Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
814 results · page 6 of 17
Jun 26, 2024ZenUML is JavaScript-based diagramming tool that requires no server, using Markdown-inspired text definitions and a renderer to create and modify sequence diagrCVE-2024-38527 · Other software · mermaid-js · reported by GitHubMedium 5.4
ZenUML is JavaScript-based diagramming tool that requires no server, using Markdown-inspired text definitions and a renderer to create and modify sequence diagrams. Markdown-based comments in the ZenUML diagram syntax are susceptible to Cross-site Scripting (XSS). The comment feature allows the user to attach small notes for reference. This feature allows the user to enter in their comment in markdown comment, allowing them to use common markdown features, such as `**` for bolded text. However, the markdown text is currently not sanitized before rendering, allowing an attacker to enter a malicious payload for the comment which leads to XSS. This puts existing applications that use ZenUML unsandboxed at risk of arbitrary JavaScript execution when rendering user-controlled diagrams. This vulnerability was patched in version 3.23.25,
- Product
- zenuml-core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 18, 2024A potential weakness in AMD SPI protection features may allow a malicious attacker with Ring0 (kernel mode) access to bypass the native System Management Mode (CVE-2022-23829 · Other software · AMD · reported by psirt@amd.comHigh 8.2
A potential weakness in AMD SPI protection features may allow a malicious attacker with Ring0 (kernel mode) access to bypass the native System Management Mode (SMM) ROM protections.
- Product
- AMD Ryzen™ Threadripper™ PRO Processors 5900 WX-Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2024puppeteer-renderer v.3.2.0 and before is vulnerable to Directory Traversal.CVE-2024-36527 · Other software · zenato · reported by MITREMedium 6.5
puppeteer-renderer v.3.2.0 and before is vulnerable to Directory Traversal. Attackers can exploit the URL parameter using the file protocol to read sensitive information from the server.
- Product
- puppeteer_renderer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jun 16, 2024Shenzhen Guoxin Synthesis image system before 8.3.0 allows unauthorized user information retrieval via the queryUser API.CVE-2024-38467 · Other software · shenzen · reported by MITREHigh 7.5
Shenzhen Guoxin Synthesis image system before 8.3.0 allows unauthorized user information retrieval via the queryUser API.
- Product
- guoxin_synthesis_image_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2024Certain ASUS router models have authentication bypass vulnerability, allowing unauthenticated remote attackers to log in the device.CVE-2024-3080 · Network & remote access · ASUS · reported by twcert@cert.org.twCritical 9.8
Certain ASUS router models have authentication bypass vulnerability, allowing unauthenticated remote attackers to log in the device.
- Product
- ZenWiFi XT8
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Jun 13, 2024Certain models of ASUS routers have buffer overflow vulnerabilities, allowing remote attackers with administrative privileges to execute arbitrary commands on tCVE-2024-3079 · Network & remote access · ASUS · reported by twcert@cert.org.twHigh 7.2
Certain models of ASUS routers have buffer overflow vulnerabilities, allowing remote attackers with administrative privileges to execute arbitrary commands on the device.
- Product
- ZenWiFi XT8
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Jun 8, 2024A vulnerability in zenml-io/zenml version 0.56.3 allows attackers to reuse old session credentials or session IDs due to insufficient session expiration.CVE-2024-4680 · Other software · zenml-io · reported by security@huntr.devHigh 8.8
A vulnerability in zenml-io/zenml version 0.56.3 allows attackers to reuse old session credentials or session IDs due to insufficient session expiration. Specifically, the session does not expire after a password change, enabling an attacker to maintain access to a compromised account without the victim's ability to revoke this access. This issue was observed in a self-hosted ZenML deployment via Docker, where after changing the password from one browser, the session remained active and usable in another browser without requiring re-authentication.
- Product
- zenml-io/zenml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2024A clickjacking vulnerability exists in zenml-io/zenml versions up to and including 0.55.5 due to the application's failure to set appropriate X-Frame-Options orCVE-2024-2383 · Other software · zenml-io · reported by security@huntr.devMedium 6.1
A clickjacking vulnerability exists in zenml-io/zenml versions up to and including 0.55.5 due to the application's failure to set appropriate X-Frame-Options or Content-Security-Policy HTTP headers. This vulnerability allows an attacker to embed the application UI within an iframe on a malicious page, potentially leading to unauthorized actions by tricking users into interacting with the interface under the attacker's control. The issue was addressed in version 0.56.3.
- Product
- zenml-io/zenml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2024An issue was discovered in zenml-io/zenml versions up to and including 0.55.4.CVE-2024-2213 · Other software · zenml-io · reported by security@huntr.devLow 3.3
An issue was discovered in zenml-io/zenml versions up to and including 0.55.4. Due to improper authentication mechanisms, an attacker with access to an active user session can change the account password without needing to know the current password. This vulnerability allows for unauthorized account takeover by bypassing the standard password change verification process. The issue was fixed in version 0.56.3.
- Product
- zenml-io/zenml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2024A stored Cross-Site Scripting (XSS) vulnerability was identified in the zenml-io/zenml repository, specifically within the 'logo_url' field.CVE-2024-2171 · Other software · zenml-io · reported by security@huntr.devMedium 4.8
A stored Cross-Site Scripting (XSS) vulnerability was identified in the zenml-io/zenml repository, specifically within the 'logo_url' field. By injecting malicious payloads into this field, an attacker could send harmful messages to other users, potentially compromising their accounts. The vulnerability affects version 0.55.3 and was fixed in version 0.56.2. The impact of exploiting this vulnerability could lead to user account compromise.
- Product
- zenml-io/zenml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2024An improper authorization vulnerability exists in the zenml-io/zenml repository, specifically within the API PUT /api/v1/users/id endpoint.CVE-2024-2035 · Other software · zenml-io · reported by security@huntr.devMedium 6.5
An improper authorization vulnerability exists in the zenml-io/zenml repository, specifically within the API PUT /api/v1/users/id endpoint. This vulnerability allows any authenticated user to modify the information of other users, including changing the `active` status of user accounts to false, effectively deactivating them. This issue affects version 0.55.3 and was fixed in version 0.56.2. The impact of this vulnerability is significant as it allows for the deactivation of admin accounts, potentially disrupting the functionality and security of the application.
- Product
- zenml-io/zenml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2024A race condition vulnerability exists in zenml-io/zenml versions up to and including 0.55.3, which allows for the creation of multiple users with the same usernCVE-2024-2032 · Other software · zenml-io · reported by security@huntr.devLow 3.1
A race condition vulnerability exists in zenml-io/zenml versions up to and including 0.55.3, which allows for the creation of multiple users with the same username when requests are sent in parallel. This issue was fixed in version 0.55.5. The vulnerability arises due to insufficient handling of concurrent user creation requests, leading to data inconsistencies and potential authentication problems. Specifically, concurrent processes may overwrite or corrupt user data, complicating user identification and posing security risks. This issue is particularly concerning for APIs that rely on usernames as input parameters, such as PUT /api/v1/users/test_race, where it could lead to further complications.
- Product
- zenml-io/zenml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 3, 2024Citizen is a MediaWiki skin that makes extensions part of the cohesive experience.CVE-2024-36123 · Other software · StarCitizenTools · reported by GitHubMedium 6.5
Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. The page `MediaWiki:Tagline` has its contents used unescaped, so custom HTML (including Javascript) can be injected by someone with the ability to edit the MediaWiki namespace (typically those with the `editinterface` permission, or sysops). This vulnerability is fixed in 2.16.0.
- Product
- mediawiki-skins-Citizen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2024In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries/iommu: LPAR panics during boot up with a frozen PE At the time of LPAR booCVE-2024-36926 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries/iommu: LPAR panics during boot up with a frozen PE At the time of LPAR boot up, partition firmware provides Open Firmware property ibm,dma-window for the PE. This property is provided on the PCI bus the PE is attached to. There are execptions where the partition firmware might not provide this property for the PE at the time of LPAR boot up. One of the scenario is where the firmware has frozen the PE due to some error condition. This PE is frozen for 24 hours or unless the whole system is reinitialized. Within this time frame, if the LPAR is booted, the frozen PE will be presented to the LPAR but ibm,dma-window property could be missing. Today, under these circumstances, the LPAR oopses with NULL pointer dereference, when configuring the PCI bus the PE is attached to. BUG: Kernel NULL pointer dereference on read at 0x000000c8 Faulting instruction address: 0xc0000000001024c0 Oops: Kernel access of bad area, sig: 7 [#1] LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA pSeries Modules linked in: Supported: Yes CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.4.0-150600.9-default #1 Har
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
May 21, 2024In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: handle the case of pci_channel_io_frozen only in amdgpu_pci_resume In current CVE-2021-47421 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: handle the case of pci_channel_io_frozen only in amdgpu_pci_resume In current code, when a PCI error state pci_channel_io_normal is detectd, it will report PCI_ERS_RESULT_CAN_RECOVER status to PCI driver, and PCI driver will continue the execution of PCI resume callback report_resume by pci_walk_bridge, and the callback will go into amdgpu_pci_resume finally, where write lock is releasd unconditionally without acquiring such lock first. In this case, a deadlock will happen when other threads start to acquire the read lock. To fix this, add a member in amdgpu_device strucutre to cache pci_channel_state, and only continue the execution in amdgpu_pci_resume when it's pci_channel_io_frozen.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
May 17, 2024In the Linux kernel, the following vulnerability has been resolved: dm-raid: really frozen sync_thread during suspend 1) commit f52f5c71f3d4 ("md: fix stoppinCVE-2024-35794 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: dm-raid: really frozen sync_thread during suspend 1) commit f52f5c71f3d4 ("md: fix stopping sync thread") remove MD_RECOVERY_FROZEN from __md_stop_writes() and doesn't realize that dm-raid relies on __md_stop_writes() to frozen sync_thread indirectly. Fix this problem by adding MD_RECOVERY_FROZEN in md_stop_writes(), and since stop_sync_thread() is only used for dm-raid in this case, also move stop_sync_thread() to md_stop_writes(). 2) The flag MD_RECOVERY_FROZEN doesn't mean that sync thread is frozen, it only prevent new sync_thread to start, and it can't stop the running sync thread; In order to frozen sync_thread, after seting the flag, stop_sync_thread() should be used. 3) The flag MD_RECOVERY_FROZEN doesn't mean that writes are stopped, use it as condition for md_stop_writes() in raid_postsuspend() doesn't look correct. Consider that reentrant stop_sync_thread() do nothing, always call md_stop_writes() in raid_postsuspend(). 4) raid_message can set/clear the flag MD_RECOVERY_FROZEN at anytime, and if MD_RECOVERY_FROZEN is cleared while the array is suspended, new sy
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
May 8, 2024SSL Zen: Does not properly prevent directory listing of the private keys folderCVE-2024-1076 · WordPress plugins & themes · reported by WPScanMedium 6.5
The SSL Zen WordPress plugin before 4.6.0 does not properly prevent directory listing of the private keys folder, as it only relies on the use of .htaccess to prevent visitors from accessing the site's generated private keys, which allows an attacker to read them if the site runs on a server who doesn't support .htaccess files, like NGINX.
- Product
- SSL Zen
- Fixed in
- 4.6.0
- What to do
- Update SSL Zen to 4.6.0 or newer.
May 7, 2024RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the file_id parameter at /CorporateCulture/kaizen_download.aspx.CVE-2024-25513 · Other software · guangzhou_luhua_information_technology · reported by MITREHigh 7.8
RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the file_id parameter at /CorporateCulture/kaizen_download.aspx.
- Product
- ruvaroa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
May 4, 2024Zenario before 9.5.60437 uses Twig filters insecurely in the Twig Snippet plugin, and in the site-wide HEAD and BODY elements, enabling code execution by a desiCVE-2024-34461 · Other software · tribalsystems · reported by MITRECritical 9.8
Zenario before 9.5.60437 uses Twig filters insecurely in the Twig Snippet plugin, and in the site-wide HEAD and BODY elements, enabling code execution by a designer or an administrator.
- Product
- zenario
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2024The Tree Explorer tool from Organizer in Zenario before 9.5.60602 is affected by XSS.CVE-2024-34460 · Other software · reported by MITREMedium 6.5
The Tree Explorer tool from Organizer in Zenario before 9.5.60602 is affected by XSS. (This component was removed in 9.5.60602.)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2024A session fixation vulnerability exists in the zenml-io/zenml application, where JWT tokens used for user authentication are not invalidated upon logout.CVE-2024-2260 · Other software · zenml-io · reported by security@huntr.devMedium 4.2
A session fixation vulnerability exists in the zenml-io/zenml application, where JWT tokens used for user authentication are not invalidated upon logout. This flaw allows an attacker to bypass authentication mechanisms by reusing a victim's JWT token.
- Product
- zenml-io/zenml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2024A directory traversal vulnerability exists in the zenml-io/zenml repository, specifically within the /api/v1/steps endpoint.CVE-2024-2083 · Other software · zenml-io · reported by security@huntr.devCritical 9.9
A directory traversal vulnerability exists in the zenml-io/zenml repository, specifically within the /api/v1/steps endpoint. Attackers can exploit this vulnerability by manipulating the 'logs' URI path in the request to fetch arbitrary file content, bypassing intended access restrictions. The vulnerability arises due to the lack of validation for directory traversal patterns, allowing attackers to access files outside of the restricted directory.
- Product
- zenml-io/zenml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2024Incorrect Authorization vulnerability in OpenText™ ZENworks Configuration Management (ZCM) allows Unauthorized Use of Device Resources.This issue affects ZENworCVE-2023-6400 · Other software · OpenText™ · reported by security@opentext.comHigh 7.4
Incorrect Authorization vulnerability in OpenText™ ZENworks Configuration Management (ZCM) allows Unauthorized Use of Device Resources.This issue affects ZENworks Configuration Management (ZCM) versions: 2020 update 3, 23.3, and 23.4.
- Product
- ZENworks Configuration Management (ZCM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.microfocus.comportal.microfocus.com
Mar 15, 2024A vulnerability classified as critical was found in MHA Sistemas arMHAzena 9.6.0.0.CVE-2024-2480 · Other software · MHA Sistemas · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in MHA Sistemas arMHAzena 9.6.0.0. This vulnerability affects unknown code of the component Executa Page. The manipulation of the argument Companhia/Planta/Agente de/Agente até leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-256888. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- arMHAzena
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjohnermac.github.iovuldb.com
Mar 15, 2024A vulnerability classified as problematic has been found in MHA Sistemas arMHAzena 9.6.0.0.CVE-2024-2479 · Other software · MHA Sistemas · reported by VulDBLow 3.5
A vulnerability classified as problematic has been found in MHA Sistemas arMHAzena 9.6.0.0. This affects an unknown part of the component Cadastro Page. The manipulation of the argument Query leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-256887. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- arMHAzena
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjohnermac.github.iovuldb.com
Mar 14, 2024zenml v0.55.4 was discovered to contain an arbitrary file upload vulnerability in the load function at /materializers/cloudpickle_materializer.py.CVE-2024-28424 · Other software · zenml · reported by MITREHigh 8.8
zenml v0.55.4 was discovered to contain an arbitrary file upload vulnerability in the load function at /materializers/cloudpickle_materializer.py. This vulnerability allows attackers to execute arbitrary code via uploading a crafted file.
- Product
- zenml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2024In the Linux kernel, the following vulnerability has been resolved: arm64: entry: always set GIC_PRIO_PSR_I_SET during entry Zenghui reports that booting a keCVE-2021-46997 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: arm64: entry: always set GIC_PRIO_PSR_I_SET during entry Zenghui reports that booting a kernel with "irqchip.gicv3_pseudo_nmi=1" on the command line hits a warning during kernel entry, due to the way we manipulate the PMR. Early in the entry sequence, we call lockdep_hardirqs_off() to inform lockdep that interrupts have been masked (as the HW sets DAIF wqhen entering an exception). Architecturally PMR_EL1 is not affected by exception entry, and we don't set GIC_PRIO_PSR_I_SET in the PMR early in the exception entry sequence, so early in exception entry the PMR can indicate that interrupts are unmasked even though they are masked by DAIF. If DEBUG_LOCKDEP is selected, lockdep_hardirqs_off() will check that interrupts are masked, before we set GIC_PRIO_PSR_I_SET in any of the exception entry paths, and hence lockdep_hardirqs_off() will WARN() that something is amiss. We can avoid this by consistently setting GIC_PRIO_PSR_I_SET during exception entry so that kernel code sees a consistent environment. We must also update local_daif_inherit() to undo this, as currently only touches DAIF. For other paths, local_daif
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Feb 27, 2024ZenML Server in the ZenML machine learning package before 0.46.7 for Python allows remote privilege escalation because the /api/v1/users/{user_name_or_id}/activCVE-2024-25723 · Other software · zenmlio · reported by MITREHigh 8.8
ZenML Server in the ZenML machine learning package before 0.46.7 for Python allows remote privilege escalation because the /api/v1/users/{user_name_or_id}/activate REST API endpoint allows access on the basis of a valid username along with a new password in the request body. These are also patched versions: 0.44.4, 0.43.1, and 0.42.2.
- Product
- zenml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2024Improper Access Control in the AMD SPI protection feature may allow a user with Ring0 (kernel mode) privileged access to bypass protections potentially resultinCVE-2023-20579 · Other software · AMD · reported by psirt@amd.comMedium 6
Improper Access Control in the AMD SPI protection feature may allow a user with Ring0 (kernel mode) privileged access to bypass protections potentially resulting in loss of integrity and availability.
- Product
- AMD Ryzen™ 5000 Series Desktop Processor with Radeon™ Graphics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2024Insufficient checking of memory buffer in ASP Secure OS may allow an attacker with a malicious TA to read/write to the ASP Secure OS kernel virtual address spacCVE-2021-46757 · Other software · AMD · reported by psirt@amd.comHigh 7.8
Insufficient checking of memory buffer in ASP Secure OS may allow an attacker with a malicious TA to read/write to the ASP Secure OS kernel virtual address space potentially leading to privilege escalation.
- Product
- AMD Ryzen™ Embedded 5000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2024Zentao v18.0 to v18.10 was discovered to contain a remote code execution (RCE) vulnerability via the checkConnection method of /app/zentao/module/repo/model.phpCVE-2024-24216 · Other software · Easycorp · reported by MITRECritical 9.8
Zentao v18.0 to v18.10 was discovered to contain a remote code execution (RCE) vulnerability via the checkConnection method of /app/zentao/module/repo/model.php.
- Product
- Zentao
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2024An arbitrary file upload vulnerability in /upgrade/control.php of ZenTao Community Edition v18.10, ZenTao Biz v8.10, and ZenTao Max v4.10 allows attackers to exCVE-2024-24202 · Other software · easycorp · reported by MITRECritical 9.8
An arbitrary file upload vulnerability in /upgrade/control.php of ZenTao Community Edition v18.10, ZenTao Biz v8.10, and ZenTao Max v4.10 allows attackers to execute arbitrary code via uploading a crafted .txt file.
- Product
- zentao_max
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordclammy-blizzard-8ef.notion.siteclammy-blizzard-8ef.notion.site
Feb 7, 2024An issue in Shenzen Tenda Technology CP3V2.0 V11.10.00.2311090948 allows a local attacker to obtain sensitive information via the password component.CVE-2024-24488 · Network & remote access · Tendacn · reported by MITREMedium 5.5
An issue in Shenzen Tenda Technology CP3V2.0 V11.10.00.2311090948 allows a local attacker to obtain sensitive information via the password component.
- Product
- Cp3 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2024Zentao versions 4.1.3 and before has a URL redirect vulnerability, which prevents the system from functioning properly.CVE-2023-49394 · Other software · Easycorp · reported by MITREMedium 6.1
Zentao versions 4.1.3 and before has a URL redirect vulnerability, which prevents the system from functioning properly.
- Product
- Zentao
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comnarrow-payment-2cd.notion.site
Dec 20, 2023Zendrop – Global Dropshipping: Unrestricted Upload of File with Dangerous TypeCVE-2023-25970 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unrestricted Upload of File with Dangerous Type vulnerability in Zendrop Zendrop – Global Dropshipping.This issue affects Zendrop – Global Dropshipping: from n/a through 1.0.0.
- Product
- Zendrop – Global Dropshipping
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Zendrop – Global Dropshipping to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 30, 2023A vulnerability classified as problematic was found in ZenTao PMS 18.8.CVE-2023-6439 · Other software · Easycorp · reported by VulDBLow 3.5
A vulnerability classified as problematic was found in ZenTao PMS 18.8. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-246439.
- Product
- Zentao
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2023Insecure permissions in the setNFZEnable function of Autel Robotics EVO Nano drone v1.6.5 allows attackers to breach the geo-fence and fly into no-fly zones.CVE-2023-47335 · Other software · Autelrobotics · reported by MITREMedium 6.5
Insecure permissions in the setNFZEnable function of Autel Robotics EVO Nano drone v1.6.5 allows attackers to breach the geo-fence and fly into no-fly zones.
- Product
- EVO Nano Drone Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2023Improper input validation in the SMM Supervisor may allow an attacker with a compromised SMI handler to gain Ring0 access potentially leading to arbitrary code CVE-2023-20596 · Other software · AMD · reported by psirt@amd.comCritical 9.8
Improper input validation in the SMM Supervisor may allow an attacker with a compromised SMI handler to gain Ring0 access potentially leading to arbitrary code execution.
- Product
- Ryzen™ 5000 Series Desktop Processor with Radeon™ Graphics Formerly codenamed “Cezanne” AM4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2023A race condition in System Management Mode (SMM) code may allow an attacker using a compromised user space to leverage CVE-2018-8897 potentially resulting in prCVE-2023-20571 · Other software · AMD · reported by psirt@amd.comHigh 8.1
A race condition in System Management Mode (SMM) code may allow an attacker using a compromised user space to leverage CVE-2018-8897 potentially resulting in privilege escalation.
- Product
- Ryzen™ 5000 Series Desktop Processor with Radeon™ Graphics “Cezanne”
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2023Insufficient protections in System Management Mode (SMM) code may allow an attacker to potentially enable escalation of privilege via local access.CVE-2023-20565 · Other software · AMD · reported by psirt@amd.comHigh 7.8
Insufficient protections in System Management Mode (SMM) code may allow an attacker to potentially enable escalation of privilege via local access.
- Product
- Ryzen™ 5000 Series Desktop Processor with Radeon™ Graphics “Cezanne”
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2023Insufficient protections in System Management Mode (SMM) code may allow an attacker to potentially enable escalation of privilege via local access.CVE-2023-20563 · Other software · AMD · reported by psirt@amd.comHigh 7.8
Insufficient protections in System Management Mode (SMM) code may allow an attacker to potentially enable escalation of privilege via local access.
- Product
- Ryzen™ 5000 Series Desktop Processor with Radeon™ Graphics “Cezanne”
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2023Insufficient DRAM address validation in System Management Unit (SMU) may allow an attacker to read/write from/to an invalid DRAM address, potentially resulting CVE-2023-20533 · Other software · AMD · reported by psirt@amd.comMedium 6.1
Insufficient DRAM address validation in System Management Unit (SMU) may allow an attacker to read/write from/to an invalid DRAM address, potentially resulting in denial-of-service.
- Product
- Ryzen™ 3000 series Desktop Processors “Matisse"
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2023Insufficient input validation in the ASP Bootloader may enable a privileged attacker with physical access to expose the contents of ASP memory potentially leadiCVE-2023-20526 · Other software · AMD · reported by psirt@amd.comLow 1.9
Insufficient input validation in the ASP Bootloader may enable a privileged attacker with physical access to expose the contents of ASP memory potentially leading to a loss of confidentiality.
- Product
- AMD Ryzen™ Threadripper™ 2000 Series Processors “Colfax”
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2023Improper access control in System Management Mode (SMM) may allow an attacker to write to SPI ROM potentially leading to arbitrary code execution.CVE-2022-23821 · Other software · AMD · reported by psirt@amd.comCritical 9.8
Improper access control in System Management Mode (SMM) may allow an attacker to write to SPI ROM potentially leading to arbitrary code execution.
- Product
- Ryzen™ 3000 Series Desktop Processors “Matisse”
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2023Failure to validate the AMD SMM communication buffer may allow an attacker to corrupt the SMRAM potentially leading to arbitrary code execution.CVE-2022-23820 · Other software · AMD · reported by psirt@amd.comHigh 7.5
Failure to validate the AMD SMM communication buffer may allow an attacker to corrupt the SMRAM potentially leading to arbitrary code execution.
- Product
- Ryzen™ 3000 series Desktop Processors “Matisse"
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2023Insufficient DRAM address validation in System Management Unit (SMU) may allow an attacker to read/write from/to an invalid DRAM address, potentially resulting CVE-2021-46774 · Other software · AMD · reported by psirt@amd.comMedium 6.7
Insufficient DRAM address validation in System Management Unit (SMU) may allow an attacker to read/write from/to an invalid DRAM address, potentially resulting in denial-of-service.
- Product
- Ryzen™ 3000 series Desktop Processors “Matisse"
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2023Improper clearing of sensitive data in the ASP Bootloader may expose secret keys to a privileged attacker accessing ASP SRAM, potentially leading to a loss of cCVE-2021-46766 · Other software · AMD · reported by psirt@amd.comLow 2.5
Improper clearing of sensitive data in the ASP Bootloader may expose secret keys to a privileged attacker accessing ASP SRAM, potentially leading to a loss of confidentiality.
- Product
- Ryzen™ Threadripper™ PRO 3000WX Series Processors “Chagall” WS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2023Insufficient validation of SPI flash addresses in the ASP (AMD Secure Processor) bootloader may allow an attacker to read data in memory mapped beyond SPI flashCVE-2021-46758 · Other software · AMD · reported by psirt@amd.comMedium 6.1
Insufficient validation of SPI flash addresses in the ASP (AMD Secure Processor) bootloader may allow an attacker to read data in memory mapped beyond SPI flash resulting in a potential loss of availability and integrity.
- Product
- Ryzen™ 5000 Series Desktop Processor with Radeon™ Graphics “Cezanne”
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2023Zendrop – Global Dropshipping: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-25960 · WordPress plugins & themes · reported by PatchstackCritical 10
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Zendrop Zendrop – Global Dropshipping zendrop-dropshipping-and-fulfillment allows SQL Injection.This issue affects Zendrop – Global Dropshipping: from n/a through 1.0.0.
- Product
- Zendrop – Global Dropshipping
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Zendrop – Global Dropshipping to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 2, 2023A Stored Cross-Site Scripting vulnerability was discovered in ZenTao 18.3 where a user can create a project, and in the name field of the project, they can injeCVE-2023-46475 · Other software · Easycorp · reported by MITREMedium 5.4
A Stored Cross-Site Scripting vulnerability was discovered in ZenTao 18.3 where a user can create a project, and in the name field of the project, they can inject malicious JavaScript code.
- Product
- Zentao
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.