Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
5,645 results · page 52 of 113
Dec 16, 2024ForumWP: Deserialization of Untrusted DataCVE-2024-54367 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Ultimate Member ForumWP forumwp allows Object Injection.This issue affects ForumWP: from n/a through <= 2.1.0.
- Product
- ForumWP
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update ForumWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024WP Mega Menu: Deserialization of Untrusted DataCVE-2024-54282 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in Themeum WP Mega Menu wp-megamenu allows Object Injection.This issue affects WP Mega Menu: from n/a through <= 1.4.2.
- Product
- WP Mega Menu
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update WP Mega Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Mail Picker: Deserialization of Untrusted DataCVE-2024-54273 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in PickPlugins Mail Picker mail-picker allows Object Injection.This issue affects Mail Picker: from n/a through <= 1.0.14.
- Product
- Mail Picker
- Affected
- up to 1.0.14
- What to do
- Affects up to 1.0.14. Update Mail Picker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Deserialization of Untrusted Data vulnerability in PlexTrac (Runbooks modules) which allows Object Injection and arbitrary file writes.This issue affects PlexTrCVE-2024-11839 · Other software · PlexTrac · reported by 5fea7123-217b-4b2d-ada8-8892719b43cdHigh 8.6
Deserialization of Untrusted Data vulnerability in PlexTrac (Runbooks modules) which allows Object Injection and arbitrary file writes.This issue affects PlexTrac: from 1.61.3 before 2.8.1.
- Product
- PlexTrac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2024Deserialization of untrusted data in Microsoft Update Catalog allows an unauthorized attacker to elevate privileges on the website’s webserver.CVE-2024-49147 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.3
Deserialization of untrusted data in Microsoft Update Catalog allows an unauthorized attacker to elevate privileges on the website’s webserver.
- Product
- Microsoft Update Catalog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2024GFI Archiver Store Service Deserialization of Untrusted Data Remote Code Execution Vulnerability.CVE-2024-11949 · Other software · GFI · reported by zdi-disclosures@trendmicro.comHigh 8.8
GFI Archiver Store Service Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GFI Archiver. Authentication is required to exploit this vulnerability. The specific flaw exists within the Store Service, which listens on TCP port 8018 by default. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-24331.
- Product
- Archiver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2024GFI Archiver Core Service Deserialization of Untrusted Data Remote Code Execution Vulnerability.CVE-2024-11947 · Other software · GFI · reported by zdi-disclosures@trendmicro.comHigh 8.8
GFI Archiver Core Service Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GFI Archiver. Authentication is required to exploit this vulnerability. The specific flaw exists within the Core Service, which listens on TCP port 8017 by default. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-24029.
- Product
- Archiver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability.CVE-2024-54051 · Other software · Adobe · reported by AdobeMedium 6.1
Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. An attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction.
- Product
- Adobe Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability.CVE-2024-54050 · Other software · Adobe · reported by AdobeMedium 6.1
Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. An attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction.
- Product
- Adobe Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024Nette Database through 3.2.4 allows SQL injection in certain situations involving an untrusted filter that is directly passed to the where method.CVE-2024-55586 · Other software · reported by MITRECritical 9.8
Nette Database through 3.2.4 allows SQL injection in certain situations involving an untrusted filter that is directly passed to the where method. NOTE: the vendor's position is that this is intended behavior.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2024Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 7.0 before 7.102, from 8.0.0 before CVE-2024-55638 · Websites & servers · Drupal · reported by mlhess@drupal.orgCritical 9.8
Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 7.0 before 7.102, from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9. Drupal core contains a chain of methods that is exploitable when an insecure deserialization vulnerability exists on the site. This so-called gadget chain presents no direct threat but is a vector that can be used to achieve remote code execution if the application deserializes untrusted data due to another vulnerability.
- Product
- Drupal Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2024Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 beCVE-2024-55637 · Websites & servers · Drupal · reported by mlhess@drupal.orgCritical 9.8
Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8. Drupal core contains a chain of methods that is exploitable when an insecure deserialization vulnerability exists on the site. This so-called gadget chain presents no direct threat but is a vector that can be used to achieve remote code execution if the application deserializes untrusted data due to another vulnerability.
- Product
- Drupal Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2024Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 beCVE-2024-55636 · Websites & servers · Drupal · reported by mlhess@drupal.orgCritical 9.8
Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8. Drupal core contains a chain of methods that is exploitable when an insecure deserialization vulnerability exists on the site. This so called gadget chain presents no direct threat, but is a vector that can be used to achieve remote code execution if the application deserializes untrusted data due to another vulnerability.
- Product
- Drupal Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2024Login Widget With Shortcode: URL Redirection to Untrusted Site ('Open Redirect')CVE-2024-54255 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in aviplugins.com Login Widget With Shortcode login-sidebar-widget allows Phishing.This issue affects Login Widget With Shortcode: from n/a through <= 6.1.2.
- Product
- Login Widget With Shortcode
- Affected
- up to 6.1.2
- What to do
- Affects up to 6.1.2. Update Login Widget With Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 6, 2024A flaw was found in Rustls 0.23.13 and related APIs.CVE-2024-11738 · Other software · Red Hat · reported by Red HatMedium 5.3
A flaw was found in Rustls 0.23.13 and related APIs. This vulnerability allows denial of service (panic) via a fragmented TLS ClientHello message.
- Product
- Red Hat Trusted Artifact Signer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Dec 5, 2024Mark Laing discovered in LXD's PKI mode, until version 5.21.1, that a restricted certificate could be added to the trust store with its restrictions not honoureCVE-2024-6219 · Other software · Canonical Ltd. · reported by security@ubuntu.comLow 3.8
Mark Laing discovered in LXD's PKI mode, until version 5.21.1, that a restricted certificate could be added to the trust store with its restrictions not honoured.
- Product
- LXD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2024Mark Laing discovered that LXD's PKI mode, until version 5.21.2, could be bypassed if the client's certificate was present in the trust store.CVE-2024-6156 · Other software · Canonical Ltd. · reported by security@ubuntu.comLow 3.8
Mark Laing discovered that LXD's PKI mode, until version 5.21.2, could be bypassed if the client's certificate was present in the trust store.
- Product
- LXD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2024rPGP is a pure Rust implementation of OpenPGP.CVE-2024-53857 · Other software · rpgp · reported by GitHubHigh 7.5
rPGP is a pure Rust implementation of OpenPGP. Prior to 0.14.1, rPGP allows attackers to trigger resource exhaustion vulnerabilities in rpgp by providing crafted messages. This affects general message parsing and decryption with symmetric keys.
- Product
- rpgp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2024rPGP is a pure Rust implementation of OpenPGP.CVE-2024-53856 · Other software · rpgp · reported by GitHubHigh 7.5
rPGP is a pure Rust implementation of OpenPGP. Prior to 0.14.1, rPGP allows an attacker to trigger rpgp crashes by providing crafted data. This vulnerability is fixed in 0.14.1.
- Product
- rpgp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 28, 2024Deserialization of untrusted data in IPC and Parquet readers in the Apache Arrow R package versions 4.0.0 through 16.1.0 allows arbitrary code execution.CVE-2024-52338 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Deserialization of untrusted data in IPC and Parquet readers in the Apache Arrow R package versions 4.0.0 through 16.1.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources (for example, user-supplied input files). This vulnerability only affects the arrow R package, not other Apache Arrow implementations or bindings unless those bindings are specifically used via the R package (for example, an R application that embeds a Python interpreter and uses PyArrow to read files from untrusted sources is still vulnerable if the arrow R package is an affected version). It is recommended that users of the arrow R package upgrade to 17.0.0 or later. Similarly, it is recommended that downstream libraries upgrade their dependency requirements to arrow 17.0.0 or later. If using an affected version of the package, untrusted data can read into a Table and its internal to_data_frame() method can be used as a workaround (e.g., read_parquet(..., as_data_frame = FALSE)$to_data_frame()). This issue affects the Apache Arrow R package: from 4.0.0 through 16.1.0. Users are recommended to upgrade to version 17.0.0, whi
- Product
- Apache Arrow R package
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.apache.org
Nov 27, 2024In elisp-mode.el in GNU Emacs before 30.1, a user who chooses to invoke elisp-completion-at-point (for code completion) on untrusted Emacs Lisp source code can CVE-2024-53920 · Other software · gnu · reported by MITREHigh 7.8
In elisp-mode.el in GNU Emacs before 30.1, a user who chooses to invoke elisp-completion-at-point (for code completion) on untrusted Emacs Lisp source code can trigger unsafe Lisp macro expansion that allows attackers to execute arbitrary code. (This unsafe expansion also occurs if a user chooses to enable on-the-fly diagnosis that byte compiles untrusted Emacs Lisp source code.)
- Product
- emacs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordeshelyaron.comgit.savannah.gnu.org
Nov 25, 2024Deno is a runtime for JavaScript and TypeScript written in rust.CVE-2024-32468 · Other software · denoland · reported by GitHubMedium 5.4
Deno is a runtime for JavaScript and TypeScript written in rust. Several cross-site scripting vulnerabilities existed in the `deno_doc` crate which lead to Self-XSS with deno doc --html. 1.) XSS in generated `search_index.js`, `deno_doc` outputs a JavaScript file for searching. However, the generated file used `innerHTML` on unsanitzed HTML input. 2.) XSS via property, method and enum names, `deno_doc` did not sanitize property names, method names and enum names. The first XSS most likely didn't have an impact since `deno doc --html` is expected to be used locally with own packages.
- Product
- deno
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024Visteon Infotainment App SoC Missing Immutable Root of Trust in Hardware Local Privilege Escalation Vulnerability.CVE-2024-8357 · Other software · Visteon · reported by zdi-disclosures@trendmicro.comHigh 7.8
Visteon Infotainment App SoC Missing Immutable Root of Trust in Hardware Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Visteon Infotainment systems. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the configuration of the application system-on-chip (SoC). The issue results from the lack of properly configured hardware root of trust. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the boot process. Was ZDI-CAN-23759.
- Product
- Infotainment
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024Hugging Face Transformers Trax Model Deserialization of Untrusted Data Remote Code Execution Vulnerability.CVE-2024-11394 · Other software · Hugging Face · reported by zdi-disclosures@trendmicro.comHigh 8.8
Hugging Face Transformers Trax Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of model files. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-25012.
- Product
- Transformers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024Hugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution Vulnerability.CVE-2024-11393 · Other software · Hugging Face · reported by zdi-disclosures@trendmicro.comHigh 8.8
Hugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of model files. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-25191.
- Product
- Transformers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024Hugging Face Transformers MobileViTV2 Deserialization of Untrusted Data Remote Code Execution Vulnerability.CVE-2024-11392 · Other software · Hugging Face · reported by zdi-disclosures@trendmicro.comHigh 8.8
Hugging Face Transformers MobileViTV2 Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of configuration files. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-24322.
- Product
- Transformers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024Allegra loadFieldMatch Deserialization of Untrusted Data Remote Code Execution Vulnerability.CVE-2024-5580 · Other software · Allegra · reported by zdi-disclosures@trendmicro.comHigh 7.2
Allegra loadFieldMatch Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Allegra. Authentication is required to exploit this vulnerability. The specific flaw exists within the loadFieldMatch method. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of LOCAL SERVICE. Was ZDI-CAN-23452.
- Product
- Allegra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordalltena.comzerodayinitiative.com
Nov 22, 2024Allegra renderFieldMatch Deserialization of Untrusted Data Remote Code Execution Vulnerability.CVE-2024-5579 · Other software · Allegra · reported by zdi-disclosures@trendmicro.comHigh 7.2
Allegra renderFieldMatch Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Allegra. Authentication is required to exploit this vulnerability. The specific flaw exists within the renderFieldMatch method. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of LOCAL SERVICE. Was ZDI-CAN-23451.
- Product
- Allegra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordalltena.comzerodayinitiative.com
Nov 22, 2024Allegra loadFieldMatch Deserialization of Untrusted Data Remote Code Execution Vulnerability.CVE-2023-51642 · Other software · Allegra · reported by zdi-disclosures@trendmicro.comMedium 6.3
Allegra loadFieldMatch Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Allegra. Although authentication is required to exploit this vulnerability, product implements a registration mechanism that can be used to create a user with a sufficient privilege level. The specific flaw exists within the loadFieldMatch method. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of LOCAL SERVICE. Was ZDI-CAN-22506.
- Product
- Allegra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtrackplus.comzerodayinitiative.com
Nov 22, 2024Allegra renderFieldMatch Deserialization of Unstrusted Data Remote Code Execution Vulnerability.CVE-2023-51641 · Other software · Allegra · reported by zdi-disclosures@trendmicro.comMedium 6.3
Allegra renderFieldMatch Deserialization of Unstrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Allegra. Although authentication is required to exploit this vulnerability, product implements a registration mechanism that can be used to create a user with a sufficient privilege level. The specific flaw exists within the renderFieldMatch method. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of LOCAL SERVICE. Was ZDI-CAN-22505.
- Product
- Allegra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtrackplus.comzerodayinitiative.com
Nov 20, 2024QRMenu Restaurant QR Menu Lite: Deserialization of Untrusted DataCVE-2024-52445 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in ModelTheme QRMenu Restaurant QR Menu Lite qrmenu-lite allows Object Injection.This issue affects QRMenu Restaurant QR Menu Lite: from n/a through <= 1.0.4.
- Product
- QRMenu Restaurant QR Menu Lite
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update QRMenu Restaurant QR Menu Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 20, 2024Geolocator: Deserialization of Untrusted DataCVE-2024-52443 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in masikonis Geolocator geolocator allows Object Injection.This issue affects Geolocator: from n/a through <= 1.1.
- Product
- Geolocator
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Geolocator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 20, 2024Xpresslane Fast Checkout: Deserialization of Untrusted DataCVE-2024-52440 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in xpresslane Xpresslane Fast Checkout xpresslane-integration-for-woocommerce allows Object Injection.This issue affects Xpresslane Fast Checkout: from n/a through <= 1.0.0.
- Product
- Xpresslane Fast Checkout
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Xpresslane Fast Checkout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 20, 2024Team Rosters: Deserialization of Untrusted DataCVE-2024-52439 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Mark O'Donnell Team Rosters team-rosters allows Object Injection.This issue affects Team Rosters: from n/a through <= 4.8.2.
- Product
- Team Rosters
- Affected
- up to 4.8.2
- What to do
- Affects up to 4.8.2. Update Team Rosters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 18, 2024In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: dcp: fix NULL dereference in AEAD crypto operation When sealing or unsealinCVE-2024-50281 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: dcp: fix NULL dereference in AEAD crypto operation When sealing or unsealing a key blob we currently do not wait for the AEAD cipher operation to finish and simply return after submitting the request. If there is some load on the system we can exit before the cipher operation is done and the buffer we read from/write to is already removed from the stack. This will e.g. result in NULL pointer dereference errors in the DCP driver during blob creation. Fix this by waiting for the AEAD cipher operation to finish before resuming the seal and unseal calls.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Nov 18, 2024Popup by Supsystic: Deserialization of Untrusted DataCVE-2024-52434 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Deserialization of Untrusted Data vulnerability in supsystic Popup by Supsystic popup-by-supsystic allows Command Injection.This issue affects Popup by Supsystic: from n/a through <= 1.10.29.
- Product
- Popup by Supsystic
- Affected
- up to 1.10.29
- What to do
- Affects up to 1.10.29. Update Popup by Supsystic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 18, 2024My Geo Posts Free: Deserialization of Untrusted DataCVE-2024-52433 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Mindstien Technologies My Geo Posts Free my-geo-posts-free allows Object Injection.This issue affects My Geo Posts Free: from n/a through <= 1.2.
- Product
- My Geo Posts Free
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update My Geo Posts Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 18, 2024NIX Anti-Spam Light: Deserialization of Untrusted DataCVE-2024-52432 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in NIX Solutions Ltd NIX Anti-Spam Light nix-anti-spam-light allows Object Injection.This issue affects NIX Anti-Spam Light: from n/a through <= 0.0.4.
- Product
- NIX Anti-Spam Light
- Affected
- up to 0.0.4
- What to do
- Affects up to 0.0.4. Update NIX Anti-Spam Light to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 18, 2024Lis Video Gallery: Deserialization of Untrusted DataCVE-2024-52430 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in bublick Lis Video Gallery lis-video-gallery allows Object Injection.This issue affects Lis Video Gallery: from n/a through <= 0.2.1.
- Product
- Lis Video Gallery
- Affected
- up to 0.2.1
- What to do
- Affects up to 0.2.1. Update Lis Video Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 18, 2024Event Tickets with Ticket Scanner: Deserialization of Untrusted DataCVE-2024-52427 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Deserialization of Untrusted Data vulnerability in Vollstart Event Tickets with Ticket Scanner event-tickets-with-ticket-scanner allows Server Side Include (SSI) Injection.This issue affects Event Tickets with Ticket Scanner: from n/a through <= 2.3.11.
- Product
- Event Tickets with Ticket Scanner
- Affected
- up to 2.3.11
- What to do
- Affects up to 2.3.11. Update Event Tickets with Ticket Scanner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 18, 2024Deserialization of Untrusted Data vulnerability in Apache HertzBeat.CVE-2024-41151 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.8
Deserialization of Untrusted Data vulnerability in Apache HertzBeat. This vulnerability can only be exploited by authorized attackers. This issue affects Apache HertzBeat: before 1.6.1. Users are recommended to upgrade to version 1.6.1, which fixes the issue.
- Product
- Apache HertzBeat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
Nov 16, 2024WDES Responsive Mobile Menu: Deserialization of Untrusted DataCVE-2024-52414 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Anthony Carbon WDES Responsive Mobile Menu wdes-responsive-mobile-menu allows Object Injection.This issue affects WDES Responsive Mobile Menu: from n/a through <= 5.3.18.
- Product
- WDES Responsive Mobile Menu
- Affected
- up to 5.3.18
- What to do
- Affects up to 5.3.18. Update WDES Responsive Mobile Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 16, 2024Airin Blog: Deserialization of Untrusted DataCVE-2024-52413 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in dmcwebzone Airin Blog airin-blog allows Object Injection.This issue affects Airin Blog: from n/a through <= 1.6.1.
- Product
- Airin Blog
- Affected
- up to 1.6.1
- What to do
- Affects up to 1.6.1. Update Airin Blog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 16, 2024Xin: Deserialization of Untrusted DataCVE-2024-52412 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Stephen Cui Xin allows Object Injection.This issue affects Xin: from n/a through 1.0.8.1.
- Product
- Xin
- Affected
- up to 1.0.8.1
- What to do
- Affects up to 1.0.8.1. Update Xin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 16, 2024Advanced Personalization: Deserialization of Untrusted DataCVE-2024-52411 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in flowcraft Advanced Personalization personalization-by-flowcraft allows Object Injection.This issue affects Advanced Personalization: from n/a through <= 1.1.2.
- Product
- Advanced Personalization
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update Advanced Personalization to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 16, 2024Referrer Detector: Deserialization of Untrusted DataCVE-2024-52410 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Phoenixheart Referrer Detector referrer-detector allows Object Injection.This issue affects Referrer Detector: from n/a through <= 4.2.1.0.
- Product
- Referrer Detector
- Affected
- up to 4.2.1.0
- What to do
- Affects up to 4.2.1.0. Update Referrer Detector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 16, 2024AJAX Random Posts: Deserialization of Untrusted DataCVE-2024-52409 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Phoenixheart AJAX Random Posts ajax-random-posts allows Object Injection.This issue affects AJAX Random Posts: from n/a through <= 0.3.3.
- Product
- AJAX Random Posts
- Affected
- up to 0.3.3
- What to do
- Affects up to 0.3.3. Update AJAX Random Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 15, 2024In JetBrains WebStorm before 2024.3 code execution in Untrusted Project mode was possible via type definitions installer scriptCVE-2024-52555 · Other software · JetBrains · reported by cve@jetbrains.comMedium 6.3
In JetBrains WebStorm before 2024.3 code execution in Untrusted Project mode was possible via type definitions installer script
- Product
- WebStorm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2024In the autofill service, the package name that is provided by the app process is trusted inappropriately.CVE-2017-13227 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In the autofill service, the package name that is provided by the app process is trusted inappropriately. This could lead to information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2024Podlove Podcast Publisher: Deserialization of Untrusted DataCVE-2024-52393 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Deserialization of Untrusted Data vulnerability in Eric Teubert Podlove Podcast Publisher podlove-podcasting-plugin-for-wordpress.This issue affects Podlove Podcast Publisher: from n/a through <= 4.1.15.
- Product
- Podlove Podcast Publisher
- Affected
- up to 4.1.15
- What to do
- Affects up to 4.1.15. Update Podlove Podcast Publisher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.