Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
678 results · page 5 of 14
Jul 22, 2024On versions before 2.1.4, after a regular user successfully logs in, they can manually make a request using the authorization token to view everyone's user flinCVE-2024-34457 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.5
On versions before 2.1.4, after a regular user successfully logs in, they can manually make a request using the authorization token to view everyone's user flink information, including executeSQL and config. Mitigation: all users should upgrade to 2.1.4
- Product
- Apache StreamPark
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Jul 22, 2024Backdrop CMS before 1.27.3 and 1.28.x before 1.28.2 does not sufficiently sanitize field labels before they are displayed in certain places.CVE-2024-41709 · Other software · Backdropcms · reported by MITREMedium 4.8
Backdrop CMS before 1.27.3 and 1.28.x before 1.28.2 does not sufficiently sanitize field labels before they are displayed in certain places. This vulnerability is mitigated by the fact that an attacker must have a role with the "administer fields" permission.
- Product
- Backdrop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbackdropcms.orgbackdropcms.org
Jul 9, 2024A vulnerability was discovered in Samsung Mobile Processors Exynos 2200 and Exynos 2400 where they lack a check for the validation of native handles, which can CVE-2024-31957 · Computers, phones & browsers · Samsung · reported by MITREMedium 6.2
A vulnerability was discovered in Samsung Mobile Processors Exynos 2200 and Exynos 2400 where they lack a check for the validation of native handles, which can result in a DoS(Denial of Service) attack by unmapping an invalid length.
- Product
- Exynos 2200 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsemiconductor.samsung.comsemiconductor.samsung.com
Jul 9, 2024A vulnerability was discovered in Samsung Mobile Processors Exynos 1280, Exynos 2200, Exynos 1330, Exynos 1380, and Exynos 2400 where they do not properly checkCVE-2024-27362 · Computers, phones & browsers · Samsung · reported by MITREMedium 4.4
A vulnerability was discovered in Samsung Mobile Processors Exynos 1280, Exynos 2200, Exynos 1330, Exynos 1380, and Exynos 2400 where they do not properly check the length of the data, which can lead to a Information disclosure.
- Product
- Exynos 1280 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsemiconductor.samsung.comsemiconductor.samsung.com
Jul 7, 2024A vulnerability classified as problematic has been found in heyewei SpringBootCMS up to 2024-05-28.CVE-2024-6539 · Other software · heyewei · reported by VulDBMedium 5.3
A vulnerability classified as problematic has been found in heyewei SpringBootCMS up to 2024-05-28. Affected is an unknown function of the file /guestbook of the component Guestbook Handler. The manipulation of the argument Content leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-270450 is the identifier assigned to this vulnerability.
- Product
- SpringBootCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 4, 2024rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users (if they have Upload perCVE-2024-39943 · Other software · rejetto · reported by MITRECritical 9.9
rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users (if they have Upload permissions). This occurs because a shell is used to execute df (i.e., with execSync instead of spawnSync in child_process in Node.js).
- Product
- http_file_server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2024Web services managed by Edito CMS (Content Management System) in versions from 3.5 through 3.25 leak sensitive data as they allow downloading configuration fileCVE-2024-4836 · Other software · Edito · reported by cvd@cert.plHigh 7.5
Web services managed by Edito CMS (Content Management System) in versions from 3.5 through 3.25 leak sensitive data as they allow downloading configuration files by an unauthenticated user. The issue in versions 3.5 - 3.25 was removed in releases which dates from 10th of January 2014. Higher versions were never affected.
- Product
- Edito CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2024In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 on Windows, an authenticated user could execute a specially crafted query that they could then use CVE-2024-36984 · Other software · Splunk · reported by prodsec@splunk.comHigh 8.8
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 on Windows, an authenticated user could execute a specially crafted query that they could then use to serialize untrusted data. The attacker could use the query to execute arbitrary code.
- Product
- Splunk Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisory.splunk.comresearch.splunk.com
Jun 30, 2024IBM InfoSphere Information Server 11.7 could allow a local user to update projects that they do not have the authorization to access.CVE-2023-35022 · Other software · IBM · reported by psirt@us.ibm.comLow 3.3
IBM InfoSphere Information Server 11.7 could allow a local user to update projects that they do not have the authorization to access. IBM X-Force ID: 258254.
- Product
- InfoSphere Information Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jun 24, 2024A session fixation vulnerability in Bludit allows an attacker to bypass the server's authentication if they can trick an administrator or any other user into auCVE-2024-24552 · Other software · Bludit · reported by vulnerability@ncsc.chMedium 5.7
A session fixation vulnerability in Bludit allows an attacker to bypass the server's authentication if they can trick an administrator or any other user into authorizing a session ID of their choosing.
- Product
- Bludit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordredguard.chredguard.ch
Jun 18, 2024Insufficient capability checks meant it was possible for users to gain access to BigBlueButton join URLs they did not have permission to access.CVE-2024-38273 · Other software · Moodle · reported by patrick@puiterwijk.orgMedium 5.4
Insufficient capability checks meant it was possible for users to gain access to BigBlueButton join URLs they did not have permission to access.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orglists.fedoraproject.org
Jun 14, 2024An open redirect issue was discovered in Kibana that could lead to a user being redirected to an arbitrary website if they use a maliciously crafted Kibana URL.CVE-2024-23442 · Other software · Elastic · reported by security@elastic.coMedium 6.1
An open redirect issue was discovered in Kibana that could lead to a user being redirected to an arbitrary website if they use a maliciously crafted Kibana URL.
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.elastic.codiscuss.elastic.co
Jun 14, 2024events-calendar-pro WordPress plugin before 6.4.0.1, The Events Calendar: Does not prevent users with at least the contributor role from leaking details about events they shouldn't have access toCVE-2024-1295 · WordPress plugins & themes · reported by WPScanMedium 6.5
The events-calendar-pro WordPress plugin before 6.4.0.1, The Events Calendar WordPress plugin before 6.4.0.1 does not prevent users with at least the contributor role from leaking details about events they shouldn't have access to. (e.g. password-protected events, drafts, etc.)
- Product
- events-calendar-pro WordPress plugin before 6.4.0.1, The Events Calendar
- Fixed in
- 6.4.0.1
- What to do
- Update events-calendar-pro WordPress plugin before 6.4.0.1, The Events Calendar to 6.4.0.1 or newer.
Jun 11, 2024In violation of spec, cookie prefixes such as `__Secure` were being ignored if they were not correctly capitalized - by spec they should be checked with a case-CVE-2024-5699 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.8
In violation of spec, cookie prefixes such as `__Secure` were being ignored if they were not correctly capitalized - by spec they should be checked with a case-insensitive comparison. This could have resulted in the browser not correctly honoring the behaviors specified by the prefix. This vulnerability affects Firefox < 127.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Jun 10, 2024SAP BW/4HANA Transformation and Data Transfer Process (DTP) allows an authenticated attacker to gain higher access levels than they should have by exploiting imCVE-2024-37176 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.5
SAP BW/4HANA Transformation and Data Transfer Process (DTP) allows an authenticated attacker to gain higher access levels than they should have by exploiting improper authorization checks. This results in escalation of privileges. It has no impact on the confidentiality of data but may have low impacts on the integrity and availability of the application.
- Product
- SAP BW/4HANA Transformation and Data Transfer Process
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordme.sap.comsupport.sap.com
May 31, 2024Incorrect validation of allowed event types in a calendar web service made it possible for some users to create events with types/audiences they did not have peCVE-2024-33996 · Other software · Moodle · reported by patrick@puiterwijk.orgMedium 6.2
Incorrect validation of allowed event types in a calendar web service made it possible for some users to create events with types/audiences they did not have permission to publish to.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2024Nintendo Wii U OS 5.5.5 allows man-in-the-middle attackers to forge SSL certificates as though they came from a Root CA, because there is a secondary verificatiCVE-2024-34454 · Other software · nintendo · reported by MITREHigh 7.4
Nintendo Wii U OS 5.5.5 allows man-in-the-middle attackers to forge SSL certificates as though they came from a Root CA, because there is a secondary verification mechanism that only checks whether a CA is known and ignores the CA details and signature (and because * is accepted as a Common Name).
- Product
- wii_u
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2024A vulnerability classified as problematic has been found in JFinalCMS up to 20221020.CVE-2024-5310 · Other software · Heyewei · reported by VulDBMedium 5.1
A vulnerability classified as problematic has been found in JFinalCMS up to 20221020. This affects an unknown part of the file /admin/content. The manipulation of the argument Title leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-266121 was assigned to this vulnerability.
- Product
- Jfinalcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 21, 2024In lunary-ai/lunary version 1.2.2, an incorrect synchronization vulnerability allows unprivileged users to rename projects they do not have access to.CVE-2024-4154 · Other software · lunary-ai · reported by security@huntr.devMedium 6.5
In lunary-ai/lunary version 1.2.2, an incorrect synchronization vulnerability allows unprivileged users to rename projects they do not have access to. Specifically, an unprivileged user can send a PATCH request to the project's endpoint with a new name for a project, despite not having the necessary permissions or being assigned to the project. This issue allows for unauthorized modification of project names, potentially leading to confusion or unauthorized access to project resources.
- Product
- lunary-ai/lunary
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2024In the Linux kernel, the following vulnerability has been resolved: gro: fix ownership transfer If packets are GROed with fraglist they might be segmented latCVE-2024-35890 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: gro: fix ownership transfer If packets are GROed with fraglist they might be segmented later on and continue their journey in the stack. In skb_segment_list those skbs can be reused as-is. This is an issue as their destructor was removed in skb_gro_receive_list but not the reference to their socket, and then they can't be orphaned. Fix this by also removing the reference to the socket. For example this could be observed, kernel BUG at include/linux/skbuff.h:3131! (skb_orphan) RIP: 0010:ip6_rcv_core+0x11bc/0x19a0 Call Trace: ipv6_list_rcv+0x250/0x3f0 __netif_receive_skb_list_core+0x49d/0x8f0 netif_receive_skb_list_internal+0x634/0xd40 napi_complete_done+0x1d2/0x7d0 gro_cell_poll+0x118/0x1f0 A similar construction is found in skb_gro_receive, apply the same change there.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
May 7, 2024An authenticated user could potentially access metadata for a datasource they are not authorized to view by submitting a targeted REST API request.This issue afCVE-2024-28148 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 4.3
An authenticated user could potentially access metadata for a datasource they are not authorized to view by submitting a targeted REST API request.This issue affects Apache Superset: before 3.1.2. Users are recommended to upgrade to version 3.1.2 or above, which fixes the issue.
- Product
- Apache Superset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
Apr 15, 2024WooCommerce: Does not prevent users with at least the contributor role from leaking products they shouldn't have access toCVE-2024-1310 · WordPress plugins & themes · reported by WPScanMedium 4.9
The WooCommerce WordPress plugin before 8.6 does not prevent users with at least the contributor role from leaking products they shouldn't have access to. (e.g. private, draft and trashed products)
- Product
- WooCommerce
- Fixed in
- 8.6
- What to do
- Update WooCommerce to 8.6 or newer.
Apr 13, 2024WP Shortcodes Plugin — Shortcodes Ultimate: Does not properly escape some of its shortcodes attributes before they are echoed back to usersCVE-2024-2583 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 7.0.5 does not properly escape some of its shortcodes attributes before they are echoed back to users, making it possible for users with the contributor role to conduct Stored XSS attacks.
- Product
- WP Shortcodes Plugin — Shortcodes Ultimate
- Fixed in
- 7.0.5
- What to do
- Update WP Shortcodes Plugin — Shortcodes Ultimate to 7.0.5 or newer.
Mar 31, 2024JJWT (aka Java JWT) through 0.12.5 ignores certain characters and thus a user might falsely conclude that they have a strong key.CVE-2024-31033 · Other software · jwtk · reported by MITREMedium 6.8
JJWT (aka Java JWT) through 0.12.5 ignores certain characters and thus a user might falsely conclude that they have a strong key. The impacted code is the setSigningKey() method within the DefaultJwtParser class and the signWith() method within the DefaultJwtBuilder class. NOTE: the vendor disputes this because the "ignores" behavior cannot occur (in any version) unless there is a user error in how JJWT is used, and because the version that was actually tested must have been more than six years out of date.
- Product
- jjwt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2024A Cross-Site Request Forgery (CSRF) vulnerability in gradio-app/gradio allows attackers to upload multiple large files to a victim's system if they are running CVE-2024-1727 · Other software · gradio-app · reported by security@huntr.devMedium 4.3
A Cross-Site Request Forgery (CSRF) vulnerability in gradio-app/gradio allows attackers to upload multiple large files to a victim's system if they are running Gradio locally. By crafting a malicious HTML page that triggers an unauthorized file upload to the victim's server, an attacker can deplete the system's disk space, potentially leading to a denial of service. This issue affects the file upload functionality as implemented in gradio/routes.py.
- Product
- gradio-app/gradio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2024 The configuration pages available are not intended to be placed on an Internet facing web server, as they expose file paths to the client, who can be an attackCVE-2024-2635 · Other software · Cegid · reported by cve-coordination@incibe.esHigh 7.3
The configuration pages available are not intended to be placed on an Internet facing web server, as they expose file paths to the client, who can be an attacker. Instead of rewriting these pages to avoid this vulnerability, they will be dismissed from future releases of Cegid Meta4 HR, as they do not offer product functionality
- Product
- Meta4 HR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2024A vulnerability has been found in heyewei JFinalCMS 5.0.0 and classified as critical.CVE-2024-2568 · Other software · heyewei · reported by VulDBMedium 4.7
A vulnerability has been found in heyewei JFinalCMS 5.0.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/div_data/delete?divId=9 of the component Custom Data Page. The manipulation leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-257071.
- Product
- JFinalCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2024If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template pCVE-2024-24785 · Other software · Go standard library · reported by security@golang.orgMedium 5.4
If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected content into templates.
- Product
- html/template
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2024Event Tickets and Registration WordPress plugin before 5.8.1, Events Tickets Plus: Does not prevent users with at least the contributor role from leaking the existence of certain events they shouldn't have access toCVE-2024-1316 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Event Tickets and Registration WordPress plugin before 5.8.1, Events Tickets Plus WordPress plugin before 5.9.1 does not prevent users with at least the contributor role from leaking the existence of certain events they shouldn't have access to. (e.g. draft, private, pending review, pw-protected, and trashed events).
- Product
- Event Tickets and Registration WordPress plugin before 5.8.1, Events Tickets Plus
- Fixed in
- 5.8.1
- What to do
- Update Event Tickets and Registration WordPress plugin before 5.8.1, Events Tickets Plus to 5.8.1 or newer.
Feb 29, 2024Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated users to view DAG code and import errors of DAGs they do not have permissioCVE-2024-27906 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.9
Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated users to view DAG code and import errors of DAGs they do not have permission to view through the API and the UI. Users of Apache Airflow are recommended to upgrade to version 2.8.2 or newer to mitigate the risk associated with this vulnerability
- Product
- Apache Airflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2024A low privilege authenticated user could import an existing dashboard or chart that they do not have access to and then modify its metadata, thereby gaining ownCVE-2024-26016 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 4.3
A low privilege authenticated user could import an existing dashboard or chart that they do not have access to and then modify its metadata, thereby gaining ownership of the object. However, it's important to note that access to the analytical data of these charts and dashboards would still be subject to validation based on data access privileges. This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1.Users are recommended to upgrade to version 3.1.1, which fixes the issue.
- Product
- Apache Superset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comlists.apache.org
Feb 27, 2024Should an instance of AnythingLLM be hosted on an internal network and the attacked be explicitly granted a permission level of manager or admin, they could linCVE-2024-0759 · Other software · mintplex-labs · reported by security@huntr.devHigh 7.5
Should an instance of AnythingLLM be hosted on an internal network and the attacked be explicitly granted a permission level of manager or admin, they could link-scrape internally resolving IPs of other services that are on the same network as AnythingLLM. This would require the attacker also be able to guess these internal IPs as `/*` ranging is not possible, but could be brute forced. There is a duty of care that other services on the same network would not be fully open and accessible via a simple CuRL with zero authentication as it is not possible to set headers or access via the link collector.
- Product
- mintplex-labs/anything-llm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 24, 2024Apache Airflow, versions before 2.8.1, have a vulnerability that allows an authenticated user to access the source code of a DAG to which they don't have accessCVE-2023-50944 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.5
Apache Airflow, versions before 2.8.1, have a vulnerability that allows an authenticated user to access the source code of a DAG to which they don't have access. This vulnerability is considered low since it requires an authenticated user to exploit it. Users are recommended to upgrade to version 2.8.1, which fixes this issue.
- Product
- Apache Airflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Jan 22, 2024In Splunk versions below 9.0.8 and 9.1.3, the “mrollup” SPL command lets a low-privileged user view metrics on an index that they do not have permission to viewCVE-2024-23676 · Other software · Splunk · reported by prodsec@splunk.comMedium 4.6
In Splunk versions below 9.0.8 and 9.1.3, the “mrollup” SPL command lets a low-privileged user view metrics on an index that they do not have permission to view. This vulnerability requires user interaction from a high-privileged user to exploit.
- Product
- Splunk Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisory.splunk.comresearch.splunk.com
Dec 15, 2023HCL Connections is vulnerable to an information disclosure vulnerability which could allow a user to obtain sensitive information they are not entitled to, causCVE-2023-28022 · Other software · HCL Software · reported by psirt@hcl.comLow 3.5
HCL Connections is vulnerable to an information disclosure vulnerability which could allow a user to obtain sensitive information they are not entitled to, caused by improper handling of request data.
- Product
- HCL Connections
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Dec 13, 2023Jenkins Dingding JSON Pusher Plugin 2.0 and earlier stores access tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed CVE-2023-50772 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
Jenkins Dingding JSON Pusher Plugin 2.0 and earlier stores access tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
- Product
- Jenkins Dingding JSON Pusher Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Nov 9, 2023Insufficient web service capability checks made it possible to move categories a user had permission to manage, to a parent category they did not have the capabCVE-2023-5549 · Other software · Moodle · reported by patrick@puiterwijk.orgLow 3.3
Insufficient web service capability checks made it possible to move categories a user had permission to manage, to a parent category they did not have the capability to manage.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.moodle.orgbugzilla.redhat.com
Nov 3, 2023Kyocera TASKalfa 4053ci printers through 2VG_S000.002.561 allow identification of valid user accounts via username enumeration because they lead to a "nicht einCVE-2023-34261 · Other software · kyocera · reported by MITREMedium 5.3
Kyocera TASKalfa 4053ci printers through 2VG_S000.002.561 allow identification of valid user accounts via username enumeration because they lead to a "nicht einloggen" error rather than a falsch error.
- Product
- taskalfa_4053ci
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec-consult.comseclists.org
Nov 2, 2023Connections to external data sources, like e-mail autoconfiguration, were not terminated in case they hit a timeout, instead those connections were logged.CVE-2023-29046 · Other software · OX Software GmbH · reported by security@open-xchange.comMedium 4.3
Connections to external data sources, like e-mail autoconfiguration, were not terminated in case they hit a timeout, instead those connections were logged. Some connections use user-controlled endpoints, which could be malicious and attempt to keep the connection open for an extended period of time. As a result users were able to trigger large amount of egress network connections, possibly exhausting network pool resources and lock up legitimate requests. A new mechanism has been introduced to cancel external connections that might access user-controlled endpoints. No publicly available exploits are known.
- Product
- OX App Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.open-xchange.comsoftware.open-xchange.com
Nov 2, 2023A Stored Cross-Site Scripting vulnerability was discovered in ZenTao 18.3 where a user can create a project, and in the name field of the project, they can injeCVE-2023-46475 · Other software · Easycorp · reported by MITREMedium 5.4
A Stored Cross-Site Scripting vulnerability was discovered in ZenTao 18.3 where a user can create a project, and in the name field of the project, they can inject malicious JavaScript code.
- Product
- Zentao
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2023A Cross-site Request Forgery (CSRF) vulnerability in Pandora FMS allows an attacker to force authenticated users to send a request to a web application they areCVE-2023-24518 · Other software · Artica PFMS · reported by cve-coordination@incibe.esMedium 6.7
A Cross-site Request Forgery (CSRF) vulnerability in Pandora FMS allows an attacker to force authenticated users to send a request to a web application they are currently authenticated against. This issue affects Pandora FMS version 767 and earlier versions on all platforms.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpandorafms.compandorafms.com
Sep 29, 2023Mattermost fails to properly validate the permissions when soft deleting a team allowing a team member to soft delete other teams that they are not part of CVE-2023-5195 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 6.5
Mattermost fails to properly validate the permissions when soft deleting a team allowing a team member to soft delete other teams that they are not part of
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Sep 28, 2023The 'age' parameter of the process_registration.php resource does not validate the characters received and they are sent unfiltered to the database.CVE-2023-44166 · Other software · Online Movie Ticket Booking System · reported by help@fluidattacks.comCritical 9.8
The 'age' parameter of the process_registration.php resource does not validate the characters received and they are sent unfiltered to the database.
- Product
- Online Movie Ticket Booking System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comprojectworlds.in
Sep 28, 2023The 'Email' parameter of the process_login.php resource does not validate the characters received and they are sent unfiltered to the database.CVE-2023-44164 · Other software · Online Movie Ticket Booking System · reported by help@fluidattacks.comCritical 9.8
The 'Email' parameter of the process_login.php resource does not validate the characters received and they are sent unfiltered to the database.
- Product
- Online Movie Ticket Booking System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comprojectworlds.in
Sep 28, 2023The 'search' parameter of the process_search.php resource does not validate the characters received and they are sent unfiltered to the database.CVE-2023-44163 · Other software · Online Movie Ticket Booking System · reported by help@fluidattacks.comCritical 9.8
The 'search' parameter of the process_search.php resource does not validate the characters received and they are sent unfiltered to the database.
- Product
- Online Movie Ticket Booking System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comprojectworlds.in
Sep 28, 2023The 'bookisbn' parameter of the cart.php resource does not validate the characters received and they are sent unfiltered to the database.CVE-2023-43739 · Other software · Online Book Store Project · reported by help@fluidattacks.comCritical 9.8
The 'bookisbn' parameter of the cart.php resource does not validate the characters received and they are sent unfiltered to the database.
- Product
- Online Book Store Project
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comprojectworlds.in
Sep 18, 2023In Artifex Ghostscript through 10.01.2, gdevijs.c in GhostPDL can lead to remote code execution via crafted PostScript documents because they can switch to the CVE-2023-43115 · Other software · Artifex · reported by MITREHigh 8.8
In Artifex Ghostscript through 10.01.2, gdevijs.c in GhostPDL can lead to remote code execution via crafted PostScript documents because they can switch to the IJS device, or change the IjsServer parameter, after SAFER has been activated. NOTE: it is a documented risk that the IJS server can be specified on a gs command line (the IJS device inherently must execute a command to start the IJS server).
- Product
- Ghostscript
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.ghostscript.comghostscript.com
Sep 15, 2023When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API.CVE-2023-38039 · Other software · curl · reported by support@hackerone.comHigh 7.5
When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API. However, curl did not have a limit in how many or how large headers it would accept in a response, allowing a malicious server to stream an endless series of headers and eventually cause curl to run out of heap memory.
- Product
- curl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Sep 6, 2023If an attacker gains write access to the Apache Superset metadata database, they could persist a specifically crafted Python object that may lead to remote codeCVE-2023-37941 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.6
If an attacker gains write access to the Apache Superset metadata database, they could persist a specifically crafted Python object that may lead to remote code execution on Superset's web backend. The Superset metadata db is an 'internal' component that is typically only accessible directly by the system administrator and the superset process itself. Gaining access to that database should be difficult and require significant privileges. This vulnerability impacts Apache Superset versions 1.5.0 up to and including 2.1.0. Users are recommended to upgrade to version 2.1.1 or later.
- Product
- Apache Superset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comlists.apache.org
Sep 5, 2023Git Providers can read from the wrong environment because they get the same cache directory base name in Salt masters prior to 3005.2 or 3006.2.CVE-2023-20898 · Other software · Saltstack · reported by security@vmware.comMedium 4.2
Git Providers can read from the wrong environment because they get the same cache directory base name in Salt masters prior to 3005.2 or 3006.2. Anything that uses Git Providers with different environments can get garbage data or the wrong data, which can lead to wrongful data disclosure, wrongful executions, data corruption and/or crash.
- Product
- Salt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orgsaltproject.io
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.