Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,626 results · page 57 of 93
Jun 11, 2024Aimeos is an Open Source e-commerce framework for online shops.CVE-2024-37295 · Other software · aimeos · reported by GitHubHigh 7.2
Aimeos is an Open Source e-commerce framework for online shops. Starting in version 2024.01.1 and prior to version 2024.04.5, a user with administrative privileges can upload files that look like images but contain PHP code which can then be executed in the context of the web server. Version 2024.04.5 fixes the issue.
- Product
- aimeos-core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2024Aimeos is an Open Source e-commerce framework for online shops.CVE-2024-37294 · Other software · aimeos · reported by GitHubMedium 5.5
Aimeos is an Open Source e-commerce framework for online shops. All SaaS and marketplace setups using Aimeos version from 2022/2023/2024 are affected by a potential denial of service attack. Users should upgrade to versions 2022.10.17, 2023.10.17, or 2024.04 of the aimeos/aimeos-core package to receive a patch.
- Product
- aimeos-core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2024MeterSphere is an open source continuous testing platform.CVE-2024-37161 · Other software · metersphere · reported by GitHubMedium 4
MeterSphere is an open source continuous testing platform. Prior to version 1.10.1-lts, the system's step editor stores cross-site scripting vulnerabilities. Version 1.10.1-lts fixes this issue.
- Product
- metersphere
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2024OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems.CVE-2024-35235 · Other software · OpenPrinting · reported by GitHubMedium 4.4
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.8 and earlier, when starting the cupsd server with a Listen configuration item pointing to a symbolic link, the cupsd process can be caused to perform an arbitrary chmod of the provided argument, providing world-writable access to the target. Given that cupsd is often running as root, this can result in the change of permission of any user or system files to be world writable. Given the aforementioned Ubuntu AppArmor context, on such systems this vulnerability is limited to those files modifiable by the cupsd process. In that specific case it was found to be possible to turn the configuration of the Listen argument into full control over the cupsd.conf and cups-files.conf configuration files. By later setting the User and Group arguments in cups-files.conf, and printing with a printer configured by PPD with a `FoomaticRIPCommandLine` argument, arbitrary user and group (not root) command execution could be achieved, which can further be used on Ubuntu systems to achieve full root command execution. Commit ff1f8a623e090dee8a8aadf12a6a4b25efac143d contains a patch for t
- Product
- cups
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Jun 4, 2024Envoy is a cloud-native, open source edge and service proxy.CVE-2024-34364 · Other software · envoyproxy · reported by GitHubMedium 5.7
Envoy is a cloud-native, open source edge and service proxy. Envoy exposed an out-of-memory (OOM) vector from the mirror response, since async HTTP client will buffer the response with an unbounded buffer.
- Product
- envoy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2024Envoy is a cloud-native, open source edge and service proxy.CVE-2024-34363 · Other software · envoyproxy · reported by GitHubHigh 7.5
Envoy is a cloud-native, open source edge and service proxy. Due to how Envoy invoked the nlohmann JSON library, the library could throw an uncaught exception from downstream data if incomplete UTF-8 strings were serialized. The uncaught exception would cause Envoy to crash.
- Product
- envoy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2024Envoy is a cloud-native, open source edge and service proxy.CVE-2024-34362 · Other software · envoyproxy · reported by GitHubMedium 5.9
Envoy is a cloud-native, open source edge and service proxy. There is a use-after-free in `HttpConnectionManager` (HCM) with `EnvoyQuicServerStream` that can crash Envoy. An attacker can exploit this vulnerability by sending a request without `FIN`, then a `RESET_STREAM` frame, and then after receiving the response, closing the connection.
- Product
- envoy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2024Envoy is a cloud-native, open source edge and service proxy.CVE-2024-32976 · Other software · envoyproxy · reported by GitHubHigh 7.5
Envoy is a cloud-native, open source edge and service proxy. Envoyproxy with a Brotli filter can get into an endless loop during decompression of Brotli data with extra input.
- Product
- envoy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2024Envoy is a cloud-native, open source edge and service proxy.CVE-2024-32975 · Other software · envoyproxy · reported by GitHubMedium 5.9
Envoy is a cloud-native, open source edge and service proxy. There is a crash at `QuicheDataReader::PeekVarInt62Length()`. It is caused by integer underflow in the `QuicStreamSequencerBuffer::PeekRegion()` implementation.
- Product
- envoy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2024Envoy is a cloud-native, open source edge and service proxy.CVE-2024-32974 · Other software · envoyproxy · reported by GitHubMedium 5.9
Envoy is a cloud-native, open source edge and service proxy. A crash was observed in `EnvoyQuicServerStream::OnInitialHeadersComplete()` with following call stack. It is a use-after-free caused by QUICHE continuing push request headers after `StopReading()` being called on the stream. As after `StopReading()`, the HCM's `ActiveStream` might have already be destroyed and any up calls from QUICHE could potentially cause use after free.
- Product
- envoy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2024Envoy is a cloud-native, open source edge and service proxy.CVE-2024-23326 · Other software · envoyproxy · reported by GitHubMedium 5.9
Envoy is a cloud-native, open source edge and service proxy. A theoretical request smuggling vulnerability exists through Envoy if a server can be tricked into adding an upgrade header into a response. Per RFC https://www.rfc-editor.org/rfc/rfc7230#section-6.7 a server sends 101 when switching protocols. Envoy incorrectly accepts a 200 response from a server when requesting a protocol upgrade, but 200 does not indicate protocol switch. This opens up the possibility of request smuggling through Envoy if the server can be tricked into adding the upgrade header to the response.
- Product
- envoy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2024Pimcore is an Open Source Data & Experience Management Platform.CVE-2024-32871 · Other software · pimcore · reported by GitHubHigh 7.5
Pimcore is an Open Source Data & Experience Management Platform. The Pimcore thumbnail generation can be used to flood the server with large files. By changing the file extension or scaling factor of the requested thumbnail, attackers can create files that are much larger in file size than the original. This vulnerability is fixed in 11.2.4.
- Product
- pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 3, 2024Misskey is an open source, decentralized microblogging platform.CVE-2024-32983 · Other software · misskey-dev · reported by GitHubHigh 8.2
Misskey is an open source, decentralized microblogging platform. Misskey doesn't perform proper normalization on the JSON structures of incoming signed ActivityPub activity objects before processing them, allowing threat actors to spoof the contents of signed activities and impersonate the authors of the original activities. This vulnerability is fixed in 2024.5.0.
- Product
- misskey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 31, 2024casgate is an Open Source Identity and Access Management system.CVE-2024-36108 · Other software · casgate · reported by GitHubCritical 9.8
casgate is an Open Source Identity and Access Management system. In affected versions `casgate` allows remote unauthenticated attacker to obtain sensitive information via GET request to an API endpoint. This issue has been addressed in PR #201 which is pending merge. An attacker could use `id` parameter of GET requests with value `anonymous/ anonymous` to bypass authorization on certain API endpoints. Successful exploitation of the vulnerability could lead to account takeover, privilege escalation or provide attacker with credential to other services. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- casgate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2024Wagtail is an open source content management system built on Django.CVE-2024-35228 · Other software · wagtail · reported by GitHubMedium 5.5
Wagtail is an open source content management system built on Django. Due to an improperly applied permission check in the `wagtail.contrib.settings` module, a user with access to the Wagtail admin and knowledge of the URL of the edit view for a settings model can access and update that setting, even when they have not been granted permission over the model. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. Patched versions have been released as Wagtail 6.0.5 and 6.1.2. Wagtail releases prior to 6.0 are unaffected. Users are advised to upgrade. Site owners who are unable to upgrade to a patched version can avoid the vulnerability in `ModelViewSet` by registering the model as a snippet instead. No workaround is available for `wagtail.contrib.settings`.
- Product
- wagtail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2024When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 requests can cause NGINX worker processes to terminate.CVE-2024-35200 · Network & remote access · F5 · reported by f5sirt@f5.comMedium 5.3
When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 requests can cause NGINX worker processes to terminate.
- Product
- NGINX Open Source
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comlists.fedoraproject.org
May 29, 2024When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module and the network infrastructure supports a Maximum Transmission Unit (MTU) of 4096 or gCVE-2024-34161 · Network & remote access · F5 · reported by f5sirt@f5.comMedium 5.3
When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module and the network infrastructure supports a Maximum Transmission Unit (MTU) of 4096 or greater without fragmentation, undisclosed QUIC packets can cause NGINX worker processes to leak previously freed memory.
- Product
- NGINX Open Source
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comlists.fedoraproject.org
May 29, 2024When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 encoder instructions can cause NGINX worker processes to terminateCVE-2024-32760 · Network & remote access · F5 · reported by f5sirt@f5.comMedium 6.5
When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 encoder instructions can cause NGINX worker processes to terminate or cause or other potential impact.
- Product
- NGINX Open Source
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comlists.fedoraproject.org
May 29, 2024When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 requests can cause NGINX worker processes to terminate or cause otCVE-2024-31079 · Network & remote access · F5 · reported by f5sirt@f5.comMedium 4.8
When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 requests can cause NGINX worker processes to terminate or cause other potential impact. This attack requires that a request be specifically timed during the connection draining process, which the attacker has no visibility and limited influence over.
- Product
- NGINX Open Source
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comlists.fedoraproject.org
May 28, 2024Umbraco Commerce is an open source dotnet ecommerce solution.CVE-2024-35240 · Websites & servers · umbraco · reported by GitHubMedium 5.4
Umbraco Commerce is an open source dotnet ecommerce solution. In affected versions there exists a stored Cross-site scripting (XSS) issue which would enable attackers to inject malicious code into Print Functionality. This issue has been addressed in versions 12.1.4, and 10.0.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- Umbraco.Commerce.Issues
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.umbraco.comgithub.com
May 28, 2024Umbraco Commerce is an open source dotnet web forms solution.CVE-2024-35239 · Other software · umbraco · reported by GitHubLow 2.7
Umbraco Commerce is an open source dotnet web forms solution. In affected versions an authenticated user that has access to edit Forms may inject unsafe code into Forms components. This issue can be mitigated by configuring TitleAndDescription:AllowUnsafeHtmlRendering after upgrading to one of the patched versions (13.0.1, 12.2.2, 10.5.3, 8.13.13).
- Product
- Umbraco.Forms.Issues
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.umbraco.comdocs.umbraco.com
May 28, 2024ansibleguy-webui is an open source WebUI for using Ansible.CVE-2024-36110 · Other software · ansibleguy · reported by GitHubHigh 8.2
ansibleguy-webui is an open source WebUI for using Ansible. Multiple forms in versions < 0.0.21 allowed injection of HTML elements. These are returned to the user after executing job actions and thus evaluated by the browser. These issues have been addressed in version 0.0.21 (0.0.21.post2 on pypi). Users are advised to upgrade. There are no known workarounds for these issues.
- Product
- webui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2024Meshery is an open source, cloud native manager that enables the design and management of Kubernetes-based infrastructure and applications.CVE-2024-35182 · Other software · meshery · reported by GitHubMedium 5.9
Meshery is an open source, cloud native manager that enables the design and management of Kubernetes-based infrastructure and applications. A SQL injection vulnerability in Meshery prior to version 0.7.22 may lead to arbitrary file write by using a SQL injection stacked queries payload, and the ATTACH DATABASE command. Additionally, attackers may be able to access and modify any data stored in the database, like performance profiles (which may contain session cookies), Meshery application data, or any Kubernetes configuration added to the system. The Meshery project exposes the function `GetAllEvents` at the API URL `/api/v2/events`. The sort query parameter read in `events_streamer.go` is directly used to build a SQL query in `events_persister.go`. Version 0.7.22 fixes this issue by using the `SanitizeOrderInput` function.
- Product
- meshery
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2024Meshery is an open source, cloud native manager that enables the design and management of Kubernetes-based infrastructure and applications.CVE-2024-35181 · Other software · meshery · reported by GitHubMedium 5.9
Meshery is an open source, cloud native manager that enables the design and management of Kubernetes-based infrastructure and applications. A SQL injection vulnerability in Meshery prior to version 0.7.22 may lead to arbitrary file write by using a SQL injection stacked queries payload, and the ATTACH DATABASE command. Additionally, attackers may be able to access and modify any data stored in the database, like performance profiles (which may contain session cookies), Meshery application data, or any Kubernetes configuration added to the system. The Meshery project exposes the function `GetMeshSyncResourcesKinds` at the API URL `/api/system/meshsync/resources/kinds`. The order query parameter is directly used to build a SQL query in `meshync_handler.go`. Version 0.7.22 fixes this issue.
- Product
- meshery
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2024Minder by Stacklok is an open source software supply chain security platform.CVE-2024-35238 · Other software · stacklok · reported by GitHubMedium 5.3
Minder by Stacklok is an open source software supply chain security platform. Minder prior to version 0.0.51 is vulnerable to a denial-of-service (DoS) attack which could allow an attacker to crash the Minder server and deny other users access to it. The root cause of the vulnerability is that Minders sigstore verifier reads an untrusted response entirely into memory without enforcing a limit on the response body. An attacker can exploit this by making Minder make a request to an attacker-controlled endpoint which returns a response with a large body which will crash the Minder server. Specifically, the point of failure is where Minder parses the response from the GitHub attestations endpoint in `getAttestationReply`. Here, Minder makes a request to the `orgs/$owner/attestations/$checksumref` GitHub endpoint (line 285) and then parses the response into the `AttestationReply` (line 295). The way Minder parses the response on line 295 makes it prone to DoS if the response is large enough. Essentially, the response needs to be larger than the machine has available memory. Version 0.0.51 contains a patch for this issue. The content that is hosted at the `orgs/$owner/attestations/$che
- Product
- minder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2024OpenProject is the leading open source project management software.CVE-2024-35224 · Other software · opf · reported by GitHubHigh 7.6
OpenProject is the leading open source project management software. OpenProject utilizes `tablesorter` inside of the Cost Report feature. This dependency, when misconfigured, can lead to Stored XSS via `{icon}` substitution in table header values. This attack requires the permissions "Edit work packages" as well as "Add attachments". A project admin could attempt to escalate their privileges by sending this XSS to a System Admin. Otherwise, if a full System Admin is required, then this attack is significantly less impactful. By utilizing a ticket's attachment, you can store javascript in the application itself and bypass the application's CSP policy to achieve Stored XSS. This vulnerability has been patched in version(s) 14.1.0, 14.0.2 and 13.4.2.
- Product
- openproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.openproject.orggithub.com
May 23, 2024OpenCTI is an open source platform allowing organizations to manage their cyber threat intelligence knowledge and observables.CVE-2024-26139 · Other software · OpenCTI-Platform · reported by GitHubHigh 8.3
OpenCTI is an open source platform allowing organizations to manage their cyber threat intelligence knowledge and observables. Due to lack of certain security controls on the profile edit functionality, an authenticated attacker with low privileges can gain administrative privileges on the web application.
- Product
- opencti
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2024Asterisk is an open source private branch exchange and telephony toolkit.CVE-2024-35190 · Other software · asterisk · reported by GitHubMedium 5.8
Asterisk is an open source private branch exchange and telephony toolkit. After upgrade to 18.23.0, ALL unauthorized SIP requests are identified as PJSIP Endpoint of local asterisk server. This vulnerability is fixed in 18.23.1, 20.8.1, and 21.3.1.
- Product
- asterisk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024PrestaShop is an open source e-commerce web application.CVE-2024-34717 · Websites & servers · PrestaShop · reported by GitHubMedium 5.3
PrestaShop is an open source e-commerce web application. In PrestaShop 8.1.5, any invoice can be downloaded from front-office in anonymous mode, by supplying a random secure_key parameter in the url. This issue is patched in version 8.1.6. No known workarounds are available.
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024PrestaShop is an open source e-commerce web application.CVE-2024-34716 · Websites & servers · PrestaShop · reported by GitHubCritical 9.6
PrestaShop is an open source e-commerce web application. A cross-site scripting (XSS) vulnerability that only affects PrestaShops with customer-thread feature flag enabled is present starting from PrestaShop 8.1.0 and prior to PrestaShop 8.1.6. When the customer thread feature flag is enabled through the front-office contact form, a hacker can upload a malicious file containing an XSS that will be executed when an admin opens the attached file in back office. The script injected can access the session and the security token, which allows it to perform any authenticated action in the scope of the administrator's right. This vulnerability is patched in 8.1.6. A workaround is to disable the customer-thread feature-flag.
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024Valtimo is an open source business process and case management platform.CVE-2024-34706 · Other software · valtimo-platform · reported by GitHubCritical 9.8
Valtimo is an open source business process and case management platform. When opening a form in Valtimo, the access token (JWT) of the user is exposed to `api.form.io` via the the `x-jwt-token` header. An attacker can retrieve personal information from this token, or use it to execute requests to the Valtimo REST API on behalf of the logged-in user. This issue is caused by a misconfiguration of the Form.io component. The following conditions have to be met in order to perform this attack: An attacker needs to have access to the network traffic on the `api.form.io` domain; the content of the `x-jwt-token` header is logged or otherwise available to the attacker; an attacker needs to have network access to the Valtimo API; and an attacker needs to act within the time-to-live of the access token. The default TTL in Keycloak is 5 minutes. Versions 10.8.4, 11.1.6 and 11.2.2 have been patched.
- Product
- valtimo-frontend-libraries
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 20241Panel is an open source Linux server operation and maintenance management panel.CVE-2024-34352 · Other software · 1Panel-dev · reported by GitHubMedium 6.5
1Panel is an open source Linux server operation and maintenance management panel. Prior to v1.10.3-lts, there are many command injections in the project, and some of them are not well filtered, leading to arbitrary file writes, and ultimately leading to RCEs. The mirror configuration write symbol `>` can be used to achieve arbitrary file writing. This vulnerability is fixed in v1.10.3-lts.
- Product
- 1Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024Sylius is an open source eCommerce platform.CVE-2024-34349 · Other software · Sylius · reported by GitHubMedium 4.8
Sylius is an open source eCommerce platform. Prior to 1.12.16 and 1.13.1, there is a possibility to execute javascript code in the Admin panel. In order to perform an XSS attack input a script into Name field in which of the resources: Taxons, Products, Product Options or Product Variants. The code will be executed while using an autocomplete field with one of the listed entities in the Admin Panel. Also for the taxons in the category tree on the product form.The issue is fixed in versions: 1.12.16, 1.13.1.
- Product
- Sylius
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024MantisBT (Mantis Bug Tracker) is an open source issue tracker.CVE-2024-34081 · Other software · mantisbt · reported by GitHubMedium 6.6
MantisBT (Mantis Bug Tracker) is an open source issue tracker. Improper escaping of a custom field's name allows an attacker to inject HTML and, if CSP settings permit, achieve execution of arbitrary JavaScript when resolving or closing issues (`bug_change_status_page.php`) belonging to a project linking said custom field, viewing issues (`view_all_bug_page.php`) when the custom field is displayed as a column, or printing issues (`print_all_bug_page.php`) when the custom field is displayed as a column. Version 2.26.2 contains a patch for the issue. As a workaround, ensure Custom Field Names do not contain HTML tags.
- Product
- mantisbt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024MantisBT (Mantis Bug Tracker) is an open source issue tracker.CVE-2024-34080 · Other software · mantisbt · reported by GitHubMedium 5.3
MantisBT (Mantis Bug Tracker) is an open source issue tracker. If an issue references a note that belongs to another issue that the user doesn't have access to, then it gets hyperlinked. Clicking on the link gives an access denied error as expected, yet some information remains available via the link, link label, and tooltip. This can result in disclosure of the existence of the note, the note author name, the note creation timestamp, and the issue id the note belongs to. Version 2.26.2 contains a patch for the issue. No known workarounds are available.
- Product
- mantisbt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024MantisBT (Mantis Bug Tracker) is an open source issue tracker.CVE-2024-34077 · Other software · mantisbt · reported by GitHubHigh 7.3
MantisBT (Mantis Bug Tracker) is an open source issue tracker. Insufficient access control in the registration and password reset process allows an attacker to reset another user's password and takeover their account, if the victim has an incomplete request pending. The exploit is only possible while the verification token is valid, i.e for 5 minutes after the confirmation URL sent by e-mail has been opened, and the user did not complete the process by updating their password. A brute-force attack calling account_update.php with increasing user IDs is possible. A successful takeover would grant the attacker full access to the compromised account, including sensitive information and functionalities associated with the account, the extent of which depends on its privileges and the data it has access to. Version 2.26.2 contains a patch for the issue. As a workaround, one may mitigate the risk by reducing the verification token's validity (change the value of the `TOKEN_EXPIRY_AUTHENTICATED` constant in `constants_inc.php`).
- Product
- mantisbt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024Froxlor is open source server administration software.CVE-2024-34070 · Other software · froxlor · reported by GitHubCritical 9.6
Froxlor is open source server administration software. Prior to 2.1.9, a Stored Blind Cross-Site Scripting (XSS) vulnerability was identified in the Failed Login Attempts Logging Feature of the Froxlor Application. An unauthenticated User can inject malicious scripts in the loginname parameter on the Login attempt, which will then be executed when viewed by the Administrator in the System Logs. By exploiting this vulnerability, the attacker can perform various malicious actions such as forcing the Administrator to execute actions without their knowledge or consent. For instance, the attacker can force the Administrator to add a new administrator controlled by the attacker, thereby giving the attacker full control over the application. This vulnerability is fixed in 2.1.9.
- Product
- Froxlor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024A Segmentation Fault issue discovered in Samsung Open Source Escargot JavaScript engine allows remote attackers to cause a denial of service via crafted inpCVE-2024-32672 · Computers, phones & browsers · Samsung Open Source · reported by PSIRT@samsung.comMedium 5.3
A Segmentation Fault issue discovered in Samsung Open Source Escargot JavaScript engine allows remote attackers to cause a denial of service via crafted input. This issue affects Escargot: 4.0.0.
- Product
- Escargot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024 Improper Input Validation vulnerability in Samsung Open Source escargot JavaScript engine allows Overflow Buffers.CVE-2024-32669 · Computers, phones & browsers · Samsung Open Source · reported by PSIRT@samsung.comMedium 5.3
Improper Input Validation vulnerability in Samsung Open Source escargot JavaScript engine allows Overflow Buffers. However, it occurs in the test code and does not include in the release. This issue affects escargot: 4.0.0.
- Product
- Escargot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024DataEase is an open source data visualization analysis tool.CVE-2024-31441 · Other software · dataease · reported by GitHubHigh 7.5
DataEase is an open source data visualization analysis tool. Due to the lack of restrictions on the connection parameters for the ClickHouse data source, it is possible to exploit certain malicious parameters to achieve arbitrary file reading. The vulnerability has been fixed in v1.18.19.
- Product
- dataease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 3, 2024tqdm is an open source progress bar for Python and CLI.CVE-2024-34062 · Other software · tqdm · reported by GitHubMedium 4.8
tqdm is an open source progress bar for Python and CLI. Any optional non-boolean CLI arguments (e.g. `--delim`, `--buf-size`, `--manpath`) are passed through python's `eval`, allowing arbitrary code execution. This issue is only locally exploitable and had been addressed in release version 4.66.3. All users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- tqdm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2024changedetection.io is a free open source web page change detection, website watcher, restock monitor and notification service.CVE-2024-34061 · Other software · dgtlmoon · reported by GitHubMedium 4.3
changedetection.io is a free open source web page change detection, website watcher, restock monitor and notification service. In affected versions Input in parameter notification_urls is not processed resulting in javascript execution in the application. A reflected XSS vulnerability happens when the user input from a URL or POST data is reflected on the page without being stored, thus allowing the attacker to inject malicious content. This issue has been addressed in version 0.45.22. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- changedetection.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2024Wagtail is an open source content management system built on Django.CVE-2024-32882 · Other software · wagtail · reported by GitHubLow 2.7
Wagtail is an open source content management system built on Django. In affected versions if a model has been made available for editing through the `wagtail.contrib.settings` module or `ModelViewSet`, and the `permission` argument on `FieldPanel` has been used to further restrict access to one or more fields of the model, a user with edit permission over the model but not the specific field can craft an HTTP POST request that bypasses the permission check on the individual field, allowing them to update its value. This vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin, or by a user who has not been granted edit access to the model in question. The editing interfaces for pages and snippets are also unaffected. Patched versions have been released as Wagtail 6.0.3 and 6.1. Wagtail releases prior to 6.0 are unaffected. Users are advised to upgrade. Site owners who are unable to upgrade to a patched version can avoid the vulnerability as follows: 1.For models registered through `ModelViewSet`, register the model as a snippet instead; 2. For settings models, place the restricted fields in a separate settings model, and configure permission
- Product
- wagtail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.wagtail.orgdocs.wagtail.org
May 1, 2024Zitadel is an open source identity management system.CVE-2024-32967 · Other software · zitadel · reported by GitHubMedium 5.3
Zitadel is an open source identity management system. In case ZITADEL could not connect to the database, connection information including db name, username and db host name could be returned to the user. This has been addressed in all supported release branches in a point release. There is no workaround since a patch is already available. Users are advised to upgrade.
- Product
- zitadel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2024Navidrome is an open source web-based music collection server and streamer.CVE-2024-32963 · Other software · navidrome · reported by GitHubMedium 4.2
Navidrome is an open source web-based music collection server and streamer. In affected versions of Navidrome are subject to a parameter tampering vulnerability where an attacker has the ability to manipulate parameter values in the HTTP requests. The attacker is able to change the parameter values in the body and successfully impersonate another user. In this case, the attacker created a playlist, added song, posted arbitrary comment, set the playlist to be public, and put the admin as the owner of the playlist. The attacker must be able to intercept http traffic for this attack. Each known user is impacted. An attacker can obtain the ownerId from shared playlist information, meaning every user who has shared a playlist is also impacted, as they can be impersonated. This issue has been addressed in version 0.52.0 and users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- navidrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2024librespeed/speedtest is an open source, self-hosted speed test for HTML5.CVE-2024-32890 · Other software · librespeed · reported by GitHubMedium 6.1
librespeed/speedtest is an open source, self-hosted speed test for HTML5. In affected versions missing neutralization of the ISP information in a speedtest result leads to stored Cross-site scripting in the JSON API. The `processedString` field in the `ispinfo` parameter is missing neutralization. It is stored when a user submits a speedtest result to the telemetry API (`results/telemetry.php`) and returned in the JSON API (`results/json.php`). This vulnerability has been introduced in commit 3937b94. This vulnerability affects LibreSpeed speedtest instances running version 5.2.5 or higher which have telemetry enabled and has been addressed in version 5.3.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- speedtest
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2024MyBB is a free and open source forum software.CVE-2024-23336 · Other software · mybb · reported by GitHubMedium 5
MyBB is a free and open source forum software. The default list of disallowed remote hosts does not contain the `127.0.0.0/8` block, which may result in a Server-Side Request Forgery (SSRF) vulnerability. The Configuration File's _Disallowed Remote Addresses_ list (`$config['disallowed_remote_addresses']`) contains the address `127.0.0.1`, but does not include the complete block `127.0.0.0/8`. MyBB 1.8.38 resolves this issue in default installations. Administrators of installed boards should update the existing configuration (`inc/config.php`) to include all addresses blocked by default. Additionally, users are advised to verify that it includes any other IPv4 addresses resolving to the server and other internal resources. Users unable to upgrade may manually add 127.0.0.0/8' to their disallowed address list.
- Product
- mybb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.mybb.comgithub.com
May 1, 2024MyBB is a free and open source forum software.CVE-2024-23335 · Other software · mybb · reported by GitHubMedium 4.7
MyBB is a free and open source forum software. The backup management module of the Admin CP may accept `.htaccess` as the name of the backup file to be deleted, which may expose the stored backup files over HTTP on Apache servers. MyBB 1.8.38 resolves this issue. Users are advised to upgrade. There are no known workarounds for this vulnerability
- Product
- mybb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2024changedetection.io is an open source web page change detection, website watcher, restock monitor and notification service.CVE-2024-32651 · Other software · dgtlmoon · reported by GitHubCritical 10
changedetection.io is an open source web page change detection, website watcher, restock monitor and notification service. There is a Server Side Template Injection (SSTI) in Jinja2 that allows Remote Command Execution on the server host. Attackers can run any system command without any restriction and they could use a reverse shell. The impact is critical as the attacker can completely takeover the server machine. This can be reduced if changedetection is behind a login page, but this isn't required by the application (not by default and not enforced).
- Product
- changedetection.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.hacktivesecurity.comgithub.com
Apr 25, 2024MeterSphere is an open source continuous testing platform.CVE-2024-32467 · Other software · metersphere · reported by GitHubMedium 5.7
MeterSphere is an open source continuous testing platform. Prior to version 2.10.14-lts, members without space permissions can view member information from other workspaces beyond their authority. Version 2.10.14-lts fixes this issue.
- Product
- metersphere
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.