Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
8,140 results · page 75 of 163
Jan 9, 2025Strawberry GraphQL is a library for creating GraphQL APIs.CVE-2025-22151 · Other software · strawberry-graphql · reported by GitHubLow 3.7
Strawberry GraphQL is a library for creating GraphQL APIs. Starting in 0.182.0 and prior to version 0.257.0, a type confusion vulnerability exists in Strawberry GraphQL's relay integration that affects multiple ORM integrations (Django, SQLAlchemy, Pydantic). The vulnerability occurs when multiple GraphQL types are mapped to the same underlying model while using the relay node interface. When querying for a specific type using the global node field (e.g., FruitType:some-id), the resolver may incorrectly return an instance of a different type mapped to the same model (e.g., SpecialFruitType). This can lead to information disclosure if the alternate type exposes sensitive fields and potential privilege escalation if the alternate type contains data intended for restricted access. This vulnerability is fixed in 0.257.0.
- Product
- strawberry
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2025Incorrect Authorization vulnerability in Drupal Drupal REST & JSON API Authentication allows Forceful Browsing.This issue affects Drupal REST & JSON API AuthentCVE-2024-13258 · Websites & servers · Drupal · reported by mlhess@drupal.orgCritical 9.8
Incorrect Authorization vulnerability in Drupal Drupal REST & JSON API Authentication allows Forceful Browsing.This issue affects Drupal REST & JSON API Authentication: from 0.0.0 before 2.0.13.
- Product
- Drupal REST & JSON API Authentication
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2025SEMA API: Reflected Cross-Site ScriptingCVE-2024-12285 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The SEMA API plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘catid’ parameter in all versions up to, and including, 5.27 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- SEMA API
- Affected
- up to 5.27
- What to do
- Affects up to 5.27. Update SEMA API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Jan 9, 2025Skyword API: Stored Cross-Site ScriptingCVE-2024-11907 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Skyword API Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'skyword_iframe' shortcode in all versions up to, and including, 2.5.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Skyword API
- Affected
- up to 2.5.2
- What to do
- Affects up to 2.5.2. Update Skyword API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 8, 2025There is a potential DOM based cross-site scripting issue in rails-ujs which leverages the Clipboard API to target HTML elements that are assigned the contentedCVE-2023-23913 · Other software · Rails · reported by support@hackerone.comMedium 6.3
There is a potential DOM based cross-site scripting issue in rails-ujs which leverages the Clipboard API to target HTML elements that are assigned the contenteditable attribute. This has the potential to occur when pasting malicious HTML content from the clipboard that includes a data-method, data-remote or data-disable-with attribute.
- Product
- rails-ujs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.debian.orgdiscuss.rubyonrails.org
Jan 7, 2025Vulnerability of native APIs not being implemented in the NFC service module Impact: Successful exploitation of this vulnerability may cause features to performCVE-2024-56442 · Other software · Huawei · reported by psirt@huawei.comMedium 5.5
Vulnerability of native APIs not being implemented in the NFC service module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025Lack of output escaping in the id attribute of menu lists.CVE-2024-40748 · Websites & servers · Joomla! Project · reported by security@joomla.orgHigh 7.5
Lack of output escaping in the id attribute of menu lists.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025The WebChannel API, which is used to transport various information across processes, did not check the sending principal but rather accepted the principal beingCVE-2025-0237 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 5.4
The WebChannel API, which is used to transport various information across processes, did not check the sending principal but rather accepted the principal being sent. This could have led to privilege escalation attacks. This vulnerability was fixed in Firefox 134, Firefox ESR 128.6, Thunderbird 134, and Thunderbird 128.6.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Jan 7, 2025IBM Cognos Controller 11.0.0 through 11.0.1 and IBM Controller 11.1.0 is vulnerable to exposure of Artifactory API keys.CVE-2024-28778 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM Cognos Controller 11.0.0 through 11.0.1 and IBM Controller 11.1.0 is vulnerable to exposure of Artifactory API keys. This vulnerability allows users to publish code to private packages or repositories under the name of the organization.
- Product
- Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2025information disclosure while invoking the mailbox read API.CVE-2024-43063 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 6.1
information disclosure while invoking the mailbox read API.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2025Information Disclosure while invoking the mailbox write API when message received from user is larger than mailbox size.CVE-2024-23366 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 6.6
Information Disclosure while invoking the mailbox write API when message received from user is larger than mailbox size.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2025In Exynos_parsing_user_data_registered_itu_t_t35 of VendorVideoAPI.cpp, there is a possible out of bounds write due to an incorrect bounds check.CVE-2024-53838 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comHigh 7.8
In Exynos_parsing_user_data_registered_itu_t_t35 of VendorVideoAPI.cpp, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2024Tapir is a private Terraform registry.CVE-2024-56802 · Other software · PacoVK · reported by GitHubHigh 8.7
Tapir is a private Terraform registry. Tapir versions 0.9.0 and 0.9.1 are facing a critical issue with scope-able Deploykeys where attackers can guess the key to get write access to the registry. User must upgrade to 0.9.2.
- Product
- tapir
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2024In WhatsUp Gold versions released before 2024.0.2, an attacker can gain access to the WhatsUp Gold server via the public API.CVE-2024-12108 · Other software · Progress Software Corporation · reported by security@progress.comCritical 9.6
In WhatsUp Gold versions released before 2024.0.2, an attacker can gain access to the WhatsUp Gold server via the public API.
- Product
- WhatsUp Gold
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2024Hunk Companion: Does not correctly authorize some REST API endpointsCVE-2024-11972 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Hunk Companion WordPress plugin before 1.9.0 does not correctly authorize some REST API endpoints, allowing unauthenticated requests to install and activate arbitrary Hunk Companion WordPress plugin before 1.9.0 from the WordPress.org repo, including vulnerable Hunk Companion WordPress plugin before 1.9.0 that have been closed.
- Product
- Hunk Companion
- Fixed in
- 1.9.0
- What to do
- Update Hunk Companion to 1.9.0 or newer.
Dec 30, 2024free-one-api allows users to access large language model reverse engineering libraries through the standard OpenAI API format.CVE-2024-56516 · Other software · RockChinQ · reported by GitHubMedium 6.9
free-one-api allows users to access large language model reverse engineering libraries through the standard OpenAI API format. In versions up to and including 1.0.1, MD5 is used to hash passwords before sending them to the backend. MD5 is a cryptographically broken hashing algorithm and is no longer considered secure for password storage or transmission. It is vulnerable to collision attacks and can be easily cracked using modern hardware, exposing user credentials to potential compromise. As of time of publication, a replacement for MD5 has not been committed to the free-one-api GitHub repository.
- Product
- free-one-api
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 30, 2024A Server-Side Request Forgery (SSRF) vulnerability exists in the POST /worker_generate_stream API endpoint of the Controller API Server in lm-sys/fastchat, as oCVE-2024-10044 · Other software · lm-sys · reported by security@huntr.devCritical 9.3
A Server-Side Request Forgery (SSRF) vulnerability exists in the POST /worker_generate_stream API endpoint of the Controller API Server in lm-sys/fastchat, as of commit e208d5677c6837d590b81cb03847c0b9de100765. This vulnerability allows attackers to exploit the victim controller API server's credentials to perform unauthorized web actions or access unauthorized web resources by combining it with the POST /register_worker endpoint.
- Product
- lm-sys/fastchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2024In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix TSO DMA API usage causing oops Commit 66600fac7a98 ("net: stmmac: TSO: FiCVE-2024-56719 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Critical 10
In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix TSO DMA API usage causing oops Commit 66600fac7a98 ("net: stmmac: TSO: Fix unbalanced DMA map/unmap for non-paged SKB data") moved the assignment of tx_skbuff_dma[]'s members to be later in stmmac_tso_xmit(). The buf (dma cookie) and len stored in this structure are passed to dma_unmap_single() by stmmac_tx_clean(). The DMA API requires that the dma cookie passed to dma_unmap_single() is the same as the value returned from dma_map_single(). However, by moving the assignment later, this is not the case when priv->dma_cap.addr64 > 32 as "des" is offset by proto_hdr_len. This causes problems such as: dwc-eth-dwmac 2490000.ethernet eth0: Tx DMA map failed and with DMA_API_DEBUG enabled: DMA-API: dwc-eth-dwmac 2490000.ethernet: device driver tries to +free DMA memory it has not allocated [device address=0x000000ffffcf65c0] [size=66 bytes] Fix this by maintaining "des" as the original DMA cookie, and use tso_des to pass the offset DMA cookie to stmmac_tso_allocator(). Full details of the crashes can be found at: https://lore.kernel.org/all/d8112193-0386-4e14-b516-37c2d838171a@nvidia.com/ htt
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Dec 27, 2024HarfBuzz is a text shaping engine.CVE-2024-56732 · Other software · harfbuzz · reported by GitHubCritical 9.3
HarfBuzz is a text shaping engine. Starting with 8.5.0 through 10.0.1, there is a heap-based buffer overflow in the hb_cairo_glyphs_from_buffer function.
- Product
- harfbuzz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2024In the Linux kernel, the following vulnerability has been resolved: gpio: graniterapids: Fix vGPIO driver crash Move setting irq_chip.name from probe() functiCVE-2024-56671 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: gpio: graniterapids: Fix vGPIO driver crash Move setting irq_chip.name from probe() function to the initialization of "irq_chip" struct in order to fix vGPIO driver crash during bootup. Crash was caused by unauthorized modification of irq_chip.name field where irq_chip struct was initialized as const. This behavior is a consequence of suboptimal implementation of gpio_irq_chip_set_chip(), which should be changed to avoid casting away const qualifier. Crash log: BUG: unable to handle page fault for address: ffffffffc0ba81c0 /#PF: supervisor write access in kernel mode /#PF: error_code(0x0003) - permissions violation CPU: 33 UID: 0 PID: 1075 Comm: systemd-udevd Not tainted 6.12.0-rc6-00077-g2e1b3cc9d7f7 #1 Hardware name: Intel Corporation Kaseyville RP/Kaseyville RP, BIOS KVLDCRB1.PGS.0026.D73.2410081258 10/08/2024 RIP: 0010:gnr_gpio_probe+0x171/0x220 [gpio_graniterapids]
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Dec 18, 2024In ThreatQuotient ThreatQ before 5.29.3, authenticated users are able to execute arbitrary commands by sending a crafted request to an API endpoint.CVE-2024-39703 · Other software · ThreatQuotient · reported by MITREHigh 8.7
In ThreatQuotient ThreatQ before 5.29.3, authenticated users are able to execute arbitrary commands by sending a crafted request to an API endpoint.
- Product
- ThreatQ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordthreatq.freshdesk.comcisa.gov
Dec 18, 2024An incomplete fix for ose-olm-catalogd-container was issued for the Rapid Reset Vulnerability (CVE-2023-39325/CVE-2023-44487) where only unauthenticated streamsCVE-2024-12698 · Other software · Red Hat · reported by Red HatMedium 6.5
An incomplete fix for ose-olm-catalogd-container was issued for the Rapid Reset Vulnerability (CVE-2023-39325/CVE-2023-44487) where only unauthenticated streams were protected, not streams created by authenticated sources.
- Product
- Red Hat OpenShift Container Platform 4.18
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Dec 16, 2024Events Calendar: Is missing access checks in the REST APICVE-2024-5333 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Events Calendar WordPress plugin before 6.8.2.1 is missing access checks in the REST API, allowing for unauthenticated users to access information about password protected events.
- Product
- Events Calendar
- Fixed in
- 6.8.2.1
- What to do
- Update Events Calendar to 6.8.2.1 or newer.
Dec 13, 2024APIExperts Square for WooCommerce: Missing AuthorizationCVE-2022-47182 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Wpexpertsio APIExperts Square for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects APIExperts Square for WooCommerce: from n/a through 4.4.1.
- Product
- APIExperts Square for WooCommerce
- Affected
- up to 4.4.1
- What to do
- Affects up to 4.4.1. Update APIExperts Square for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024MStore API – Create Native Android & iOS Apps On The Cloud: Stored Cross-Site ScriptingCVE-2024-12042 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the profile picture upload functionality in all versions up to, and including, 4.16.4 due to insufficient file type validation. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload HTML files with arbitrary web scripts that will execute whenever a user accesses the file.
- Product
- MStore API – Create Native Android & iOS Apps On The Cloud
- Affected
- up to 4.16.4
- What to do
- Affects up to 4.16.4. Update MStore API – Create Native Android & iOS Apps On The Cloud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 13, 2024External Control of File Name or Path vulnerability in PlexTrac allows Local Code Inclusion through use of an undocumented API endpoint.This issue affects PlexTCVE-2024-11838 · Other software · PlexTrac · reported by 5fea7123-217b-4b2d-ada8-8892719b43cdHigh 8.6
External Control of File Name or Path vulnerability in PlexTrac allows Local Code Inclusion through use of an undocumented API endpoint.This issue affects PlexTrac: from 1.61.3 before 2.8.1.
- Product
- PlexTrac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2024AI Engine: Does not sanitize and escape a parameter from one of its RESP API endpoint before using it in a SQL statementCVE-2024-10499 · WordPress plugins & themes · reported by WPScanHigh 7.2
The AI Engine WordPress plugin before 2.6.5 does not sanitize and escape a parameter from one of its RESP API endpoint before using it in a SQL statement, allowing admins to perform SQL injection attacks
- Product
- AI Engine
- Fixed in
- 2.6.5
- What to do
- Update AI Engine to 2.6.5 or newer.
Dec 12, 2024Planaday API: Reflected Cross-Site ScriptingCVE-2024-11804 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Planaday API plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 11.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Planaday API
- Affected
- up to 11.4
- What to do
- Affects up to 11.4. Update Planaday API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 11, 2024Ultimate Endpoints With Rest Api: Reflected Cross-Site ScriptingCVE-2024-12260 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Ultimate Endpoints With Rest Api plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 2.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Ultimate Endpoints With Rest Api
- Affected
- up to 2.2.2
- What to do
- Affects up to 2.2.2. Update Ultimate Endpoints With Rest Api to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 11, 2024Windows IP Routing Management Snapin Remote Code Execution VulnerabilityCVE-2024-49080 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Windows IP Routing Management Snapin Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1507
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2024RapidLoad – Optimize Web Vitals Automatically: Unauthorized access of data and modification of dataCVE-2024-11840 · WordPress plugins & themes · reported by WordfenceHigh 7.1
The RapidLoad – Optimize Web Vitals Automatically plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the uucss_data, update_rapidload_settings, wp_ajax_update_htaccess_file, uucss_update_rule, upload_rules, get_all_rules, update_titan_settings, preload_page, and activate_module functions in all versions up to, and including, 2.4.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify plugin settings or conduct SQL injection attacks.
- Product
- RapidLoad – Optimize Web Vitals Automatically
- Affected
- up to 2.4.2
- What to do
- Affects up to 2.4.2. Update RapidLoad – Optimize Web Vitals Automatically to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 11, 2024Rapid7 Insight Platform versions prior to November 13th 2024, suffer from a privilege escalation vulnerability whereby, due to a lack of authorization checks, aCVE-2024-11401 · Other software · Rapid7 · reported by cve@rapid7.comMedium 5.3
Rapid7 Insight Platform versions prior to November 13th 2024, suffer from a privilege escalation vulnerability whereby, due to a lack of authorization checks, an attacker can successfully update the password policy in the platform settings as a standard user by crafting an API (the functionality was not possible through the platform's User Interface). This vulnerability has been fixed as of November 13th 2024.
- Product
- Insight Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024Cross-Site Request Forgery (CSRF) in Avenwu Whistle v.2.9.90 and before allows attackers to perform malicious API calls, resulting in the execution of arbitraryCVE-2024-55500 · Other software · reported by MITREHigh 8.8
Cross-Site Request Forgery (CSRF) in Avenwu Whistle v.2.9.90 and before allows attackers to perform malicious API calls, resulting in the execution of arbitrary code on the victim's machine.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsonarsource.com
Dec 10, 2024An out of bounds read due to improper input validation in HeapObjMapImpl.cpp in NI LabVIEW may disclose information or result in arbitrary code execution.CVE-2024-10494 · Other software · NI · reported by security@ni.comHigh 8.4
An out of bounds read due to improper input validation in HeapObjMapImpl.cpp in NI LabVIEW may disclose information or result in arbitrary code execution. Successful exploitation requires an attacker to provide a user with a specially crafted VI. This vulnerability affects LabVIEW 2024 Q3 and prior versions.
- Product
- LabVIEW
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024A security issue exists in Vertex Gemini API for customers using VPC-SC.CVE-2024-12236 · Computers, phones & browsers · Google Cloud Platform · reported by cve-coordination@google.comMedium 6.8
A security issue exists in Vertex Gemini API for customers using VPC-SC. By utilizing a custom crafted file URI for image input, data exfiltration is possible due to requests being routed outside the VPC-SC security perimeter, circumventing the intended security restrictions of VPC-SC. No further fix actions are needed. Google Cloud Platform implemented a fix to return an error message when a media file URL is specified in the fileUri parameter and VPC Service Controls is enabled. Other use cases are unaffected.
- Product
- Vertex Gemini API
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2024Webservice API endpoints for Assisted Service Module within SAP Commerce Cloud has information disclosure vulnerability.CVE-2024-47577 · Websites & servers · SAP_SE · reported by cna@sap.comLow 2.7
Webservice API endpoints for Assisted Service Module within SAP Commerce Cloud has information disclosure vulnerability. When an authorized agent searches for customer to manage their accounts, the request url includes customer data and it is recorded in server logs. If an attacker impersonating as authorized admin visits such server logs, then they get access to the customer data. The amount of leaked confidential data however is extremely limited, and the attacker has no control over what data is leaked.
- Product
- SAP Commerce Cloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2024Directus is a real-time API and App dashboard for managing SQL database content.CVE-2024-54151 · Other software · directus · reported by GitHubHigh 7.5
Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 11.0.0 and prior to version 11.3.0, when setting `WEBSOCKETS_GRAPHQL_AUTH` or `WEBSOCKETS_REST_AUTH` to "public", an unauthenticated user is able to do any of the supported operations (CRUD, subscriptions) with full admin privileges. This impacts any Directus instance that has either `WEBSOCKETS_GRAPHQL_AUTH` or `WEBSOCKETS_REST_AUTH` set to `public` allowing unauthenticated users to subscribe for changes on any collection or do REST CRUD operations on user defined collections ignoring permissions. Version 11.3.0 fixes the issue.
- Product
- directus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2024Improper Authorization vulnerability in Apache Superset when FAB_ADD_SECURITY_API is enabled (disabled by default).CVE-2024-53949 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.6
Improper Authorization vulnerability in Apache Superset when FAB_ADD_SECURITY_API is enabled (disabled by default). Allows for lower privilege users to use this API. issue affects Apache Superset: from 2.0.0 before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue.
- Product
- Apache Superset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Dec 9, 2024Contact Form to Any API: Missing AuthorizationCVE-2023-47871 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in IT Path Solutions Contact Form to Any API allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form to Any API: from n/a through 1.1.6.
- Product
- Contact Form to Any API
- Affected
- up to 1.1.6
- What to do
- Affects up to 1.1.6. Update Contact Form to Any API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 7, 2024Mini Program API: Stored Cross-Site ScriptingCVE-2024-11380 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Mini Program API plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'qvideo' shortcode in all versions up to, and including, 1.4.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Mini Program API
- Affected
- up to 1.4.5
- What to do
- Affects up to 1.4.5. Update Mini Program API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Dec 6, 2024A flaw was found in Rustls 0.23.13 and related APIs.CVE-2024-11738 · Other software · Red Hat · reported by Red HatMedium 5.3
A flaw was found in Rustls 0.23.13 and related APIs. This vulnerability allows denial of service (panic) via a fragmented TLS ClientHello message.
- Product
- Red Hat Trusted Artifact Signer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Dec 6, 2024Unauthenticated CROWN APIs allow access to critical functions.CVE-2024-10774 · Other software · SICK AG · reported by psirt@sick.deHigh 7.3
Unauthenticated CROWN APIs allow access to critical functions. This leads to the accessibility of large parts of the web application without authentication.
- Product
- SICK InspectorP61x
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2024Directus is a real-time API and App dashboard for managing SQL database content.CVE-2024-54128 · Other software · directus · reported by GitHubMedium 5.7
Directus is a real-time API and App dashboard for managing SQL database content. The Comment feature has implemented a filter to prevent users from adding restricted characters, such as HTML tags. However, this filter operates on the client-side, which can be bypassed, making the application vulnerable to HTML Injection. This vulerability is fixed in 10.13.4 and 11.2.0.
- Product
- directus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2024Incorrect authorization vulnerability in ActionRule webapi component in Synology Surveillance Station before 9.2.0-11289 and 9.2.0-9289 allows remote authenticaCVE-2023-52944 · Network & remote access · Synology · reported by security@synology.comMedium 4.3
Incorrect authorization vulnerability in ActionRule webapi component in Synology Surveillance Station before 9.2.0-11289 and 9.2.0-9289 allows remote authenticated users to perform limited actions on the set action rules function via unspecified vectors.
- Product
- Surveillance Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2024Incorrect authorization vulnerability in Alert.Setting webapi component in Synology Surveillance Station before 9.2.0-11289 and 9.2.0-9289 allows remote authentCVE-2023-52943 · Network & remote access · Synology · reported by security@synology.comMedium 4.3
Incorrect authorization vulnerability in Alert.Setting webapi component in Synology Surveillance Station before 9.2.0-11289 and 9.2.0-9289 allows remote authenticated users to to perform limited actions on the alerting function via unspecified vectors.
- Product
- Surveillance Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2024An issue in InfoDom Performa 365 v4.0.1 allows authenticated attackers to elevate their privileges to Administrator via a crafted payload sent to /api/users.CVE-2024-46624 · Other software · infodom · reported by MITREHigh 8.8
An issue in InfoDom Performa 365 v4.0.1 allows authenticated attackers to elevate their privileges to Administrator via a crafted payload sent to /api/users.
- Product
- performa_365
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2024JFinal CMS 5.1.0 is vulnerable to Command Execution via unauthorized execution of deserialization in the file ApiForm.javaCVE-2024-53477 · Other software · Jflyfox · reported by MITRECritical 9.8
JFinal CMS 5.1.0 is vulnerable to Command Execution via unauthorized execution of deserialization in the file ApiForm.java
- Product
- Jfinal CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Dec 2, 2024In WhatsUp Gold versions released before 2024.0.1, a remote unauthenticated attacker could leverage NmAPI.exe to create or change an existing registry value in CVE-2024-8785 · Other software · Progress Software Corporation · reported by security@progress.comCritical 9.8
In WhatsUp Gold versions released before 2024.0.1, a remote unauthenticated attacker could leverage NmAPI.exe to create or change an existing registry value in registry path HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Ipswitch\.
- Product
- WhatsUp Gold
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.progress.comdocs.progress.com
Dec 2, 2024Memory corruption while processing API calls to NPU with invalid input.CVE-2024-43052 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory corruption while processing API calls to NPU with invalid input.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2024Memory corruption when invalid input is passed to invoke GPU Headroom API call.CVE-2024-43048 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory corruption when invalid input is passed to invoke GPU Headroom API call.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.