Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
669 results · page 5 of 14
Jun 9, 2025Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection in the Service Account Auditing reports.CVE-2025-27709 · Other software · ManageEngine · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 8.3
Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection in the Service Account Auditing reports.
- Product
- ADAudit Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2025Zohocorp ManageEngine ADAudit Plus versions below 8511 are vulnerable to SQL injection in the OU History report.CVE-2025-41407 · Other software · ManageEngine · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 8.3
Zohocorp ManageEngine ADAudit Plus versions below 8511 are vulnerable to SQL injection in the OU History report.
- Product
- ADAudit Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2025Zohocorp ManageEngine ADAudit Plus versions below 8511 are vulnerable to SQL injection while exporting reports.CVE-2025-36527 · Other software · ManageEngine · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 8.3
Zohocorp ManageEngine ADAudit Plus versions below 8511 are vulnerable to SQL injection while exporting reports.
- Product
- ADAudit Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2025Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection while fetching service account audit data.CVE-2025-41403 · Other software · ManageEngine · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 8.3
Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection while fetching service account audit data.
- Product
- ADAudit Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2025Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection in the logon events aggregate report.CVE-2025-3836 · Other software · ManageEngine · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 8.3
Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection in the logon events aggregate report.
- Product
- ADAudit Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2025Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection in the OU History report.CVE-2025-3834 · Other software · ManageEngine · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 8.1
Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection in the OU History report.
- Product
- ADAudit Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2025Vault Community and Vault Enterprise Key/Value (kv) Version 2 plugin may unintentionally expose sensitive information in server and audit logs when users submitCVE-2025-4166 · Other software · HashiCorp · reported by security@hashicorp.comMedium 4.5
Vault Community and Vault Enterprise Key/Value (kv) Version 2 plugin may unintentionally expose sensitive information in server and audit logs when users submit malformed payloads during secret creation or update operations via the Vault REST API. This vulnerability, identified as CVE-2025-4166, is fixed in Vault Community 1.19.3 and Vault Enterprise 1.19.3, 1.18.9, 1.17.16, 1.16.20.
- Product
- Vault
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2025Mattermost versions 9.11.x <= 9.11.8 fail to enforce proper access controls on the /api/v4/audits endpoint, allowing users with delegated granular administratiCVE-2025-24866 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comLow 2.7
Mattermost versions 9.11.x <= 9.11.8 fail to enforce proper access controls on the /api/v4/audits endpoint, allowing users with delegated granular administration roles who lack access to Compliance Monitoring to retrieve User Activity Logs.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2025An authentication bypass vulnerability was found in Videx's CyberAudit-Web.CVE-2025-22375 · Other software · Videx Inc. · reported by csirt@divd.nlCritical 9.3
An authentication bypass vulnerability was found in Videx's CyberAudit-Web. Through the exploitation of a logic flaw, an attacker could create a valid session without any credentials. This vulnerability has been patched in versions later than 9.5 and a patch has been made available to all instances of CyberAudit-Web, including the versions that are End of Maintenance (EOM). Anyone that requires support with the resolution of this issue can contact support@videx.com for assistance.
- Product
- CyberAudit-Web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcsirt.divd.nlcsirt.divd.nl
Apr 10, 2025A Server-Side Request Forgery (SSRF) vulnerability was discovered in the videx-legacy-ssl web service of Videx’s CyberAudit-Web, affecting versions prior to 1.1CVE-2025-22374 · Other software · Videx Inc. · reported by csirt@divd.nlMedium 6
A Server-Side Request Forgery (SSRF) vulnerability was discovered in the videx-legacy-ssl web service of Videx’s CyberAudit-Web, affecting versions prior to 1.1.3. This vulnerability has been patched in versions after 1.1.3. Leaving this vulnerability unpatched could lead to unauthorized access to the underlying infrastructure.
- Product
- CyberAudit-Web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcsirt.divd.nlcsirt.divd.nl
Apr 3, 2025generator-jhipster-entity-audit is a JHipster module to enable entity audit and audit log page.CVE-2025-31119 · Other software · jhipster · reported by GitHubHigh 7.6
generator-jhipster-entity-audit is a JHipster module to enable entity audit and audit log page. Prior to 5.9.1, generator-jhipster-entity-audit allows unsafe reflection when having Javers selected as Entity Audit Framework. If an attacker manages to place some malicious classes into the classpath and also has access to these REST interface for calling the mentioned REST endpoints, using these lines of code can lead to unintended remote code execution. This vulnerability is fixed in 5.9.1.
- Product
- generator-jhipster-entity-audit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2025JumpServer is an open source bastion host and an operation and maintenance security audit system.CVE-2025-27095 · Other software · jumpserver · reported by GitHubMedium 4.3
JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.8.0 and 3.10.18, an attacker with a low-privileged account can access the Kubernetes session feature and manipulate the kubeconfig file to redirect API requests to an external server controlled by the attacker. This allows the attacker to intercept and capture the Kubernetes cluster token. This can potentially allow unauthorized access to the cluster and compromise its security. This vulnerability is fixed in 4.8.0 and 3.10.18.
- Product
- jumpserver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2025WP Database Audit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23633 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in khanhtruong WP Database Audit database-audit allows Reflected XSS.This issue affects WP Database Audit: from n/a through <= 1.0.
- Product
- WP Database Audit
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update WP Database Audit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2025A vulnerability exists in Issuetrak v17.2.2 and prior that allows a low-privileged user to access audit results of other users by exploiting an Insecure Direct CVE-2025-2271 · Other software · issuetrak · reported by b7efe717-a805-47cf-8e9a-921fca0ce0ceHigh 7.7
A vulnerability exists in Issuetrak v17.2.2 and prior that allows a low-privileged user to access audit results of other users by exploiting an Insecure Direct Object Reference (IDOR) vulnerability in the Issuetrak audit component. The vulnerability enables unauthorized access to sensitive information, including user details, network and hardware information, installed programs, running processes, drives, and printers. Due to improper access controls, an attacker can retrieve audit data belonging to other users, potentially leading to unauthorized data exposure, privacy violations, and security risks.
- Product
- audit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpcenter.issuetrak.com
Mar 10, 2025Nomad Community and Nomad Enterprise (“Nomad”) are vulnerable to unintentional exposure of the workload identity token and client secret token in audit logs.CVE-2025-1296 · Other software · HashiCorp · reported by security@hashicorp.comMedium 6.5
Nomad Community and Nomad Enterprise (“Nomad”) are vulnerable to unintentional exposure of the workload identity token and client secret token in audit logs. This vulnerability, identified as CVE-2025-1296, is fixed in Nomad Community Edition 1.9.7 and Nomad Enterprise 1.9.7, 1.8.11, and 1.7.19.
- Product
- Nomad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2025A vulnerability has been found in BDCOM Behavior Management and Auditing System up to 20250210 and classified as critical.CVE-2025-1546 · Other software · BDCOM · reported by VulDBMedium 6.9
A vulnerability has been found in BDCOM Behavior Management and Auditing System up to 20250210 and classified as critical. Affected by this vulnerability is the function log_operate_clear of the file /webui/modules/log/operate.mds. The manipulation of the argument start_code leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Behavior Management and Auditing System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2025Docker daemon in Brocade SANnav before SANnav 2.3.1b runs without auditing.CVE-2024-2240 · Other software · Brocade · reported by sirt@brocade.comHigh 8.6
Docker daemon in Brocade SANnav before SANnav 2.3.1b runs without auditing. The vulnerability could allow a remote authenticated attacker to execute various attacks.
- Product
- Brocade SANnav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2025CWE-269: Improper Privilege Management vulnerability exists for two services (of which one managing audit trail data and the other acting as server managing cliCVE-2025-0327 · Other software · Schneider Electric · reported by cybersecurity@se.comHigh 8.5
CWE-269: Improper Privilege Management vulnerability exists for two services (of which one managing audit trail data and the other acting as server managing client request) that could cause a loss of Confidentiality, Integrity and Availability of engineering workstation when an attacker with standard privilege modifies the executable path of the windows services. To be exploited, services need to be restarted.
- Product
- EcoStruxure Process Expert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.com
Feb 5, 2025When users log in through the webUI or API using local authentication, BIG-IP Next Central Manager may log sensitive information in the pgaudit log files.CVE-2025-23413 · Network & remote access · F5 · reported by f5sirt@f5.comMedium 6.7
When users log in through the webUI or API using local authentication, BIG-IP Next Central Manager may log sensitive information in the pgaudit log files. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- Product
- BIG-IP Next Central Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2025kube-audit-rest is a simple logger of mutation/creation requests to the k8s api.CVE-2025-24884 · Other software · RichardoC · reported by GitHubMedium 5.1
kube-audit-rest is a simple logger of mutation/creation requests to the k8s api. If the "full-elastic-stack" example vector configuration was used for a real cluster, the previous values of kubernetes secrets would have been disclosed in the audit messages. This vulnerability is fixed in 1.0.16.
- Product
- kube-audit-rest
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2025Caido is a web security auditing toolkit.CVE-2025-23039 · Other software · caido · reported by GitHubMedium 5.2
Caido is a web security auditing toolkit. A Cross-Site Scripting (XSS) vulnerability was identified in Caido v0.45.0 due to improper sanitization in the URL decoding tooltip of HTTP request and response editors. This issue could allow an attacker to execute arbitrary scripts, potentially leading to the theft of sensitive information. This issue has been addressed in version 0.45.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- caido
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2025A flaw was found in the FreeIPA API audit, where it sends the whole FreeIPA command line to journalctl.CVE-2024-11029 · Other software · Red Hat · reported by Red HatMedium 5.5
A flaw was found in the FreeIPA API audit, where it sends the whole FreeIPA command line to journalctl. As a consequence, during the FreeIPA installation process, it inadvertently leaks the administrative user credentials, including the administrator password, to the journal database. In the worst-case scenario, where the journal log is centralized, users with access to it can have improper access to the FreeIPA administrator credentials.
- Product
- Red Hat Enterprise Linux 9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Jan 13, 2025Order Audit Log for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22337 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in infosoftplugin Order Audit Log for WooCommerce order-audit-log-for-woocommerce allows Reflected XSS.This issue affects Order Audit Log for WooCommerce: from n/a through <= 2.0.
- Product
- Order Audit Log for WooCommerce
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Order Audit Log for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 9, 2025Canlineapp Online 1.1 is vulnerable to Broken Access Control and allows users with the Auditor role to create an audit template as a result of improper authorizCVE-2024-56114 · Other software · Henkel · reported by MITREMedium 6.5
Canlineapp Online 1.1 is vulnerable to Broken Access Control and allows users with the Auditor role to create an audit template as a result of improper authorization checks. This feature is designated for supervisor role, but auditors have been able to successfully create audit templates from their account.
- Product
- Canlineapp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.come-connectsolutions.com
Jan 7, 2025Seth Fogie, member of AXIS Camera Station Pro Bug Bounty Program, has found that it is possible for an authenticated malicious client to tamper with audit log cCVE-2024-7696 · Other software · Axis Communications AB · reported by product-security@axis.comMedium 6.3
Seth Fogie, member of AXIS Camera Station Pro Bug Bounty Program, has found that it is possible for an authenticated malicious client to tamper with audit log creation in AXIS Camera Station, or perform a Denial-of-Service attack on the AXIS Camera Station server using maliciously crafted audit log entries. Axis has released a patched version for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.
- Product
- AXIS Camera Station Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 30, 2024Content Audit Exporter: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2024-53768 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ideinteractive Content Audit Exporter content-audit-exporter allows Retrieve Embedded Sensitive Data.This issue affects Content Audit Exporter: from n/a through <= 1.1.
- Product
- Content Audit Exporter
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Content Audit Exporter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 29, 2024DCME-320 <=7.4.12.90, DCME-520 <=9.25.5.11, DCME-320-L <=9.3.5.26, and DCME-720 <=9.1.5.11 are vulnerable to Remote Code Execution via /function/audit/newstatisCVE-2024-52782 · Other software · dcnglobal · reported by MITRECritical 9.8
DCME-320 <=7.4.12.90, DCME-520 <=9.25.5.11, DCME-320-L <=9.3.5.26, and DCME-720 <=9.1.5.11 are vulnerable to Remote Code Execution via /function/audit/newstatistics/mon_stat_hist_new.php.
- Product
- dcme-320_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 29, 2024DCME-320 <=7.4.12.90, DCME-520 <=9.25.5.11, DCME-320-L <=9.3.5.26, and DCME-720 <=9.1.5.11 are vulnerable to Remote Code Execution via /function/audit/newstatisCVE-2024-52779 · Other software · dcnglobal · reported by MITRECritical 9.8
DCME-320 <=7.4.12.90, DCME-520 <=9.25.5.11, DCME-320-L <=9.3.5.26, and DCME-720 <=9.1.5.11 are vulnerable to Remote Code Execution via /function/audit/newstatistics/mon_stat_top10.php.
- Product
- dcme-320_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 29, 2024DCME-320 <=7.4.12.90, DCME-520 <=9.25.5.11, DCME-320-L <=9.3.5.26, and DCME-720 <=9.1.5.11 are vulnerable to Remote Code Execution via /function/audit/newstatisCVE-2024-52778 · Other software · dcnglobal · reported by MITRECritical 9.8
DCME-320 <=7.4.12.90, DCME-520 <=9.25.5.11, DCME-320-L <=9.3.5.26, and DCME-720 <=9.1.5.11 are vulnerable to Remote Code Execution via /function/audit/newstatistics/mon_stat_hist.php.
- Product
- dcme-320_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024: Insufficient Logging vulnerability in OpenText Secure Content Manager on Windows allows Audit Log Manipulation.This issue affects Secure Content Manager: fromCVE-2024-10863 · Other software · OpenText · reported by security@opentext.comMedium 5.1
: Insufficient Logging vulnerability in OpenText Secure Content Manager on Windows allows Audit Log Manipulation.This issue affects Secure Content Manager: from 10.1 before <24.4. End-users can potentially exploit the vulnerability to exclude audit trails from being recorded on the client side.
- Product
- Secure Content Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 18, 2024Zohocorp ManageEngine ADAudit Plus versions below 8123 are vulnerable to SQL Injection in the reports module.CVE-2024-49574 · Other software · ManageEngine · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 8.3
Zohocorp ManageEngine ADAudit Plus versions below 8123 are vulnerable to SQL Injection in the reports module.
- Product
- ADAudit Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2024GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing.CVE-2024-45611 · Other software · glpi-project · reported by GitHubMedium 5.7
GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authenticated user can bypass the access control policy to create a private RSS feed attached to another user account and use a malicious payload to triggger a stored XSS. Upgrade to 10.0.17.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2024GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing.CVE-2024-45610 · Other software · glpi-project · reported by GitHubMedium 6.5
GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An unauthenticated user can provide a malicious link to a GLPI technician in order to exploit a reflected XSS vulnerability located in the Cable form. Upgrade to 10.0.17.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2024Audition versions 23.6.9, 24.4.6 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory.CVE-2024-49536 · Other software · Adobe · reported by AdobeMedium 5.5
Audition versions 23.6.9, 24.4.6 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Audition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2024GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing.CVE-2024-45609 · Other software · glpi-project · reported by GitHubMedium 6.5
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An unauthenticated user can provide a malicious link to a GLPI technician in order to exploit a reflected XSS vulnerability located in the reports pages. Upgrade to 10.0.17.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2024The ventilator and the Service PC lack sufficient audit logging capabilities to allow for detection of malicious activity and subsequent forensic examination.CVE-2024-48967 · Other software · Baxter · reported by productsecurity@baxter.comCritical 10
The ventilator and the Service PC lack sufficient audit logging capabilities to allow for detection of malicious activity and subsequent forensic examination. An attacker with access to the ventilator and/or the Service PC could, without detection, make unauthorized changes to ventilator settings that result in unauthorized disclosure of information and/or have unintended impacts on device performance.
- Product
- Life2000 Ventilation System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024Audition versions 23.6.9, 24.4.6 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory.CVE-2024-47449 · Other software · Adobe · reported by AdobeMedium 5.5
Audition versions 23.6.9, 24.4.6 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Audition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 8, 2024Airflow versions before 2.10.3 have a vulnerability that allows authenticated users with audit log access to see sensitive values in audit logs which they shoulCVE-2024-50378 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 4.9
Airflow versions before 2.10.3 have a vulnerability that allows authenticated users with audit log access to see sensitive values in audit logs which they should not see. When sensitive variables were set via airflow CLI, values of those variables appeared in the audit log and were stored unencrypted in the Airflow database. While this risk is limited to users with audit log access, it is recommended to upgrade to Airflow 2.10.3 or a later version, which addresses this issue. Users who previously used the CLI to set secret variables should manually delete entries with those variables from the log table.
- Product
- Apache Airflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.apache.org
Nov 4, 2024Zohocorp ManageEngine ADAudit Plus versions below 8121 are vulnerable to SQL Injection in Technician reports option.CVE-2024-36485 · Other software · ManageEngine · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 8.3
Zohocorp ManageEngine ADAudit Plus versions below 8121 are vulnerable to SQL Injection in Technician reports option.
- Product
- ADAudit Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2024Zohocorp ManageEngine ADManager Plus versions 7241 and prior are vulnerable to SQL Injection in Archived Audit Report.CVE-2024-48878 · Other software · ManageEngine · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 8.3
Zohocorp ManageEngine ADManager Plus versions 7241 and prior are vulnerable to SQL Injection in Archived Audit Report.
- Product
- ADManager Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 24, 2024Zohocorp ManageEngine ADAudit Plus versions below 8121 are vulnerable to SQL Injection in the technician reports feature.CVE-2024-5608 · Other software · ManageEngine · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 8.3
Zohocorp ManageEngine ADAudit Plus versions below 8121 are vulnerable to SQL Injection in the technician reports feature.
- Product
- ADAudit Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2024A vulnerability has been identified which may lead to sensitive data being leaked into Rancher's audit logs.CVE-2023-22649 · Other software · SUSE · reported by meissner@suse.deHigh 8.4
A vulnerability has been identified which may lead to sensitive data being leaked into Rancher's audit logs. [Rancher Audit Logging](https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/enable-api-audit-log) is an opt-in feature, only deployments that have it enabled and have [AUDIT_LEVEL](https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/enable-api-audit-log#audit-log-levels) set to `1 or above` are impacted by this issue.
- Product
- rancher
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.suse.comgithub.com
Sep 13, 2024IPMI credentials may be captured in XCC audit log entries when the account username length is 16 characters.CVE-2024-8059 · Other software · Lenovo · reported by psirt@lenovo.comMedium 4.3
IPMI credentials may be captured in XCC audit log entries when the account username length is 16 characters.
- Product
- HX5530 Appliance (ThinkAgile) XCC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2024An internal product security audit discovered a UEFI SMM (System Management Mode) callout vulnerability in some ThinkSystem servers that could allow a local attCVE-2024-45105 · Other software · Lenovo · reported by psirt@lenovo.comMedium 6.7
An internal product security audit discovered a UEFI SMM (System Management Mode) callout vulnerability in some ThinkSystem servers that could allow a local attacker with elevated privileges to execute arbitrary code.
- Product
- HX5530 Appliance (ThinkAgile) BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2024Audition versions 24.4.1, 23.6.6 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory.CVE-2024-41868 · Other software · Adobe · reported by AdobeMedium 5.5
Audition versions 24.4.1, 23.6.6 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Audition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2024Audition versions 24.4.1, 23.6.6 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context oCVE-2024-39378 · Other software · Adobe · reported by AdobeHigh 7.8
Audition versions 24.4.1, 23.6.6 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Audition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024auditor-bundle, formerly known as DoctrineAuditBundle, integrates auditor library into any Symfony 3.4+ application.CVE-2024-45592 · Other software · DamienHarper · reported by GitHubHigh 8.2
auditor-bundle, formerly known as DoctrineAuditBundle, integrates auditor library into any Symfony 3.4+ application. Prior to version 5.2.6, there is an unescaped entity property enabling Javascript injection. This is possible because `%source_label%` in twig macro is not escaped. Therefore script tags can be inserted and are executed. The vulnerability is fixed in versions 6.0.0 and 5.2.6.
- Product
- auditor-bundle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2024Vault Community Edition and Vault Enterprise experienced a regression where functionality that HMAC’d sensitive headers in the configured audit device, specificCVE-2024-8365 · Other software · HashiCorp · reported by security@hashicorp.comMedium 6.2
Vault Community Edition and Vault Enterprise experienced a regression where functionality that HMAC’d sensitive headers in the configured audit device, specifically client tokens and token accessors, was removed. This resulted in the plaintext values of client tokens and token accessors being stored in the audit log. This vulnerability, CVE-2024-8365, was fixed in Vault Community Edition and Vault Enterprise 1.17.5 and Vault Enterprise 1.16.9.
- Product
- Vault
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 23, 2024Zohocorp ManageEngine ADAudit Plus versions below 8121 are vulnerable to the authenticated SQL injection in extranet lockouts report option.CVE-2024-5586 · Other software · ManageEngine · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 8.3
Zohocorp ManageEngine ADAudit Plus versions below 8121 are vulnerable to the authenticated SQL injection in extranet lockouts report option.
- Product
- ADAudit Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 23, 2024Zohocorp ManageEngine ADAudit Plus versions below 8000 are vulnerable to the authenticated SQL injection in reports module.CVE-2024-5556 · Other software · ManageEngine · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 8.3
Zohocorp ManageEngine ADAudit Plus versions below 8000 are vulnerable to the authenticated SQL injection in reports module.
- Product
- ADAudit Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.