Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,383 results · page 25 of 68
Nov 4, 2024In gradio <=4.42.0, the gr.DownloadButton function has a hidden server-side request forgery (SSRF) vulnerability.CVE-2024-48052 · Other software · gradio_project · reported by MITREMedium 6.5
In gradio <=4.42.0, the gr.DownloadButton function has a hidden server-side request forgery (SSRF) vulnerability. The reason is that within the save_url_to_cache function, there are no restrictions on the URL, which allows access to local target resources. This can lead to the download of local resources and sensitive information.
- Product
- gradio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comrumbling-slice-eb0.notion.site
Nov 4, 2024Accordion title for Elementor: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-51685 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Michael Gangolf Accordion title for Elementor allows Stored XSS.This issue affects Accordion title for Elementor: from n/a through 1.2.1.
- Product
- Accordion title for Elementor
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update Accordion title for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Sysmac Studio provided by OMRON Corporation contains an incorrect authorization vulnerability.CVE-2024-49501 · Other software · OMRON Corporation · reported by vultures@jpcert.or.jpMedium 5.7
Sysmac Studio provided by OMRON Corporation contains an incorrect authorization vulnerability. If this vulnerability is exploited, an attacker may access the program which is protected by Data Protection function.
- Product
- SYSMAC-SE2[][][]
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2024Studio-42 eLfinder 2.1.62 contains a filename restriction bypass leading to a persistent Cross-site Scripting (XSS) vulnerability.CVE-2023-52045 · Other software · std42 · reported by MITREMedium 6.1
Studio-42 eLfinder 2.1.62 contains a filename restriction bypass leading to a persistent Cross-site Scripting (XSS) vulnerability.
- Product
- elfinder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2024Studio-42 eLfinder 2.1.62 is vulnerable to Remote Code Execution (RCE) as there is no restriction for uploading files with the .php8 extension.CVE-2023-52044 · Other software · std42 · reported by MITRECritical 9.8
Studio-42 eLfinder 2.1.62 is vulnerable to Remote Code Execution (RCE) as there is no restriction for uploading files with the .php8 extension.
- Product
- elfinder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2024Directory Traversal in /SASStudio/sasexec/sessions/{sessionID}/workspace/{InternalPath} in SAS Studio 9.4 allows remote attacker to access internal files by manCVE-2024-48735 · Other software · sas · reported by MITREHigh 7.7
Directory Traversal in /SASStudio/sasexec/sessions/{sessionID}/workspace/{InternalPath} in SAS Studio 9.4 allows remote attacker to access internal files by manipulating default path during file download. NOTE: this is disputed by the vendor because these filesystem paths are allowed for authorized users.
- Product
- studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2024Unrestricted file upload in /SASStudio/SASStudio/sasexec/{sessionID}/{InternalPath} in SAS Studio 9.4 allows remote attacker to upload malicious files.CVE-2024-48734 · Other software · sas · reported by MITREHigh 8.8
Unrestricted file upload in /SASStudio/SASStudio/sasexec/{sessionID}/{InternalPath} in SAS Studio 9.4 allows remote attacker to upload malicious files. NOTE: this is disputed by the vendor because file upload is allowed for authorized users.
- Product
- studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2024SQL injection vulnerability in /SASStudio/sasexec/sessions/{sessionID}/sql in SAS Studio 9.4 allows remote attacker to execute arbitrary SQL commands via the POCVE-2024-48733 · Other software · sas · reported by MITREHigh 8.8
SQL injection vulnerability in /SASStudio/sasexec/sessions/{sessionID}/sql in SAS Studio 9.4 allows remote attacker to execute arbitrary SQL commands via the POST body request. NOTE: this is disputed by the vendor because SQL statement execution is allowed for authorized users.
- Product
- studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsupport.sas.com
Oct 29, 2024Profile files from TRO600 series radios are extracted in plain-text and encrypted file formats.CVE-2024-41156 · Other software · Hitachi Energy · reported by cybersecurity@hitachienergy.comLow 2.7
Profile files from TRO600 series radios are extracted in plain-text and encrypted file formats. Profile files provide potential attackers valuable configuration information about the Tropos network. Profiles can only be exported by authenticated users with higher privilege of write access.
- Product
- TRO600
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpublisher.hitachienergy.com
Oct 29, 2024Command injection vulnerability in the Edge Computing UI for the TRO600 series radios that allows for the execution of arbitrary system commands.CVE-2024-41153 · Other software · Hitachi Energy · reported by cybersecurity@hitachienergy.comHigh 7.2
Command injection vulnerability in the Edge Computing UI for the TRO600 series radios that allows for the execution of arbitrary system commands. If exploited, an attacker with write access to the web UI can execute commands on the device with root privileges, far more extensive than what the write privilege intends.
- Product
- TRO600
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpublisher.hitachienergy.com
Oct 25, 2024Shoutcast Icecast HTML5 Radio Player: Stored Cross-Site ScriptingCVE-2024-8666 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Shoutcast Icecast HTML5 Radio Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'html5radio' shortcode in all versions up to, and including, 2.1.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Shoutcast Icecast HTML5 Radio Player
- Affected
- up to 2.1.7
- What to do
- Affects up to 2.1.7. Update Shoutcast Icecast HTML5 Radio Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 25, 2024Sharp and Toshiba Tec MFPs improperly validate input data in URI data registration, resulting in a stored cross-site scripting vulnerability.CVE-2024-48870 · Other software · Toshiba Tec Corporation · reported by vultures@jpcert.or.jpMedium 6.2
Sharp and Toshiba Tec MFPs improperly validate input data in URI data registration, resulting in a stored cross-site scripting vulnerability. If crafted input is stored by an administrative user, malicious script may be executed on the web browsers of other victim users.
- Product
- e-STUDIO 908
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 24, 2024Compact WP Audio Player: Stored Cross-Site ScriptingCVE-2024-10176 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Compact WP Audio Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sc_embed_player shortcode in all versions up to, and including, 1.9.13 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Compact WP Audio Player
- Affected
- up to 1.9.13
- What to do
- Affects up to 1.9.13. Update Compact WP Audio Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 21, 2024A vulnerability in the AWV (Audio, Web and Video Conferencing) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attackCVE-2024-47224 · Email & office · Mitel · reported by MITREMedium 6.5
A vulnerability in the AWV (Audio, Web and Video Conferencing) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct a CRLF injection attack due to inadequate encoding of user input in URLs. A successful exploit could allow an attacker to perform a phishing attack.
- Product
- Micollab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2024A vulnerability in the AWV (Audio, Web, and Video) Conferencing component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacCVE-2024-47912 · Email & office · mitel · reported by MITREHigh 8.2
A vulnerability in the AWV (Audio, Web, and Video) Conferencing component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to perform unauthorized data-access attacks due to missing authentication mechanisms. A successful exploit could allow an attacker to access and delete sensitive information.
- Product
- micollab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2024A vulnerability in the AWV (Audio, Web and Video Conferencing) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attackCVE-2024-47223 · Email & office · mitel · reported by MITRECritical 9.4
A vulnerability in the AWV (Audio, Web and Video Conferencing) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct a SQL injection attack due to insufficient sanitization of user input. A successful exploit could allow an attacker to access non-sensitive user provisioning information and execute arbitrary SQL database commands.
- Product
- micollab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2024The API Interface of the AWV (Audio, Web and Video Conferencing) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attaCVE-2024-47189 · Email & office · Mitel · reported by MITREHigh 7.7
The API Interface of the AWV (Audio, Web and Video Conferencing) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct SQL injection due to insufficient sanitization of user input. A successful exploit could allow an attacker with knowledge of specific details to access non-sensitive user provisioning information and execute arbitrary SQL database commands.
- Product
- Micollab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2024In the Linux kernel, the following vulnerability has been resolved: net: mdiobus: fix unbalanced node reference count I got the following report while doing dCVE-2022-49016 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: net: mdiobus: fix unbalanced node reference count I got the following report while doing device(mscc-miim) load test with CONFIG_OF_UNITTEST and CONFIG_OF_DYNAMIC enabled: OF: ERROR: memory leak, expected refcount 1 instead of 2, of_node_get()/of_node_put() unbalanced - destroy cset entry: attach overlay node /spi/soc@0/mdio@7107009c/ethernet-phy@0 If the 'fwnode' is not an acpi node, the refcount is get in fwnode_mdiobus_phy_device_register(), but it has never been put when the device is freed in the normal path. So call fwnode_handle_put() in phy_device_release() to avoid leak. If it's an acpi node, it has never been get, but it's put in the error path, so call fwnode_handle_get() before phy_device_register() to keep get/put operation balanced.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Oct 21, 2024In the Linux kernel, the following vulnerability has been resolved: net: mdio: fix unbalanced fwnode reference count in mdio_device_release() There is warningCVE-2022-48961 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: net: mdio: fix unbalanced fwnode reference count in mdio_device_release() There is warning report about of_node refcount leak while probing mdio device: OF: ERROR: memory leak, expected refcount 1 instead of 2, of_node_get()/of_node_put() unbalanced - destroy cset entry: attach overlay node /spi/soc@0/mdio@710700c0/ethernet@4 In of_mdiobus_register_device(), we increase fwnode refcount by fwnode_handle_get() before associating the of_node with mdio device, but it has never been decreased in normal path. Since that, in mdio_device_release(), it needs to call fwnode_handle_put() in addition instead of calling kfree() directly. After above, just calling mdio_device_free() in the error handle path of of_mdiobus_register_device() is enough to keep the refcount balanced.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Oct 21, 2024In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to wait dio completion It should wait all existing dio write IOs before block reCVE-2024-47726 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to wait dio completion It should wait all existing dio write IOs before block removal, otherwise, previous direct write IO may overwrite data in the block which may be reused by other inode.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Oct 20, 2024SermonAudio Widgets: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-49614 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SermonAudio SermonAudio Widgets sermonaudio-widgets allows SQL Injection.This issue affects SermonAudio Widgets: from n/a through <= 1.9.3.
- Product
- SermonAudio Widgets
- Affected
- up to 1.9.3
- What to do
- Affects up to 1.9.3. Update SermonAudio Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 17, 2024D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the key parameter in the SetWLanRadioSecurCVE-2024-48634 · Other software · dlink · reported by MITREHigh 8
D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the key parameter in the SetWLanRadioSecurity function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted POST request.
- Product
- dir-882_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2024D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the SSID parameter in the SetWLanRadioSettCVE-2024-48631 · Other software · dlink · reported by MITREHigh 8
D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the SSID parameter in the SetWLanRadioSettings function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted POST request.
- Product
- dir-882_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2024A vulnerability classified as critical has been found in mikexstudios Xcomic up to 0.8.2.CVE-2005-10003 · Other software · mikexstudios · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in mikexstudios Xcomic up to 0.8.2. This affects an unknown part. The manipulation of the argument cmd leads to os command injection. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 0.8.3 is able to address this issue. The patch is named 6ed8e3cc336e29f09c7e791863d0559939da98bf. It is recommended to upgrade the affected component.
- Product
- Xcomic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordxcomic.mikexstudios.comgithub.com
Oct 16, 2024Admidio is an open-source user management solution.CVE-2024-47836 · Other software · Admidio · reported by GitHubLow 3.5
Admidio is an open-source user management solution. Prior to version 4.3.12, an unsafe deserialization vulnerability allows any unauthenticated user to execute arbitrary code on the server. Version 4.3.12 fixes this issue.
- Product
- admidio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2024Accordion Slider: Stored Cross-Site ScriptingCVE-2024-9582 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Accordion Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘html’ attribute of an accordion slider in all versions up to, and including, 1.9.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: Successful exploitation by Contributor-level users requires an Administrator-level user to provide access to the plugin's admin area via the `Access` plugin setting, which is restricted to administrators by default.
- Product
- Accordion Slider
- Affected
- up to 1.9.11
- What to do
- Affects up to 1.9.11. Update Accordion Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 15, 2024IBM Watson Studio Local 1.2.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitteCVE-2024-49340 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM Watson Studio Local 1.2.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.
- Product
- Watson Studio Local
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2024A vulnerability in parisneo/lollms-webui version 9.8 allows for a Denial of Service (DOS) attack when uploading an audio file.CVE-2024-6959 · Other software · parisneo · reported by security@huntr.devHigh 7.1
A vulnerability in parisneo/lollms-webui version 9.8 allows for a Denial of Service (DOS) attack when uploading an audio file. If an attacker appends a large number of characters to the end of a multipart boundary, the system will continuously process each character, rendering lollms-webui inaccessible. This issue is exacerbated by the lack of Cross-Site Request Forgery (CSRF) protection, enabling remote exploitation. The vulnerability leads to service disruption, resource exhaustion, and extended downtime.
- Product
- parisneo/lollms-webui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2024A DLL hijack vulnerability was reported in Lenovo stARstudio that could allow a local attacker to execute code with elevated privileges.CVE-2024-9046 · Other software · Lenovo · reported by psirt@lenovo.comHigh 7.8
A DLL hijack vulnerability was reported in Lenovo stARstudio that could allow a local attacker to execute code with elevated privileges.
- Product
- stARstudio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2024CWE-269: Improper Privilege Management vulnerability exists that could cause unauthorized access, loss of confidentiality, integrity, and availability of the woCVE-2024-9002 · Other software · Schneider Electric · reported by cybersecurity@se.comHigh 7.8
CWE-269: Improper Privilege Management vulnerability exists that could cause unauthorized access, loss of confidentiality, integrity, and availability of the workstation when non-admin authenticated user tries to perform privilege escalation by tampering with the binaries
- Product
- Easergy Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.com
Oct 10, 2024Gradio is an open-source Python package designed for quick prototyping.CVE-2024-47872 · Other software · gradio-app · reported by GitHubMedium 6.9
Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves **Cross-Site Scripting (XSS)** on any Gradio server that allows file uploads. Authenticated users can upload files such as HTML, JavaScript, or SVG files containing malicious scripts. When other users download or view these files, the scripts will execute in their browser, allowing attackers to perform unauthorized actions or steal sensitive information from their sessions. This impacts any Gradio server that allows file uploads, particularly those using components that process or display user-uploaded files. Users are advised to upgrade to `gradio>=5` to address this issue. As a workaround, users can restrict the types of files that can be uploaded to the Gradio server by limiting uploads to non-executable file types such as images or text. Additionally, developers can implement server-side validation to sanitize uploaded files, ensuring that HTML, JavaScript, and SVG files are properly handled or rejected before being stored or displayed to users.
- Product
- gradio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2024Gradio is an open-source Python package designed for quick prototyping.CVE-2024-47871 · Other software · gradio-app · reported by GitHubHigh 8.2
Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves **insecure communication** between the FRP (Fast Reverse Proxy) client and server when Gradio's `share=True` option is used. HTTPS is not enforced on the connection, allowing attackers to intercept and read files uploaded to the Gradio server, as well as modify responses or data sent between the client and server. This impacts users who are sharing Gradio demos publicly over the internet using `share=True` without proper encryption, exposing sensitive data to potential eavesdroppers. Users are advised to upgrade to `gradio>=5` to address this issue. As a workaround, users can avoid using `share=True` in production environments and instead host their Gradio applications on servers with HTTPS enabled to ensure secure communication.
- Product
- gradio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2024Gradio is an open-source Python package designed for quick prototyping.CVE-2024-47870 · Other software · gradio-app · reported by GitHubHigh 7.1
Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves a **race condition** in the `update_root_in_config` function, allowing an attacker to modify the `root` URL used by the Gradio frontend to communicate with the backend. By exploiting this flaw, an attacker can redirect user traffic to a malicious server. This could lead to the interception of sensitive data such as authentication credentials or uploaded files. This impacts all users who connect to a Gradio server, especially those exposed to the internet, where malicious actors could exploit this race condition. Users are advised to upgrade to `gradio>=5` to address this issue. There are no known workarounds for this issue.
- Product
- gradio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2024Gradio is an open-source Python package designed for quick prototyping.CVE-2024-47869 · Other software · gradio-app · reported by GitHubLow 2.3
Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves a **timing attack** in the way Gradio compares hashes for the `analytics_dashboard` function. Since the comparison is not done in constant time, an attacker could exploit this by measuring the response time of different requests to infer the correct hash byte-by-byte. This can lead to unauthorized access to the analytics dashboard, especially if the attacker can repeatedly query the system with different keys. Users are advised to upgrade to `gradio>4.44` to mitigate this issue. To mitigate the risk before applying the patch, developers can manually patch the `analytics_dashboard` dashboard to use a **constant-time comparison** function for comparing sensitive values, such as hashes. Alternatively, access to the analytics dashboard can be disabled.
- Product
- gradio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2024Gradio is an open-source Python package designed for quick prototyping.CVE-2024-47868 · Other software · gradio-app · reported by GitHubMedium 6.3
Gradio is an open-source Python package designed for quick prototyping. This is a **data validation vulnerability** affecting several Gradio components, which allows arbitrary file leaks through the post-processing step. Attackers can exploit these components by crafting requests that bypass expected input constraints. This issue could lead to sensitive files being exposed to unauthorized users, especially when combined with other vulnerabilities, such as issue TOB-GRADIO-15. The components most at risk are those that return or handle file data. Vulnerable Components: 1. **String to FileData:** DownloadButton, Audio, ImageEditor, Video, Model3D, File, UploadButton. 2. **Complex data to FileData:** Chatbot, MultimodalTextbox. 3. **Direct file read in preprocess:** Code. 4. **Dictionary converted to FileData:** ParamViewer, Dataset. Exploit Scenarios: 1. A developer creates a Dropdown list that passes values to a DownloadButton. An attacker bypasses the allowed inputs, sends an arbitrary file path (like `/etc/passwd`), and downloads sensitive files. 2. An attacker crafts a malicious payload in a ParamViewer component, leaking sensitive files from a server through the arbitrary file l
- Product
- gradio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2024Gradio is an open-source Python package designed for quick prototyping.CVE-2024-47867 · Other software · gradio-app · reported by GitHubLow 2.1
Gradio is an open-source Python package designed for quick prototyping. This vulnerability is a **lack of integrity check** on the downloaded FRP client, which could potentially allow attackers to introduce malicious code. If an attacker gains access to the remote URL from which the FRP client is downloaded, they could modify the binary without detection, as the Gradio server does not verify the file's checksum or signature. Any users utilizing the Gradio server's sharing mechanism that downloads the FRP client could be affected by this vulnerability, especially those relying on the executable binary for secure data tunneling. There is no direct workaround for this issue without upgrading. However, users can manually validate the integrity of the downloaded FRP client by implementing checksum or signature verification in their own environment to ensure the binary hasn't been tampered with.
- Product
- gradio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2024Gradio is an open-source Python package designed for quick prototyping.CVE-2024-47168 · Other software · gradio-app · reported by GitHubLow 2.3
Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves data exposure due to the enable_monitoring flag not properly disabling monitoring when set to False. Even when monitoring is supposedly disabled, an attacker or unauthorized user can still access the monitoring dashboard by directly requesting the /monitoring endpoint. This means that sensitive application analytics may still be exposed, particularly in environments where monitoring is expected to be disabled. Users who set enable_monitoring=False to prevent unauthorized access to monitoring data are impacted. Users are advised to upgrade to gradio>=4.44 to address this issue. There are no known workarounds for this vulnerability.
- Product
- gradio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2024Gradio is an open-source Python package designed for quick prototyping.CVE-2024-47167 · Other software · gradio-app · reported by GitHubMedium 6.9
Gradio is an open-source Python package designed for quick prototyping. This vulnerability relates to **Server-Side Request Forgery (SSRF)** in the `/queue/join` endpoint. Gradio’s `async_save_url_to_cache` function allows attackers to force the Gradio server to send HTTP requests to user-controlled URLs. This could enable attackers to target internal servers or services within a local network and possibly exfiltrate data or cause unwanted internal requests. Additionally, the content from these URLs is stored locally, making it easier for attackers to upload potentially malicious files to the server. This impacts users deploying Gradio servers that use components like the Video component which involve URL fetching. Users are advised to upgrade to `gradio>=5` to address this issue. As a workaround, users can disable or heavily restrict URL-based inputs in their Gradio applications to trusted domains only. Additionally, implementing stricter URL validation (such as allowinglist-based validation) and ensuring that local or internal network addresses cannot be requested via the `/queue/join` endpoint can help mitigate the risk of SSRF attacks.
- Product
- gradio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2024Gradio is an open-source Python package designed for quick prototyping.CVE-2024-47166 · Other software · gradio-app · reported by GitHubLow 2.3
Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves a **one-level read path traversal** in the `/custom_component` endpoint. Attackers can exploit this flaw to access and leak source code from custom Gradio components by manipulating the file path in the request. Although the traversal is limited to a single directory level, it could expose proprietary or sensitive code that developers intended to keep private. This impacts users who have developed custom Gradio components and are hosting them on publicly accessible servers. Users are advised to upgrade to `gradio>=4.44` to address this issue. As a workaround, developers can sanitize the file paths and ensure that components are not stored in publicly accessible directories.
- Product
- gradio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2024Gradio is an open-source Python package designed for quick prototyping.CVE-2024-47165 · Other software · gradio-app · reported by GitHubMedium 6.9
Gradio is an open-source Python package designed for quick prototyping. This vulnerability relates to **CORS origin validation accepting a null origin**. When a Gradio server is deployed locally, the `localhost_aliases` variable includes "null" as a valid origin. This allows attackers to make unauthorized requests from sandboxed iframes or other sources with a null origin, potentially leading to data theft, such as user authentication tokens or uploaded files. This impacts users running Gradio locally, especially those using basic authentication. Users are advised to upgrade to `gradio>=5.0` to address this issue. As a workaround, users can manually modify the `localhost_aliases` list in their local Gradio deployment to exclude "null" as a valid origin. By removing this value, the Gradio server will no longer accept requests from sandboxed iframes or sources with a null origin, mitigating the potential for exploitation.
- Product
- gradio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2024Gradio is an open-source Python package designed for quick prototyping.CVE-2024-47164 · Other software · gradio-app · reported by GitHubLow 2.3
Gradio is an open-source Python package designed for quick prototyping. This vulnerability relates to the **bypass of directory traversal checks** within the `is_in_or_equal` function. This function, intended to check if a file resides within a given directory, can be bypassed with certain payloads that manipulate file paths using `..` (parent directory) sequences. Attackers could potentially access restricted files if they are able to exploit this flaw, although the difficulty is high. This primarily impacts users relying on Gradio’s blocklist or directory access validation, particularly when handling file uploads. Users are advised to upgrade to `gradio>=5.0` to address this issue. As a workaround, users can manually sanitize and normalize file paths in their Gradio deployment before passing them to the `is_in_or_equal` function. Ensuring that all file paths are properly resolved and absolute can help mitigate the bypass vulnerabilities caused by the improper handling of `..` sequences or malformed paths.
- Product
- gradio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2024Gradio is an open-source Python package designed for quick prototyping.CVE-2024-47084 · Other software · gradio-app · reported by GitHubMedium 6.9
Gradio is an open-source Python package designed for quick prototyping. This vulnerability is related to **CORS origin validation**, where the Gradio server fails to validate the request origin when a cookie is present. This allows an attacker’s website to make unauthorized requests to a local Gradio server. Potentially, attackers can upload files, steal authentication tokens, and access user data if the victim visits a malicious website while logged into Gradio. This impacts users who have deployed Gradio locally and use basic authentication. Users are advised to upgrade to `gradio>4.44` to address this issue. As a workaround, users can manually enforce stricter CORS origin validation by modifying the `CustomCORSMiddleware` class in their local Gradio server code. Specifically, they can bypass the condition that skips CORS validation for requests containing cookies to prevent potential exploitation.
- Product
- gradio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2024execute_filter_audio in archive_read_support_format_rar.c in libarchive before 3.7.5 allows out-of-bounds access via a crafted archive file because src can moveCVE-2024-48957 · Other software · libarchive · reported by MITREHigh 7.8
execute_filter_audio in archive_read_support_format_rar.c in libarchive before 3.7.5 allows out-of-bounds access via a crafted archive file because src can move beyond dst.
- Product
- libarchive
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2024ampache is a web based audio/video streaming application and file manager.CVE-2024-47828 · Other software · ampache · reported by GitHubMedium 5.3
ampache is a web based audio/video streaming application and file manager. A CSRF attack can be performed in order to delete objects (Playlist, smartlist etc.). Cross-Site Request Forgery (CSRF) is an attack that forces authenticated users to submit a request to a Web application against which they are currently authenticated. This vulnerability can be exploited by creating a malicious script with an arbitrary playlist ID belonging to another user. When the user submits the request, their playlist will be deleted. Any User with active sessions who are tricked into submitting a malicious request are impacted, as their playlists or other objects could be deleted without their consent.
- Product
- ampache
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2024Exposure of Sensitive Information to an Unauthorized Actor in Copilot Studio allows a unauthenticated attacker to view sensitive information through network attCVE-2024-43610 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.4
Exposure of Sensitive Information to an Unauthorized Actor in Copilot Studio allows a unauthenticated attacker to view sensitive information through network attack vector
- Product
- Microsoft Copilot Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2024Visual Studio Collector Service Denial of Service VulnerabilityCVE-2024-43603 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Visual Studio Collector Service Denial of Service Vulnerability
- Product
- Microsoft Visual Studio 2015 Update 3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2024Visual Studio Code for Linux Remote Code Execution VulnerabilityCVE-2024-43601 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Visual Studio Code for Linux Remote Code Execution Vulnerability
- Product
- Visual Studio Code for Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2024Visual C++ Redistributable Installer Elevation of Privilege VulnerabilityCVE-2024-43590 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Visual C++ Redistributable Installer Elevation of Privilege Vulnerability
- Product
- Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2024Missing authentication for critical function in Visual Studio Code extension for Arduino allows an unauthenticated attacker to perform remote code execution thrCVE-2024-43488 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Missing authentication for critical function in Visual Studio Code extension for Arduino allows an unauthenticated attacker to perform remote code execution through network attack vector.
- Product
- Visual Studio Code
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2024.NET and Visual Studio Denial of Service VulnerabilityCVE-2024-43485 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
.NET and Visual Studio Denial of Service Vulnerability
- Product
- .NET 6.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.