Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
864 results · page 4 of 18
Jan 17, 2025Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Newtec NTC2218, NTC2250, NTC2299 on Linux, PowerPC, ARM (Updating signalCVE-2024-13503 · Other software · Newtec/iDirect · reported by vulnerability@ncsc.chCritical 9.5
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Newtec NTC2218, NTC2250, NTC2299 on Linux, PowerPC, ARM (Updating signaling process in the swdownload binary modules) allows Local Execution of Code, Remote Code Inclusion. This issue affects NTC2218, NTC2250, NTC2299: from 1.0.1.1 through 2.2.6.19. The issue is both present on the PowerPC versions of the modem and the ARM versions. A stack buffer buffer overflow in the swdownload binary allows attackers to execute arbitrary code. The parse_INFO function uses an unrestricted `sscanf` to read a string of an incoming network packet into a statically sized buffer.
- Product
- NTC2218, NTC2250, NTC2299
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025Classic Addons – WPBakery Page Builder: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-56286 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in webcodingplace Classic Addons – WPBakery Page Builder classic-addons-wpbakery-page-builder-addons allows PHP Local File Inclusion.This issue affects Classic Addons – WPBakery Page Builder: from n/a through <= 3.0.
- Product
- Classic Addons – WPBakery Page Builder
- Affected
- up to 3.0
- What to do
- Affects up to 3.0. Update Classic Addons – WPBakery Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 19, 2024An issue was discovered in the Webmail Classic UI in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1.CVE-2024-54663 · Email & office · Synacor · reported by MITREHigh 7.5
An issue was discovered in the Webmail Classic UI in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A Local File Inclusion (LFI) vulnerability exists in the /h/rest endpoint, allowing authenticated remote attackers to include and access sensitive files in the WebRoot directory. Exploitation requires a valid auth token and involves crafting a malicious request targeting specific file paths.
- Product
- Zimbra Collaboration Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwiki.zimbra.comwiki.zimbra.com
Dec 13, 2024Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional (Routing Service) allows Overflow Variables andCVE-2024-52066 · Other software · RTI · reported by 3f572a00-62e2-4423-959a-7ea25eff1638High 8.3
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional (Routing Service) allows Overflow Variables and Tags.This issue affects Connext Professional: from 7.4.0 before 7.5.0, from 7.0.0 before 7.3.0.5, from 6.1.0 before 6.1.2.21, from 6.0.0 before 6.0.1.40.
- Product
- Connext Professional
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2024Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional on non-Windows (Persistence Service) allows BufCVE-2024-52065 · Other software · RTI · reported by 3f572a00-62e2-4423-959a-7ea25eff1638Medium 6.9
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional on non-Windows (Persistence Service) allows Buffer Overflow via Environment Variables.This issue affects Connext Professional: from 7.0.0 before 7.3.0.2, from 6.1.1.2 before 6.1.2.21, from 5.3.1.40 before 5.3.1.41.
- Product
- Connext Professional
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2024Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Variables and CVE-2024-52064 · Other software · RTI · reported by 3f572a00-62e2-4423-959a-7ea25eff1638Medium 6.9
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Variables and Tags.This issue affects Connext Professional: from 7.0.0 before 7.3.0.2, from 6.1.0 before 6.1.2.21, from 6.0.0 before 6.0.1.40, from 5.0.0 before 5.3.1.45.
- Product
- Connext Professional
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2024Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional (Core Libraries, Routing Service) allows OverflCVE-2024-52063 · Other software · RTI · reported by 3f572a00-62e2-4423-959a-7ea25eff1638High 8.3
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional (Core Libraries, Routing Service) allows Overflow Variables and Tags.This issue affects Connext Professional: from 7.0.0 before 7.3.0.5, from 6.1.0 before 6.1.2.21, from 6.0.0 before 6.0.1.40, from 5.0.0 before 5.3.1.45.
- Product
- Connext Professional
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2024Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Variables and CVE-2024-52062 · Other software · RTI · reported by 3f572a00-62e2-4423-959a-7ea25eff1638Medium 6.9
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Variables and Tags.This issue affects Connext Professional: from 7.0.0 before 7.3.0.5, from 6.1.0 before 6.1.2.21, from 6.0.0 before 6.0.1.40, from 5.0.0 before 5.3.1.45.
- Product
- Connext Professional
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2024Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional (Core Libraries, Queuing Service, Recording SerCVE-2024-52061 · Other software · RTI · reported by 3f572a00-62e2-4423-959a-7ea25eff1638High 8.3
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional (Core Libraries, Queuing Service, Recording Service, Routing Service) allows Overflow Variables and Tags.This issue affects Connext Professional: from 7.4.0 before 7.5.0, from 7.0.0 before 7.3.0.5, from 6.1.0 before 6.1.2.21, from 6.0.0 before 6.0.1.40, from 5.0.0 before 5.3.1.45.
- Product
- Connext Professional
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2024Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional (Routing Service, Recording Service, Queuing SeCVE-2024-52060 · Other software · RTI · reported by 3f572a00-62e2-4423-959a-7ea25eff1638High 8.3
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional (Routing Service, Recording Service, Queuing Service, Observability Collector Service, Cloud Discovery Service) allows Buffer Overflow via Environment Variables.This issue affects Connext Professional: from 7.0.0 before 7.3.0.5, from 6.1.0 before 6.1.2.21, from 6.0.0 before 6.0.*, from 5.3.0 before 5.3.1.45.
- Product
- Connext Professional
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2024Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Heap-based Buffer Overflow, Integer Overflow or Wraparound vulnerability in RTI Connext CVE-2024-52059 · Other software · RTI · reported by 3f572a00-62e2-4423-959a-7ea25eff1638Medium 6.9
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Heap-based Buffer Overflow, Integer Overflow or Wraparound vulnerability in RTI Connext Professional (Security Plugins) allows Overflow Variables and Tags. This issue affects Connext Professional: from 7.0.0 before 7.3.0.2, from 6.1.0 before 6.1.2.17.
- Product
- Connext Professional
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2024XnSoft XnView Classic RWZ File Parsing Integer Underflow Remote Code Execution Vulnerability.CVE-2024-11950 · Other software · XnSoft · reported by zdi-disclosures@trendmicro.comHigh 8.8
XnSoft XnView Classic RWZ File Parsing Integer Underflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of XnSoft XnView Classic. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of RWZ files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer underflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22913.
- Product
- XnView Classic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2024Classic Addons – WPBakery Page Builder: Limited Local PHP File InclusionCVE-2024-11952 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Classic Addons – WPBakery Page Builder plugin for WordPress is vulnerable to Limited Local PHP File Inclusion in all versions up to, and including, 3.0 via the 'style' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, and permissions granted by an Administrator, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. The vulnerability is limited to PHP files in a Windows environment.
- Product
- Classic Addons – WPBakery Page Builder
- Affected
- up to 3.0
- What to do
- Affects up to 3.0. Update Classic Addons – WPBakery Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 26, 2024Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Apache NimBLE.CVE-2024-47248 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.3
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Apache NimBLE. Specially crafted MESH message could result in memory corruption when non-default build configuration is used. This issue affects Apache NimBLE: through 1.7.0. Users are recommended to upgrade to version 1.8.0, which fixes the issue.
- Product
- Apache NimBLE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.apache.org
Nov 13, 2024Uncontrolled search path for some Intel(R) Fortran Compiler Classic software before version 2021.13 may allow an authenticated user to potentially enable escalaCVE-2024-28881 · Other software · intel · reported by secure@intel.comMedium 5.4
Uncontrolled search path for some Intel(R) Fortran Compiler Classic software before version 2021.13 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- fortran_compiler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 8, 2024SQL injection vulnerability exists in OS4ED openSIS-Classic Version 9.1, specifically in the resetuserinfo.php file.CVE-2024-51211 · Other software · os4ed · reported by MITRECritical 9.8
SQL injection vulnerability exists in OS4ED openSIS-Classic Version 9.1, specifically in the resetuserinfo.php file. The vulnerability is due to improper input validation of the $username_stn_id parameter, which can be manipulated by an attacker to inject arbitrary SQL commands.
- Product
- opensis-classic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2024Classic Editor and Classic Widgets: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-47312 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Grim Classic Editor and Classic Widgets classic-editor-and-classic-widgets allows SQL Injection.This issue affects Classic Editor and Classic Widgets: from n/a through <= 1.4.1.
- Product
- Classic Editor and Classic Widgets
- Affected
- up to 1.4.1
- What to do
- Affects up to 1.4.1. Update Classic Editor and Classic Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 2, 2024OS4ED openSIS-Classic v9.1 was discovered to contain a SQL injection vulnerability via a crafted payload.CVE-2024-46626 · Other software · os4ed · reported by MITREHigh 8.8
OS4ED openSIS-Classic v9.1 was discovered to contain a SQL injection vulnerability via a crafted payload.
- Product
- opensis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 26, 2024Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in vss service component in Synology Drive Client before 3.5.0-16084 allowsCVE-2023-52946 · Network & remote access · Synology · reported by security@synology.comHigh 8.2
Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in vss service component in Synology Drive Client before 3.5.0-16084 allows remote attackers to overwrite trivial buffers and crash the client via unspecified vectors.
- Product
- Synology Drive Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 26, 2024Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in backup task management functionality in Synology Drive Client before 3.4CVE-2022-49041 · Network & remote access · Synology · reported by security@synology.comMedium 4.4
Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in backup task management functionality in Synology Drive Client before 3.4.0-15721 allows local users with administrator privileges to crash the client via unspecified vectors.
- Product
- Synology Drive Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 26, 2024Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in connection management functionality in Synology Drive Client before 3.4.CVE-2022-49040 · Network & remote access · Synology · reported by security@synology.comMedium 4.4
Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in connection management functionality in Synology Drive Client before 3.4.0-15721 allows local users with administrator privileges to crash the client via unspecified vectors.
- Product
- Synology Drive Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2024BT: Classic: SDP OOB access in get_att_search_listCVE-2024-6137 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgHigh 7.6
BT: Classic: SDP OOB access in get_att_search_list
- Product
- Zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2024BT:Classic: Multiple missing buf length checksCVE-2024-6135 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgHigh 7.6
BT:Classic: Multiple missing buf length checks
- Product
- Zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2024Classic Addons – WPBakery Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-43953 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webcodingplace Classic Addons – WPBakery Page Builder classic-addons-wpbakery-page-builder-addons allows Stored XSS.This issue affects Classic Addons – WPBakery Page Builder: from n/a through <= 3.5.
- Product
- Classic Addons – WPBakery Page Builder
- Affected
- up to 3.5
- What to do
- Affects up to 3.5. Update Classic Addons – WPBakery Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 23, 2024Applications that use spring-boot-loader or spring-boot-loader-classic and contain custom code that performs signature verification of nested jar files may be vCVE-2024-38807 · Other software · Spring · reported by security@vmware.comMedium 6.3
Applications that use spring-boot-loader or spring-boot-loader-classic and contain custom code that performs signature verification of nested jar files may be vulnerable to signature forgery where content that appears to have been signed by one signer has, in fact, been signed by another.
- Product
- Spring Boot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordspring.iosecurity.netapp.com
Aug 20, 2024CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability exists that could cause a crash of the Accutech Manager when receiCVE-2024-6918 · Other software · Schneider Electric · reported by cybersecurity@se.comHigh 7.5
CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability exists that could cause a crash of the Accutech Manager when receiving a specially crafted request over port 2536/TCP.
- Product
- Accutech Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.com
Jul 30, 2024Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore.CVE-2024-41109 · Other software · pimcore · reported by GitHubMedium 6.3
Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. Navigating to `/admin/index/statistics` with a logged in Pimcore user exposes information about the Pimcore installation, PHP version, MYSQL version, installed bundles and all database tables and their row count in the system. This vulnerability is fixed in 1.5.2, 1.4.6, and 1.3.10.
- Product
- admin-ui-classic-bundle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2024Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Renesas arm-trusted-firmware allows Local Execution of Code.CVE-2024-6563 · Other software · Renesas · reported by cve@asrg.ioHigh 7.5
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Renesas arm-trusted-firmware allows Local Execution of Code. This vulnerability is associated with program files https://github.Com/renesas-rcar/arm-trusted-firmware/blob/rcar_gen3_v2.5/drivers/renesas/common/io/i... https://github.Com/renesas-rcar/arm-trusted-firmware/blob/rcar_gen3_v2.5/drivers/renesas/common/io/io_rcar.C . In line 313 "addr_loaded_cnt" is checked not to be "CHECK_IMAGE_AREA_CNT" (5) or larger, this check does not halt the function. Immediately after (line 317) there will be an overflow in the buffer and the value of "dst" will be written to the area immediately after the buffer, which is "addr_loaded_cnt". This will allow an attacker to freely control the value of "addr_loaded_cnt" and thus control the destination of the write immediately after (line 318). The write in line 318 will then be fully controlled by said attacker, with whichever address and whichever value ("len") they desire.
- Product
- rcar_gen3_v2.5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2024A vulnerability regarding buffer copy without checking size of input ('Classic Buffer Overflow') is found in the libjansson component and it does not affect theCVE-2024-39349 · Network & remote access · Synology · reported by security@synology.comCritical 9.8
A vulnerability regarding buffer copy without checking size of input ('Classic Buffer Overflow') is found in the libjansson component and it does not affect the upstream library. This allows remote attackers to execute arbitrary code via unspecified vectors. The following models with Synology Camera Firmware versions before 1.0.7-0298 may be affected: BC500 and TC500.
- Product
- Camera Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsynology.comsynology.com
Jun 12, 2024CWE-120: Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’) vulnerability exists that could allow a user with access to the device’s web intCVE-2024-37040 · Other software · Schneider Electric · reported by cybersecurity@se.comMedium 5.4
CWE-120: Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’) vulnerability exists that could allow a user with access to the device’s web interface to cause a fault on the device when sending a malformed HTTP request.
- Product
- Sage 1410
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.comdownload.schneider-electric.com
Jun 4, 2024A vulnerability regarding buffer copy without checking the size of input ('Classic Buffer Overflow') has been found in the login component.CVE-2024-5463 · Network & remote access · Synology · reported by security@synology.comMedium 6.5
A vulnerability regarding buffer copy without checking the size of input ('Classic Buffer Overflow') has been found in the login component. This allows remote attackers to write specific files containing non-sensitive information and conduct limited denial-of-service attacks via unspecified vectors. This attack only affects the login service which will automatically restart. The following models with Synology Camera Firmware versions before 1.1.1-0383 may be affected: BC500 and TC500.
- Product
- Camera Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsynology.comsynology.com
May 21, 2024In the Linux kernel, the following vulnerability has been resolved: cpufreq: CPPC: Fix potential memleak in cppc_cpufreq_cpu_init It's a classic example of meCVE-2021-47313 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 8.4
In the Linux kernel, the following vulnerability has been resolved: cpufreq: CPPC: Fix potential memleak in cppc_cpufreq_cpu_init It's a classic example of memleak, we allocate something, we fail and never free the resources. Make sure we free all resources on policy ->init() failures.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Apr 29, 2024Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Secomea GateManager (webserver modules) allows crash of GateManager.ThisCVE-2024-1969 · Other software · Secomea · reported by VulnerabilityReporting@secomea.comHigh 8.2
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Secomea GateManager (webserver modules) allows crash of GateManager.This issue affects GateManager: from 9.7 before 11.2.624095033.
- Product
- GateManager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecomea.comsecomea.com
Mar 31, 2024Mighty Classic Pros And Cons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-30556 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MightyThemes Mighty Classic Pros And Cons allows Stored XSS.This issue affects Mighty Classic Pros And Cons: from n/a through 2.0.9.
- Product
- Mighty Classic Pros And Cons
- Affected
- up to 2.0.9
- What to do
- Affects up to 2.0.9. Update Mighty Classic Pros And Cons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 16, 2024Authorization bypass can be achieved by session ID prediction in MASmobile Classic Android version 1.16.18 and earlier and MASmobile Classic iOS version 1.7.CVE-2023-36483 · Other software · MAS (a Carrier brand) · reported by productsecurity@carrier.comMedium 6.5
Authorization bypass can be achieved by session ID prediction in MASmobile Classic Android version 1.16.18 and earlier and MASmobile Classic iOS version 1.7.24 and earlier which allows remote attackers to retrieve sensitive data including customer data, security system status, and event history.
- Product
- MASmobile Classic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcorporate.carrier.comcorporate.carrier.com
Feb 19, 2024Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore.CVE-2024-25625 · Other software · pimcore · reported by GitHubHigh 8.1
Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. A potential security vulnerability has been discovered in `pimcore/admin-ui-classic-bundle` prior to version 1.3.4. The vulnerability involves a Host Header Injection in the `invitationLinkAction` function of the UserController, specifically in the way `$loginUrl` trusts user input. The host header from incoming HTTP requests is used unsafely when generating URLs. An attacker can manipulate the HTTP host header in requests to the /admin/user/invitationlink endpoint, resulting in the generation of URLs with the attacker's domain. In fact, if a host header is injected in the POST request, the $loginURL parameter is constructed with this unvalidated host header. It is then used to send an invitation email to the provided user. This vulnerability can be used to perform phishing attacks by making the URLs in the invitation links emails point to an attacker-controlled domain. Version 1.3.4 contains a patch for the vulnerability. The maintainers recommend validating the host header and ensuring it matches the application's domain. It would also be beneficial to use a default trusted host or hostname if the incoming host he
- Product
- admin-ui-classic-bundle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2024Improper buffer restrictions the Intel(R) C++ Compiler Classic before version 2021.8 for Intel(R) oneAPI Toolkits before version 2022.3.1 may allow a privilegedCVE-2023-29162 · Other software · intel · reported by secure@intel.comMedium 6
Improper buffer restrictions the Intel(R) C++ Compiler Classic before version 2021.8 for Intel(R) oneAPI Toolkits before version 2022.3.1 may allow a privileged user to potentially enable escalation of privilege via local access.
- Product
- oneapi_toolkits
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 7, 2024Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore.CVE-2024-24822 · Other software · pimcore · reported by GitHubMedium 6.5
Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. Prior to version 1.3.3, an attacker can create, delete etc. tags without having the permission to do so. A fix is available in version 1.3.3. As a workaround, one may apply the patch manually.
- Product
- admin-ui-classic-bundle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 24, 2024Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore.CVE-2024-23646 · Other software · pimcore · reported by GitHubHigh 8.8
Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. The application allows users to create zip files from available files on the site. In the 1.x branch prior to version 1.3.2, parameter `selectedIds` is susceptible to SQL Injection. Any backend user with very basic permissions can execute arbitrary SQL statements and thus alter any data or escalate their privileges to at least admin level. Version 1.3.2 contains a fix for this issue.
- Product
- admin-ui-classic-bundle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 24, 2024Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore.CVE-2024-23648 · Other software · pimcore · reported by GitHubHigh 8.8
Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. The password reset functionality sends to the the user requesting a password change an email containing an URL to reset its password. The URL sent contains a unique token, valid during 24 hours, allowing the user to reset its password. This token is highly sensitive ; as an attacker able to retrieve it would be able to resets the user's password. Prior to version 1.2.3, the reset-password URL is crafted using the "Host" HTTP header of the request sent to request a password reset. This way, an external attacker could send password requests for users, but specify a "Host" header of a website that they control. If the user receiving the mail clicks on the link, the attacker would retrieve the reset token of the victim and perform account takeover. Version 1.2.3 fixes this issue.
- Product
- admin-ui-classic-bundle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2024Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Hancom HCell on Windows allows Overflow Buffers.This issue affects HCellCVE-2023-40250 · Other software · Hancom · reported by vuln@krcert.or.krHigh 8.8
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Hancom HCell on Windows allows Overflow Buffers.This issue affects HCell: 12.0.0.893.
- Product
- HCell
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2023XnView Classic before 2.51.3 on Windows has a Write Access Violation at xnview.exe+0x3125D6.CVE-2023-52174 · Other software · Xnview · reported by MITRECritical 9.8
XnView Classic before 2.51.3 on Windows has a Write Access Violation at xnview.exe+0x3125D6.
- Product
- Xnview Classic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnewsgroup.xnview.com
Dec 28, 2023XnView Classic before 2.51.3 on Windows has a Write Access Violation at xnview.exe+0x3ADBD0.CVE-2023-52173 · Other software · Xnview · reported by MITRECritical 9.8
XnView Classic before 2.51.3 on Windows has a Write Access Violation at xnview.exe+0x3ADBD0.
- Product
- Xnview Classic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnewsgroup.xnview.com
Dec 14, 2023lockss-daemon (aka Classic LOCKSS Daemon) before 1.77.3 performs post-Unicode normalization, which may allow bypass of intended access restrictions, such as wheCVE-2023-42183 · Other software · Lockss · reported by MITREMedium 5.3
lockss-daemon (aka Classic LOCKSS Daemon) before 1.77.3 performs post-Unicode normalization, which may allow bypass of intended access restrictions, such as when U+1FEF is converted to a backtick.
- Product
- Classic Lockss Daemon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 14, 2023Download of Code Without Integrity Check vulnerability in PHOENIX CONTACT classic line PLCs allows an unauthenticated remote attacker to modify some or all applCVE-2023-46143 · Other software · PHOENIX CONTACT · reported by info@cert.vde.comHigh 7.5
Download of Code Without Integrity Check vulnerability in PHOENIX CONTACT classic line PLCs allows an unauthenticated remote attacker to modify some or all applications on a PLC.
- Product
- Automation Worx Software Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcert.vde.com
Dec 14, 2023Incorrect Permission Assignment for Critical Resource vulnerability in multiple products of the PHOENIX CONTACT classic line allow an remote unauthenticated attCVE-2023-46141 · Other software · PHOENIX CONTACT · reported by info@cert.vde.comCritical 9.8
Incorrect Permission Assignment for Critical Resource vulnerability in multiple products of the PHOENIX CONTACT classic line allow an remote unauthenticated attacker to gain full access of the affected device.
- Product
- Automation Worx Software Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcert.vde.com
Dec 3, 2023In display, there is a possible classic buffer overflow due to a missing bounds check.CVE-2023-32860 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comMedium 6.7
In display, there is a possible classic buffer overflow due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07929788; Issue ID: ALPS07929788.
- Product
- MT6761, MT6765, MT6768, MT6779, MT6781, MT6785, MT6789, MT6833, MT6835, MT6853, MT6855, MT6873, MT6877, MT6879, MT6883, MT6885, MT6886, MT6889, MT6893, MT6895,
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcorp.mediatek.comcorp.mediatek.com
Dec 3, 2023In meta, there is a possible classic buffer overflow due to a missing bounds check.CVE-2023-32859 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comMedium 6.7
In meta, there is a possible classic buffer overflow due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08000473; Issue ID: ALPS08000473.
- Product
- MT6761, MT6765, MT6768, MT6779, MT6781, MT6785, MT6789, MT6833, MT6835, MT6853, MT6855, MT6873, MT6877, MT6879, MT6883, MT6885, MT6886, MT6889, MT6893, MT6895,
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcorp.mediatek.comcorp.mediatek.com
Nov 28, 2023The Admin Classic Bundle provides a Backend UI for Pimcore.CVE-2023-49075 · Other software · pimcore · reported by GitHubHigh 8.4
The Admin Classic Bundle provides a Backend UI for Pimcore. `AdminBundle\Security\PimcoreUserTwoFactorCondition` introduced in v11 disable the two factor authentication for all non-admin security firewalls. An authenticated user can access the system without having to provide the two factor credentials. This issue has been patched in version 1.2.2.
- Product
- admin-ui-classic-bundle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2023OpenSIS Classic Community Edition version 9.0 lacks cross-site request forgery (CSRF) protection throughout the whole app.CVE-2023-38885 · Other software · Os4ed · reported by MITREHigh 8.8
OpenSIS Classic Community Edition version 9.0 lacks cross-site request forgery (CSRF) protection throughout the whole app. This may allow an attacker to trick an authenticated user into performing any kind of state changing request.
- Product
- Opensis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.