Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
7,366 results · page 60 of 148
Aug 14, 2024Missing authorization in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow a privileged user to conduct an information disclosure vCVE-2024-39824 · Other software · Zoom Communications Inc. · reported by security@zoom.usMedium 4.9
Missing authorization in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow a privileged user to conduct an information disclosure via network access.
- Product
- Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2024Missing authorization in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow a privileged user to conduct an information disclosure vCVE-2024-39823 · Other software · Zoom Communications Inc. · reported by security@zoom.usMedium 4.9
Missing authorization in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow a privileged user to conduct an information disclosure via network access.
- Product
- Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2024Sensitive information exposure in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow an authenticated user to conduct an informationCVE-2024-39822 · Other software · Zoom Communications Inc. · reported by security@zoom.usMedium 6.5
Sensitive information exposure in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow an authenticated user to conduct an information disclosure via network access.
- Product
- Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2024Incorrect default permissions in some Intel Unite(R) Client Extended Display Plugin software installers before version 1.1.352.157 may allow an authenticated usCVE-2024-22378 · Other software · intel · reported by secure@intel.comMedium 5.4
Incorrect default permissions in some Intel Unite(R) Client Extended Display Plugin software installers before version 1.1.352.157 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- unite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2024Dell BIOS contains an Improper Input Validation vulnerability in an externally developed component.CVE-2024-38483 · Other software · Dell · reported by security_alert@emc.comMedium 5.8
Dell BIOS contains an Improper Input Validation vulnerability in an externally developed component. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution.
- Product
- Dell Client Platform BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2024Azure IoT SDK Remote Code Execution VulnerabilityCVE-2024-38157 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Azure IoT SDK Remote Code Execution Vulnerability
- Product
- Azure IoT Hub Device Client SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2024aiohttp is an asynchronous HTTP client/server framework for asyncio and Python.CVE-2024-42367 · Other software · aio-libs · reported by GitHubMedium 4.8
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In versions on the 3.10 branch prior to version 3.10.2, static routes which contain files with compressed variants (`.gz` or `.br` extension) are vulnerable to path traversal outside the root directory if those variants are symbolic links. The server protects static routes from path traversal outside the root directory when `follow_symlinks=False` (default). It does this by resolving the requested URL to an absolute path and then checking that path relative to the root. However, these checks are not performed when looking for compressed variants in the `FileResponse` class, and symbolic links are then automatically followed when performing the `Path.stat()` and `Path.open()` to send the file. Version 3.10.2 contains a patch for the issue.
- Product
- aiohttp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 8, 2024The InfoScan client download page can be intercepted with a proxy, to expose filenames located on the system, which could lead to additional information exposCVE-2024-42408 · Other software · Dorsett Controls · reported by ics-cert@hq.dhs.govMedium 6.9
The InfoScan client download page can be intercepted with a proxy, to expose filenames located on the system, which could lead to additional information exposure.
- Product
- InfoScan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.dtscada.comcisa.gov
Aug 6, 2024matrix-react-sdk is a react-based SDK for inserting a Matrix chat/voip client into a web page.CVE-2024-42347 · Other software · matrix-org · reported by GitHubHigh 7.7
matrix-react-sdk is a react-based SDK for inserting a Matrix chat/voip client into a web page. A malicious homeserver could manipulate a user's account data to cause the client to enable URL previews in end-to-end encrypted rooms, in which case any URLs in encrypted messages would be sent to the server. This was patched in matrix-react-sdk 3.105.0. Deployments that trust their homeservers, as well as closed federations of trusted servers, are not affected. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- matrix-react-sdk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2024An Improper Input Validation vulnerability in Zscaler Client Connector on MacOS allows OS Command Injection.CVE-2024-23483 · Other software · Zscaler · reported by cve@zscaler.comHigh 7
An Improper Input Validation vulnerability in Zscaler Client Connector on MacOS allows OS Command Injection. This issue affects Zscaler Client Connector on MacOS <4.2.
- Product
- Client Connector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2024In certain cases, Zscaler Internet Access (ZIA) can be disabled by PowerShell commands with admin rights.CVE-2024-23464 · Other software · Zscaler · reported by cve@zscaler.comHigh 7.2
In certain cases, Zscaler Internet Access (ZIA) can be disabled by PowerShell commands with admin rights. This affects Zscaler Client Connector on Windows <4.2.1
- Product
- Client Connector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2024The Zscaler Updater process does not validate the digital signature of the installer before execution, allowing arbitrary code to be locally executed.CVE-2024-23460 · Other software · Zscaler · reported by cve@zscaler.comMedium 6.4
The Zscaler Updater process does not validate the digital signature of the installer before execution, allowing arbitrary code to be locally executed. This affects Zscaler Client Connector on MacOS <4.2.
- Product
- Client Connector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2024While copying individual autoupdater log files, reparse point check was missing which could result into crafted attacks, potentially leading to a local privilegCVE-2024-23458 · Other software · Zscaler · reported by cve@zscaler.comHigh 7.3
While copying individual autoupdater log files, reparse point check was missing which could result into crafted attacks, potentially leading to a local privilege escalation. This issue affects Zscaler Client Connector on Windows <4.2.0.190.
- Product
- Client Connector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2024Anti-tampering can be disabled under certain conditions without signature validation.CVE-2024-23456 · Other software · Zscaler · reported by cve@zscaler.comHigh 7.8
Anti-tampering can be disabled under certain conditions without signature validation. This affects Zscaler Client Connector <4.2.0.190 with anti-tampering enabled.
- Product
- Client Connector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2024An Improper Validation of signature in Zscaler Client Connector on Windows allows an authenticated user to disable anti-tampering.CVE-2023-28806 · Other software · Zscaler · reported by cve@zscaler.comMedium 5.7
An Improper Validation of signature in Zscaler Client Connector on Windows allows an authenticated user to disable anti-tampering. This issue affects Client Connector on Windows <4.2.0.190.
- Product
- Client Connector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2024It's possible for a gRPC client communicating with a HTTP/2 proxy to poison the HPACK table between the proxy and the backend such that other clients see failedCVE-2024-7246 · Computers, phones & browsers · Google · reported by cve-coordination@google.comMedium 6.3
It's possible for a gRPC client communicating with a HTTP/2 proxy to poison the HPACK table between the proxy and the backend such that other clients see failed requests. It's also possible to use this vulnerability to leak other clients HTTP header keys, but not values. This occurs because the error status for a misencoded header is not cleared between header reads, resulting in subsequent (incrementally indexed) added headers in the first request being poisoned until cleared from the HPACK table. Please update to a fixed version of gRPC as soon as possible. This bug has been fixed in 1.58.3, 1.59.5, 1.60.2, 1.61.3, 1.62.3, 1.63.2, 1.64.3, 1.65.4.
- Product
- gRPC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2024Information disclosure while handling beacon probe frame during scan entry generation in client side.CVE-2024-21467 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 6.5
Information disclosure while handling beacon probe frame during scan entry generation in client side.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2024Improper Control of Generation of Code ('Code Injection') vulnerability in Apache InLong.CVE-2024-36268 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache InLong. This issue affects Apache InLong: from 1.10.0 through 1.12.0, which could lead to Remote Code Execution. Users are advised to upgrade to Apache InLong's 1.13.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/10251
- Product
- Apache InLong TubeMQ Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Aug 1, 2024Under certain circumstances the communication between exacqVision Client and exacqVision Server will use insufficient key length and exchangeCVE-2024-32758 · Other software · Johnson Controls · reported by productsecurity@jci.comCritical 9
Under certain circumstances the communication between exacqVision Client and exacqVision Server will use insufficient key length and exchange
- Product
- exacqVision
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcisa.govjohnsoncontrols.com
Aug 1, 2024In parisneo/lollms-webui version v9.8, the lollms_binding_infos is missing the client_id parameter, which leads to multiple security vulnerabilities.CVE-2024-6040 · Other software · parisneo · reported by security@huntr.devHigh 8.8
In parisneo/lollms-webui version v9.8, the lollms_binding_infos is missing the client_id parameter, which leads to multiple security vulnerabilities. Specifically, the endpoints /reload_binding, /install_binding, /reinstall_binding, /unInstall_binding, /set_active_binding_settings, and /update_binding_settings are susceptible to CSRF attacks and local attacks. An attacker can exploit this vulnerability to perform unauthorized actions on the victim's machine.
- Product
- parisneo/lollms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2024goframe v2.7.2 is configured to skip TLS certificate verification, possibly allowing attackers to execute a man-in-the-middle attack via the gclient component.CVE-2024-41253 · Other software · goframe · reported by MITREHigh 7.1
goframe v2.7.2 is configured to skip TLS certificate verification, possibly allowing attackers to execute a man-in-the-middle attack via the gclient component.
- Product
- goframe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2024Cato Networks Windows SDP Client Local root certificates can be installed by low-privileged users.This issue affects SDP Client: before 5.10.28.CVE-2024-6978 · Other software · Cato Networks · reported by 2505284f-8ffb-486c-bf60-e19c1097a90bMedium 5.6
Cato Networks Windows SDP Client Local root certificates can be installed by low-privileged users.This issue affects SDP Client: before 5.10.28.
- Product
- SDP Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.catonetworks.com
Jul 31, 2024A vulnerability in Cato Networks SDP Client on Windows allows the insertion of sensitive information into the log file, which can lead to an account takeover.CVE-2024-6977 · Other software · Cato Networks · reported by 2505284f-8ffb-486c-bf60-e19c1097a90bMedium 6.5
A vulnerability in Cato Networks SDP Client on Windows allows the insertion of sensitive information into the log file, which can lead to an account takeover. However, the attack requires bypassing protections on modifying the tunnel token on a the attacker's system.This issue affects SDP Client: before 5.10.34.
- Product
- SDP Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.catonetworks.com
Jul 31, 2024Cato Networks Windows SDP Client Local Privilege Escalation via openssl configuration file.CVE-2024-6975 · Other software · Cato Networks · reported by 2505284f-8ffb-486c-bf60-e19c1097a90bHigh 8.8
Cato Networks Windows SDP Client Local Privilege Escalation via openssl configuration file. This issue affects SDP Client before 5.10.34.
- Product
- SDP Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.catonetworks.com
Jul 31, 2024Cato Networks Windows SDP Client Local Privilege Escalation via self-upgradeThis issue affects SDP Client: before 5.10.34.CVE-2024-6974 · Other software · Cato Networks · reported by 2505284f-8ffb-486c-bf60-e19c1097a90bHigh 8.8
Cato Networks Windows SDP Client Local Privilege Escalation via self-upgradeThis issue affects SDP Client: before 5.10.34.
- Product
- SDP Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.catonetworks.com
Jul 31, 2024Remote Code Execution in Cato Windows SDP client via crafted URLs.CVE-2024-6973 · Other software · Cato Networks · reported by 2505284f-8ffb-486c-bf60-e19c1097a90bHigh 7.5
Remote Code Execution in Cato Windows SDP client via crafted URLs. This issue affects Windows SDP Client before 5.10.34.
- Product
- SDP Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.catonetworks.com
Jul 29, 2024Path traversal vulnerability exists in SKYSEA Client View Ver.3.013.00 to Ver.19.210.04e.CVE-2024-41726 · Other software · Sky Co.,LTD. · reported by vultures@jpcert.or.jpHigh 7.5
Path traversal vulnerability exists in SKYSEA Client View Ver.3.013.00 to Ver.19.210.04e. If this vulnerability is exploited, an arbitrary executable file may be executed by a user who can log in to the PC where the product's Windows client is installed.
- Product
- SKYSEA Client View
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpskyseaclientview.net
Jul 29, 2024Origin validation error vulnerability exists in SKYSEA Client View Ver.3.013.00 to Ver.19.210.04e.CVE-2024-41143 · Other software · Sky Co.,LTD. · reported by vultures@jpcert.or.jpHigh 7.8
Origin validation error vulnerability exists in SKYSEA Client View Ver.3.013.00 to Ver.19.210.04e. If this vulnerability is exploited, an arbitrary process may be executed with SYSTEM privilege by a user who can log in to the PC where the product's Windows client is installed.
- Product
- SKYSEA Client View
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpskyseaclientview.net
Jul 29, 2024Incorrect privilege assignment vulnerability exists in SKYSEA Client View Ver.6.010.06 to Ver.19.210.04e.CVE-2024-41139 · Other software · Sky Co.,LTD. · reported by vultures@jpcert.or.jpHigh 7.8
Incorrect privilege assignment vulnerability exists in SKYSEA Client View Ver.6.010.06 to Ver.19.210.04e. If a user who can log in to the PC where the product's Windows client is installed places a specially crafted DLL file in a specific folder, arbitrary code may be executed with SYSTEM privilege.
- Product
- SKYSEA Client View
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpskyseaclientview.net
Jul 26, 2024An issue was discovered in WithSecure Elements Agent through 23.x for macOS and WithSecure Elements Client Security through 23.x for macOS.CVE-2024-27358 · Other software · reported by MITRELow 3.3
An issue was discovered in WithSecure Elements Agent through 23.x for macOS and WithSecure Elements Client Security through 23.x for macOS. Local users can block an admin from completing an installation, aka a Denial-of-Service (DoS).
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwithsecure.comwithsecure.com
Jul 26, 2024An issue was discovered in WithSecure Elements Agent through 23.x for macOS, WithSecure Elements Client Security through 23.x for macOS, and WithSecure MDR throCVE-2024-27357 · Other software · withsecure · reported by MITREMedium 5.8
An issue was discovered in WithSecure Elements Agent through 23.x for macOS, WithSecure Elements Client Security through 23.x for macOS, and WithSecure MDR through 23.x for macOS. Local Privilege Escalation can occur during installations or updates by admins.
- Product
- elements_endpoint_protection
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwithsecure.comwithsecure.com
Jul 25, 2024There is an elevation of privilege vulnerability in server and client components of Absolute Secure Access prior to version 13.07.CVE-2024-40872 · Other software · Absolute Security · reported by SecurityResponse@netmotionsoftware.comHigh 8.4
There is an elevation of privilege vulnerability in server and client components of Absolute Secure Access prior to version 13.07. Attackers with local access and valid desktop user credentials can elevate their privilege to system level by passing invalid address data to the vulnerable component. This could be used to manipulate process tokens to elevate the privilege of a normal process to System. The scope is changed, the impact to system confidentiality and integrity is high, the impact to the availability of the effected component is none.
- Product
- Secure Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabsolute.comabsolute.com
Jul 24, 2024Tenda FH1201 v1.2.0.14 was discovered to contain a stack-based buffer overflow vulnerability via the page parameter at ip/goform/DhcpListClient.CVE-2024-41462 · Network & remote access · tenda · reported by MITREHigh 7.5
Tenda FH1201 v1.2.0.14 was discovered to contain a stack-based buffer overflow vulnerability via the page parameter at ip/goform/DhcpListClient.
- Product
- fh1201_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 24, 2024Tenda FH1201 v1.2.0.14 was discovered to contain a stack-based buffer overflow vulnerability via the list1 parameter at ip/goform/DhcpListClient.CVE-2024-41461 · Network & remote access · tenda · reported by MITRECritical 9.8
Tenda FH1201 v1.2.0.14 was discovered to contain a stack-based buffer overflow vulnerability via the list1 parameter at ip/goform/DhcpListClient.
- Product
- fh1201
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2024Client queries that trigger serving stale data and that also require lookups in local authoritative zone data may result in an assertion failure.CVE-2024-4076 · Other software · ISC · reported by security-officer@isc.orgHigh 7.5
Client queries that trigger serving stale data and that also require lookups in local authoritative zone data may result in an assertion failure. This issue affects BIND 9 versions 9.16.13 through 9.16.50, 9.18.0 through 9.18.27, 9.19.0 through 9.19.24, 9.11.33-S1 through 9.11.37-S1, 9.16.13-S1 through 9.16.50-S1, and 9.18.11-S1 through 9.18.27-S1.
- Product
- BIND 9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Jul 23, 2024A malicious client can send many DNS messages over TCP, potentially causing the server to become unstable while the attack is in progress.CVE-2024-0760 · Other software · ISC · reported by security-officer@isc.orgHigh 7.5
A malicious client can send many DNS messages over TCP, potentially causing the server to become unstable while the attack is in progress. The server may recover after the attack ceases. Use of ACLs will not mitigate the attack. This issue affects BIND 9 versions 9.18.1 through 9.18.27, 9.19.0 through 9.19.24, and 9.18.11-S1 through 9.18.27-S1.
- Product
- BIND 9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Jul 19, 2024In versions of Apache CXF before 3.6.4 and 4.0.5 (3.5.x and lower versions are not impacted), a CXF HTTP client conduit may prevent HTTPClient instances from beCVE-2024-41172 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
In versions of Apache CXF before 3.6.4 and 4.0.5 (3.5.x and lower versions are not impacted), a CXF HTTP client conduit may prevent HTTPClient instances from being garbage collected and it is possible that memory consumption will continue to increase, eventually causing the application to run out of memory
- Product
- Apache CXF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Jul 18, 2024matrix-rust-sdk is an implementation of a Matrix client-server library in Rust.CVE-2024-40648 · Other software · matrix-org · reported by GitHubMedium 5.4
matrix-rust-sdk is an implementation of a Matrix client-server library in Rust. The `UserIdentity::is_verified()` method in the matrix-sdk-crypto crate before version 0.7.2 doesn't take into account the verification status of the user's own identity while performing the check and may as a result return a value contrary to what is implied by its name and documentation. If the method is used to decide whether to perform sensitive operations towards a user identity, a malicious homeserver could manipulate the outcome in order to make the identity appear trusted. This is not a typical usage of the method, which lowers the impact. The method itself is not used inside the `matrix-sdk-crypto` crate. The 0.7.2 release of the `matrix-sdk-crypto` crate includes a fix. All users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- matrix-rust-sdk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2024Vulnerability in SonicWall SMA100 NetExtender Windows (32 and 64-bit) client 10.2.339 and earlier versions allows an attacker to arbitrary code execution when pCVE-2024-29014 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comHigh 8.8
Vulnerability in SonicWall SMA100 NetExtender Windows (32 and 64-bit) client 10.2.339 and earlier versions allows an attacker to arbitrary code execution when processing an EPC Client update.
- Product
- NetExtender
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.global.sonicwall.compsirt.global.sonicwall.com
Jul 17, 2024A vulnerability in APIML Spring Cloud Gateway which leverages user privileges by unexpected signing proxied request by Zowe's client certificate.CVE-2024-6834 · Other software · Open Mainframe Project · reported by zowe-security@lists.openmainframeproject.orgCritical 9
A vulnerability in APIML Spring Cloud Gateway which leverages user privileges by unexpected signing proxied request by Zowe's client certificate. This allows access to a user to the endpoints requiring an internal client certificate without any credentials. It could lead to managing components in there and allow an attacker to handle the whole communication including user credentials.
- Product
- Zowe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2024FULL – Cliente: Stored Cross-Site ScriptingCVE-2024-6447 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The FULL – Cliente plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the license plan parameter in all versions up to, and including, 3.1.12 due to insufficient input sanitization and output escaping as well as missing authorization and capability checks on the related functions. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute whenever an administrative user accesses wp-admin dashboard
- Product
- FULL – Cliente
- Affected
- up to 3.1.12
- What to do
- Affects up to 3.1.12. Update FULL – Cliente to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 9, 2024SQL Server Native Client OLE DB Provider Remote Code Execution VulnerabilityCVE-2024-38088 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
- Product
- Microsoft SQL Server 2017 (GDR)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jul 9, 2024SQL Server Native Client OLE DB Provider Remote Code Execution VulnerabilityCVE-2024-38087 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
- Product
- Microsoft SQL Server 2017 (GDR)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jul 9, 2024SQL Server Native Client OLE DB Provider Remote Code Execution VulnerabilityCVE-2024-37336 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
- Product
- Microsoft SQL Server 2017 (GDR)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jul 9, 2024SQL Server Native Client OLE DB Provider Remote Code Execution VulnerabilityCVE-2024-37333 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
- Product
- Microsoft SQL Server 2017 (GDR)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jul 9, 2024SQL Server Native Client OLE DB Provider Remote Code Execution VulnerabilityCVE-2024-37332 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
- Product
- Microsoft SQL Server 2017 (GDR)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jul 9, 2024SQL Server Native Client OLE DB Provider Remote Code Execution VulnerabilityCVE-2024-37331 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
- Product
- Microsoft SQL Server 2017 (GDR)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jul 9, 2024SQL Server Native Client OLE DB Provider Remote Code Execution VulnerabilityCVE-2024-37330 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
- Product
- Microsoft SQL Server 2017 (GDR)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jul 9, 2024SQL Server Native Client OLE DB Provider Remote Code Execution VulnerabilityCVE-2024-37329 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
- Product
- Microsoft SQL Server 2017 (GDR)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jul 9, 2024SQL Server Native Client OLE DB Provider Remote Code Execution VulnerabilityCVE-2024-37328 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
- Product
- Microsoft SQL Server 2017 (GDR)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.