Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
144 results · page 2 of 3
Jul 3, 2025Bolt CMS versions 3.7.0 and earlier contain a chain of vulnerabilities that together allow an authenticated user to achieve remote code execution.CVE-2025-34086 · Other software · Bolt · reported by VulnCheckHigh 7.5
Bolt CMS versions 3.7.0 and earlier contain a chain of vulnerabilities that together allow an authenticated user to achieve remote code execution. A user with valid credentials can inject arbitrary PHP code into the displayname field of the user profile, which is rendered unsanitized in backend templates. The attacker can then list and rename cached session files via the /async/browse/cache/.sessions and /async/folder/rename endpoints. By renaming a .session file to a path under the publicly accessible /files/ directory with a .php extension, the attacker can turn the injected code into an executable web shell. Finally, the attacker triggers the payload via a crafted HTTP GET request to the rogue file. NOTE: The vendor announced that Bolt 3 reached end-of-life after 31 December 2021.
- Product
- CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2025In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix memory leak in margining Memory for the usb4->margining needs to be relasCVE-2023-53050 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix memory leak in margining Memory for the usb4->margining needs to be relased for the upstream port of the router as well, even though the debugfs directory gets released with the router device removal. Fix this.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Mar 10, 2025Passbolt API before 5, if the server is misconfigured (with an incorrect installation process and disregarding of Health Check results), can send email messagesCVE-2025-27913 · Other software · Passbolt · reported by MITRELow 2.1
Passbolt API before 5, if the server is misconfigured (with an incorrect installation process and disregarding of Health Check results), can send email messages with a domain name taken from an attacker-controlled HTTP Host header.
- Product
- API
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2024Improper Access Control in some Thunderbolt(TM) Share software before version 1.0.49.9 may allow an authenticated user to potentially enable escalation of priviCVE-2024-34022 · Other software · intel · reported by secure@intel.comMedium 5.4
Improper Access Control in some Thunderbolt(TM) Share software before version 1.0.49.9 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- thunderbolt_share_software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2024In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix KASAN reported stack out-of-bounds read in tb_retimer_scan() KASAN reportCVE-2024-50227 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.1
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix KASAN reported stack out-of-bounds read in tb_retimer_scan() KASAN reported following issue: BUG: KASAN: stack-out-of-bounds in tb_retimer_scan+0xffe/0x1550 [thunderbolt] Read of size 4 at addr ffff88810111fc1c by task kworker/u56:0/11 CPU: 0 UID: 0 PID: 11 Comm: kworker/u56:0 Tainted: G U 6.11.0+ #1387 Tainted: [U]=USER Workqueue: thunderbolt0 tb_handle_hotplug [thunderbolt] Call Trace: <TASK> dump_stack_lvl+0x6c/0x90 print_report+0xd1/0x630 kasan_report+0xdb/0x110 __asan_report_load4_noabort+0x14/0x20 tb_retimer_scan+0xffe/0x1550 [thunderbolt] tb_scan_port+0xa6f/0x2060 [thunderbolt] tb_handle_hotplug+0x17b1/0x3080 [thunderbolt] process_one_work+0x626/0x1100 worker_thread+0x6c8/0xfa0 kthread+0x2c8/0x3a0 ret_from_fork+0x3a/0x80 ret_from_fork_asm+0x1a/0x30 This happens because the loop variable still gets incremented by one so max becomes 3 instead of 2, and this makes the second loop read past the the array declared on the stack. Fix this by assigning to max directly in the loop body.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Oct 21, 2024In the Linux kernel, the following vulnerability has been resolved: net: thunderbolt: fix memory leak in tbnet_open() When tb_ring_alloc_rx() failed in tbnet_CVE-2022-48955 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: net: thunderbolt: fix memory leak in tbnet_open() When tb_ring_alloc_rx() failed in tbnet_open(), ida that allocated in tb_xdomain_alloc_out_hopid() is not released. Add tb_xdomain_release_out_hopid() to the error path to release ida.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Oct 8, 2024Insecure permissions in the Bluetooth Low Energy (BLE) component of Fire-Boltt Artillery Smart Watch NJ-R6E-10.3 allow attackers to cause a Denial of Service (DCVE-2024-46539 · Other software · fire-boltt · reported by MITREHigh 8.2
Insecure permissions in the Bluetooth Low Energy (BLE) component of Fire-Boltt Artillery Smart Watch NJ-R6E-10.3 allow attackers to cause a Denial of Service (DoS).
- Product
- artillery_smartwatch_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Sep 13, 2024In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Mark XDomain as unplugged when router is removed I noticed that when we do diCVE-2024-46702 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Mark XDomain as unplugged when router is removed I noticed that when we do discrete host router NVM upgrade and it gets hot-removed from the PCIe side as a result of NVM firmware authentication, if there is another host connected with enabled paths we hang in tearing them down. This is due to fact that the Thunderbolt networking driver also tries to cleanup the paths and ends up blocking in tb_disconnect_xdomain_paths() waiting for the domain lock. However, at this point we already cleaned the paths in tb_stop() so there is really no need for tb_disconnect_xdomain_paths() to do that anymore. Furthermore it already checks if the XDomain is unplugged and bails out early so take advantage of that and mark the XDomain as unplugged when we remove the parent router.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jul 31, 2024A vulnerability classified as problematic has been found in Bolt CMS 3.7.1.CVE-2024-7300 · Other software · Bolt · reported by VulDBMedium 5.3
A vulnerability classified as problematic has been found in Bolt CMS 3.7.1. Affected is an unknown function of the file /bolt/editcontent/showcases of the component Showcase Creation Handler. The manipulation of the argument title/textarea leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the affected release tree is end-of-life.
- Product
- CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2024** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Bolt CMS 3.7.1.CVE-2024-7299 · Other software · Bolt · reported by VulDBMedium 5.3
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Bolt CMS 3.7.1. It has been rated as problematic. This issue affects some unknown processing of the file /preview/page of the component Entry Preview Handler. The manipulation of the argument body leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-273167. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the affected release tree is end-of-life.
- Product
- CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2024Improper access control for some Intel(R) Thunderbolt driver software before version 89 may allow an authenticated user to potentially enable escalation of privCVE-2022-37410 · Other software · intel · reported by secure@intel.comHigh 7
Improper access control for some Intel(R) Thunderbolt driver software before version 89 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- thunderbolt_dch_driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2024In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix NULL pointer dereference in tb_port_update_credits() Olliver reported thaCVE-2024-27060 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix NULL pointer dereference in tb_port_update_credits() Olliver reported that his system crashes when plugging in Thunderbolt 1 device: BUG: kernel NULL pointer dereference, address: 0000000000000020 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI RIP: 0010:tb_port_do_update_credits+0x1b/0x130 [thunderbolt] Call Trace: <TASK> ? __die+0x23/0x70 ? page_fault_oops+0x171/0x4e0 ? exc_page_fault+0x7f/0x180 ? asm_exc_page_fault+0x26/0x30 ? tb_port_do_update_credits+0x1b/0x130 ? tb_switch_update_link_attributes+0x83/0xd0 tb_switch_add+0x7a2/0xfe0 tb_scan_port+0x236/0x6f0 tb_handle_hotplug+0x6db/0x900 process_one_work+0x171/0x340 worker_thread+0x27b/0x3a0 ? __pfx_worker_thread+0x10/0x10 kthread+0xe5/0x120 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x31/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 </TASK> This is due the fact that some Thunderbolt 1 devices only have one lane adapter. Fix this by checking for the lane 1 before we read its credits.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Apr 25, 2024Passbolt API before 4.6.2 allows HTML injection in a URL parameter, resulting in custom content being displayed when a user visits the crafted URL.CVE-2024-33670 · Other software · passbolt · reported by MITREMedium 4.3
Passbolt API before 4.6.2 allows HTML injection in a URL parameter, resulting in custom content being displayed when a user visits the crafted URL. Although the injected content is not executed as JavaScript due to Content Security Policy (CSP) restrictions, it may still impact the appearance and user interaction of the page.
- Product
- passbolt_api
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.passbolt.compassbolt.com
Apr 25, 2024An issue was discovered in Passbolt Browser Extension before 4.6.2.CVE-2024-33669 · Other software · passbolt · reported by MITREMedium 6.1
An issue was discovered in Passbolt Browser Extension before 4.6.2. It can send multiple requests to HaveIBeenPwned while a password is being typed, which results in an information leak. This allows an attacker capable of observing Passbolt's HTTPS queries to the Pwned Password API to more easily brute force passwords that are manually typed by the user.
- Product
- passbolt_api
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.quarkslab.comhaveibeenpwned.com
Apr 15, 2024An issue in Fireboltt Dream Wristphone BSW202_FB_AAC_v2.0_20240110-20240110-1956 allows attackers to cause a Denial of Service (DoS) via a crafted deauth frame.CVE-2024-30656 · Other software · Fireboltt · reported by MITREHigh 7.5
An issue in Fireboltt Dream Wristphone BSW202_FB_AAC_v2.0_20240110-20240110-1956 allows attackers to cause a Denial of Service (DoS) via a crafted deauth frame.
- Product
- Dream Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2024Backup Bolt: Is vulnerable to Information Exposure via the unprotected access of debug logsCVE-2023-7236 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Backup Bolt WordPress plugin through 1.3.0 is vulnerable to Information Exposure via the unprotected access of debug logs. This makes it possible for unauthenticated attackers to retrieve the debug log which may contain information like system errors which could contain sensitive information.
- Product
- Backup Bolt
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update Backup Bolt to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 14, 2024Improper buffer restrictions in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow a privileged user to potentially enable escalaCVE-2023-27308 · Other software · Intel · reported by secure@intel.comMedium 4.6
Improper buffer restrictions in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow a privileged user to potentially enable escalation of privilege via local access.
- Product
- Thunderbolt DCH Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2024Improper buffer restrictions in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially enable inCVE-2023-27307 · Other software · Intel · reported by secure@intel.comLow 3.8
Improper buffer restrictions in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially enable information disclosure via local access.
- Product
- Thunderbolt DCH Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2024Improper access control in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially enable informaCVE-2023-27303 · Other software · Intel · reported by secure@intel.comLow 3.8
Improper access control in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially enable information disclosure via local access.
- Product
- Thunderbolt DCH Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2024Improper access control in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially enable escalatCVE-2023-27301 · Other software · Intel · reported by secure@intel.comMedium 4.2
Improper access control in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- Thunderbolt DCH Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2024Improper buffer restrictions in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially enable inCVE-2023-27300 · Other software · Intel · reported by secure@intel.comLow 3.8
Improper buffer restrictions in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially enable information disclosure via local access.
- Product
- Thunderbolt DCH Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2024Improper access control in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially enable denial CVE-2023-26596 · Other software · Intel · reported by secure@intel.comLow 2.5
Improper access control in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially enable denial of service via local access.
- Product
- Thunderbolt DCH Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2024Deserialization of untrusted data in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially enabCVE-2023-26592 · Other software · Intel · reported by secure@intel.comLow 3.8
Deserialization of untrusted data in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially enable a denial of service via local access.
- Product
- Thunderbolt DCH Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2024Unchecked return value in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an unauthenticated user to potentially enable denialCVE-2023-26591 · Other software · Intel · reported by secure@intel.comLow 2
Unchecked return value in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an unauthenticated user to potentially enable denial of service via physical access.
- Product
- Thunderbolt DCH Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2024Improper access control in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially enable denial CVE-2023-26585 · Other software · Intel · reported by secure@intel.comMedium 5
Improper access control in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially enable denial of service via local access.
- Product
- Thunderbolt DCH Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2024Uncontrolled search path element in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially enablCVE-2023-25779 · Other software · intel · reported by secure@intel.comMedium 6.7
Uncontrolled search path element in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- thunderbolt_dch_driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2024Improper access control in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially enable escalatCVE-2023-25777 · Other software · Intel · reported by secure@intel.comHigh 7.9
Improper access control in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- Thunderbolt DCH Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2024Uncontrolled resource consumption in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially enabCVE-2023-25769 · Other software · Intel · reported by secure@intel.comMedium 5.5
Uncontrolled resource consumption in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially enable denial of service via local access.
- Product
- Thunderbolt DCH Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2024Improper buffer restrictions in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow a privileged user to potentially enable escalaCVE-2023-24589 · Other software · Intel · reported by secure@intel.comMedium 6.1
Improper buffer restrictions in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow a privileged user to potentially enable escalation of privilege via local access.
- Product
- Thunderbolt DCH Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2024Unquoted search path or element in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially enableCVE-2023-24542 · Other software · Intel · reported by secure@intel.comMedium 6.7
Unquoted search path or element in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- Thunderbolt DCH Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2024Improper access control in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially enable escalatCVE-2023-24481 · Other software · Intel · reported by secure@intel.comMedium 6.3
Improper access control in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- Thunderbolt DCH Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2024Improper input validation in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an unauthenticated user to potentially enable infCVE-2023-24463 · Other software · Intel · reported by secure@intel.comMedium 4.3
Improper input validation in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an unauthenticated user to potentially enable information disclosure via adjacent access.
- Product
- Thunderbolt DCH Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2024Improper access control in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially enable denial CVE-2023-22848 · Other software · Intel · reported by secure@intel.comMedium 5.5
Improper access control in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially enable denial of service via local access.
- Product
- Thunderbolt DCH Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2024Improper buffer restrictions in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially enable inCVE-2023-22390 · Other software · Intel · reported by secure@intel.comMedium 6.5
Improper buffer restrictions in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially enable information disclosure via local access.
- Product
- Thunderbolt DCH Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2024Improper input validation in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially enable escalCVE-2023-22342 · Other software · Intel · reported by secure@intel.comHigh 7.7
Improper input validation in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- Thunderbolt DCH Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2024Improper access control in the Intel(R) Thunderbolt(TM) DCH drivers for Windows may allow an authenticated user to potentially enable escalation of privilege viCVE-2023-22293 · Other software · Intel · reported by secure@intel.comHigh 8.2
Improper access control in the Intel(R) Thunderbolt(TM) DCH drivers for Windows may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- Thunderbolt DCH Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2023Uncontrolled search path in some Intel(R) NUC Kit NUC6i7KYK Thunderbolt(TM) 3 Firmware Update Tool installation software before version 46 may allow an authentiCVE-2023-32660 · Other software · intel_nuc_kit_nuc6i7kyk_thunderbolt_3_frimware_update_tool_installation_software · reported by secure@intel.comMedium 6.7
Uncontrolled search path in some Intel(R) NUC Kit NUC6i7KYK Thunderbolt(TM) 3 Firmware Update Tool installation software before version 46 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- intel_nuc_kit_nuc6i7kyk_thunderbolt_3_frimware_update_tool_installation_software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2023An issue in BoltWire v.6.03 allows a remote attacker to obtain sensitive information via a crafted payload to the view and change admin password function.CVE-2023-46501 · Other software · boltwire · reported by MITRECritical 9.1
An issue in BoltWire v.6.03 allows a remote attacker to obtain sensitive information via a crafted payload to the view and change admin password function.
- Product
- boltwire
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2023In Puppet Bolt versions prior to 3.27.4, a path to escalate privileges was identified.CVE-2023-5214 · Other software · Puppet · reported by security@puppet.comMedium 6.5
In Puppet Bolt versions prior to 3.27.4, a path to escalate privileges was identified.
- Product
- Bolt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2023Certain versions of HP PC Hardware Diagnostics Windows, HP Image Assistant, and HP Thunderbolt Dock G2 Firmware are potentially vulnerable to elevation of priviCVE-2023-32673 · Other software · HP Inc. · reported by hp-security-alert@hp.comCritical 9.8
Certain versions of HP PC Hardware Diagnostics Windows, HP Image Assistant, and HP Thunderbolt Dock G2 Firmware are potentially vulnerable to elevation of privilege.
- Product
- HP PC Hardware Diagnostics Windows, HP Image Assistant, and HP Thunderbolt Dock G2 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hp.comsupport.hp.com
Sep 15, 2022Bolt CMS contains a vulnerability in version 5.1.12 and below that allows an authenticated user with the ROLE_EDITOR privileges to upload and rename a maliciousCVE-2022-36532 · Other software · Bolt · reported by MITREHigh 8.8
Bolt CMS contains a vulnerability in version 5.1.12 and below that allows an authenticated user with the ROLE_EDITOR privileges to upload and rename a malicious file to achieve remote code execution.
- Product
- Bolt CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlutrasecurity.comlutrasecurity.com
Aug 1, 2022The foldername parameter in Bolt 5.1.7 was discovered to have incorrect input validation, allowing attackers to perform directory enumeration or cause a Denial CVE-2022-31321 · Other software · Boltcms · reported by MITRECritical 9.1
The foldername parameter in Bolt 5.1.7 was discovered to have incorrect input validation, allowing attackers to perform directory enumeration or cause a Denial of Service (DoS) via a crafted input.
- Product
- Bolt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 19, 2022Puppet Bolt prior to version 3.24.0 will print sensitive parameters when planning a run resulting in them potentially being logged when run programmatically, suCVE-2022-2394 · Other software · Puppet · reported by security@puppet.comMedium 4.1
Puppet Bolt prior to version 3.24.0 will print sensitive parameters when planning a run resulting in them potentially being logged when run programmatically, such as via Puppet Enterprise.
- Product
- Bolt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 11, 2022Bolt CMS <= 4.2 is vulnerable to Remote Code Execution.CVE-2021-40219 · Other software · Bolt · reported by MITREHigh 8.8
Bolt CMS <= 4.2 is vulnerable to Remote Code Execution. Unsafe theme rendering allows an authenticated attacker to edit theme to inject server-side template injection that leads to remote code execution.
- Product
- Bolt CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2022A cross-site scripting (XSS) vulnerability in BoltWire v7.10 and v 8.00 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the nCVE-2022-24227 · Other software · Boltwire · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in BoltWire v7.10 and v 8.00 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the name and lastname parameters.
- Product
- Boltwire
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2021Improper access control in some Intel(R) Thunderbolt(TM) Windows DCH Drivers before version 1.41.1054.0 may allow unauthenticated user to potentially enable denCVE-2021-0110 · Other software · Intel · reported by secure@intel.comMedium 5.5
Improper access control in some Intel(R) Thunderbolt(TM) Windows DCH Drivers before version 1.41.1054.0 may allow unauthenticated user to potentially enable denial of service via local access.
- Product
- Thunderbolt DCH Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2021Improper permissions in the installer for the Intel(R) Thunderbolt(TM) non-DCH driver, all versions, for Windows may allow an authenticated user to potentially CVE-2020-8741 · Other software · Intel · reported by secure@intel.comHigh 7.8
Improper permissions in the installer for the Intel(R) Thunderbolt(TM) non-DCH driver, all versions, for Windows may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- Thunderbolt Non-dch Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2021A flaw was discovered in bolt-server and ace where running a task with sensitive parameters results in those sensitive parameters being logged when they should CVE-2021-27022 · Other software · Puppet · reported by security@puppet.comMedium 4.9
A flaw was discovered in bolt-server and ace where running a task with sensitive parameters results in those sensitive parameters being logged when they should not be. This issue only affects SSH/WinRM nodes (inventory service nodes).
- Product
- Puppet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2021Uncontrolled resource consumption in some Intel(R) Thunderbolt(TM) controllers may allow an authenticated user to potentially enable denial of service via localCVE-2020-12296 · Other software · Intel · reported by secure@intel.comMedium 5.5
Uncontrolled resource consumption in some Intel(R) Thunderbolt(TM) controllers may allow an authenticated user to potentially enable denial of service via local access.
- Product
- Dsl5320 Thunderbolt 2 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2021Improper input validation in some Intel(R) Thunderbolt(TM) controllers may allow an authenticated user to potentially enable denial of service via local access.CVE-2020-12295 · Other software · Intel · reported by secure@intel.comMedium 5.5
Improper input validation in some Intel(R) Thunderbolt(TM) controllers may allow an authenticated user to potentially enable denial of service via local access.
- Product
- Jhl6240 Thunderbolt 3 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.