.
- Product
- SAP GUI for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2025IBM Concert Software 1.0.0 through 1.0.5 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive informationCVE-2024-55912 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.9
IBM Concert Software 1.0.0 through 1.0.5 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
- Product
- Concert Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2025IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.12 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highlyCVE-2024-22314 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.9
IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.12 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
- Product
- Storage Defender - Resiliency Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2025IBM Aspera Console 3.4.0 through 3.4.4 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.CVE-2022-43851 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.9
IBM Aspera Console 3.4.0 through 3.4.4 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
- Product
- Aspera Console
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2025IBM SPSS Statistics 26.0, 27.0.1, 28.0.1, and 29.0.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitiveCVE-2024-31896 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.9
IBM SPSS Statistics 26.0, 27.0.1, 28.0.1, and 29.0.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
- Product
- SPSS Statistics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 14, 2025IBM Security QRadar 3.12 EDR uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt sensitive credential information.CVE-2024-45643 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.9
IBM Security QRadar 3.12 EDR uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt sensitive credential information.
- Product
- QRadar EDR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2025IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0 Rich Client uses weaker than expected cryptographic algorithms that could allow CVE-2024-28780 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.9
IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0 Rich Client uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
- Product
- Cognos Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2025Vulnerabilities in the algorithms used by Fuchsia to populate network protocol header fields, specifically the TCP ISN, TCP timestamp, TCP and UDP source ports,CVE-2024-10604 · Computers, phones & browsers · Google · reported by cve-coordination@google.comMedium 6.9
Vulnerabilities in the algorithms used by Fuchsia to populate network protocol header fields, specifically the TCP ISN, TCP timestamp, TCP and UDP source ports, and IPv4/IPv6 fragment ID allow for these values to be guessed under circumstances
- Product
- Fuchsia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfuchsia.googlesource.comfuchsia.googlesource.com
Jan 28, 2025EWON Flexy 202 transmits user credentials in clear text with no encryption when a user is added, or user credentials are changed via its webpage.CVE-2025-0432 · Other software · HMS Networks · reported by ics-cert@hq.dhs.govMedium 6.9
EWON Flexy 202 transmits user credentials in clear text with no encryption when a user is added, or user credentials are changed via its webpage.
- Product
- Ewon Flexy 202
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhmsnetworks.blob.core.windows.netsupport.hms-networks.com
Jan 4, 2025IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.0.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt CVE-2024-41763 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.9
IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.0.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
- Product
- Engineering Lifecycle Optimization Publishing
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2024A code injection vulnerability in HMS Networks Ewon Flexy 205 allows executing commands on system level on the device.CVE-2024-9154 · Other software · HMS Networks · reported by office@cyberdanube.comHigh 8.6
A code injection vulnerability in HMS Networks Ewon Flexy 205 allows executing commands on system level on the device. This issue affects Ewon Flexy 205: through 14.8s0 (#2633).
- Product
- Ewon Flexy 205
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcyberdanube.comseclists.org
Dec 18, 2024IBM Cognos Analytics Mobile for Android 1.1.14 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive inforCVE-2021-39081 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.9
IBM Cognos Analytics Mobile for Android 1.1.14 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
- Product
- Cognos Analytics Mobile for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 6, 2024liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms.CVE-2024-54137 · Other software · open-quantum-safe · reported by GitHubHigh 7.4
liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. A correctness error has been identified in the reference implementation of the HQC key encapsulation mechanism. Due to an indexing error, part of the secret key is incorrectly treated as non-secret data. This results in an incorrect shared secret value being returned when the decapsulation function is called with a malformed ciphertext. This vulnerability is fixed in 0.12.0.
- Product
- liboqs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2024Apache Hive Metastore (HMS) uses SerializationUtilities#deserializeObjectWithTypeInformation method when filtering and fetching partitions that is unsafe and caCVE-2022-41137 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.3
Apache Hive Metastore (HMS) uses SerializationUtilities#deserializeObjectWithTypeInformation method when filtering and fetching partitions that is unsafe and can lead to Remote Code Execution (RCE) since it allows the deserialization of arbitrary data. In real deployments, the vulnerability can be exploited only by authenticated users/clients that were able to successfully establish a connection to the Metastore. From an API perspective any code that calls the unsafe method may be vulnerable unless it performs additional prerechecks on the input arguments.
- Product
- Apache Hive
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2024IBM Cognos Controller 11.0.0 and 11.0.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.CVE-2024-41775 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.9
IBM Cognos Controller 11.0.0 and 11.0.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
- Product
- Cognos Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2024Brocade SANnav before Brocade SANnav 2.2.2 supports key exchange algorithms, which are considered weak on ports 24, 6514, 18023, 19094, and 19095.CVE-2022-43934 · Other software · Brocade · reported by sirt@brocade.comMedium 6.5
Brocade SANnav before Brocade SANnav 2.2.2 supports key exchange algorithms, which are considered weak on ports 24, 6514, 18023, 19094, and 19095.
- Product
- SANnav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2024In the Linux kernel, the following vulnerability has been resolved: zram: free secondary algorithms names We need to kfree() secondary algorithms names when rCVE-2024-50064 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: zram: free secondary algorithms names We need to kfree() secondary algorithms names when reset zram device that had multi-streams, otherwise we leak memory. [senozhatsky@chromium.org: kfree(NULL) is legal]
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Oct 17, 2024The EWON FLEXY 202 transmits credentials using a weak encoding method base64.CVE-2024-7755 · Other software · HMS Networks · reported by ics-cert@hq.dhs.govHigh 7.1
The EWON FLEXY 202 transmits credentials using a weak encoding method base64. An attacker who is present in the network can sniff the traffic and decode the credentials.
- Product
- EWON FLEXY 202
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2024Certain switch models from PLANET Technology only support obsolete algorithms for authentication protocol and encryption protocol in the SNMPv3 service, allowinCVE-2024-8452 · Other software · PLANET Technology · reported by twcert@cert.org.twHigh 7.5
Certain switch models from PLANET Technology only support obsolete algorithms for authentication protocol and encryption protocol in the SNMPv3 service, allowing attackers to obtain plaintext SNMPv3 credentials potentially.
- Product
- GS-4210-24PL4C hardware 2.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Sep 7, 2024IBM Maximo Application Suite - Manage Component 8.10, 8.11, and 9.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt hCVE-2024-37068 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.9
IBM Maximo Application Suite - Manage Component 8.10, 8.11, and 9.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information using man in the middle techniques.
- Product
- Maximo Application Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Aug 22, 2024IBM Sterling Connect:Direct Web Services 6.0, 6.1, 6.2, and 6.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highlCVE-2024-39745 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.9
IBM Sterling Connect:Direct Web Services 6.0, 6.1, 6.2, and 6.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
- Product
- Sterling Connect:Direct Web Services
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Aug 6, 2024A compromised HMS Networks Cosy+ device could be used to request a Certificate Signing Request from Talk2m for another device, resulting in an availability issuCVE-2024-33897 · Other software · hms-networks · reported by MITRECritical 9.1
A compromised HMS Networks Cosy+ device could be used to request a Certificate Signing Request from Talk2m for another device, resulting in an availability issue. The issue was patched on the Talk2m production server on April 18, 2024.
- Product
- ewon_cosy_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.syss.comhmsnetworks.blob.core.windows.net
Aug 2, 2024Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 are vulnerable to code injection due to improper parameter blacklisting.CVE-2024-33896 · Other software · Hms-networks · reported by MITREHigh 7.2
Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 are vulnerable to code injection due to improper parameter blacklisting. This is fixed in version 21.2s10 and 22.1s3.
- Product
- Ewon Cosy+ Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.syss.comhmsnetworks.blob.core.windows.net
Aug 2, 2024Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 use a unique key to encrypt the configuration parameters.CVE-2024-33895 · Other software · Hms-networks · reported by MITREMedium 6.6
Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 use a unique key to encrypt the configuration parameters. This is fixed in version 21.2s10 and 22.1s3, the key is now unique per device.
- Product
- Ewon Cosy+ Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.syss.comhmsnetworks.blob.core.windows.net
Aug 2, 2024Insecure Permission vulnerability in Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 are executing several processes with elCVE-2024-33894 · Other software · hms-networks · reported by MITREHigh 8.8
Insecure Permission vulnerability in Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 are executing several processes with elevated privileges.
- Product
- ewon_cosy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.syss.comhmsnetworks.blob.core.windows.net
Aug 2, 2024Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 are vulnerable to XSS when displaying the logs due to improper input sanitizCVE-2024-33893 · Other software · Hms-networks · reported by MITREMedium 6.1
Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 are vulnerable to XSS when displaying the logs due to improper input sanitization. This is fixed in version 21.2s10 and 22.1s3.
- Product
- Ewon Cosy+ Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.syss.comhmsnetworks.blob.core.windows.net
Aug 2, 2024Insecure Permissions vulnerability in Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 are susceptible to leaking informationCVE-2024-33892 · Other software · hms-networks · reported by MITREHigh 7.5
Insecure Permissions vulnerability in Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 are susceptible to leaking information through cookies. This is fixed in version 21.2s10 and 22.1s3
- Product
- ewon_cosy_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.syss.comhmsnetworks.blob.core.windows.net
Jul 25, 2024HMS Industrial Networks Anybus-CompactCom 30 products are vulnerable to a XSS attack caused by the lack of input sanitation checks.CVE-2024-6558 · Other software · HMS Industrial Networks · reported by ics-cert@hq.dhs.govMedium 6.3
HMS Industrial Networks Anybus-CompactCom 30 products are vulnerable to a XSS attack caused by the lack of input sanitation checks. As a consequence, it is possible to insert HTML code into input fields and store the HTML code. The stored HTML code will be embedded in the page and executed by host browser the next time the page is loaded, enabling social engineering attacks.
- Product
- Anybus-CompactCom 30
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhmsnetworks.blob.core.windows.netcisa.gov
Jul 14, 2024IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly seCVE-2024-39731 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.9
IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 295970.
- Product
- Datacap Navigator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jun 27, 2024IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sCVE-2023-38371 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.9
IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 261198.
- Product
- Security Access Manager Docker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jun 26, 2024An issue was discovered on HMS Anybus X-Gateway AB7832-F firmware version 3.CVE-2024-23767 · Other software · hms-networks · reported by MITREHigh 8.8
An issue was discovered on HMS Anybus X-Gateway AB7832-F firmware version 3. The HICP protocol allows unauthenticated changes to a device's network configurations.
- Product
- anybus_x-gateway_ab7832-f
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsensepost.comsensepost.com
Jun 26, 2024An issue was discovered on HMS Anybus X-Gateway AB7832-F 3 devices.CVE-2024-23766 · Other software · hms-networks · reported by MITREHigh 7.5
An issue was discovered on HMS Anybus X-Gateway AB7832-F 3 devices. The gateway exposes a web interface on port 80. An unauthenticated GET request to a specific URL triggers the reboot of the Anybus gateway (or at least most of its modules). An attacker can use this feature to carry out a denial of service attack by continuously sending GET requests to that URL.
- Product
- anybus_x-gateway_ab7832-f3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsensepost.comsensepost.com
Jun 26, 2024An issue was discovered on HMS Anybus X-Gateway AB7832-F 3 devices.CVE-2024-23765 · Other software · reported by MITREMedium 4
An issue was discovered on HMS Anybus X-Gateway AB7832-F 3 devices. The gateway exposes an unidentified service on port 7412 on the network. All the network services of the gateway become unresponsive after sending 85 requests to this port. The content and length of the frame does not matter. The device needs to be restarted to resume operations.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsensepost.comsensepost.com
Jun 16, 2024C/sorting/binary_insertion_sort.c in The Algorithms - C through e5dad3f has a segmentation fault for deep recursion, which may affect common use cases such as sCVE-2024-38443 · Other software · the_algorithms · reported by MITREMedium 6.2
C/sorting/binary_insertion_sort.c in The Algorithms - C through e5dad3f has a segmentation fault for deep recursion, which may affect common use cases such as sorting an array of 50 elements.
- Product
- c
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2024liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms.CVE-2024-36405 · Other software · open-quantum-safe · reported by GitHubMedium 5.9
liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. A control-flow timing lean has been identified in the reference implementation of the Kyber key encapsulation mechanism when it is compiled with Clang 15-18 for `-Os`, `-O1`, and other compilation options. A proof-of-concept local attack on the reference implementation leaks the entire ML-KEM 512 secret key in ~10 minutes using end-to-end decapsulation timing measurements. The issue has been fixed in version 0.10.1. As a possible workaround, some compiler options may produce vectorized code that does not leak secret information, however relying on these compiler options as a workaround may not be reliable.
- Product
- liboqs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2024Aircompressor is a library with ports of the Snappy, LZO, LZ4, and Zstandard compression algorithms to Java.CVE-2024-36114 · Other software · airlift · reported by GitHubHigh 8.6
Aircompressor is a library with ports of the Snappy, LZO, LZ4, and Zstandard compression algorithms to Java. All decompressor implementations of Aircompressor (LZ4, LZO, Snappy, Zstandard) can crash the JVM for certain input, and in some cases also leak the content of other memory of the Java process (which could contain sensitive information). When decompressing certain data, the decompressors try to access memory outside the bounds of the given byte arrays or byte buffers. Because Aircompressor uses the JDK class `sun.misc.Unsafe` to speed up memory access, no additional bounds checks are performed and this has similar security consequences as out-of-bounds access in C or C++, namely it can lead to non-deterministic behavior or crash the JVM. Users should update to Aircompressor 0.27 or newer where these issues have been fixed. When decompressing data from untrusted users, this can be exploited for a denial-of-service attack by crashing the JVM, or to leak other sensitive information from the Java process. There are no known workarounds for this issue.
- Product
- aircompressor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024Improper DLL loading algorithms in B&R Automation Studio versions >=4.0 and <4.12 may allow an authenticated local attacker to execute code in the context of thCVE-2021-22280 · Other software · B&R Industrial Automation · reported by cybersecurity@ch.abb.comHigh 7.2
Improper DLL loading algorithms in B&R Automation Studio versions >=4.0 and <4.12 may allow an authenticated local attacker to execute code in the context of the product.
- Product
- Automation Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbr-automation.combr-automation.com
May 3, 2024IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive infCVE-2023-40696 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.9
IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 264939.
- Product
- Cognos Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
May 3, 2024IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive infCVE-2020-4874 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.9
IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 190837.
- Product
- Cognos Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Apr 26, 2024Setor Informatica Sistema Inteligente para Laboratorios (S.I.L.) 388 was discovered to contain a remote code execution (RCE) vulnerability via the hmsg parameteCVE-2024-22632 · Other software · setor · reported by MITRECritical 9.8
Setor Informatica Sistema Inteligente para Laboratorios (S.I.L.) 388 was discovered to contain a remote code execution (RCE) vulnerability via the hmsg parameter. This vulnerability is triggered via a crafted POST request.
- Product
- sil
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtomiodarim.iotomiodarim.io
Mar 22, 2024IBM Security Verify Directory 10.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.CVE-2022-32753 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.5
IBM Security Verify Directory 10.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 228444.
- Product
- Security Verify Directory
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.