Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
5,798 results · page 28 of 116
Jul 7, 2025A remote attacker with administrator account can gain full control of the device due to improper neutralization of special elements used in an OS Command ('OS CCVE-2025-3626 · Other software · Frauscher · reported by info@cert.vde.comCritical 9.1
A remote attacker with administrator account can gain full control of the device due to improper neutralization of special elements used in an OS Command ('OS Command Injection') while uploading a config file via webUI.
- Product
- FDS102
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 4, 2025In the Production Environment extension in Netmake ScriptCase through 9.12.006 (23), the Administrator password reset mechanism is mishandled.CVE-2025-47227 · Other software · ScriptCase · reported by MITREHigh 7.5
In the Production Environment extension in Netmake ScriptCase through 9.12.006 (23), the Administrator password reset mechanism is mishandled. Making both a GET and a POST request to login.php.is sufficient. An unauthenticated attacker can then bypass authentication via administrator account takeover.
- Product
- ScriptCase
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comscriptcase.net
Jul 2, 2025An authenticated remote code execution vulnerability exists in Lucee’s administrative interface due to insecure design in the scheduled task functionality.CVE-2025-34074 · Other software · Lucee Association Switzerland · reported by VulnCheckCritical 9.4
An authenticated remote code execution vulnerability exists in Lucee’s administrative interface due to insecure design in the scheduled task functionality. An administrator with access to /lucee/admin/web.cfm can configure a scheduled job to retrieve a remote .cfm file from an attacker-controlled server, which is written to the Lucee webroot and executed with the privileges of the Lucee service account. Because Lucee does not enforce integrity checks, path restrictions, or execution controls for scheduled task fetches, this feature can be abused to achieve arbitrary code execution. This issue is distinct from CVE-2024-55354.
- Product
- Lucee
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comraw.githubusercontent.com
Jul 2, 2025Secret Server version 11.7 and earlier is vulnerable to a SQL report creation vulnerability that allows an administrator to gain access to restricted tables.CVE-2025-6943 · Other software · Delinea · reported by 1443cd92-d354-46d2-9290-d812316ca43aLow 3.8
Secret Server version 11.7 and earlier is vulnerable to a SQL report creation vulnerability that allows an administrator to gain access to restricted tables.
- Product
- Secret Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.delinea.comdocs.delinea.com
Jul 2, 2025A remote code execution vulnerability in GFI Kerio Control 9.4.5 allows attackers with administrative access to upload and execute arbitrary code through the fiCVE-2025-34071 · Other software · GFI Software · reported by VulnCheckCritical 9.4
A remote code execution vulnerability in GFI Kerio Control 9.4.5 allows attackers with administrative access to upload and execute arbitrary code through the firmware upgrade feature. The system upgrade mechanism accepts unsigned .img files, which can be modified to include malicious scripts within the upgrade.sh or disk image components. These modified upgrade images are not validated for authenticity or integrity, and are executed by the system post-upload, enabling root access.
- Product
- Kerio Control
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordssd-disclosure.comvulncheck.com
Jul 2, 2025A missing double-check feature in the WebGUI for CLI deactivation in Infinera G42 version R6.1.3 allows an authenticated administrator to make other managemenCVE-2025-27026 · Other software · Infinera · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158Medium 4.9
A missing double-check feature in the WebGUI for CLI deactivation in Infinera G42 version R6.1.3 allows an authenticated administrator to make other management interfaces unavailable via local and network interfaces. The CLI deactivation via the WebGUI does not only stop CLI interface but deactivates also Linux Shell, WebGUI and Physical Serial Console access. No confirmation is asked at deactivation time. Loosing access to these services device administrators are at risk of completely loosing device control.
- Product
- G42
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordeuvd.enisa.europa.eucvcn.gov.it
Jul 2, 2025Nokia Single RAN baseband software earlier than 24R1-SR 1.0 MP contains administrative shell input validation fault, which authenticated admin user can, in theoCVE-2025-24333 · Other software · Nokia · reported by b48c3b8f-639e-4c16-8725-497bc411dad0Medium 6.4
Nokia Single RAN baseband software earlier than 24R1-SR 1.0 MP contains administrative shell input validation fault, which authenticated admin user can, in theory, potentially use for injecting arbitrary commands for unprivileged baseband OAM service process execution via special characters added to baseband internal COMA_config.xml file. This issue has been corrected starting from release 24R1-SR 1.0 MP and later, by adding proper input validation to OAM service process which prevents injecting special characters via baseband internal COMA_config.xml file.
- Product
- Nokia Single RAN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2025Nokia Single RAN AirScale baseband allows an authenticated administrative user access to all physical boards after performing a single login to the baseband sysCVE-2025-24332 · Other software · Nokia · reported by b48c3b8f-639e-4c16-8725-497bc411dad0High 7.1
Nokia Single RAN AirScale baseband allows an authenticated administrative user access to all physical boards after performing a single login to the baseband system board. The baseband does not re-authenticate the user when they connect from the baseband system board to the baseband capacity boards using the internal bsoc SSH service, which is available only internally within the baseband and through the internal backplane between the boards. The bsoc SSH allows login from one board to another via the baseband internal backplane using an SSH private key present on the baseband system board. This bsoc SSH capability was previously considered an administrative functionality but has now been restricted to be available only to baseband root-privileged administrators. This restriction mitigates the possibility of misuse with lower-level privileges (e.g., from baseband software images). This mitigation is included starting from release 23R4-SR 3.0 MP and later
- Product
- Nokia Single RAN AirScale (Flexi Multiradio is not affected)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2025In Tenable Nessus versions prior to 10.8.5 on a Windows host, it was found that a non-administrative user could overwrite arbitrary local system files with log CVE-2025-36630 · Other software · Tenable · reported by vulnreport@tenable.comHigh 8.4
In Tenable Nessus versions prior to 10.8.5 on a Windows host, it was found that a non-administrative user could overwrite arbitrary local system files with log content at SYSTEM privilege.
- Product
- Nessus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2025Improper signature verification in AMD CPU ROM microcode patch loader may allow an attacker with local administrator privilege to load malicious microcode, poteCVE-2024-36347 · Other software · AMD · reported by psirt@amd.comMedium 6.4
Improper signature verification in AMD CPU ROM microcode patch loader may allow an attacker with local administrator privilege to load malicious microcode, potentially resulting in loss of integrity of x86 instruction execution, loss of confidentiality and integrity of data in x86 CPU privileged context and compromise of SMM execution environment.
- Product
- AMD EPYC™ 7001 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2025A flaw was found in Infinispan CLI.CVE-2025-5731 · Other software · Red Hat · reported by Red HatMedium 5.5
A flaw was found in Infinispan CLI. A sensitive password, decoded from a Base64-encoded Kubernetes secret, is processed in plaintext and included in a command string that may expose the data in an error message when a command is not found.
- Product
- infinispan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Jun 26, 2025Under certain conditions, an authenticated user request may execute with stale privileges following an intentional change by an authorized administrator.CVE-2025-6707 · Other software · MongoDB Inc · reported by cna@mongodb.comMedium 4.2
Under certain conditions, an authenticated user request may execute with stale privileges following an intentional change by an authorized administrator. This issue affects MongoDB Server v5.0 version prior to 5.0.31, MongoDB Server v6.0 version prior to 6.0.24, MongoDB Server v7.0 version prior to 7.0.21 and MongoDB Server v8.0 version prior to 8.0.5.
- Product
- MongoDB Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2025An unauthenticated attacker who knows the target device's serial number, can generate the default administrator password for the device.CVE-2024-51978 · Other software · Brother Industries, Ltd · reported by cve@rapid7.comCritical 9.8
An unauthenticated attacker who knows the target device's serial number, can generate the default administrator password for the device. An unauthenticated attacker can first discover the target device's serial number via CVE-2024-51977 over HTTP/HTTPS/IPP, or via a PJL request, or via an SNMP request.
- Product
- DCP-J928N-W/B
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordassets.contentstack.iogithub.com
Jun 23, 2025Mitel OpenScape Accounting Management through V5 R1.1.0 could allow an authenticated attacker with administrative privileges to conduct a path traversal attack CVE-2025-23092 · Other software · reported by MITREHigh 7.2
Mitel OpenScape Accounting Management through V5 R1.1.0 could allow an authenticated attacker with administrative privileges to conduct a path traversal attack due to insufficient sanitization of user input. A successful exploit could allow an attacker to upload arbitrary files and execute unauthorized commands.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 18, 2025In the Linux kernel, the following vulnerability has been resolved: gadgetfs: ep_io - wait until IRQ finishes after usb_ep_queue() if wait_for_completion_inteCVE-2022-50028 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: gadgetfs: ep_io - wait until IRQ finishes after usb_ep_queue() if wait_for_completion_interruptible() is interrupted we need to wait until IRQ gets finished. Otherwise complete() from epio_complete() can corrupt stack.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jun 16, 2025In Tenable Agent versions prior to 10.8.5 on a Windows host, it was found that a non-administrative user could execute code with SYSTEM privilege.CVE-2025-36632 · Other software · Tenable · reported by vulnreport@tenable.comHigh 7.8
In Tenable Agent versions prior to 10.8.5 on a Windows host, it was found that a non-administrative user could execute code with SYSTEM privilege.
- Product
- Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2025Unsanitized user-supplied data saved in the PingFederate Administrative Console could trigger the execution of JavaScript code in subsequent user processing.CVE-2024-25573 · Other software · Ping Identity · reported by responsible-disclosure@pingidentity.comMedium 6.9
Unsanitized user-supplied data saved in the PingFederate Administrative Console could trigger the execution of JavaScript code in subsequent user processing.
- Product
- PingFederate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pingidentity.compingidentity.com
Jun 13, 2025In Tenable Agent versions prior to 10.8.5 on a Windows host, it was found that a non-administrative user could arbitrarily delete local system files with SYSTEMCVE-2025-36633 · Other software · Tenable · reported by vulnreport@tenable.comHigh 8.8
In Tenable Agent versions prior to 10.8.5 on a Windows host, it was found that a non-administrative user could arbitrarily delete local system files with SYSTEM privilege, potentially leading to local privilege escalation.
- Product
- Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2025In Tenable Agent versions prior to 10.8.5 on a Windows host, it was found that a non-administrative user could overwrite arbitrary local system files with log cCVE-2025-36631 · Other software · Tenable · reported by vulnreport@tenable.comHigh 8.4
In Tenable Agent versions prior to 10.8.5 on a Windows host, it was found that a non-administrative user could overwrite arbitrary local system files with log content at SYSTEM privilege.
- Product
- Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2025An improper neutralization of wildcards vulnerability in the log collection feature of Palo Alto Networks GlobalProtect™ app on macOS allows a non administrativCVE-2025-4232 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comHigh 8.5
An improper neutralization of wildcards vulnerability in the log collection feature of Palo Alto Networks GlobalProtect™ app on macOS allows a non administrative user to escalate their privileges to root.
- Product
- GlobalProtect App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.paloaltonetworks.com
Jun 12, 2025A command injection vulnerability in Palo Alto Networks PAN-OS® enables an authenticated administrative user to perform actions as the root user.CVE-2025-4231 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comHigh 8.6
A command injection vulnerability in Palo Alto Networks PAN-OS® enables an authenticated administrative user to perform actions as the root user. The attacker must have network access to the management web interface and successfully authenticate to exploit this issue. Cloud NGFW and Prisma Access are not impacted by this vulnerability.
- Product
- Cloud NGFW
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.paloaltonetworks.com
Jun 12, 2025A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary CVE-2025-4230 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comHigh 8.4
A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To be able to exploit this issue, the user must have access to the PAN-OS CLI. The security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators. Cloud NGFW and Prisma® Access are not affected by this vulnerability.
- Product
- Cloud NGFW
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.paloaltonetworks.com
Jun 12, 2025An incorrect privilege assignment vulnerability in Palo Alto Networks Cortex® XDR Broker VM allows an authenticated administrative user to execute certain filesCVE-2025-4228 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comMedium 4.6
An incorrect privilege assignment vulnerability in Palo Alto Networks Cortex® XDR Broker VM allows an authenticated administrative user to execute certain files available within the Broker VM and escalate their privileges to root.
- Product
- Cortex XDR Broker VM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.paloaltonetworks.com
Jun 12, 2025A cross-site scripting vulnerability exists in AVEVA PI Connector for CygNet Versions 1.6.14 and prior that, if exploited, could allow an administrator miscrCVE-2025-4417 · Other software · AVEVA · reported by ics-cert@hq.dhs.govMedium 6.9
A cross-site scripting vulnerability exists in AVEVA PI Connector for CygNet Versions 1.6.14 and prior that, if exploited, could allow an administrator miscreant with local access to the connector admin portal to persist arbitrary JavaScript code that will be executed by other users who visit affected pages.
- Product
- PI Connector for CygNet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025An OS command injection vulnerability within the update functionality may allow an authenticated administrator to execute unauthorized arbitrary OS commands.CVE-2024-13089 · Other software · Nozomi Networks · reported by prodsec@nozominetworks.comHigh 7.5
An OS command injection vulnerability within the update functionality may allow an authenticated administrator to execute unauthorized arbitrary OS commands. Users with administrative privileges may upload update packages to upgrade the versions of Nozomi Networks Guardian and CMC. While these updates are signed and their signatures are validated prior to installation, an improper signature validation check has been identified. This issue could potentially enable users to execute commands remotely on the appliance, thereby impacting confidentiality, integrity, and availability.
- Product
- Guardian
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.nozominetworks.com
Jun 9, 2025SAP GRC allows a non-administrative user to access and initiate transaction which could allow them to modify or control the transmitted system credentials.CVE-2025-42982 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 8.8
SAP GRC allows a non-administrative user to access and initiate transaction which could allow them to modify or control the transmitted system credentials. This causes high impact on confidentiality, integrity and availability of the application.
- Product
- SAP GRC (AC Plugin)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 7, 2025In the moPS App through 1.8.618, all users can access administrative API endpoints without additional authentication, resulting in unrestricted read and write aCVE-2024-55585 · Other software · MOPS · reported by MITRECritical 9
In the moPS App through 1.8.618, all users can access administrative API endpoints without additional authentication, resulting in unrestricted read and write access, as demonstrated by /api/v1/users/resetpassword.
- Product
- moPS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkaratemuffin.itmedia.ccc.de
Jun 6, 2025A predefined administrative account is not documented and cannot be deactivated.CVE-2025-3321 · Other software · B. Braun Melsungen AG · reported by productsecurity@bbraun.comCritical 9.4
A predefined administrative account is not documented and cannot be deactivated. This account cannot be misused from the network, only by local users on the server.
- Product
- OnlineSuite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2025Froxlor is open source server administration software.CVE-2025-48958 · Other software · froxlor · reported by GitHubMedium 5.5
Froxlor is open source server administration software. Prior to version 2.2.6, an HTML Injection vulnerability in the customer account portal allows an attacker to inject malicious HTML payloads in the email section. This can lead to phishing attacks, credential theft, and reputational damage by redirecting users to malicious external websites. The vulnerability has a medium severity, as it can be exploited through user input without authentication. Version 2.2.6 fixes the issue.
- Product
- Froxlor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2025The VAPIX Device Configuration framework allowed a privilege escalation, enabling a lower-privileged user to gain administrator privileges.CVE-2025-0324 · Other software · Axis Communications AB · reported by product-security@axis.comCritical 9.4
The VAPIX Device Configuration framework allowed a privilege escalation, enabling a lower-privileged user to gain administrator privileges.
- Product
- AXIS OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2025Improper access control in user group management in Devolutions Server 2025.1.7.0 and earlier allows a non-administrative user with both "User Management" and "CVE-2025-4433 · Other software · Devolutions · reported by security@devolutions.netHigh 8.7
Improper access control in user group management in Devolutions Server 2025.1.7.0 and earlier allows a non-administrative user with both "User Management" and "User Group Management" permissions to perform privilege escalation by adding users to groups with administrative privileges.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2025A malicious user with administrative privileges in the web portal would be able to manipulate the Diagnostics module to obtain remote code execution on the locaCVE-2025-4635 · Other software · JCT · reported by cve_disclosure@tech.gov.sgMedium 6.6
A malicious user with administrative privileges in the web portal would be able to manipulate the Diagnostics module to obtain remote code execution on the local device as a low privileged user.
- Product
- Airpointer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2025An unauthenticated HTTP GET request to the /client.php endpoint will disclose the default administrator user credentials.CVE-2025-48045 · Other software · MICI Network Co. Ltd. · reported by cve@rapid7.comHigh 8.7
An unauthenticated HTTP GET request to the /client.php endpoint will disclose the default administrator user credentials.
- Product
- NetFax Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 28, 2025Incorrect access control in M2Soft CROWNIX Report & ERS affected v7.x to v7.4.3.599 and v8.x to v8.0.3.79 allows unauthorized attackers to obtain Administrator CVE-2024-57336 · Other software · reported by MITREMedium 6.5
Incorrect access control in M2Soft CROWNIX Report & ERS affected v7.x to v7.4.3.599 and v8.x to v8.0.3.79 allows unauthorized attackers to obtain Administrator account access.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2025In Tenable Network Monitor versions prior to 6.5.1 on a Windows host, it was found that a non-administrative user could stage files in a local directory to run CVE-2025-24917 · Other software · Tenable · reported by vulnreport@tenable.comHigh 7.8
In Tenable Network Monitor versions prior to 6.5.1 on a Windows host, it was found that a non-administrative user could stage files in a local directory to run arbitrary code with SYSTEM privileges, potentially leading to local privilege escalation.
- Product
- Network Monitor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2025An access control vulnerability was discovered in Grafana OSS where an Organization administrator could permanently delete the Server administrator account.CVE-2025-3580 · Other software · Grafana · reported by security@grafana.comMedium 5.5
An access control vulnerability was discovered in Grafana OSS where an Organization administrator could permanently delete the Server administrator account. This vulnerability exists in the DELETE /api/org/users/ endpoint. The vulnerability can be exploited when: 1. An Organization administrator exists 2. The Server administrator is either: - Not part of any organization, or - Part of the same organization as the Organization administrator Impact: - Organization administrators can permanently delete Server administrator accounts - If the only Server administrator is deleted, the Grafana instance becomes unmanageable - No super-user permissions remain in the system - Affects all users, organizations, and teams managed in the instance The vulnerability is particularly serious as it can lead to a complete loss of administrative control over the Grafana instance.
- Product
- Grafana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2025Stored Absolute Path Traversal vulnerabilities in ASPECT could expose sensitive data if administrator credentials become compromised.CVE-2024-13945 · Other software · ABB · reported by cybersecurity@ch.abb.comHigh 8.4
Stored Absolute Path Traversal vulnerabilities in ASPECT could expose sensitive data if administrator credentials become compromised. This issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.
- Product
- ASPECT-Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2025Predictable filename vulnerabilities in ASPECT may expose sensitive information to a potential attacker if administrator credentials become compromisedThis issuCVE-2024-51553 · Other software · ABB · reported by cybersecurity@ch.abb.comHigh 7
Predictable filename vulnerabilities in ASPECT may expose sensitive information to a potential attacker if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.
- Product
- ASPECT-Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2025Weak password storage vulnerabilities exist in ASPECT if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: through 3.*; NEXUS SeCVE-2024-51552 · Other software · ABB · reported by cybersecurity@ch.abb.comHigh 7.1
Weak password storage vulnerabilities exist in ASPECT if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.
- Product
- ASPECT-Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2025Large content vulnerabilities are present in ASPECT exposing a device to disk overutilization on a system if administrator credentials become compromisedThis isCVE-2024-48848 · Other software · ABB · reported by cybersecurity@ch.abb.comHigh 7
Large content vulnerabilities are present in ASPECT exposing a device to disk overutilization on a system if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.
- Product
- ASPECT-Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2025An issue in Ocuco Innovation - JOBMANAGER.EXE v2.10.24.16 allows attackers to bypass authentication and escalate privileges to Administrator via a crafted TCP pCVE-2024-41199 · Other software · Ocuco · reported by MITREHigh 7.2
An issue in Ocuco Innovation - JOBMANAGER.EXE v2.10.24.16 allows attackers to bypass authentication and escalate privileges to Administrator via a crafted TCP packet.
- Product
- Innovation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgist.githubusercontent.com
May 22, 2025An issue in Ocuco Innovation - REPORTS.EXE v2.10.24.13 allows attackers to bypass authentication and escalate privileges to Administrator via a crafted TCP packCVE-2024-41198 · Other software · Ocuco · reported by MITRECritical 9.8
An issue in Ocuco Innovation - REPORTS.EXE v2.10.24.13 allows attackers to bypass authentication and escalate privileges to Administrator via a crafted TCP packet.
- Product
- Innovation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgist.githubusercontent.com
May 22, 2025An issue in Ocuco Innovation - INVCLIENT.EXE v2.10.24.5 allows attackers to bypass authentication and escalate privileges to Administrator via a crafted TCP pacCVE-2024-41197 · Other software · Ocuco · reported by MITRECritical 9.8
An issue in Ocuco Innovation - INVCLIENT.EXE v2.10.24.5 allows attackers to bypass authentication and escalate privileges to Administrator via a crafted TCP packet.
- Product
- Innovation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgist.githubusercontent.com
May 22, 2025An issue in Ocuco Innovation - REPORTSERVER.EXE v2.10.24.13 allows attackers to bypass authentication and escalate privileges to Administrator via a crafted TCPCVE-2024-41196 · Other software · Ocuco · reported by MITRECritical 9.8
An issue in Ocuco Innovation - REPORTSERVER.EXE v2.10.24.13 allows attackers to bypass authentication and escalate privileges to Administrator via a crafted TCP packet.
- Product
- Innovation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcwe.mitre.orgdrive.google.com
May 22, 2025An issue in Ocuco Innovation - INNOVASERVICEINTF.EXE v2.10.24.17 allows attackers to bypass authentication and escalate privileges to Administrator via a crafteCVE-2024-41195 · Other software · Ocuco · reported by MITRECritical 9.8
An issue in Ocuco Innovation - INNOVASERVICEINTF.EXE v2.10.24.17 allows attackers to bypass authentication and escalate privileges to Administrator via a crafted TCP packet.
- Product
- Innovation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgist.githubusercontent.com
May 22, 2025Stored Cross Site Scripting vulnerabilities exist in ASPECT if administrator creden-tials become compromisedThis issue affects ASPECT-Enterprise: through 3.*; NCVE-2024-13958 · Other software · ABB · reported by cybersecurity@ch.abb.comMedium 4.6
Stored Cross Site Scripting vulnerabilities exist in ASPECT if administrator creden-tials become compromisedThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.
- Product
- ASPECT-Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2025SSRF Server Side Request Forgery vulnerabilities exist in ASPECT if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: through 3.CVE-2024-13957 · Other software · ABB · reported by cybersecurity@ch.abb.comHigh 7
SSRF Server Side Request Forgery vulnerabilities exist in ASPECT if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.
- Product
- ASPECT-Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2025SSL Verification Bypass vulnerabilities exist in ASPECT if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: through 3.*; NEXUS CVE-2024-13956 · Other software · ABB · reported by cybersecurity@ch.abb.comHigh 8.8
SSL Verification Bypass vulnerabilities exist in ASPECT if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.
- Product
- ASPECT-Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 20252nd Order SQL injection vulnerabilities in ASPECT allow unintended access and manipulation of database repositories if administrator credentials become compromiCVE-2024-13955 · Other software · ABB · reported by cybersecurity@ch.abb.comCritical 9.4
2nd Order SQL injection vulnerabilities in ASPECT allow unintended access and manipulation of database repositories if administrator credentials become compromised.This issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.
- Product
- ASPECT-Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2025Sensitive device logger information in ASPECT may be exposed if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: through 3.*; NCVE-2024-13953 · Other software · ABB · reported by cybersecurity@ch.abb.comMedium 6.9
Sensitive device logger information in ASPECT may be exposed if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.
- Product
- ASPECT-Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.