Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,898 results · page 23 of 58
Jan 14, 2025Microsoft Office Remote Code Execution VulnerabilityCVE-2025-21365 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Office Remote Code Execution Vulnerability
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2025Microsoft Outlook Remote Code Execution VulnerabilityCVE-2025-21361 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Outlook Remote Code Execution Vulnerability
- Product
- Microsoft Office LTSC for Mac 2021
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2025Microsoft Office Visio Remote Code Execution VulnerabilityCVE-2025-21356 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Office Visio Remote Code Execution Vulnerability
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2025Microsoft Office Security Feature Bypass VulnerabilityCVE-2025-21346 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.1
Microsoft Office Security Feature Bypass Vulnerability
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2025Microsoft Office Visio Remote Code Execution VulnerabilityCVE-2025-21345 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Office Visio Remote Code Execution Vulnerability
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2025GDI+ Remote Code Execution VulnerabilityCVE-2025-21338 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.8
GDI+ Remote Code Execution Vulnerability
- Product
- Microsoft Office for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2025BigAnt Office Messenger 5.6.06 is vulnerable to SQL Injection via the 'dev_code' parameter.CVE-2024-54761 · Other software · Bigantsoft · reported by MITREMedium 6.3
BigAnt Office Messenger 5.6.06 is vulnerable to SQL Injection via the 'dev_code' parameter.
- Product
- Bigant Office Messenger 5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jan 8, 2025A vulnerability was found in Kingsoft WPS Office 6.14.0 on macOS.CVE-2024-13187 · Other software · Kingsoft · reported by VulDBMedium 4.8
A vulnerability was found in Kingsoft WPS Office 6.14.0 on macOS. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component TCC Handler. The manipulation leads to code injection. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- WPS Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025Exposure of Environmental Variables and arbitrary INI file values to an Unauthorized Actor vulnerability in The Document Foundation LibreOffice.CVE-2024-12426 · Other software · The Document Foundation · reported by security@documentfoundation.orgMedium 6.7
Exposure of Environmental Variables and arbitrary INI file values to an Unauthorized Actor vulnerability in The Document Foundation LibreOffice. URLs could be constructed which expanded environmental variables or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document containing such links. This issue affects LibreOffice: from 24.8 before < 24.8.4.
- Product
- LibreOffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlibreoffice.orglists.debian.org
Jan 7, 2025Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The Document Foundation LibreOffice allows Absolute Path TraversCVE-2024-12425 · Other software · The Document Foundation · reported by security@documentfoundation.orgLow 2.4
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The Document Foundation LibreOffice allows Absolute Path Traversal. An attacker can write to arbitrary locations, albeit suffixed with ".ttf", by supplying a file in a format that supports embedded font files. This issue affects LibreOffice: from 24.8 before < 24.8.4.
- Product
- LibreOffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlibreoffice.orglists.debian.org
Jan 3, 2025PhpSpreadsheet is a PHP library for reading and writing spreadsheet files.CVE-2024-56412 · Websites & servers · PHPOffice · reported by GitHubMedium 4.8
PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 are vulnerable to bypass of the cross-site scripting sanitizer using the javascript protocol and special characters. An attacker can use special characters, so that the library processes the javascript protocol with special characters and generates an HTML link. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7 contain a patch for the issue.
- Product
- PhpSpreadsheet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 3, 2025PhpSpreadsheet is a PHP library for reading and writing spreadsheet files.CVE-2024-56411 · Websites & servers · PHPOffice · reported by GitHubMedium 4.8
PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 have a cross-site scripting (XSS) vulnerability of the hyperlink base in the HTML page header. The HTML page is formed without sanitizing the hyperlink base. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7 contain a patch for the issue.
- Product
- PhpSpreadsheet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 3, 2025PhpSpreadsheet is a PHP library for reading and writing spreadsheet files.CVE-2024-56410 · Websites & servers · PHPOffice · reported by GitHubMedium 4.8
PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 have a cross-site scripting (XSS) vulnerability in custom properties. The HTML page is generated without clearing custom properties. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7 contain a patch for the issue.
- Product
- PhpSpreadsheet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 3, 2025PhpSpreadsheet is a PHP library for reading and writing spreadsheet files.CVE-2024-56409 · Websites & servers · PHPOffice · reported by GitHubHigh 8.3
PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 are vulnerable to unauthorized reflected cross-site scripting in the `Currency.php` file. Using the `/vendor/phpoffice/phpspreadsheet/samples/Wizards/NumberFormat/Currency.php` script, an attacker can perform a cross-site scripting attack. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7 contain a patch for the issue.
- Product
- PhpSpreadsheet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 3, 2025PhpSpreadsheet is a PHP library for reading and writing spreadsheet files.CVE-2024-56366 · Websites & servers · PHPOffice · reported by GitHubHigh 8.3
PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 are vulnerable to unauthorized reflected cross-site scripting in the `Accounting.php` file. Using the `/vendor/phpoffice/phpspreadsheet/samples/Wizards/NumberFormat/Accounting.php` script, an attacker can perform a cross-site scripting attack. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7 contain a patch for the issue.
- Product
- PhpSpreadsheet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 3, 2025PhpSpreadsheet is a PHP library for reading and writing spreadsheet files.CVE-2024-56365 · Websites & servers · PHPOffice · reported by GitHubHigh 8.3
PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 are vulnerable to unauthorized reflected cross-site scripting in the constructor of the `Downloader` class. Using the `/vendor/phpoffice/phpspreadsheet/samples/download.php` script, an attacker can perform a cross-site scripting attack. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7 contain a patch for the issue.
- Product
- PhpSpreadsheet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 3, 2025PhpSpreadsheet is a PHP library for reading and writing spreadsheet files.CVE-2024-56408 · Websites & servers · PHPOffice · reported by GitHubHigh 8.3
PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 have no sanitization in the `/vendor/phpoffice/phpspreadsheet/samples/Engineering/Convert-Online.php` file, which leads to the possibility of a cross-site scripting attack. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7 contain a patch for the issue.
- Product
- PhpSpreadsheet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2024Woffice: Authentication Bypass Using an Alternate Path or ChannelCVE-2024-43234 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in WofficeIO Woffice woffice allows Authentication Bypass.This issue affects Woffice: from n/a through <= 5.4.14.
- Product
- Woffice
- Affected
- up to 5.4.14
- What to do
- Affects up to 5.4.14. Update Woffice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 12, 2024ONLYOFFICE DocSpace: Stored Cross-Site ScriptingCVE-2024-11750 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The ONLYOFFICE DocSpace plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'onlyoffice-docspace' shortcode in all versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- ONLYOFFICE DocSpace
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update ONLYOFFICE DocSpace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 11, 2024Microsoft Office Remote Code Execution VulnerabilityCVE-2024-49065 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Microsoft Office Remote Code Execution Vulnerability
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2024Microsoft Office Elevation of Privilege VulnerabilityCVE-2024-49059 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Microsoft Office Elevation of Privilege Vulnerability
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2024Microsoft Office Elevation of Privilege VulnerabilityCVE-2024-43600 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Office Elevation of Privilege Vulnerability
- Product
- Microsoft Office 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2024Zammad before 6.4.1 places sensitive data (such as auth_microsoft_office365_credentials and application_secret) in log files.CVE-2024-55578 · Other software · Zammad · reported by MITREMedium 4.3
Zammad before 6.4.1 places sensitive data (such as auth_microsoft_office365_credentials and application_secret) in log files.
- Product
- Zammad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 6, 2024ONLYOFFICE Docs: Stored Cross-Site ScriptingCVE-2024-11450 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The ONLYOFFICE Docs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'onlyoffice' shortcode in all versions up to, and including, 2.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- ONLYOFFICE Docs
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update ONLYOFFICE Docs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 29, 2024Ibexa Admin UI Bundle is all the necessary parts to run the Ibexa DXP Back Office interface.CVE-2024-53864 · Other software · ibexa · reported by GitHubMedium 5.3
Ibexa Admin UI Bundle is all the necessary parts to run the Ibexa DXP Back Office interface. The Content name pattern is used to build Content names from one or more fields. An XSS vulnerability has been found in this mechanism. Content edit permission is required to exploit it. After the fix, any existing injected XSS will not run. This issue has been patched in version 4.6.14. All users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- admin-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevelopers.ibexa.codoc.ibexa.co
Nov 28, 2024A low privileged remote attacker can insert a SQL injection in the web application due to improper handling of HTTP request input data which allows to exfiltratCVE-2024-8308 · Other software · Siempelkamp · reported by info@cert.vde.comMedium 6.5
A low privileged remote attacker can insert a SQL injection in the web application due to improper handling of HTTP request input data which allows to exfiltrate all data.
- Product
- UmweltOffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 28, 2024Office Locator: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2024-52501 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WebbyTemplate Office Locator office-locator.This issue affects Office Locator: from n/a through <= 1.3.0.
- Product
- Office Locator
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update Office Locator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 19, 2024File Upload vulnerability in Xi'an Daxi Information technology OfficeWeb365 v.8.6.1.0 and v7.18.23.0 allows a remote attacker to execute arbitrary code via the CVE-2024-48694 · Other software · xian_daxi_information_technology · reported by MITRECritical 9.8
File Upload vulnerability in Xi'an Daxi Information technology OfficeWeb365 v.8.6.1.0 and v7.18.23.0 allows a remote attacker to execute arbitrary code via the pw/savedraw component.
- Product
- officeweb_365
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordavd.aliyun.comgithub.com
Nov 18, 2024PhpSpreadsheet is a PHP library for reading and writing spreadsheet files.CVE-2024-48917 · Websites & servers · PHPOffice · reported by GitHubHigh 7.5
PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. The `XmlScanner` class has a scan method which should prevent XXE attacks. However, in a bypass of the previously reported `CVE-2024-47873`, the regexes from the `findCharSet` method, which is used for determining the current encoding can be bypassed by using a payload in the encoding UTF-7, and adding at end of the file a comment with the value `encoding="UTF-8"` with `"`, which is matched by the first regex, so that `encoding='UTF-7'` with single quotes `'` in the XML header is not matched by the second regex. An attacker can bypass the sanitizer and achieve an XML external entity attack. Versions 1.9.4, 2.1.3, 2.3.2, and 3.4.0 fix the issue.
- Product
- PhpSpreadsheet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 18, 2024PhpSpreadsheet is a PHP library for reading and writing spreadsheet files.CVE-2024-47873 · Websites & servers · PHPOffice · reported by GitHubHigh 7.5
PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. The XmlScanner class has a scan method which should prevent XXE attacks. However, prior to versions 1.9.4, 2.1.3, 2.3.2, and 3.4.0, the regexes used in the `scan` method and the findCharSet method can be bypassed by using UCS-4 and encoding guessing. An attacker can bypass the sanitizer and achieve an XML external entity attack. Versions 1.9.4, 2.1.3, 2.3.2, and 3.4.0 fix the issue.
- Product
- PhpSpreadsheet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024Microsoft Word Security Feature Bypass VulnerabilityCVE-2024-49033 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.5
Microsoft Word Security Feature Bypass Vulnerability
- Product
- Microsoft Office LTSC for Mac 2024
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024Microsoft Office Graphics Remote Code Execution VulnerabilityCVE-2024-49032 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Office Graphics Remote Code Execution Vulnerability
- Product
- Microsoft Office LTSC for Mac 2024
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024Microsoft Office Graphics Remote Code Execution VulnerabilityCVE-2024-49031 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Office Graphics Remote Code Execution Vulnerability
- Product
- Microsoft Office LTSC for Mac 2024
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024Microsoft Excel Remote Code Execution VulnerabilityCVE-2024-49030 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Excel Remote Code Execution Vulnerability
- Product
- Microsoft Office LTSC for Mac 2024
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024Microsoft Excel Remote Code Execution VulnerabilityCVE-2024-49029 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Excel Remote Code Execution Vulnerability
- Product
- Microsoft Office LTSC for Mac 2024
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024Microsoft Excel Remote Code Execution VulnerabilityCVE-2024-49028 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Excel Remote Code Execution Vulnerability
- Product
- Microsoft Office LTSC for Mac 2024
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024Microsoft Excel Remote Code Execution VulnerabilityCVE-2024-49027 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Excel Remote Code Execution Vulnerability
- Product
- Microsoft Office 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024Microsoft Excel Remote Code Execution VulnerabilityCVE-2024-49026 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Excel Remote Code Execution Vulnerability
- Product
- Microsoft Office 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2024Orchid is a @laravel package that allows for rapid application development of back-office applications, admin/user panels, and dashboards.CVE-2024-51992 · Other software · orchidsoftware · reported by GitHubMedium 4.1
Orchid is a @laravel package that allows for rapid application development of back-office applications, admin/user panels, and dashboards. This vulnerability is a method exposure issue (CWE-749: Exposed Dangerous Method or Function) in the Orchid Platform’s asynchronous modal functionality, affecting users of Orchid Platform version 8 through 14.42.x. Attackers could exploit this vulnerability to call arbitrary methods within the `Screen` class, leading to potential brute force of database tables, validation checks against user credentials, and disclosure of the server’s real IP address. The issue has been patched in the latest release, version 14.43.0, released on November 6, 2024. Users should upgrade to version 14.43.0 or later to address this vulnerability. If upgrading to version 14.43.0 is not immediately possible, users can mitigate the vulnerability by implementing middleware to intercept and validate requests to asynchronous modal endpoints, allowing only approved methods and parameters.
- Product
- platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 8, 2024An attacker with local access the to medical office computer can escalate his Windows user privileges to "NT AUTHORITY\SYSTEM" by exploiting a race condition CVE-2024-50592 · Other software · HASOMED · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfHigh 7
An attacker with local access the to medical office computer can escalate his Windows user privileges to "NT AUTHORITY\SYSTEM" by exploiting a race condition in the Elefant Update Service during the repair or update process. When using the repair function, the service queries the server for a list of files and their hashes. In addition, instructions to execute binaries to finalize the repair process are included. The executables are executed as "NT AUTHORITY\SYSTEM" after they are copied over to the user writable installation folder (C:\Elefant1). This means that a user can overwrite either "PostESUUpdate.exe" or "Update_OpenJava.exe" in the time frame after the copy and before the execution of the final repair step. The overwritten executable is then executed as "NT AUTHORITY\SYSTEM".
- Product
- Elefant Software Updater
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhasomed.der.sec-consult.com
Nov 8, 2024An attacker with local access to the medical office computer can access restricted functions of the Elefant Service tool by using a hard-coded "Hotline" passwCVE-2024-50593 · Other software · HASOMED · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfHigh 7.8
An attacker with local access to the medical office computer can access restricted functions of the Elefant Service tool by using a hard-coded "Hotline" password in the Elefant service binary, which is shipped with the software.
- Product
- Elefant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhasomed.der.sec-consult.com
Nov 8, 2024An attacker with local access the to medical office computer can escalate his Windows user privileges to "NT AUTHORITY\SYSTEM" by exploiting a command injectiCVE-2024-50591 · Other software · HASOMED · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfHigh 7.8
An attacker with local access the to medical office computer can escalate his Windows user privileges to "NT AUTHORITY\SYSTEM" by exploiting a command injection vulnerability in the Elefant Update Service. The command injection can be exploited by communicating with the Elefant Update Service which is running as "SYSTEM" via Windows Named Pipes.The Elefant Software Updater (ESU) consists of two components. An ESU service which runs as "NT AUTHORITY\SYSTEM" and an ESU tray client which communicates with the service to update or repair the installation and is running with user permissions. The communication is implemented using named pipes. A crafted message of type "MessageType.SupportServiceInfos" can be sent to the local ESU service to inject commands, which are then executed as "NT AUTHORITY\SYSTEM".
- Product
- Elefant Software Updater
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhasomed.der.sec-consult.com
Nov 8, 2024Attackers with local access to the medical office computer can escalate their Windows user privileges to "NT AUTHORITY\SYSTEM" by overwriting one of two ElefaCVE-2024-50590 · Other software · HASOMED · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfHigh 7.8
Attackers with local access to the medical office computer can escalate their Windows user privileges to "NT AUTHORITY\SYSTEM" by overwriting one of two Elefant service binaries with weak permissions. The default installation directory of Elefant is "C:\Elefant1" which is writable for all users. In addition, the Elefant installer registers two Firebird database services which are running as “NT AUTHORITY\SYSTEM”. Path: C:\Elefant1\Firebird_2\bin\fbserver.exe Path: C:\Elefant1\Firebird_2\bin\fbguard.exe Both service binaries are user writable. This means that a local attacker can rename one of the service binaries, replace the service executable with a new executable, and then restart the system. Once the system has rebooted, the new service binary is executed as "NT AUTHORITY\SYSTEM".
- Product
- Elefant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhasomed.der.sec-consult.com
Nov 8, 2024An unauthenticated attacker with access to the local network of the medical office can query an unprotected Fast Healthcare Interoperability Resources (FHIR) CVE-2024-50589 · Other software · HASOMED · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfHigh 7.5
An unauthenticated attacker with access to the local network of the medical office can query an unprotected Fast Healthcare Interoperability Resources (FHIR) API to get access to sensitive electronic health records (EHR).
- Product
- Elefant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhasomed.der.sec-consult.com
Nov 8, 2024An unauthenticated attacker with access to the local network of the medical office can use known default credentials to gain remote DBA access to the Elefant CVE-2024-50588 · Other software · HASOMED · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfCritical 9.8
An unauthenticated attacker with access to the local network of the medical office can use known default credentials to gain remote DBA access to the Elefant Firebird database. The data in the database includes patient data and login credentials among other sensitive data. In addition, this enables an attacker to create and overwrite arbitrary files on the server filesystem with the rights of the Firebird database ("NT AUTHORITY\SYSTEM").
- Product
- Elefant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhasomed.der.sec-consult.com
Nov 1, 2024Woffice Core: Missing AuthorizationCVE-2024-37470 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in WofficeIO Woffice Core allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Woffice Core: from n/a through 5.4.8.
- Product
- Woffice Core
- Affected
- up to 5.4.8
- What to do
- Affects up to 5.4.8. Update Woffice Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 8, 2024Microsoft Office Remote Code Execution VulnerabilityCVE-2024-43616 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Office Remote Code Execution Vulnerability
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2024Microsoft Office Spoofing VulnerabilityCVE-2024-43609 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Microsoft Office Spoofing Vulnerability
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2024Microsoft Office Remote Code Execution VulnerabilityCVE-2024-43576 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Office Remote Code Execution Vulnerability
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2024Microsoft Office Visio Remote Code Execution VulnerabilityCVE-2024-43505 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Office Visio Remote Code Execution Vulnerability
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.