Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,780 results · page 28 of 76
Dec 10, 2024Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attackerCVE-2024-52844 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attacker to execute arbitrary code in the context of the victim's browser session. By manipulating a DOM element through a crafted URL or user input, the attacker can inject malicious scripts that run when the page is rendered. This type of attack requires user interaction, as the victim would need to visit a malicious link or input data into a compromised form.
- Product
- Adobe Experience Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attackerCVE-2024-52840 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attacker to execute arbitrary code in the context of the victim's browser session. By manipulating a DOM element through a crafted URL or user input, the attacker can inject malicious scripts that run when the page is rendered. This type of attack requires user interaction, as the victim would need to access the manipulated URL or input the malicious data themselves.
- Product
- Adobe Experience Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attackerCVE-2024-52839 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attacker to execute arbitrary code in the context of the victim's browser session. By manipulating a DOM element through a crafted URL or user input, the attacker can inject malicious scripts that run when the page is rendered. This type of attack requires user interaction, as the victim would need to visit a malicious link or input data into a compromised form.
- Product
- Adobe Experience Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attackerCVE-2024-52838 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attacker to execute arbitrary code in the context of the victim's browser session. By manipulating a DOM element through a crafted URL or user input, the attacker can inject malicious scripts that run when the page is rendered. This type of attack requires user interaction, as the victim would need to visit a malicious link or input data into a compromised form.
- Product
- Adobe Experience Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attackerCVE-2024-52837 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attacker to execute arbitrary code in the context of the victim's browser session. By manipulating a DOM element through a crafted URL or user input, the attacker can inject malicious scripts that run when the page is rendered. This type of attack requires user interaction, as the victim would need to access the manipulated URL or input for the exploit to execute.
- Product
- Adobe Experience Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attackerCVE-2024-52823 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attacker to execute arbitrary code in the context of the victim's browser session. By manipulating a DOM element through a crafted URL or user input, the attacker can inject malicious scripts that run when the page is rendered. This type of attack requires user interaction, as the victim would need to visit a malicious link or input data into a compromised form.
- Product
- Adobe Experience Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attackerCVE-2024-52822 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attacker to execute arbitrary code in the context of the victim's browser session. By manipulating a DOM element through a crafted URL or user input, the attacker can inject malicious scripts that run when the page is rendered. This type of attack requires user interaction, as the victim would need to access a manipulated URL or page with the malicious script.
- Product
- Adobe Experience Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could allow an attacker to executCVE-2024-43754 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could allow an attacker to execute arbitrary code in the context of the victim's browser. This issue occurs when data from a malicious source is processed by a web application's client-side scripts to update the DOM. Exploitation of this issue requires user interaction, such as convincing a victim to click on a malicious link.
- Product
- Adobe Experience Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could allow an attacker to executCVE-2024-43738 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could allow an attacker to execute arbitrary code in the context of the victim's browser. This issue occurs when data from a malicious source is processed by a web application and subsequently written to the web page without proper sanitization, allowing for the execution of unintended script code or the alteration of the intended user interface. User interaction is required as the victim must visit a malicious page or view a maliciously crafted link.
- Product
- Adobe Experience Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attackerCVE-2024-43733 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attacker to execute arbitrary code in the context of the victim's browser session. By manipulating a DOM element through a crafted URL or user input, the attacker can inject malicious scripts that run when the page is rendered. This type of attack requires user interaction, as the victim would need to visit a malicious link or input data into a compromised form.
- Product
- Adobe Experience Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could allow an attacker to executCVE-2024-43732 · Other software · Adobe · reported by AdobeMedium 4.6
Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could allow an attacker to execute arbitrary code in the context of the victim's browser. This issue occurs when data from a malicious source is processed by a web application's client-side scripts to update the DOM. Exploitation of this issue requires user interaction, such as convincing a victim to click on a malicious link.
- Product
- Adobe Experience Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attackerCVE-2024-43724 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attacker to execute arbitrary code in the context of the victim's browser session. By manipulating a DOM element through a crafted URL or user input, the attacker can inject malicious scripts that run when the page is rendered. Exploitation of this issue requires user interaction.
- Product
- Adobe Experience Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attackerCVE-2024-43723 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attacker to execute arbitrary code in the context of the victim's browser session. By manipulating a DOM element through a crafted URL or user input, the attacker can inject malicious scripts that run when the page is rendered. This type of attack requires user interaction, as the victim would need to visit a malicious link or page.
- Product
- Adobe Experience Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attackerCVE-2024-43722 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attacker to execute arbitrary code in the context of the victim's browser session. By manipulating a DOM element through a crafted URL or user input, the attacker can inject malicious scripts that run when the page is rendered. This type of attack requires user interaction, as the victim would need to access the manipulated URL or input.
- Product
- Adobe Experience Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attackerCVE-2024-43721 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attacker to execute arbitrary code in the context of the victim's browser session. By manipulating a DOM element through a crafted URL or user input, the attacker can inject malicious scripts that run when the page is rendered. This type of attack requires user interaction, as the victim would need to access a manipulated link or input data into a vulnerable page.
- Product
- Adobe Experience Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited to execute arbCVE-2024-43720 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited to execute arbitrary code in the context of the victim's browser session. By manipulating the DOM environment in the victim's browser, an attacker can inject malicious scripts that are executed by the victim's browser. Exploitation of this issue requires user interaction, typically in the form of following a malicious link.
- Product
- Adobe Experience Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attackerCVE-2024-43719 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attacker to execute arbitrary code in the context of the victim's browser session. By manipulating a DOM element through a crafted URL or user input, the attacker can inject malicious scripts that run when the page is rendered. This type of attack requires user interaction, as the victim would need to access the manipulated URL or input.
- Product
- Adobe Experience Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attackerCVE-2024-43715 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attacker to execute arbitrary code in the context of the victim's browser session. By manipulating a DOM element through a crafted URL or user input, the attacker can inject malicious scripts that run when the page is rendered. This type of attack requires user interaction, as the victim would need to visit a malicious link or input data into a compromised form.
- Product
- Adobe Experience Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attackerCVE-2024-43714 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attacker to execute arbitrary code in the context of the victim's browser session. By manipulating a DOM element through a crafted URL or user input, the attacker can inject malicious scripts that run when the page is rendered. This type of attack requires user interaction, as the victim would need to visit a malicious link or input data into a vulnerable page.
- Product
- Adobe Experience Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attackerCVE-2024-43713 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attacker to execute arbitrary code in the context of the victim's browser session. By manipulating a DOM element through a crafted URL or user input, the attacker can inject malicious scripts that run when the page is rendered. This type of attack requires user interaction, as the victim would need to access a manipulated URL or page with the malicious script.
- Product
- Adobe Experience Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could allow an attacker to executCVE-2024-43712 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could allow an attacker to execute arbitrary code in the context of the victim's browser. This issue occurs when data from a user-controllable source is improperly sanitized before being used in the Document Object Model (DOM) of a web page, leading to the execution of malicious scripts. Exploitation of this issue requires user interaction, such as tricking a victim into clicking a link or navigating to a malicious website.
- Product
- Adobe Experience Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attacker to eCVE-2024-54037 · Other software · Adobe · reported by AdobeHigh 8.1
Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attacker to execute arbitrary code in the context of the victim's browser session. By manipulating a DOM element through a crafted URL or user input, the high-privileged attacker can inject malicious scripts that run when the page is rendered. This type of attack requires user interaction, as the victim would need to visit a malicious link or input data into a compromised form. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as high.
- Product
- Adobe Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 6, 2024The HTTP host header can be manipulated and cause the application to behave in unexpected ways.CVE-2024-30129 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.3
The HTTP host header can be manipulated and cause the application to behave in unexpected ways. Any changes made to the header would cause the request to be sent to a completely different domain/IP address.
- Product
- Nomad server on Domino
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Dec 5, 2024Use of cryptographically weak pseudo-random number generator (PRNG) vulnerability in the SonicWall SMA100 SSLVPN backup code generator that, in certain cases, cCVE-2024-53702 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comMedium 5.3
Use of cryptographically weak pseudo-random number generator (PRNG) vulnerability in the SonicWall SMA100 SSLVPN backup code generator that, in certain cases, can be predicted by an attacker, potentially exposing the generated secret.
- Product
- SMA100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.global.sonicwall.com
Dec 4, 2024In the Linux kernel, the following vulnerability has been resolved: pmdomain: imx93-blk-ctrl: correct remove path The check condition should be 'i < bc->oneceCVE-2024-53134 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: pmdomain: imx93-blk-ctrl: correct remove path The check condition should be 'i < bc->onecell_data.num_domains', not 'bc->onecell_data.num_domains' which will make the look never finish and cause kernel panic. Also disable runtime to address "imx93-blk-ctrl 4ac10000.system-controller: Unbalanced pm_runtime_enable!"
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Dec 4, 2024Listdom – Business Directory and Classified Ads Listings: Stored Cross-Site ScriptingCVE-2024-11854 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Listdom – Business Directory and Classified Ads Listings WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘shortcode’ parameter in all versions up to, and including, 3.7.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Listdom – Business Directory and Classified Ads Listings
- Affected
- up to 3.7.0
- What to do
- Affects up to 3.7.0. Update Listdom – Business Directory and Classified Ads Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 3, 2024An issue in InfoDom Performa 365 v4.0.1 allows authenticated attackers to elevate their privileges to Administrator via a crafted payload sent to /api/users.CVE-2024-46624 · Other software · infodom · reported by MITREHigh 8.8
An issue in InfoDom Performa 365 v4.0.1 allows authenticated attackers to elevate their privileges to Administrator via a crafted payload sent to /api/users.
- Product
- performa_365
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2024An authenticated arbitrary file upload vulnerability in the /documentCache/upload endpoint of InfoDom Performa 365 v4.0.1 allows attackers to execute arbitrary CVE-2024-46625 · Other software · reported by MITREHigh 8.8
An authenticated arbitrary file upload vulnerability in the /documentCache/upload endpoint of InfoDom Performa 365 v4.0.1 allows attackers to execute arbitrary code via uploading a crafted SVG file.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2024Memory corruption when PAL client calls PAL service APIs by passing a random value as handle and the handle is not validated by the service.CVE-2024-33039 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 6.7
Memory corruption when PAL client calls PAL service APIs by passing a random value as handle and the handle is not validated by the service.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 30, 2024Random Banner: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53787 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in M A Vinoth Kumar Random Banner random-banner allows Stored XSS.This issue affects Random Banner: from n/a through <= 4.2.12.
- Product
- Random Banner
- Affected
- up to 4.2.12
- What to do
- Affects up to 4.2.12. Update Random Banner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 26, 2024The incorrect domain may have been displayed in the address bar during an interrupted navigation attempt.CVE-2024-11701 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 4.3
The incorrect domain may have been displayed in the address bar during an interrupted navigation attempt. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 133 and Thunderbird < 133.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Nov 26, 2024Enhanced Tracking Protection's Strict mode may have inadvertently allowed a CSP `frame-src` bypass and DOM-based XSS through the Google SafeFrame shim in the WeCVE-2024-11694 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.1
Enhanced Tracking Protection's Strict mode may have inadvertently allowed a CSP `frame-src` bypass and DOM-based XSS through the Google SafeFrame shim in the Web Compatibility extension. This issue could have exposed users to malicious frames masquerading as legitimate content. This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Firefox ESR < 115.18, Thunderbird < 133, Thunderbird < 128.5, and Thunderbird < 115.18.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Nov 26, 2024QSEE will randomly experience a fatal error during execution due to speculative instruction fetches from device memory.CVE-2016-10408 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 8.4
QSEE will randomly experience a fatal error during execution due to speculative instruction fetches from device memory. Device memory is not valid executable memory.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024Panda Security Dome VPN Incorrect Permission Assignment Local Privilege Escalation Vulnerability.CVE-2024-7245 · Other software · Panda Security · reported by zdi-disclosures@trendmicro.comHigh 7.8
Panda Security Dome VPN Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Panda Security Dome. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Hydra Sdk Windows Service. The issue lies in the lack of proper permissions set on a folder created by the service. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-23429.
- Product
- Dome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024Panda Security Dome VPN DLL Hijacking Local Privilege Escalation Vulnerability.CVE-2024-7244 · Other software · Panda Security · reported by zdi-disclosures@trendmicro.comHigh 7.8
Panda Security Dome VPN DLL Hijacking Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Panda Security Dome. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the VPN process. The process does not restrict DLL search to trusted paths, which can result in the loading of a malicious DLL. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-23428.
- Product
- Dome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024Panda Security Dome Link Following Local Privilege Escalation Vulnerability.CVE-2024-7243 · Other software · Panda Security · reported by zdi-disclosures@trendmicro.comHigh 7.8
Panda Security Dome Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Panda Security Dome. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the PSANHost executable. By creating a junction, an attacker can abuse the service to create arbitrary files. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-23413.
- Product
- Dome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024Panda Security Dome Link Following Local Privilege Escalation Vulnerability.CVE-2024-7242 · Other software · Panda Security · reported by zdi-disclosures@trendmicro.comHigh 7.8
Panda Security Dome Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Panda Security Dome. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the PSANHost executable. By creating a junction, an attacker can abuse the service to delete arbitrary files. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-23402.
- Product
- Dome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024Panda Security Dome Link Following Local Privilege Escalation Vulnerability.CVE-2024-7241 · Other software · Panda Security · reported by zdi-disclosures@trendmicro.comHigh 7.8
Panda Security Dome Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Panda Security Dome. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the PSANHost service. By creating a junction, an attacker can abuse the service to create an arbitrary file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-23375.
- Product
- Dome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024Incorrect access control in KIA Seltos vehicle instrument cluster with software and hardware v1.0 allows attackers to arbitrarily change odometer readings in thCVE-2024-51074 · Other software · reported by MITREMedium 6.7
Incorrect access control in KIA Seltos vehicle instrument cluster with software and hardware v1.0 allows attackers to arbitrarily change odometer readings in the vehicle by targeting the instrument cluster through the unsecured CAN network. NOTE: this is disputed by the supplier because the CAN bus is not externally exposed, and because the packets can only increase the odometer reading (which typically has no value to an adversary). Also, this is disputed by the Supplier because the findings came from a potentially unrealistic test environment (an isolated ECU part that was not in a vehicle), and because the observed behavior follows the UDS (Unified Diagnostic Services) specification.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorden.wikipedia.orggithub.com
Nov 21, 2024A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that.CVE-2024-52616 · Other software · Red Hat · reported by Red HatMedium 5.3
A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. This predictable behavior facilitates DNS spoofing attacks, allowing attackers to guess transaction IDs.
- Product
- Red Hat Enterprise Linux 9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Nov 19, 2024In the Linux kernel, the following vulnerability has been resolved: drm/tegra: Fix NULL vs IS_ERR() check in probe() The iommu_paging_domain_alloc() function CVE-2024-53078 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: drm/tegra: Fix NULL vs IS_ERR() check in probe() The iommu_paging_domain_alloc() function doesn't return NULL pointers, it returns error pointers. Update the check to match.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Nov 19, 2024Random Featured Post: Cross-Site Request Forgery (CSRF)CVE-2024-51650 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in scottmydollarplancom Random Featured Post random-featured-post-plugin allows Stored XSS.This issue affects Random Featured Post: from n/a through <= 1.1.3.
- Product
- Random Featured Post
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update Random Featured Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 19, 2024EndomondoWP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50551 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Odyno EndomondoWP endomondowp allows Stored XSS.This issue affects EndomondoWP: from n/a through <= 0.1.1.
- Product
- EndomondoWP
- Affected
- up to 0.1.1
- What to do
- Affects up to 0.1.1. Update EndomondoWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 19, 2024Domain Sharding: Cross-Site Request Forgery (CSRF)CVE-2024-50533 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in David Garcia Domain Sharding domain-sharding allows Stored XSS.This issue affects Domain Sharding: from n/a through <= 1.2.1.
- Product
- Domain Sharding
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update Domain Sharding to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 17, 2024Bitcoin Core before 22.0 has a miniupnp infinite loop in which it allocates memory on the basis of random data received over the network, e.g., large M-SEARCH rCVE-2024-52917 · Other software · bitcoin · reported by MITREMedium 6.5
Bitcoin Core before 22.0 has a miniupnp infinite loop in which it allocates memory on the basis of random data received over the network, e.g., large M-SEARCH replies from a fake UPnP device.
- Product
- bitcoin_core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbitcoincore.orgen.bitcoin.it
Nov 16, 2024AJAX Random Posts: Deserialization of Untrusted DataCVE-2024-52409 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Phoenixheart AJAX Random Posts ajax-random-posts allows Object Injection.This issue affects AJAX Random Posts: from n/a through <= 0.3.3.
- Product
- AJAX Random Posts
- Affected
- up to 0.3.3
- What to do
- Affects up to 0.3.3. Update AJAX Random Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 15, 2024An improper restriction of external entities (XXE) vulnerability in dompdf/dompdf's SVG parser allows for Server-Side Request Forgery (SSRF) and deserializationCVE-2021-3902 · Other software · dompdf · reported by security@huntr.devCritical 9.8
An improper restriction of external entities (XXE) vulnerability in dompdf/dompdf's SVG parser allows for Server-Side Request Forgery (SSRF) and deserialization attacks. This issue affects all versions prior to 2.0.0. The vulnerability can be exploited even if the isRemoteEnabled option is set to false. It allows attackers to perform SSRF, disclose internal image files, and cause PHAR deserialization attacks.
- Product
- dompdf/dompdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2024DomPDF before version 2.0.0 is vulnerable to PHAR deserialization due to a lack of checking on the protocol before passing it into the file_get_contents() functCVE-2021-3838 · Other software · dompdf · reported by security@huntr.devCritical 9.8
DomPDF before version 2.0.0 is vulnerable to PHAR deserialization due to a lack of checking on the protocol before passing it into the file_get_contents() function. An attacker who can upload files of any type to the server can pass in the phar:// protocol to unserialize the uploaded file and instantiate arbitrary PHP objects. This can lead to remote code execution, especially when DOMPdf is used with frameworks with documented POP chains like Laravel or vulnerable developer code.
- Product
- dompdf/dompdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2024Versions of the package dom-iterator before 1.0.1 are vulnerable to Arbitrary Code Execution due to use of the Function constructor without complete input sanitCVE-2024-21541 · Other software · dom-iterator · reported by report@snyk.ioMedium 5.5
Versions of the package dom-iterator before 1.0.1 are vulnerable to Arbitrary Code Execution due to use of the Function constructor without complete input sanitization. Function generates a new function body and thus care must be given to ensure that the inputs to Function are not attacker-controlled. The risks involved are similar to that of allowing attacker-controlled input to reach eval.
- Product
- dom-iterator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecurity.snyk.io
Nov 7, 2024Dell PowerProtect Data Domain, versions prior to 8.1.0.0, 7.13.1.10, 7.10.1.40, and 7.7.5.50, contains an escalation of privilege vulnerability.CVE-2024-45759 · Other software · Dell · reported by security_alert@emc.comMedium 6.8
Dell PowerProtect Data Domain, versions prior to 8.1.0.0, 7.13.1.10, 7.10.1.40, and 7.7.5.50, contains an escalation of privilege vulnerability. A local low privileged attacker could potentially exploit this vulnerability, leading to unauthorized execution of certain commands to overwrite system config of the application. Exploitation may lead to denial of service of system.
- Product
- PowerProtect DD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.