Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
7,334 results · page 56 of 147
Nov 12, 2024A client-side enforcement of server-side security in Fortinet FortiAnalyzer-BigData at least version 7.4.0 and 7.2.0 through 7.2.6 and 7.0.1 through 7.0.6 andCVE-2024-23666 · Network & remote access · Fortinet · reported by psirt@fortinet.comHigh 7.5
A client-side enforcement of server-side security in Fortinet FortiAnalyzer-BigData at least version 7.4.0 and 7.2.0 through 7.2.6 and 7.0.1 through 7.0.6 and 6.4.5 through 6.4.7 and 6.2.5, FortiManager version 7.4.0 through 7.4.1 and 7.2.0 through 7.2.4 and 7.0.0 through 7.0.11 and 6.4.0 through 6.4.14, FortiAnalyzer version 7.4.0 through 7.4.1 and 7.2.0 through 7.2.4 and 7.0.0 through 7.0.11 and 6.4.0 through 6.4.14 allows attacker to improper access control via crafted requests.
- Product
- FortiManager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.fortinet.com
Nov 12, 2024An insufficient entropy vulnerability in the SecuSUITE Secure Client Authentication (SCA) Server of SecuSUITE versions 5.0.420 and earlier could allow an attackCVE-2024-51720 · Other software · BlackBerry · reported by secure@blackberry.comMedium 4.8
An insufficient entropy vulnerability in the SecuSUITE Secure Client Authentication (SCA) Server of SecuSUITE versions 5.0.420 and earlier could allow an attacker to potentially enroll an attacker-controlled device to the victim’s account and telephone number.
- Product
- SecuSUITE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.blackberry.com
Nov 12, 2024SQL Server Native Client Remote Code Execution VulnerabilityCVE-2024-49018 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
SQL Server Native Client Remote Code Execution Vulnerability
- Product
- Microsoft SQL Server 2017 (GDR)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024SQL Server Native Client Remote Code Execution VulnerabilityCVE-2024-49017 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
SQL Server Native Client Remote Code Execution Vulnerability
- Product
- Microsoft SQL Server 2017 (GDR)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024SQL Server Native Client Remote Code Execution VulnerabilityCVE-2024-49016 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
SQL Server Native Client Remote Code Execution Vulnerability
- Product
- Microsoft SQL Server 2017 (GDR)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024SQL Server Native Client Remote Code Execution VulnerabilityCVE-2024-49015 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
SQL Server Native Client Remote Code Execution Vulnerability
- Product
- Microsoft SQL Server 2019 (CU 29)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024SQL Server Native Client Remote Code Execution VulnerabilityCVE-2024-49014 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
SQL Server Native Client Remote Code Execution Vulnerability
- Product
- Microsoft SQL Server 2017 (GDR)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024SQL Server Native Client Remote Code Execution VulnerabilityCVE-2024-49013 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
SQL Server Native Client Remote Code Execution Vulnerability
- Product
- Microsoft SQL Server 2017 (GDR)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024SQL Server Native Client Remote Code Execution VulnerabilityCVE-2024-49012 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
SQL Server Native Client Remote Code Execution Vulnerability
- Product
- Microsoft SQL Server 2017 (GDR)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024SQL Server Native Client Remote Code Execution VulnerabilityCVE-2024-49011 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
SQL Server Native Client Remote Code Execution Vulnerability
- Product
- Microsoft SQL Server 2017 (GDR)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024SQL Server Native Client Remote Code Execution VulnerabilityCVE-2024-49010 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
SQL Server Native Client Remote Code Execution Vulnerability
- Product
- Microsoft SQL Server 2017 (GDR)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024SQL Server Native Client Remote Code Execution VulnerabilityCVE-2024-49009 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
SQL Server Native Client Remote Code Execution Vulnerability
- Product
- Microsoft SQL Server 2017 (GDR)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024SQL Server Native Client Remote Code Execution VulnerabilityCVE-2024-49008 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
SQL Server Native Client Remote Code Execution Vulnerability
- Product
- Microsoft SQL Server 2017 (GDR)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024SQL Server Native Client Remote Code Execution VulnerabilityCVE-2024-49007 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
SQL Server Native Client Remote Code Execution Vulnerability
- Product
- Microsoft SQL Server 2017 (GDR)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024SQL Server Native Client Remote Code Execution VulnerabilityCVE-2024-49006 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
SQL Server Native Client Remote Code Execution Vulnerability
- Product
- Microsoft SQL Server 2017 (GDR)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024SQL Server Native Client Remote Code Execution VulnerabilityCVE-2024-49005 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
SQL Server Native Client Remote Code Execution Vulnerability
- Product
- Microsoft SQL Server 2017 (GDR)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024SQL Server Native Client Remote Code Execution VulnerabilityCVE-2024-49004 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
SQL Server Native Client Remote Code Execution Vulnerability
- Product
- Microsoft SQL Server 2017 (GDR)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024SQL Server Native Client Remote Code Execution VulnerabilityCVE-2024-49003 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
SQL Server Native Client Remote Code Execution Vulnerability
- Product
- Microsoft SQL Server 2019 (CU 29)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024SQL Server Native Client Remote Code Execution VulnerabilityCVE-2024-49002 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
SQL Server Native Client Remote Code Execution Vulnerability
- Product
- Microsoft SQL Server 2017 (GDR)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024SQL Server Native Client Remote Code Execution VulnerabilityCVE-2024-49001 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
SQL Server Native Client Remote Code Execution Vulnerability
- Product
- Microsoft SQL Server 2019 (CU 29)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024SQL Server Native Client Remote Code Execution VulnerabilityCVE-2024-49000 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
SQL Server Native Client Remote Code Execution Vulnerability
- Product
- Microsoft SQL Server 2017 (GDR)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024SQL Server Native Client Remote Code Execution VulnerabilityCVE-2024-48999 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
SQL Server Native Client Remote Code Execution Vulnerability
- Product
- Microsoft SQL Server 2017 (GDR)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024SQL Server Native Client Remote Code Execution VulnerabilityCVE-2024-48998 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
SQL Server Native Client Remote Code Execution Vulnerability
- Product
- Microsoft SQL Server 2017 (GDR)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024SQL Server Native Client Remote Code Execution VulnerabilityCVE-2024-48997 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
SQL Server Native Client Remote Code Execution Vulnerability
- Product
- Microsoft SQL Server 2017 (GDR)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024SQL Server Native Client Remote Code Execution VulnerabilityCVE-2024-48996 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
SQL Server Native Client Remote Code Execution Vulnerability
- Product
- Microsoft SQL Server 2017 (GDR)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024SQL Server Native Client Remote Code Execution VulnerabilityCVE-2024-48995 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
SQL Server Native Client Remote Code Execution Vulnerability
- Product
- Microsoft SQL Server 2017 (GDR)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024SQL Server Native Client Remote Code Execution VulnerabilityCVE-2024-48994 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
SQL Server Native Client Remote Code Execution Vulnerability
- Product
- Microsoft SQL Server 2017 (GDR)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024SQL Server Native Client Remote Code Execution VulnerabilityCVE-2024-48993 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
SQL Server Native Client Remote Code Execution Vulnerability
- Product
- Microsoft SQL Server 2017 (GDR)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024Windows Client-Side Caching Elevation of Privilege VulnerabilityCVE-2024-43644 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Windows Client-Side Caching Elevation of Privilege Vulnerability
- Product
- Windows Server 2025
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024SQL Server Native Client Remote Code Execution VulnerabilityCVE-2024-43462 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
SQL Server Native Client Remote Code Execution Vulnerability
- Product
- Microsoft SQL Server 2019 (CU 29)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024SQL Server Native Client Remote Code Execution VulnerabilityCVE-2024-43459 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
SQL Server Native Client Remote Code Execution Vulnerability
- Product
- Microsoft SQL Server 2017 (GDR)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024SQL Server Native Client Remote Code Execution VulnerabilityCVE-2024-38255 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
SQL Server Native Client Remote Code Execution Vulnerability
- Product
- Microsoft SQL Server 2017 (GDR)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024A buffer over-read in Ivanti Secure Access Client before 22.7R4 allows a local unauthenticated attacker to cause a denial of service.CVE-2024-9843 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75Medium 5
A buffer over-read in Ivanti Secure Access Client before 22.7R4 allows a local unauthenticated attacker to cause a denial of service.
- Product
- Secure Access Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024Incorrect permissions in Ivanti Secure Access Client before version 22.7R4 allows a local authenticated attacker to create arbitrary folders.CVE-2024-9842 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75High 7.3
Incorrect permissions in Ivanti Secure Access Client before version 22.7R4 allows a local authenticated attacker to create arbitrary folders.
- Product
- Secure Access Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024Improper authorization in Ivanti Secure Access Client before version 22.7R3 allows a local authenticated attacker to modify sensitive configuration files.CVE-2024-8539 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75High 7.1
Improper authorization in Ivanti Secure Access Client before version 22.7R3 allows a local authenticated attacker to modify sensitive configuration files.
- Product
- Secure Access Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024Incorrect permissions in Ivanti Secure Access Client before 22.7R4 allows a local authenticated attacker to escalate their privileges.CVE-2024-7571 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75High 7.8
Incorrect permissions in Ivanti Secure Access Client before 22.7R4 allows a local authenticated attacker to escalate their privileges.
- Product
- Secure Access Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024Element is a Matrix web client built using the Matrix React SDK.CVE-2024-51750 · Other software · element-hq · reported by GitHubMedium 5
Element is a Matrix web client built using the Matrix React SDK. A malicious homeserver can send invalid messages over federation which can prevent Element Web and Desktop from rendering single messages or the entire room containing them. This was patched in Element Web and Desktop 1.11.85.
- Product
- element-web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024Element is a Matrix web client built using the Matrix React SDK.CVE-2024-51749 · Other software · element-hq · reported by GitHubLow 3.5
Element is a Matrix web client built using the Matrix React SDK. Versions of Element Web and Desktop earlier than 1.11.85 do not check if thumbnails for attachments, stickers and images are coherent. It is possible to add thumbnails to events trigger a file download once clicked. Fixed in element-web 1.11.85.
- Product
- element-web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript.CVE-2024-50336 · Other software · matrix-org · reported by GitHubMedium 5.3
matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. matrix-js-sdk before 34.11.0 is vulnerable to client-side path traversal via crafted MXC URIs. A malicious room member can trigger clients based on the matrix-js-sdk to issue arbitrary authenticated GET requests to the client's homeserver. Fixed in matrix-js-sdk 34.11.1.
- Product
- matrix-js-sdk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comspec.matrix.org
Nov 12, 2024Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients.CVE-2024-47535 · Other software · netty · reported by GitHubMedium 5.5
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. An unsafe reading of environment file could potentially cause a denial of service in Netty. When loaded on an Windows application, Netty attempts to load a file that does not exist. If an attacker creates such a large file, the Netty application crashes. This vulnerability is fixed in 4.1.115.
- Product
- netty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2024In the Linux kernel, the following vulnerability has been resolved: smb: client: fix possible double free in smb2_set_ea() Clang static checker(scan-build) waCVE-2024-50152 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Critical 9.8
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix possible double free in smb2_set_ea() Clang static checker(scan-build) warning： fs/smb/client/smb2ops.c:1304:2: Attempt to free released memory. 1304 | kfree(ea); | ^~~~~~~~~ There is a double free in such case: 'ea is initialized to NULL' -> 'first successful memory allocation for ea' -> 'something failed, goto sea_exit' -> 'first memory release for ea' -> 'goto replay_again' -> 'second goto sea_exit before allocate memory for ea' -> 'second memory release for ea resulted in double free'. Re-initialie 'ea' to NULL near to the replay_again label, it can fix this double free problem.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Nov 7, 2024In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOBs when building SMB2_IOCTL request When using encryption, either enforCVE-2024-50151 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOBs when building SMB2_IOCTL request When using encryption, either enforced by the server or when using 'seal' mount option, the client will squash all compound request buffers down for encryption into a single iov in smb2_set_next_command(). SMB2_ioctl_init() allocates a small buffer (448 bytes) to hold the SMB2_IOCTL request in the first iov, and if the user passes an input buffer that is greater than 328 bytes, smb2_set_next_command() will end up writing off the end of @rqst->iov[0].iov_base as shown below: mount.cifs //srv/share /mnt -o ...,seal ln -s $(perl -e "print('a')for 1..1024") /mnt/link BUG: KASAN: slab-out-of-bounds in smb2_set_next_command.cold+0x1d6/0x24c [cifs] Write of size 4116 at addr ffff8881148fcab8 by task ln/859 CPU: 1 UID: 0 PID: 859 Comm: ln Not tainted 6.12.0-rc3 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-2.fc40 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x5d/0x80 ? smb2_set_next_command.cold+0x1d6/0x24c [cifs] print_report+0x156/0x4d9 ? smb2_set_next_command.cold+0x1d6/0x24c [cifs] ? __virt_addr_valid+0
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Nov 7, 2024A flaw was found in hibernate-validator's 'isValid' method in the org.hibernate.validator.internal.constraintvalidators.hv.SafeHtmlValidator class, which can beCVE-2023-1932 · Other software · Red Hat · reported by Red HatMedium 6.1
A flaw was found in hibernate-validator's 'isValid' method in the org.hibernate.validator.internal.constraintvalidators.hv.SafeHtmlValidator class, which can be bypassed by omitting the tag ending in a less-than character. Browsers may render an invalid html, allowing HTML injection or Cross-Site-Scripting (XSS) attacks.
- Product
- A-MQ Clients 2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Nov 6, 2024symfony/http-client is a module for the Symphony PHP framework which provides powerful methods to fetch HTTP resources synchronously or asynchronously.CVE-2024-50342 · Other software · symfony · reported by GitHubLow 3.1
symfony/http-client is a module for the Symphony PHP framework which provides powerful methods to fetch HTTP resources synchronously or asynchronously. When using the `NoPrivateNetworkHttpClient`, some internal information is still leaking during host resolution, which leads to possible IP/port enumeration. As of versions 5.4.46, 6.4.14, and 7.1.7 the `NoPrivateNetworkHttpClient` now filters blocked IPs earlier to prevent such leaks. All users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- symfony
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2024In the Linux kernel, the following vulnerability has been resolved: smb: client: Handle kstrdup failures for passwords In smb3_reconfigure(), after duplicatinCVE-2024-50120 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: smb: client: Handle kstrdup failures for passwords In smb3_reconfigure(), after duplicating ctx->password and ctx->password2 with kstrdup(), we need to check for allocation failures. If ses->password allocation fails, return -ENOMEM. If ses->password2 allocation fails, free ses->password, set it to NULL, and return -ENOMEM.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Nov 1, 2024Cross Site Scripting vulnerability in FiberHome HG6544C RP2743 allows an attacker to execute arbitrary code via the SSID field in the WIFI Clients List not beinCVE-2024-51432 · Other software · fiberhome · reported by MITREMedium 4.8
Cross Site Scripting vulnerability in FiberHome HG6544C RP2743 allows an attacker to execute arbitrary code via the SSID field in the WIFI Clients List not being sanitized
- Product
- hg6544c_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorden.fiberhome.comgithub.com
Oct 31, 2024Webswing 23.2.2 allows remote attackers to modify client-side JavaScript code to achieve path traversal, likely leading to remote code execution via modificatioCVE-2024-39332 · Other software · webswing · reported by MITRECritical 9.8
Webswing 23.2.2 allows remote attackers to modify client-side JavaScript code to achieve path traversal, likely leading to remote code execution via modification of shell scripts on the server.
- Product
- webswing
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2024Client / Server PCs with the HP Smart Universal Printing Driver installed are potentially vulnerable to Remote Code Execution and/or Elevation of Privilege.CVE-2024-9419 · Other software · HP, Inc. · reported by hp-security-alert@hp.comHigh 7.8
Client / Server PCs with the HP Smart Universal Printing Driver installed are potentially vulnerable to Remote Code Execution and/or Elevation of Privilege. A client using the HP Smart Universal Printing Driver that sends a print job comprised of a malicious XPS file could potentially lead to Remote Code Execution and/or Elevation of Privilege on the PC.
- Product
- HP Smart Universal Printing Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2024The LevelOne WBR-6012 router with firmware R0.40e6 has an authentication bypass vulnerability in its web application due to reliance on client IP addresses for CVE-2024-23309 · Other software · LevelOne · reported by talos-cna@cisco.comCritical 9
The LevelOne WBR-6012 router with firmware R0.40e6 has an authentication bypass vulnerability in its web application due to reliance on client IP addresses for authentication. Attackers could spoof an IP address to gain unauthorized access without needing a session token.
- Product
- WBR-6012
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Oct 30, 2024In Eclipse Mosquitto, from version 1.3.2 through 2.0.18, if a malicious broker sends a crafted SUBACK packet with no reason codes, a client using libmosquitto mCVE-2024-10525 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 7.2
In Eclipse Mosquitto, from version 1.3.2 through 2.0.18, if a malicious broker sends a crafted SUBACK packet with no reason codes, a client using libmosquitto may make out of bounds memory access when acting in its on_subscribe callback. This affects the mosquitto_sub and mosquitto_rr clients.
- Product
- mosquitto
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgitlab.eclipse.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.