Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
912 results · page 6 of 19
Jul 15, 2025An authenticated multi-stage remote code execution vulnerability exists in Riverbed SteelCentral NetProfiler and NetExpress 10.8.7 virtual appliances.CVE-2025-34112 · Other software · Riverbed Technology · reported by VulnCheckCritical 10
An authenticated multi-stage remote code execution vulnerability exists in Riverbed SteelCentral NetProfiler and NetExpress 10.8.7 virtual appliances. A SQL injection vulnerability in the '/api/common/1.0/login' endpoint can be exploited to create a new user account in the appliance database. This user can then trigger a command injection vulnerability in the '/index.php?page=licenses' endpoint to execute arbitrary commands. The attacker may escalate privileges to root by exploiting an insecure sudoers configuration that allows the 'mazu' user to execute arbitrary commands as root via SSH key extraction and command chaining. Successful exploitation allows full remote root access to the virtual appliance.
- Product
- SteelCentral NetExpress
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comsupport.riverbed.com
Jul 7, 2025SAP CMC Promotion Management allows an authenticated attacker to enumerate internal network systems by submitting crafted requests during job source configuratiCVE-2025-42965 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.1
SAP CMC Promotion Management allows an authenticated attacker to enumerate internal network systems by submitting crafted requests during job source configuration. By analysing response times for various IP addresses and ports, the attacker can infer valid network endpoints. Successful exploitation may lead to information disclosure. This vulnerability does not impact the integrity or availability of the application.
- Product
- SAP BusinessObjects BI Platform Central Management Console Promotion Management Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 3, 2025Improper Authentication vulnerability in Wikimedia Foundation Mediawiki - CentralAuth Extension allows : Bypass Authentication.This issue affects Mediawiki - CeCVE-2025-6926 · Other software · Wikimedia Foundation · reported by c4f26cc8-17ff-4c99-b5e2-38fc1793eaccHigh 8.8
Improper Authentication vulnerability in Wikimedia Foundation Mediawiki - CentralAuth Extension allows : Bypass Authentication.This issue affects Mediawiki - CentralAuth Extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.
- Product
- Mediawiki - CentralAuth Extension
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgerrit.wikimedia.orgphabricator.wikimedia.org
Jun 17, 2025A Server-side Request Forgery (SSRF) vulnerability in Trend Micro Apex Central (SaaS) could allow an attacker to manipulate certain parameters leading to informCVE-2025-30680 · Other software · Trend Micro, Inc. · reported by security@trendmicro.comHigh 7.1
A Server-side Request Forgery (SSRF) vulnerability in Trend Micro Apex Central (SaaS) could allow an attacker to manipulate certain parameters leading to information disclosure on affected installations. Please note: this vulnerability only affects the SaaS instance of Apex Central - customers that automatically apply Trend Micro's monthly maintenance releases to the SaaS instance do not have to take any further action.
- Product
- Trend Micro Apex Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsuccess.trendmicro.comzerodayinitiative.com
Jun 17, 2025A Server-side Request Forgery (SSRF) vulnerability in Trend Micro Apex Central (on-premise) modOSCE component could allow an attacker to manipulate certain paraCVE-2025-30679 · Other software · Trend Micro, Inc. · reported by security@trendmicro.comMedium 6.5
A Server-side Request Forgery (SSRF) vulnerability in Trend Micro Apex Central (on-premise) modOSCE component could allow an attacker to manipulate certain parameters leading to information disclosure on affected installations.
- Product
- Trend Micro Apex Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsuccess.trendmicro.comzerodayinitiative.com
Jun 17, 2025A Server-side Request Forgery (SSRF) vulnerability in Trend Micro Apex Central (on-premise) modTMSM component could allow an attacker to manipulate certain paraCVE-2025-30678 · Other software · Trend Micro, Inc. · reported by security@trendmicro.comMedium 6.5
A Server-side Request Forgery (SSRF) vulnerability in Trend Micro Apex Central (on-premise) modTMSM component could allow an attacker to manipulate certain parameters leading to information disclosure on affected installations.
- Product
- Trend Micro Apex Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsuccess.trendmicro.comzerodayinitiative.com
Jun 17, 2025An insecure deserialization operation in Trend Micro Apex Central below version 8.0.7007 could lead to a pre-authentication remote code execution on affected inCVE-2025-49220 · Other software · Trend Micro, Inc. · reported by security@trendmicro.comCritical 9.8
An insecure deserialization operation in Trend Micro Apex Central below version 8.0.7007 could lead to a pre-authentication remote code execution on affected installations. Note that this vulnerability is similar to CVE-2025-49219 but is in a different method.
- Product
- Trend Micro Apex Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsuccess.trendmicro.comzerodayinitiative.com
Jun 17, 2025An insecure deserialization operation in Trend Micro Apex Central below versions 8.0.7007 could lead to a pre-authentication remote code execution on affected iCVE-2025-49219 · Other software · Trend Micro, Inc. · reported by security@trendmicro.comCritical 9.8
An insecure deserialization operation in Trend Micro Apex Central below versions 8.0.7007 could lead to a pre-authentication remote code execution on affected installations. Note that this vulnerability is similar to CVE-2025-49220 but is in a different method.
- Product
- Trend Micro Apex Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsuccess.trendmicro.comzerodayinitiative.com
Jun 17, 2025A Local File Inclusion vulnerability in a Trend Micro Apex Central widget in versions below 8.0.6955 could allow an attacker to include arbitrary files to execuCVE-2025-47867 · Other software · Trend Micro, Inc. · reported by security@trendmicro.comHigh 7.5
A Local File Inclusion vulnerability in a Trend Micro Apex Central widget in versions below 8.0.6955 could allow an attacker to include arbitrary files to execute as PHP code and lead to remote code execution on affected installations.
- Product
- Trend Micro Apex Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsuccess.trendmicro.comzerodayinitiative.com
Jun 17, 2025An unrestricted file upload vulnerability in a Trend Micro Apex Central widget below version 8.0.6955 could allow an attacker to upload arbitrary files on affecCVE-2025-47866 · Other software · Trend Micro, Inc. · reported by security@trendmicro.comMedium 4.3
An unrestricted file upload vulnerability in a Trend Micro Apex Central widget below version 8.0.6955 could allow an attacker to upload arbitrary files on affected installations.
- Product
- Trend Micro Apex Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsuccess.trendmicro.comzerodayinitiative.com
Jun 17, 2025A Local File Inclusion vulnerability in a Trend Micro Apex Central widget below version 8.0.6955 could allow an attacker to gain remote code execution on affectCVE-2025-47865 · Other software · Trend Micro, Inc. · reported by security@trendmicro.comHigh 7.5
A Local File Inclusion vulnerability in a Trend Micro Apex Central widget below version 8.0.6955 could allow an attacker to gain remote code execution on affected installations.
- Product
- Trend Micro Apex Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsuccess.trendmicro.comzerodayinitiative.com
Jun 12, 2025A username and password are required to authenticate to the central SinoTrack device management interface.CVE-2025-5484 · Other software · SinoTrack · reported by ics-cert@hq.dhs.govHigh 7.6
A username and password are required to authenticate to the central SinoTrack device management interface. The username for all devices is an identifier printed on the receiver. The default password is well-known and common to all devices. Modification of the default password is not enforced during device setup. A malicious actor can retrieve device identifiers with either physical access or by capturing identifiers from pictures of the devices posted on publicly accessible websites such as eBay.
- Product
- IOT PC Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcisa.govsinotrackgps.com
Jun 9, 2025SAP S/4HANA Manage Central Purchase Contract does not perform necessary authorization checks for an authenticated user.CVE-2025-42984 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.4
SAP S/4HANA Manage Central Purchase Contract does not perform necessary authorization checks for an authenticated user. Due to this, an attacker could execute the function import on the entity making it inaccessible for unrestricted user. This has low impact on confidentiality and availability of the application.
- Product
- SAP S/4HANA (Manage Central Purchase Contract application)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2025An SQL injection vulnerability has been reported to affect Qsync Central.CVE-2025-29892 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 8.7
An SQL injection vulnerability has been reported to affect Qsync Central. If exploited, the vulnerability could allow remote attackers who have gained user access to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Qsync Central 4.5.0.6 ( 2025/03/20 ) and later
- Product
- Qsync Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2025A use of externally-controlled format string vulnerability has been reported to affect Qsync Central.CVE-2025-22482 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twLow 2.3
A use of externally-controlled format string vulnerability has been reported to affect Qsync Central. If exploited, the vulnerability could allow remote attackers who have gained user access to obtain secret data or modify memory. We have already fixed the vulnerability in the following version: Qsync Central 4.5.0.6 ( 2025/03/20 ) and later
- Product
- Qsync Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2025Failed login response could be different depending on whether the username was local or central.CVE-2025-48015 · Other software · Schweitzer Engineering Laboratories · reported by security@selinc.comLow 3.7
Failed login response could be different depending on whether the username was local or central.
- Product
- SEL-5056 Software-Defined Network Flow Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2025Plugin Central: Cross-Site Request Forgery (CSRF)CVE-2025-46439 · WordPress plugins & themes · reported by PatchstackHigh 7.4
Cross-Site Request Forgery (CSRF) vulnerability in Vladimir Prelovac Plugin Central plugin-central allows Path Traversal.This issue affects Plugin Central: from n/a through <= 2.5.1.
- Product
- Plugin Central
- Affected
- up to 2.5.1
- What to do
- Affects up to 2.5.1. Update Plugin Central to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 9, 2025A Heap-based Buffer Overflow vulnerability in the flexible PIC concentrator (FPC) of Juniper Networks Junos OS on EX2300, EX3400, EX4100, EX4300, EX4300MP, EX44CVE-2025-30644 · Network & remote access · Juniper Networks · reported by sirt@juniper.netHigh 7.7
A Heap-based Buffer Overflow vulnerability in the flexible PIC concentrator (FPC) of Juniper Networks Junos OS on EX2300, EX3400, EX4100, EX4300, EX4300MP, EX4400, EX4600, EX4650-48Y, and QFX5k Series allows an attacker to send a specific DHCP packet to the device, leading to an FPC crash and restart, resulting in a Denial of Service (DoS). Continued receipt and processing of this packet will create a sustained Denial of Service (DoS) condition. Under a rare timing scenario outside the attacker's control, memory corruption may be observed when DHCP Option 82 is enabled, leading to an FPC crash and affecting packet forwarding. Due to the nature of the heap-based overflow, exploitation of this vulnerability could also lead to remote code execution within the FPC, resulting in complete control of the vulnerable component. This issue affects Junos OS on EX2300, EX3400, EX4100, EX4300, EX4300MP, EX4400, EX4600, EX4650-48Y, and QFX5k Series: * All versions before 21.4R3-S9, * from 22.2 before 22.2R3-S5, * from 22.4 before 22.4R3-S5, * from 23.2 before 23.2R2-S3, * from 23.4 before 23.4R2-S3, * from 24.2 before 24.2R2.
- Product
- Junos OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupportportal.juniper.net
Apr 8, 2025Improper input validation in Dynamics Business Central allows an authorized attacker to disclose information locally.CVE-2025-29821 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Improper input validation in Dynamics Business Central allows an authorized attacker to disclose information locally.
- Product
- Microsoft Dynamics 365 Business Central 2023 Wave 2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2025Icinga Reporting is the central component for reporting related functionality in the monitoring web frontend and framework Icinga Web 2.CVE-2025-27406 · Other software · Icinga · reported by GitHubHigh 7.6
Icinga Reporting is the central component for reporting related functionality in the monitoring web frontend and framework Icinga Web 2. A vulnerability present in versions 0.10.0 through 1.0.2 allows to set up a template that allows to embed arbitrary Javascript. This enables the attacker to act on behalf of the user, if the template is being previewed; and act on behalf of the headless browser, if a report using the template is printed to PDF. This issue has been resolved in version 1.0.3 of Icinga Reporting. As a workaround, review all templates and remove suspicious settings.
- Product
- icingaweb2-module-reporting
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025A SQL injection issue has been discovered in eTRAKiT.net release 3.2.1.77.CVE-2025-29980 · Other software · CentralSquare · reported by 9119a7d8-5eab-497f-8521-727c672e3725Critical 9.3
A SQL injection issue has been discovered in eTRAKiT.net release 3.2.1.77. Due to improper input validation, a remote unauthenticated attacker can run arbitrary commands as the current MS SQL server account. It is recommended that the CRM feature is turned off while on eTRAKiT.net release 3.2.1.77. eTRAKiT.Net is no longer supported, and users are recommended to migrate to the latest version of CentralSquare Community Development.
- Product
- eTRAKiT.Net
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comraw.githubusercontent.com
Mar 17, 2025N-central is vulnerable to a path traversal that allows unintended access to the Apache Tomcat WEB-INF directory.CVE-2024-8510 · Other software · N-able · reported by a5532a13-c4dd-4202-bef1-e0b8f2f8d12bMedium 5.3
N-central is vulnerable to a path traversal that allows unintended access to the Apache Tomcat WEB-INF directory. Customer data is not exposed. This vulnerability is present in all deployments of N-central prior to N-central 2024.6.
- Product
- N-central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.n-able.comme.n-able.com
Mar 17, 2025Agate is central authentication server software for OBiBa epidemiology applications.CVE-2025-27102 · Other software · obiba · reported by GitHubMedium 5.4
Agate is central authentication server software for OBiBa epidemiology applications. Prior to version 3.3.0, when registering for an Agate account, arbitrary HTML code can be injected into a user's first and last name. This HTML is then rendered in the email sent to administrative users. The Agate service account sends this email and appears trustworthy, making this a significant risk for phishing attacks. Administrative users are impacted, as they can be targeted by unauthenticated users. Version 3.3.0 fixes the issue.
- Product
- agate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2025Under specific conditions, the Central Management Console of the SAP BusinessObjects Business Intelligence platform allows an attacker with admin rights to geneCVE-2025-0064 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 8.7
Under specific conditions, the Central Management Console of the SAP BusinessObjects Business Intelligence platform allows an attacker with admin rights to generate or retrieve a secret passphrase, enabling them to impersonate any user in the system. This results in a high impact on confidentiality and integrity, with no impact on availability.
- Product
- SAP BusinessObjects Business Intelligence platform (Central Management Console)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2025When BIG-IP Next Central Manager is running, undisclosed requests to the BIG-IP Next Central Manager API can cause the BIG-IP Next Central Manager Node's KubernCVE-2025-24319 · Network & remote access · F5 · reported by f5sirt@f5.comHigh 7.1
When BIG-IP Next Central Manager is running, undisclosed requests to the BIG-IP Next Central Manager API can cause the BIG-IP Next Central Manager Node's Kubernetes service to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- Product
- BIG-IP Next Central Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2025When users log in through the webUI or API using local authentication, BIG-IP Next Central Manager may log sensitive information in the pgaudit log files.CVE-2025-23413 · Network & remote access · F5 · reported by f5sirt@f5.comMedium 6.7
When users log in through the webUI or API using local authentication, BIG-IP Next Central Manager may log sensitive information in the pgaudit log files. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- Product
- BIG-IP Next Central Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2025ManageEngine Endpoint Central versions before 11.3.2440.09 are vulnerable to IDOR vulnerability which allows the attacker to change the username in the chat.CVE-2024-9097 · Other software · ManageEngine · reported by 0fc0942c-577d-436f-ae8e-945763c79b02Low 3.5
ManageEngine Endpoint Central versions before 11.3.2440.09 are vulnerable to IDOR vulnerability which allows the attacker to change the username in the chat.
- Product
- Endpoint Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V05.30).CVE-2024-53832 · Other software · Siemens · reported by productcert@siemens.comMedium 5.1
A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V05.30). The affected devices contain a secure element which is connected via an unencrypted SPI bus. This could allow an attacker with physical access to the SPI bus to observe the password used for the secure element authentication, and then use the secure element as an oracle to decrypt all encrypted update files.
- Product
- CPCI85 Central Processing/Communication
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comseclists.org
Dec 6, 2024A link following vulnerability has been reported to affect Qsync Central.CVE-2024-50404 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 6.8
A link following vulnerability has been reported to affect Qsync Central. If exploited, the vulnerability could allow remote attackers who have gained user access to traverse the file system to unintended locations. We have already fixed the vulnerability in the following versions: Qsync Central 4.4.0.16_20240819 ( 2024/08/19 ) and later
- Product
- Qsync Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2024RingCentral Communications: Cross-Site Request Forgery (CSRF)CVE-2024-53770 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in pbmacintyre RingCentral Communications rccp-free allows Stored XSS.This issue affects RingCentral Communications: from n/a through <= 1.7.0.
- Product
- RingCentral Communications
- Affected
- up to 1.7.0
- What to do
- Affects up to 1.7.0. Update RingCentral Communications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 27, 2024An authenticated attacker with low privileges may use a SQL Injection vulnerability in the affected products administration panel to gain read and write access CVE-2024-11025 · Other software · SMA · reported by info@cert.vde.comMedium 5.4
An authenticated attacker with low privileges may use a SQL Injection vulnerability in the affected products administration panel to gain read and write access to a specific log file of the device.
- Product
- Sunny Central SC 1760-US
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2024By default, dedicated folders of ZONECENTRAL for Windows up to 2024.3 or up to Q.2021.2 (ANSSI qualification submission) can be accessed by other users to misusCVE-2024-46466 · Other software · reported by MITREHigh 7.8
By default, dedicated folders of ZONECENTRAL for Windows up to 2024.3 or up to Q.2021.2 (ANSSI qualification submission) can be accessed by other users to misuse technical files and make them perform tasks with higher privileges. Configuration of ZONECENTRAL has to be modified to prevent this vulnerability.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2024Zohocorp ManageEngine EndPoint Central versions 11.3.2416.21 and below, 11.3.2428.9 and below are vulnerable to Arbitrary File Deletion in the agent installed mCVE-2024-10203 · Other software · ManageEngine · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 7
Zohocorp ManageEngine EndPoint Central versions 11.3.2416.21 and below, 11.3.2428.9 and below are vulnerable to Arbitrary File Deletion in the agent installed machines.
- Product
- EndPoint Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2024There is a SQL injection vulnerability in some HikCentral Professional versions.CVE-2024-47487 · Network & remote access · Hikvision · reported by hsrc@hikvision.comHigh 7.2
There is a SQL injection vulnerability in some HikCentral Professional versions. This could allow an authenticated user to execute arbitrary SQL queries.
- Product
- HikCentral Professional
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2024There is an XSS vulnerability in some HikCentral Master Lite versions.CVE-2024-47486 · Network & remote access · Hikvision · reported by hsrc@hikvision.comLow 2.1
There is an XSS vulnerability in some HikCentral Master Lite versions. If exploited, an attacker could inject scripts into certain pages by building malicious data.
- Product
- HikCentral Master Lite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2024There is a CSV injection vulnerability in some HikCentral Master Lite versions.CVE-2024-47485 · Network & remote access · Hikvision · reported by hsrc@hikvision.comMedium 5.5
There is a CSV injection vulnerability in some HikCentral Master Lite versions. If exploited, an attacker could build malicious data to generate executable commands in the CSV file.
- Product
- HikCentral Master Lite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2024A vulnerability in the backup feature of Cisco UCS Central Software could allow an attacker with access to a backup file to learn sensitive information that is CVE-2024-20280 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.3
A vulnerability in the backup feature of Cisco UCS Central Software could allow an attacker with access to a backup file to learn sensitive information that is stored in the full state and configuration backup files. This vulnerability is due to a weakness in the encryption method that is used for the backup function. An attacker could exploit this vulnerability by accessing a backup file and leveraging a static key that is used for the backup configuration feature. A successful exploit could allow an attacker with access to a backup file to learn sensitive information that is stored in full state backup files and configuration backup files, such as local user credentials, authentication server passwords, Simple Network Management Protocol (SNMP) community names, and the device SSL server certificate and key.
- Product
- Cisco Unified Computing System Central Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Oct 11, 2024A denial of service may be caused to a single peripheral device in a BLE network when multiple central devices continuously connect and disconnect to the peripCVE-2024-6657 · Other software · silabs.com · reported by product-security@silabs.comMedium 6.5
A denial of service may be caused to a single peripheral device in a BLE network when multiple central devices continuously connect and disconnect to the peripheral. A hard reset is required to recover the peripheral device.
- Product
- EFR32 BLE SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2024Meshtastic is an open source, off-grid, decentralized, mesh network built to run on affordable, low-power devices.CVE-2024-47079 · Other software · meshtastic · reported by GitHubMedium 6.4
Meshtastic is an open source, off-grid, decentralized, mesh network built to run on affordable, low-power devices. Meshtastic firmware is an open source firmware implementation for the broader project. The remote hardware module of the firmware does not have proper checks to ensure a remote hardware control message was received should be considered valid. This issue has been addressed in release version 2.5.1. All users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2024A local privilege escalation vulnerability in Sophos Intercept X for Windows with Central Device Encryption 2024.2.0 and older allows writing of arbitrary filesCVE-2024-8885 · Network & remote access · Sophos · reported by security-alert@sophos.comHigh 8.8
A local privilege escalation vulnerability in Sophos Intercept X for Windows with Central Device Encryption 2024.2.0 and older allows writing of arbitrary files.
- Product
- Sophos Intercept X
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2024A vulnerability in the Central Web Authentication (CWA) feature of Cisco IOS XE Software for Wireless Controllers could allow an unauthenticated, adjacent attacCVE-2024-20510 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4.7
A vulnerability in the Central Web Authentication (CWA) feature of Cisco IOS XE Software for Wireless Controllers could allow an unauthenticated, adjacent attacker to bypass the pre-authentication access control list (ACL), which could allow access to network resources before user authentication. This vulnerability is due to a logic error when activating the pre-authentication ACL that is received from the authentication, authorization, and accounting (AAA) server. An attacker could exploit this vulnerability by connecting to a wireless network that is configured for CWA and sending traffic through an affected device that should be denied by the configured ACL before user authentication. A successful exploit could allow the attacker to bypass configured ACL protections on the affected device before the user authentication is completed, allowing the attacker to access trusted networks that the device might be protecting.
- Product
- Cisco IOS XE Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Sep 25, 2024Meshtastic is an open source, off-grid, decentralized, mesh network.CVE-2024-47078 · Other software · meshtastic · reported by GitHubHigh 8.1
Meshtastic is an open source, off-grid, decentralized, mesh network. Meshtastic uses MQTT to communicate over an internet connection to a shared or private MQTT Server. Nodes can communicate directly via an internet connection or proxied through a connected phone (i.e., via bluetooth). Prior to version 2.5.1, multiple weaknesses in the MQTT implementation allow for authentication and authorization bypasses resulting in unauthorized control of MQTT-connected nodes. Version 2.5.1 contains a patch.
- Product
- firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2024Improper authorization in Dynamics 365 Business Central resulted in a vulnerability that allows an authenticated attacker to elevate privileges over a network.CVE-2024-43460 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.1
Improper authorization in Dynamics 365 Business Central resulted in a vulnerability that allows an authenticated attacker to elevate privileges over a network.
- Product
- Dynamics 365 Business Central Online
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024Microsoft Dynamics 365 Business Central Elevation of Privilege VulnerabilityCVE-2024-38225 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability
- Product
- Microsoft Dynamics 365 Business Central 2023 Release Wave 1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2024Cairo-Contracts are OpenZeppelin Contracts written in Cairo for Starknet, a decentralized ZK Rollup.CVE-2024-45304 · Other software · OpenZeppelin · reported by GitHubMedium 5.3
Cairo-Contracts are OpenZeppelin Contracts written in Cairo for Starknet, a decentralized ZK Rollup. This vulnerability can lead to unauthorized ownership transfer, contrary to the original owner's intention of leaving the contract without an owner. It introduces a security risk where an unintended party (pending owner) can gain control of the contract after the original owner has renounced ownership. This could also be used by a malicious owner to simulate leaving a contract without an owner, to later regain ownership by previously having proposed himself as a pending owner. This issue has been addressed in release version 0.16.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- cairo-contracts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2024Zohocorp ManageEngine Endpoint Central affected by Incorrect authorization vulnerability while isolating the devices.This issue affects Endpoint Central: beforeCVE-2024-38868 · Other software · ManageEngine · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 7.6
Zohocorp ManageEngine Endpoint Central affected by Incorrect authorization vulnerability while isolating the devices.This issue affects Endpoint Central: before 11.3.2406.08 and before 11.3.2400.15
- Product
- Endpoint Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2024Meshtastic device firmware is a firmware for meshtastic devices to run an open source, off-grid, decentralized, mesh network built to run on affordable, low-powCVE-2024-45038 · Other software · meshtastic · reported by GitHubHigh 7.5
Meshtastic device firmware is a firmware for meshtastic devices to run an open source, off-grid, decentralized, mesh network built to run on affordable, low-power devices. Meshtastic device firmware is subject to a denial of serivce vulnerability in MQTT handling, fixed in version 2.4.1 of the Meshtastic firmware and on the Meshtastic public MQTT Broker. It's strongly suggested that all users of Meshtastic, particularly those that connect to a privately hosted MQTT server, update to this or a more recent stable version right away. There are no known workarounds for this vulnerability.
- Product
- firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2024A traversal vulnerability in GeneralDocs.aspx in CentralSquare CryWolf (False Alarm Management) through 2024-08-09 allows unauthenticated attackers to read fileCVE-2024-45241 · Other software · centralsquare · reported by MITREHigh 7.5
A traversal vulnerability in GeneralDocs.aspx in CentralSquare CryWolf (False Alarm Management) through 2024-08-09 allows unauthenticated attackers to read files outside of the working web directory via the rpt parameter, leading to the disclosure of sensitive information.
- Product
- crywolf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 23, 2024Zohocorp ManageEngine Endpoint Central affected by Incorrect authorization vulnerability in remote office deploy configurations.This issue affects Endpoint CentCVE-2024-38869 · Other software · ManageEngine · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 8.3
Zohocorp ManageEngine Endpoint Central affected by Incorrect authorization vulnerability in remote office deploy configurations.This issue affects Endpoint Central: before 11.3.2416.04 and before 11.3.2400.25.
- Product
- Endpoint Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2024Improper access control in Decentralized Identity Services resulted in a vulnerability that allows an unauthenticated attacker to disable Verifiable ID's on anoCVE-2024-43477 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Improper access control in Decentralized Identity Services resulted in a vulnerability that allows an unauthenticated attacker to disable Verifiable ID's on another tenant.
- Product
- Microsoft Entra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.