Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
6,834 results · page 60 of 137
Oct 11, 2024A vulnerability was discovered in DI_8200-16.07.26A1, which has been classified as critical.CVE-2024-44413 · Other software · dlink · reported by MITREHigh 8.8
A vulnerability was discovered in DI_8200-16.07.26A1, which has been classified as critical. This issue affects the upgrade_filter_asp function in the upgrade_filter.asp file. Manipulation of the path parameter can lead to command injection.
- Product
- di-8200_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2024CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause exposure of private data when an already generated “logcaptures” arcCVE-2024-8530 · Other software · Schneider Electric · reported by cybersecurity@se.comMedium 5.9
CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause exposure of private data when an already generated “logcaptures” archive is accessed directly by HTTPS.
- Product
- Data Center Expert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.com
Oct 11, 2024A path traversal vulnerability exists in the parisneo/lollms-webui repository, specifically in the `lollms_file_system.py` file.CVE-2024-6971 · Other software · parisneo · reported by security@huntr.devMedium 4.4
A path traversal vulnerability exists in the parisneo/lollms-webui repository, specifically in the `lollms_file_system.py` file. The functions `add_rag_database`, `toggle_mount_rag_database`, and `vectorize_folder` do not implement security measures such as `sanitize_path_from_endpoint` or `sanitize_path`. This allows an attacker to perform vectorize operations on `.sqlite` files in any directory on the victim's computer, potentially installing multiple packages and causing a crash.
- Product
- parisneo/lollms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2024A vulnerability was found in Codezips Tourist Management System 1.0 and classified as critical.CVE-2024-9816 · Other software · Codezips · reported by VulDBMedium 5.1
A vulnerability was found in Codezips Tourist Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/change-image.php. The manipulation of the argument packageimage leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Tourist Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2024A vulnerability has been found in Codezips Tourist Management System 1.0 and classified as critical.CVE-2024-9815 · Other software · Codezips · reported by VulDBMedium 5.1
A vulnerability has been found in Codezips Tourist Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/create-package.php. The manipulation of the argument packageimage leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Tourist Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2024A vulnerability, which was classified as critical, was found in Codezips Pharmacy Management System 1.0.CVE-2024-9814 · Other software · Codezips · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, was found in Codezips Pharmacy Management System 1.0. Affected is an unknown function of the file product/update.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Pharmacy Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2024A vulnerability, which was classified as critical, has been found in Codezips Pharmacy Management System 1.0.CVE-2024-9813 · Other software · Codezips · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, has been found in Codezips Pharmacy Management System 1.0. This issue affects some unknown processing of the file product/register.php. The manipulation of the argument category leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Pharmacy Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2024A vulnerability, which was classified as critical, has been found in Codezips Online Shopping Portal 1.0.CVE-2024-9794 · Other software · Codezips · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, has been found in Codezips Online Shopping Portal 1.0. This issue affects some unknown processing of the file /update-image1.php. The manipulation of the argument productimage1 leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Online Shopping Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2024A vulnerability classified as critical was found in Tenda AC1206 up to 15.03.06.23.CVE-2024-9793 · Network & remote access · Tenda · reported by VulDBMedium 5.3
A vulnerability classified as critical was found in Tenda AC1206 up to 15.03.06.23. This vulnerability affects the function ate_iwpriv_set/ate_ifconfig_set of the file /goform/ate. The manipulation leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AC1206
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2024A vulnerability was found in LyLme_spage 1.9.5 and classified as critical.CVE-2024-9789 · Other software · lylme · reported by VulDBMedium 5.1
A vulnerability was found in LyLme_spage 1.9.5 and classified as critical. This issue affects some unknown processing of the file /admin/apply.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- lylme_spage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2024A vulnerability has been found in LyLme_spage 1.9.5 and classified as critical.CVE-2024-9788 · Other software · lylme · reported by VulDBMedium 5.1
A vulnerability has been found in LyLme_spage 1.9.5 and classified as critical. This vulnerability affects unknown code of the file /admin/tag.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- lylme_spage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2024Authd, through version 0.3.6, did not sufficiently randomize user IDs to prevent collisions.CVE-2024-9312 · Other software · Canonical Ltd. · reported by security@ubuntu.comHigh 7.5
Authd, through version 0.3.6, did not sufficiently randomize user IDs to prevent collisions. A local attacker who can register user names could spoof another user's ID and gain their privileges.
- Product
- Authd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2024A vulnerability, which was classified as critical, has been found in D-Link DIR-619L B1 2.06.CVE-2024-9786 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability, which was classified as critical, has been found in D-Link DIR-619L B1 2.06. Affected by this issue is the function formSetLog of the file /goform/formSetLog. The manipulation of the argument curTime leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- DIR-619L B1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2024A vulnerability classified as critical was found in D-Link DIR-619L B1 2.06.CVE-2024-9785 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability classified as critical was found in D-Link DIR-619L B1 2.06. Affected by this vulnerability is the function formSetDDNS of the file /goform/formSetDDNS. The manipulation of the argument curTime leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- DIR-619L B1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2024A vulnerability classified as critical has been found in D-Link DIR-619L B1 2.06.CVE-2024-9784 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability classified as critical has been found in D-Link DIR-619L B1 2.06. Affected is the function formResetStatistic of the file /goform/formResetStatistic. The manipulation of the argument curTime leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- DIR-619L B1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2024Missing authentication for critical function in Visual Studio Code extension for Arduino allows an unauthenticated attacker to perform remote code execution thrCVE-2024-43488 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Missing authentication for critical function in Visual Studio Code extension for Arduino allows an unauthenticated attacker to perform remote code execution through network attack vector.
- Product
- Visual Studio Code
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2024Improper check for exception conditions in Knox Guard prior to SMR Oct-2024 Release 1 allows physical attackers to bypass Knox Guard in a multi-user environmentCVE-2024-34664 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4.1
Improper check for exception conditions in Knox Guard prior to SMR Oct-2024 Release 1 allows physical attackers to bypass Knox Guard in a multi-user environment.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.com
Oct 7, 2024Improper access removal handling in firmware of some Solidigm DC Products may allow an attacker with physical access to gain unauthorized access.CVE-2024-47976 · Other software · Solidigm · reported by f946a70c-00eb-42ce-8e9b-634d1f7b5a6fMedium 6.7
Improper access removal handling in firmware of some Solidigm DC Products may allow an attacker with physical access to gain unauthorized access.
- Product
- DC P4510
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2024Improper access control validation in firmware of some Solidigm DC Products may allow an attacker with physical access to gain unauthorized access or an attackeCVE-2024-47975 · Other software · Solidigm · reported by f946a70c-00eb-42ce-8e9b-634d1f7b5a6fHigh 7
Improper access control validation in firmware of some Solidigm DC Products may allow an attacker with physical access to gain unauthorized access or an attacker with local access to potentially enable denial of service.
- Product
- D7-P5500
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2024A vulnerability was found in D-Link DIR-619L B1 2.06 and classified as critical.CVE-2024-9570 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability was found in D-Link DIR-619L B1 2.06 and classified as critical. Affected by this issue is the function formEasySetTimezone of the file /goform/formEasySetTimezone. The manipulation of the argument curTime leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- DIR-619L B1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2024A vulnerability has been found in D-Link DIR-619L B1 2.06 and classified as critical.CVE-2024-9569 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability has been found in D-Link DIR-619L B1 2.06 and classified as critical. Affected by this vulnerability is the function formEasySetPassword of the file /goform/formEasySetPassword. The manipulation of the argument curTime leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- DIR-619L B1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2024A vulnerability, which was classified as critical, was found in D-Link DIR-619L B1 2.06.CVE-2024-9568 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability, which was classified as critical, was found in D-Link DIR-619L B1 2.06. Affected is the function formAdvNetwork of the file /goform/formAdvNetwork. The manipulation of the argument curTime leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- DIR-619L B1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2024A vulnerability, which was classified as critical, has been found in D-Link DIR-619L B1 2.06.CVE-2024-9567 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability, which was classified as critical, has been found in D-Link DIR-619L B1 2.06. This issue affects the function formAdvFirewall of the file /goform/formAdvFirewall. The manipulation of the argument curTime leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- DIR-619L B1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2024A vulnerability classified as critical was found in D-Link DIR-619L B1 2.06.CVE-2024-9566 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability classified as critical was found in D-Link DIR-619L B1 2.06. This vulnerability affects the function formDeviceReboot of the file /goform/formDeviceReboot. The manipulation of the argument next_page leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- DIR-619L B1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2024A vulnerability has been found in D-Link DIR-605L 2.13B01 BETA and classified as critical.CVE-2024-9565 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability has been found in D-Link DIR-605L 2.13B01 BETA and classified as critical. Affected by this vulnerability is the function formSetPassword of the file /goform/formSetPassword. The manipulation of the argument curTime leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- DIR-605L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2024A vulnerability, which was classified as critical, was found in D-Link DIR-605L 2.13B01 BETA.CVE-2024-9564 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability, which was classified as critical, was found in D-Link DIR-605L 2.13B01 BETA. Affected is the function formWlanWizardSetup of the file /goform/formWlanWizardSetup. The manipulation of the argument webpage leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- DIR-605L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2024A vulnerability, which was classified as critical, has been found in D-Link DIR-605L 2.13B01 BETA.CVE-2024-9563 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability, which was classified as critical, has been found in D-Link DIR-605L 2.13B01 BETA. This issue affects the function formWlanSetup_Wizard of the file /goform/formWlanSetup_Wizard. The manipulation of the argument webpage leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- DIR-605L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2024A vulnerability classified as critical was found in D-Link DIR-605L 2.13B01 BETA.CVE-2024-9562 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability classified as critical was found in D-Link DIR-605L 2.13B01 BETA. This vulnerability affects the function formSetWizard1/formSetWizard2. The manipulation of the argument curTime leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- DIR-605L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2024A vulnerability classified as critical has been found in D-Link DIR-605L 2.13B01 BETA.CVE-2024-9561 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability classified as critical has been found in D-Link DIR-605L 2.13B01 BETA. This affects the function formSetWAN_Wizard51/formSetWAN_Wizard52. The manipulation of the argument curTime leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- DIR-605L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2024A vulnerability was found in D-Link DIR-605L 2.13B01 BETA and classified as critical.CVE-2024-9558 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability was found in D-Link DIR-605L 2.13B01 BETA and classified as critical. This issue affects the function formSetWanPPTP of the file /goform/formSetWanPPTP. The manipulation of the argument webpage leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- DIR-605L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2024A vulnerability has been found in D-Link DIR-605L 2.13B01 BETA and classified as critical.CVE-2024-9557 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability has been found in D-Link DIR-605L 2.13B01 BETA and classified as critical. This vulnerability affects the function formSetWanPPPoE of the file /goform/formSetWanPPPoE. The manipulation of the argument webpage leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- DIR-605L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2024A vulnerability, which was classified as critical, was found in D-Link DIR-605L 2.13B01 BETA.CVE-2024-9556 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability, which was classified as critical, was found in D-Link DIR-605L 2.13B01 BETA. This affects the function formSetEnableWizard of the file /goform/formSetEnableWizard. The manipulation of the argument curTime leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- DIR-605L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2024A vulnerability, which was classified as critical, has been found in D-Link DIR-605L 2.13B01 BETA.CVE-2024-9555 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability, which was classified as critical, has been found in D-Link DIR-605L 2.13B01 BETA. Affected by this issue is the function formSetEasy_Wizard of the file /goform/formSetEasy_Wizard. The manipulation of the argument curTime leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- DIR-605L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2024Medical Addon for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-44024 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nicheaddons Medical Addon for Elementor medical-addon-for-elementor allows Stored XSS.This issue affects Medical Addon for Elementor: from n/a through <= 1.6.4.
- Product
- Medical Addon for Elementor
- Affected
- up to 1.6.4
- What to do
- Affects up to 1.6.4. Update Medical Addon for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2024WP Timeline – Vertical and Horizontal timeline: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47322 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ex-Themes WP Timeline – Vertical and Horizontal timeline plugin wp-timelines allows Reflected XSS.This issue affects WP Timeline – Vertical and Horizontal timeline plugin: from n/a through <= 3.6.7.
- Product
- WP Timeline – Vertical and Horizontal timeline
- Affected
- up to 3.6.7
- What to do
- Affects up to 3.6.7. Update WP Timeline – Vertical and Horizontal timeline to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2024A vulnerability classified as critical has been found in D-Link DIR-605L 2.13B01 BETA.CVE-2024-9553 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability classified as critical has been found in D-Link DIR-605L 2.13B01 BETA. This affects the function formdumpeasysetup of the file /goform/formdumpeasysetup. The manipulation of the argument curTime leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- DIR-605L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2024Automatically Hierarchic Categories in Menu: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47365 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Atakan Au Automatically Hierarchic Categories in Menu automatically-hierarchic-categories-in-menu allows Stored XSS.This issue affects Automatically Hierarchic Categories in Menu: from n/a through <= 2.0.5.
- Product
- Automatically Hierarchic Categories in Menu
- Affected
- up to 2.0.5
- What to do
- Affects up to 2.0.5. Update Automatically Hierarchic Categories in Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2024A vulnerability was found in D-Link DIR-605L 2.13B01 BETA and classified as critical.CVE-2024-9549 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability was found in D-Link DIR-605L 2.13B01 BETA and classified as critical. This issue affects the function formEasySetupWizard/formEasySetupWizard2 of the file /goform/formEasySetupWizard. The manipulation of the argument curTime leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- DIR-605L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2024A vulnerability was found in D-Link DIR-605L 2.13B01 BETA and classified as critical.CVE-2024-9533 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability was found in D-Link DIR-605L 2.13B01 BETA and classified as critical. This issue affects the function formDeviceReboot of the file /goform/formDeviceReboot. The manipulation of the argument next_page leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- DIR-605L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2024WP Timeline – Vertical and Horizontal timeline: Path Traversal: '.../...//'CVE-2024-47324 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Path Traversal: '.../...//' vulnerability in Ex-Themes WP Timeline – Vertical and Horizontal timeline plugin wp-timelines.This issue affects WP Timeline – Vertical and Horizontal timeline plugin: from n/a through <= 3.6.7.
- Product
- WP Timeline – Vertical and Horizontal timeline
- Affected
- up to 3.6.7
- What to do
- Affects up to 3.6.7. Update WP Timeline – Vertical and Horizontal timeline to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2024WP Timeline – Vertical and Horizontal timeline: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2024-47323 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Ex-Themes WP Timeline – Vertical and Horizontal timeline plugin wp-timelines.This issue affects WP Timeline – Vertical and Horizontal timeline plugin: from n/a through <= 3.6.7.
- Product
- WP Timeline – Vertical and Horizontal timeline
- Affected
- up to 3.6.7
- What to do
- Affects up to 3.6.7. Update WP Timeline – Vertical and Horizontal timeline to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2024A vulnerability has been found in D-Link DIR-605L 2.13B01 BETA and classified as critical.CVE-2024-9532 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability has been found in D-Link DIR-605L 2.13B01 BETA and classified as critical. This vulnerability affects the function formAdvanceSetup of the file /goform/formAdvanceSetup. The manipulation of the argument webpage leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- DIR-605L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2024Authd PAM module before version 0.3.5 can allow broker-managed users to impersonate any other user managed by the same broker and perform any PAM operation withCVE-2024-9313 · Other software · Canonical Ltd. · reported by security@ubuntu.comHigh 8.8
Authd PAM module before version 0.3.5 can allow broker-managed users to impersonate any other user managed by the same broker and perform any PAM operation with it, including authenticating as them.
- Product
- Authd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2024Incorrect Permission Assignment for Critical Resource vulnerability in OpenText™ Vertica could allow Privilege Abuse and result in unauthorized access or privilCVE-2024-6360 · Other software · OpenText™ · reported by security@opentext.comMedium 6.9
Incorrect Permission Assignment for Critical Resource vulnerability in OpenText™ Vertica could allow Privilege Abuse and result in unauthorized access or privileges to Vertica agent apikey. This issue affects Vertica: from 10.0 through 10.X, from 11.0 through 11.X, from 12.0 through 12.X, from 23.0 through 23.X, from 24.0 through 24.X.
- Product
- Vertica
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2024Vulnerable juju introspection abstract UNIX domain socket.CVE-2024-8038 · Other software · Canonical Ltd. · reported by security@ubuntu.comHigh 7.9
Vulnerable juju introspection abstract UNIX domain socket. An abstract UNIX domain socket responsible for introspection is available without authentication locally to network namespace users. This enables denial of service attacks.
- Product
- Juju
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2024Vulnerable juju hook tool abstract UNIX domain socket.CVE-2024-8037 · Other software · Canonical Ltd. · reported by security@ubuntu.comMedium 6.5
Vulnerable juju hook tool abstract UNIX domain socket. When combined with an attack of JUJU_CONTEXT_ID, any user on the local system with access to the default network namespace may connect to the @/var/lib/juju/agents/unit-xxxx-yyyy/agent.socket and perform actions that are normally reserved to a juju charm.
- Product
- Juju
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2024JUJU_CONTEXT_ID is a predictable authentication secret.CVE-2024-7558 · Other software · Canonical Ltd. · reported by security@ubuntu.comHigh 8.7
JUJU_CONTEXT_ID is a predictable authentication secret. On a Juju machine (non-Kubernetes) or Juju charm container (on Kubernetes), an unprivileged user in the same network namespace can connect to an abstract domain socket and guess the JUJU_CONTEXT_ID value. This gives the unprivileged user access to the same information and tools as the Juju charm.
- Product
- Juju
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2024An unauthenticated remote attacker may use a missing authentication for critical function vulnerability to reboot or erase the affected devices resulting in datCVE-2024-35293 · Other software · Schneider Elektronik · reported by info@cert.vde.comCritical 9.1
An unauthenticated remote attacker may use a missing authentication for critical function vulnerability to reboot or erase the affected devices resulting in data loss and/or a DoS.
- Product
- Series 700
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordschneider-elektronik.de
Oct 1, 2024A SQL Injection vulnerability was discovered in Cloudlog 2.6.15, specifically within the get_station_info()function located in the file /application/models/OqrsCVE-2024-45999 · Other software · cloudlog · reported by MITRECritical 9.8
A SQL Injection vulnerability was discovered in Cloudlog 2.6.15, specifically within the get_station_info()function located in the file /application/models/Oqrs_model.php. The vulnerability is exploitable via the station_id parameter.
- Product
- cloudlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchiggerlor.substack.com
Oct 1, 2024By checking the result of calls to `window.open` with specifically set protocol handlers, an attacker could determine if the application which implements that pCVE-2024-9398 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 5.3
By checking the result of calls to `window.open` with specifically set protocol handlers, an attacker could determine if the application which implements that protocol handler is installed. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Thunderbird < 128.3, and Thunderbird < 131.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.