Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
423 results · page 2 of 9
Sep 29, 2026Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Cross-Site Request Forgery (CSRF) vulnerability.CVE-2026-73597 · Other software · Dell · reported by security_alert@emc.comMedium 6.5
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Cross-Site Request Forgery (CSRF) vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure, Information tampering, Launch of phishing attacks, and Protection mechanism bypass.
- Product
- Secure Connect Gateway (SCG) Policy Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Initialization of a Resource with an Insecure Default vulnerability.CVE-2026-73596 · Other software · Dell · reported by security_alert@emc.comLow 3.8
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Initialization of a Resource with an Insecure Default vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges, Information tampering, Protection mechanism bypass, and Unauthorized access.
- Product
- Secure Connect Gateway (SCG) Policy Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, Versions prior to 5.36, contains a Download of Code Without Integrity Check vulnCVE-2026-73595 · Other software · Dell · reported by security_alert@emc.comMedium 4.7
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, Versions prior to 5.36, contains a Download of Code Without Integrity Check vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Code execution, Information disclosure, Information tampering, and Protection mechanism bypass.
- Product
- Secure Connect Gateway (SCG) Policy Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, Versions prior to 5.36, contains an Improper Certificate Validation vulnerabilitCVE-2026-73594 · Other software · Dell · reported by security_alert@emc.comMedium 6.4
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, Versions prior to 5.36, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Information disclosure, Information tampering, and Protection mechanism bypass.
- Product
- Secure Connect Gateway (SCG) Policy Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Active Debug Code vulnerability.CVE-2026-73593 · Other software · Dell · reported by security_alert@emc.comLow 3
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Active Debug Code vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure, Information tampering, Protection mechanism bypass, and Unauthorized access.
- Product
- Secure Connect Gateway (SCG) Policy Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Inclusion of Sensitive Information in Source Code vulnerability.CVE-2026-73591 · Other software · Dell · reported by security_alert@emc.comHigh 7.5
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Inclusion of Sensitive Information in Source Code vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information exposure.
- Product
- Secure Connect Gateway (SCG) Policy Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, Versions prior to 5.36, contains a Weak Encoding for Password vulnerability.CVE-2026-73589 · Other software · Dell · reported by security_alert@emc.comMedium 6.3
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, Versions prior to 5.36, contains a Weak Encoding for Password vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure, Information tampering, Protection mechanism bypass, and Unauthorized access.
- Product
- Secure Connect Gateway (SCG) Policy Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Missing Authentication for Critical Function vulnerability.CVE-2026-73588 · Other software · Dell · reported by security_alert@emc.comHigh 7.4
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.
- Product
- Secure Connect Gateway (SCG) Policy Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Certificate Validation vulnerability.CVE-2026-73587 · Other software · Dell · reported by security_alert@emc.comMedium 6.8
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Information disclosure, Information tampering, and Protection mechanism bypass.
- Product
- Secure Connect Gateway (SCG) Policy Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Insufficient Session Expiration vulnerability.CVE-2026-73586 · Other software · Dell · reported by security_alert@emc.comMedium 6.4
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Insufficient Session Expiration vulnerability. A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Elevation of privileges, Protection mechanism bypass, and Unauthorized access.
- Product
- Secure Connect Gateway (SCG) Policy Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Use of Non-Canonical URL Paths for Authorization Decisions vulnerabiCVE-2026-71178 · Other software · Dell · reported by security_alert@emc.comLow 3.7
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Use of Non-Canonical URL Paths for Authorization Decisions vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.
- Product
- Secure Connect Gateway (SCG) Policy Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Restriction of Rendered UI Layers or Frames vulnerability.CVE-2026-71177 · Other software · Dell · reported by security_alert@emc.comMedium 5.4
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Restriction of Rendered UI Layers or Frames vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges and Session theft.
- Product
- Secure Connect Gateway (SCG) Policy Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Privilege Management vulnerability.CVE-2026-61413 · Other software · Dell · reported by security_alert@emc.comMedium 6.8
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Privilege Management vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.
- Product
- Secure Connect Gateway (SCG) Policy Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2026A vulnerability in the web-based management interface of CPPM guest account management services could allow an unauthenticated remote attacker to manipulate accCVE-2026-73789 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comMedium 5.3
A vulnerability in the web-based management interface of CPPM guest account management services could allow an unauthenticated remote attacker to manipulate account settings. Successful exploitation could allow an attacker to extend network access beyond policy limits, leading to unauthorized prolonged use of network resources.
- Product
- ClearPass Policy Manager (CPPM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2026A vulnerability in the ClearPass OnGuard agent could allow an authenticated remote attacker to elevate their own privileges on a vulnerable ClearPass OnGuard deCVE-2026-73788 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comMedium 6.5
A vulnerability in the ClearPass OnGuard agent could allow an authenticated remote attacker to elevate their own privileges on a vulnerable ClearPass OnGuard deployment. Successful exploitation could allow an attacker to obtain root privileges, leading to potentially unauthorized operation of the vulnerable system.
- Product
- ClearPass Policy Manager (CPPM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2026A vulnerability in the CPPM web interface could allow an authenticated remote attacker to access directory information on a vulnerable system.CVE-2026-73787 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 7.2
A vulnerability in the CPPM web interface could allow an authenticated remote attacker to access directory information on a vulnerable system. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.
- Product
- ClearPass Policy Manager (CPPM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2026A vulnerability in the web-based management interface of CPPM could allow an unauthenticated remote attacker to conduct a Denial-of-Service (DoS) attack.CVE-2026-73786 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 7.5
A vulnerability in the web-based management interface of CPPM could allow an unauthenticated remote attacker to conduct a Denial-of-Service (DoS) attack. Successful exploitation could allow an attacker to cause instability and degrade performance of the vulnerable CPPM server.
- Product
- ClearPass Policy Manager (CPPM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2026A vulnerability in the web-based management interface of vulnerable CPPM systems could allow an authenticated remote attacker to achieve remote code execution.CVE-2026-73769 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 7.2
A vulnerability in the web-based management interface of vulnerable CPPM systems could allow an authenticated remote attacker to achieve remote code execution. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.
- Product
- ClearPass Policy Manager (CPPM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2026An unauthenticated remote code execution vulnerability exists in the Policy Manager console of Akana API Platform.CVE-2026-85978 · Other software · Perforce · reported by security@puppet.comCritical 10
An unauthenticated remote code execution vulnerability exists in the Policy Manager console of Akana API Platform. A path normalization discrepancy between the authentication filter and the servlet dispatcher allows a crafted request to bypass authentication and reach an endpoint that evaluates attacker-supplied script code without sandboxing, resulting in arbitrary code execution. Exploitation requires no authentication or user interaction.
- Product
- Akana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 17, 2026A local privilege-escalation vulnerability has been discovered in the HPE Aruba Networking ClearPass OnGuard Software for Linux.CVE-2026-23599 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 7.8
A local privilege-escalation vulnerability has been discovered in the HPE Aruba Networking ClearPass OnGuard Software for Linux. Successful exploitation of this vulnerability could allow a local attacker to achieve arbitrary code execution with root privileges.
- Product
- HPE Aruba Networking ClearPass Policy Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2025Dell Secure Connect Gateway (SCG) Policy Manager, version(s) 5.20.CVE-2025-36592 · Other software · Dell · reported by security_alert@emc.comMedium 5.4
Dell Secure Connect Gateway (SCG) Policy Manager, version(s) 5.20. 5.22, 5.24, 5.26, 5.28, contain(s) an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Script injection.
- Product
- Secure Connect Gateway SCG Policy Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2025Password Policy Manager | Password Manager: Unauthorized modification of dataCVE-2025-11255 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Password Policy Manager | Password Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'moppm_ajax' AJAX endpoint in all versions up to, and including, 2.0.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to log out the site's connection to miniorange.
- Product
- Password Policy Manager | Password Manager
- Affected
- up to 2.0.5
- What to do
- Affects up to 2.0.5. Update Password Policy Manager | Password Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 17, 2025A vulnerability in the web-based management interface of network access control services could allow an unauthenticated remote attacker to conduct a Reflected CCVE-2025-37122 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comMedium 6.1
A vulnerability in the web-based management interface of network access control services could allow an unauthenticated remote attacker to conduct a Reflected Cross-Site Scripting (XSS) attack. Successful exploitation could allow an attacker to execute arbitrary JavaScript code in a victim's browser in the context of the affected interface.
- Product
- HPE Aruba Networking ClearPass Policy Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2025Password Policy Manager: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-31019 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in miniOrange Password Policy Manager password-policy-manager allows Authentication Abuse.This issue affects Password Policy Manager: from n/a through <= 2.0.4.
- Product
- Password Policy Manager
- Affected
- up to 2.0.4
- What to do
- Affects up to 2.0.4. Update Password Policy Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 4, 2025A vulnerability in the web-based management interface of HPE Aruba Networking ClearPass Policy Manager (CPPM) allows remote authenticated users to run arbitraryCVE-2025-25039 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comMedium 4.7
A vulnerability in the web-based management interface of HPE Aruba Networking ClearPass Policy Manager (CPPM) allows remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as a lower privileged user on the underlying operating system.
- Product
- HPE Aruba Networking ClearPass Policy Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2025A vulnerability in HPE Aruba Networking ClearPass Policy Manager may, under certain circumstances, expose sensitive unencrypted information.CVE-2025-23060 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comMedium 6.6
A vulnerability in HPE Aruba Networking ClearPass Policy Manager may, under certain circumstances, expose sensitive unencrypted information. Exploiting this vulnerability could allow an attacker to perform a man-in-the-middle attack, potentially granting unauthorized access to network resources as well as enabling data tampering.
- Product
- HPE Aruba Networking ClearPass Policy Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2025A vulnerability in the web-based management interface of HPE Aruba Networking ClearPass Policy Manager exposes directories containing sensitive information.CVE-2025-23059 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comMedium 6.8
A vulnerability in the web-based management interface of HPE Aruba Networking ClearPass Policy Manager exposes directories containing sensitive information. If exploited successfully, this vulnerability allows an authenticated remote attacker with high privileges to access and retrieve sensitive data, potentially compromising the integrity and security of the entire system.
- Product
- HPE Aruba Networking ClearPass Policy Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2025A vulnerability in the ClearPass Policy Manager web-based management interface allows a low-privileged (read-only) authenticated remote attacker to gain unauthoCVE-2025-23058 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 8.8
A vulnerability in the ClearPass Policy Manager web-based management interface allows a low-privileged (read-only) authenticated remote attacker to gain unauthorized access to data and the ability to execute functions that should be restricted to administrators only with read/write privileges. Successful exploitation could enable a low-privileged user to execute administrative functions leading to an escalation of privileges.
- Product
- HPE Aruba Networking ClearPass Policy Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2024A vulnerability in the ClearPass Policy Manager web-based management interface allows remote authenticated users to run arbitrary commands on the underlying hosCVE-2024-53672 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comMedium 4.7
A vulnerability in the ClearPass Policy Manager web-based management interface allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploit could allow an attacker to execute arbitrary commands as a lower privileged user on the underlying operating system.
- Product
- HPE Aruba Networking ClearPass Policy Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2024A vulnerability in the HPE Aruba Networking ClearPass Policy Manager web-based management interface could allow an authenticated remote Attacker to conduct a stCVE-2024-51773 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comMedium 4.8
A vulnerability in the HPE Aruba Networking ClearPass Policy Manager web-based management interface could allow an authenticated remote Attacker to conduct a stored cross-site scripting (XSS) attack. Successful exploitation could enable a threat actor to perform any actions the user is authorized to do, including accessing the user's data and altering information within the user's permissions. This could lead to data modification, deletion, or theft, including unauthorized access to files, file deletion, or the theft of session cookies, which an attacker could use to hijack a user's session.
- Product
- HPE Aruba Networking ClearPass Policy Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2024An authenticated RCE vulnerability in the ClearPass Policy Manager web-based management interface allows remote authenticated users to run arbitrary commands onCVE-2024-51772 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comMedium 6.4
An authenticated RCE vulnerability in the ClearPass Policy Manager web-based management interface allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.
- Product
- HPE Aruba Networking ClearPass Policy Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2024A vulnerability in the HPE Aruba Networking ClearPass Policy Manager web-based management interface could allow an authenticated remote threat actor to conduct CVE-2024-51771 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 7.2
A vulnerability in the HPE Aruba Networking ClearPass Policy Manager web-based management interface could allow an authenticated remote threat actor to conduct a remote code execution attack. Successful exploitation could enable the attacker to run arbitrary commands on the underlying operating system.
- Product
- HPE Aruba Networking ClearPass Policy Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2024A vulnerability exists in ClearPass Policy Manager that allows for an attacker with administrative privileges to access sensitive information in a cleartext forCVE-2024-5486 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comMedium 5.8
A vulnerability exists in ClearPass Policy Manager that allows for an attacker with administrative privileges to access sensitive information in a cleartext format. A successful exploit allows an attacker to retrieve information which could be used to potentially gain further access to network services supported by ClearPass Policy Manager
- Product
- ClearPass Policy Manager (CPPM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hpe.comsupport.hpe.com
Jul 30, 2024A vulnerability exists in ClearPass Policy Manager that allows for an attacker with administrative privileges to access sensitive information in a cleartext forCVE-2024-41916 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comMedium 6.8
A vulnerability exists in ClearPass Policy Manager that allows for an attacker with administrative privileges to access sensitive information in a cleartext format. A successful exploit allows an attacker to retrieve information which could be used to potentially gain further access to network services supported by ClearPass Policy Manager.
- Product
- ClearPass Policy Manager (CPPM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hpe.comsupport.hpe.com
Jul 30, 2024A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injection attacks CVE-2024-41915 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 7.2
A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. An attacker could exploit this vulnerability to obtain and modify sensitive information in the underlying database potentially leading to complete compromise of the ClearPass Policy Manager cluster.
- Product
- ClearPass Policy Manager (CPPM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hpe.comsupport.hpe.com
Jul 16, 2024The v6.40 release of Rockwell Automation FactoryTalk® Policy Manager CVE-2021-22681 https://www.rockwellautomation.com/en-us/trust-center/security-advisories/adCVE-2024-6325 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comMedium 6
The v6.40 release of Rockwell Automation FactoryTalk® Policy Manager CVE-2021-22681 https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1550.html and CVE-2022-1161 https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1585.html by implementing CIP security and did not update to the versions of the software CVE-2022-1161 https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1585.html and CVE-2022-1161. https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1585.html
- Product
- FactoryTalk® System Services (installed via FTPM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.comrockwellautomation.com
Jun 13, 2024SCG Policy Manager, all versions, contains an overly permissive Cross-Origin Resource Policy (CORP) vulnerability.CVE-2024-37131 · Other software · Dell · reported by security_alert@emc.comHigh 7.5
SCG Policy Manager, all versions, contains an overly permissive Cross-Origin Resource Policy (CORP) vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the execution of malicious actions on the application in the context of the authenticated user.
- Product
- Secure Connect Gateway (SCG) Policy Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2024Dell Secure Connect Gateway (SCG) Policy Manager, all versions, contain(s) a Stored Cross-Site Scripting Vulnerability in the Filters page.CVE-2024-24907 · Other software · Dell · reported by security_alert@emc.comHigh 7.6
Dell Secure Connect Gateway (SCG) Policy Manager, all versions, contain(s) a Stored Cross-Site Scripting Vulnerability in the Filters page. An adjacent network high privileged attacker could potentially exploit this vulnerability, leading to the storage of malicious HTML or JavaScript codes in a trusted application data store. When a victim user accesses the data store through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable web application. Exploitation may lead to information disclosure, session theft, or client-side request forgery.
- Product
- Secure Connect Gateway (SCG) Policy Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2024Dell Secure Connect Gateway (SCG) Policy Manager, all versions, contain(s) a Stored Cross-Site Scripting Vulnerability.CVE-2024-24905 · Other software · Dell · reported by security_alert@emc.comHigh 7.6
Dell Secure Connect Gateway (SCG) Policy Manager, all versions, contain(s) a Stored Cross-Site Scripting Vulnerability. An adjacent network high privileged attacker could potentially exploit this vulnerability, leading to the storage of malicious HTML or JavaScript codes in a trusted application data store. When a victim user accesses the data store through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable web application. Exploitation may lead to information disclosure, session theft, or client-side request forgery.
- Product
- Secure Connect Gateway (SCG) Policy Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2024Dell Secure Connect Gateway (SCG) Policy Manager, all versions, contain(s) a Stored Cross-Site Scripting Vulnerability.CVE-2024-24904 · Other software · Dell · reported by security_alert@emc.comHigh 7.6
Dell Secure Connect Gateway (SCG) Policy Manager, all versions, contain(s) a Stored Cross-Site Scripting Vulnerability. An adjacent network high privileged attacker could potentially exploit this vulnerability, leading to the storage of malicious HTML or JavaScript codes in a trusted application data store. When a victim user accesses the data store through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable web application. Exploitation may lead to information disclosure, session theft, or client-side request forgery.
- Product
- Secure Connect Gateway (SCG) Policy Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2024Dell Secure Connect Gateway (SCG) Policy Manager, version 5.10+, contain a weak password recovery mechanism for forgotten passwords.CVE-2024-24903 · Other software · Dell · reported by security_alert@emc.comHigh 8
Dell Secure Connect Gateway (SCG) Policy Manager, version 5.10+, contain a weak password recovery mechanism for forgotten passwords. An adjacent network low privileged attacker could potentially exploit this vulnerability, leading to unauthorized access to the application with privileges of the compromised account. The attacker could retrieve the reset password token without authorization and then perform the password change.
- Product
- Secure Connect Gateway (SCG) Policy Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2024Dell Secure Connect Gateway (SCG) Policy Manager, all versions, contain(s) a Stored Cross-Site Scripting Vulnerability in Policy page.CVE-2024-24906 · Other software · Dell · reported by security_alert@emc.comHigh 7.6
Dell Secure Connect Gateway (SCG) Policy Manager, all versions, contain(s) a Stored Cross-Site Scripting Vulnerability in Policy page. An adjacent network high privileged attacker could potentially exploit this vulnerability, leading to the storage of malicious HTML or JavaScript codes in a trusted application data store. When a victim user accesses the data store through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable web application. Exploitation may lead to information disclosure, session theft, or client-side request forgery.
- Product
- Secure Connect Gateway (SCG) Policy Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2024Dell Secure Connect Gateway (SCG) Policy Manager, all versions, contain an improper authorization vulnerability.CVE-2024-24900 · Other software · Dell · reported by security_alert@emc.comMedium 5.8
Dell Secure Connect Gateway (SCG) Policy Manager, all versions, contain an improper authorization vulnerability. An adjacent network low privileged attacker could potentially exploit this vulnerability, leading to unauthorized devices added to policies. Exploitation may lead to information disclosure and unauthorized access to the system.
- Product
- Secure Connect Gateway (SCG) Policy Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2024A vulnerability in the web-based management interface of ClearPass Policy Manager could allow a remote attacker authenticated with low privileges to access sensCVE-2024-26302 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comMedium 4.8
A vulnerability in the web-based management interface of ClearPass Policy Manager could allow a remote attacker authenticated with low privileges to access sensitive information. A successful exploit allows an attacker to retrieve information which could be used to potentially gain further access to network services supported by ClearPass Policy Manager.
- Product
- Aruba ClearPass Policy Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
Feb 27, 2024A vulnerability in the web-based management interface of ClearPass Policy Manager could allow a remote attacker authenticated with low privileges to access sensCVE-2024-26301 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comMedium 6.5
A vulnerability in the web-based management interface of ClearPass Policy Manager could allow a remote attacker authenticated with low privileges to access sensitive information. A successful exploit allows an attacker to retrieve information which could be used to potentially gain further access to network services supported by ClearPass Policy Manager.
- Product
- Aruba ClearPass Policy Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
Feb 27, 2024A vulnerability in the guest interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) aCVE-2024-26300 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comMedium 6.6
A vulnerability in the guest interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against an administrative user of the interface. A successful exploit allows an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface.
- Product
- Aruba ClearPass Policy Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
Feb 27, 2024A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct a stored cross-site scCVE-2024-26299 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comMedium 6.6
A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against an administrative user of the interface. A successful exploit allows an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface.
- Product
- Aruba ClearPass Policy Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
Feb 27, 2024Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying hostCVE-2024-26298 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 7.2
Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise.
- Product
- Aruba ClearPass Policy Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
Feb 27, 2024Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying hostCVE-2024-26297 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 7.2
Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise.
- Product
- Aruba ClearPass Policy Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
Feb 27, 2024Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying hostCVE-2024-26296 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 7.2
Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise.
- Product
- Aruba ClearPass Policy Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.