Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
5,645 results · page 51 of 113
Feb 3, 2025Taxi Booking Manager for WooCommerce: Deserialization of Untrusted DataCVE-2025-24661 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in magepeopleteam Taxi Booking Manager for WooCommerce ecab-taxi-booking-manager allows Object Injection.This issue affects Taxi Booking Manager for WooCommerce: from n/a through <= 1.1.8.
- Product
- Taxi Booking Manager for WooCommerce
- Affected
- up to 1.1.8
- What to do
- Affects up to 1.1.8. Update Taxi Booking Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 30, 2025Untrusted search path in the installer for some Zoom Workplace Apps for Windows may allow an authorized user to conduct an escalation of privilege via local accCVE-2025-0145 · Other software · Zoom Communications, Inc · reported by security@zoom.usMedium 4.6
Untrusted search path in the installer for some Zoom Workplace Apps for Windows may allow an authorized user to conduct an escalation of privilege via local access.
- Product
- Zoom Workplace Apps for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2025NVIDIA RAPIDS contains a vulnerability in cuDF and cuML, where a user could cause a deserialization of untrusted data issue.CVE-2024-0140 · Other software · NVIDIA · reported by psirt@nvidia.comMedium 6.8
NVIDIA RAPIDS contains a vulnerability in cuDF and cuML, where a user could cause a deserialization of untrusted data issue. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and information disclosure.
- Product
- RAPIDS cuDF and cuML
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2025NVIDIA Container Toolkit contains an improper isolation vulnerability where a specially crafted container image could lead to untrusted code running in the hostCVE-2024-0137 · Other software · NVIDIA · reported by psirt@nvidia.comMedium 5.5
NVIDIA Container Toolkit contains an improper isolation vulnerability where a specially crafted container image could lead to untrusted code running in the host’s network namespace. This vulnerability is present only when the NVIDIA Container Toolkit is configured in a nondefault way. A successful exploit of this vulnerability may lead to denial of service and escalation of privileges.
- Product
- NVIDIA Container Toolkit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2025NVIDIA Container Toolkit contains an improper isolation vulnerability where a specially crafted container image could lead to untrusted code obtaining read and CVE-2024-0136 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.6
NVIDIA Container Toolkit contains an improper isolation vulnerability where a specially crafted container image could lead to untrusted code obtaining read and write access to host devices. This vulnerability is present only when the NVIDIA Container Toolkit is configured in a nondefault way. A successful exploit of this vulnerability may lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.
- Product
- NVIDIA Container Toolkit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2025vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs.CVE-2025-24365 · Other software · dani-garcia · reported by GitHubHigh 8.1
vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Attacker can obtain owner rights of other organization. Hacker should know the ID of victim organization (in real case the user can be a part of the organization as an unprivileged user) and be the owner/admin of other organization (by default you can create your own organization) in order to attack. This vulnerability is fixed in 1.33.0.
- Product
- vaultwarden
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2025vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs.CVE-2025-24364 · Other software · dani-garcia · reported by GitHubHigh 7.2
vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Attacker with authenticated access to the vaultwarden admin panel can execute arbitrary code in the system. The attacker could then change some settings to use sendmail as mail agent but adjust the settings in such a way that it would use a shell command. It then also needed to craft a special favicon image which would have the commands embedded to run during for example sending a test email. This vulnerability is fixed in 1.33.0.
- Product
- vaultwarden
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2025KB Support: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-24741 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in LOGON KB Support kb-support.This issue affects KB Support: from n/a through <= 1.6.7.
- Product
- KB Support
- Affected
- up to 1.6.7
- What to do
- Affects up to 1.6.7. Update KB Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 27, 2025LearnPress: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-24740 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in ThimPress LearnPress learnpress.This issue affects LearnPress: from n/a through <= 4.2.7.1.
- Product
- LearnPress
- Affected
- up to 4.2.7.1
- What to do
- Affects up to 4.2.7.1. Update LearnPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 27, 2025Save as PDF: Deserialization of Untrusted DataCVE-2025-24671 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Pdfcrowd Dev Team Save as PDF save-as-pdf-by-pdfcrowd allows Object Injection.This issue affects Save as PDF: from n/a through <= 4.4.0.
- Product
- Save as PDF
- Affected
- up to 4.4.0
- What to do
- Affects up to 4.4.0. Update Save as PDF to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 27, 2025FundPress: Deserialization of Untrusted DataCVE-2025-24601 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThimPress FundPress fundpress allows Object Injection.This issue affects FundPress: from n/a through <= 2.0.6.
- Product
- FundPress
- Affected
- up to 2.0.6
- What to do
- Affects up to 2.0.6. Update FundPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 27, 2025Core creation allows users to replace "trusted" configset files with arbitrary configuration Solr instances that (1) use the "FileSystemConfigSetService" compoCVE-2025-24814 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.5
Core creation allows users to replace "trusted" configset files with arbitrary configuration Solr instances that (1) use the "FileSystemConfigSetService" component (the default in "standalone" or "user-managed" mode), and (2) are running without authentication and authorization are vulnerable to a sort of privilege escalation wherein individual "trusted" configset files can be ignored in favor of potentially-untrusted replacements available elsewhere on the filesystem. These replacement config files are treated as "trusted" and can use "<lib>" tags to add to Solr's classpath, which an attacker might use to load malicious code as a searchComponent or other plugin. This issue affects all Apache Solr versions up through Solr 9.7. Users can protect against the vulnerability by enabling authentication and authorization on their Solr clusters or switching to SolrCloud (and away from "FileSystemConfigSetService"). Users are also recommended to upgrade to Solr 9.8.0, which mitigates this issue by disabling use of "<lib>" tags by default.
- Product
- Apache Solr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Jan 23, 2025RestrictedPython is a tool that helps to define a subset of the Python language which allows to provide a program input into a trusted environment.CVE-2025-22153 · Other software · zopefoundation · reported by GitHubHigh 7.9
RestrictedPython is a tool that helps to define a subset of the Python language which allows to provide a program input into a trusted environment. Via a type confusion bug in versions of the CPython interpreter starting in 3.11 and prior to 3.13.2 when using `try/except*`, RestrictedPython starting in version 6.0 and prior to version 8.0 could be bypassed. The issue is patched in version 8.0 of RestrictedPython by removing support for `try/except*` clauses. No known workarounds are available.
- Product
- RestrictedPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2025A mail spoofing vulnerability in Xerox Workplace Suite allows attackers to forge email headers, making it appear as though messages are sent from trusted sourceCVE-2024-55929 · Other software · Xerox · reported by 10b61619-3869-496c-8a1e-f291b0e71e3fMedium 5.3
A mail spoofing vulnerability in Xerox Workplace Suite allows attackers to forge email headers, making it appear as though messages are sent from trusted sources.
- Product
- Xerox Workplace Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecuritydocs.business.xerox.com
Jan 22, 2025Muzaara Google Ads Report: Deserialization of Untrusted DataCVE-2025-23914 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in muzaara Muzaara Google Ads Report muzaara-adwords-optimize-dashboard allows Object Injection.This issue affects Muzaara Google Ads Report: from n/a through <= 3.1.
- Product
- Muzaara Google Ads Report
- Affected
- up to 3.1
- What to do
- Affects up to 3.1. Update Muzaara Google Ads Report to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2025WOOEXIM: Deserialization of Untrusted DataCVE-2025-23944 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in bulktheme WOOEXIM wooexim allows Object Injection.This issue affects WOOEXIM: from n/a through <= 5.0.0.
- Product
- WOOEXIM
- Affected
- up to 5.0.0
- What to do
- Affects up to 5.0.0. Update WOOEXIM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2025Quick Count: Deserialization of Untrusted DataCVE-2025-23932 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Marko-M Quick Count quick-count allows Object Injection.This issue affects Quick Count: from n/a through <= 3.00.
- Product
- Quick Count
- Affected
- up to 3.00
- What to do
- Affects up to 3.00. Update Quick Count to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 21, 2025ARPrice: Deserialization of Untrusted DataCVE-2024-49699 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in reputeinfosystems ARPrice arprice allows Object Injection.This issue affects ARPrice: from n/a through <= 4.1.3.
- Product
- ARPrice
- Affected
- up to 4.1.3
- What to do
- Affects up to 4.1.3. Update ARPrice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 21, 2025ARPrice: Deserialization of Untrusted DataCVE-2024-49688 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in reputeinfosystems ARPrice arprice allows Object Injection.This issue affects ARPrice: from n/a through <= 4.1.3.
- Product
- ARPrice
- Affected
- up to 4.1.3
- What to do
- Affects up to 4.1.3. Update ARPrice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 20, 2025gitoxide is an implementation of git written in Rust.CVE-2025-22620 · Other software · GitoxideLabs · reported by GitHubMedium 5
gitoxide is an implementation of git written in Rust. Prior to 0.17.0, gix-worktree-state specifies 0777 permissions when checking out executable files, intending that the umask will restrict them appropriately. But one of the strategies it uses to set permissions is not subject to the umask. This causes files in a repository to be world-writable in some situations. This vulnerability is fixed in 0.17.0.
- Product
- gitoxide
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2025IBM Security ReaQta 3.12 could allow an authenticated user to perform unauthorized actions due to reliance on untrusted inputs.CVE-2024-45654 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM Security ReaQta 3.12 could allow an authenticated user to perform unauthorized actions due to reliance on untrusted inputs.
- Product
- Security ReaQta
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2025CWE-502: Deserialization of untrusted data vulnerability exists that could lead to loss of confidentiality, integrity and potential remote code execution on worCVE-2024-12703 · Other software · Schneider Electric · reported by cybersecurity@se.comHigh 8.5
CWE-502: Deserialization of untrusted data vulnerability exists that could lead to loss of confidentiality, integrity and potential remote code execution on workstation when a non-admin authenticated user opens a malicious project file.
- Product
- RemoteConnect and SCADAPack x70 Utilities
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.com
Jan 15, 2025An untrusted search path vulnerability in testinitsigs.exe as used in Bitdefender Antivirus Free 2020 allows a low-privilege attacker to execute code as SYSTEM CVE-2020-8094 · Other software · Bitdefender · reported by cve-requests@bitdefender.comHigh 8.8
An untrusted search path vulnerability in testinitsigs.exe as used in Bitdefender Antivirus Free 2020 allows a low-privilege attacker to execute code as SYSTEM via a specially crafted DLL file.
- Product
- Antivirus Free 2020
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2025Windows Virtual Trusted Platform Module Denial of Service VulnerabilityCVE-2025-21284 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Windows Virtual Trusted Platform Module Denial of Service Vulnerability
- Product
- Windows 10 Version 1507
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2025Windows Virtual Trusted Platform Module Denial of Service VulnerabilityCVE-2025-21280 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Windows Virtual Trusted Platform Module Denial of Service Vulnerability
- Product
- Windows 10 Version 1507
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2025Deserialization of untrusted data in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthentCVE-2024-13163 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75High 7.8
Deserialization of untrusted data in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to achieve remote code execution. Local user interaction is required.
- Product
- Endpoint Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2025GiveWP: Deserialization of Untrusted DataCVE-2025-22777 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in StellarWP GiveWP give allows Object Injection.This issue affects GiveWP: from n/a through <= 3.19.3.
- Product
- GiveWP
- Affected
- up to 3.19.3
- What to do
- Affects up to 3.19.3. Update GiveWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comsecurityonline.info
Jan 13, 2025TRUSTist REVIEWer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22567 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in trustist TRUSTist REVIEWer trustist-reviewer allows Reflected XSS.This issue affects TRUSTist REVIEWer: from n/a through <= 2.0.
- Product
- TRUSTist REVIEWer
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update TRUSTist REVIEWer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 9, 2025Deserialization of Untrusted Data vulnerability in Drupal Eloqua allows Object Injection.This issue affects Eloqua: from 7.X-* before 7.X-1.15.CVE-2024-13297 · Websites & servers · Drupal · reported by mlhess@drupal.orgMedium 6.6
Deserialization of Untrusted Data vulnerability in Drupal Eloqua allows Object Injection.This issue affects Eloqua: from 7.X-* before 7.X-1.15.
- Product
- Eloqua
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2025Deserialization of Untrusted Data vulnerability in Drupal Mailjet allows Object Injection.This issue affects Mailjet: from 0.0.0 before 4.0.1.CVE-2024-13296 · Websites & servers · Drupal · reported by mlhess@drupal.orgMedium 6.6
Deserialization of Untrusted Data vulnerability in Drupal Mailjet allows Object Injection.This issue affects Mailjet: from 0.0.0 before 4.0.1.
- Product
- Mailjet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2025Deserialization of Untrusted Data vulnerability in Drupal Node export allows Object Injection.This issue affects Node export: from 7.X-* before 7.X-3.3.CVE-2024-13295 · Websites & servers · Drupal · reported by mlhess@drupal.orgMedium 6.6
Deserialization of Untrusted Data vulnerability in Drupal Node export allows Object Injection.This issue affects Node export: from 7.X-* before 7.X-3.3.
- Product
- Node export
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2025Deserialization of Untrusted Data vulnerability in Drupal Monster Menus allows Object Injection.This issue affects Monster Menus: from 0.0.0 before 9.3.4, from CVE-2024-13288 · Websites & servers · Drupal · reported by mlhess@drupal.orgMedium 4.3
Deserialization of Untrusted Data vulnerability in Drupal Monster Menus allows Object Injection.This issue affects Monster Menus: from 0.0.0 before 9.3.4, from 9.4.0 before 9.4.2.
- Product
- Monster Menus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2025WC Price History for Omnibus: Deserialization of Untrusted DataCVE-2025-22510 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in kkarpieszuk WC Price History for Omnibus wc-price-history allows Object Injection.This issue affects WC Price History for Omnibus: from n/a through <= 2.1.4.
- Product
- WC Price History for Omnibus
- Affected
- up to 2.1.4
- What to do
- Affects up to 2.1.4. Update WC Price History for Omnibus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 8, 2025There is a vulnerability in ActiveSupport if the new bytesplice method is called on a SafeBuffer with untrusted user input.CVE-2023-28120 · Other software · Rails · reported by support@hackerone.comMedium 5.3
There is a vulnerability in ActiveSupport if the new bytesplice method is called on a SafeBuffer with untrusted user input.
- Product
- ActiveSupport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.rubyonrails.orggithub.com
Jan 8, 2025There is a deserialization of untrusted data vulnerability in the Kredis JSON deserialization codeCVE-2023-27531 · Other software · Rails · reported by support@hackerone.comMedium 5.3
There is a deserialization of untrusted data vulnerability in the Kredis JSON deserialization code
- Product
- Kredis JSON
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.rubyonrails.org
Jan 7, 2025matrix-rust-sdk is an implementation of a Matrix client-server library in Rust.CVE-2024-52813 · Other software · matrix-org · reported by GitHubMedium 4.3
matrix-rust-sdk is an implementation of a Matrix client-server library in Rust. Versions of the matrix-sdk-crypto Rust crate before 0.8.0 lack a dedicated mechanism to notify that a user's cryptographic identity has changed from a verified to an unverified one, which could cause client applications relying on the SDK to overlook such changes. matrix-sdk-crypto 0.8.0 adds a new VerificationLevel::VerificationViolation enum variant which indicates that a previously verified identity has been changed.
- Product
- matrix-rust-sdk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025PlainInventory: Deserialization of Untrusted DataCVE-2024-56291 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Deserialization of Untrusted Data vulnerability in plainware PlainInventory z-inventory-manager allows Object Injection.This issue affects PlainInventory: from n/a through <= 3.1.6.
- Product
- PlainInventory
- Affected
- up to 3.1.6
- What to do
- Affects up to 3.1.6. Update PlainInventory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Locatoraid Store Locator: Deserialization of Untrusted DataCVE-2024-56283 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Deserialization of Untrusted Data vulnerability in plainware Locatoraid Store Locator locatoraid allows Object Injection.This issue affects Locatoraid Store Locator: from n/a through <= 3.9.50.
- Product
- Locatoraid Store Locator
- Affected
- up to 3.9.50
- What to do
- Affects up to 3.9.50. Update Locatoraid Store Locator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025WPGuppy: Deserialization of Untrusted DataCVE-2024-49222 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in AmentoTech Private Limited WPGuppy wpguppy-lite allows Object Injection.This issue affects WPGuppy: from n/a through <= 1.1.0.
- Product
- WPGuppy
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update WPGuppy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 6, 2025Information disclosure while processing IOCTL call made for releasing a trusted VM process release or opening a channel without initializing the process.CVE-2024-33061 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 6.8
Information disclosure while processing IOCTL call made for releasing a trusted VM process release or opening a channel without initializing the process.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2024WP SuperBackup: Deserialization of Untrusted DataCVE-2024-56068 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Deserialization of Untrusted Data vulnerability in azzaroco WP SuperBackup indeed-wp-superbackup.This issue affects WP SuperBackup: from n/a through <= 2.3.3.
- Product
- WP SuperBackup
- Affected
- up to 2.3.3
- What to do
- Affects up to 2.3.3. Update WP SuperBackup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 25, 2024IBM Engineering Lifecycle Optimization - Engineering Insights 7.0.2 and 7.0.3 uses a web link with untrusted references to an external site.CVE-2024-39727 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.1
IBM Engineering Lifecycle Optimization - Engineering Insights 7.0.2 and 7.0.3 uses a web link with untrusted references to an external site. A remote attacker could exploit this vulnerability to expose sensitive information or perform unauthorized actions on the victims’ web browser.
- Product
- Engineering Insights
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 20, 2024vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs.CVE-2024-56335 · Other software · dani-garcia · reported by GitHubHigh 7.6
vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. In affected versions an attacker is capable of updating or deleting groups from an organization given a few conditions: 1. The attacker has a user account in the server. 2. The attacker's account has admin or owner permissions in an unrelated organization. 3. The attacker knows the target organization's UUID and the target group's UUID. Note that this vulnerability is related to group functionality and as such is only applicable for servers who have enabled the `ORG_GROUPS_ENABLED` setting, which is disabled by default. This attack can lead to different situations: 1. Denial of service, the attacker can limit users from accessing the organization's data by removing their membership from the group. 2. Privilege escalation, if the attacker is part of the victim organization, they can escalate their own privileges by joining a group they wouldn't normally have access to. For attackers that aren't part of the organization, this shouldn't lead to any possible plain-text data exfiltration as all the data is encrypted client side. This vulnerability is patched in Vaultwarden `1.32.7`,
- Product
- vaultwarden
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2024pyrage is a set of Python bindings for the rage file encryption library (age in Rust).CVE-2024-56327 · Other software · woodruffw · reported by GitHubHigh 7.7
pyrage is a set of Python bindings for the rage file encryption library (age in Rust). `pyrage` uses the Rust `age` crate for its underlying operations, and `age` is vulnerable to GHSA-4fg7-vxc8-qx5w. All details of GHSA-4fg7-vxc8-qx5w are relevant to `pyrage` for the versions specified in this advisory. See GHSA-4fg7-vxc8-qx5w for full details. Versions of `pyrage` before 1.2.0 lack plugin support and are therefore **not affected**. An equivalent issue was fixed in [the reference Go implementation of age](https://github.com/FiloSottile/age), see advisory GHSA-32gq-x56h-299c. This issue has been addressed in version 1.2.3 and all users are advised to update. There are no known workarounds for this vulnerability.
- Product
- pyrage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2024BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) OS Command Injection VulnerabilityCVE-2024-12686 · Other software · BeyondTrust · reported by 13061848-ea10-403d-bd75-c83a022c2891ExploitedMedium 6.6
BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) contain an OS command injection vulnerability that can be exploited by an attacker with existing administrative privileges to upload a malicious file. Successful exploitation of this vulnerability can allow a remote attacker to execute underlying operating system commands within the context of the site user.
- Product
- Privileged Remote Access (PRA) and Remote Support (RS)
- On CISA’s list since
- Jan 13, 2025 (federal fix deadline Feb 3, 2025)
- What to do
- Attackers are using this now. Install BeyondTrust’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalognvd.nist.govbeyondtrust.com
Dec 18, 2024A deserialization of untrusted data vulnerability exists in NI DAQExpress that may result in remote code execution.CVE-2024-12741 · Other software · NI · reported by security@ni.comHigh 8.4
A deserialization of untrusted data vulnerability exists in NI DAQExpress that may result in remote code execution. Successful exploitation requires an attacker to get a user to open a specially crafted project file. This vulnerability affects DAQExpress 5.1 and prior versions. Please note that DAQExpress is an EOL product and will not receive any updates.
- Product
- DAQExpress
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2024IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.9 does not properly validate a certificate which could allow an attacker to spoof a trusted entity bCVE-2024-47119 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.9
IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.9 does not properly validate a certificate which could allow an attacker to spoof a trusted entity by interfering in the communication path between the host and client.
- Product
- Storage Defender - Resiliency Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2024VRPConnector: Deserialization of Untrusted DataCVE-2024-56058 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in denniskravetstns VRPConnector vrpconnector allows Object Injection.This issue affects VRPConnector: from n/a through <= 2.0.1.
- Product
- VRPConnector
- Affected
- up to 2.0.1
- What to do
- Affects up to 2.0.1. Update VRPConnector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 17, 2024BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) Command Injection Vulnerability CVE-2024-12356 · Other software · BeyondTrust · reported by 13061848-ea10-403d-bd75-c83a022c2891ExploitedCritical 9.8
BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) contain a command injection vulnerability, which can allow an unauthenticated attacker to inject commands that are run as a site user.
- Product
- Privileged Remote Access (PRA) and Remote Support (RS)
- On CISA’s list since
- Dec 19, 2024 (federal fix deadline Dec 27, 2024)
- What to do
- Attackers are using this now. Install BeyondTrust’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalognvd.nist.govbeyondtrust.com
Dec 16, 2024Deserialization of Untrusted Data vulnerability in PlexTrac (Runbooks modules) which allows Object Injection and arbitrary file writes.CVE-2024-12687 · Other software · PlexTrac · reported by 5fea7123-217b-4b2d-ada8-8892719b43cdHigh 8.6
Deserialization of Untrusted Data vulnerability in PlexTrac (Runbooks modules) which allows Object Injection and arbitrary file writes. This issue affects PlexTrac: from 1.61.3 before 2.8.1.
- Product
- PlexTrac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.