Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,578 results · page 20 of 52
Aug 14, 2024InDesign Desktop versions ID19.4, ID18.5.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution CVE-2024-41853 · Other software · Adobe · reported by AdobeHigh 7.8
InDesign Desktop versions ID19.4, ID18.5.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- InDesign Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2024InDesign Desktop versions ID19.4, ID18.5.2 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code executionCVE-2024-41852 · Other software · Adobe · reported by AdobeHigh 7.8
InDesign Desktop versions ID19.4, ID18.5.2 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- InDesign Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2024InDesign Desktop versions ID19.4, ID18.5.2 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execuCVE-2024-41851 · Other software · Adobe · reported by AdobeHigh 7.8
InDesign Desktop versions ID19.4, ID18.5.2 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- InDesign Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2024InDesign Desktop versions ID19.4, ID18.5.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution CVE-2024-41850 · Other software · Adobe · reported by AdobeHigh 7.8
InDesign Desktop versions ID19.4, ID18.5.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- InDesign Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2024InDesign Desktop versions ID19.4, ID18.5.2 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to an application denial-of-servCVE-2024-39395 · Other software · Adobe · reported by AdobeMedium 5.5
InDesign Desktop versions ID19.4, ID18.5.2 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to an application denial-of-service (DoS). An attacker could exploit this vulnerability to crash the application, resulting in a DoS condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- InDesign Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2024InDesign Desktop versions ID19.4, ID18.5.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in theCVE-2024-39394 · Other software · Adobe · reported by AdobeHigh 7.8
InDesign Desktop versions ID19.4, ID18.5.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- InDesign Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2024InDesign Desktop versions ID19.4, ID18.5.2 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a CVE-2024-39393 · Other software · Adobe · reported by AdobeHigh 7.8
InDesign Desktop versions ID19.4, ID18.5.2 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- InDesign Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2024InDesign Desktop versions ID19.4, ID18.5.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in theCVE-2024-39391 · Other software · Adobe · reported by AdobeHigh 7.8
InDesign Desktop versions ID19.4, ID18.5.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- InDesign Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2024InDesign Desktop versions ID19.4, ID18.5.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in theCVE-2024-39390 · Other software · Adobe · reported by AdobeHigh 7.8
InDesign Desktop versions ID19.4, ID18.5.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- InDesign Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2024InDesign Desktop versions ID19.4, ID18.5.2 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code executionCVE-2024-39389 · Other software · Adobe · reported by AdobeHigh 7.8
InDesign Desktop versions ID19.4, ID18.5.2 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- InDesign Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2024InDesign Desktop versions ID19.4, ID18.5.2 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory.CVE-2024-34127 · Other software · Adobe · reported by AdobeMedium 5.5
InDesign Desktop versions ID19.4, ID18.5.2 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- InDesign Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2024Photoshop Desktop versions 24.7.3, 25.9.1 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the contexCVE-2024-34117 · Other software · Adobe · reported by AdobeHigh 7.8
Photoshop Desktop versions 24.7.3, 25.9.1 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Photoshop Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2024Improper bounds checking in APCB firmware may allow an attacker to perform an out of bounds write, corrupting the APCB entry, potentially leading to arbitrary cCVE-2022-23815 · Other software · AMD · reported by psirt@amd.comHigh 7.5
Improper bounds checking in APCB firmware may allow an attacker to perform an out of bounds write, corrupting the APCB entry, potentially leading to arbitrary code execution.
- Product
- AMD Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2024A malicious attacker in x86 can misconfigure the Trusted Memory Regions (TMRs), which may allow the attacker to set an arbitrary address range for the TMR, poteCVE-2021-26367 · Other software · AMD · reported by psirt@amd.comMedium 5.7
A malicious attacker in x86 can misconfigure the Trusted Memory Regions (TMRs), which may allow the attacker to set an arbitrary address range for the TMR, potentially leading to a loss of integrity and availability.
- Product
- AMD Ryzen™ 5000 Series Desktop Processor with Radeon™ Graphics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2024InDesign Desktop versions ID18.5.2, ID19.3 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory.CVE-2024-39396 · Other software · Adobe · reported by AdobeMedium 5.5
InDesign Desktop versions ID18.5.2, ID19.3 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- InDesign Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2024InDesign Desktop versions ID18.5.2, ID19.3 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution CVE-2024-39392 · Other software · Adobe · reported by AdobeHigh 7.8
InDesign Desktop versions ID18.5.2, ID19.3 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- InDesign Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 27, 2024xdg-desktop-portal-hyprland (aka an XDG Desktop Portal backend for Hyprland) before 1.3.3 allows OS command execution, e.g., because single quotes are not used CVE-2024-42029 · Other software · xdg · reported by MITREMedium 6.3
xdg-desktop-portal-hyprland (aka an XDG Desktop Portal backend for Hyprland) before 1.3.3 allows OS command execution, e.g., because single quotes are not used when sending a list of app IDs and titles via the environment.
- Product
- desktop_portal_hyperland
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2024An issue was discovered in provd before version 0.1.5 with a setuid binary, which allows a local attacker to escalate their privilege.CVE-2024-6714 · Other software · Canonical Ltd. · reported by security@ubuntu.comHigh 8.8
An issue was discovered in provd before version 0.1.5 with a setuid binary, which allows a local attacker to escalate their privilege.
- Product
- Ubuntu Desktop Provision
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.launchpad.netgithub.com
Jul 23, 2024InDesign Desktop versions ID18.5.2, ID19.3 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to an application denial-of-servCVE-2024-41836 · Other software · Adobe · reported by AdobeMedium 5.5
InDesign Desktop versions ID18.5.2, ID19.3 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to an application denial-of-service (DoS) condition. An attacker could exploit this vulnerability to crash the application, resulting in a DoS. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- InDesign Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Jul 16, 2024Exposure of Sensitive Information in edge browser session proxy feature in Devolutions Remote Desktop Manager 2024.2.14.0 and earlier on Windows allows an attacCVE-2024-6492 · Other software · Devolutions · reported by security@devolutions.netHigh 7.4
Exposure of Sensitive Information in edge browser session proxy feature in Devolutions Remote Desktop Manager 2024.2.14.0 and earlier on Windows allows an attacker to intercept proxy credentials via a specially crafted website.
- Product
- Remote Desktop Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevolutions.netdevolutions.net
Jul 15, 2024Improper input validation in the installer for Zoom Workplace Desktop App for Windows before version 6.0.10 may allow an authenticated user to conduct a denial CVE-2024-39827 · Other software · Zoom Communications, Inc · reported by security@zoom.usMedium 5.5
Improper input validation in the installer for Zoom Workplace Desktop App for Windows before version 6.0.10 may allow an authenticated user to conduct a denial of service via local access.
- Product
- Zoom Workplace Desktop App for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2024Uncontrolled search path element in the installer for Zoom Workplace Desktop App for macOS before version 6.0.10 may allow an authenticated user to conduct a deCVE-2024-39820 · Other software · Zoom Communications, Inc · reported by security@zoom.usMedium 6.6
Uncontrolled search path element in the installer for Zoom Workplace Desktop App for macOS before version 6.0.10 may allow an authenticated user to conduct a denial of service via local access.
- Product
- Zoom Workplace Desktop App for macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2024Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges in Virtual Delivery Agent for Windows used by Citrix Virtual Apps and DesktopsCVE-2024-6151 · Network & remote access · Citrix · reported by secure@citrix.comHigh 8.5
Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges in Virtual Delivery Agent for Windows used by Citrix Virtual Apps and Desktops and Citrix DaaS
- Product
- Windows Virtual Delivery Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.citrix.comsupport.citrix.com
Jul 9, 2024InDesign Desktop versions ID19.3, ID18.5.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution CVE-2024-20785 · Other software · Adobe · reported by AdobeHigh 7.8
InDesign Desktop versions ID19.3, ID18.5.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- InDesign Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Jul 9, 2024InDesign Desktop versions ID19.3, ID18.5.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution CVE-2024-20783 · Other software · Adobe · reported by AdobeHigh 7.8
InDesign Desktop versions ID19.3, ID18.5.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- InDesign Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Jul 9, 2024InDesign Desktop versions ID19.3, ID18.5.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in theCVE-2024-20782 · Other software · Adobe · reported by AdobeHigh 7.8
InDesign Desktop versions ID19.3, ID18.5.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- InDesign Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Jul 9, 2024InDesign Desktop versions ID19.3, ID18.5.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution CVE-2024-20781 · Other software · Adobe · reported by AdobeHigh 7.8
InDesign Desktop versions ID19.3, ID18.5.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- InDesign Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Jul 9, 2024In Docker Desktop before v4.29.0, an attacker who has gained access to the Docker Desktop VM through a container breakout can further escape to the host by passCVE-2024-6222 · Other software · Docker Inc. · reported by security@docker.comHigh 7.3
In Docker Desktop before v4.29.0, an attacker who has gained access to the Docker Desktop VM through a container breakout can further escape to the host by passing extensions and dashboard related IPC messages. Docker Desktop v4.29.0 https://docs.docker.com/desktop/release-notes/#4290 fixes the issue on MacOS, Linux and Windows with Hyper-V backend. As exploitation requires "Allow only extensions distributed through the Docker Marketplace" to be disabled, Docker Desktop v4.31.0 https://docs.docker.com/desktop/release-notes/#4310 additionally changes the default configuration to enable this setting by default.
- Product
- Docker Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.docker.comdocs.docker.com
Jul 9, 2024In Docker Desktop on Windows before v4.31.0 allows a user in the docker-users group to cause a Windows Denial-of-Service through the exec-path Docker daemon conCVE-2024-5652 · Other software · Docker Inc. · reported by security@docker.comMedium 6.1
In Docker Desktop on Windows before v4.31.0 allows a user in the docker-users group to cause a Windows Denial-of-Service through the exec-path Docker daemon config option in Windows containers mode.
- Product
- Docker Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.docker.comdocs.docker.com
Jul 9, 2024Windows Remote Desktop Licensing Service Denial of Service VulnerabilityCVE-2024-38099 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.9
Windows Remote Desktop Licensing Service Denial of Service Vulnerability
- Product
- Windows Server 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jul 9, 2024Windows Remote Desktop Licensing Service Remote Code Execution VulnerabilityCVE-2024-38077 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.8
Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability
- Product
- Windows Server 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jul 9, 2024Windows Remote Desktop Licensing Service Remote Code Execution VulnerabilityCVE-2024-38076 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.8
Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability
- Product
- Windows Server 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jul 9, 2024Windows Remote Desktop Licensing Service Remote Code Execution VulnerabilityCVE-2024-38074 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.8
Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability
- Product
- Windows Server 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jul 9, 2024Windows Remote Desktop Licensing Service Denial of Service VulnerabilityCVE-2024-38073 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Windows Remote Desktop Licensing Service Denial of Service Vulnerability
- Product
- Windows Server 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jul 9, 2024Windows Remote Desktop Licensing Service Denial of Service VulnerabilityCVE-2024-38072 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Windows Remote Desktop Licensing Service Denial of Service Vulnerability
- Product
- Windows Server 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jul 9, 2024Windows Remote Desktop Licensing Service Denial of Service VulnerabilityCVE-2024-38071 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Windows Remote Desktop Licensing Service Denial of Service Vulnerability
- Product
- Windows Server 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jul 9, 2024Windows Remote Desktop Gateway (RD Gateway) Denial of Service VulnerabilityCVE-2024-38015 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Windows Remote Desktop Gateway (RD Gateway) Denial of Service Vulnerability
- Product
- Windows Server 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jul 5, 2024goanother Another Redis Desktop Manager =<1.6.1 is vulnerable to Cross Site Scripting (XSS) via src/components/Setting.vue.CVE-2024-23998 · Other software · goanother · reported by MITRECritical 9.6
goanother Another Redis Desktop Manager =<1.6.1 is vulnerable to Cross Site Scripting (XSS) via src/components/Setting.vue.
- Product
- another_redis_desktop_manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2024Marco Trevisan discovered that the Ubuntu Advantage Desktop Daemon, before version 1.12, leaks the Pro token to unprivileged users by passing the token as an arCVE-2024-6388 · Other software · Canonical Ltd. · reported by security@ubuntu.comMedium 5.9
Marco Trevisan discovered that the Ubuntu Advantage Desktop Daemon, before version 1.12, leaks the Pro token to unprivileged users by passing the token as an argument in plaintext.
- Product
- Ubuntu Advantage Desktop Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.launchpad.netgithub.com
Jun 26, 2024Improper access control in PAM dashboard in Devolutions Remote Desktop Manager 2024.2.11 and earlier on Windows allows an authenticated user to bypass the execuCVE-2024-6354 · Other software · Devolutions · reported by security@devolutions.netHigh 7.2
Improper access control in PAM dashboard in Devolutions Remote Desktop Manager 2024.2.11 and earlier on Windows allows an authenticated user to bypass the execute permission via the use of the PAM dashboard.
- Product
- Remote Desktop Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevolutions.netdevolutions.net
Jun 21, 2024Improper privilege management vulnerability in Parallels Desktop Software, which affects versions earlier than 19.3.0.CVE-2024-6240 · Other software · Parallels · reported by cve-coordination@incibe.esHigh 7.7
Improper privilege management vulnerability in Parallels Desktop Software, which affects versions earlier than 19.3.0. An attacker could add malicious code in a script and populate the BASH_ENV environment variable with the path to the malicious script, executing on application startup. An attacker could exploit this vulnerability to escalate privileges on the system.
- Product
- Parallels Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2024Parallels Desktop Toolgate Heap-based Buffer Overflow Local Privilege Escalation Vulnerability.CVE-2024-6154 · Other software · Parallels · reported by zdi-disclosures@trendmicro.comMedium 6.7
Parallels Desktop Toolgate Heap-based Buffer Overflow Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the Toolgate component. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the current user on the host system. Was ZDI-CAN-20450.
- Product
- Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzerodayinitiative.comzerodayinitiative.com
Jun 20, 2024Parallels Desktop Updater Protection Mechanism Failure Software Downgrade Vulnerability.CVE-2024-6153 · Other software · Parallels · reported by zdi-disclosures@trendmicro.comHigh 7.8
Parallels Desktop Updater Protection Mechanism Failure Software Downgrade Vulnerability. This vulnerability allows local attackers to downgrade Parallels software on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute low-privileged code on the target host system in order to exploit this vulnerability. The specific flaw exists within the Updater service. The issue results from the lack of proper validation of version information before performing an update. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute arbitrary code in the context of root. Was ZDI-CAN-19481.
- Product
- Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzerodayinitiative.comzerodayinitiative.com
Jun 17, 2024Improper authentication in the vault password feature in Devolutions Remote Desktop Manager 2024.1.31.0 and earlier allows an attacker that has compromised an aCVE-2024-6057 · Other software · Devolutions · reported by security@devolutions.netCritical 9.8
Improper authentication in the vault password feature in Devolutions Remote Desktop Manager 2024.1.31.0 and earlier allows an attacker that has compromised an access to an RDM instance to bypass the vault master password via the offline mode feature.
- Product
- Remote Desktop Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevolutions.netdevolutions.net
Jun 17, 2024Improper removal of sensitive information in data source export feature in Devolutions Remote Desktop Manager 2024.1.32.0 and earlier on Windows allows an attacCVE-2024-6055 · Other software · Devolutions · reported by security@devolutions.netMedium 4.7
Improper removal of sensitive information in data source export feature in Devolutions Remote Desktop Manager 2024.1.32.0 and earlier on Windows allows an attacker that obtains the exported settings to recover powershell credentials configured on the data source via stealing the configuration file.
- Product
- Remote Desktop Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevolutions.netdevolutions.net
Jun 14, 2024The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with your computer.CVE-2024-37885 · Other software · nextcloud · reported by GitHubLow 3.8
The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with your computer. A code injection in Nextcloud Desktop Client for macOS allowed to load arbitrary code when starting the client with DYLD_INSERT_LIBRARIES set in the enviroment. It is recommended that the Nextcloud Desktop client is upgraded to 3.12.0.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2024Mattermost Desktop App versions <=5.7.0 fail to correctly prompt for permission when opening external URLs which allows a remote attacker to force a victim overCVE-2024-37182 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 4.7
Mattermost Desktop App versions <=5.7.0 fail to correctly prompt for permission when opening external URLs which allows a remote attacker to force a victim over the Internet to run arbitrary programs on the victim's system via custom URI schemes.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jun 14, 2024Mattermost Desktop App versions <=5.7.0 fail to disable certain Electron debug flags which allows for bypassing TCC restrictions on macOS.CVE-2024-36287 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comLow 3.8
Mattermost Desktop App versions <=5.7.0 fail to disable certain Electron debug flags which allows for bypassing TCC restrictions on macOS.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jun 13, 2024Dropbox Desktop Folder Sharing Mark-of-the-Web Bypass Vulnerability.CVE-2024-5924 · Other software · Dropbox · reported by zdi-disclosures@trendmicro.comHigh 8.8
Dropbox Desktop Folder Sharing Mark-of-the-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of Dropbox Desktop. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of shared folders. When syncing files from a shared folder belonging to an untrusted account, the Dropbox desktop application does not apply the Mark-of-the-Web to the local files. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current user. Was ZDI-CAN-23991.
- Product
- Dropbox Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzerodayinitiative.comzerodayinitiative.com
Jun 13, 2024Creative Cloud Desktop versions 6.1.0.587 and earlier are affected by an Uncontrolled Search Path Element vulnerability that could result in a security feature CVE-2024-34116 · Other software · Adobe · reported by AdobeHigh 7.1
Creative Cloud Desktop versions 6.1.0.587 and earlier are affected by an Uncontrolled Search Path Element vulnerability that could result in a security feature bypass. An attacker could exploit this vulnerability to load and execute malicious libraries, leading to arbitrary file delete. Exploitation of this issue requires user interaction.
- Product
- Creative Cloud Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.