Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,461 results · page 27 of 50
May 6, 2024An unauthenticated local attacker may trick a user to open corrupted project files to execute arbitrary code or crash the system due to an out-of-bounds write vCVE-2023-49675 · Other software · CODESYS · reported by info@cert.vde.comHigh 7.8
An unauthenticated local attacker may trick a user to open corrupted project files to execute arbitrary code or crash the system due to an out-of-bounds write vulnerability.
- Product
- CODESYS Development System V2.3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcert.vde.com
Apr 29, 2024SQL Injection vulnerability in Prestaddons flashsales 1.9.7 and before allows an attacker to run arbitrary SQL commands via the FsModel::getFlashSales method.CVE-2024-33269 · Other software · communitydeveloper · reported by MITRECritical 9.8
SQL Injection vulnerability in Prestaddons flashsales 1.9.7 and before allows an attacker to run arbitrary SQL commands via the FsModel::getFlashSales method.
- Product
- prestaddons_flashsales
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.friendsofpresta.orgsecurity.friendsofpresta.org
Apr 28, 2024IBM i 7.2, 7.3, 7.4, 7.5 and IBM Rational Development Studio for i 7.2, 7.3, 7.4, 7.5 networking and compiler infrastructure could allow a local user to gain elCVE-2024-25050 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.4
IBM i 7.2, 7.3, 7.4, 7.5 and IBM Rational Development Studio for i 7.2, 7.3, 7.4, 7.5 networking and compiler infrastructure could allow a local user to gain elevated privileges due to an unqualified library call. A malicious actor could cause user-controlled code to run with administrator privileges. IBM X-Force ID: 283242.
- Product
- i
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Apr 26, 2024Mattermost versions 9.6.x <= 9.6.0, 9.5.x <= 9.5.2, 9.4.x <= 9.4.4 and 8.1.x <= 8.1.11 fail to remove detailed error messages in API requests even if the develoCVE-2024-32046 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 4.3
Mattermost versions 9.6.x <= 9.6.0, 9.5.x <= 9.5.2, 9.4.x <= 9.4.4 and 8.1.x <= 8.1.11 fail to remove detailed error messages in API requests even if the developer mode is off which allows an attacker to get information about the server such as the full path were files are stored
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Apr 24, 2024Insufficient argument checking in Secure state Entry functions in software using Cortex-M Security Extensions (CMSE), that has been compiled using toolchains thCVE-2024-0151 · Computers, phones & browsers · Arm · reported by arm-security@arm.comMedium 6.5
Insufficient argument checking in Secure state Entry functions in software using Cortex-M Security Extensions (CMSE), that has been compiled using toolchains that implement 'Arm v8-M Security Extensions Requirements on Development Tools' prior to version 1.4, allows an attacker to pass values to Secure state that are out of range for types smaller than 32-bits. Out of range values might lead to incorrect operations in secure state.
- Product
- Arm v8-M Security Extensions Requirements on Development Tools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.arm.comdeveloper.arm.com
Apr 16, 2024A bug in Micrium OS Network HTTP Server permits an invalid pointer dereference during header processing - potentially allowing a device crash and Denial of ServCVE-2023-51391 · Other software · silabs · reported by product-security@silabs.comHigh 7.5
A bug in Micrium OS Network HTTP Server permits an invalid pointer dereference during header processing - potentially allowing a device crash and Denial of Service.
- Product
- gecko_software_development_kit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.silabs.comtalosintelligence.com
Apr 4, 2024Vite (French word for "quick", pronounced /vit/, like "veet") is a frontend build tooling to improve the frontend development experience.`server.fs.deny` does nCVE-2024-31207 · Other software · vitejs · reported by GitHubMedium 5.9
Vite (French word for "quick", pronounced /vit/, like "veet") is a frontend build tooling to improve the frontend development experience.`server.fs.deny` does not deny requests for patterns with directories. This vulnerability has been patched in version(s) 5.2.6, 5.1.7, 5.0.13, 4.5.3, 3.2.10 and 2.9.18.
- Product
- vite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2024Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine developed by the OISF and the Suricata commCVE-2024-28870 · Other software · OISF · reported by GitHubHigh 7.5
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine developed by the OISF and the Suricata community. When parsing an overly long SSH banner, Suricata can use excessive CPU resources, as well as cause excessive logging volume in alert records. This issue has been patched in versions 6.0.17 and 7.0.4.
- Product
- suricata
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 29, 2024Tuleap is an Open Source Suite to improve management of software developments and collaboration.CVE-2024-30246 · Other software · Enalean · reported by GitHubHigh 7.6
Tuleap is an Open Source Suite to improve management of software developments and collaboration. A malicious user could exploit this issue on purpose to delete information on the instance or possibly gain access to restricted artifacts. It is however not possible to control exactly which information is deleted. Information from theDate, File, Float, Int, List, OpenList, Text, and Permissions on artifact (this one can lead to the disclosure of restricted information) fields can be impacted. This vulnerability is fixed in Tuleap Community Edition version 15.7.99.6 and Tuleap Enterprise Edition 15.7-2, 15.6-5, 15.5-6, 15.4-8, 15.3-6, 15.2-5, 15.1-9, 15.0-9, and 14.12-6.
- Product
- tuleap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2024Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients.CVE-2024-29025 · Other software · netty · reported by GitHubMedium 5.3
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The `HttpPostRequestDecoder` can be tricked to accumulate data. While the decoder can store items on the disk if configured so, there are no limits to the number of fields the form can have, an attacher can send a chunked post consisting of many small fields that will be accumulated in the `bodyListHttpData` list. The decoder cumulates bytes in the `undecodedChunk` buffer until it can decode a field, this field can cumulate data without limits. This vulnerability is fixed in 4.1.108.Final.
- Product
- netty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Mar 25, 2024ESP-IDF is the development framework for Espressif SoCs supported on Windows, Linux and macOS.CVE-2024-28183 · Other software · espressif · reported by GitHubMedium 6.1
ESP-IDF is the development framework for Espressif SoCs supported on Windows, Linux and macOS. A Time-of-Check to Time-of-Use (TOCTOU) vulnerability was discovered in the implementation of the ESP-IDF bootloader which could allow an attacker with physical access to flash of the device to bypass anti-rollback protection. Anti-rollback prevents rollback to application with security version lower than one programmed in eFuse of chip. This attack can allow to boot past (passive) application partition having lower security version of the same device even in the presence of the flash encryption scheme. The attack requires carefully modifying the flash contents after the anti-rollback checks have been performed by the bootloader (before loading the application). The vulnerability is fixed in 4.4.7 and 5.2.1.
- Product
- esp-idf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2024WiX toolset lets developers create installers for Windows Installer, the Windows installation engine.CVE-2024-29188 · Other software · wixtoolset · reported by GitHubHigh 7.9
WiX toolset lets developers create installers for Windows Installer, the Windows installation engine. The custom action behind WiX's `RemoveFolderEx` functionality could allow a standard user to delete protected directories. `RemoveFolderEx` deletes an entire directory tree during installation or uninstallation. It does so by recursing every subdirectory starting at a specified directory and adding each subdirectory to the list of directories Windows Installer should delete. If the setup author instructed `RemoveFolderEx` to delete a per-user folder from a per-machine installer, an attacker could create a directory junction in that per-user folder pointing to a per-machine, protected directory. Windows Installer, when executing the per-machine installer after approval by an administrator, would delete the target of the directory junction. This vulnerability is fixed in 3.14.1 and 4.0.5.
- Product
- issues
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2024WiX toolset lets developers create installers for Windows Installer, the Windows installation engine.CVE-2024-29187 · Other software · wixtoolset · reported by GitHubHigh 7.3
WiX toolset lets developers create installers for Windows Installer, the Windows installation engine. When a bundle runs as SYSTEM user, Burn uses GetTempPathW which points to an insecure directory C:\Windows\Temp to drop and load multiple binaries. Standard users can hijack the binary before it's loaded in the application resulting in elevation of privileges. This vulnerability is fixed in 3.14.1 and 4.0.5.
- Product
- issues
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2024Prior to versions 7.1.0, 6.1.2, and 5.3.4, the webpack-dev-middleware development middleware for devpack does not validate the supplied URL address sufficientlyCVE-2024-29180 · Other software · webpack · reported by GitHubHigh 7.4
Prior to versions 7.1.0, 6.1.2, and 5.3.4, the webpack-dev-middleware development middleware for devpack does not validate the supplied URL address sufficiently before returning the local file. It is possible to access any file on the developer's machine. The middleware can either work with the physical filesystem when reading the files or it can use a virtualized in-memory `memfs` filesystem. If `writeToDisk` configuration option is set to `true`, the physical filesystem is used. The `getFilenameFromUrl` method is used to parse URL and build the local file path. The public path prefix is stripped from the URL, and the `unsecaped` path suffix is appended to the `outputPath`. As the URL is not unescaped and normalized automatically before calling the midlleware, it is possible to use `%2e` and `%2f` sequences to perform path traversal attack. Developers using `webpack-dev-server` or `webpack-dev-middleware` are affected by the issue. When the project is started, an attacker might access any file on the developer's machine and exfiltrate the content. If the development server is listening on a public IP address (or `0.0.0.0`), an attacker on the local network can access the local fi
- Product
- webpack-dev-middleware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2024Coder allows oragnizations to provision remote development environments via Terraform.CVE-2024-27918 · Other software · coder · reported by GitHubHigh 8.2
Coder allows oragnizations to provision remote development environments via Terraform. Prior to versions 2.6.1, 2.7.3, and 2.8.4, a vulnerability in Coder's OIDC authentication could allow an attacker to bypass the `CODER_OIDC_EMAIL_DOMAIN` verification and create an account with an email not in the allowlist. Deployments are only affected if the OIDC provider allows users to create accounts on the provider. During OIDC registration, the user's email was improperly validated against the allowed `CODER_OIDC_EMAIL_DOMAIN`s. This could allow a user with a domain that only partially matched an allowed domain to successfully login or register. An attacker could register a domain name that exploited this vulnerability and register on a Coder instance with a public OIDC provider. Coder instances with OIDC enabled and protected by the `CODER_OIDC_EMAIL_DOMAIN` configuration are affected. Coder instances using a private OIDC provider are not affected, as arbitrary users cannot register through a private OIDC provider without first having an account on the provider. Public OIDC providers are impacted. GitHub authentication and external authentication are not impacted. This vulnerability is
- Product
- coder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2024OpenZeppelin Contracts is a library for secure smart contract development.CVE-2024-27094 · Other software · OpenZeppelin · reported by GitHubMedium 6.5
OpenZeppelin Contracts is a library for secure smart contract development. The `Base64.encode` function encodes a `bytes` input by iterating over it in chunks of 3 bytes. When this input is not a multiple of 3, the last iteration may read parts of the memory that are beyond the input buffer. The vulnerability is fixed in 5.0.2 and 4.9.6.
- Product
- openzeppelin-contracts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2024A vulnerability, which was classified as problematic, has been found in Surya2Developer Hostel Management Service 1.0.CVE-2024-2483 · Other software · Surya2Developer · reported by VulDBMedium 4.3
A vulnerability, which was classified as problematic, has been found in Surya2Developer Hostel Management Service 1.0. This issue affects some unknown processing of the file /change-password.php of the component Password Change Handler. The manipulation of the argument oldpassword leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-256889 was assigned to this vulnerability.
- Product
- Hostel Management Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2024A vulnerability has been found in Surya2Developer Hostel Management Service 1.0 and classified as problematic.CVE-2024-2482 · Other software · Surya2Developer · reported by VulDBLow 3.7
A vulnerability has been found in Surya2Developer Hostel Management Service 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /check_availability.php of the component HTTP POST Request Handler. The manipulation of the argument oldpassword leads to observable response discrepancy. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-256891.
- Product
- Hostel Management Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2024A vulnerability, which was classified as critical, was found in Surya2Developer Hostel Management System 1.0.CVE-2024-2481 · Other software · Surya2Developer · reported by VulDBMedium 6.5
A vulnerability, which was classified as critical, was found in Surya2Developer Hostel Management System 1.0. Affected is an unknown function of the file /admin/manage-students.php. The manipulation of the argument del leads to improper access controls. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-256890 is the identifier assigned to this vulnerability.
- Product
- Hostel Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 8, 2024WeasyPrint helps web developers to create PDF documents.CVE-2024-28184 · Other software · Kozea · reported by GitHubHigh 7.4
WeasyPrint helps web developers to create PDF documents. Since version 61.0, there's a vulnerability which allows attaching content of arbitrary files and URLs to a generated PDF document, even if `url_fetcher` is configured to prevent access to files and URLs. This vulnerability has been patched in version 61.2.
- Product
- WeasyPrint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2024Hoppscotch is an API development ecosystem.CVE-2024-27092 · Other software · hoppscotch · reported by GitHubMedium 5.4
Hoppscotch is an API development ecosystem. Due to lack of validation for fields like Label (Edit Team) - TeamName, bad actors can send emails with Spoofed Content as Hoppscotch. Part of payload (external link) is presented in clickable form - easier to achieve own goals by malicious actors. This issue is fixed in 2023.12.6.
- Product
- hoppscotch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2024Flask-AppBuilder is an application development framework, built on top of Flask.CVE-2024-27083 · Other software · dpgaspar · reported by GitHubMedium 4.3
Flask-AppBuilder is an application development framework, built on top of Flask. A Cross-Site Scripting (XSS) vulnerability has been discovered on the OAuth login page. An attacker could trick a user to follow a specially crafted URL to the OAuth login page. This URL could inject and execute malicious javascript code that would get executed on the user's browser. This issue was introduced on 4.1.4 and patched on 4.2.1.
- Product
- Flask-AppBuilder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2024Flask-AppBuilder is an application development framework, built on top of Flask.CVE-2024-25128 · Other software · dpgaspar · reported by GitHubCritical 9.1
Flask-AppBuilder is an application development framework, built on top of Flask. When Flask-AppBuilder is set to AUTH_TYPE AUTH_OID, it allows an attacker to forge an HTTP request, that could deceive the backend into using any requested OpenID service. This vulnerability could grant an attacker unauthorised privilege access if a custom OpenID service is deployed by the attacker and accessible by the backend. This vulnerability is only exploitable when the application is using the OpenID 2.0 authorization protocol. Upgrade to Flask-AppBuilder 4.3.11 to fix the vulnerability.
- Product
- Flask-AppBuilder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2024A vulnerability has been found in Surya2Developer Online Shopping System 1.0 and classified as critical.CVE-2024-1971 · Other software · Surya2Developer · reported by VulDBHigh 7.3
A vulnerability has been found in Surya2Developer Online Shopping System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file login.php of the component POST Parameter Handler. The manipulation of the argument password with the input nochizplz'+or+1%3d1+limit+1%23 leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-255127.
- Product
- Online Shopping System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2024In the module "Import/Update Bulk Product from any Csv/Excel File Pro" (ba_importer) up to version 1.1.28 from Buy Addons for PrestaShop, a guest can perform SQCVE-2024-25843 · Other software · communitydeveloper · reported by MITRECritical 9.8
In the module "Import/Update Bulk Product from any Csv/Excel File Pro" (ba_importer) up to version 1.1.28 from Buy Addons for PrestaShop, a guest can perform SQL injection in affected versions.
- Product
- import\/update_bulk_product_from_any_csv\/excel_file_pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaddons.prestashop.comsecurity.friendsofpresta.org
Feb 23, 2024`@backstage/backend-common` is a common functionality library for backends for Backstage, an open platform for building developer portals.CVE-2024-26150 · Other software · backstage · reported by GitHubHigh 8.7
`@backstage/backend-common` is a common functionality library for backends for Backstage, an open platform for building developer portals. In `@backstage/backend-common` prior to versions 0.21.1, 0.20.2, and 0.19.10, paths checks with the `resolveSafeChildPath` utility were not exhaustive enough, leading to risk of path traversal vulnerabilities if symlinks can be injected by attackers. This issue is patched in `@backstage/backend-common` versions 0.21.1, 0.20.2, and 0.19.10.
- Product
- backstage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 22, 2024baserCMS is a website development framework.CVE-2024-26128 · Other software · baserproject · reported by GitHubMedium 5.4
baserCMS is a website development framework. Prior to version 5.0.9, there is a cross-site scripting vulnerability in the content management feature. Version 5.0.9 contains a fix for this vulnerability.
- Product
- basercms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbasercms.netgithub.com
Feb 22, 2024Tuleap is an open source suite to improve management of software developments and collaboration.CVE-2024-25130 · Other software · Enalean · reported by GitHubMedium 5.4
Tuleap is an open source suite to improve management of software developments and collaboration. Prior to version 15.5.99.76 of Tuleap Community Edition and prior to versions 15.5-4 and 15.4-7 of Tuleap Enterprise Edition, users with a read access to a tracker where the mass update feature is used might get access to restricted information. Tuleap Community Edition 15.5.99.76, Tuleap Enterprise Edition 15.5-4, and Tuleap Enterprise Edition 15.4-7 contain a patch for this issue.
- Product
- tuleap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 22, 2024baserCMS is a website development framework.CVE-2023-51450 · Other software · baserproject · reported by GitHubMedium 5.6
baserCMS is a website development framework. Prior to version 5.0.9, there is an OS Command Injection vulnerability in the site search feature of baserCMS. Version 5.0.9 contains a fix for this vulnerability.
- Product
- basercms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbasercms.netgithub.com
Feb 22, 2024baserCMS is a website development framework.CVE-2023-44379 · Other software · baserproject · reported by GitHubMedium 6.1
baserCMS is a website development framework. Prior to version 5.0.9, there is a cross-site scripting vulnerability in the site search feature. Version 5.0.9 contains a fix for this vulnerability.
- Product
- basercms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbasercms.netgithub.com
Feb 21, 2024cryptography is a package designed to expose cryptographic primitives and recipes to Python developers.CVE-2024-26130 · Other software · pyca · reported by GitHubHigh 7.5
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Starting in version 38.0.0 and prior to version 42.0.4, if `pkcs12.serialize_key_and_certificates` is called with both a certificate whose public key did not match the provided private key and an `encryption_algorithm` with `hmac_hash` set (via `PrivateFormat.PKCS12.encryption_builder().hmac_hash(...)`, then a NULL pointer dereference would occur, crashing the Python process. This has been resolved in version 42.0.4, the first version in which a `ValueError` is properly raised.
- Product
- cryptography
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2024Yocto Project is an open source collaboration project that helps developers create custom Linux-based systems regardless of the hardware architecture.CVE-2024-25626 · Other software · yoctoproject · reported by GitHubHigh 8.8
Yocto Project is an open source collaboration project that helps developers create custom Linux-based systems regardless of the hardware architecture. In Yocto Projects Bitbake before 2.6.2 (before and included Yocto Project 4.3.1), with the Toaster server (included in bitbake) running, missing input validation allows an attacker to perform a remote code execution in the server's shell via a crafted HTTP request. Authentication is not necessary. Toaster server execution has to be specifically run and is not the default for Bitbake command line builds, it is only used for the Toaster web based user interface to Bitbake. The fix has been backported to the bitbake included with Yocto Project 5.0, 3.1.31, 4.0.16, and 4.3.2.
- Product
- poky
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2024Uncontrolled search path in some Intel(R) SDK for OpenCL(TM) Applications software may allow an authenticated user to potentially enable escalation of privilegeCVE-2023-36493 · Other software · intel · reported by secure@intel.comMedium 6.7
Uncontrolled search path in some Intel(R) SDK for OpenCL(TM) Applications software may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- field_programmable_gate_array_software_development_kit_for_opencl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2024A flaw was found in the decompression function of registry-support.CVE-2024-1485 · Other software · Red Hat · reported by Red HatHigh 8
A flaw was found in the decompression function of registry-support. This issue can be triggered if an unauthenticated remote attacker tricks a user into parsing a devfile which uses the `parent` or `plugin` keywords. This could download a malicious archive and cause the cleanup process to overwrite or delete files outside of the archive, which should not be allowed.
- Product
- OpenShift Developer Tools and Services
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Feb 6, 2024WiX toolset lets developers create installers for Windows Installer, the Windows installation engine.CVE-2024-24810 · Other software · wixtoolset · reported by GitHubHigh 8.2
WiX toolset lets developers create installers for Windows Installer, the Windows installation engine. The .be TEMP folder is vulnerable to DLL redirection attacks that allow the attacker to escalate privileges. This impacts any installer built with the WiX installer framework. This issue has been patched in version 4.0.4.
- Product
- issues
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2024Tuleap is an Open Source Suite to improve management of software developments and collaboration.CVE-2024-23344 · Other software · Enalean · reported by GitHubMedium 5.3
Tuleap is an Open Source Suite to improve management of software developments and collaboration. Some users might get access to restricted information when a process validates the permissions of multiple users (e.g. mail notifications). This issue has been patched in version 15.4.99.140 of Tuleap Community Edition.
- Product
- tuleap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 31, 2024Heap-based buffer overflow vulnerability in Resource Hacker, developed by Angus Johnson, affecting version 3.6.0.92.CVE-2024-1112 · Other software · Angus Johnson · reported by cve-coordination@incibe.esHigh 7.3
Heap-based buffer overflow vulnerability in Resource Hacker, developed by Angus Johnson, affecting version 3.6.0.92. This vulnerability could allow an attacker to execute arbitrary code via a long filename argument.
- Product
- Resource Hacker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 24, 2024SvelteKit is a web development kit.CVE-2024-23641 · Other software · sveltejs · reported by GitHubHigh 7.5
SvelteKit is a web development kit. In SvelteKit 2, sending a GET request with a body eg `{}` to a built and previewed/hosted sveltekit app throws `Request with GET/HEAD method cannot have body.` and crashes the preview/hosting. After this happens, one must manually restart the app. `TRACE` requests will also cause the app to crash. Prerendered pages and SvelteKit 1 apps are not affected. `@sveltejs/adapter-node` versions 2.1.2, 3.0.3, and 4.0.1 and `@sveltejs/kit` version 2.4.3 contain a patch for this issue.
- Product
- kit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2024Electronic Delivery Check System (Ministry of Agriculture, Forestry and Fisheries The Agriculture and Rural Development Project Version) March, Heisei 31 era edCVE-2024-22380 · Other software · Ministry of Agriculture, Forestry and Fisheries · reported by vultures@jpcert.or.jpMedium 5.5
Electronic Delivery Check System (Ministry of Agriculture, Forestry and Fisheries The Agriculture and Rural Development Project Version) March, Heisei 31 era edition Ver.14.0.001.002 and earlier improperly restricts XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files on the system may be read by an attacker.
- Product
- Electronic Delivery Check System (Ministry of Agriculture, Forestry and Fisheries The Agriculture and Rural Development Project Version) March, Heisei 31 era ed
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2024Clerk helps developers build user management.CVE-2024-22206 · Other software · clerk · reported by GitHubCritical 9
Clerk helps developers build user management. Unauthorized access or privilege escalation due to a logic flaw in auth() in the App Router or getAuth() in the Pages Router. This vulnerability was patched in version 4.29.3.
- Product
- javascript
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2024A missing authorization check vulnerability exists in GitLab Remote Development affecting all versions prior to 16.5.6, 16.6 prior to 16.6.4 and 16.7 prior to 1CVE-2023-6955 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 6.6
A missing authorization check vulnerability exists in GitLab Remote Development affecting all versions prior to 16.5.6, 16.6 prior to 16.6.4 and 16.7 prior to 16.7.2. This condition allows an attacker to create a workspace in one group that is associated with an agent from another group.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2024GitPython is a python library used to interact with Git repositories.CVE-2024-22190 · Other software · gitpython-developers · reported by GitHubHigh 7.8
GitPython is a python library used to interact with Git repositories. There is an incomplete fix for CVE-2023-40590. On Windows, GitPython uses an untrusted search path if it uses a shell to run `git`, as well as when it runs `bash.exe` to interpret hooks. If either of those features are used on Windows, a malicious `git.exe` or `bash.exe` may be run from an untrusted repository. This issue has been patched in version 3.1.41.
- Product
- GitPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2024Azure IPAM (IP Address Management) is a lightweight solution developed on top of the Azure platform designed to help Azure customers manage their IP Address spaCVE-2024-21638 · Other software · Azure · reported by GitHubCritical 9.1
Azure IPAM (IP Address Management) is a lightweight solution developed on top of the Azure platform designed to help Azure customers manage their IP Address space easily and effectively. By design there is no write access to customers' Azure environments as the Service Principal used is only assigned the Reader role at the root Management Group level. Until recently, the solution lacked the validation of the passed in authentication token which may result in attacker impersonating any privileged user to access data stored within the IPAM instance and subsequently from Azure, causing an elevation of privilege. This vulnerability has been patched in version 3.0.0.
- Product
- ipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2024IdentityModel Extensions for .NET provide assemblies for web developers that wish to use federated identity providers for establishing the caller's identity.CVE-2024-21643 · Other software · AzureAD · reported by GitHubHigh 7.1
IdentityModel Extensions for .NET provide assemblies for web developers that wish to use federated identity providers for establishing the caller's identity. Anyone leveraging the `SignedHttpRequest`protocol or the `SignedHttpRequestValidator`is vulnerable. Microsoft.IdentityModel trusts the `jku`claim by default for the `SignedHttpRequest`protocol. This raises the possibility to make any remote or local `HTTP GET` request. The vulnerability has been fixed in Microsoft.IdentityModel.Protocols.SignedHttpRequest. Users should update all their Microsoft.IdentityModel versions to 7.1.2 (for 7x) or higher, 6.34.0 (for 6x) or higher.
- Product
- azure-activedirectory-identitymodel-extensions-for-dotnet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 4, 2024A flaw was found in the Red Hat Developer Hub (RHDH).CVE-2023-6944 · Other software · Red Hat · reported by Red HatMedium 5.7
A flaw was found in the Red Hat Developer Hub (RHDH). The catalog-import function leaks GitLab access tokens on the frontend when the base64 encoded GitLab token includes a newline at the end of the string. The sanitized error can display on the frontend, including the raw access token. Upon gaining access to this token and depending on permissions, an attacker could push malicious code to repositories, delete resources in Git, revoke or generate new keys, and sign code illegitimately.
- Product
- RHDH-1.1-RHEL-9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Jan 3, 2024Laf is a cloud development platform.CVE-2023-50253 · Other software · labring · reported by GitHubCritical 9.6
Laf is a cloud development platform. In the Laf version design, the log uses communication with k8s to quickly retrieve logs from the container without the need for additional storage. However, in version 1.0.0-beta.13 and prior, this interface does not verify the permissions of the pod, which allows authenticated users to obtain any pod logs under the same namespace through this method, thereby obtaining sensitive information printed in the logs. As of time of publication, no known patched versions exist.
- Product
- laf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2023Deepin-Compressor is the default archive manager of Deepin Linux OS.CVE-2023-50255 · Computers, phones & browsers · linuxdeepin · reported by GitHubCritical 9.3
Deepin-Compressor is the default archive manager of Deepin Linux OS. Prior to 5.12.21, there's a path traversal vulnerability in deepin-compressor that can be exploited to achieve Remote Command Execution on the target system upon opening crafted archives. Users are advised to update to version 5.12.21 which addresses the issue. There are no known workarounds for this vulnerability.
- Product
- developer-center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2023AWS SDK for PHP is the Amazon Web Services software development kit for PHP.CVE-2023-51651 · Other software · aws · reported by GitHubMedium 6
AWS SDK for PHP is the Amazon Web Services software development kit for PHP. Within the scope of requests to S3 object keys and/or prefixes containing a Unix double-dot, a URI path traversal is possible. The issue exists in the `buildEndpoint` method in the RestSerializer component of the AWS SDK for PHP v3 prior to 3.288.1. The `buildEndpoint` method relies on the Guzzle Psr7 UriResolver utility, which strips dot segments from the request path in accordance with RFC 3986. Under certain conditions, this could lead to an arbitrary object being accessed. This issue has been patched in version 3.288.1.
- Product
- aws-sdk-php
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2023The Snowflake .NET driver provides an interface to the Microsoft .NET open source software framework for developing applications.CVE-2023-51662 · Other software · snowflakedb · reported by GitHubMedium 6
The Snowflake .NET driver provides an interface to the Microsoft .NET open source software framework for developing applications. Snowflake recently received a report about a vulnerability in the Snowflake Connector .NET where the checks against the Certificate Revocation List (CRL) were not performed where the insecureMode flag was set to false, which is the default setting. The vulnerability affects versions between 2.0.25 and 2.1.4 (inclusive). Snowflake fixed the issue in version 2.1.5.
- Product
- snowflake-connector-net
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.snowflake.comgithub.com
Dec 22, 2023Deepin Linux's default document reader `deepin-reader` software suffers from a serious vulnerability in versions prior to 6.0.7 due to a design flaw that leads CVE-2023-50254 · Computers, phones & browsers · linuxdeepin · reported by GitHubCritical 9.3
Deepin Linux's default document reader `deepin-reader` software suffers from a serious vulnerability in versions prior to 6.0.7 due to a design flaw that leads to remote command execution via crafted docx document. This is a file overwrite vulnerability. Remote code execution (RCE) can be achieved by overwriting files like .bash_rc, .bash_login, etc. RCE will be triggered when the user opens the terminal. Version 6.0.7 contains a patch for the issue.
- Product
- developer-center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.