Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
245 results · page 3 of 5
Sep 27, 2024In UMTS RLC driver, there is a possible out of bounds write due to a missing bounds check.CVE-2024-39431 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comHigh 8.3
In UMTS RLC driver, there is a possible out of bounds write due to a missing bounds check. This could lead to remote denial of service with System execution privileges needed.
- Product
- SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2024In the Linux kernel, the following vulnerability has been resolved: ionic: fix kernel panic in XDP_TX action In the XDP_TX path, ionic driver sends a packet tCVE-2024-40907 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Critical 9.8
In the Linux kernel, the following vulnerability has been resolved: ionic: fix kernel panic in XDP_TX action In the XDP_TX path, ionic driver sends a packet to the TX path with rx page and corresponding dma address. After tx is done, ionic_tx_clean() frees that page. But RX ring buffer isn't reset to NULL. So, it uses a freed page, which causes kernel panic. BUG: unable to handle page fault for address: ffff8881576c110c PGD 773801067 P4D 773801067 PUD 87f086067 PMD 87efca067 PTE 800ffffea893e060 Oops: Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC KASAN NOPTI CPU: 1 PID: 25 Comm: ksoftirqd/1 Not tainted 6.9.0+ #11 Hardware name: ASUS System Product Name/PRIME Z690-P D4, BIOS 0603 11/01/2021 RIP: 0010:bpf_prog_f0b8caeac1068a55_balancer_ingress+0x3b/0x44f Code: 00 53 41 55 41 56 41 57 b8 01 00 00 00 48 8b 5f 08 4c 8b 77 00 4c 89 f7 48 83 c7 0e 48 39 d8 RSP: 0018:ffff888104e6fa28 EFLAGS: 00010283 RAX: 0000000000000002 RBX: ffff8881576c1140 RCX: 0000000000000002 RDX: ffffffffc0051f64 RSI: ffffc90002d33048 RDI: ffff8881576c110e RBP: ffff888104e6fa88 R08: 0000000000000000 R09: ffffed1027a04a23 R10: 0000000000000000 R11: 0000000000000000 R12: ffff8881b03a21a8 R13: ffff8881589f800f R14: ff
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jul 3, 2024The bson_string_append function in MongoDB C Driver may be vulnerable to a buffer overflow where the function might attempt to allocate too small of buffer and CVE-2024-6383 · Other software · MongoDB Inc · reported by cna@mongodb.comMedium 5.3
The bson_string_append function in MongoDB C Driver may be vulnerable to a buffer overflow where the function might attempt to allocate too small of buffer and may lead to memory corruption of neighbouring heap memory. This issue affects libbson versions prior to 1.27.1
- Product
- libbson
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjira.mongodb.orgjira.mongodb.org
Jul 2, 2024The bson_strfreev function in the MongoDB C driver library may be susceptible to an integer overflow where the function will try to free memory at a negative ofCVE-2024-6381 · Other software · MongoDB Inc · reported by cna@mongodb.comMedium 4
The bson_strfreev function in the MongoDB C driver library may be susceptible to an integer overflow where the function will try to free memory at a negative offset. This may result in memory corruption. This issue affected libbson versions prior to 1.26.2
- Product
- libbson
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjira.mongodb.orgjira.mongodb.org
May 21, 2024In the Linux kernel, the following vulnerability has been resolved: net:sfc: fix non-freed irq in legacy irq mode SFC driver can be configured via modparam toCVE-2021-47283 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: net:sfc: fix non-freed irq in legacy irq mode SFC driver can be configured via modparam to work using MSI-X, MSI or legacy IRQ interrupts. In the last one, the interrupt was not properly released on module remove. It was not freed because the flag irqs_hooked was not set during initialization in the case of using legacy IRQ. Example of (trimmed) trace during module remove without this fix: remove_proc_entry: removing non-empty directory 'irq/125', leaking at least '0000:3b:00.1' WARNING: CPU: 39 PID: 3658 at fs/proc/generic.c:715 remove_proc_entry+0x15c/0x170 ...trimmed... Call Trace: unregister_irq_proc+0xe3/0x100 free_desc+0x29/0x70 irq_free_descs+0x47/0x70 mp_unmap_irq+0x58/0x60 acpi_unregister_gsi_ioapic+0x2a/0x40 acpi_pci_irq_disable+0x78/0xb0 pci_disable_device+0xd1/0x100 efx_pci_remove+0xa1/0x1e0 [sfc] pci_device_remove+0x38/0xa0 __device_release_driver+0x177/0x230 driver_detach+0xcb/0x110 bus_remove_driver+0x58/0xd0 pci_unregister_driver+0x2a/0xb0 efx_exit_module+0x24/0xf40 [sfc] __do_sys_delete_module.constprop.0+0x171/0x280 ? exit_to_user_mode_prepare+0x83/0x1d0 do_syscall_64+0x3d/0x
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
May 14, 2024The Amazon JDBC Driver for Redshift is a Type 4 JDBC driver that provides database connectivity through the standard JDBC application program interfaces (APIs) CVE-2024-32888 · Other software · aws · reported by GitHubCritical 10
The Amazon JDBC Driver for Redshift is a Type 4 JDBC driver that provides database connectivity through the standard JDBC application program interfaces (APIs) available in the Java Platform, Enterprise Editions. Prior to version 2.1.0.28, SQL injection is possible when using the non-default connection property `preferQueryMode=simple` in combination with application code which has a vulnerable SQL that negates a parameter value. There is no vulnerability in the driver when using the default, extended query mode. Note that `preferQueryMode` is not a supported parameter in Redshift JDBC driver, and is inherited code from Postgres JDBC driver. Users who do not override default settings to utilize this unsupported query mode are not affected. This issue is patched in driver version 2.1.0.28. As a workaround, do not use the connection property `preferQueryMode=simple`. (NOTE: Those who do not explicitly specify a query mode use the default of extended query mode and are not affected by this issue.)
- Product
- amazon-redshift-jdbc-driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2024In the Linux kernel, the following vulnerability has been resolved: hv_netvsc: Register VF in netvsc_probe if NET_DEVICE_REGISTER missed If hv_netvsc driver iCVE-2024-26820 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: hv_netvsc: Register VF in netvsc_probe if NET_DEVICE_REGISTER missed If hv_netvsc driver is unloaded and reloaded, the NET_DEVICE_REGISTER handler cannot perform VF register successfully as the register call is received before netvsc_probe is finished. This is because we register register_netdevice_notifier() very early( even before vmbus_driver_register()). To fix this, we try to register each such matching VF( if it is visible as a netdevice) at the end of netvsc_probe.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Apr 9, 2024Microsoft ODBC Driver for SQL Server Remote Code Execution VulnerabilityCVE-2024-29043 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
- Product
- Microsoft SQL Server 2022 for (CU 12)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 9, 2024Microsoft ODBC Driver for SQL Server Remote Code Execution VulnerabilityCVE-2024-28943 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
- Product
- Microsoft SQL Server 2019 (GDR)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 9, 2024Microsoft ODBC Driver for SQL Server Remote Code Execution VulnerabilityCVE-2024-28941 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
- Product
- Microsoft SQL Server 2019 (GDR)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 9, 2024Microsoft ODBC Driver for SQL Server Remote Code Execution VulnerabilityCVE-2024-28938 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
- Product
- Microsoft SQL Server 2022 for (CU 12)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 9, 2024Microsoft ODBC Driver for SQL Server Remote Code Execution VulnerabilityCVE-2024-28937 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
- Product
- Microsoft SQL Server 2019 (GDR)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 9, 2024Microsoft ODBC Driver for SQL Server Remote Code Execution VulnerabilityCVE-2024-28936 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
- Product
- Microsoft SQL Server 2022 for (CU 12)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 9, 2024Microsoft ODBC Driver for SQL Server Remote Code Execution VulnerabilityCVE-2024-28935 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
- Product
- Microsoft SQL Server 2019 (CU 25)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 9, 2024Microsoft ODBC Driver for SQL Server Remote Code Execution VulnerabilityCVE-2024-28934 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
- Product
- Microsoft SQL Server 2022 for (CU 12)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 9, 2024Microsoft ODBC Driver for SQL Server Remote Code Execution VulnerabilityCVE-2024-28933 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
- Product
- Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 9, 2024Microsoft ODBC Driver for SQL Server Remote Code Execution VulnerabilityCVE-2024-28932 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
- Product
- Microsoft SQL Server 2022 for (CU 12)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 9, 2024Microsoft ODBC Driver for SQL Server Remote Code Execution VulnerabilityCVE-2024-28931 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
- Product
- Microsoft SQL Server 2022 for (CU 12)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 9, 2024Microsoft ODBC Driver for SQL Server Remote Code Execution VulnerabilityCVE-2024-28930 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
- Product
- Microsoft SQL Server 2019 (CU 25)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 9, 2024Microsoft ODBC Driver for SQL Server Remote Code Execution VulnerabilityCVE-2024-28929 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
- Product
- Microsoft SQL Server 2019 (CU 25)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 9, 2024Microsoft WDAC SQL Server ODBC Driver Remote Code Execution VulnerabilityCVE-2024-26214 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Microsoft WDAC SQL Server ODBC Driver Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 12, 2024Microsoft ODBC Driver Remote Code Execution VulnerabilityCVE-2024-26162 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Microsoft ODBC Driver Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 12, 2024Microsoft ODBC Driver Remote Code Execution VulnerabilityCVE-2024-26159 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Microsoft ODBC Driver Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 12, 2024Microsoft ODBC Driver Remote Code Execution VulnerabilityCVE-2024-21451 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Microsoft ODBC Driver Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 12, 2024Microsoft ODBC Driver Remote Code Execution VulnerabilityCVE-2024-21440 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Microsoft ODBC Driver Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Feb 19, 2024pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE.CVE-2024-1597 · Other software · pgjdbc · reported by f86ef6dc-4d3a-42ad-8f28-e6d5547a5007Critical 10
pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note this is not the default. In the default mode there is no vulnerability. A placeholder for a numeric value must be immediately preceded by a minus. There must be a second placeholder for a string value after the first placeholder; both must be on the same line. By constructing a matching string payload, the attacker can inject SQL to alter the query,bypassing the protections that parameterized queries bring against SQL Injection attacks. Versions before 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, and 42.2.28 are affected.
- Product
- pgjdbc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Feb 13, 2024Microsoft WDAC ODBC Driver Remote Code Execution VulnerabilityCVE-2024-21353 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Microsoft WDAC ODBC Driver Remote Code Execution Vulnerability
- Product
- Windows Server 2022, 23H2 Edition (Server Core installation)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Feb 13, 2024Microsoft ODBC Driver Remote Code Execution VulnerabilityCVE-2024-21347 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Microsoft ODBC Driver Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1507
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Feb 12, 2024The use-after-free vulnerability was found in the AuthentIC driver in OpenSC packages, occuring in the card enrolment process using pkcs15-init when a user or aCVE-2024-1454 · Other software · Red Hat · reported by Red HatLow 3.4
The use-after-free vulnerability was found in the AuthentIC driver in OpenSC packages, occuring in the card enrolment process using pkcs15-init when a user or administrator enrols or modifies cards. An attacker must have physical access to the computer system and requires a crafted USB device or smart card to present the system with specially crafted responses to the APDUs, which are considered high complexity and low severity. This manipulation can allow for compromised card management operations during enrolment.
- Product
- Red Hat Enterprise Linux 7
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugs.chromium.org
Jan 12, 2024When calling bson_utf8_validate on some inputs a loop with an exit condition that cannot be reached may occur, i.e.CVE-2023-0437 · Other software · MongoDB Inc · reported by cna@mongodb.comMedium 5.3
When calling bson_utf8_validate on some inputs a loop with an exit condition that cannot be reached may occur, i.e. an infinite loop. This issue affects All MongoDB C Driver versions prior to versions 1.25.0.
- Product
- MongoDB C Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjira.mongodb.orglists.fedoraproject.org
Jan 9, 2024Microsoft ODBC Driver Remote Code Execution VulnerabilityCVE-2024-20654 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8
Microsoft ODBC Driver Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Dec 20, 2023IBM Informix JDBC Driver 4.10 and 4.50 is susceptible to remote code execution attack via JNDI injection when passing an unchecked argument to a certain API.CVE-2023-35895 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.3
IBM Informix JDBC Driver 4.10 and 4.50 is susceptible to remote code execution attack via JNDI injection when passing an unchecked argument to a certain API. IBM X-Force ID: 259116.
- Product
- Informix JDBC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Dec 12, 2023Microsoft ODBC Driver Remote Code Execution VulnerabilityCVE-2023-35639 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Microsoft ODBC Driver Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Oct 10, 2023Microsoft ODBC Driver for SQL Server Remote Code Execution VulnerabilityCVE-2023-36785 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
- Product
- Microsoft SQL Server 2019 (GDR)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Oct 10, 2023Microsoft ODBC Driver for SQL Server Remote Code Execution VulnerabilityCVE-2023-36730 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
- Product
- Microsoft SQL Server 2019 (GDR)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Oct 10, 2023Microsoft WDAC ODBC Driver Remote Code Execution VulnerabilityCVE-2023-36598 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft WDAC ODBC Driver Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Oct 10, 2023Microsoft ODBC Driver for SQL Server Remote Code Execution VulnerabilityCVE-2023-36420 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
- Product
- Microsoft SQL Server 2019 (GDR)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Aug 29, 2023Some MongoDB Drivers may erroneously publish events containing authentication-related data to a command listener configured by an application.CVE-2021-32050 · Other software · MongoDB Inc · reported by cna@mongodb.comMedium 4.2
Some MongoDB Drivers may erroneously publish events containing authentication-related data to a command listener configured by an application. The published events may contain security-sensitive data when specific authentication-related commands are executed. Without due care, an application may inadvertently expose this sensitive information, e.g., by writing it to a log file. This issue only arises if an application enables the command listener feature (this is not enabled by default). This issue affects the MongoDB C Driver 1.0.0 prior to 1.17.7, MongoDB PHP Driver 1.0.0 prior to 1.9.2, MongoDB Swift Driver 1.0.0 prior to 1.1.1, MongoDB Node.js Driver 3.6 prior to 3.6.10, MongoDB Node.js Driver 4.0 prior to 4.17.0 and MongoDB Node.js Driver 5.0 prior to 5.8.0. This issue also affects users of the MongoDB C++ Driver dependent on the C driver 1.0.0 prior to 1.17.7 (C++ driver prior to 3.7.0).
- Product
- MongoDB C Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjira.mongodb.orgjira.mongodb.org
Aug 16, 2023A use-after-free flaw was found in vmxnet3_rq_alloc_rx_buf in drivers/net/vmxnet3/vmxnet3_drv.c in VMware's vmxnet3 ethernet NIC driver in the Linux Kernel.CVE-2023-4387 · Other software · Red Hat · reported by Red HatHigh 7.1
A use-after-free flaw was found in vmxnet3_rq_alloc_rx_buf in drivers/net/vmxnet3/vmxnet3_drv.c in VMware's vmxnet3 ethernet NIC driver in the Linux Kernel. This issue could allow a local attacker to crash the system due to a double-free while cleaning up vmxnet3_rq_cleanup_all, which could also lead to a kernel information leak problem.
- Product
- Red Hat Enterprise Linux 8
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Aug 8, 2023Microsoft SQL OLE DB Remote Code Execution VulnerabilityCVE-2023-38169 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Microsoft SQL OLE DB Remote Code Execution Vulnerability
- Product
- Microsoft ODBC Driver 17 for SQL Server on Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jul 11, 2023Microsoft ODBC Driver Remote Code Execution VulnerabilityCVE-2023-32038 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Microsoft ODBC Driver Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jul 10, 2023IBM Db2 JDBC Driver for Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 could allow a remote authenticated attacker to execute arbitrary code on the systemCVE-2023-27869 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.3
IBM Db2 JDBC Driver for Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unchecked logger injection. By sending a specially crafted request using the named traceFile property, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 249517.
- Product
- Db2 for Linux, UNIX and Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comsecurity.netapp.com
Jul 10, 2023IBM Db2 JDBC Driver for Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 could allow a remote authenticated attacker to execute arbitrary code on the systemCVE-2023-27868 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.3
IBM Db2 JDBC Driver for Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unchecked class instantiation when providing plugin classes. By sending a specially crafted request using the named pluginClassName class, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 249516.
- Product
- Db2 for Linux, UNIX and Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comsecurity.netapp.com
Jul 10, 2023IBM Db2 JDBC Driver for Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 could allow a remote authenticated attacker to execute arbitrary code via JNDI InjeCVE-2023-27867 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.3
IBM Db2 JDBC Driver for Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 could allow a remote authenticated attacker to execute arbitrary code via JNDI Injection. By sending a specially crafted request using the property clientRerouteServerListJNDIName, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 249514.
- Product
- Db2 for Linux, UNIX and Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comsecurity.netapp.com
Jun 28, 2023IBM Informix JDBC Driver 4.10 and 4.50 is susceptible to remote code execution attack via JNDI injection when driver code or the application using the driver doCVE-2023-27866 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.3
IBM Informix JDBC Driver 4.10 and 4.50 is susceptible to remote code execution attack via JNDI injection when driver code or the application using the driver do not verify supplied LDAP URL in Connect String. IBM X-Force ID: 249511.
- Product
- Informix JDBC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jun 15, 2023Microsoft ODBC Driver for SQL Server Remote Code Execution VulnerabilityCVE-2023-32027 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
- Product
- Microsoft ODBC Driver 17 for SQL Server on Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jun 15, 2023Microsoft ODBC Driver for SQL Server Remote Code Execution VulnerabilityCVE-2023-32026 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
- Product
- Microsoft ODBC Driver 17 for SQL Server on MacOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jun 15, 2023Microsoft ODBC Driver for SQL Server Remote Code Execution VulnerabilityCVE-2023-32025 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
- Product
- Microsoft ODBC Driver 17 for SQL Server on Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jun 15, 2023Microsoft ODBC Driver for SQL Server Remote Code Execution VulnerabilityCVE-2023-29356 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
- Product
- Microsoft ODBC Driver 17 for SQL Server on Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jun 13, 2023Microsoft ODBC Driver Remote Code Execution VulnerabilityCVE-2023-29373 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Microsoft ODBC Driver Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.