Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,938 results · page 47 of 99
Feb 18, 2025Improperly built order clauses lead to a SQL injection vulnerability in the backend task list of com_scheduler.CVE-2025-22207 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 6.7
Improperly built order clauses lead to a SQL injection vulnerability in the backend task list of com_scheduler.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2025Wazuh SIEM version 4.8.2 is affected by a broken access control vulnerability.CVE-2024-57378 · Other software · reported by MITREHigh 7.3
Wazuh SIEM version 4.8.2 is affected by a broken access control vulnerability. This issue allows the unauthorized creation of internal users without assigning any existing user role, potentially leading to privilege escalation or unauthorized access to sensitive resources.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025An issue in MaysWind ezBookkeeping 0.7.0 allows a remote attacker to escalate privileges via the token component.CVE-2024-57604 · Other software · Mayswind · reported by MITRECritical 9.8
An issue in MaysWind ezBookkeeping 0.7.0 allows a remote attacker to escalate privileges via the token component.
- Product
- Ezbookkeeping
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025go-crypto-winnative Go crypto backend for Windows using Cryptography API: Next Generation (CNG).CVE-2025-25199 · Computers, phones & browsers · microsoft · reported by GitHubHigh 7.5
go-crypto-winnative Go crypto backend for Windows using Cryptography API: Next Generation (CNG). Prior to commit f49c8e1379ea4b147d5bff1b3be5b0ff45792e41, calls to `cng.TLS1PRF` don't release the key handle, producing a small memory leak every time. Commit f49c8e1379ea4b147d5bff1b3be5b0ff45792e41 contains a fix for the issue. The fix is included in versions 1.23.6-2 and 1.22.12-2 of the Microsoft build of go, as well as in the pseudoversion 0.0.0-20250211154640-f49c8e1379ea of the `github.com/microsoft/go-crypto-winnative` Go package.
- Product
- go-crypto-winnative
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025In Progress® Telerik® Kendo UI for Vue versions v2.4.0 through v6.0.1, an attacker can introduce or modify properties within the global prototype chain which caCVE-2024-11628 · Other software · Progress Software · reported by security@progress.comMedium 4.1
In Progress® Telerik® Kendo UI for Vue versions v2.4.0 through v6.0.1, an attacker can introduce or modify properties within the global prototype chain which can result in denial of service or command injection.
- Product
- Progress® Telerik® Kendo UI for Vue
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025In Progress® Telerik® KendoReact versions v3.5.0 through v9.4.0, an attacker can introduce or modify properties within the global prototype chain which can resuCVE-2024-12629 · Other software · Progress Software · reported by security@progress.comMedium 4.1
In Progress® Telerik® KendoReact versions v3.5.0 through v9.4.0, an attacker can introduce or modify properties within the global prototype chain which can result in denial of service or command injection.
- Product
- Telerik KendoReact
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2025Cleartext Storage of Sensitive Information vulnerability in Salesforce Tableau Server can record the Personal Access Token (PAT) into logging repositories.This CVE-2025-26495 · Other software · Salesforce · reported by security@salesforce.comHigh 7.5
Cleartext Storage of Sensitive Information vulnerability in Salesforce Tableau Server can record the Personal Access Token (PAT) into logging repositories.This issue affects Tableau Server: before 2022.1.3, before 2021.4.8, before 2021.3.13, before 2021.2.14, before 2021.1.16, before 2020.4.19.
- Product
- Tableau Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 7, 2025pimcore/admin-ui-classic-bundle provides a Backend UI for Pimcore.CVE-2025-24980 · Other software · pimcore · reported by GitHubMedium 6.9
pimcore/admin-ui-classic-bundle provides a Backend UI for Pimcore. In affected versions an error message discloses existing accounts and leads to user enumeration on the target via "Forgot password" function. No generic error message has been implemented. This issue has been addressed in version 1.7.4 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- admin-ui-classic-bundle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2025Using API in the 2N OS device, authorized user can enable logging, which discloses valid authentication tokens in system log.CVE-2024-13416 · Other software · 2N · reported by product-security@axis.comMedium 4.3
Using API in the 2N OS device, authorized user can enable logging, which discloses valid authentication tokens in system log. 2N has released an updated version 2.46 of 2N OS, where this vulnerability is mitigated. It is recommended that all customers update their devices to the latest 2N OS.
- Product
- 2N OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2025Dell Avamar, version 19.4 or later, contains an access token reuse vulnerability in the AUI.CVE-2025-21117 · Other software · Dell · reported by security_alert@emc.comMedium 6.6
Dell Avamar, version 19.4 or later, contains an access token reuse vulnerability in the AUI. A low privileged local attacker could potentially exploit this vulnerability, leading to fully impersonating the user.
- Product
- Avamar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2025Broken access control vulnerability in Geovision GV-ASWeb with version v6.1.0.0 or less.CVE-2024-56898 · Other software · reported by MITREHigh 8.8
Broken access control vulnerability in Geovision GV-ASWeb with version v6.1.0.0 or less. This vulnerability allows low privilege users perform actions that they aren't authorized to, which can be leveraged to escalate privileges, create, modify or delete accounts.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2025Xerox Workplace Suite stores tokens in session storage, which may expose them to potential access if a user's session is compromised.CVE-2024-55931 · Other software · Xerox · reported by 10b61619-3869-496c-8a1e-f291b0e71e3fMedium 6.5
Xerox Workplace Suite stores tokens in session storage, which may expose them to potential access if a user's session is compromised. The patch for this vulnerability will be included in a future release of Workplace Suite, and customers will be notified through an update to the security bulletin.
- Product
- Xerox Workplace Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecuritydocs.business.xerox.com
Jan 26, 2025IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 does not set the secure attribute on authorization tokens or sessionCVE-2024-28771 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.8
IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.
- Product
- Security Directory Integrator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2025IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 does not set the secure attribute on authorization tokens or sessionCVE-2024-28770 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.8
IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.
- Product
- Security Directory Integrator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2025IBM Common Licensing 9.0 could allow an authenticated user to modify a configuration file that they should not have access to due to a broken authorization mecCVE-2023-50946 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM Common Licensing 9.0 could allow an authenticated user to modify a configuration file that they should not have access to due to a broken authorization mechanism.
- Product
- Common Licensing
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 24, 2025One Backend Language: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23837 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in martinjuhasz One Backend Language one-backend-language allows Reflected XSS.This issue affects One Backend Language: from n/a through <= 1.0.
- Product
- One Backend Language
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update One Backend Language to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2025A vulnerability in Xerox Workplace Suite arises from flawed token generation and the use of hard-coded keys.CVE-2024-55927 · Other software · Xerox · reported by 10b61619-3869-496c-8a1e-f291b0e71e3fHigh 7.6
A vulnerability in Xerox Workplace Suite arises from flawed token generation and the use of hard-coded keys. These weaknesses allow attackers to predict or forge tokens, leading to unauthorized access to sensitive functions.
- Product
- Xerox Workplace Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecuritydocs.business.xerox.com
Jan 21, 2025In JetBrains YouTrack before 2024.3.55417 permanent tokens could be exposed in logsCVE-2025-24457 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.5
In JetBrains YouTrack before 2024.3.55417 permanent tokens could be exposed in logs
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2025In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: adapt set backend to use GC transaction API Use the GC transaction ACVE-2023-52923 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: adapt set backend to use GC transaction API Use the GC transaction API to replace the old and buggy gc API and the busy mark approach. No set elements are removed from async garbage collection anymore, instead the _DEAD bit is set on so the set element is not visible from lookup path anymore. Async GC enqueues transaction work that might be aborted and retried later. rbtree and pipapo set backends does not set on the _DEAD bit from the sync GC path since this runs in control plane path where mutex is held. In this case, set elements are deactivated, removed and then released via RCU callback, sync GC never fails.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jan 18, 2025MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Tokens Wallet: Stored Cross-Site ScriptingCVE-2024-13391 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Tokens Wallet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'videowhisper_content_upload_guest' shortcode in all versions up to, and including, 2.9.29 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Tokens Wallet
- Affected
- up to 2.9.29
- What to do
- Affects up to 2.9.29. Update MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Tokens Wallet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 17, 2025A valid set of credentials in a .js file and a static token for communication were obtained from the decompiled IPA.CVE-2024-53683 · Other software · Ossur · reported by ics-cert@hq.dhs.govMedium 5.6
A valid set of credentials in a .js file and a static token for communication were obtained from the decompiled IPA. An attacker could use the information to disrupt normal use of the application by changing the translation files and thus weaken the integrity of normal use.
- Product
- Mobile Logic Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2025A Broken Object Level Authorization (BOLA) vulnerability in Indico through 3.3.5 allows attackers to read information by sending a crafted POST request to the cCVE-2024-50633 · Other software · CERN · reported by MITRENone
A Broken Object Level Authorization (BOLA) vulnerability in Indico through 3.3.5 allows attackers to read information by sending a crafted POST request to the component /api/principals. NOTE: this is disputed by the Supplier because the product intentionally lets all users retrieve certain information about other user accounts (this functionality is, in the current design, not restricted to any privileged roles such as event organizer).
- Product
- Indico
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2025A “Use of a Broken or Risky Cryptographic Algorithm” vulnerability in the SSL/TLS component used in B&R Automation Runtime versions before 6.1 and B&R mapp ViewCVE-2024-8603 · Other software · B&R Industrial Automation · reported by cybersecurity@ch.abb.comHigh 8.2
A “Use of a Broken or Risky Cryptographic Algorithm” vulnerability in the SSL/TLS component used in B&R Automation Runtime versions before 6.1 and B&R mapp View versions before 6.1 may be abused by unauthenticated network-based attackers to masquerade as services on impacted devices.
- Product
- Automation Runtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2025HCL MyXalytics is affected by broken authentication.CVE-2024-42172 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.3
HCL MyXalytics is affected by broken authentication. It allows attackers to compromise keys, passwords, and session tokens, potentially leading to identity theft and system control. This vulnerability arises from poor configuration, logic errors, or software bugs and can affect any application with access control, including databases, network infrastructure, and web applications.
- Product
- DRYiCE MyXalytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Jan 10, 2025Specially constructed queries cause cross platform scripting leaking administrator tokensCVE-2024-9188 · Other software · Arista Networks · reported by psirt@arista.comHigh 8.8
Specially constructed queries cause cross platform scripting leaking administrator tokens
- Product
- Arista Edge Threat Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2025A user with administrator privileges is able to retrieve authentication tokensCVE-2024-9133 · Other software · Arista Networks · reported by psirt@arista.comMedium 6.6
A user with administrator privileges is able to retrieve authentication tokens
- Product
- Arista Edge Threat Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2025Expired and unusable administrator authentication tokens can be revealed by units that have timed out from ETM accessCVE-2024-47517 · Other software · Arista Networks · reported by psirt@arista.comMedium 6.8
Expired and unusable administrator authentication tokens can be revealed by units that have timed out from ETM access
- Product
- Arista Edge Threat Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2025Canlineapp Online 1.1 is vulnerable to Broken Access Control and allows users with the Auditor role to create an audit template as a result of improper authorizCVE-2024-56114 · Other software · Henkel · reported by MITREMedium 6.5
Canlineapp Online 1.1 is vulnerable to Broken Access Control and allows users with the Auditor role to create an audit template as a result of improper authorization checks. This feature is designated for supervisor role, but auditors have been able to successfully create audit templates from their account.
- Product
- Canlineapp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.come-connectsolutions.com
Jan 9, 2025Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in the SonicOS SSLVPN authentication token generator that, in certain cases, can be predicteCVE-2024-40762 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comCritical 9.8
Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in the SonicOS SSLVPN authentication token generator that, in certain cases, can be predicted by an attacker potentially resulting in authentication bypass.
- Product
- SonicOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.global.sonicwall.com
Jan 7, 2025IBM Cognos Controller 11.0.0 through 11.0.1 and IBM Controller 11.1.0 could allow an unauthorized user to obtain valid tokens to gain access to protected resourCVE-2024-40702 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.2
IBM Cognos Controller 11.0.0 through 11.0.1 and IBM Controller 11.1.0 could allow an unauthorized user to obtain valid tokens to gain access to protected resources due to improper certificate validation.
- Product
- Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025Improper Neutralization of Input During CMS Backend (adminstrative section) Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Progress SitefiCVE-2024-11626 · Other software · Progress Software Corporation · reported by security@progress.comHigh 8.4
Improper Neutralization of Input During CMS Backend (adminstrative section) Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Progress Sitefinity.This issue affects Sitefinity: from 4.0 through 14.4.8142, from 15.0.8200 through 15.0.8229, from 15.1.8300 through 15.1.8327, from 15.2.8400 through 15.2.8421.
- Product
- Sitefinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.progress.comprogress.com
Jan 6, 2025Transient DOS can occur when GVM sends a specific message type to the Vdev-FastRPC backend.CVE-2024-45559 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 5.5
Transient DOS can occur when GVM sends a specific message type to the Vdev-FastRPC backend.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 3, 2025IBM PowerHA SystemMirror for i 7.4 and 7.5 does not set the secure attribute on authorization tokens or session cookies.CVE-2024-55897 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM PowerHA SystemMirror for i 7.4 and 7.5 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.
- Product
- i
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2025Tokens in CTFd used for account activation and password resetting can be used interchangeably for these operations.CVE-2024-11717 · Other software · CTFd · reported by cvd@cert.plMedium 6.3
Tokens in CTFd used for account activation and password resetting can be used interchangeably for these operations. When used, they are sent to the server as a GET parameter and they are not single use, which means, that during token expiration time an on-path attacker might reuse such a token to change user's password and take over the account. Moreover, the tokens also include base64 encoded user email. This issue impacts releases up to 3.7.4 and was addressed by pull request 2679 https://github.com/CTFd/CTFd/pull/2679 included in 3.7.5 release.
- Product
- CTFd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2025Kentico CMS in version 7 is vulnerable to a Reflected XSS attacks through manipulation of a specific GET request parameter sent to /CMSMessages/AccessDenied.asCVE-2024-12907 · Other software · Kentico · reported by cvd@cert.plMedium 5.3
Kentico CMS in version 7 is vulnerable to a Reflected XSS attacks through manipulation of a specific GET request parameter sent to /CMSMessages/AccessDenied.aspx endpoint. Notably, support for this version of Kentico ended in 2016. Version 8 was tested as well and does not contain this vulnerability.
- Product
- Kentico CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2025Broken Link Checker | Finder: Missing AuthorizationCVE-2023-46082 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Cyberlord92 Broken Link Checker | Finder broken-link-finder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Broken Link Checker | Finder: from n/a through <= 2.4.2.
- Product
- Broken Link Checker | Finder
- Affected
- up to 2.4.2
- What to do
- Affects up to 2.4.2. Update Broken Link Checker | Finder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2024Smadar SPS – CWE-327: Use of a Broken or Risky Cryptographic AlgorithmCVE-2024-47921 · Other software · Smadar · reported by cna@cyber.gov.ilHigh 8.4
Smadar SPS – CWE-327: Use of a Broken or Risky Cryptographic Algorithm
- Product
- SPS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2024Broken Link Checker: Does not validate a the link URLs before making a request to themCVE-2024-10903 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Broken Link Checker WordPress plugin before 2.4.2 does not validate a the link URLs before making a request to them, which could allow admin users to perform SSRF attack, for example on a multisite installation.
- Product
- Broken Link Checker
- Fixed in
- 2.4.2
- What to do
- Update Broken Link Checker to 2.4.2 or newer.
Dec 20, 2024Onyxia is a web app that aims at being the glue between multiple open source backend technologies to provide a state of art working environment for data scientiCVE-2024-56333 · Other software · InseeFrLab · reported by GitHubCritical 9.4
Onyxia is a web app that aims at being the glue between multiple open source backend technologies to provide a state of art working environment for data scientists. This critical vulnerability allows authenticated users to remotely execute code within the Onyxia-API, leading to potential consequences such as unauthorized access to other user environments and denial of service attacks. This issue has been patched in api versions 4.2.0, 3.1.1, and 2.8.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- onyxia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.onyxia.shgithub.com
Dec 20, 2024In JetBrains TeamCity before 2024.12 access tokens were not revoked after removing user rolesCVE-2024-56351 · Other software · JetBrains · reported by cve@jetbrains.comMedium 6.3
In JetBrains TeamCity before 2024.12 access tokens were not revoked after removing user roles
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2024Nomad Community and Nomad Enterprise ("Nomad") allocations are vulnerable to privilege escalation within a namespace through unredacted workload identity tokensCVE-2024-12678 · Other software · HashiCorp · reported by security@hashicorp.comMedium 6.5
Nomad Community and Nomad Enterprise ("Nomad") allocations are vulnerable to privilege escalation within a namespace through unredacted workload identity tokens. This vulnerability, identified as CVE-2024-12678, is fixed in Nomad Community Edition 1.9.4 and Nomad Enterprise 1.9.4, 1.8.8, and 1.7.16.
- Product
- Nomad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2024cjwt is a C JSON Web Token (JWT) Implementation.CVE-2024-54150 · Other software · xmidt-org · reported by GitHubHigh 8.7
cjwt is a C JSON Web Token (JWT) Implementation. Algorithm confusion occurs when a system improperly verifies the type of signature used, allowing attackers to exploit the lack of distinction between signing methods. If the system doesn't differentiate between an HMAC signed token and an RS/EC/PS signed token during verification, it becomes vulnerable to this kind of attack. For instance, an attacker could craft a token with the alg field set to "HS256" while the server expects an asymmetric algorithm like "RS256". The server might mistakenly use the wrong verification method, such as using a public key as the HMAC secret, leading to unauthorised access. For RSA, the key can be computed from a few signatures. For Elliptic Curve (EC), two potential keys can be recovered from one signature. This can be used to bypass the signature mechanism if an application relies on asymmetrically signed tokens. This issue has been addressed in version 2.3.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- cjwt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2024Broken Link Checker | Finder: Blind Server-Side Request ForgeryCVE-2024-12121 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Broken Link Checker | Finder plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 2.5.0 via the 'moblc_check_link' function. This makes it possible for authenticated attackers, with Author-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
- Product
- Broken Link Checker | Finder
- Affected
- up to 2.5.0
- What to do
- Affects up to 2.5.0. Update Broken Link Checker | Finder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 18, 2024Keyfactor Command before 12.5.0 has Incorrect Access Control: access tokens are over permissioned, aka 64099.CVE-2024-49202 · Other software · reported by MITREHigh 7.6
Keyfactor Command before 12.5.0 has Incorrect Access Control: access tokens are over permissioned, aka 64099. The fixed versions are 11.5.1.1, 11.5.2.1, 11.5.3.1, 11.5.4.5, 11.5.6.1, 11.6.0, 12.2.0.1, 12.3.0.1, 12.4.0.1, 12.5.0, and 24.4.0.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkeyfactor.comsoftware.keyfactor.com
Dec 18, 2024GetSimple CMS CE 3.3.19 is vulnerable to Server-Side Request Forgery (SSRF) in the backend plugin module.CVE-2024-55088 · Other software · Getsimple-ce · reported by MITREHigh 8.8
GetSimple CMS CE 3.3.19 is vulnerable to Server-Side Request Forgery (SSRF) in the backend plugin module.
- Product
- Getsimple CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgetsimple-ce.ovhtasteful-stamp-da4.notion.site
Dec 18, 2024In the GetSimple CMS CE 3.3.19 management page, Server-Side Request Forgery (SSRF) can be achieved in the plug-in download address in the backend management sysCVE-2024-55086 · Other software · Getsimple-ce · reported by MITREHigh 7.2
In the GetSimple CMS CE 3.3.19 management page, Server-Side Request Forgery (SSRF) can be achieved in the plug-in download address in the backend management system.
- Product
- Getsimple CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgetsimple-ce.ovhtasteful-stamp-da4.notion.site
Dec 18, 2024Inclusion of undocumented features or chicken bits issue exists in AE1021 firmware versions 2.0.10 and earlier and AE1021PE firmware versions 2.0.10 and earlierCVE-2024-54457 · Other software · FXC Inc. · reported by vultures@jpcert.or.jpHigh 7.2
Inclusion of undocumented features or chicken bits issue exists in AE1021 firmware versions 2.0.10 and earlier and AE1021PE firmware versions 2.0.10 and earlier, which may allow a logged-in user to enable telnet service.
- Product
- AE1021
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2024CyberPanel (aka Cyber Panel) before f0cf648 allows XSS via token or username to plogical/phpmyadminsignin.php.CVE-2024-56112 · Other software · Cyberpanel · reported by MITREMedium 6.1
CyberPanel (aka Cyber Panel) before f0cf648 allows XSS via token or username to plogical/phpmyadminsignin.php.
- Product
- Cyberpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcyberpanel.netgithub.com
Dec 13, 2024Dell RecoverPoint for VMs, version(s) 6.0.x contain(s) a Use of a Broken or Risky Cryptographic Algorithm vulnerability in the SSH.CVE-2024-28980 · Other software · Dell · reported by security_alert@emc.comMedium 6.5
Dell RecoverPoint for VMs, version(s) 6.0.x contain(s) a Use of a Broken or Risky Cryptographic Algorithm vulnerability in the SSH. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Remote execution.
- Product
- RecoverPoint for Virtual Machines
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2024Kraken.io Image Optimizer: Missing AuthorizationCVE-2023-22708 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Karim Salman Kraken.io Image Optimizer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kraken.io Image Optimizer: from n/a through 2.6.7.
- Product
- Kraken.io Image Optimizer
- Affected
- up to 2.6.7
- What to do
- Affects up to 2.6.7. Update Kraken.io Image Optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.