Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
349 results · page 3 of 7
Oct 7, 2024Improper resource initialization handling in firmware of some Solidigm DC Products may allow an attacker to potentially enable denial of service.CVE-2024-47967 · Other software · Solidigm · reported by f946a70c-00eb-42ce-8e9b-634d1f7b5a6fMedium 4.4
Improper resource initialization handling in firmware of some Solidigm DC Products may allow an attacker to potentially enable denial of service.
- Product
- D7-P5510
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2024Improper access removal handling in firmware of some Solidigm DC Products may allow an attacker with physical access to gain unauthorized access.CVE-2024-47976 · Other software · Solidigm · reported by f946a70c-00eb-42ce-8e9b-634d1f7b5a6fMedium 6.7
Improper access removal handling in firmware of some Solidigm DC Products may allow an attacker with physical access to gain unauthorized access.
- Product
- DC P4510
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2024Improper resource management in firmware of some Solidigm DC Products may allow an attacker to potentially control the performance of the resource.CVE-2024-47972 · Other software · Solidigm · reported by f946a70c-00eb-42ce-8e9b-634d1f7b5a6fMedium 4
Improper resource management in firmware of some Solidigm DC Products may allow an attacker to potentially control the performance of the resource.
- Product
- D7-P5510
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2024Improper error handling in firmware of some SSD DC Products may allow an attacker to enable denial of service.CVE-2024-47971 · Other software · Solidigm · reported by f946a70c-00eb-42ce-8e9b-634d1f7b5a6fMedium 6.5
Improper error handling in firmware of some SSD DC Products may allow an attacker to enable denial of service.
- Product
- D5-P5316
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2024Improper access control validation in firmware of some Solidigm DC Products may allow an attacker with physical access to gain unauthorized access or an attackeCVE-2024-47975 · Other software · Solidigm · reported by f946a70c-00eb-42ce-8e9b-634d1f7b5a6fHigh 7
Improper access control validation in firmware of some Solidigm DC Products may allow an attacker with physical access to gain unauthorized access or an attacker with local access to potentially enable denial of service.
- Product
- D7-P5500
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2024Micron Crucial MX500 Series Solid State Drives M3CR046 is vulnerable to Buffer Overflow, which can be triggered by sending specially crafted ATA packets from thCVE-2024-42642 · Other software · Crucial · reported by MITREMedium 6.7
Micron Crucial MX500 Series Solid State Drives M3CR046 is vulnerable to Buffer Overflow, which can be triggered by sending specially crafted ATA packets from the host to the drive controller. NOTE: The supplier states that this vulnerability was fully remediated in December 2024 and that updated firmware is available through Crucial’s official support page.
- Product
- Mx500 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2024zksolc is a Solidity compiler for ZKsync.CVE-2024-45056 · Other software · matter-labs · reported by GitHubMedium 5.9
zksolc is a Solidity compiler for ZKsync. All LLVM versions since 2015 fold `(xor (shl 1, x), -1)` to `(rotl ~1, x)` if run with optimizations enabled. Here `~1` is generated as an unsigned 64 bits number (`2^64-1`). This number is zero-extended to 256 bits on EraVM target while it should have been sign-extended. Thus instead of producing `roti 2^256 - 1, x` the compiler produces `rotl 2^64 - 1, x`. Analysis has shown that no contracts were affected by the date of publishing this advisory. This issue has been addressed in version 1.5.3. Users are advised to upgrade and redeploy all contracts. There are no known workarounds for this vulnerability.
- Product
- era-compiler-solidity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 21, 2024Solid Security: Use of Less Trusted SourceCVE-2022-44593 · WordPress plugins & themes · reported by PatchstackLow 3.7
Use of Less Trusted Source vulnerability in SolidWP Solid Security allows HTTP DoS.This issue affects Solid Security: from n/a through 9.3.1.
- Product
- Solid Security
- Affected
- up to 9.3.1
- What to do
- Affects up to 9.3.1. Update Solid Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 10, 2024SAP Financial Consolidation does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.CVE-2024-37178 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5
SAP Financial Consolidation does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. These endpoints are exposed over the network. The vulnerability can exploit resources beyond the vulnerable component. On successful exploitation, an attacker can cause limited impact to confidentiality of the application.
- Product
- SAP Financial Consolidation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordme.sap.comsupport.sap.com
Jun 10, 2024SAP Financial Consolidation allows data to enter a Web application through an untrusted source.CVE-2024-37177 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 8.1
SAP Financial Consolidation allows data to enter a Web application through an untrusted source. These endpoints are exposed over the network and it allows the user to modify the content from the web site. On successful exploitation, an attacker can cause significant impact to confidentiality and integrity of the application.
- Product
- SAP Financial Consolidation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordme.sap.comsupport.sap.com
May 27, 2024ZKsync Era is a layer 2 rollup that uses zero-knowledge proofs to scale Ethereum.CVE-2024-35229 · Other software · matter-labs · reported by GitHubMedium 5.3
ZKsync Era is a layer 2 rollup that uses zero-knowledge proofs to scale Ethereum. Prior to version 1.3.10, there is a very specific pattern `f(a(),b()); check_if_a_executed_last()` in Yul that exposes a bug in evaluation order of Yul function arguments. This vulnerability has been fixed in version 1.3.10. As a workaround, update and redeploy affected contracts.
- Product
- era-compiler-solidity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024Solidus <= 4.3.4 is affected by a Stored Cross-Site Scripting vulnerability in the order tracking URL.CVE-2024-4859 · Other software · solidus · reported by vulnreport@tenable.comMedium 5.7
Solidus <= 4.3.4 is affected by a Stored Cross-Site Scripting vulnerability in the order tracking URL.
- Product
- solidus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
May 14, 2024A vulnerability has been identified in Solid Edge (All versions < V224.0 Update 2).CVE-2024-34773 · Other software · Siemens · reported by productcert@siemens.comHigh 7.8
A vulnerability has been identified in Solid Edge (All versions < V224.0 Update 2). The affected applications contain a stack overflow vulnerability while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.
- Product
- Solid Edge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comcert-portal.siemens.com
May 14, 2024A vulnerability has been identified in Solid Edge (All versions < V224.0 Update 4).CVE-2024-34772 · Other software · Siemens · reported by productcert@siemens.comHigh 7.8
A vulnerability has been identified in Solid Edge (All versions < V224.0 Update 4). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.
- Product
- Solid Edge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comcert-portal.siemens.com
May 14, 2024A vulnerability has been identified in Solid Edge (All versions < V224.0 Update 2).CVE-2024-34771 · Other software · Siemens · reported by productcert@siemens.comHigh 7.8
A vulnerability has been identified in Solid Edge (All versions < V224.0 Update 2). The affected application is vulnerable to heap-based buffer overflow while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.
- Product
- Solid Edge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comcert-portal.siemens.com
May 14, 2024A vulnerability has been identified in Solid Edge (All versions < V224.0 Update 5).CVE-2024-33493 · Other software · Siemens · reported by productcert@siemens.comHigh 7.8
A vulnerability has been identified in Solid Edge (All versions < V224.0 Update 5). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.
- Product
- Solid Edge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comcert-portal.siemens.com
May 14, 2024A vulnerability has been identified in Solid Edge (All versions < V224.0 Update 5).CVE-2024-33492 · Other software · Siemens · reported by productcert@siemens.comHigh 7.8
A vulnerability has been identified in Solid Edge (All versions < V224.0 Update 5). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.
- Product
- Solid Edge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comcert-portal.siemens.com
May 14, 2024A vulnerability has been identified in Solid Edge (All versions < V224.0 Update 5).CVE-2024-33491 · Other software · Siemens · reported by productcert@siemens.comHigh 7.8
A vulnerability has been identified in Solid Edge (All versions < V224.0 Update 5). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.
- Product
- Solid Edge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comcert-portal.siemens.com
May 14, 2024A vulnerability has been identified in Solid Edge (All versions < V224.0 Update 5).CVE-2024-33490 · Other software · Siemens · reported by productcert@siemens.comHigh 7.8
A vulnerability has been identified in Solid Edge (All versions < V224.0 Update 5). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.
- Product
- Solid Edge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comcert-portal.siemens.com
May 14, 2024A vulnerability has been identified in Solid Edge (All versions < V224.0 Update 5).CVE-2024-33489 · Other software · Siemens · reported by productcert@siemens.comHigh 7.8
A vulnerability has been identified in Solid Edge (All versions < V224.0 Update 5). The affected application is vulnerable to heap-based buffer overflow while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.
- Product
- Solid Edge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comcert-portal.siemens.com
May 14, 2024A vulnerability has been identified in Parasolid V35.1 (All versions < V35.1.256), Parasolid V36.0 (All versions < V36.0.210), Parasolid V36.1 (All versions < VCVE-2024-31980 · Other software · Siemens · reported by productcert@siemens.comHigh 7.8
A vulnerability has been identified in Parasolid V35.1 (All versions < V35.1.256), Parasolid V36.0 (All versions < V36.0.210), Parasolid V36.1 (All versions < V36.1.185). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted X_T part file. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-23468)
- Product
- Parasolid V35.1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comcert-portal.siemens.com
May 14, 2024era-compiler-solidity is the ZKsync compiler for Solidity.CVE-2024-34704 · Other software · matter-labs · reported by GitHubMedium 5.9
era-compiler-solidity is the ZKsync compiler for Solidity. The problem occurred during instruction selection in the `DAGCombine` phase while visiting the XOR operation. The issue arises when attempting to fold the expression `!(x cc y)` into `(x !cc y)`. To perform this transformation, the second operand of XOR should be a constant representing the true value. However, it was incorrectly assumed that -1 represents the true value, when in fact, 1 is the correct representation, so this transformation for this case should be skipped. This vulnerability is fixed in 1.4.1.
- Product
- era-compiler-solidity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2024spaces_plugin/app.py in SolidUI 0.4.0 has an unnecessary print statement for an OpenAI key.CVE-2024-34527 · Other software · cloudorc · reported by MITREHigh 7.5
spaces_plugin/app.py in SolidUI 0.4.0 has an unnecessary print statement for an OpenAI key. The printed string might be logged.
- Product
- solidui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2024lunasvg v2.3.9 was discovered to contain a segmentation violation via the component composition_solid_source_over.CVE-2024-33768 · Other software · sammycage · reported by MITRECritical 9.8
lunasvg v2.3.9 was discovered to contain a segmentation violation via the component composition_solid_source_over.
- Product
- lunasvg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2024lunasvg v2.3.9 was discovered to contain a segmentation violation via the component composition_solid_source.CVE-2024-33767 · Other software · Sammycage · reported by MITREMedium 5
lunasvg v2.3.9 was discovered to contain a segmentation violation via the component composition_solid_source.
- Product
- Lunasvg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2024Solid Affiliate: Insertion of Sensitive Information into Log FileCVE-2024-33637 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Insertion of Sensitive Information into Log File vulnerability in Solid Plugins Solid Affiliate.This issue affects Solid Affiliate: from n/a through 1.9.1.
- Product
- Solid Affiliate
- Affected
- up to 1.9.1
- What to do
- Affects up to 1.9.1. Update Solid Affiliate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 9, 2024A vulnerability has been identified in JT2Go (All versions < V2312.0004), Parasolid V35.1 (All versions < V35.1.254), Parasolid V36.0 (All versions < V36.0.207)CVE-2024-26277 · Other software · Siemens · reported by productcert@siemens.comMedium 4.8
A vulnerability has been identified in JT2Go (All versions < V2312.0004), Parasolid V35.1 (All versions < V35.1.254), Parasolid V36.0 (All versions < V36.0.207), Parasolid V36.1 (All versions < V36.1.147), Teamcenter Visualization V14.2 (All versions < V14.2.0.12), Teamcenter Visualization V14.3 (All versions < V14.3.0.9), Teamcenter Visualization V2312 (All versions < V2312.0004). The affected applications contain a null pointer dereference vulnerability while parsing specially crafted X_T files. An attacker could leverage this vulnerability to crash the application causing denial of service condition.
- Product
- JT2Go
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comcert-portal.siemens.com
Apr 9, 2024A vulnerability has been identified in JT2Go (All versions < V2312.0004), Parasolid V35.1 (All versions < V35.1.254), Parasolid V36.0 (All versions < V36.0.207)CVE-2024-26276 · Other software · Siemens · reported by productcert@siemens.comMedium 4.8
A vulnerability has been identified in JT2Go (All versions < V2312.0004), Parasolid V35.1 (All versions < V35.1.254), Parasolid V36.0 (All versions < V36.0.207), Parasolid V36.1 (All versions < V36.1.147), Teamcenter Visualization V14.2 (All versions < V14.2.0.12), Teamcenter Visualization V14.3 (All versions < V14.3.0.9), Teamcenter Visualization V2312 (All versions < V2312.0004). The affected application contains a stack exhaustion vulnerability while parsing a specially crafted X_T file. This could allow an attacker to cause denial of service condition.
- Product
- JT2Go
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comcert-portal.siemens.com
Apr 9, 2024A vulnerability has been identified in JT2Go (All versions < V2312.0004), Parasolid V35.1 (All versions < V35.1.254), Parasolid V36.0 (All versions < V36.0.207)CVE-2024-26275 · Other software · Siemens · reported by productcert@siemens.comHigh 7.3
A vulnerability has been identified in JT2Go (All versions < V2312.0004), Parasolid V35.1 (All versions < V35.1.254), Parasolid V36.0 (All versions < V36.0.207), Parasolid V36.1 (All versions < V36.1.147), Teamcenter Visualization V14.2 (All versions < V14.2.0.12), Teamcenter Visualization V14.3 (All versions < V14.3.0.9), Teamcenter Visualization V2312 (All versions < V2312.0004). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted X_T files. This could allow an attacker to execute code in the context of the current process.
- Product
- JT2Go
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comcert-portal.siemens.com
Apr 4, 2024Out-Of-Bounds Write, Use of Uninitialized Resource and Use-After-Free vulnerabilities exist in the file reading procedure in eDrawings from Release SOLIDWORKS 2CVE-2024-3299 · Other software · Dassault Systèmes · reported by 3DS.Information-Security@3ds.comHigh 7.8
Out-Of-Bounds Write, Use of Uninitialized Resource and Use-After-Free vulnerabilities exist in the file reading procedure in eDrawings from Release SOLIDWORKS 2023 through Release SOLIDWORKS 2024. These vulnerabilities could allow an attacker to execute arbitrary code while opening a specially crafted SLDDRW or SLDPRT file. NOTE: this vulnerability was SPLIT from CVE-2024-1847.
- Product
- eDrawings
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2024Out-Of-Bounds Write and Type Confusion vulnerabilities exist in the file reading procedure in eDrawings from Release SOLIDWORKS 2023 through Release SOLIDWORKS CVE-2024-3298 · Other software · Dassault Systèmes · reported by 3DS.Information-Security@3ds.comHigh 7.8
Out-Of-Bounds Write and Type Confusion vulnerabilities exist in the file reading procedure in eDrawings from Release SOLIDWORKS 2023 through Release SOLIDWORKS 2024. These vulnerabilities could allow an attacker to execute arbitrary code while opening a specially crafted DWG or DXF. NOTE: this vulnerability was SPLIT from CVE-2024-1847.
- Product
- eDrawings
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 22, 2024Heap-based Buffer Overflow, Memory Corruption, Out-Of-Bounds Read, Out-Of-Bounds Write, Stack-based Buffer Overflow, Type Confusion, Uninitialized Variable, UseCVE-2024-1848 · Other software · Dassault Systèmes · reported by 3DS.Information-Security@3ds.comHigh 7.8
Heap-based Buffer Overflow, Memory Corruption, Out-Of-Bounds Read, Out-Of-Bounds Write, Stack-based Buffer Overflow, Type Confusion, Uninitialized Variable, Use-After-Free vulnerabilities exist in the file reading procedure in SOLIDWORKS Desktop on Release SOLIDWORKS 2024. These vulnerabilities could allow an attacker to execute arbitrary code while opening a specially crafted CATPART, DWG, DXF, IPT, JT, SAT, SLDDRW, SLDPRT, STL, STP, X_B or X_T file.
- Product
- SOLIDWORKS Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2024A vulnerability has been identified in Parasolid V35.0 (All versions < V35.0.251), Parasolid V35.1 (All versions < V35.1.170).CVE-2024-22043 · Other software · Siemens · reported by productcert@siemens.comLow 3.3
A vulnerability has been identified in Parasolid V35.0 (All versions < V35.0.251), Parasolid V35.1 (All versions < V35.1.170). The affected applications contain a null pointer dereference vulnerability while parsing specially crafted XT files. An attacker could leverage this vulnerability to crash the application causing denial of service condition.
- Product
- Parasolid V35.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comcert-portal.siemens.com
Feb 13, 2024A vulnerability has been identified in Parasolid V35.0 (All versions < V35.0.263), Parasolid V35.1 (All versions < V35.1.252), Parasolid V36.0 (All versions < VCVE-2023-49125 · Other software · Siemens · reported by productcert@siemens.comHigh 7.8
A vulnerability has been identified in Parasolid V35.0 (All versions < V35.0.263), Parasolid V35.1 (All versions < V35.1.252), Parasolid V36.0 (All versions < V36.0.198), Solid Edge SE2023 (All versions < V223.0 Update 11), Solid Edge SE2024 (All versions < V224.0 Update 3). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted files containing XT format. This could allow an attacker to execute code in the context of the current process.
- Product
- Parasolid V35.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comcert-portal.siemens.com
Feb 6, 2024libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your apCVE-2024-24577 · Other software · libgit2 · reported by GitHubHigh 8.6
libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Using well-crafted inputs to `git_index_add` can cause heap corruption that could be leveraged for arbitrary code execution. There is an issue in the `has_dir_name` function in `src/libgit2/index.c`, which frees an entry that should not be freed. The freed entry is later used and overwritten with potentially bad actor-controlled data leading to controlled heap corruption. Depending on the application that uses libgit2, this could lead to arbitrary code execution. This issue has been patched in version 1.6.5 and 1.7.2.
- Product
- libgit2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2024libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your apCVE-2024-24575 · Other software · libgit2 · reported by GitHubHigh 7.5
libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Using well-crafted inputs to `git_revparse_single` can cause the function to enter an infinite loop, potentially causing a Denial of Service attack in the calling application. The revparse function in `src/libgit2/revparse.c` uses a loop to parse the user-provided spec string. There is an edge-case during parsing that allows a bad actor to force the loop conditions to access arbitrary memory. Potentially, this could also leak memory if the extracted rev spec is reflected back to the attacker. As such, libgit2 versions before 1.4.0 are not affected. Users should upgrade to version 1.6.5 or 1.7.2.
- Product
- libgit2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2024A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10).CVE-2023-49132 · Other software · Siemens · reported by productcert@siemens.comHigh 7.8
A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected application is vulnerable to uninitialized pointer access while parsing specially crafted PAR files. An attacker could leverage this vulnerability to execute code in the context of the current process.
- Product
- Solid Edge SE2023
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comcert-portal.siemens.com
Jan 9, 2024A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10).CVE-2023-49131 · Other software · Siemens · reported by productcert@siemens.comHigh 7.8
A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected application is vulnerable to uninitialized pointer access while parsing specially crafted PAR files. An attacker could leverage this vulnerability to execute code in the context of the current process.
- Product
- Solid Edge SE2023
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comcert-portal.siemens.com
Jan 9, 2024A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10).CVE-2023-49130 · Other software · Siemens · reported by productcert@siemens.comHigh 7.8
A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected application is vulnerable to uninitialized pointer access while parsing specially crafted PAR files. An attacker could leverage this vulnerability to execute code in the context of the current process.
- Product
- Solid Edge SE2023
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comcert-portal.siemens.com
Jan 9, 2024A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10).CVE-2023-49129 · Other software · Siemens · reported by productcert@siemens.comHigh 7.8
A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected applications contain a stack overflow vulnerability while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.
- Product
- Solid Edge SE2023
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comcert-portal.siemens.com
Jan 9, 2024A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10).CVE-2023-49128 · Other software · Siemens · reported by productcert@siemens.comHigh 7.8
A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted PAR file. This could allow an attacker to execute code in the context of the current process.
- Product
- Solid Edge SE2023
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comcert-portal.siemens.com
Jan 9, 2024A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10).CVE-2023-49127 · Other software · Siemens · reported by productcert@siemens.comHigh 7.8
A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.
- Product
- Solid Edge SE2023
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comcert-portal.siemens.com
Jan 9, 2024A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10).CVE-2023-49126 · Other software · Siemens · reported by productcert@siemens.comHigh 7.8
A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.
- Product
- Solid Edge SE2023
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comcert-portal.siemens.com
Jan 9, 2024A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10).CVE-2023-49124 · Other software · Siemens · reported by productcert@siemens.comHigh 7.8
A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.
- Product
- Solid Edge SE2023
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comcert-portal.siemens.com
Jan 9, 2024A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10).CVE-2023-49123 · Other software · Siemens · reported by productcert@siemens.comHigh 7.8
A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected application is vulnerable to heap-based buffer overflow while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.
- Product
- Solid Edge SE2023
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comcert-portal.siemens.com
Jan 9, 2024A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10).CVE-2023-49122 · Other software · Siemens · reported by productcert@siemens.comHigh 7.8
A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected application is vulnerable to heap-based buffer overflow while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.
- Product
- Solid Edge SE2023
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comcert-portal.siemens.com
Jan 9, 2024A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10).CVE-2023-49121 · Other software · Siemens · reported by productcert@siemens.comHigh 7.8
A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected application is vulnerable to heap-based buffer overflow while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.
- Product
- Solid Edge SE2023
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comcert-portal.siemens.com
Dec 29, 2023Solid Security – Password, Two Factor Authentication, and Brute Force Protection: URL Redirection to Untrusted Site ('Open Redirect')CVE-2023-28786 · WordPress plugins & themes · reported by PatchstackLow 3.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in SolidWP Solid Security – Password, Two Factor Authentication, and Brute Force Protection.This issue affects Solid Security – Password, Two Factor Authentication, and Brute Force Protection: from n/a through 8.1.4.
- Product
- Solid Security – Password, Two Factor Authentication, and Brute Force Protection
- Affected
- up to 8.1.4
- What to do
- Affects up to 8.1.4. Update Solid Security – Password, Two Factor Authentication, and Brute Force Protection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 14, 2023Improper access control in firmware for some Intel(R) Optane(TM) SSD products may allow an unauthenticated user to potentially enable information disclosure viaCVE-2023-27879 · Other software · Intel · reported by secure@intel.comMedium 6.8
Improper access control in firmware for some Intel(R) Optane(TM) SSD products may allow an unauthenticated user to potentially enable information disclosure via physical access.
- Product
- Optane Memory H20 With Solid State Storage Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2023Improper input validation in firmware for some Intel(R) Optane(TM) SSD products may allow a privileged user to potentially enable escalation of privilege via loCVE-2023-27519 · Other software · Intel · reported by secure@intel.comMedium 6.9
Improper input validation in firmware for some Intel(R) Optane(TM) SSD products may allow a privileged user to potentially enable escalation of privilege via local access.
- Product
- Optane Memory H20 With Solid State Storage Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.