Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,599 results · page 8 of 52
Jun 28, 2024HCL DRYiCE AEX product is impacted by lack of input validation vulnerability in a particular web application.CVE-2024-30110 · Other software · HCL Software · reported by psirt@hcl.comLow 3.7
HCL DRYiCE AEX product is impacted by lack of input validation vulnerability in a particular web application. A malicious script can be injected into a system which can cause the system to behave in unexpected ways.
- Product
- DRYiCE AEX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Jun 28, 2024HCL DRYiCE AEX is impacted by a lack of clickjacking protection in the AEX web application.CVE-2024-30109 · Other software · HCL Software · reported by psirt@hcl.comLow 3.7
HCL DRYiCE AEX is impacted by a lack of clickjacking protection in the AEX web application. An attacker can use multiple transparent or opaque layers to trick a user into clicking on a button or link on another page than the one intended.
- Product
- DRYiCE AEX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Jun 27, 2024This Advisory describes an issue that impacts Arista Wireless Access Points.CVE-2024-4578 · Other software · Arista Networks · reported by psirt@arista.comHigh 8.4
This Advisory describes an issue that impacts Arista Wireless Access Points. Any entity with the ability to authenticate via SSH to an affected AP as the “config” user is able to cause a privilege escalation via spawning a bash shell. The SSH CLI session does not require high permissions to exploit this vulnerability, but the config password is required to establish the session. The spawned shell is able to obtain root privileges.
- Product
- Arista Wireless Access Points
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2024HCL DRYiCE Optibot Reset Station is impacted by an Unused Parameter in the web application.CVE-2024-30120 · Other software · HCL Software · reported by psirt@hcl.comLow 2.9
HCL DRYiCE Optibot Reset Station is impacted by an Unused Parameter in the web application.
- Product
- DRYiCE Optibot Reset Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Jun 14, 2024HCL DRYiCE Optibot Reset Station is impacted by a missing Strict Transport Security Header.CVE-2024-30119 · Other software · HCL Software · reported by psirt@hcl.comLow 3.7
HCL DRYiCE Optibot Reset Station is impacted by a missing Strict Transport Security Header. This could allow an attacker to intercept or manipulate data during redirection.
- Product
- DRYiCE Optibot Reset Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Jun 14, 2024Function vulnerabilities in the Calendar module Impact: Successful exploitation of this vulnerability will affect availability.CVE-2024-5465 · Other software · Huawei · reported by psirt@huawei.comMedium 5.9
Function vulnerabilities in the Calendar module Impact: Successful exploitation of this vulnerability will affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Jun 14, 2024Vulnerability of insufficient permission verification in the NearLink module Impact: Successful exploitation of this vulnerability may affect service confidentiCVE-2024-5464 · Other software · Huawei · reported by psirt@huawei.comMedium 4
Vulnerability of insufficient permission verification in the NearLink module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Jun 14, 2024Memory management vulnerability in the Gralloc module Impact: Successful exploitation of this vulnerability will affect availability.CVE-2024-36503 · Other software · Huawei · reported by psirt@huawei.comHigh 7.3
Memory management vulnerability in the Gralloc module Impact: Successful exploitation of this vulnerability will affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Jun 14, 2024Out-of-bounds read vulnerability in the audio module Impact: Successful exploitation of this vulnerability will affect availability.CVE-2024-36502 · Other software · Huawei · reported by psirt@huawei.comHigh 7.9
Out-of-bounds read vulnerability in the audio module Impact: Successful exploitation of this vulnerability will affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Jun 14, 2024Memory management vulnerability in the boottime module Impact: Successful exploitation of this vulnerability can affect integrity.CVE-2024-36501 · Other software · Huawei · reported by psirt@huawei.comMedium 5.6
Memory management vulnerability in the boottime module Impact: Successful exploitation of this vulnerability can affect integrity.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Jun 14, 2024Privilege escalation vulnerability in the AMS module Impact: Successful exploitation of this vulnerability may affect service confidentiality.CVE-2024-36500 · Other software · Huawei · reported by psirt@huawei.comHigh 7.8
Privilege escalation vulnerability in the AMS module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Jun 14, 2024Vulnerability of unauthorized screenshot capturing in the WMS module Impact: Successful exploitation of this vulnerability may affect service confidentiality.CVE-2024-36499 · Other software · Huawei · reported by psirt@huawei.comMedium 6.8
Vulnerability of unauthorized screenshot capturing in the WMS module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
May 28, 2024HCL DRYiCE Optibot Reset Station is impacted by insecure encryption of One-Time Passwords (OTPs).CVE-2024-23580 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.5
HCL DRYiCE Optibot Reset Station is impacted by insecure encryption of One-Time Passwords (OTPs). This could allow an attacker with access to the database to recover some or all encrypted values.
- Product
- DRYiCE Optibot Reset Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
May 28, 2024HCL DRYiCE Optibot Reset Station is impacted by insecure encryption of security questions.CVE-2024-23579 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.5
HCL DRYiCE Optibot Reset Station is impacted by insecure encryption of security questions. This could allow an attacker with access to the database to recover some or all encrypted values.
- Product
- DRYiCE Optibot Reset Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
May 14, 2024Cracking vulnerability in the OS security module Impact: Successful exploitation of this vulnerability will affect availability.CVE-2024-4046 · Other software · Huawei · reported by psirt@huawei.comMedium 6.4
Cracking vulnerability in the OS security module Impact: Successful exploitation of this vulnerability will affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
May 14, 2024Cracking vulnerability in the OS security module Impact: Successful exploitation of this vulnerability will affect availability.CVE-2024-32999 · Other software · Huawei · reported by psirt@huawei.comMedium 6.8
Cracking vulnerability in the OS security module Impact: Successful exploitation of this vulnerability will affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
May 14, 2024NULL pointer access vulnerability in the clock module Impact: Successful exploitation of this vulnerability will affect availability.CVE-2024-32998 · Other software · Huawei · reported by psirt@huawei.comMedium 5.9
NULL pointer access vulnerability in the clock module Impact: Successful exploitation of this vulnerability will affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
May 14, 2024Race condition vulnerability in the binder driver module Impact: Successful exploitation of this vulnerability will affect availability.CVE-2024-32997 · Other software · Huawei · reported by psirt@huawei.comHigh 8.4
Race condition vulnerability in the binder driver module Impact: Successful exploitation of this vulnerability will affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
May 14, 2024Privilege escalation vulnerability in the account module Impact: Successful exploitation of this vulnerability will affect availability.CVE-2024-32996 · Other software · Huawei · reported by psirt@huawei.comMedium 6.2
Privilege escalation vulnerability in the account module Impact: Successful exploitation of this vulnerability will affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
May 14, 2024Denial of service (DoS) vulnerability in the AMS module Impact: Successful exploitation of this vulnerability will affect availability.CVE-2024-32995 · Other software · Huawei · reported by psirt@huawei.comMedium 6.2
Denial of service (DoS) vulnerability in the AMS module Impact: Successful exploitation of this vulnerability will affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
May 14, 2024Out-of-bounds access vulnerability in the memory module Impact: Successful exploitation of this vulnerability will affect availability.CVE-2024-32993 · Other software · Huawei · reported by psirt@huawei.comMedium 5.6
Out-of-bounds access vulnerability in the memory module Impact: Successful exploitation of this vulnerability will affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
May 14, 2024Insufficient verification vulnerability in the baseband module Impact: Successful exploitation of this vulnerability will affect availability.CVE-2024-32992 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
Insufficient verification vulnerability in the baseband module Impact: Successful exploitation of this vulnerability will affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
May 14, 2024Permission verification vulnerability in the wpa_supplicant module Impact: Successful exploitation of this vulnerability will affect availability.CVE-2024-32991 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
Permission verification vulnerability in the wpa_supplicant module Impact: Successful exploitation of this vulnerability will affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
May 14, 2024Permission verification vulnerability in the system sharing pop-up module Impact: Successful exploitation of this vulnerability will affect availability.CVE-2024-32990 · Other software · Huawei · reported by psirt@huawei.comMedium 6.1
Permission verification vulnerability in the system sharing pop-up module Impact: Successful exploitation of this vulnerability will affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
May 14, 2024Insufficient verification vulnerability in the system sharing pop-up module Impact: Successful exploitation of this vulnerability will affect availability.CVE-2024-32989 · Other software · Huawei · reported by psirt@huawei.comLow 3.3
Insufficient verification vulnerability in the system sharing pop-up module Impact: Successful exploitation of this vulnerability will affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
May 14, 2024Race condition vulnerability in the soundtrigger module Impact: Successful exploitation of this vulnerability will affect availability.CVE-2023-52720 · Other software · Huawei · reported by psirt@huawei.comMedium 4.1
Race condition vulnerability in the soundtrigger module Impact: Successful exploitation of this vulnerability will affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
May 14, 2024Privilege escalation vulnerability in the PMS module Impact: Successful exploitation of this vulnerability may affect service confidentiality.CVE-2023-52719 · Other software · Huawei · reported by psirt@huawei.comHigh 7.1
Privilege escalation vulnerability in the PMS module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
May 14, 2024Double-free vulnerability in the RSMC module Impact: Successful exploitation of this vulnerability will affect availability.CVE-2023-52384 · Other software · Huawei · reported by psirt@huawei.comMedium 4.7
Double-free vulnerability in the RSMC module Impact: Successful exploitation of this vulnerability will affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
May 14, 2024Double-free vulnerability in the RSMC module Impact: Successful exploitation of this vulnerability will affect availability.CVE-2023-52383 · Other software · Huawei · reported by psirt@huawei.comMedium 4.7
Double-free vulnerability in the RSMC module Impact: Successful exploitation of this vulnerability will affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
May 7, 2024No Limit on Number of Open Sessions / Bad Session Close Behaviour in dnf5daemon-server before 5.1.17 allows a malicious user to impact Availability via No LimiCVE-2024-1930 · Other software · Fedora · reported by patrick@puiterwijk.orgMedium 6.5
No Limit on Number of Open Sessions / Bad Session Close Behaviour in dnf5daemon-server before 5.1.17 allows a malicious user to impact Availability via No Limit on Number of Open Sessions. There is no limit on how many sessions D-Bus clients may create using the `open_session()` D-Bus method. For each session a thread is created in dnf5daemon-server. This spends a couple of hundred megabytes of memory in the process. Further connections will become impossible, likely because no more threads can be spawned by the D-Bus service.
- Product
- dnf5daemon-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
May 7, 2024Local Root Exploit via Configuration Dictionary in dnf5daemon-server before 5.1.17 allows a malicious user to impact Confidentiality and Integrity via ConfigurCVE-2024-1929 · Other software · Fedora · reported by patrick@puiterwijk.orgHigh 7.5
Local Root Exploit via Configuration Dictionary in dnf5daemon-server before 5.1.17 allows a malicious user to impact Confidentiality and Integrity via Configuration Dictionary. There are issues with the D-Bus interface long before Polkit is invoked. The `org.rpm.dnf.v0.SessionManager.open_session` method takes a key/value map of configuration entries. A sub-entry in this map, placed under the "config" key, is another key/value map. The configuration values found in it will be forwarded as configuration overrides to the `libdnf5::Base` configuration. Practically all libdnf5 configuration aspects can be influenced here. Already when opening the session via D-Bus, the libdnf5 will be initialized using these override configuration values. There is no sanity checking of the content of this "config" map, which is untrusted data. It is possible to make the library loading a plug-in shared library under control of an unprivileged user, hence achieving root access.
- Product
- dnf5daemon-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Apr 9, 2024HCL DRYiCE MyXalytics is impacted by an insecure SQL interface vulnerability, potentially giving an attacker the ability to execute custom SQL queries.CVE-2023-50347 · Other software · HCL Software · reported by psirt@hcl.comLow 3.7
HCL DRYiCE MyXalytics is impacted by an insecure SQL interface vulnerability, potentially giving an attacker the ability to execute custom SQL queries. A malicious user can run arbitrary SQL commands including changing system configuration.
- Product
- DRYiCE MyXalytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Apr 8, 2024Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impact summary: An attacker may exCVE-2024-2511 · Websites & servers · OpenSSL · reported by openssl-security@openssl.orgMedium 5.9
Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impact summary: An attacker may exploit certain server configurations to trigger unbounded memory growth that would lead to a Denial of Service This problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is being used (but not if early_data support is also configured and the default anti-replay protection is in use). In this case, under certain conditions, the session cache can get into an incorrect state and it will fail to flush properly as it fills. The session cache will continue to grow in an unbounded manner. A malicious client could deliberately create the scenario for this failure to force a Denial of Service. It may also happen by accident in normal operation. This issue only affects TLS servers supporting TLSv1.3. It does not affect TLS clients. The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL 1.0.2 is also not affected by this issue.
- Product
- OpenSSL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2024A Speculative Race Condition (SRC) vulnerability that impacts modern CPU architectures supporting speculative execution (related to Spectre V1) has been disclosCVE-2024-2193 · Other software · AMD · reported by cret@cert.orgMedium 5.7
A Speculative Race Condition (SRC) vulnerability that impacts modern CPU architectures supporting speculative execution (related to Spectre V1) has been disclosed. An unauthenticated attacker can exploit this vulnerability to disclose arbitrary data from the CPU using race conditions to access the speculative executable code paths.
- Product
- CPU
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comdownload.vusec.net
Mar 13, 2024This vulnerability potentially allows files on a PaperCut NG/MF server to be exposed using a specifically formed payload against the impacted API endpoint.CVE-2024-1221 · Other software · PaperCut · reported by eb41dac7-0af8-4f84-9f6d-0272772514f4Low 3.1
This vulnerability potentially allows files on a PaperCut NG/MF server to be exposed using a specifically formed payload against the impacted API endpoint. The attacker must carry out some reconnaissance to gain knowledge of a system token. This CVE only affects Linux and macOS PaperCut NG/MF servers.
- Product
- PaperCut NG, PaperCut MF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpapercut.compapercut.com
Mar 11, 2024Under certain conditions SAP NetWeaver WSRM - version 7.50, allows an attacker to access information which would otherwise be restricted, causing low impact on CVE-2024-25644 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.3
Under certain conditions SAP NetWeaver WSRM - version 7.50, allows an attacker to access information which would otherwise be restricted, causing low impact on Confidentiality with no impact on Integrity and Availability of the application.
- Product
- NetWeaver (WSRM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordme.sap.comsupport.sap.com
Mar 3, 2024p2putil.c in iNet wireless daemon (IWD) through 2.15 allows attackers to cause a denial of service (daemon crash) or possibly have unspecified other impact becaCVE-2024-28084 · Other software · Intel · reported by MITREHigh 7.5
p2putil.c in iNet wireless daemon (IWD) through 2.15 allows attackers to cause a denial of service (daemon crash) or possibly have unspecified other impact because of initialization issues in situations where parsing of advertised service information fails.
- Product
- Inet Wireless Daemon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Mar 1, 2024Lack of proper input validation and constraint enforcement in Apache Ambari prior to 2.7.8 Impact : As it will be stored XSS, Could be exploited to perform CVE-2023-50378 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.1
Lack of proper input validation and constraint enforcement in Apache Ambari prior to 2.7.8 Impact : As it will be stored XSS, Could be exploited to perform unauthorized actions, varying from data access to session hijacking and delivering malicious payloads. Users are recommended to upgrade to version 2.7.8 which fixes this issue.
- Product
- Apache Ambari
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Feb 20, 2024Impact: The library offers a function to generate an ed25519 key pair via Ed25519KeyIdentity.generate with an optional param to provide a 32 byte seed value, whCVE-2024-1631 · Other software · Internet Computer · reported by 6b35d637-e00f-4228-858c-b20ad6e1d07bCritical 9.1
Impact: The library offers a function to generate an ed25519 key pair via Ed25519KeyIdentity.generate with an optional param to provide a 32 byte seed value, which will then be used as the secret key. When no seed value is provided, it is expected that the library generates the secret key using secure randomness. However, a recent change broke this guarantee and uses an insecure seed for key pair generation. Since the private key of this identity (535yc-uxytb-gfk7h-tny7p-vjkoe-i4krp-3qmcl-uqfgr-cpgej-yqtjq-rqe) is compromised, one could lose funds associated with the principal on ledgers or lose access to a canister where this principal is the controller.
- Product
- agent-js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordagent-js.icp.xyzgithub.com
Feb 9, 2024Sametime is impacted by lack of clickjacking protection in Outlook add-in.CVE-2023-45698 · Other software · HCL Software · reported by psirt@hcl.comMedium 4.8
Sametime is impacted by lack of clickjacking protection in Outlook add-in. The application is not implementing appropriate protections in order to protect users from clickjacking attacks.
- Product
- HCL Sametime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Feb 9, 2024Sametime is impacted by sensitive fields with autocomplete enabled in the Legacy web chat client.CVE-2023-45696 · Other software · HCL Software · reported by psirt@hcl.comMedium 4
Sametime is impacted by sensitive fields with autocomplete enabled in the Legacy web chat client. By default, this allows user entered data to be stored by the browser.
- Product
- HCL Sametime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Feb 9, 2024Sametime is impacted by a failure to invalidate sessions.CVE-2023-45718 · Other software · HCL Software · reported by psirt@hcl.comLow 3.9
Sametime is impacted by a failure to invalidate sessions. The application is setting sensitive cookie values in a persistent manner in Sametime Web clients. When this happens, cookie values can remain valid even after a user has closed out their session.
- Product
- HCL Sametime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Feb 9, 2024Sametime is impacted by sensitive information passed in URL.CVE-2023-45716 · Other software · HCL Software · reported by psirt@hcl.comLow 1.7
Sametime is impacted by sensitive information passed in URL.
- Product
- HCL Sametime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Feb 9, 2024Sametime is impacted by a Cross Site Request Forgery (CSRF) vulnerability.CVE-2023-50349 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.9
Sametime is impacted by a Cross Site Request Forgery (CSRF) vulnerability. Some REST APIs in the Sametime Proxy application can allow an attacker to perform malicious actions on the application.
- Product
- HCL Sametime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Jan 26, 2024Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of Service attack Impact summary: ApplicaCVE-2024-0727 · Websites & servers · OpenSSL · reported by openssl-security@openssl.orgMedium 5.5
Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of Service attack Impact summary: Applications loading files in the PKCS12 format from untrusted sources might terminate abruptly. A file in PKCS12 format can contain certificates and keys and may come from an untrusted source. The PKCS12 specification allows certain fields to be NULL, but OpenSSL does not correctly check for this case. This can lead to a NULL pointer dereference that results in OpenSSL crashing. If an application processes PKCS12 files from an untrusted source using the OpenSSL APIs then that application will be vulnerable to this issue. OpenSSL APIs that are vulnerable to this are: PKCS12_parse(), PKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes() and PKCS12_newpass(). We have also fixed a similar issue in SMIME_write_PKCS7(). However since this function is related to writing data we do not consider it security significant. The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue.
- Product
- OpenSSL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2024HCL DRYiCE MyXalytics is impacted by improper access control (Unauthenticated File Download) vulnerability.CVE-2023-50344 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.4
HCL DRYiCE MyXalytics is impacted by improper access control (Unauthenticated File Download) vulnerability. An unauthenticated user can download certain files.
- Product
- DRYiCE MyXalytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Jan 2, 2024HCL DRYiCE MyXalytics is impacted by an Improper Access Control (Controller APIs) vulnerability.CVE-2023-50343 · Other software · HCL Software · reported by psirt@hcl.comHigh 8.3
HCL DRYiCE MyXalytics is impacted by an Improper Access Control (Controller APIs) vulnerability. Certain API endpoints are accessible to Customer Admin Users that can allow access to sensitive information about other users.
- Product
- DRYiCE MyXalytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Jan 2, 2024HCL DRYiCE MyXalytics is impacted by an Insecure Direct Object Reference (IDOR) vulnerability.CVE-2023-50342 · Other software · HCL Software · reported by psirt@hcl.comHigh 7.1
HCL DRYiCE MyXalytics is impacted by an Insecure Direct Object Reference (IDOR) vulnerability. A user can obtain certain details about another user as a result of improper access control.
- Product
- DRYiCE MyXalytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Jan 2, 2024HCL DRYiCE MyXalytics is impacted by Improper Access Control (Obsolete web pages) vulnerability.CVE-2023-50341 · Other software · HCL Software · reported by psirt@hcl.comHigh 7.6
HCL DRYiCE MyXalytics is impacted by Improper Access Control (Obsolete web pages) vulnerability. Discovery of outdated and accessible web pages, reflects a "Missing Access Control" vulnerability, which could lead to inadvertent exposure of sensitive information and/or exposing a vulnerable endpoint.
- Product
- DRYiCE MyXalytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Jan 2, 2024HCL DRYiCE MyXalytics product is impacted by unauthenticated file upload vulnerability.CVE-2023-45724 · Other software · HCL Software · reported by psirt@hcl.comHigh 8.2
HCL DRYiCE MyXalytics product is impacted by unauthenticated file upload vulnerability. The web application permits the upload of a certain file without requiring user authentication.
- Product
- DRYiCE MyXalytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.