Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
365 results · page 4 of 8
Feb 26, 2025In the Linux kernel, the following vulnerability has been resolved: net: dsa: felix: fix possible NULL pointer dereference As the possible failure of the alloCVE-2022-49141 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: net: dsa: felix: fix possible NULL pointer dereference As the possible failure of the allocation, kzalloc() may return NULL pointer. Therefore, it should be better to check the 'sgi' in order to prevent the dereference of NULL pointer.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Feb 11, 2025Ash Authentication is an authentication framework for Elixir applications.CVE-2025-25202 · Other software · team-alembic · reported by GitHubMedium 6.3
Ash Authentication is an authentication framework for Elixir applications. Applications which have been bootstrapped by the igniter installer present since AshAuthentication v4.1.0 and who have used the magic link strategy _or_ are manually revoking tokens are affected by revoked tokens being allowed to verify as valid. Unless one hase implemented any kind of custom token revocation feature in your application, then one will not be affected. The impact here for users using builtin functionality is that magic link tokens are reusable until they expire. With that said, magic link tokens are only valid for 10 minutes, so the surface area for abuse is extremely low here. The flaw is patched in version 4.4.9. Additionally a compile time warning is shown to users with remediation instructions if they upgrade. 4.4.9 ships with an upgrader, so those who use `mix igniter.upgrade ash_authentication` will have the necessary patch applied. Otherwise, one may run the upgrader manually as described in the error message. As a workaround, delete the generated `:revoked?` generic action in the token resource. This will cause it to use the one internal to Ash Authentication which has always been cor
- Product
- ash_authentication
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2025Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Felix Webconsole.CVE-2025-25247 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Felix Webconsole. This issue affects Apache Felix Webconsole 4.x up to 4.9.8 and 5.x up to 5.0.8. Users are recommended to upgrade to version 4.9.10 or 5.0.10 or higher, which fixes the issue.
- Product
- Apache Felix Webconsole
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Jan 29, 2025An attacker with access to an HX 10.0.0 and previous versions, may send specially-crafted data to the HX console.CVE-2025-0617 · Other software · Trellix · reported by trellixpsirt@trellix.comMedium 5.9
An attacker with access to an HX 10.0.0 and previous versions, may send specially-crafted data to the HX console. The malicious detection would then trigger file parsing containing exponential entity expansions in the consumer process thus causing a Denial of Service.
- Product
- Trellix HX Console
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 20, 2024Cross-site scripting vulnerability in Trellix ePolicy Orchestrator prior to ePO 5.10 Service Pack 1 Update 3 allows a remote authenticated attacker to craft reqCVE-2024-5955 · Other software · Trellix · reported by trellixpsirt@trellix.comMedium 5.4
Cross-site scripting vulnerability in Trellix ePolicy Orchestrator prior to ePO 5.10 Service Pack 1 Update 3 allows a remote authenticated attacker to craft requests causing arbitrary content to be injected into the response when accessing the epolicy Orchestrator.
- Product
- ePO Onprem Sp1 Update4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2024A Hardcoded Cryptographic key vulnerability existed in DLP Extension 11.11.1.3 which allowed the decryption of previously encrypted user credentials.CVE-2024-9679 · Other software · Trellix · reported by trellixpsirt@trellix.comMedium 5.3
A Hardcoded Cryptographic key vulnerability existed in DLP Extension 11.11.1.3 which allowed the decryption of previously encrypted user credentials.
- Product
- DLP Extension
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2024An SQL Injection vulnerability existed in DLP Extension 11.11.1.3.CVE-2024-9678 · Other software · Trellix · reported by trellixpsirt@trellix.comMedium 4.9
An SQL Injection vulnerability existed in DLP Extension 11.11.1.3. The vulnerability allowed an attacker to perform arbitrary SQL queries potentially leading to command execution.
- Product
- DLP Extension
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2024Flixita: Reflected Cross-Site ScriptingCVE-2024-10836 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Flixita theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 1.0.82 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Flixita
- Affected
- up to 1.0.82
- What to do
- Affects up to 1.0.82. Update Flixita to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemes.trac.wordpress.orgthemes.trac.wordpress.org
Nov 29, 2024A vulnerability in ESM 11.6.10 allows unauthenticated access to the internal Snowservice API and enables remote code execution through command injection, executCVE-2024-11482 · Other software · Trellix · reported by trellixpsirt@trellix.comCritical 9.8
A vulnerability in ESM 11.6.10 allows unauthenticated access to the internal Snowservice API and enables remote code execution through command injection, executed as the root user.
- Product
- Trellix Enterprise Security Manager (ESM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordthrive.trellix.comhackerone.com
Nov 29, 2024A vulnerability in ESM 11.6.10 allows unauthenticated access to the internal Snowservice API.CVE-2024-11481 · Other software · Trellix · reported by trellixpsirt@trellix.comHigh 8.2
A vulnerability in ESM 11.6.10 allows unauthenticated access to the internal Snowservice API. This leads to improper handling of path traversal, insecure forwarding to an AJP backend without adequate validation, and lack of authentication for accessing internal API endpoints.
- Product
- Trellix Enterprise Security Manager (ESM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2024In Helix Core versions prior to 2024.2, an unauthenticated remote Denial of Service (DoS) via the shutdown function was identified.CVE-2024-10345 · Other software · Helix · reported by security@puppet.comHigh 8.7
In Helix Core versions prior to 2024.2, an unauthenticated remote Denial of Service (DoS) via the shutdown function was identified. Reported by Karol Więsek.
- Product
- Helix Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2024In Helix Core versions prior to 2024.2, an unauthenticated remote Denial of Service (DoS) via the refuse function was identified.CVE-2024-10344 · Other software · Helix · reported by security@puppet.comHigh 8.7
In Helix Core versions prior to 2024.2, an unauthenticated remote Denial of Service (DoS) via the refuse function was identified. Reported by Karol Więsek.
- Product
- Helix Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2024In Helix Core versions prior to 2024.2, an unauthenticated remote Denial of Service (DoS) via the auto-generation function was identified.CVE-2024-10314 · Other software · Helix · reported by security@puppet.comHigh 8.7
In Helix Core versions prior to 2024.2, an unauthenticated remote Denial of Service (DoS) via the auto-generation function was identified. Reported by Karol Więsek.
- Product
- Helix Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2024Fujian Kelixin Communication Command and Dispatch Platform <=7.6.6.4391 is vulnerable to SQL Injection via /client/get_gis_fence.php.CVE-2024-45918 · Other software · kirisun · reported by MITRECritical 9.8
Fujian Kelixin Communication Command and Dispatch Platform <=7.6.6.4391 is vulnerable to SQL Injection via /client/get_gis_fence.php.
- Product
- command_and_dispatch_platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comkirisun.com
Sep 27, 2024A path traversal issue in E2Nest prior to commit 8a41948e553c89c56b14410c6ed395e9cfb9250aCVE-2024-9301 · Other software · Netflix · reported by security-report@netflix.comHigh 8.7
A path traversal issue in E2Nest prior to commit 8a41948e553c89c56b14410c6ed395e9cfb9250a
- Product
- E2Nest
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2024In versions of Helix Core prior to 2024.1 Patch 2 (2024.1/2655224) a Windows ANSI API Unicode "best fit" argument injection was identified.CVE-2024-8067 · Other software · Helix · reported by security@puppet.comMedium 5.8
In versions of Helix Core prior to 2024.1 Patch 2 (2024.1/2655224) a Windows ANSI API Unicode "best fit" argument injection was identified.
- Product
- Helix Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2024This vulnerability allows unauthenticated remote attackers to bypass authentication and gain APIs access of the Manager.CVE-2024-5957 · Other software · Trellix · reported by trellixpsirt@trellix.comMedium 6.3
This vulnerability allows unauthenticated remote attackers to bypass authentication and gain APIs access of the Manager.
- Product
- Intrusion Prevention System (IPS) Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2024This vulnerability allows unauthenticated remote attackers to bypass authentication and gain partial data access to the vulnerable Trellix IPS Manager with garbCVE-2024-5956 · Other software · Trellix · reported by trellixpsirt@trellix.comMedium 6.5
This vulnerability allows unauthenticated remote attackers to bypass authentication and gain partial data access to the vulnerable Trellix IPS Manager with garbage data in response mostly
- Product
- Intrusion Prevention System (IPS) Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2024An authenticated user can access the restricted files from NX, EX, FX, AX, IVX and CMS using path traversal.CVE-2024-7608 · Other software · Trellix · reported by trellixpsirt@trellix.comMedium 5.9
An authenticated user can access the restricted files from NX, EX, FX, AX, IVX and CMS using path traversal.
- Product
- Trellix NX, EX, AX, FX, CMS and IVX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2024** UNSUPPORTED WHEN ASSIGNED ** The Apache Helix Front (UI) component contained a hard-coded secret, allowing an attacker to spoof sessions by generating their CVE-2024-22281 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
** UNSUPPORTED WHEN ASSIGNED ** The Apache Helix Front (UI) component contained a hard-coded secret, allowing an attacker to spoof sessions by generating their own fake cookies. This issue affects Apache Helix Front (UI): all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- Apache Helix Front (UI)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Aug 1, 2024Dispatch's notification service uses Jinja templates to generate messages to users.CVE-2024-7093 · Other software · Netflix · reported by security-report@netflix.comCritical 9.4
Dispatch's notification service uses Jinja templates to generate messages to users. Jinja permits code execution within blocks, which were neither properly sanitized nor sandboxed. This vulnerability enables users to construct command line scripts in their custom message templates, which are then executed whenever these notifications are rendered and sent out.
- Product
- Dispatch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2024In the Linux kernel, the following vulnerability has been resolved: net: dsa: felix: don't use devres for mdiobus As explained in commits: 74b6d7d13307 ("net:CVE-2022-48813 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: net: dsa: felix: don't use devres for mdiobus As explained in commits: 74b6d7d13307 ("net: dsa: realtek: register the MDIO bus under devres") 5135e96a3dd2 ("net: dsa: don't allocate the slave_mii_bus using devres") mdiobus_free() will panic when called from devm_mdiobus_free() <- devres_release_all() <- __device_release_driver(), and that mdiobus was not previously unregistered. The Felix VSC9959 switch is a PCI device, so the initial set of constraints that I thought would cause this (I2C or SPI buses which call ->remove on ->shutdown) do not apply. But there is one more which applies here. If the DSA master itself is on a bus that calls ->remove from ->shutdown (like dpaa2-eth, which is on the fsl-mc bus), there is a device link between the switch and the DSA master, and device_links_unbind_consumers() will unbind the felix switch driver on shutdown. So the same treatment must be applied to all DSA switch drivers, which is: either use devres for both the mdiobus allocation and registration, or don't use devres at all. The felix driver has the code structure in place for orderly mdiobus removal, so just rep
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jul 9, 2024Fujian Kelixun <=7.6.6.4391 is vulnerable to SQL Injection in send_event.php.CVE-2024-39071 · Other software · fujiankelixun · reported by MITRECritical 9.8
Fujian Kelixun <=7.6.6.4391 is vulnerable to SQL Injection in send_event.php.
- Product
- command_and_dispatch_platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jun 28, 2024In Helix ALM versions prior to 2024.2.0, a local command injection was identified.CVE-2024-3995 · Other software · Perforce · reported by security@puppet.comLow 2
In Helix ALM versions prior to 2024.2.0, a local command injection was identified. Reported by Bryan Riggins.
- Product
- Helix ALM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.perforce.comportal.perforce.com
Jun 14, 2024A vulnerability in the IPS Manager, Central Manager, and Local Manager communication workflow allows an attacker to control the destination of a request by maniCVE-2024-5731 · Other software · Trellix · reported by trellixpsirt@trellix.comMedium 6.8
A vulnerability in the IPS Manager, Central Manager, and Local Manager communication workflow allows an attacker to control the destination of a request by manipulating the parameter, thereby leveraging sensitive information.
- Product
- Intrusion Prevention System (IPS) Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordthrive.trellix.comthrive.trellix.com
Jun 14, 2024Insecure Deserialization in some workflows of the IPS Manager allows unauthenticated remote attackers to perform arbitrary code execution and access to the vulnCVE-2024-5671 · Other software · Trellix · reported by trellixpsirt@trellix.comCritical 9.8
Insecure Deserialization in some workflows of the IPS Manager allows unauthenticated remote attackers to perform arbitrary code execution and access to the vulnerable Trellix IPS Manager.
- Product
- Intrusion Prevention System (IPS) Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordthrive.trellix.comthrive.trellix.com
Jun 13, 2024An Cross site scripting vulnerability in the EDR XConsole before this release allowed an attacker to potentially leverage an XSS/HTML-Injection using command liCVE-2024-4176 · Other software · Trellix · reported by trellixpsirt@trellix.comMedium 4.1
An Cross site scripting vulnerability in the EDR XConsole before this release allowed an attacker to potentially leverage an XSS/HTML-Injection using command line variables. A malicious threat actor could execute commands on the victim's browser for sending carefully crafted malicious links to the EDR XConsole end user.
- Product
- Trellix EDR UI (XConsole)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordthrive.trellix.comthrive.trellix.com
May 24, 2024In the Linux kernel, the following vulnerability has been resolved: net: dsa: felix: Fix memory leak in felix_setup_mmio_filtering Avoid a memory leak if therCVE-2021-47513 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: net: dsa: felix: Fix memory leak in felix_setup_mmio_filtering Avoid a memory leak if there is not a CPU port defined. Addresses-Coverity-ID: 1492897 ("Resource leak") Addresses-Coverity-ID: 1492899 ("Resource leak")
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
May 16, 2024Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Netflix ConsoleMe allows Command Injection.This issue affecCVE-2024-5023 · Other software · Netflix · reported by security-report@netflix.comCritical 9.3
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Netflix ConsoleMe allows Command Injection.This issue affects ConsoleMe: before 1.4.0.
- Product
- ConsoleMe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2024Hardcoded credentials vulnerability in Trellix ePolicy Orchestrator (ePO) on Premise prior to 5.10 Service Pack 1 Update 2 allows an attacker with admin privileCVE-2024-4844 · Other software · Trellix · reported by trellixpsirt@trellix.comHigh 7.5
Hardcoded credentials vulnerability in Trellix ePolicy Orchestrator (ePO) on Premise prior to 5.10 Service Pack 1 Update 2 allows an attacker with admin privileges on the ePO server to read the contents of the orion.keystore file, allowing them to access the ePO database encryption key. This was possible through using a hard coded password for the keystore. Access Control restrictions on the file mean this would not be exploitable unless the user is the system admin for the server that ePO is running on.
- Product
- ePolicy Orchestrator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordthrive.trellix.comthrive.trellix.com
May 16, 2024ePO doesn't allow a regular privileged user to delete tasks or assignments.CVE-2024-4843 · Other software · Trellix · reported by trellixpsirt@trellix.comMedium 4.3
ePO doesn't allow a regular privileged user to delete tasks or assignments. Insecure direct object references that allow a least privileged user to manipulate the client task and client task assignments, hence escalating his/her privilege.
- Product
- ePolicy Orchestrator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordthrive.trellix.comthrive.trellix.com
May 14, 2024A path traversal issue potentially leading to remote code execution in Genie for all versions prior to 4.3.18CVE-2024-4701 · Other software · Netflix · reported by security-report@netflix.comCritical 9.9
A path traversal issue potentially leading to remote code execution in Genie for all versions prior to 4.3.18
- Product
- Genie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2024erlang-jose (aka JOSE for Erlang and Elixir) through 1.11.6 allow attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) valCVE-2023-50966 · Other software · potatosalad · reported by MITREMedium 5.3
erlang-jose (aka JOSE for Erlang and Elixir) through 1.11.6 allow attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value in a JOSE header.
- Product
- erlang-jose
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2024A vulnerability was found in Fujian Kelixin Communication Command and Dispatch Platform up to 20240318.CVE-2024-2622 · Other software · Fujian Kelixin Communication · reported by VulDBMedium 6.3
A vulnerability was found in Fujian Kelixin Communication Command and Dispatch Platform up to 20240318. It has been classified as critical. This affects an unknown part of the file /api/client/editemedia.php. The manipulation of the argument number/enterprise_uuid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-257199.
- Product
- Command and Dispatch Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordh0e4a0r1t.github.iovuldb.com
Mar 18, 2024A vulnerability was found in Fujian Kelixin Communication Command and Dispatch Platform up to 20240318 and classified as critical.CVE-2024-2621 · Other software · Fujian Kelixin Communication · reported by VulDBMedium 6.3
A vulnerability was found in Fujian Kelixin Communication Command and Dispatch Platform up to 20240318 and classified as critical. Affected by this issue is some unknown functionality of the file api/client/user/pwd_update.php. The manipulation of the argument uuid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-257198 is the identifier assigned to this vulnerability.
- Product
- Command and Dispatch Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordh0e4a0r1t.github.iovuldb.com
Mar 18, 2024A vulnerability has been found in Fujian Kelixin Communication Command and Dispatch Platform up to 20240318 and classified as critical.CVE-2024-2620 · Other software · Fujian Kelixin Communication · reported by VulDBMedium 6.3
A vulnerability has been found in Fujian Kelixin Communication Command and Dispatch Platform up to 20240318 and classified as critical. Affected by this vulnerability is an unknown functionality of the file api/client/down_file.php. The manipulation of the argument uuid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-257197 was assigned to this vulnerability.
- Product
- Command and Dispatch Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordh0e4a0r1t.github.iovuldb.com
Mar 17, 2024A vulnerability was found in Fujian Kelixin Communication Command and Dispatch Platform up to 20240313.CVE-2024-2566 · Other software · Fujian Kelixin Communication · reported by VulDBHigh 7.3
A vulnerability was found in Fujian Kelixin Communication Command and Dispatch Platform up to 20240313. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file api/client/get_extension_yl.php. The manipulation of the argument imei leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-257065 was assigned to this vulnerability.
- Product
- Command and Dispatch Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordh0e4a0r1t.github.iovuldb.com
Feb 22, 2024The `mjml` PyPI package, found at the `FelixSchwarz/mjml-python` GitHub repo, is an unofficial Python port of MJML, a markup language created by Mailjet.CVE-2024-26151 · Other software · FelixSchwarz · reported by GitHubHigh 8.2
The `mjml` PyPI package, found at the `FelixSchwarz/mjml-python` GitHub repo, is an unofficial Python port of MJML, a markup language created by Mailjet. All users of `FelixSchwarz/mjml-python` who insert untrusted data into mjml templates unless that data is checked in a very strict manner. User input like `<script>` would be rendered as `<script>` in the final HTML output. The attacker must be able to control some data which is later injected in an mjml template which is then send out as email to other users. The attacker could control contents of email messages sent through the platform. The problem has been fixed in version 0.11.0 of this library. Versions before 0.10.0 are not affected by this security issue. As a workaround, ensure that potentially untrusted user input does not contain any sequences which could be rendered as HTML.
- Product
- mjml-python
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2024Incorrect permissions in the installation directories for shared SystemLink Elixir based services may allow an authenticated user to potentially enable escalatiCVE-2024-1155 · Other software · NI · reported by security@ni.comHigh 7.8
Incorrect permissions in the installation directories for shared SystemLink Elixir based services may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- SystemLink Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2024 A cross-site scripting vulnerability in Trellix Central Management (CM) prior to 9.1.3.97129 allows a remote authenticated attacker to craft CM dashboard interCVE-2023-6072 · Other software · Trellix · reported by trellixpsirt@trellix.comMedium 4.6
A cross-site scripting vulnerability in Trellix Central Management (CM) prior to 9.1.3.97129 allows a remote authenticated attacker to craft CM dashboard internal requests causing arbitrary content to be injected into the response when accessing the CM dashboard.
- Product
- Trellix Central Management (CM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.trellix.comdocs.trellix.com
Feb 11, 2024In the Samly package before 1.4.0 for Elixir, Samly.State.Store.get_assertion/3 can return an expired session, which interferes with access control because SamlCVE-2024-25718 · Other software · samly · reported by MITRECritical 9.8
In the Samly package before 1.4.0 for Elixir, Samly.State.Store.get_assertion/3 can return an expired session, which interferes with access control because Samly.AuthHandler uses a cached session and does not replace it, even after expiry.
- Product
- elixr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 1, 2024In Helix Sync versions prior to 2024.1, a local command injection was identified.CVE-2024-0325 · Other software · Helix · reported by security@puppet.comLow 3.6
In Helix Sync versions prior to 2024.1, a local command injection was identified. Reported by Bryan Riggins.
- Product
- Sync
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordperforce.comperforce.com
Jan 30, 2024An arbitrary file upload vulnerability in Schlix CMS v2.2.8-1, allows remote authenticated attackers to execute arbitrary code and obtain sensitive information CVE-2023-31505 · Other software · Schlix · reported by MITREHigh 7.2
An arbitrary file upload vulnerability in Schlix CMS v2.2.8-1, allows remote authenticated attackers to execute arbitrary code and obtain sensitive information via a crafted .phtml file.
- Product
- CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordm3n0sd0n4ld.github.iom3n0sd0n4ld.github.io
Jan 10, 2024 A content-security-policy vulnerability in ENS Control browser extension prior to 10.7.0 Update 15 allows a remote attacker to alter the response header parameCVE-2024-0310 · Other software · Trellix · reported by trellixpsirt@trellix.comMedium 6.1
A content-security-policy vulnerability in ENS Control browser extension prior to 10.7.0 Update 15 allows a remote attacker to alter the response header parameter setting to switch the content security policy into report-only mode, allowing an attacker to bypass the content-security-policy configuration.
- Product
- Trellix Endpoint Security (ENS) Web Control
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkcm.trellix.comkcm.trellix.com
Jan 9, 2024 A buffer overflow vulnerability in TA for Linux and TA for MacOS prior to 5.8.1 allows a local user to gain elevated permissions, or cause a Denial of Service CVE-2024-0213 · Other software · Trellix · reported by trellixpsirt@trellix.comHigh 8.2
A buffer overflow vulnerability in TA for Linux and TA for MacOS prior to 5.8.1 allows a local user to gain elevated permissions, or cause a Denial of Service (DoS), through exploiting a memory corruption issue in the TA service, which runs as root. This may also result in the disabling of event reporting to ePO, caused by failure to validate input from the file correctly.
- Product
- Trellix Agent (TA)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkcm.trellix.comkcm.trellix.com
Jan 9, 2024 A symbolic link manipulation vulnerability in Trellix Anti-Malware Engine prior to the January 2024 release allows an authenticated local user to potentially gCVE-2024-0206 · Other software · Trellix · reported by trellixpsirt@trellix.comHigh 7.1
A symbolic link manipulation vulnerability in Trellix Anti-Malware Engine prior to the January 2024 release allows an authenticated local user to potentially gain an escalation of privileges. This was achieved by adding an entry to the registry under the Trellix ENS registry folder with a symbolic link to files that the user wouldn't normally have permission to. After a scan, the Engine would follow the links and remove the files
- Product
- Anti-Malware Engine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkcm.trellix.comkcm.trellix.com
Jan 8, 2024WALLIX Bastion 7.x, 8.x, 9.x and 10.x and WALLIX Access Manager 3.x and 4.x have Incorrect Access Control which can lead to sensitive data exposure.CVE-2023-49961 · Other software · Wallix · reported by MITREHigh 7.5
WALLIX Bastion 7.x, 8.x, 9.x and 10.x and WALLIX Access Manager 3.x and 4.x have Incorrect Access Control which can lead to sensitive data exposure.
- Product
- Bastion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 30, 2023 An Improper Neutralization of Special Elements used in a command vulnerability in ESM prior to version 11.6.9 allows a remote administrator to execute arbitrarCVE-2023-6071 · Other software · Trellix · reported by trellixpsirt@trellix.comHigh 8.4
An Improper Neutralization of Special Elements used in a command vulnerability in ESM prior to version 11.6.9 allows a remote administrator to execute arbitrary code as root on the ESM. This is possible as the input isn't correctly sanitized when adding a new data source.
- Product
- ESM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkcm.trellix.comkcm.trellix.com
Nov 29, 2023 A server-side request forgery vulnerability in ESM prior to version 11.6.8 allows a low privileged authenticated user to upload arbitrary content, potentially CVE-2023-6070 · Other software · Trellix · reported by trellixpsirt@trellix.comMedium 4.3
A server-side request forgery vulnerability in ESM prior to version 11.6.8 allows a low privileged authenticated user to upload arbitrary content, potentially altering configuration. This is possible through the certificate validation functionality where the API accepts uploaded content and doesn't parse for invalid data
- Product
- Trellix Enterprise Security Manager (ESM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkcm.trellix.comkcm.trellix.com
Nov 27, 2023 An improper limitation of a path name to a restricted directory (path traversal) vulnerability in the TACC ePO extension, for on-premises ePO servers, prior toCVE-2023-5607 · Other software · Trellix · reported by trellixpsirt@trellix.comHigh 8.4
An improper limitation of a path name to a restricted directory (path traversal) vulnerability in the TACC ePO extension, for on-premises ePO servers, prior to version 8.4.0 could lead to an authorised administrator attacker executing arbitrary code through uploading a specially crafted GTI reputation file. The attacker would need the appropriate privileges to access the relevant section of the User Interface. The import logic has been updated to restrict file types and content.
- Product
- Trellix Application and Change Control (TACC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkcm.trellix.comkcm.trellix.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.