Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,938 results · page 49 of 99
Oct 2, 2024Jenkins OpenId Connect Authentication Plugin 4.354.v321ce67a_1de8 and earlier does not check the `aud` (Audience) claim of an ID Token, allowing attackers to suCVE-2024-47806 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comHigh 8.1
Jenkins OpenId Connect Authentication Plugin 4.354.v321ce67a_1de8 and earlier does not check the `aud` (Audience) claim of an ID Token, allowing attackers to subvert the authentication flow, potentially gaining administrator access to Jenkins.
- Product
- Jenkins OpenId Connect Authentication Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2024Broken Link Checker: Reflected Cross-Site ScriptingCVE-2024-8981 · WordPress plugins & themes · reported by WordfenceHigh 7.1
The Broken Link Checker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg in /app/admin-notices/features/class-view.php without appropriate escaping on the URL in all versions up to, and including, 2.4.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Broken Link Checker
- Affected
- up to 2.4.0
- What to do
- Affects up to 2.4.0. Update Broken Link Checker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 26, 2024A host header injection vulnerability in scheduleR v0.0.18 allows attackers to obtain the password reset token via user interaction with a crafted password reseCVE-2024-45982 · Other software · scheduler · reported by MITREHigh 8.8
A host header injection vulnerability in scheduleR v0.0.18 allows attackers to obtain the password reset token via user interaction with a crafted password reset link. This allows attackers to arbitrarily reset other users' passwords and compromise their accounts.
- Product
- scheduler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 26, 2024A host header injection vulnerability in BookReviewLibrary 1.0 allows attackers to obtain the password reset token via user interaction with a crafted password CVE-2024-45981 · Other software · bookreviewlibrary · reported by MITREHigh 8.8
A host header injection vulnerability in BookReviewLibrary 1.0 allows attackers to obtain the password reset token via user interaction with a crafted password reset link.
- Product
- bookreviewlibrary
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 26, 2024A host header injection vulnerability in MEANStore 1.0 allows attackers to obtain the password reset token via user interaction with a crafted password reset liCVE-2024-45980 · Other software · meanstore · reported by MITREHigh 8.8
A host header injection vulnerability in MEANStore 1.0 allows attackers to obtain the password reset token via user interaction with a crafted password reset link. This allows attackers to arbitrarily reset other users' passwords and compromise their accounts.
- Product
- meanstore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 26, 2024A host header injection vulnerability in Lines Police CAD 1.0 allows attackers to obtain the password reset token via user interaction with a crafted password rCVE-2024-45979 · Other software · lpc · reported by MITREHigh 8.8
A host header injection vulnerability in Lines Police CAD 1.0 allows attackers to obtain the password reset token via user interaction with a crafted password reset link. This allows attackers to arbitrarily reset other users' passwords and compromise their accounts.
- Product
- lines_police_cad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2024sqlite-vec v0.1.1 was discovered to contain a heap buffer overflow via the npy_token_next function.CVE-2024-46488 · Other software · sqlite · reported by MITREMedium 5.5
sqlite-vec v0.1.1 was discovered to contain a heap buffer overflow via the npy_token_next function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted file.
- Product
- sqlite-vec
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2024In Apache Linkis <= 1.5.0, a Random string security vulnerability in Spark EngineConn, random string generated by the Token when starting Py4j uses the Commons CVE-2024-39928 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
In Apache Linkis <= 1.5.0, a Random string security vulnerability in Spark EngineConn, random string generated by the Token when starting Py4j uses the Commons Lang's RandomStringUtils. Users are recommended to upgrade to version 1.6.0, which fixes this issue.
- Product
- Apache Linkis Spark EngineConn
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Sep 19, 2024In JetBrains YouTrack before 2024.3.44799 token could be revealed on Imports pageCVE-2024-47162 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.1
In JetBrains YouTrack before 2024.3.44799 token could be revealed on Imports page
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2024This vulnerability exists in the Apex Softcell LD Geo due to improper validation of the transaction token ID in the API endpoint.CVE-2024-47089 · Other software · Apex Softcell · reported by vdisclose@cert-in.org.inHigh 8.7
This vulnerability exists in the Apex Softcell LD Geo due to improper validation of the transaction token ID in the API endpoint. An authenticated remote attacker could exploit this vulnerability by manipulating the transaction token ID in the API request leading to unauthorized access and modification of transactions belonging to other users.
- Product
- LD Geo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2024Dedecms V5.7.115 contains an arbitrary code execution via file upload vulnerability in the backend.CVE-2024-46373 · Other software · dedecms · reported by MITREHigh 8.8
Dedecms V5.7.115 contains an arbitrary code execution via file upload vulnerability in the backend.
- Product
- dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2024An attacker with access to the network where CIRCUTOR Q-SMT is located in its firmware version 1.0.4, could steal the tokens used on the web, since these have nCVE-2024-8888 · Other software · CIRCUTOR · reported by cve-coordination@incibe.esCritical 10
An attacker with access to the network where CIRCUTOR Q-SMT is located in its firmware version 1.0.4, could steal the tokens used on the web, since these have no expiration date to access the web application without restrictions. Token theft can originate from different methods such as network captures, locally stored web information, etc.
- Product
- CIRCUTOR Q-SMT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2024Hidden functionality issue in multiple digital video recorders provided by TAKENAKA ENGINEERING CO., LTD.CVE-2024-47001 · Other software · TAKENAKA ENGINEERING CO., LTD. · reported by vultures@jpcert.or.jpHigh 8.8
Hidden functionality issue in multiple digital video recorders provided by TAKENAKA ENGINEERING CO., LTD. allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter the device settings.
- Product
- HDVR-400
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2024OS command injection vulnerability in multiple digital video recorders provided by TAKENAKA ENGINEERING CO., LTD.CVE-2024-43778 · Other software · TAKENAKA ENGINEERING CO., LTD. · reported by vultures@jpcert.or.jpHigh 8.8
OS command injection vulnerability in multiple digital video recorders provided by TAKENAKA ENGINEERING CO., LTD. allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter the device settings.
- Product
- HDVR-400
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2024Improper authentication vulnerability in multiple digital video recorders provided by TAKENAKA ENGINEERING CO., LTD.CVE-2024-41929 · Other software · TAKENAKA ENGINEERING CO., LTD. · reported by vultures@jpcert.or.jpHigh 8.8
Improper authentication vulnerability in multiple digital video recorders provided by TAKENAKA ENGINEERING CO., LTD. allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter the device settings.
- Product
- HDVR-400
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2024An improper access control (IDOR) vulnerability in the /api-selfportal/get-info-token-properties endpoint in MFASOFT Secure Authentication Server (SAS) 1.8.x thCVE-2024-46937 · Other software · mfasoft · reported by MITREHigh 7.5
An improper access control (IDOR) vulnerability in the /api-selfportal/get-info-token-properties endpoint in MFASOFT Secure Authentication Server (SAS) 1.8.x through 1.9.x before 1.9.040924 allows remote attackers gain access to user tokens without authentication. The is a brute-force attack on the serial parameter by number identifier: GA00001, GA00002, GA00003, etc.
- Product
- secure_authentication_server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2024A broken access control vulnerability exists in the latest version of lunary-ai/lunary.CVE-2024-6582 · Other software · lunary-ai · reported by security@huntr.devMedium 4.3
A broken access control vulnerability exists in the latest version of lunary-ai/lunary. The `saml.ts` file allows a user from one organization to update the Identity Provider (IDP) settings and view the SSO metadata of another organization. This vulnerability can lead to unauthorized access and potential account takeover if the email of a user in the target organization is known.
- Product
- lunary-ai/lunary
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2024IBM Concert 1.0 does not set the secure attribute on authorization tokens or session cookies.CVE-2024-43180 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM Concert 1.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.
- Product
- Concert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Sep 11, 2024In Eclipse Dataspace Components, from version 0.5.0 and before version 0.9.0, the ConsumerPullTransferTokenValidationApiController does not check for token valiCVE-2024-8642 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 5.1
In Eclipse Dataspace Components, from version 0.5.0 and before version 0.9.0, the ConsumerPullTransferTokenValidationApiController does not check for token validity (expiry, not-before, issuance date), which can allow an attacker to bypass the check for token expiration. The issue requires to have a dataplane configured to support http proxy consumer pull AND include the module "transfer-data-plane". The affected code was marked deprecated from the version 0.6.0 in favour of Dataplane Signaling. In 0.9.0 the vulnerable code has been removed.
- Product
- Eclipse EDC Connector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024A low privileged remote attacker can get access to CSRF tokens of higher privileged users which can be abused to mount CSRF attacks.CVE-2024-7698 · Other software · PHOENIX CONTACT · reported by info@cert.vde.comMedium 5.7
A low privileged remote attacker can get access to CSRF tokens of higher privileged users which can be abused to mount CSRF attacks.
- Product
- FL MGUARD 2102
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024Dell PowerScale InsightIQ, versions 5.0 through 5.1, contains a Use of a Broken or Risky Cryptographic Algorithm vulnerability.CVE-2024-39583 · Other software · Dell · reported by security_alert@emc.comHigh 8.1
Dell PowerScale InsightIQ, versions 5.0 through 5.1, contains a Use of a Broken or Risky Cryptographic Algorithm vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.
- Product
- PowerScale InsightIQ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024Amin Aliakbari, member of the AXIS OS Bug Bounty Program, has found a broken access control which would lead to less-privileged operator- and/or viewer accountsCVE-2024-6979 · Other software · Axis Communications AB · reported by product-security@axis.comMedium 6.8
Amin Aliakbari, member of the AXIS OS Bug Bounty Program, has found a broken access control which would lead to less-privileged operator- and/or viewer accounts having more privileges than designed. The risk of exploitation is very low as it requires complex steps to execute, including knowing of account passwords and social engineering attacks in tricking the administrator to perform specific configurations on operator- and/or viewer-privileged accounts. Axis has released patched AXIS OS a version for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.
- Product
- AXIS OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2024An insufficient entropy vulnerability caused by the improper use of a randomness function with low entropy for web authentication tokens generation exists in thCVE-2024-38270 · Network & remote access · Zyxel · reported by security@zyxel.com.twMedium 5.3
An insufficient entropy vulnerability caused by the improper use of a randomness function with low entropy for web authentication tokens generation exists in the Zyxel GS1900-10HP firmware version V2.80(AAZI.0)C0. This vulnerability could allow a LAN-based attacker a slight chance to gain a valid session token if multiple authenticated sessions are alive.
- Product
- GS1900-10HP firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2024An improper access control vulnerability allows an attacker with valid access tokens to access saved credentials.CVE-2024-42021 · Other software · Veeam · reported by support@hackerone.comMedium 6.5
An improper access control vulnerability allows an attacker with valid access tokens to access saved credentials.
- Product
- One
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2024Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask.CVE-2024-45399 · Other software · indico · reported by GitHubMedium 4.3
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. In Indico prior to version 3.3.4, corresponding to Flask-Multipass prior to version 0.5.5, there is a Cross-Site-Scripting vulnerability during account creation when redirecting to the `next` URL. Exploitation requires initiating the account creation process with a maliciously crafted link, and then finalizing the signup process. Because of this, it can only target newly created (and thus unprivileged) Indico users. Indico 3.3.4 upgrades the dependency on Flask-Multipass to version 0.5.5, which fixes the issue. Those who build the Indico package themselves and cannot upgrade can update the `flask-multipass` dependency to `>=0.5.5` which fixes the vulnerability. Otherwise one could configure one's web server to disallow requests containing a query string with a `next` parameter that starts with `javascript:`.
- Product
- indico
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2024ShopXO 6.2 is vulnerable to Cross Site Scripting (XSS) in the backend that allows attackers to execute code by changing POST parameters.CVE-2024-44682 · Other software · Shopxo · reported by MITREMedium 6.1
ShopXO 6.2 is vulnerable to Cross Site Scripting (XSS) in the backend that allows attackers to execute code by changing POST parameters.
- Product
- Shopxo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2024The Xiaomi Security Center expresses heartfelt thanks to Ken Gannon and Ilyes Beghdadi of NCC Group working with Trend Micro Zero Day Initiative! At the same tiCVE-2024-45346 · Computers, phones & browsers · Xiaomi · reported by security@xiaomi.comHigh 8.8
The Xiaomi Security Center expresses heartfelt thanks to Ken Gannon and Ilyes Beghdadi of NCC Group working with Trend Micro Zero Day Initiative! At the same time, we also welcome more outstanding and professional security experts and security teams to join the Mi Security Center (MiSRC) to jointly ensure the safe access of millions of Xiaomi users worldwide Life.
- Product
- GetApps application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2024Netskope was notified about a security gap in Netskope Client enrollment process where NSClient is using a static token “Orgkey” as authentication parameter.CVE-2024-7401 · Other software · Netskope · reported by psirt@netskope.comHigh 8.5
Netskope was notified about a security gap in Netskope Client enrollment process where NSClient is using a static token “Orgkey” as authentication parameter. Since this is a static token, if leaked, cannot be rotated or revoked. A malicious actor can use this token to enroll NSClient from a customer’s tenant and impersonate a user.
- Product
- Netskope Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.netskope.comquickskope.com
Aug 23, 2024Guest users in the Mage AI framework that remain logged in after their accounts are deleted, are mistakenly given high privileges and specifically given access CVE-2024-45187 · Other software · mage · reported by reefs@jfrog.comHigh 7.1
Guest users in the Mage AI framework that remain logged in after their accounts are deleted, are mistakenly given high privileges and specifically given access to remotely execute arbitrary code through the Mage AI terminal server
- Product
- mage-ai
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 23, 2024A host header injection vulnerability in Staff Appraisal System v1.0 allows attackers to obtain the password reset token via user interaction with a crafted pasCVE-2024-42915 · Other software · staff_appraisal_system · reported by MITREHigh 8
A host header injection vulnerability in Staff Appraisal System v1.0 allows attackers to obtain the password reset token via user interaction with a crafted password reset link. This will allow attackers to arbitrarily reset other users' passwords and compromise their accounts.
- Product
- staff_appraisal_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2024In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: make apf token non-zero to fix bug In current async pagefault logic, when a CVE-2022-48943 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.1
In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: make apf token non-zero to fix bug In current async pagefault logic, when a page is ready, KVM relies on kvm_arch_can_dequeue_async_page_present() to determine whether to deliver a READY event to the Guest. This function test token value of struct kvm_vcpu_pv_apf_data, which must be reset to zero by Guest kernel when a READY event is finished by Guest. If value is zero meaning that a READY event is done, so the KVM can deliver another. But the kvm_arch_setup_async_pf() may produce a valid token with zero value, which is confused with previous mention and may lead the loss of this READY event. This bug may cause task blocked forever in Guest: INFO: task stress:7532 blocked for more than 1254 seconds. Not tainted 5.10.0 #16 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:stress state:D stack: 0 pid: 7532 ppid: 1409 flags:0x00000080 Call Trace: __schedule+0x1e7/0x650 schedule+0x46/0xb0 kvm_async_pf_task_wait_schedule+0xad/0xe0 ? exit_to_user_mode_prepare+0x60/0x70 __kvm_handle_async_pf+0x4f/0xb0 ? asm_exc_page_fault+0x8/0x30 exc_pag
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Aug 22, 2024In the Linux kernel, the following vulnerability has been resolved: CDC-NCM: avoid overflow in sanity checking A broken device may give an extreme offset likeCVE-2022-48938 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: CDC-NCM: avoid overflow in sanity checking A broken device may give an extreme offset like 0xFFF0 and a reasonable length for a fragment. In the sanity check as formulated now, this will create an integer overflow, defeating the sanity check. Both offset and offset + len need to be checked in such a manner that no overflow can occur. And those quantities should be unsigned.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Aug 21, 2024A vulnerability found in OpenText Privileged Access Manager that issues a token.CVE-2020-11846 · Other software · OpenText · reported by security@opentext.comHigh 8.7
A vulnerability found in OpenText Privileged Access Manager that issues a token. on successful issuance of the token, a cookie gets set that allows unrestricted access to all the application resources. This issue affects Privileged Access Manager before 3.7.0.1.
- Product
- Privileged Access Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2024Improper Access Controls allows backend users to overwrite their username when disallowed.CVE-2024-27187 · Websites & servers · Joomla! Project · reported by security@joomla.orgHigh 7.5
Improper Access Controls allows backend users to overwrite their username when disallowed.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2024In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: wow: fix GTK offload H2C skbuff issue We mistakenly put skb too large and thaCVE-2024-43844 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: wow: fix GTK offload H2C skbuff issue We mistakenly put skb too large and that may exceed skb->end. Therefore, we fix it. skbuff: skb_over_panic: text:ffffffffc09e9a9d len:416 put:204 head:ffff8fba04eca780 data:ffff8fba04eca7e0 tail:0x200 end:0x140 dev:<NULL> ------------[ cut here ]------------ kernel BUG at net/core/skbuff.c:192! invalid opcode: 0000 [#1] PREEMPT SMP PTI CPU: 1 PID: 4747 Comm: kworker/u4:44 Tainted: G O 6.6.30-02659-gc18865c4dfbd #1 86547039b47e46935493f615ee31d0b2d711d35e Hardware name: HP Meep/Meep, BIOS Google_Meep.11297.262.0 03/18/2021 Workqueue: events_unbound async_run_entry_fn RIP: 0010:skb_panic+0x5d/0x60 Code: c6 63 8b 8f bb 4c 0f 45 f6 48 c7 c7 4d 89 8b bb 48 89 ce 44 89 d1 41 56 53 41 53 ff b0 c8 00 00 00 e8 27 5f 23 00 48 83 c4 20 <0f> 0b 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 RSP: 0018:ffffaa700144bad0 EFLAGS: 00010282 RAX: 0000000000000089 RBX: 0000000000000140 RCX: 14432c5aad26c900 RDX: 0000000000000000 RSI: 00000000ffffdfff RDI: 0000000000000001 RBP: ffffaa700144bae0 R08: 0000000000000000 R09: ffffaa700144b920 R10: 00000000ffff
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Aug 14, 2024The Central Manager user session refresh token does not expire when a user logs out.CVE-2024-39809 · Network & remote access · F5 · reported by f5sirt@f5.comHigh 8.9
The Central Manager user session refresh token does not expire when a user logs out. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
- Product
- BIG-IP Next Central Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2024In SAP BusinessObjects Business Intelligence Platform, if Single Signed On is enabled on Enterprise authentication, an unauthorized user can get a logon token uCVE-2024-41730 · Network & remote access · SAP_SE · reported by cna@sap.comCritical 9.8
In SAP BusinessObjects Business Intelligence Platform, if Single Signed On is enabled on Enterprise authentication, an unauthorized user can get a logon token using a REST endpoint. The attacker can fully compromise the system resulting in High impact on confidentiality, integrity and availability.
- Product
- SAP BusinessObjects Business Intelligence Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2024Insufficiently random values for generating activation token in FIWARE Keyrock <= 8.4 allow attackers to activate accounts of any user by predicting the token fCVE-2024-42165 · Other software · FIWARE · reported by office@cyberdanube.comMedium 6.3
Insufficiently random values for generating activation token in FIWARE Keyrock <= 8.4 allow attackers to activate accounts of any user by predicting the token for the activation link.
- Product
- FIWARE Keyrock
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2024Insufficiently random values for generating password reset token in FIWARE Keyrock <= 8.4 allow attackers to disable two factor authorization of any user by preCVE-2024-42164 · Other software · FIWARE · reported by office@cyberdanube.comMedium 4.3
Insufficiently random values for generating password reset token in FIWARE Keyrock <= 8.4 allow attackers to disable two factor authorization of any user by predicting the token for the disable_2fa link.
- Product
- FIWARE Keyrock
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2024Insufficiently random values for generating password reset token in FIWARE Keyrock <= 8.4 allow attackers to take over the account of any user by predicting theCVE-2024-42163 · Other software · FIWARE · reported by office@cyberdanube.comHigh 8.3
Insufficiently random values for generating password reset token in FIWARE Keyrock <= 8.4 allow attackers to take over the account of any user by predicting the token for the password reset link.
- Product
- FIWARE Keyrock
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2024Password reset tokens are generated using an insecure source of randomness.CVE-2024-6890 · Other software · Journyx · reported by bbf0bd87-ece2-41be-b873-96928ee8fab9High 8.8
Password reset tokens are generated using an insecure source of randomness. Attackers who know the username of the Journyx installation user can bruteforce the password reset and change the administrator password.
- Product
- Journyx (jtime)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkorelogic.comseclists.org
Aug 6, 2024It's possible for a gRPC client communicating with a HTTP/2 proxy to poison the HPACK table between the proxy and the backend such that other clients see failedCVE-2024-7246 · Computers, phones & browsers · Google · reported by cve-coordination@google.comMedium 6.3
It's possible for a gRPC client communicating with a HTTP/2 proxy to poison the HPACK table between the proxy and the backend such that other clients see failed requests. It's also possible to use this vulnerability to leak other clients HTTP header keys, but not values. This occurs because the error status for a misencoded header is not cleared between header reads, resulting in subsequent (incrementally indexed) added headers in the first request being poisoned until cleared from the HPACK table. Please update to a fixed version of gRPC as soon as possible. This bug has been fixed in 1.58.3, 1.59.5, 1.60.2, 1.61.3, 1.62.3, 1.63.2, 1.64.3, 1.65.4.
- Product
- gRPC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2024Biscuit is an authorization token with decentralized verification, offline attenuation and strong security policy enforcement based on a logic language.CVE-2024-42350 · Other software · biscuit-auth · reported by GitHubLow 3
Biscuit is an authorization token with decentralized verification, offline attenuation and strong security policy enforcement based on a logic language. Third-party blocks can be generated without transferring the whole token to the third-party authority. Instead, a `ThirdPartyBlock` request can be sent, providing only the necessary info to generate a third-party block and to sign it: 1. the public key of the previous block (used in the signature), 2. the public keys part of the token symbol table (for public key interning in datalog expressions). A third-part block request forged by a malicious user can trick the third-party authority into generating datalog trusting the wrong keypair. Tokens with third-party blocks containing `trusted` annotations generated through a third party block request. This has been addressed in version 4 of the specification. Users are advised to update their implementations to conform. There are no known workarounds for this vulnerability.
- Product
- biscuit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2024mod_css_styles in Roundcube through 1.5.7 and 1.6.x through 1.6.7 insufficiently filters Cascading Style Sheets (CSS) token sequences in rendered e-mail messageCVE-2024-42010 · Websites & servers · roundcube · reported by MITREHigh 7.5
mod_css_styles in Roundcube through 1.5.7 and 1.6.x through 1.6.7 insufficiently filters Cascading Style Sheets (CSS) token sequences in rendered e-mail messages, allowing a remote attacker to obtain sensitive information.
- Product
- roundcube
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2024In Apache Linkis <= 1.5.0, Privilege Escalation in Basic management services where the attacking user is a trusted account allows access to Linkis's Token CVE-2024-27181 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.8
In Apache Linkis <= 1.5.0, Privilege Escalation in Basic management services where the attacking user is a trusted account allows access to Linkis's Token information. Users are advised to upgrade to version 1.6.0, which fixes this issue.
- Product
- Apache Linkis Basic management services
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Aug 1, 2024biscuit-rust is the Rust implementation of Biscuit, an authentication and authorization token for microservices architectures.CVE-2024-41949 · Other software · biscuit-auth · reported by GitHubLow 3
biscuit-rust is the Rust implementation of Biscuit, an authentication and authorization token for microservices architectures. Third-party blocks can be generated without transferring the whole token to the third-party authority. Instead, a ThirdPartyBlock request can be sent, providing only the necessary info to generate a third-party block and to sign it, which includes the public key of the previous block (used in the signature) and the public keys part of the token symbol table (for public key interning in datalog expressions). A third-part block request forged by a malicious user can trick the third-party authority into generating datalog trusting the wrong keypair.
- Product
- biscuit-rust
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 1, 2024biscuit-java is the java implementation of Biscuit, an authentication and authorization token for microservices architectures.CVE-2024-41948 · Other software · biscuit-auth · reported by GitHubLow 3
biscuit-java is the java implementation of Biscuit, an authentication and authorization token for microservices architectures. Third-party blocks can be generated without transferring the whole token to the third-party authority. Instead, a ThirdPartyBlock request can be sent, providing only the necessary info to generate a third-party block and to sign it, which includes the public key of the previous block (used in the signature) and the public keys part of the token symbol table (for public key interning in datalog expressions). A third-part block request forged by a malicious user can trick the third-party authority into generating datalog trusting the wrong keypair. This vulnerability is fixed in 4.0.0.
- Product
- biscuit-java
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 1, 2024Under certain circumstances the exacqVision Web Service can expose authentication token details within communications.CVE-2024-32931 · Other software · Johnson Controls · reported by productsecurity@jci.comMedium 5.7
Under certain circumstances the exacqVision Web Service can expose authentication token details within communications.
- Product
- exacqVision
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcisa.govjohnsoncontrols.com
Aug 1, 2024Dell InsightIQ, Verion 5.0.0, contains a use of a broken or risky cryptographic algorithm vulnerability.CVE-2024-28972 · Other software · Dell · reported by security_alert@emc.comMedium 5.9
Dell InsightIQ, Verion 5.0.0, contains a use of a broken or risky cryptographic algorithm vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to information disclosure.
- Product
- InsightIQ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2024In versions of Akana API Platform prior to 2024.1.0, SAML tokens can be replayed.CVE-2024-5249 · Other software · Akana · reported by security@puppet.comMedium 5.4
In versions of Akana API Platform prior to 2024.1.0, SAML tokens can be replayed.
- Product
- Akana API Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.perforce.comportal.perforce.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.