Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
8,140 results · page 74 of 163
Feb 11, 2025In affected versions of Octopus Deploy it was possible to upload files to unexpected locations on the host using an API endpoint.CVE-2025-0526 · Other software · Octopus Deploy · reported by security@octopus.comLow 2.3
In affected versions of Octopus Deploy it was possible to upload files to unexpected locations on the host using an API endpoint. The field lacked validation which could potentially result in ways to circumvent expected workflows.
- Product
- Octopus Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.octopus.comadvisories.octopus.com
Feb 11, 2025In affected versions of Octopus Deploy where customers are using Active Directory for authentication it was possible for an unauthenticated user to make an API CVE-2025-0589 · Other software · Octopus Deploy · reported by security@octopus.comMedium 6.9
In affected versions of Octopus Deploy where customers are using Active Directory for authentication it was possible for an unauthenticated user to make an API request against two endpoints which would retrieve some data from the associated Active Directory. The requests when crafted correctly would return specific information from user profiles (Email address/UPN and Display name) from one endpoint and group information ( Group ID and Display name) from the other. This vulnerability does not expose data within the Octopus Server product itself.
- Product
- Octopus Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.octopus.com
Feb 7, 2025Tally Prime Edit Log v2.1 was discovered to contain a DLL hijacking vulnerability via the component TextShaping.dll.CVE-2024-48091 · Other software · reported by MITREHigh 7.8
Tally Prime Edit Log v2.1 was discovered to contain a DLL hijacking vulnerability via the component TextShaping.dll. This vulnerability allows attackers to execute arbitrary code via a crafted DLL.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comtallysolutions.com
Feb 7, 2025Indeed API: Cross-Site Request Forgery (CSRF)CVE-2025-25103 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in bnielsen Indeed API indeed-api allows Cross Site Request Forgery.This issue affects Indeed API: from n/a through <= 0.5.
- Product
- Indeed API
- Affected
- up to 0.5
- What to do
- Affects up to 0.5. Update Indeed API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 6, 2025Using API in the 2N OS device, authorized user can enable logging, which discloses valid authentication tokens in system log.CVE-2024-13416 · Other software · 2N · reported by product-security@axis.comMedium 4.3
Using API in the 2N OS device, authorized user can enable logging, which discloses valid authentication tokens in system log. 2N has released an updated version 2.46 of 2N OS, where this vulnerability is mitigated. It is recommended that all customers update their devices to the latest 2N OS.
- Product
- 2N OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2025An information disclosure vulnerability exists in the Vault API functionality of ClearML Enterprise Server 3.22.5-1533.CVE-2024-43779 · Other software · ClearML · reported by talos-cna@cisco.comHigh 7.7
An information disclosure vulnerability exists in the Vault API functionality of ClearML Enterprise Server 3.22.5-1533. A specially crafted HTTP request can lead to reading vaults that have been previously disabled, possibly leaking sensitive credentials. An attacker can send a series of HTTP requests to trigger this vulnerability.
- Product
- ClearML
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Feb 5, 2025When BIG-IP Next Central Manager is running, undisclosed requests to the BIG-IP Next Central Manager API can cause the BIG-IP Next Central Manager Node's KubernCVE-2025-24319 · Network & remote access · F5 · reported by f5sirt@f5.comHigh 7.1
When BIG-IP Next Central Manager is running, undisclosed requests to the BIG-IP Next Central Manager API can cause the BIG-IP Next Central Manager Node's Kubernetes service to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- Product
- BIG-IP Next Central Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2025When users log in through the webUI or API using local authentication, BIG-IP Next Central Manager may log sensitive information in the pgaudit log files.CVE-2025-23413 · Network & remote access · F5 · reported by f5sirt@f5.comMedium 6.7
When users log in through the webUI or API using local authentication, BIG-IP Next Central Manager may log sensitive information in the pgaudit log files. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- Product
- BIG-IP Next Central Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2025A vulnerability in an API of Cisco ISE could allow an authenticated, remote attacker with valid read-only credentials to obtain sensitive information, change noCVE-2025-20125 · Network & remote access · Cisco · reported by psirt@cisco.comCritical 9.1
A vulnerability in an API of Cisco ISE could allow an authenticated, remote attacker with valid read-only credentials to obtain sensitive information, change node configurations, and restart the node. This vulnerability is due to a lack of authorization in a specific API and improper validation of user-supplied data. An attacker could exploit this vulnerability by sending a crafted HTTP request to a specific API on the device. A successful exploit could allow the attacker to attacker to obtain information, modify system configuration, and reload the device. Note: To successfully exploit this vulnerability, the attacker must have valid read-only administrative credentials. In a single-node deployment, new devices will not be able to authenticate during the reload time.
- Product
- Cisco Identity Services Engine Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Feb 5, 2025A vulnerability in an API of Cisco ISE could allow an authenticated, remote attacker to execute arbitrary commands as the root user on an affected device.CVE-2025-20124 · Network & remote access · Cisco · reported by psirt@cisco.comCritical 9.9
A vulnerability in an API of Cisco ISE could allow an authenticated, remote attacker to execute arbitrary commands as the root user on an affected device. This vulnerability is due to insecure deserialization of user-supplied Java byte streams by the affected software. An attacker could exploit this vulnerability by sending a crafted serialized Java object to an affected API. A successful exploit could allow the attacker to execute arbitrary commands on the device and elevate privileges. Note: To successfully exploit this vulnerability, the attacker must have valid read-only administrative credentials. In a single-node deployment, new devices will not be able to authenticate during the reload time.
- Product
- Cisco Identity Services Engine Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Feb 4, 2025Inappropriate implementation in Extensions API in Google Chrome prior to 133.0.6943.53 allowed a remote attacker who convinced a user to engage in specific UI gCVE-2025-0451 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 6.3
Inappropriate implementation in Extensions API in Google Chrome prior to 133.0.6943.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted Chrome Extension. (Chromium security severity: Medium)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Feb 4, 2025An attacker could have caused a use-after-free via the Custom Highlight API, leading to a potentially exploitable crash.CVE-2025-1010 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.8
An attacker could have caused a use-after-free via the Custom Highlight API, leading to a potentially exploitable crash. This vulnerability was fixed in Firefox 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Feb 4, 2025Sensei LMS: Does not properly protect some its REST API routesCVE-2025-0466 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Sensei LMS WordPress plugin before 4.24.4 does not properly protect some its REST API routes, allowing unauthenticated attackers to leak sensei_email and sensei_message Information.
- Product
- Sensei LMS
- Fixed in
- 4.24.4
- What to do
- Update Sensei LMS to 4.24.4 or newer.
Feb 3, 2025org.gaul S3Proxy implements the S3 API and proxies requests.CVE-2025-24961 · Other software · gaul · reported by GitHubMedium 6
org.gaul S3Proxy implements the S3 API and proxies requests. Users of the filesystem and filesystem-nio2 storage backends could unintentionally expose local files to users. This issue has been addressed in version 2.6.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- s3proxy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2025Nedis SmartLife android app v1.4.0 was discovered to contain an API key disclosure vulnerability.CVE-2024-34897 · Other software · reported by MITREHigh 7.5
Nedis SmartLife android app v1.4.0 was discovered to contain an API key disclosure vulnerability.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 31, 2025Dell PowerProtect DD versions prior to 7.10.1.50 and 7.13.1.20 contain a Stack-based Buffer Overflow vulnerability in the RestAPI.CVE-2024-53296 · Other software · Dell · reported by security_alert@emc.comLow 2.7
Dell PowerProtect DD versions prior to 7.10.1.50 and 7.13.1.20 contain a Stack-based Buffer Overflow vulnerability in the RestAPI. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of service.
- Product
- PowerProtect DD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 31, 2025RapidLoad – Optimize Web Vitals Automatically: Unauthorized modification of dataCVE-2024-13651 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The RapidLoad – Optimize Web Vitals Automatically plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_deactivate() function in all versions up to, and including, 2.4.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset some of the plugin's settings.
- Product
- RapidLoad – Optimize Web Vitals Automatically
- Affected
- up to 2.4.4
- What to do
- Affects up to 2.4.4. Update RapidLoad – Optimize Web Vitals Automatically to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 31, 2025Code Injection vulnerability in EasyVirt DCScope <= 8.6.0 and CO2Scope <= 1.3.0 allows remote unauthenticated attackers to execute arbitrary code to /api/licensCVE-2024-55062 · Other software · Easyvirt · reported by MITRECritical 9.8
Code Injection vulnerability in EasyVirt DCScope <= 8.6.0 and CO2Scope <= 1.3.0 allows remote unauthenticated attackers to execute arbitrary code to /api/license/sendlicense/.
- Product
- Co2scope
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 31, 2025A heap buffer overflow in the XML Text Escaping component of Qualisys C++ SDK commit a32a21a allows attackers to cause Denial of Service (DoS) via escaping specCVE-2024-53319 · Other software · reported by MITREHigh 7.5
A heap buffer overflow in the XML Text Escaping component of Qualisys C++ SDK commit a32a21a allows attackers to cause Denial of Service (DoS) via escaping special XML characters.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 31, 2025Bentley Systems ProjectWise Integration Server before 10.00.03.288 allows unintended SQL query execution by an authenticated user via an API call.CVE-2024-53007 · Other software · Bentley · reported by MITREMedium 6.4
Bentley Systems ProjectWise Integration Server before 10.00.03.288 allows unintended SQL query execution by an authenticated user via an API call.
- Product
- ProjectWise Integration Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2025kube-audit-rest is a simple logger of mutation/creation requests to the k8s api.CVE-2025-24884 · Other software · RichardoC · reported by GitHubMedium 5.1
kube-audit-rest is a simple logger of mutation/creation requests to the k8s api. If the "full-elastic-stack" example vector configuration was used for a real cluster, the previous values of kubernetes secrets would have been disclosed in the audit messages. This vulnerability is fixed in 1.0.16.
- Product
- kube-audit-rest
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2025AutoLib Software Systems OPAC v20.10 was discovered to have multiple API keys exposed within the source code.CVE-2024-48310 · Other software · reported by MITREHigh 7.5
AutoLib Software Systems OPAC v20.10 was discovered to have multiple API keys exposed within the source code. Attackers may use these keys to access the backend API or other sensitive information.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Jan 27, 2025NVIDIA RAPIDS contains a vulnerability in cuDF and cuML, where a user could cause a deserialization of untrusted data issue.CVE-2024-0140 · Other software · NVIDIA · reported by psirt@nvidia.comMedium 6.8
NVIDIA RAPIDS contains a vulnerability in cuDF and cuML, where a user could cause a deserialization of untrusted data issue. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and information disclosure.
- Product
- RAPIDS cuDF and cuML
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2025In AXESS ACS (Auto Configuration Server) through 5.2.0, unsanitized user input in the TR069 API allows remote unauthenticated attackers to cause a permanent DenCVE-2024-56316 · Other software · reported by MITREHigh 7.5
In AXESS ACS (Auto Configuration Server) through 5.2.0, unsanitized user input in the TR069 API allows remote unauthenticated attackers to cause a permanent Denial of Service via crafted TR069 requests on TCP port 9675 or 7547. Rebooting does not resolve the permanent Denial of Service.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 24, 2025An issue was discovered in Deepin dde-api-proxy through 1.0.19 in which unprivileged users can access D-Bus services as root.CVE-2025-23222 · Other software · Deepin · reported by MITREHigh 8.4
An issue was discovered in Deepin dde-api-proxy through 1.0.19 in which unprivileged users can access D-Bus services as root. Specifically, dde-api-proxy runs as root and forwards messages from arbitrary local users to legacy D-Bus methods in the actual D-Bus services, and the actual D-Bus services don't know about the proxy situation (they believe that root is asking them to do things). Consequently several proxied methods, that shouldn't be accessible to non-root users, are accessible to non-root users. In situations where Polkit is involved, the caller would be treated as admin, resulting in a similar escalation of privileges.
- Product
- dde-api-proxy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.suse.comsecurity.opensuse.org
Jan 24, 2025IBM Maximo Asset Management 7.6.1.3 MXAPIASSET API is vulnerable to unrestricted file upload which allows authenticated low privileged user to upload restrictedCVE-2024-45077 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM Maximo Asset Management 7.6.1.3 MXAPIASSET API is vulnerable to unrestricted file upload which allows authenticated low privileged user to upload restricted file types with a simple method of adding a dot to the end of the file name if Maximo is installed on Windows operating system.
- Product
- Maximo Asset Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2025Information Disclosure in API in Replicated Replicated Classic versions prior to 2.53.1 on all platforms allows authenticated users with Admin Console access toCVE-2021-42718 · Other software · Replicated · reported by security@replicated.comMedium 4.9
Information Disclosure in API in Replicated Replicated Classic versions prior to 2.53.1 on all platforms allows authenticated users with Admin Console access to retrieve sensitive data, including application secrets, via accessing container definitions with environment variables through the Admin Console API on port 8800. This CVE was originally reserved in 2021 and later publicly disclosed by Replicated on their website on 21 October 2021. However, it mistakenly remained in the Reserved But Public (RBP) status with the CVE Numbering Authority (CNA). Please note that this product reached its end of life on 31 December 2024. Publishing this CVE with the CNA was required to comply with CNA rules, despite the fact that the issue was disclosed and fixed four years ago, and the affected product is no longer supported as of 2024. Summary of VulnerabilityThis advisory discloses a low severity security vulnerability in the versions of Replicated Classic listed above (“Affected Replicated Classic Versions”) DescriptionReplicated Classic versions prior to 2.53.1 have an authenticated API from the Replicated Admin Console that may expose sensitive data including application secrets, depend
- Product
- Replicated Classic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2025Directus is a real-time API and App dashboard for managing SQL database content.CVE-2025-24353 · Other software · directus · reported by GitHubMedium 5
Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 11.2.0, when sharing an item, a typical user can specify an arbitrary role. It allows the user to use a higher-privileged role to see fields that otherwise the user should not be able to see. Instances that are impacted are those that use the share feature and have specific roles hierarchy and fields that are not visible for certain roles. Version 11.2.0 contains a patch the issue.
- Product
- directus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2025In Xerox Workplace Suite, an API restricted to specific hosts can be bypassed by manipulating the Host header.CVE-2024-55925 · Other software · Xerox · reported by 10b61619-3869-496c-8a1e-f291b0e71e3fHigh 7.5
In Xerox Workplace Suite, an API restricted to specific hosts can be bypassed by manipulating the Host header. If the server improperly validates or trusts the Host header without verifying the actual destination, an attacker can forge a value to gain unauthorized access. This exploit targets improper host validation, potentially exposing sensitive API endpoints.
- Product
- Xerox Workplace Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecuritydocs.business.xerox.com
Jan 23, 2025An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/metrics/snapshot.CVE-2024-52972 · Other software · Elastic · reported by security@elastic.coMedium 6.5
An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/metrics/snapshot. This can be carried out by users with read access to the Observability Metrics or Logs features in Kibana.
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2025A server side request forgery vulnerability was identified in Kibana where the /api/fleet/health_check API could be used to send requests to internal endpoints.CVE-2024-43710 · Other software · Elastic · reported by security@elastic.coMedium 4.3
A server side request forgery vulnerability was identified in Kibana where the /api/fleet/health_check API could be used to send requests to internal endpoints. Due to the nature of the underlying request, only endpoints available over https that return JSON could be accessed. This can be carried out by users with read access to Fleet.
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2025A vulnerability in the REST API of Cisco Meeting Management could allow a remote, authenticated attacker with low privileges to elevate privileges to administraCVE-2025-20156 · Network & remote access · Cisco · reported by psirt@cisco.comCritical 9.9
A vulnerability in the REST API of Cisco Meeting Management could allow a remote, authenticated attacker with low privileges to elevate privileges to administrator on an affected device. This vulnerability exists because proper authorization is not enforced upon REST API users. An attacker could exploit this vulnerability by sending API requests to a specific endpoint. A successful exploit could allow the attacker to gain administrator-level control over edge nodes that are managed by Cisco Meeting Management.
- Product
- Cisco Meeting Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.clamav.netsec.cloudapps.cisco.com
Jan 21, 2025pearProjectApi v2.8.10 was discovered to contain a SQL injection vulnerability via the organizationCode parameter at project.php.CVE-2023-27113 · Other software · A54552239 · reported by MITRECritical 9.8
pearProjectApi v2.8.10 was discovered to contain a SQL injection vulnerability via the organizationCode parameter at project.php.
- Product
- Pearprojectapi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2025pearProjectApi v2.8.10 was discovered to contain a SQL injection vulnerability via the projectCode parameter at project.php.CVE-2023-27112 · Other software · A54552239 · reported by MITRECritical 9.8
pearProjectApi v2.8.10 was discovered to contain a SQL injection vulnerability via the projectCode parameter at project.php.
- Product
- Pearprojectapi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2025Poll Maker: Improper Encoding or Escaping of OutputCVE-2024-56277 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Encoding or Escaping of Output vulnerability in Ays Pro Poll Maker poll-maker.This issue affects Poll Maker: from n/a through < 5.5.5.
- Product
- Poll Maker
- Fixed in
- 5.5.5
- What to do
- Update Poll Maker to 5.5.5 or newer.
Jan 21, 2025In the Linux kernel, the following vulnerability has been resolved: netdev: prevent accessing NAPI instances from another namespace The NAPI IDs were not fullCVE-2025-21659 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 8.1
In the Linux kernel, the following vulnerability has been resolved: netdev: prevent accessing NAPI instances from another namespace The NAPI IDs were not fully exposed to user space prior to the netlink API, so they were never namespaced. The netlink API must ensure that at the very least NAPI instance belongs to the same netns as the owner of the genl sock. napi_by_id() can become static now, but it needs to move because of dev_get_by_napi_id().
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jan 21, 2025An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/log_entries/summary.CVE-2024-52973 · Other software · Elastic · reported by security@elastic.coMedium 6.5
An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/log_entries/summary. This can be carried out by users with read access to the Observability-Logs feature in Kibana.
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2025In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: adapt set backend to use GC transaction API Use the GC transaction ACVE-2023-52923 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: adapt set backend to use GC transaction API Use the GC transaction API to replace the old and buggy gc API and the busy mark approach. No set elements are removed from async garbage collection anymore, instead the _DEAD bit is set on so the set element is not visible from lookup path anymore. Async GC enqueues transaction work that might be aborted and retried later. rbtree and pipapo set backends does not set on the _DEAD bit from the sync GC path since this runs in control plane path where mutex is held. In this case, set elements are deactivated, removed and then released via RCU callback, sync GC never fails.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jan 18, 2025IBM Maximo MXAPIASSET API 7.6.1.3 could allow a remote attacker to traverse directories on the system.CVE-2024-45652 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM Maximo MXAPIASSET API 7.6.1.3 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.
- Product
- Maximo Asset Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2025IBM Concert 1.0.0, 1.0.1, and 1.0.2 is vulnerable to sensitive information disclosure through specially crafted API Calls.CVE-2024-49354 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM Concert 1.0.0, 1.0.1, and 1.0.2 is vulnerable to sensitive information disclosure through specially crafted API Calls.
- Product
- Concert Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2025The /rest/rights/ REST API endpoint in Becon DATAGerry through 2.2.0 contains an Incorrect Access Control vulnerability.CVE-2024-50967 · Other software · reported by MITREMedium 6.5
The /rest/rights/ REST API endpoint in Becon DATAGerry through 2.2.0 contains an Incorrect Access Control vulnerability. An attacker can remotely access this endpoint without authentication, leading to unauthorized disclosure of sensitive information.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddatagerry.readthedocs.iogithub.com
Jan 15, 2025Navigation Du Lapin Blanc: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22745 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bjoerne Navigation Du Lapin Blanc navigation-du-lapin-blanc allows DOM-Based XSS.This issue affects Navigation Du Lapin Blanc: from n/a through <= 1.1.1.
- Product
- Navigation Du Lapin Blanc
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update Navigation Du Lapin Blanc to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 15, 2025A flaw was found in the FreeIPA API audit, where it sends the whole FreeIPA command line to journalctl.CVE-2024-11029 · Other software · Red Hat · reported by Red HatMedium 5.5
A flaw was found in the FreeIPA API audit, where it sends the whole FreeIPA command line to journalctl. As a consequence, during the FreeIPA installation process, it inadvertently leaks the administrative user credentials, including the administrator password, to the journal database. In the worst-case scenario, where the journal log is centralized, users with access to it can have improper access to the FreeIPA administrator credentials.
- Product
- Red Hat Enterprise Linux 9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Jan 14, 2025Gradio is an open-source Python package that allows quick building of demos and web application for machine learning models, API, or any arbitrary Python functiCVE-2025-23042 · Other software · gradio-app · reported by GitHubHigh 8.7
Gradio is an open-source Python package that allows quick building of demos and web application for machine learning models, API, or any arbitrary Python function. Gradio's Access Control List (ACL) for file paths can be bypassed by altering the letter case of a blocked file or directory path. This vulnerability arises due to the lack of case normalization in the file path validation logic. On case-insensitive file systems, such as those used by Windows and macOS, this flaw enables attackers to circumvent security restrictions and access sensitive files that should be protected. This issue can lead to unauthorized data access, exposing sensitive information and undermining the integrity of Gradio's security model. Given Gradio's popularity for building web applications, particularly in machine learning and AI, this vulnerability may pose a substantial threat if exploited in production environments. This issue has been addressed in release version 5.6.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- gradio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2025An access control issue in the component /api/squareComment/DelectSquareById of iceCMS v2.2.0 allows unauthenticated attackers to access sensitive information.CVE-2025-22984 · Other software · Thecosy · reported by MITREHigh 7.5
An access control issue in the component /api/squareComment/DelectSquareById of iceCMS v2.2.0 allows unauthenticated attackers to access sensitive information.
- Product
- Icecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2025Incorrect Access Control in Cfx.re FXServer v9601 and earlier allows unauthenticated users to modify and read arbitrary user data via exposed API endpointCVE-2024-46310 · Other software · reported by MITRECritical 9.1
Incorrect Access Control in Cfx.re FXServer v9601 and earlier allows unauthenticated users to modify and read arbitrary user data via exposed API endpoint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2025Teedy through 1.11 allows CSRF for account takeover via POST /api/user/admin.CVE-2025-22963 · Other software · Sismics · reported by MITREHigh 7.5
Teedy through 1.11 allows CSRF for account takeover via POST /api/user/admin.
- Product
- Teedy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.teedy.iogithub.com
Jan 11, 2025In the Linux kernel, the following vulnerability has been resolved: net: tun: fix tun_napi_alloc_frags() syzbot reported the following crash [1] Issue came wCVE-2024-56372 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: net: tun: fix tun_napi_alloc_frags() syzbot reported the following crash [1] Issue came with the blamed commit. Instead of going through all the iov components, we keep using the first one and end up with a malformed skb. [1] kernel BUG at net/core/skbuff.c:2849 ! Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 0 UID: 0 PID: 6230 Comm: syz-executor132 Not tainted 6.13.0-rc1-syzkaller-00407-g96b6fcc0ee41 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/25/2024 RIP: 0010:__pskb_pull_tail+0x1568/0x1570 net/core/skbuff.c:2848 Code: 38 c1 0f 8c 32 f1 ff ff 4c 89 f7 e8 92 96 74 f8 e9 25 f1 ff ff e8 e8 ae 09 f8 48 8b 5c 24 08 e9 eb fb ff ff e8 d9 ae 09 f8 90 <0f> 0b 66 0f 1f 44 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 RSP: 0018:ffffc90004cbef30 EFLAGS: 00010293 RAX: ffffffff8995c347 RBX: 00000000fffffff2 RCX: ffff88802cf45a00 RDX: 0000000000000000 RSI: 00000000fffffff2 RDI: 0000000000000000 RBP: ffff88807df0c06a R08: ffffffff8995b084 R09: 1ffff1100fbe185c R10: dffffc0000000000 R11: ffffed100fbe185d R12: ffff888076e85d50 R13: ffff888076e85c80 R14: ffff888076e85cf4
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jan 9, 2025Vaultwarden v1.32.5 was discovered to contain an authenticated reflected cross-site scripting (XSS) vulnerability via the component /api/core/mod.rs.CVE-2024-55226 · Other software · Dani-garcia · reported by MITREMedium 5.4
Vaultwarden v1.32.5 was discovered to contain an authenticated reflected cross-site scripting (XSS) vulnerability via the component /api/core/mod.rs.
- Product
- Vaultwarden
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2025An issue in the component src/api/identity.rs of Vaultwarden prior to v1.32.5 allows attackers to impersonate users, including Administrators, via a crafted autCVE-2024-55225 · Other software · Dani-garcia · reported by MITRECritical 9.8
An issue in the component src/api/identity.rs of Vaultwarden prior to v1.32.5 allows attackers to impersonate users, including Administrators, via a crafted authorization request.
- Product
- Vaultwarden
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.