Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,128 results · page 43 of 83
Jul 9, 2024.NET, .NET Framework, and Visual Studio Elevation of Privilege VulnerabilityCVE-2024-38081 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.3
.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability
- Product
- Microsoft Visual Studio 2022 version 17.4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jul 9, 2024In Spring Cloud Function framework, versions 4.1.x prior to 4.1.2, 4.0.x prior to 4.0.8 an application is vulnerable to a DOS attack when attempting to compose CVE-2024-22271 · Other software · Spring by VMware Tanzu · reported by security@vmware.comHigh 8.2
In Spring Cloud Function framework, versions 4.1.x prior to 4.1.2, 4.0.x prior to 4.0.8 an application is vulnerable to a DOS attack when attempting to compose functions with non-existing functions. Specifically, an application is vulnerable when all of the following are true: User is using Spring Cloud Function Web module Affected Spring Products and Versions Spring Cloud Function Framework 4.1.0 to 4.1.2 4.0.0 to 4.0.8 References https://spring.io/security/cve-2022-22979 https://checkmarx.com/blog/spring-function-cloud-dos-cve-2022-22979-and-unintended-function-invocation/ History 2020-01-16: Initial vulnerability report published.
- Product
- Spring Cloud Function Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2024SAP CRM (WebClient UI Framework) allows an authenticated attacker to enumerate accessible HTTP endpoints in the internal network by specially crafting HTTP requCVE-2024-39598 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5
SAP CRM (WebClient UI Framework) allows an authenticated attacker to enumerate accessible HTTP endpoints in the internal network by specially crafting HTTP requests. On successful exploitation this can result in information disclosure. It has no impact on integrity and availability of the application.
- Product
- SAP CRM WebClient UI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2024NHibernate is an object-relational mapper for the .NET framework.CVE-2024-39677 · Other software · nhibernate · reported by GitHubMedium 5.9
NHibernate is an object-relational mapper for the .NET framework. A SQL injection vulnerability exists in some types implementing ILiteralType.ObjectToSQLString. Callers of these methods are exposed to the vulnerability, which includes mappings using inheritance with discriminator values; HQL queries referencing a static field of the application; users of the SqlInsertBuilder and SqlUpdateBuilder utilities, calling their AddColumn overload taking a literal value; and any direct use of the ObjectToSQLString methods for building SQL queries on the user side. This vulnerability is fixed in 5.4.9 and 5.5.2.
- Product
- nhibernate-core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2024Fiber is an Express-inspired web framework written in Go A vulnerability present in versions prior to 2.52.5 is a session middleware issue in GoFiber versions 2CVE-2024-38513 · Other software · gofiber · reported by GitHubCritical 10
Fiber is an Express-inspired web framework written in Go A vulnerability present in versions prior to 2.52.5 is a session middleware issue in GoFiber versions 2 and above. This vulnerability allows users to supply their own session_id value, resulting in the creation of a session with that key. If a website relies on the mere presence of a session for security purposes, this can lead to significant security risks, including unauthorized access and session fixation attacks. All users utilizing GoFiber's session middleware in the affected versions are impacted. The issue has been addressed in version 2.52.5. Users are strongly encouraged to upgrade to version 2.52.5 or higher to mitigate this vulnerability. Users who are unable to upgrade immediately can apply the following workarounds to reduce the risk: Either implement additional validation to ensure session IDs are not supplied by the user and are securely generated by the server, or regularly rotate session IDs and enforce strict session expiration policies.
- Product
- fiber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2024phpok 6.4.003 contains a Cross Site Scripting (XSS) vulnerability in the ok_f() method under the framework/api/upload_control.php file.CVE-2024-38953 · Websites & servers · Phpok · reported by MITREMedium 6.1
phpok 6.4.003 contains a Cross Site Scripting (XSS) vulnerability in the ok_f() method under the framework/api/upload_control.php file.
- Product
- Phpok
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2024October is a self-hosted CMS platform based on the Laravel PHP Framework.CVE-2024-25637 · Other software · octobercms · reported by GitHubLow 3.1
October is a self-hosted CMS platform based on the Laravel PHP Framework. The X-October-Request-Handler Header does not sanitize the AJAX handler name and allows unescaped HTML to be reflected back. There is no impact since this vulnerability cannot be exploited through normal browser interactions. This unescaped value is only detectable when using a proxy interception tool. This issue has been patched in version 3.5.15.
- Product
- october
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2024Versions of the package djangorestframework before 3.15.2 are vulnerable to Cross-site Scripting (XSS) via the break_long_headers template filter due to impropeCVE-2024-21520 · Other software · django-rest-framework · reported by report@snyk.ioLow 2.1
Versions of the package djangorestframework before 3.15.2 are vulnerable to Cross-site Scripting (XSS) via the break_long_headers template filter due to improper input sanitization before splitting and joining with <br> tags.
- Product
- django_rest_framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2024October is a self-hosted CMS platform based on the Laravel PHP Framework.CVE-2024-24764 · Other software · octobercms · reported by GitHubLow 3.5
October is a self-hosted CMS platform based on the Laravel PHP Framework. This issue affects authenticated administrators who may be redirected to an untrusted URL using the PageFinder schema. The resolver for the page finder link schema (`october://`) allowed external links, therefore allowing an open redirect outside the scope of the active host. This vulnerability has been patched in version 3.5.15.
- Product
- october
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2024An arbitrary file upload vulnerability in /fileupload/upload.cfm in Daemon PTY Limited FarCry Core framework before 7.2.14 allows attackers to execute arbitraryCVE-2024-35527 · Other software · farcry · reported by MITRECritical 9.8
An arbitrary file upload vulnerability in /fileupload/upload.cfm in Daemon PTY Limited FarCry Core framework before 7.2.14 allows attackers to execute arbitrary code via uploading a crafted .cfm file.
- Product
- farcry
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbastionsecurity.co.nzbastionsecurity.co.nz
Jun 25, 2024An issue in Daemon PTY Limited FarCry Core framework before 7.2.14 allows attackers to access sensitive information in the /facade directory.CVE-2024-35526 · Other software · reported by MITREMedium 5.9
An issue in Daemon PTY Limited FarCry Core framework before 7.2.14 allows attackers to access sensitive information in the /facade directory.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbastionsecurity.co.nzbastionsecurity.co.nz
Jun 19, 2024Socket.IO is an open source, real-time, bidirectional, event-based, communication framework.CVE-2024-38355 · Other software · socketio · reported by GitHubHigh 7.3
Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. This issue is fixed by commit `15af22fc22` which has been included in `socket.io@4.6.2` (released in May 2023). The fix was backported in the 2.x branch as well with commit `d30630ba10`. Users are advised to upgrade. Users unable to upgrade may attach a listener for the "error" event to catch these errors.
- Product
- socket.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2024DeepJavaLibrary(DJL) is an Engine-Agnostic Deep Learning Framework in Java.CVE-2024-37902 · Other software · deepjavalibrary · reported by GitHubCritical 10
DeepJavaLibrary(DJL) is an Engine-Agnostic Deep Learning Framework in Java. DJL versions 0.1.0 through 0.27.0 do not prevent absolute path archived artifacts from inserting archived files directly into the system, overwriting system files. This is fixed in DJL 0.28.0 and patched in DJL Large Model Inference containers version 0.27.0. Users are advised to upgrade.
- Product
- djl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2024Lobe Chat is an open-source LLMs/AI chat framework.CVE-2024-37895 · Other software · lobehub · reported by GitHubMedium 5.7
Lobe Chat is an open-source LLMs/AI chat framework. In affected versions if an attacker can successfully authenticate through SSO/Access Code, they can obtain the real backend API Key by modifying the base URL to their own attack URL on the frontend and setting up a server-side request. This issue has been addressed in version 0.162.25. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- lobe-chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2024There is a vulnerability in AVEVA PI Asset Framework Client that could allow malicious code to execute on the PI System Explorer environment under the privilegeCVE-2024-3467 · Other software · AVEVA · reported by ics-cert@hq.dhs.govHigh 7
There is a vulnerability in AVEVA PI Asset Framework Client that could allow malicious code to execute on the PI System Explorer environment under the privileges of an interactive user that was socially engineered to import XML supplied by an attacker.
- Product
- PI Asset Framework Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2024The AWS Deployment Framework (ADF) is a framework to manage and deploy resources across multiple AWS accounts and regions within an AWS Organization.CVE-2024-37293 · Other software · awslabs · reported by GitHubHigh 7.5
The AWS Deployment Framework (ADF) is a framework to manage and deploy resources across multiple AWS accounts and regions within an AWS Organization. ADF allows for staged, parallel, multi-account, cross-region deployments of applications or resources via the structure defined in AWS Organizations while taking advantage of services such as AWS CodePipeline, AWS CodeBuild, and AWS CodeCommit to alleviate the heavy lifting and management compared to a traditional CI/CD setup. ADF contains a bootstrap process that is responsible to deploy ADF's bootstrap stacks to facilitate multi-account cross-region deployments. The ADF bootstrap process relies on elevated privileges to perform this task. Two versions of the bootstrap process exist; a code-change driven pipeline using AWS CodeBuild and an event-driven state machine using AWS Lambda. If an actor has permissions to change the behavior of the CodeBuild project or the Lambda function, they would be able to escalate their privileges. Prior to version 4.0.0, the bootstrap CodeBuild role provides access to the `sts:AssumeRole` operation without further restrictions. Therefore, it is able to assume into any AWS Account in the AWS Organizat
- Product
- aws-deployment-framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.aws.amazon.comgithub.com
Jun 11, 2024Aimeos is an Open Source e-commerce framework for online shops.CVE-2024-37295 · Other software · aimeos · reported by GitHubHigh 7.2
Aimeos is an Open Source e-commerce framework for online shops. Starting in version 2024.01.1 and prior to version 2024.04.5, a user with administrative privileges can upload files that look like images but contain PHP code which can then be executed in the context of the web server. Version 2024.04.5 fixes the issue.
- Product
- aimeos-core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2024Aimeos is an Open Source e-commerce framework for online shops.CVE-2024-37294 · Other software · aimeos · reported by GitHubMedium 5.5
Aimeos is an Open Source e-commerce framework for online shops. All SaaS and marketplace setups using Aimeos version from 2022/2023/2024 are affected by a potential denial of service attack. Users should upgrade to versions 2022.10.17, 2023.10.17, or 2024.04 of the aimeos/aimeos-core package to receive a patch.
- Product
- aimeos-core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2024The encrypt() function of Ninja Core v7.0.0 was discovered to use a weak cryptographic algorithm, leading to a possible leakage of sensitive information.CVE-2024-36823 · Other software · Ninjaframework · reported by MITREHigh 7.5
The encrypt() function of Ninja Core v7.0.0 was discovered to use a weak cryptographic algorithm, leading to a possible leakage of sensitive information.
- Product
- Ninja
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2024A vulnerability in the `download_model_with_test_data` function of the onnx/onnx framework, version 1.16.0, allows for arbitrary file overwrite due to inadequatCVE-2024-5187 · Other software · onnx · reported by security@huntr.devHigh 8.8
A vulnerability in the `download_model_with_test_data` function of the onnx/onnx framework, version 1.16.0, allows for arbitrary file overwrite due to inadequate prevention of path traversal attacks in malicious tar files. This vulnerability enables attackers to overwrite any file on the system, potentially leading to remote code execution, deletion of system, personal, or application files, thus impacting the integrity and availability of the system. The issue arises from the function's handling of tar file extraction without performing security checks on the paths within the tar file, as demonstrated by the ability to overwrite the `/home/kali/.ssh/authorized_keys` file by specifying an absolute path in the malicious tar file.
- Product
- onnx/onnx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2024Multiple plugins for WordPress utilizing the XootiX Framework are vulnerable to unauthorized modification of data due to a missing capability check on the 'impoCVE-2024-5324 · WordPress plugins & themes · reported by WordfenceHigh 8.8
Multiple plugins for WordPress utilizing the XootiX Framework are vulnerable to unauthorized modification of data due to a missing capability check on the 'import_settings' function in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary options on affected sites. This can be used to enable new user registration and set the default role for new users to Administrator.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 4, 2024Action Pack is a framework for handling and responding to web requests.CVE-2024-28103 · Other software · rails · reported by GitHubMedium 5.4
Action Pack is a framework for handling and responding to web requests. Since 6.1.0, the application configurable Permissions-Policy is only served on responses with an HTML related Content-Type. This vulnerability is fixed in 6.1.7.8, 7.0.8.2, and 7.1.3.3.
- Product
- rails
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 3, 2024The Active Admin (aka activeadmin) framework before 3.2.2 for Ruby on Rails allows stored XSS in certain situations where users can create entities (to be laterCVE-2024-37031 · Other software · reported by MITREMedium 6.1
The Active Admin (aka activeadmin) framework before 3.2.2 for Ruby on Rails allows stored XSS in certain situations where users can create entities (to be later edited in forms) with arbitrary names, aka a "dynamic form legends" issue. 4.0.0.beta7 is also a fixed version.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2024Yii 2 is a PHP application framework.CVE-2024-32877 · Other software · yiisoft · reported by GitHubMedium 4.2
Yii 2 is a PHP application framework. During internal penetration testing of a product based on Yii2, users discovered a Cross-site Scripting (XSS) vulnerability within the framework itself. This issue is relevant for the latest version of Yii2 (2.0.49.3). This issue lies in the mechanism for displaying function argument values in the stack trace. The vulnerability manifests when an argument's value exceeds 32 characters. For convenience, argument values exceeding this limit are truncated and displayed with an added "...". The full argument value becomes visible when hovering over it with the mouse, as it is displayed in the title attribute of a span tag. However, the use of a double quote (") allows an attacker to break out of the title attribute's value context and inject their own attributes into the span tag, including malicious JavaScript code through event handlers such as onmousemove. This vulnerability allows an attacker to execute arbitrary JavaScript code in the security context of the victim's site via a specially crafted link. This could lead to the theft of cookies (including httpOnly cookies, which are accessible on the page), content substitution, or complete takeove
- Product
- yii2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2024Kaminari is a paginator for web app frameworks and object relational mappings.CVE-2024-32978 · Other software · kaminari · reported by GitHubMedium 6.6
Kaminari is a paginator for web app frameworks and object relational mappings. A security vulnerability involving insecure file permissions has been identified in the Kaminari pagination library for Ruby on Rails, concerning insecure file permissions. This vulnerability is of moderate severity due to the potential for unauthorized write access to particular Ruby files managed by the library. Such access could lead to the alteration of application behavior or data integrity issues. Users of affected versions are advised to update to Kaminari version 0.16.2 or later, where file permissions have been adjusted to enhance security. If upgrading is not feasible immediately, review and adjust the file permissions for particular Ruby files in Kaminari to ensure they are only accessible by authorized user.
- Product
- kaminari
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2024Tauri is a framework for building binaries for all major desktop platforms.CVE-2024-35222 · Other software · tauri-apps · reported by GitHubMedium 5.9
Tauri is a framework for building binaries for all major desktop platforms. Remote origin iFrames in Tauri applications can access the Tauri IPC endpoints without being explicitly allowed in the `dangerousRemoteDomainIpcAccess` in v1 and in the `capabilities` in v2. Valid commands with potentially unwanted consequences ("delete project", "transfer credits", etc.) could be invoked by an attacker that controls the content of an iframe running inside a Tauri app. This vulnerability has been patched in versions 1.6.7 and 2.0.0-beta.19.
- Product
- tauri
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 21, 2024In the Linux kernel, the following vulnerability has been resolved: block: don't call rq_qos_ops->done_bio if the bio isn't tracked rq_qos framework is only aCVE-2021-47412 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: block: don't call rq_qos_ops->done_bio if the bio isn't tracked rq_qos framework is only applied on request based driver, so: 1) rq_qos_done_bio() needn't to be called for bio based driver 2) rq_qos_done_bio() needn't to be called for bio which isn't tracked, such as bios ended from error handling code. Especially in bio_endio(): 1) request queue is referred via bio->bi_bdev->bd_disk->queue, which may be gone since request queue refcount may not be held in above two cases 2) q->rq_qos may be freed in blk_cleanup_queue() when calling into __rq_qos_done_bio() Fix the potential kernel panic by not calling rq_qos_ops->done_bio if the bio isn't tracked. This way is safe because both ioc_rqos_done_bio() and blkcg_iolatency_done_bio() are nop if the bio isn't tracked.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
May 17, 2024socialdriver-framework: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2024-2697 · WordPress plugins & themes · reported by WPScanMedium 6.5
The socialdriver-framework WordPress plugin before 2024.0.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- socialdriver-framework
- Fixed in
- 2024.0.0
- What to do
- Update socialdriver-framework to 2024.0.0 or newer.
May 16, 2024Uncontrolled search path in some Intel(R) GPA Framework software before version 2023.4 may allow an authenticated user to potentially enable escalation of priviCVE-2024-21861 · Other software · intel · reported by secure@intel.comMedium 6.7
Uncontrolled search path in some Intel(R) GPA Framework software before version 2023.4 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- graphics_performance_analyzer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2024Improper access control in some Intel(R) GPA Framework software installers before version 2023.3 may allow an authenticated user to potentially enable escalatioCVE-2023-43748 · Other software · intel · reported by secure@intel.comHigh 7.8
Improper access control in some Intel(R) GPA Framework software installers before version 2023.3 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- graphics_performance_analyzer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2024Uncontrolled search path in some Intel(R) GPA Framework software before version 2023.3 may allow an authenticated user to potentially enable escalation of priviCVE-2023-35192 · Other software · intel · reported by secure@intel.comMedium 6.7
Uncontrolled search path in some Intel(R) GPA Framework software before version 2023.3 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- graphics_performance_analyzer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2024A command injection vulnerability exists in the RunGptLLM class of the llama_index library, version 0.9.47, used by the RunGpt framework from JinaAI to connect CVE-2024-4181 · Other software · run-llama · reported by security@huntr.devHigh 8.8
A command injection vulnerability exists in the RunGptLLM class of the llama_index library, version 0.9.47, used by the RunGpt framework from JinaAI to connect to Language Learning Models (LLMs). The vulnerability arises from the improper use of the eval function, allowing a malicious or compromised LLM hosting provider to execute arbitrary commands on the client's machine. This issue was fixed in version 0.10.13. The exploitation of this vulnerability could lead to a hosting provider gaining full control over client machines.
- Product
- run-llama/llama_index
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024Swift Framework: Stored Cross-Site ScriptingCVE-2024-3916 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Swift Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several of the plugin's shortcodes in all versions up to, and including, 2.7.31 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Unfortunately, we did not receive a response from the vendor to send over the vulnerability details.
- Product
- Swift Framework
- Affected
- up to 2.7.31
- What to do
- Affects up to 2.7.31. Update Swift Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordswiftideas.comwordfence.com
May 14, 2024Swift Framework: Unauthorized modification of dataCVE-2024-3915 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Swift Framework plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the sf_edit_directory_item() function in all versions up to, and including, 2.7.31. This makes it possible for unauthenticated attackers to update arbitrary posts with arbitrary content. Unfortunately, we did not receive a response from the vendor to send over the vulnerability details.
- Product
- Swift Framework
- Affected
- up to 2.7.31
- What to do
- Affects up to 2.7.31. Update Swift Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordswiftideas.comwordfence.com
May 14, 2024Next.js is a React framework that can provide building blocks to create web applications.CVE-2024-34351 · Other software · vercel · reported by GitHubHigh 7.5
Next.js is a React framework that can provide building blocks to create web applications. A Server-Side Request Forgery (SSRF) vulnerability was identified in Next.js Server Actions. If the `Host` header is modified, and the below conditions are also met, an attacker may be able to make requests that appear to be originating from the Next.js application server itself. The required conditions are 1) Next.js is running in a self-hosted manner; 2) the Next.js application makes use of Server Actions; and 3) the Server Action performs a redirect to a relative path which starts with a `/`. This vulnerability was fixed in Next.js `14.1.1`.
- Product
- next.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024Next.js is a React framework that can provide building blocks to create web applications.CVE-2024-34350 · Other software · vercel · reported by GitHubHigh 7.5
Next.js is a React framework that can provide building blocks to create web applications. Prior to 13.5.1, an inconsistent interpretation of a crafted HTTP request meant that requests are treated as both a single request, and two separate requests by Next.js, leading to desynchronized responses. This led to a response queue poisoning vulnerability in the affected Next.js versions. For a request to be exploitable, the affected route also had to be making use of the [rewrites](https://nextjs.org/docs/app/api-reference/next-config-js/rewrites) feature in Next.js. The vulnerability is resolved in Next.js `13.5.1` and newer.
- Product
- next.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024Cacti provides an operational monitoring and fault management framework.CVE-2024-34340 · Other software · Cacti · reported by GitHubCritical 9.1
Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, Cacti calls `compat_password_hash` when users set their password. `compat_password_hash` use `password_hash` if there is it, else use `md5`. When verifying password, it calls `compat_password_verify`. In `compat_password_verify`, `password_verify` is called if there is it, else use `md5`. `password_verify` and `password_hash` are supported on PHP < 5.5.0, following PHP manual. The vulnerability is in `compat_password_verify`. Md5-hashed user input is compared with correct password in database by `$md5 == $hash`. It is a loose comparison, not `===`. It is a type juggling vulnerability. Version 1.2.27 contains a patch for the issue.
- Product
- cacti
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.fedoraproject.org
May 14, 2024Frappe is a full-stack web application framework.CVE-2024-34074 · Other software · frappe · reported by GitHubMedium 6.1
Frappe is a full-stack web application framework. Prior to 15.26.0 and 14.74.0, the login page accepts redirect argument and it allowed redirect to untrusted external URls. This behaviour can be used by malicious actors for phishing. This vulnerability is fixed in 15.26.0 and 14.74.0.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024Lobe Chat is a chatbot framework that supports speech synthesis, multimodal, and extensible Function Call plugin system.CVE-2024-32964 · Other software · lobehub · reported by GitHubCritical 9
Lobe Chat is a chatbot framework that supports speech synthesis, multimodal, and extensible Function Call plugin system. Prior to 0.150.6, lobe-chat had an unauthorized Server-Side Request Forgery vulnerability in the /api/proxy endpoint. An attacker can construct malicious requests to cause Server-Side Request Forgery without logging in, attack intranet services, and leak sensitive information.
- Product
- lobe-chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024Cacti provides an operational monitoring and fault management framework.CVE-2024-31460 · Other software · Cacti · reported by GitHubMedium 6.5
Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, some of the data stored in `automation_tree_rules.php` is not thoroughly checked and is used to concatenate the SQL statement in `create_all_header_nodes()` function from `lib/api_automation.php` , finally resulting in SQL injection. Using SQL based secondary injection technology, attackers can modify the contents of the Cacti database, and based on the modified content, it may be possible to achieve further impact, such as arbitrary file reading, and even remote code execution through arbitrary file writing. Version 1.2.27 contains a patch for the issue.
- Product
- cacti
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024Cacti provides an operational monitoring and fault management framework.CVE-2024-31459 · Other software · Cacti · reported by GitHubHigh 8
Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, there is a file inclusion issue in the `lib/plugin.php` file. Combined with SQL injection vulnerabilities, remote code execution can be implemented. There is a file inclusion issue with the `api_plugin_hook()` function in the `lib/plugin.php` file, which reads the plugin_hooks and plugin_config tables in database. The read data is directly used to concatenate the file path which is used for file inclusion. Version 1.2.27 contains a patch for the issue.
- Product
- cacti
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024Cacti provides an operational monitoring and fault management framework.CVE-2024-31458 · Other software · Cacti · reported by GitHubMedium 4.6
Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, some of the data stored in `form_save()` function in `graph_template_inputs.php` is not thoroughly checked and is used to concatenate the SQL statement in `draw_nontemplated_fields_graph_item()` function from `lib/html_form_templates.php` , finally resulting in SQL injection. Version 1.2.27 contains a patch for the issue.
- Product
- cacti
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.fedoraproject.org
May 14, 2024Cacti provides an operational monitoring and fault management framework.CVE-2024-31445 · Other software · Cacti · reported by GitHubHigh 8.8
Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, a SQL injection vulnerability in `automation_get_new_graphs_sql` function of `api_automation.php` allows authenticated users to exploit these SQL injection vulnerabilities to perform privilege escalation and remote code execution. In `api_automation.php` line 856, the `get_request_var('filter')` is being concatenated into the SQL statement without any sanitization. In `api_automation.php` line 717, The filter of `'filter'` is `FILTER_DEFAULT`, which means there is no filter for it. Version 1.2.27 contains a patch for the issue.
- Product
- cacti
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024Cacti provides an operational monitoring and fault management framework.CVE-2024-31444 · Other software · Cacti · reported by GitHubMedium 4.6
Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, some of the data stored in `automation_tree_rules_form_save()` function in `automation_tree_rules.php` is not thoroughly checked and is used to concatenate the HTML statement in `form_confirm()` function from `lib/html.php` , finally resulting in cross-site scripting. Version 1.2.27 contains a patch for the issue.
- Product
- cacti
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.fedoraproject.org
May 14, 2024Cacti provides an operational monitoring and fault management framework.CVE-2024-31443 · Other software · Cacti · reported by GitHubMedium 5.7
Cacti provides an operational monitoring and fault management framework. Prior to 1.2.27, some of the data stored in `form_save()` function in `data_queries.php` is not thoroughly checked and is used to concatenate the HTML statement in `grow_right_pane_tree()` function from `lib/html.php` , finally resulting in cross-site scripting. Version 1.2.27 contains a patch for the issue.
- Product
- cacti
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024Cacti provides an operational monitoring and fault management framework.CVE-2024-30268 · Other software · Cacti · reported by GitHubMedium 6.1
Cacti provides an operational monitoring and fault management framework. A reflected cross-site scripting vulnerability on the 1.3.x DEV branch allows attackers to obtain cookies of administrator and other users and fake their login using obtained cookies. This issue is fixed in commit a38b9046e9772612fda847b46308f9391a49891e.
- Product
- cacti
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024Cacti provides an operational monitoring and fault management framework.CVE-2024-29895 · Other software · Cacti · reported by GitHubCritical 10
Cacti provides an operational monitoring and fault management framework. A command injection vulnerability on the 1.3.x DEV branch allows any unauthenticated user to execute arbitrary command on the server when `register_argc_argv` option of PHP is `On`. In `cmd_realtime.php` line 119, the `$poller_id` used as part of the command execution is sourced from `$_SERVER['argv']`, which can be controlled by URL when `register_argc_argv` option of PHP is `On`. And this option is `On` by default in many environments such as the main PHP Docker image for PHP. Commit 53e8014d1f082034e0646edc6286cde3800c683d contains a patch for the issue, but this commit was reverted in commit 99633903cad0de5ace636249de16f77e57a3c8fc.
- Product
- cacti
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024Cacti provides an operational monitoring and fault management framework.CVE-2024-29894 · Other software · Cacti · reported by GitHubMedium 5.4
Cacti provides an operational monitoring and fault management framework. Versions of Cacti prior to 1.2.27 contain a residual cross-site scripting vulnerability caused by an incomplete fix for CVE-2023-50250. `raise_message_javascript` from `lib/functions.php` now uses purify.js to fix CVE-2023-50250 (among others). However, it still generates the code out of unescaped PHP variables `$title` and `$header`. If those variables contain single quotes, they can be used to inject JavaScript code. An attacker exploiting this vulnerability could execute actions on behalf of other users. This ability to impersonate users could lead to unauthorized changes to settings. Version 1.2.27 fixes this issue.
- Product
- cacti
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024Cacti provides an operational monitoring and fault management framework.CVE-2024-27082 · Other software · Cacti · reported by GitHubHigh 7.6
Cacti provides an operational monitoring and fault management framework. Versions of Cacti prior to 1.2.27 are vulnerable to stored cross-site scripting, a type of cross-site scripting where malicious scripts are permanently stored on a target server and served to users who access a particular page. Version 1.2.27 contains a patch for the issue.
- Product
- cacti
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024Cacti provides an operational monitoring and fault management framework.CVE-2024-25641 · Other software · Cacti · reported by GitHubCritical 9.1
Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, an arbitrary file write vulnerability, exploitable through the "Package Import" feature, allows authenticated users having the "Import Templates" permission to execute arbitrary PHP code on the web server. The vulnerability is located within the `import_package()` function defined into the `/lib/import.php` script. The function blindly trusts the filename and file content provided within the XML data, and writes such files into the Cacti base path (or even outside, since path traversal sequences are not filtered). This can be exploited to write or overwrite arbitrary files on the web server, leading to execution of arbitrary PHP code or other security impacts. Version 1.2.27 contains a patch for this issue.
- Product
- cacti
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orggithub.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.