Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,128 results · page 40 of 83
Jan 14, 2025Open source machine learning framework.CVE-2024-49375 · Other software · RasaHQ · reported by GitHubCritical 9
Open source machine learning framework. A vulnerability has been identified in Rasa that enables an attacker who has the ability to load a maliciously crafted model remotely into a Rasa instance to achieve Remote Code Execution. The prerequisites for this are: 1. The HTTP API must be enabled on the Rasa instance eg with `--enable-api`. This is not the default configuration. 2. For unauthenticated RCE to be exploitable, the user must not have configured any authentication or other security controls recommended in our documentation. 3. For authenticated RCE, the attacker must posses a valid authentication token or JWT to interact with the Rasa API. This issue has been addressed in rasa version 3.6.21 and all users are advised to upgrade. Users unable to upgrade should ensure that they require authentication and that only trusted users are given access.
- Product
- rasa-pro-security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2025.NET, .NET Framework, and Visual Studio Remote Code Execution VulnerabilityCVE-2025-21176 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability
- Product
- .NET 8.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comherodevs.com
Jan 13, 2025Under certain conditions SAP NetWeaver AS for ABAP and ABAP Platform (Internet Communication Framework) allows an attacker to access restricted information due CVE-2025-0066 · Network & remote access · SAP_SE · reported by cna@sap.comCritical 9.9
Under certain conditions SAP NetWeaver AS for ABAP and ABAP Platform (Internet Communication Framework) allows an attacker to access restricted information due to weak access controls. This can have a significant impact on the confidentiality, integrity, and availability of an application
- Product
- SAP NetWeaver AS for ABAP and ABAP Platform (Internet Communication Framework)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2025Vulnerability in Drupal Megamenu Framework.This issue affects Megamenu Framework: *.*.CVE-2024-13299 · Websites & servers · Drupal · reported by mlhess@drupal.orgMedium 6.6
Vulnerability in Drupal Megamenu Framework.This issue affects Megamenu Framework: *.*.
- Product
- Megamenu Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025Vulnerability of input parameters not being verified in the widget framework module Impact: Successful exploitation of this vulnerability may affect availabilitCVE-2024-56437 · Other software · Huawei · reported by psirt@huawei.comMedium 5.7
Vulnerability of input parameters not being verified in the widget framework module Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2025Dell Update Package Framework, versions prior to 22.01.02, contain(s) a Local Privilege Escalation Vulnerability.CVE-2025-22395 · Other software · Dell · reported by security_alert@emc.comHigh 8.2
Dell Update Package Framework, versions prior to 22.01.02, contain(s) a Local Privilege Escalation Vulnerability. A local low privileged attacker could potentially exploit this vulnerability, leading to the execution of arbitrary remote scripts on the server. Exploitation may lead to a denial of service by an attacker.
- Product
- Dell Update Package (DUP) Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2025NiceGUI is an easy-to-use, Python-based UI framework.CVE-2025-21618 · Other software · zauberzeug · reported by GitHubHigh 7.5
NiceGUI is an easy-to-use, Python-based UI framework. Prior to 2.9.1, authenticating with NiceGUI logged in the user for all browsers, including browsers in incognito mode. This vulnerability is fixed in 2.9.1.
- Product
- nicegui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 3, 2025Next.js is a React framework for building full-stack web applications.CVE-2024-56332 · Other software · vercel · reported by GitHubMedium 5.3
Next.js is a React framework for building full-stack web applications. Starting in version 13.0.0 and prior to versions 13.5.8, 14.2.21, and 15.1.2, Next.js is vulnerable to a Denial of Service (DoS) attack that allows attackers to construct requests that leaves requests to Server Actions hanging until the hosting provider cancels the function execution. This vulnerability can also be used as a Denial of Wallet (DoW) attack when deployed in providers billing by response times. (Note: Next.js server is idle during that time and only keeps the connection open. CPU and memory footprint are low during that time.). Deployments without any protection against long running Server Action invocations are especially vulnerable. Hosting providers like Vercel or Netlify set a default maximum duration on function execution to reduce the risk of excessive billing. This is the same issue as if the incoming HTTP request has an invalid `Content-Length` header or never closes. If the host has no other mitigations to those then this vulnerability is novel. This vulnerability affects only Next.js deployments using Server Actions. The issue was resolved in Next.js 13.5.8, 14.2.21, and 15.1.2. We recomme
- Product
- next.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 23, 2024Rizin is a UNIX-like reverse engineering framework and command-line toolset.CVE-2024-53256 · Other software · rizinorg · reported by GitHubHigh 7.8
Rizin is a UNIX-like reverse engineering framework and command-line toolset. `rizin.c` still had an old snippet of code which suffered a command injection due the usage of `rz_core_cmdf` to invoke the command `m` which was removed in v0.1.x. A malicious binary defining `bclass` (part of RzBinInfo) is executed if `rclass` (part of RzBinInfo) is set to `fs`; the vulnerability can be exploited by any bin format where `bclass` and `rclass` are user defined. This vulnerability is fixed in 0.7.4.
- Product
- rizin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 20, 2024Oqtane Framework is vulnerable to Insecure Direct Object Reference (IDOR) in Oqtane.Controllers.UserController.CVE-2024-55471 · Other software · reported by MITREMedium 6.5
Oqtane Framework is vulnerable to Insecure Direct Object Reference (IDOR) in Oqtane.Controllers.UserController. This allows unauthorized users to access sensitive information of other users by manipulating the id parameter.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 20, 2024Oqtane Framework 6.0.0 is vulnerable to Incorrect Access Control.CVE-2024-55470 · Other software · reported by MITREHigh 7.5
Oqtane Framework 6.0.0 is vulnerable to Incorrect Access Control. By manipulating the entityid parameter, attackers can bypass passcode validation and successfully log into the application or access restricted data without proper authorization. The lack of server-side validation exacerbates the issue, as the application relies on client-side information for authentication.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Dec 20, 2024An IDOR (Insecure Direct Object Reference) vulnerability exists in oqtane Framework 6.0.0, allowing a logged-in user to access inbox messages of other users by CVE-2024-55186 · Other software · reported by MITREMedium 4.3
An IDOR (Insecure Direct Object Reference) vulnerability exists in oqtane Framework 6.0.0, allowing a logged-in user to access inbox messages of other users by manipulating the notification ID in the request URL. By changing the notification ID, an attacker can view sensitive mail details belonging to other users.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Dec 19, 2024Astro is a web framework for content-driven websites.CVE-2024-56159 · Other software · withastro · reported by GitHubHigh 7.8
Astro is a web framework for content-driven websites. A bug in the build process allows any unauthenticated user to read parts of the server source code. During build, along with client assets such as css and font files, the sourcemap files **for the server code** are moved to a publicly-accessible folder. Any outside party can read them with an unauthorized HTTP GET request to the same server hosting the rest of the website. While some server files are hashed, making their access obscure, the files corresponding to the file system router (those in `src/pages`) are predictably named. For example. the sourcemap file for `src/pages/index.astro` gets named `dist/client/pages/index.astro.mjs.map`. This vulnerability is the root cause of issue #12703, which links to a simple stackblitz project demonstrating the vulnerability. Upon build, notice the contents of the `dist/client` (referred to as `config.build.client` in astro code) folder. All astro servers make the folder in question accessible to the public internet without any authentication. It contains `.map` files corresponding to the code that runs on the server. All **server-output** projects on Astro 5 versions **v5.0.3** through
- Product
- astro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2024Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks.CVE-2024-38819 · Other software · reported by security@vmware.comHigh 7.5
Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordspring.iosecurity.netapp.com
Dec 18, 2024Astro is a web framework for content-driven websites.CVE-2024-56140 · Other software · withastro · reported by GitHubMedium 5.9
Astro is a web framework for content-driven websites. In affected versions a bug in Astro’s CSRF-protection middleware allows requests to bypass CSRF checks. When the `security.checkOrigin` configuration option is set to `true`, Astro middleware will perform a CSRF check. However, a vulnerability exists that can bypass this security. A semicolon-delimited parameter is allowed after the type in `Content-Type`. Web browsers will treat a `Content-Type` such as `application/x-www-form-urlencoded; abc` as a `simple request` and will not perform preflight validation. In this case, CSRF is not blocked as expected. Additionally, the `Content-Type` header is not required for a request. This issue has been addressed in version 4.16.17 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- astro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.mozilla.orggithub.com
Dec 17, 2024Next.js is a React framework for building full-stack web applications.CVE-2024-51479 · Other software · vercel · reported by GitHubHigh 7.5
Next.js is a React framework for building full-stack web applications. In affected versions if a Next.js application is performing authorization in middleware based on pathname, it was possible for this authorization to be bypassed for pages directly under the application's root directory. For example: * [Not affected] `https://example.com/` * [Affected] `https://example.com/foo` * [Not affected] `https://example.com/foo/bar`. This issue is patched in Next.js `14.2.15` and later. If your Next.js application is hosted on Vercel, this vulnerability has been automatically mitigated, regardless of Next.js version. There are no official workarounds for this vulnerability.
- Product
- next.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2024beego is an open-source web framework for the Go programming language.CVE-2024-55885 · Other software · beego · reported by GitHubMedium 6.9
beego is an open-source web framework for the Go programming language. Versions of beego prior to 2.3.4 use MD5 as a hashing algorithm. MD5 is no longer considered secure against well-funded opponents due to its vulnerability to collision attacks. Version 2.3.4 replaces MD5 with SHA256.
- Product
- beego
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024Action Pack is a framework for handling and responding to web requests.CVE-2024-54133 · Other software · rails · reported by GitHubLow 2.3
Action Pack is a framework for handling and responding to web requests. There is a possible Cross Site Scripting (XSS) vulnerability in the `content_security_policy` helper starting in version 5.2.0 of Action Pack and prior to versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1. Applications which set Content-Security-Policy (CSP) headers dynamically from untrusted user input may be vulnerable to carefully crafted inputs being able to inject new directives into the CSP. This could lead to a bypass of the CSP and its protection against XSS and other attacks. Versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1 contain a fix. As a workaround, applications can avoid setting CSP headers dynamically from untrusted input, or can validate/sanitize that input.
- Product
- rails
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024Angular Expressions provides expressions for the Angular.JS web framework as a standalone module.CVE-2024-54152 · Other software · peerigon · reported by GitHubCritical 9.3
Angular Expressions provides expressions for the Angular.JS web framework as a standalone module. Prior to version 1.4.3, an attacker can write a malicious expression that escapes the sandbox to execute arbitrary code on the system. With a more complex (undisclosed) payload, one can get full access to Arbitrary code execution on the system. The problem has been patched in version 1.4.3 of Angular Expressions. Two possible workarounds are available. One may either disable access to `__proto__` globally or make sure that one uses the function with just one argument.
- Product
- angular-expressions
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2024Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework.CVE-2024-54149 · Other software · wintercms · reported by GitHubHigh 8.4
Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Winter CMS prior to versions 1.2.7, 1.1.11, and 1.0.476 allow users with access to the CMS templates sections that modify Twig files to bypass the sandbox placed on Twig files and modify resources such as theme customisation values or modify, or remove, templates in the theme even if not provided direct access via the permissions. As all objects passed through to Twig are references to the live objects, it is also possible to also manipulate model data if models are passed directly to Twig, including changing attributes or even removing records entirely. In most cases, this is unwanted behavior and potentially dangerous. To actively exploit this security issue, an attacker would need access to the Backend with a user account with any of the following permissions: `cms.manage_layouts`; `cms.manage_pages`; or `cms.manage_partials`. The Winter CMS maintainers strongly recommend that these permissions only be reserved to trusted administrators and developers in general. The maintainers of Winter CMS have significantly increased the scope of the sandbox, effectively making all models and da
- Product
- winter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2024Apollo13 Framework Extensions: Missing AuthorizationCVE-2023-25959 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Apollo13Themes Apollo13 Framework Extensions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Apollo13 Framework Extensions: from n/a through 1.8.10.
- Product
- Apollo13 Framework Extensions
- Affected
- up to 1.8.10
- What to do
- Affects up to 1.8.10. Update Apollo13 Framework Extensions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 3, 2024Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.CVE-2024-54000 · Other software · MobSF · reported by GitHubHigh 7.5
Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. In versions prior to 3.9.7, the requests.get() request in the _check_url method is specified as allow_redirects=True, which allows a server-side request forgery when a request to .well-known/assetlinks.json" returns a 302 redirect. This is a bypass of the fix for CVE-2024-29190 and is fixed in 3.9.7.
- Product
- Mobile-Security-Framework-MobSF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2024Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.CVE-2024-53999 · Other software · MobSF · reported by GitHubHigh 8.1
Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. The application allows users to upload files with scripts in the filename parameter. As a result, a malicious user can upload a script file to the system. When users in the application use the "Diff or Compare" functionality, they are affected by a Stored Cross-Site Scripting vulnerability. This vulnerability is fixed in 4.2.9.
- Product
- Mobile-Security-Framework-MobSF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2024LGPD Framework: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52465 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Data443 Risk Mitigation, Inc. LGPD Framework lgpd-framework allows Reflected XSS.This issue affects LGPD Framework: from n/a through <= 2.0.2.
- Product
- LGPD Framework
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update LGPD Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 27, 2024In SensorService::isDataInjectionEnabled of frameworks/native/services/sensorservice/SensorService.cpp, there is a possible out of bounds read due to a missing CVE-2017-13321 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In SensorService::isDataInjectionEnabled of frameworks/native/services/sensorservice/SensorService.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 26, 2024Lobe Chat is an open-source, AI chat framework.CVE-2024-32965 · Other software · lobehub · reported by GitHubHigh 8.1
Lobe Chat is an open-source, AI chat framework. Versions of lobe-chat prior to 1.19.13 have an unauthorized ssrf vulnerability. An attacker can construct malicious requests to cause SSRF without logging in, attack intranet services, and leak sensitive information. The jwt token header X-Lobe-Chat-Auth strored proxy address and OpenAI API Key, can be modified to scan an internal network in the target lobe-web environment. This issue has been addressed in release version 1.19.13 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- lobe-chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 26, 2024AppPresser – Mobile App Framework: Privilege escalationCVE-2024-11024 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The AppPresser – Mobile App Framework plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.4.6. This is due to the plugin not properly validating a user's password reset code prior to updating their password. This makes it possible for unauthenticated attackers, with knowledge of a user's email address, to reset the user's password and gain access to their account.
- Product
- AppPresser – Mobile App Framework
- Affected
- up to 4.4.6
- What to do
- Affects up to 4.4.6. Update AppPresser – Mobile App Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 25, 2024SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte.CVE-2024-53262 · Other software · sveltejs · reported by GitHubLow 2
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. The static error.html template for errors contains placeholders that are replaced without escaping the content first. error.html is the page that is rendered when everything else fails. It can contain the following placeholders: %sveltekit.status% — the HTTP status, and %sveltekit.error.message% — the error message. This leads to possible injection if an app explicitly creates an error with a message that contains user controlled content. Only applications where user provided input is used in the `Error` message will be vulnerable, so the vast majority of applications will not be vulnerable This issue has been addressed in version 2.8.3 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- kit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 25, 2024SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte.CVE-2024-53261 · Other software · sveltejs · reported by GitHubLow 2
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. "Unsanitized input from *the request URL* flows into `end`, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS)." The files `packages/kit/src/exports/vite/dev/index.js` and `packages/kit/src/exports/vite/utils.js` both contain user controllable data which under specific conditions may flow to dev mode pages. There is little to no expected impact. The Vite development is not exposed to the network by default and even if someone were able to trick a developer into executing an XSS against themselves, a development database should not have any sensitive data. None the less this issue has been addressed in version 2.8.3 and all users are advised to upgrade.
- Product
- kit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 25, 2024Improper handling of WiFi information by framework services can allow certain malicious applications to obtain sensitive information.CVE-2020-12492 · Other software · vivo · reported by security@vivo.comLow 1
Improper handling of WiFi information by framework services can allow certain malicious applications to obtain sensitive information.
- Product
- Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 25, 2024Improper control of framework service permissions with possibility of some sensitive device information leakage.CVE-2020-12491 · Other software · vivo · reported by security@vivo.comMedium 4.8
Improper control of framework service permissions with possibility of some sensitive device information leakage.
- Product
- Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024Tornado is a Python web framework and asynchronous networking library.CVE-2024-52804 · Other software · tornadoweb · reported by GitHubHigh 7.5
Tornado is a Python web framework and asynchronous networking library. The algorithm used for parsing HTTP cookies in Tornado versions prior to 6.4.2 sometimes has quadratic complexity, leading to excessive CPU consumption when parsing maliciously-crafted cookie headers. This parsing occurs in the event loop thread and may block the processing of other requests. Version 6.4.2 fixes the issue.
- Product
- tornado
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2024Litestar is an Asynchronous Server Gateway Interface (ASGI) framework.CVE-2024-52581 · Other software · litestar-org · reported by GitHubHigh 8.2
Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to version 2.13.0, the multipart form parser shipped with litestar expects the entire request body as a single byte string and there is no default limit for the total size of the request body. This allows an attacker to upload arbitrary large files wrapped in a `multipart/form-data` request and cause excessive memory consumption on the server. The multipart form parser in affected versions is vulnerable to this type of attack by design. The public method signature as well as its implementation both expect the entire request body to be available as a single byte string. It is not possible to accept large file uploads in a safe way using this parser. This may be a regression, as a variation of this issue was already reported in CVE-2023-25578. Limiting the part number is not sufficient to prevent out-of-memory errors on the server. A patch is available in version 2.13.0.
- Product
- litestar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 18, 2024aiohttp is an asynchronous HTTP client/server framework for asyncio and Python.CVE-2024-52304 · Other software · aio-libs · reported by GitHubMedium 6.3
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.10.11, the Python parser parses newlines in chunk extensions incorrectly which can lead to request smuggling vulnerabilities under certain conditions. If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or `AIOHTTP_NO_EXTENSIONS` is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. Version 3.10.11 fixes the issue.
- Product
- aiohttp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 18, 2024aiohttp is an asynchronous HTTP client/server framework for asyncio and Python.CVE-2024-52303 · Other software · aio-libs · reported by GitHubHigh 8.7
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In versions starting with 3.10.6 and prior to 3.10.11, a memory leak can occur when a request produces a MatchInfoError. This was caused by adding an entry to a cache on each request, due to the building of each MatchInfoError producing a unique cache entry. An attacker may be able to exhaust the memory resources of a server by sending a substantial number (100,000s to millions) of such requests. Those who use any middlewares with aiohttp.web should upgrade to version 3.10.11 to receive a patch.
- Product
- aiohttp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2024A security vulnerability has been identified in HPE Data Management Framework (DMF) Suite (CXFS).CVE-2024-51764 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comMedium 5.5
A security vulnerability has been identified in HPE Data Management Framework (DMF) Suite (CXFS). Depending on configuration, this vulnerability may lead to local/cluster unauthorized access.
- Product
- SGI CXFS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2024Giskard is an evaluation and testing framework for AI systems.CVE-2024-52524 · Other software · Giskard-AI · reported by GitHubMedium 6.9
Giskard is an evaluation and testing framework for AI systems. A Remote Code Execution (ReDoS) vulnerability was discovered in Giskard component by the GitHub Security Lab team. When processing datasets with specific text patterns with Giskard detectors, this vulnerability could trigger exponential regex evaluation times, potentially leading to denial of service. Giskard versions prior to 2.15.5 are affected.
- Product
- giskard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2024Android Framework Privilege Escalation VulnerabilityCVE-2024-43093 · Computers, phones & browsers · Android · reported by security@android.comExploitedHigh 7.3
Android Framework contains an unspecified vulnerability that allows for privilege escalation.
- Product
- Framework
- On CISA’s list since
- Nov 7, 2024 (federal fix deadline Nov 28, 2024)
- What to do
- Attackers are using this now. Install Android’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogandroid.googlesource.comsource.android.com
Nov 13, 2024Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes.CVE-2024-51996 · Other software · symfony · reported by GitHubHigh 7.5
Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. When consuming a persisted remember-me cookie, Symfony does not check if the username persisted in the database matches the username attached with the cookie, leading to authentication bypass. This vulnerability is fixed in 5.4.47, 6.4.15, and 7.1.8.
- Product
- symfony
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2024Decidim is a participatory democracy framework.CVE-2024-45594 · Other software · decidim · reported by GitHubHigh 7.7
Decidim is a participatory democracy framework. The meeting embeds feature used in the online or hybrid meetings is subject to potential XSS attack through a malformed URL. This vulnerability is fixed in 0.28.3 and 0.29.0.
- Product
- decidim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2024UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework.CVE-2024-52305 · Other software · unopim · reported by GitHubMedium 6.5
UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. A vulnerability exists in the Create User process, allowing the creation of a new admin account with an option to upload a profile image. An attacker can upload a malicious SVG file containing an embedded script. When the profile image is accessed, the embedded script executes, leading to the potential theft of session cookies. This vulnerability is fixed in 0.1.5.
- Product
- unopim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024Laravel is a web application framework.CVE-2024-52301 · Other software · laravel · reported by GitHubHigh 8.7
Laravel is a web application framework. When the register_argc_argv php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment used by the framework when handling the request. The vulnerability fixed in 6.20.45, 7.30.7, 8.83.28, 9.52.17, 10.48.23, and 11.31.0. The framework now ignores argv values for environment detection on non-cli SAPIs.
- Product
- framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Nov 12, 2024Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients.CVE-2024-47535 · Other software · netty · reported by GitHubMedium 5.5
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. An unsafe reading of environment file could potentially cause a denial of service in Netty. When loaded on an Windows application, Netty attempts to load a file that does not exist. If an attacker creates such a large file, the Netty application crashes. This vulnerability is fixed in 4.1.115.
- Product
- netty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2024Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes.CVE-2024-51736 · Other software · symfony · reported by GitHubNone
Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. On Windows, when an executable file named `cmd.exe` is located in the current working directory it will be called by the `Process` class when preparing command arguments, leading to possible hijacking. This issue has been addressed in release versions 5.4.46, 6.4.14, and 7.1.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- symfony
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2024symfony/http-foundation is a module for the Symphony PHP framework which defines an object-oriented layer for the HTTP specification.CVE-2024-50345 · Other software · symfony · reported by GitHubLow 3.1
symfony/http-foundation is a module for the Symphony PHP framework which defines an object-oriented layer for the HTTP specification. The `Request` class, does not parse URI with special characters the same way browsers do. As a result, an attacker can trick a validator relying on the `Request` class to redirect users to another domain. The `Request::create` methods now assert the URI does not contain invalid characters as defined by https://url.spec.whatwg.org/. This issue has been patched in versions 5.4.46, 6.4.14, and 7.1.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- symfony
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comurl.spec.whatwg.org
Nov 6, 2024symfony/validator is a module for the Symphony PHP framework which provides tools to validate values.CVE-2024-50343 · Other software · symfony · reported by GitHubLow 3.1
symfony/validator is a module for the Symphony PHP framework which provides tools to validate values. It is possible to trick a `Validator` configured with a regular expression using the `$` metacharacters, with an input ending with `\n`. Symfony as of versions 5.4.43, 6.4.11, and 7.1.4 now uses the `D` regex modifier to match the entire input. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- symfony
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2024symfony/http-client is a module for the Symphony PHP framework which provides powerful methods to fetch HTTP resources synchronously or asynchronously.CVE-2024-50342 · Other software · symfony · reported by GitHubLow 3.1
symfony/http-client is a module for the Symphony PHP framework which provides powerful methods to fetch HTTP resources synchronously or asynchronously. When using the `NoPrivateNetworkHttpClient`, some internal information is still leaking during host resolution, which leads to possible IP/port enumeration. As of versions 5.4.46, 6.4.14, and 7.1.7 the `NoPrivateNetworkHttpClient` now filters blocked IPs earlier to prevent such leaks. All users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- symfony
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2024symfony/security-bundle is a module for the Symphony PHP framework which provides a tight integration of the Security component into the Symfony full-stack framCVE-2024-50341 · Other software · symfony · reported by GitHubLow 3.1
symfony/security-bundle is a module for the Symphony PHP framework which provides a tight integration of the Security component into the Symfony full-stack framework. The custom `user_checker` defined on a firewall is not called when Login Programmaticaly with the `Security::login` method, leading to unwanted login. As of versions 6.4.10, 7.0.10 and 7.1.3 the `Security::login` method now ensure to call the configured `user_checker`. All users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- symfony
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2024symfony/runtime is a module for the Symphony PHP framework which enables decoupling PHP applications from global state.CVE-2024-50340 · Other software · symfony · reported by GitHubHigh 7.3
symfony/runtime is a module for the Symphony PHP framework which enables decoupling PHP applications from global state. When the `register_argv_argc` php directive is set to `on` , and users call any URL with a special crafted query string, they are able to change the environment or debug mode used by the kernel when handling the request. As of versions 5.4.46, 6.4.14, and 7.1.7 the `SymfonyRuntime` now ignores the `argv` values for non-SAPI PHP runtimes. All users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- symfony
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2024Basticom Framework: Stored Cross-Site ScriptingCVE-2024-9443 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Basticom Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
- Product
- Basticom Framework
- Affected
- up to 1.5.0
- What to do
- Affects up to 1.5.0. Update Basticom Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.