Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
5,528 results · page 36 of 111
Dec 13, 2024Image Widget: Does not sanitise and escape some of its Image Widget settingsCVE-2024-10939 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Image Widget WordPress plugin before 4.4.11 does not sanitise and escape some of its Image Widget settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Image Widget
- Fixed in
- 4.4.11
- What to do
- Update Image Widget to 4.4.11 or newer.
Dec 12, 2024An authenticated attacker with the user/role "Poweruser" can perform an SQL injection by accessing the /class/template_io.php file and supplying malicious GET pCVE-2024-50584 · Other software · Image Access GmbH · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfMedium 4.4
An authenticated attacker with the user/role "Poweruser" can perform an SQL injection by accessing the /class/template_io.php file and supplying malicious GET parameters. The "templates" parameter is vulnerable against blind boolean-based SQL injection attacks. SQL syntax must be injected into the JSON syntax of the templates parameter.
- Product
- Scan2Net
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordr.sec-consult.comimageaccess.de
Dec 12, 2024The application uses several hard-coded credentials to encrypt config files during backup, to decrypt the new firmware during an update and some passwords allowCVE-2024-28146 · Other software · Image Access GmbH · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfHigh 8.4
The application uses several hard-coded credentials to encrypt config files during backup, to decrypt the new firmware during an update and some passwords allow a direct connection to the database server of the affected device.
- Product
- Scan2Net
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordr.sec-consult.comimageaccess.de
Dec 12, 2024An unauthenticated attacker can perform an SQL injection by accessing the /class/dbconnect.php file and supplying malicious GET parameters.CVE-2024-28145 · Other software · Image Access GmbH · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfMedium 5.9
An unauthenticated attacker can perform an SQL injection by accessing the /class/dbconnect.php file and supplying malicious GET parameters. The HTTP GET parameters search, table, field, and value are vulnerable. For example, one SQL injection can be performed on the parameter "field" with the UNION keyword.
- Product
- Scan2Net
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordr.sec-consult.comimageaccess.de
Dec 12, 2024An attacker who can spoof the IP address and the User-Agent of a logged-in user can takeover the session because of flaws in the self-developed session managemeCVE-2024-28144 · Other software · Image Access GmbH · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfMedium 5.5
An attacker who can spoof the IP address and the User-Agent of a logged-in user can takeover the session because of flaws in the self-developed session management. If two users access the web interface from the same IP they are logged in as the other user.
- Product
- Scan2Net
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordr.sec-consult.comimageaccess.de
Dec 12, 2024The password change function at /cgi/admin.cgi does not require the current/old password, which makes the application vulnerable to account takeover.CVE-2024-28143 · Other software · Image Access GmbH · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfHigh 8.4
The password change function at /cgi/admin.cgi does not require the current/old password, which makes the application vulnerable to account takeover. An attacker can use this to forcefully set a new password within the -rsetpass+-aaction+- parameter for a user without knowing the old password, e.g. by exploiting a CSRF issue.
- Product
- Scan2Net
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordr.sec-consult.comimageaccess.de
Dec 12, 2024Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users.CVE-2024-47947 · Other software · Image Access GmbH · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfMedium 4.7
Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The "Edit Disclaimer Text" function of the configuration menu is vulnerable to stored XSS. Only the users Poweruser and Admin can use this function which is available at the URL https://$SCANNER/cgi/admin.cgi?-rdisclaimer+-apre The stored Javascript payload will be executed every time the ScanWizard is loaded, even in the Kiosk-mode browser.
- Product
- Scan2Net
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordr.sec-consult.comimageaccess.de
Dec 12, 2024Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users.CVE-2024-36498 · Other software · Image Access GmbH · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfMedium 4.7
Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The "Edit Disclaimer Text" function of the configuration menu is vulnerable to stored XSS. Only the users Poweruser and Admin can use this function which is available at the URL https://$SCANNER/cgi/admin.cgi?-rdisclaimer+-apre The stored Javascript payload will be executed every time the ScanWizard is loaded, even in the Kiosk-mode browser. Version 7.40 implemented a fix, but it could be bypassed via URL-encoding the Javascript payload again.
- Product
- Scan2Net
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordr.sec-consult.comimageaccess.de
Dec 12, 2024Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users.CVE-2024-36494 · Other software · Image Access GmbH · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfMedium 4.7
Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The login page at /cgi/slogin.cgi suffers from XSS due to improper input filtering of the -tsetup+-uuser parameter, which can only be exploited if the target user is not already logged in. This makes it ideal for login form phishing attempts.
- Product
- Scan2Net
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordr.sec-consult.comimageaccess.de
Dec 12, 2024Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users.CVE-2024-28142 · Other software · Image Access GmbH · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfMedium 4.7
Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The "File Name" page (/cgi/uset.cgi?-cfilename) in the User Settings menu improperly filters the "file name" and wildcard character input field. By exploiting the wildcard character feature, attackers are able to store arbitrary Javascript code which is being triggered if the page is viewed afterwards, e.g. by higher privileged users such as admins. This attack can even be performed without being logged in because the affected functions are not fully protected. Without logging in, only the file name parameter of the "Default" User can be changed.
- Product
- Scan2Net
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordr.sec-consult.comimageaccess.de
Dec 12, 2024Read/Write vulnerability in the image decoding module Impact: Successful exploitation of this vulnerability will affect availability.CVE-2024-54111 · Other software · Huawei · reported by psirt@huawei.comMedium 5.7
Read/Write vulnerability in the image decoding module Impact: Successful exploitation of this vulnerability will affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2024Read/Write vulnerability in the image decoding module Impact: Successful exploitation of this vulnerability will affect availability.CVE-2024-54109 · Other software · Huawei · reported by psirt@huawei.comMedium 6.5
Read/Write vulnerability in the image decoding module Impact: Successful exploitation of this vulnerability will affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2024Read/Write vulnerability in the image decoding module Impact: Successful exploitation of this vulnerability will affect availability.CVE-2024-54108 · Other software · Huawei · reported by psirt@huawei.comMedium 6.5
Read/Write vulnerability in the image decoding module Impact: Successful exploitation of this vulnerability will affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2024Read/Write vulnerability in the image decoding module Impact: Successful exploitation of this vulnerability will affect availability.CVE-2024-54107 · Other software · Huawei · reported by psirt@huawei.comHigh 7.1
Read/Write vulnerability in the image decoding module Impact: Successful exploitation of this vulnerability will affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2024Null pointer dereference vulnerability in the image decoding module Impact: Successful exploitation of this vulnerability will affect availability.CVE-2024-54106 · Other software · Huawei · reported by psirt@huawei.comHigh 7.1
Null pointer dereference vulnerability in the image decoding module Impact: Successful exploitation of this vulnerability will affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2024Read/Write vulnerability in the image decoding module Impact: Successful exploitation of this vulnerability will affect availability.CVE-2024-54105 · Other software · Huawei · reported by psirt@huawei.comMedium 5.1
Read/Write vulnerability in the image decoding module Impact: Successful exploitation of this vulnerability will affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2024Horizontal scroll image slideshow: Stored Cross-Site ScriptingCVE-2024-11442 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Horizontal scroll image slideshow plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'horizontal-scroll-image-slideshow' shortcode in all versions up to, and including, 10.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Horizontal scroll image slideshow
- Affected
- up to 10.1
- What to do
- Affects up to 10.1. Update Horizontal scroll image slideshow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Dec 11, 2024The web application is not protected against cross-site request forgery attacks.CVE-2024-28141 · Other software · Image Access GmbH · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfMedium 6.3
The web application is not protected against cross-site request forgery attacks. Therefore, an attacker can trick users into performing actions on the application when they visit an attacker-controlled website or click on a malicious link. E.g. an attacker can forge malicious links to reset the admin password or create new users.
- Product
- Scan2Net
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordr.sec-consult.comimageaccess.de
Dec 11, 2024The scanner device boots into a kiosk mode by default and opens the Scan2Net interface in a browser window.CVE-2024-28140 · Other software · Image Access GmbH · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfMedium 6.1
The scanner device boots into a kiosk mode by default and opens the Scan2Net interface in a browser window. This browser is run with the permissions of the root user. There are also several other applications running as root user. This can be confirmed by running "ps aux" as the root user and observing the output.
- Product
- Scan2Net
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordr.sec-consult.comimageaccess.de
Dec 11, 2024The www-data user can elevate its privileges because sudo is configured to allow the execution of the mount command as root without a password.CVE-2024-28139 · Other software · Image Access GmbH · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfHigh 8.8
The www-data user can elevate its privileges because sudo is configured to allow the execution of the mount command as root without a password. Therefore, the privileges can be escalated to the root user. The risk has been accepted by the vendor and won't be fixed in the near future.
- Product
- Scan2Net
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordr.sec-consult.comseclists.org
Dec 10, 2024If the attacker has access to a valid Poweruser session, remote code execution is possible because specially crafted valid PNG files with injected PHP content cCVE-2024-47946 · Other software · Image Access GmbH · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfHigh 7.2
If the attacker has access to a valid Poweruser session, remote code execution is possible because specially crafted valid PNG files with injected PHP content can be uploaded as desktop backgrounds or lock screens. After the upload, the PHP script is available in the web root. The PHP code executes once the uploaded file is accessed. This allows the execution of arbitrary PHP code and OS commands on the device as "www-data".
- Product
- Scan2Net
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordr.sec-consult.comimageaccess.de
Dec 10, 2024An unauthenticated attacker with network access to the affected device's web interface can execute any system command via the "msg_events.php" script as the wwwCVE-2024-28138 · Other software · Image Access GmbH · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfHigh 7.3
An unauthenticated attacker with network access to the affected device's web interface can execute any system command via the "msg_events.php" script as the www-data user. The HTTP GET parameter "data" is not properly sanitized.
- Product
- Scan2Net
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordr.sec-consult.comimageaccess.de
Dec 9, 2024Acme Fix Images: Missing AuthorizationCVE-2023-47793 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Acme Themes Acme Fix Images acme-fix-images allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Acme Fix Images: from n/a through <= 1.0.0.
- Product
- Acme Fix Images
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Acme Fix Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Branded Social Images: Missing AuthorizationCVE-2023-28536 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Acato Branded Social Images allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Branded Social Images: from n/a through 1.1.0.
- Product
- Branded Social Images
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Branded Social Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Album and Image Gallery plus Lightbox: Missing AuthorizationCVE-2023-25060 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP OnlineSupport, Essential Plugin Album and Image Gallery plus Lightbox allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Album and Image Gallery plus Lightbox: from n/a through 1.6.2.
- Product
- Album and Image Gallery plus Lightbox
- Affected
- up to 1.6.2
- What to do
- Affects up to 1.6.2. Update Album and Image Gallery plus Lightbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Kraken.io Image Optimizer: Missing AuthorizationCVE-2023-22708 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Karim Salman Kraken.io Image Optimizer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kraken.io Image Optimizer: from n/a through 2.6.7.
- Product
- Kraken.io Image Optimizer
- Affected
- up to 2.6.7
- What to do
- Affects up to 2.6.7. Update Kraken.io Image Optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 6, 2024Poll Maker – Versus Polls, Anonymous Polls, Image Polls: Cross-Site Request ForgeryCVE-2024-12115 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.5.4. This is due to missing or incorrect nonce validation on the duplicate_poll() function. This makes it possible for unauthenticated attackers to duplicate polls via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Poll Maker – Versus Polls, Anonymous Polls, Image Polls
- Affected
- up to 5.5.4
- What to do
- Affects up to 5.5.4. Update Poll Maker – Versus Polls, Anonymous Polls, Image Polls to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 6, 2024openwrt/asu is an image on demand server for OpenWrt based distributions.CVE-2024-54143 · Other software · openwrt · reported by GitHubCritical 9.3
openwrt/asu is an image on demand server for OpenWrt based distributions. The request hashing mechanism truncates SHA-256 hashes to only 12 characters. This significantly reduces entropy, making it feasible for an attacker to generate collisions. By exploiting this, a previously built malicious image can be served in place of a legitimate one, allowing the attacker to "poison" the artifact cache and deliver compromised images to unsuspecting users. This can be combined with other attacks, such as a command injection in Imagebuilder that allows malicious users to inject arbitrary commands into the build process, resulting in the production of malicious firmware images signed with the legitimate build key. This has been patched with 920c8a1.
- Product
- asu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2024In buildImageItemsIfPossible of ItemTable.cpp there is a possible out of bound read due to uninitialized data.CVE-2018-9429 · Computers, phones & browsers · Google · reported by security@android.comMedium 6.5
In buildImageItemsIfPossible of ItemTable.cpp there is a possible out of bound read due to uninitialized data. This could lead to information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2024Image horizontal reel scroll slideshow: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52492 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gopiplus Image horizontal reel scroll slideshow image-horizontal-reel-scroll-slideshow allows Stored XSS.This issue affects Image horizontal reel scroll slideshow: from n/a through <= 13.4.
- Product
- Image horizontal reel scroll slideshow
- Affected
- up to 13.4
- What to do
- Affects up to 13.4. Update Image horizontal reel scroll slideshow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 1, 2024Elementor Image Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53744 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SkyBootstrap Elementor Image Gallery Plugin skyboot-portfolio-gallery allows Stored XSS.This issue affects Elementor Image Gallery Plugin: from n/a through <= 1.0.5.
- Product
- Elementor Image Gallery
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Elementor Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 29, 2024moby v25.0.0 - v26.0.2 is vulnerable to NULL Pointer Dereference via daemon/images/image_history.go.CVE-2024-36620 · Other software · Mobyproject · reported by MITREMedium 6.5
moby v25.0.0 - v26.0.2 is vulnerable to NULL Pointer Dereference via daemon/images/image_history.go.
- Product
- Moby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Nov 28, 2024Image Alt Text: Unauthorized modification of data|CVE-2024-11918 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Image Alt Text plugin for WordPress is vulnerable to unauthorized modification of data| due to a missing capability check on the iat_add_alt_txt_action and iat_update_alt_txt_action AJAX actions in all versions up to, and including, 2.0.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to update the alt text on arbitrary images.
- Product
- Image Alt Text
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update Image Alt Text to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 26, 2024An image with a version lower than the fuse version may potentially be booted lead to improper authentication.CVE-2018-11952 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 8.4
An image with a version lower than the fuse version may potentially be booted lead to improper authentication.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 26, 202451l3nc3, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API managedoverlayimages.cgi was vulnerable to a race condition attack allowing for CVE-2024-8772 · Other software · Axis Communications AB · reported by product-security@axis.comMedium 4.3
51l3nc3, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API managedoverlayimages.cgi was vulnerable to a race condition attack allowing for an attacker to block access to the overlay configuration page in the web interface of the Axis device. This flaw can only be exploited after authenticating with an operator- or administrator-privileged service account. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.
- Product
- AXIS OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 25, 2024Photo Gallery, Sliders, Proofing and: Does not sanitise and escape some of its Images settingsCVE-2024-6393 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Photo Gallery, Sliders, Proofing and WordPress plugin before 3.59.5 does not sanitise and escape some of its Images settings, which could allow high privilege users such as Admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Photo Gallery, Sliders, Proofing and
- Fixed in
- 3.59.5
- What to do
- Update Photo Gallery, Sliders, Proofing and to 3.59.5 or newer.
Nov 24, 2024The Imager package before 1.025 for Perl has a heap-based buffer overflow leading to denial of service, or possibly unspecified other impact, when the trim() meCVE-2024-53901 · Other software · Tonycoz · reported by MITREMedium 5.5
The Imager package before 1.025 for Perl has a heap-based buffer overflow leading to denial of service, or possibly unspecified other impact, when the trim() method is called on a crafted input image.
- Product
- Imager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024FastStone Image Viewer GIF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.CVE-2024-9114 · Other software · FastStone · reported by zdi-disclosures@trendmicro.comHigh 7.8
FastStone Image Viewer GIF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of FastStone Image Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of GIF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25145.
- Product
- Image Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024FastStone Image Viewer TGA File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.CVE-2024-9113 · Other software · FastStone · reported by zdi-disclosures@trendmicro.comHigh 7.8
FastStone Image Viewer TGA File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of FastStone Image Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TGA files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25140.
- Product
- Image Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024FastStone Image Viewer PSD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.CVE-2024-9112 · Other software · FastStone · reported by zdi-disclosures@trendmicro.comHigh 7.8
FastStone Image Viewer PSD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of FastStone Image Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PSD files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25102.
- Product
- Image Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2024Media File Rename, Find Unused File, Add Alt text, Caption, Desc For Image SEO: Does not sanitise uploaded SVG filesCVE-2024-10482 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Media File Rename, Find Unused File, Add Alt text, Caption, Desc For Image SEO WordPress plugin before 1.5.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.
- Product
- Media File Rename, Find Unused File, Add Alt text, Caption, Desc For Image SEO
- Fixed in
- 1.5.0
- What to do
- Update Media File Rename, Find Unused File, Add Alt text, Caption, Desc For Image SEO to 1.5.0 or newer.
Nov 20, 2024File Upload vulnerability in change-image.php in Anuj Kumar's Boat Booking System version 1.0 allows local attackers to upload a malicious PHP script via the ImCVE-2024-51208 · Websites & servers · phpgurukul · reported by MITREHigh 7.2
File Upload vulnerability in change-image.php in Anuj Kumar's Boat Booking System version 1.0 allows local attackers to upload a malicious PHP script via the Image Upload Mechanism parameter.
- Product
- boat_booking_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comphpgurukul.com
Nov 20, 2024Image Optimizer, Resizer and CDN – Sirv: Unauthorized modification of data that can lead to a denial of serviceCVE-2024-10855 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Image Optimizer, Resizer and CDN – Sirv plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to insufficient validation on the filename parameter of the sirv_upload_file_by_chunks() function and lack of in all versions up to, and including, 7.3.0. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary option values on the WordPress site. This can be leveraged to delete an option that would create an error on the site and deny service to legitimate users.
- Product
- Image Optimizer, Resizer and CDN – Sirv
- Affected
- up to 7.3.0
- What to do
- Affects up to 7.3.0. Update Image Optimizer, Resizer and CDN – Sirv to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 19, 2024Fast Video and Image Display: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51935 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sam Perrow Fast Video and Image Display fast-video-and-image-display allows DOM-Based XSS.This issue affects Fast Video and Image Display: from n/a through <= 2.5.2.
- Product
- Fast Video and Image Display
- Affected
- up to 2.5.2
- What to do
- Affects up to 2.5.2. Update Fast Video and Image Display to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 19, 2024drop in image slideshow gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51914 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gopiplus drop in image slideshow gallery drop-in-image-slideshow-gallery allows DOM-Based XSS.This issue affects drop in image slideshow gallery: from n/a through <= 12.0.
- Product
- drop in image slideshow gallery
- Affected
- up to 12.0
- What to do
- Affects up to 12.0. Update drop in image slideshow gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 19, 2024Image Carousel Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51842 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sazzad Image Carousel Shortcode image-carousel-shortcode allows DOM-Based XSS.This issue affects Image Carousel Shortcode: from n/a through <= 1.2.
- Product
- Image Carousel Shortcode
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Image Carousel Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 19, 2024Wd-image-magnifier-xoss: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51840 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rezaul Wd-image-magnifier-xoss wd-image-magnifier-xoss allows DOM-Based XSS.This issue affects Wd-image-magnifier-xoss: from n/a through <= 1.0.
- Product
- Wd-image-magnifier-xoss
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Wd-image-magnifier-xoss to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 19, 2024Popup Image: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51811 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hussam Hussien Popup Image popup-image allows Stored XSS.This issue affects Popup Image: from n/a through <= 1.0.1.
- Product
- Popup Image
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Popup Image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 19, 2024Parallax Image: Stored Cross-Site ScriptingCVE-2024-11224 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Parallax Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘position’ parameter in all versions up to, and including, 1.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Parallax Image
- Affected
- up to 1.9
- What to do
- Affects up to 1.9. Update Parallax Image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 18, 2024A vulnerability in the Image Signature Verification feature of Cisco SD-WAN Software could allow an authenticated, remote attacker with Administrator-levelCVE-2021-1461 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4.9
A vulnerability in the Image Signature Verification feature of Cisco SD-WAN Software could allow an authenticated, remote attacker with Administrator-level credentials to install a malicious software patch on an affected device. The vulnerability is due to improper verification of digital signatures for patch images. An attacker could exploit this vulnerability by crafting an unsigned software patch to bypass signature checks and loading it on an affected device. A successful exploit could allow the attacker to boot a malicious software patch image.Cisco has released software updates that address the vulnerability described in this advisory. There are no workarounds that address this vulnerability.
- Product
- Cisco Catalyst SD-WAN Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.comsec.cloudapps.cisco.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.