Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,599 results · page 7 of 52
Sep 27, 2024Access permission verification vulnerability in the App Multiplier module Impact: Successful exploitation of this vulnerability may affect service confidentialiCVE-2024-9136 · Other software · Huawei · reported by psirt@huawei.comMedium 6.7
Access permission verification vulnerability in the App Multiplier module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2024Access permission verification vulnerability in the input method framework module Impact: Successful exploitation of this vulnerability may affect availability.CVE-2024-47294 · Other software · Huawei · reported by psirt@huawei.comMedium 4.4
Access permission verification vulnerability in the input method framework module Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2024Out-of-bounds write vulnerability in the HAL-WIFI module Impact: Successful exploitation of this vulnerability may affect availability.CVE-2024-47293 · Other software · Huawei · reported by psirt@huawei.comMedium 4.7
Out-of-bounds write vulnerability in the HAL-WIFI module Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2024Path traversal vulnerability in the Bluetooth module Impact: Successful exploitation of this vulnerability may affect service confidentiality.CVE-2024-47292 · Other software · Huawei · reported by psirt@huawei.comMedium 6.2
Path traversal vulnerability in the Bluetooth module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2024Permission vulnerability in the ActivityManagerService (AMS) module Impact: Successful exploitation of this vulnerability may affect availability.CVE-2024-47291 · Other software · Huawei · reported by psirt@huawei.comMedium 5.6
Permission vulnerability in the ActivityManagerService (AMS) module Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2024Input validation vulnerability in the USB service module Impact: Successful exploitation of this vulnerability may affect availability.CVE-2024-47290 · Other software · Huawei · reported by psirt@huawei.comMedium 5.5
Input validation vulnerability in the USB service module Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2024ImpactThe default .htaccess file has some restrictions in the access to PHP files to only allow specific PHP files to be executed in the root of the applicationCVE-2022-25769 · Other software · Mautic · reported by security@mautic.orgHigh 7.2
ImpactThe default .htaccess file has some restrictions in the access to PHP files to only allow specific PHP files to be executed in the root of the application. This logic isn't correct, as the regex in the second FilesMatch only checks the filename, not the full path.
- Product
- Mautic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2024CVE-2024-45826 IMPACT Due to improper input validation, a path traversal and remote code execution vulnerability exists when the ThinManager® processes a crafteCVE-2024-45826 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comHigh 8.5
CVE-2024-45826 IMPACT Due to improper input validation, a path traversal and remote code execution vulnerability exists when the ThinManager® processes a crafted POST request. If exploited, a user can install an executable file.
- Product
- ThinManager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Sep 12, 2024CVE-2024-45825 IMPACT A denial-of-service vulnerability exists in the affected products.CVE-2024-45825 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comHigh 8.7
CVE-2024-45825 IMPACT A denial-of-service vulnerability exists in the affected products. The vulnerability occurs when a malformed CIP packet is sent over the network to the device and results in a major nonrecoverable fault causing a denial-of-service.
- Product
- 5015-U8IHFT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Sep 12, 2024CVE-2024-45823 IMPACT An authentication bypass vulnerability exists in the affected product.CVE-2024-45823 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comCritical 9.2
CVE-2024-45823 IMPACT An authentication bypass vulnerability exists in the affected product. The vulnerability exists due to shared secrets across accounts and could allow a threat actor to impersonate a user if the threat actor is able to enumerate additional information required during authentication.
- Product
- FactoryTalk® Batch View™
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Sep 12, 2024CVE-2024-45824 IMPACT A remote code vulnerability exists in the affected products.CVE-2024-45824 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comCritical 9.2
CVE-2024-45824 IMPACT A remote code vulnerability exists in the affected products. The vulnerability occurs when chained with Path Traversal, Command Injection, and XSS Vulnerabilities and allows for full unauthenticated remote code execution. The link in the mitigations section below contains patches to fix this issue.
- Product
- FactoryTalk View Site Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Sep 3, 2024Memory request vulnerability in the memory management module Impact: Successful exploitation of this vulnerability may affect service confidentiality.CVE-2024-8298 · Other software · Huawei · reported by psirt@huawei.comMedium 6.2
Memory request vulnerability in the memory management module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhttpsconsumer.huawei.com
Sep 3, 2024Access permission verification vulnerability in the ringtone setting module Impact: Successful exploitation of this vulnerability may affect service confidentiaCVE-2024-45449 · Other software · Huawei · reported by psirt@huawei.comMedium 5.1
Access permission verification vulnerability in the ringtone setting module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2024Page table protection configuration vulnerability in the trusted firmware module Impact: Successful exploitation of this vulnerability may affect service confidCVE-2024-45448 · Other software · Huawei · reported by psirt@huawei.comMedium 4.1
Page table protection configuration vulnerability in the trusted firmware module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Sep 3, 2024Access control vulnerability in the camera framework module Impact: Successful exploitation of this vulnerability may affect service confidentiality.CVE-2024-45447 · Other software · Huawei · reported by psirt@huawei.comMedium 4.4
Access control vulnerability in the camera framework module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2024Access permission verification vulnerability in the camera driver module Impact: Successful exploitation of this vulnerability will affect availability.CVE-2024-45446 · Other software · Huawei · reported by psirt@huawei.comMedium 5.5
Access permission verification vulnerability in the camera driver module Impact: Successful exploitation of this vulnerability will affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2024Vulnerability of resources not being closed or released in the keystore module Impact: Successful exploitation of this vulnerability will affect availability.CVE-2024-45445 · Other software · Huawei · reported by psirt@huawei.comMedium 4
Vulnerability of resources not being closed or released in the keystore module Impact: Successful exploitation of this vulnerability will affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2024Access permission verification vulnerability in the WMS module Impact: Successful exploitation of this vulnerability may affect service confidentiality.CVE-2024-45444 · Other software · Huawei · reported by psirt@huawei.comMedium 5.5
Access permission verification vulnerability in the WMS module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2024Directory traversal vulnerability in the cust module Impact: Successful exploitation of this vulnerability will affect availability and confidentiality.CVE-2024-45443 · Other software · Huawei · reported by psirt@huawei.comMedium 6.1
Directory traversal vulnerability in the cust module Impact: Successful exploitation of this vulnerability will affect availability and confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2024Vulnerability of permission verification for APIs in the DownloadProviderMain module Impact: Successful exploitation of this vulnerability will affect availabilCVE-2024-45442 · Other software · Huawei · reported by psirt@huawei.comMedium 5.1
Vulnerability of permission verification for APIs in the DownloadProviderMain module Impact: Successful exploitation of this vulnerability will affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2024Input verification vulnerability in the system service module Impact: Successful exploitation of this vulnerability will affect availability.CVE-2024-45441 · Other software · huawei · reported by psirt@huawei.comMedium 6.2
Input verification vulnerability in the system service module Impact: Successful exploitation of this vulnerability will affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2024Access control vulnerability in the SystemUI module Impact: Successful exploitation of this vulnerability may affect service confidentiality.CVE-2024-42039 · Other software · Huawei · reported by psirt@huawei.comMedium 4.3
Access control vulnerability in the SystemUI module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2024A Cross-Site Scripting vulnerable identified in NetIQ Advance Authentication that impacts the server functionality and disclose sensitive information.CVE-2021-38122 · Other software · OpenText · reported by security@opentext.comMedium 6.2
A Cross-Site Scripting vulnerable identified in NetIQ Advance Authentication that impacts the server functionality and disclose sensitive information. This issue affects NetIQ Advance Authentication before 6.3.5.1
- Product
- NetIQ Advance Authentication
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2024CVE-2024-7515 IMPACT A denial-of-service vulnerability exists in the affected products.CVE-2024-7515 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comHigh 8.7
CVE-2024-7515 IMPACT A denial-of-service vulnerability exists in the affected products. A malformed PTP management packet can cause a major nonrecoverable fault in the controller.
- Product
- CompactLogix 5380 (5069-L3z)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Aug 14, 2024CVE-2024-7513 IMPACT A code execution vulnerability exists in the affected product.CVE-2024-7513 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comHigh 8.5
CVE-2024-7513 IMPACT A code execution vulnerability exists in the affected product. The vulnerability occurs due to improper default file permissions allowing any user to edit or replace files, which are executed by account with elevated permissions.
- Product
- FactoryTalk View Site Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Aug 14, 2024CVE-2024-7507 IMPACT A denial-of-service vulnerability exists in the affected products.CVE-2024-7507 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comHigh 8.7
CVE-2024-7507 IMPACT A denial-of-service vulnerability exists in the affected products. This vulnerability occurs when a malformed PCCC message is received, causing a fault in the controller.
- Product
- CompactLogix 5380 (5069 – L3z)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Aug 14, 2024CVE-2024-6078 IMPACT An improper authentication vulnerability exists in the affected product, which could allow a malicious user to generate cookies for any usCVE-2024-6078 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comHigh 8.6
CVE-2024-6078 IMPACT An improper authentication vulnerability exists in the affected product, which could allow a malicious user to generate cookies for any user ID without the use of a username or password. If exploited, a malicious user could take over the account of a legitimate user. The malicious user would be able to view and modify data stored in the cloud.
- Product
- DataMosaix™
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Aug 14, 2024CVE-2024-40620 IMPACT A vulnerability exists in the affected product due to lack of encryption of sensitive information.CVE-2024-40620 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comMedium 5.3
CVE-2024-40620 IMPACT A vulnerability exists in the affected product due to lack of encryption of sensitive information. The vulnerability results in data being sent between the Console and the Dashboard without encryption, which can be seen in the logs of proxy servers, potentially impacting the data's confidentiality.
- Product
- Pavilion8®
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Aug 14, 2024CVE-2024-40619 IMPACT A denial-of-service vulnerability exists in the affected products.CVE-2024-40619 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comHigh 8.7
CVE-2024-40619 IMPACT A denial-of-service vulnerability exists in the affected products. The vulnerability occurs when a malformed CIP packet is sent over the network to the device and results in a major nonrecoverable fault causing a denial-of-service.
- Product
- ControlLogix® 5580
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Aug 13, 2024SAP Document Builder does not perform necessary authorization checks for one of the function modules resulting in escalation of privileges causing low impact onCVE-2024-39591 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
SAP Document Builder does not perform necessary authorization checks for one of the function modules resulting in escalation of privileges causing low impact on confidentiality of the application.
- Product
- SAP Document Builder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2024Under certain conditions SAP Permit to Work allows an authenticated attacker to access information which would otherwise be restricted causing low impact on theCVE-2024-41736 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
Under certain conditions SAP Permit to Work allows an authenticated attacker to access information which would otherwise be restricted causing low impact on the confidentiality of the application.
- Product
- SAP Permit to Work
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2024SAP Commerce Backoffice does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability causing low impact on confideCVE-2024-41735 · Websites & servers · SAP_SE · reported by cna@sap.comMedium 5.4
SAP Commerce Backoffice does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability causing low impact on confidentiality and integrity of the application.
- Product
- SAP Commerce Backoffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2024A non-admin user can change or remove important features within the Zabbix Agent application, thus impacting the integrity and availability of the application.CVE-2024-22121 · Other software · Zabbix · reported by security@zabbix.comMedium 6.1
A non-admin user can change or remove important features within the Zabbix Agent application, thus impacting the integrity and availability of the application.
- Product
- Zabbix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 8, 2024Vulnerability of PIN enhancement failures in the screen lock module Impact: Successful exploitation of this vulnerability may affect service confidentiality, inCVE-2024-42038 · Other software · Huawei · reported by psirt@huawei.comHigh 8.8
Vulnerability of PIN enhancement failures in the screen lock module Impact: Successful exploitation of this vulnerability may affect service confidentiality, integrity, and availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 8, 2024Vulnerability of uncaught exceptions in the Graphics module Impact: Successful exploitation of this vulnerability may affect service confidentiality.CVE-2024-42037 · Other software · Huawei · reported by psirt@huawei.comCritical 9.3
Vulnerability of uncaught exceptions in the Graphics module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 8, 2024Access permission verification vulnerability in the Notepad module Impact: Successful exploitation of this vulnerability may affect service confidentiality.CVE-2024-42036 · Other software · Huawei · reported by psirt@huawei.comLow 2.5
Access permission verification vulnerability in the Notepad module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 8, 2024Permission control vulnerability in the App Multiplier module Impact:Successful exploitation of this vulnerability may affect functionality and confidentiality.CVE-2024-42035 · Other software · Huawei · reported by psirt@huawei.comHigh 8.4
Permission control vulnerability in the App Multiplier module Impact:Successful exploitation of this vulnerability may affect functionality and confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 8, 2024Access permission verification vulnerability in the Contacts module Impact: Successful exploitation of this vulnerability may affect service confidentiality.CVE-2024-42032 · Other software · Huawei · reported by psirt@huawei.comMedium 4.4
Access permission verification vulnerability in the Contacts module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 8, 2024Access permission verification vulnerability in the content sharing pop-up module Impact: Successful exploitation of this vulnerability may affect service confiCVE-2024-42030 · Other software · Huawei · reported by psirt@huawei.comMedium 6.2
Access permission verification vulnerability in the content sharing pop-up module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 8, 2024Permission verification vulnerability in the lock screen module Impact: Successful exploitation of this vulnerability may affect availabilityCVE-2023-7265 · Other software · Huawei · reported by psirt@huawei.comMedium 4
Permission verification vulnerability in the lock screen module Impact: Successful exploitation of this vulnerability may affect availability
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2024Prototype Pollution in alykoshin mini-deep-assign v0.0.8 allows an attacker to execute arbitrary code or cause a Denial of Service (DoS) and cause other impactsCVE-2024-38983 · Other software · alykoshin · reported by MITRECritical 9.8
Prototype Pollution in alykoshin mini-deep-assign v0.0.8 allows an attacker to execute arbitrary code or cause a Denial of Service (DoS) and cause other impacts via the _assign() method at (/lib/index.js:91)
- Product
- mini-deep-assign
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jul 30, 2024Prototype Pollution in chargeover redoc v2.0.9-rc.69 allows attackers to execute arbitrary code or cause a Denial of Service (DoS) and cause other impacts via tCVE-2024-39011 · Other software · redocly · reported by MITRECritical 9.8
Prototype Pollution in chargeover redoc v2.0.9-rc.69 allows attackers to execute arbitrary code or cause a Denial of Service (DoS) and cause other impacts via the function mergeObjects.
- Product
- redoc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jul 30, 2024Prototype Pollution in 75lb deep-merge 1.1.1 allows attackers to execute arbitrary code or cause a Denial of Service (DoS) and cause other impacts via merge metCVE-2024-38986 · Other software · 75lb · reported by MITRECritical 9.8
Prototype Pollution in 75lb deep-merge 1.1.1 allows attackers to execute arbitrary code or cause a Denial of Service (DoS) and cause other impacts via merge methods of lodash to merge objects.
- Product
- deep-merge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jul 30, 2024Prototype pollution in allpro form-manager 0.7.4 allows attackers to run arbitrary code and cause other impacts via the functions setDefaults, mergeBranch, and CVE-2024-36572 · Other software · allpro · reported by MITRECritical 9.8
Prototype pollution in allpro form-manager 0.7.4 allows attackers to run arbitrary code and cause other impacts via the functions setDefaults, mergeBranch, and Object.setObjectValue.
- Product
- form-manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jul 29, 2024Incorrect access control in Himalaya Xiaoya nano smart speaker rom_version 1.6.96 allows a remote attacker to have an unspecified impact.CVE-2024-41624 · Other software · reported by MITREMedium 6.3
Incorrect access control in Himalaya Xiaoya nano smart speaker rom_version 1.6.96 allows a remote attacker to have an unspecified impact.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 25, 2024Privilege escalation vulnerability in the NMS module Impact: Successful exploitation of this vulnerability will affect availability.CVE-2023-7271 · Other software · Huawei · reported by psirt@huawei.comMedium 5.5
Privilege escalation vulnerability in the NMS module Impact: Successful exploitation of this vulnerability will affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Jul 19, 2024In versions of Apache CXF before 3.6.4 and 4.0.5 (3.5.x and lower versions are not impacted), a CXF HTTP client conduit may prevent HTTPClient instances from beCVE-2024-41172 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
In versions of Apache CXF before 3.6.4 and 4.0.5 (3.5.x and lower versions are not impacted), a CXF HTTP client conduit may prevent HTTPClient instances from being garbage collected and it is possible that memory consumption will continue to increase, eventually causing the application to run out of memory
- Product
- Apache CXF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Jul 16, 2024Under certain circumstances the impacted Software House C•CURE 9000 installer will utilize unnecessarily wide permissions.CVE-2024-32861 · Other software · Johnson Controls · reported by productsecurity@jci.comHigh 7.8
Under certain circumstances the impacted Software House C•CURE 9000 installer will utilize unnecessarily wide permissions.
- Product
- Software House C•CURE 9000 Installer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcisa.govjohnsoncontrols.com
Jun 28, 2024HCL DRYiCE AEX is potentially impacted by disclosure of sensitive information in the mobile application when a snapshot is taken.CVE-2024-30135 · Other software · HCL Software · reported by psirt@hcl.comLow 3.3
HCL DRYiCE AEX is potentially impacted by disclosure of sensitive information in the mobile application when a snapshot is taken.
- Product
- DRYiCE AEX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Jun 28, 2024HCL DRYiCE AEX product is impacted by Missing Root Detection vulnerability in the mobile application.CVE-2024-30111 · Other software · HCL Software · reported by psirt@hcl.comLow 3.3
HCL DRYiCE AEX product is impacted by Missing Root Detection vulnerability in the mobile application. The mobile app can be installed in the rooted device due to which malicious users can gain unauthorized access to the rooted devices, compromising security and potentially leading to data breaches or other malicious activities.
- Product
- DRYiCE AEX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.