Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
871 results · page 8 of 18
Dec 12, 2024Greenshift – animation and page builder blocks: Information ExposureCVE-2024-11181 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 9.9.9.3 via the 'wp_reusable_render' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from password protected, private, or draft posts that they should not have access to.
- Product
- Greenshift – animation and page builder blocks
- Affected
- up to 9.9.9.3
- What to do
- Affects up to 9.9.9.3. Update Greenshift – animation and page builder blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 10, 2024Animate versions 23.0.8, 24.0.5 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code executioCVE-2024-53954 · Other software · Adobe · reported by AdobeHigh 7.8
Animate versions 23.0.8, 24.0.5 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Animate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024Animate versions 23.0.8, 24.0.5 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the cCVE-2024-53953 · Other software · Adobe · reported by AdobeHigh 7.8
Animate versions 23.0.8, 24.0.5 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Animate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024Animate versions 23.0.8, 24.0.5 and earlier are affected by a Buffer Underwrite ('Buffer Underflow') vulnerability that could result in arbitrary code executionCVE-2024-52990 · Other software · Adobe · reported by AdobeHigh 7.8
Animate versions 23.0.8, 24.0.5 and earlier are affected by a Buffer Underwrite ('Buffer Underflow') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could leverage this vulnerability to manipulate memory in such a way that they could execute code under the privileges of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Animate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024Animate versions 23.0.8, 24.0.5 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code executioCVE-2024-52989 · Other software · Adobe · reported by AdobeHigh 7.8
Animate versions 23.0.8, 24.0.5 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Animate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024Animate versions 23.0.8, 24.0.5 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context ofCVE-2024-52988 · Other software · Adobe · reported by AdobeHigh 7.8
Animate versions 23.0.8, 24.0.5 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Animate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024Animate versions 23.0.8, 24.0.5 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code executioCVE-2024-52987 · Other software · Adobe · reported by AdobeHigh 7.8
Animate versions 23.0.8, 24.0.5 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Animate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024Animate versions 23.0.8, 24.0.5 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code executioCVE-2024-52986 · Other software · Adobe · reported by AdobeHigh 7.8
Animate versions 23.0.8, 24.0.5 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Animate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024Animate versions 23.0.8, 24.0.5 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code executioCVE-2024-52985 · Other software · Adobe · reported by AdobeHigh 7.8
Animate versions 23.0.8, 24.0.5 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Animate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024Animate versions 23.0.8, 24.0.5 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code executioCVE-2024-52984 · Other software · Adobe · reported by AdobeHigh 7.8
Animate versions 23.0.8, 24.0.5 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Animate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024Animate versions 23.0.8, 24.0.5 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in theCVE-2024-52983 · Other software · Adobe · reported by AdobeHigh 7.8
Animate versions 23.0.8, 24.0.5 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Animate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024Animate versions 23.0.8, 24.0.5 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the contCVE-2024-52982 · Other software · Adobe · reported by AdobeHigh 7.8
Animate versions 23.0.8, 24.0.5 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Animate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024Animate versions 23.0.8, 24.0.5 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in arbitrary code execution in the contexCVE-2024-45156 · Other software · Adobe · reported by AdobeHigh 7.8
Animate versions 23.0.8, 24.0.5 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Animate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024Animate versions 23.0.8, 24.0.5 and earlier are affected by an Access of Uninitialized Pointer vulnerability that could result in arbitrary code execution in thCVE-2024-45155 · Other software · Adobe · reported by AdobeHigh 7.8
Animate versions 23.0.8, 24.0.5 and earlier are affected by an Access of Uninitialized Pointer vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Animate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2024Minimum and Maximum Quantity for WooCommerce: Missing AuthorizationCVE-2024-54227 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Dotstore Minimum and Maximum Quantity for WooCommerce min-and-max-quantity-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Minimum and Maximum Quantity for WooCommerce: from n/a through <= 2.0.0.
- Product
- Minimum and Maximum Quantity for WooCommerce
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update Minimum and Maximum Quantity for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 28, 2024Tumult Hype Animations: Arbitrary file uploadsCVE-2024-11082 · WordPress plugins & themes · reported by WordfenceCritical 9.9
The Tumult Hype Animations plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the hypeanimations_panel() function in all versions up to, and including, 1.9.15. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- Tumult Hype Animations
- Affected
- up to 1.9.15
- What to do
- Affects up to 1.9.15. Update Tumult Hype Animations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Nov 27, 2024Counter Up – Animated Number Counter & Milestone Showcase: Stored Cross-Site ScriptingCVE-2024-10895 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Counter Up – Animated Number Counter & Milestone Showcase plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'lgx-counter' shortcode in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Counter Up – Animated Number Counter & Milestone Showcase
- Affected
- up to 2.4.0
- What to do
- Affects up to 2.4.0. Update Counter Up – Animated Number Counter & Milestone Showcase to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 26, 2024Out-of-bounds Read vulnerability in Apache NimBLE.CVE-2024-51569 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
Out-of-bounds Read vulnerability in Apache NimBLE. Missing proper validation of HCI Number Of Completed Packets could lead to out-of-bound access when parsing HCI event and invalid read from HCI transport memory. This issue requires broken or bogus Bluetooth controller and thus severity is considered low. This issue affects Apache NimBLE: through 1.7.0. Users are recommended to upgrade to version 1.8.0, which fixes the issue.
- Product
- Apache NimBLE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.apache.org
Nov 26, 2024Out-of-bounds Read vulnerability in Apache NimBLE.CVE-2024-47250 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5
Out-of-bounds Read vulnerability in Apache NimBLE. Missing proper validation of HCI advertising report could lead to out-of-bound access when parsing HCI event and thus bogus GAP 'device found' events being sent. This issue requires broken or bogus Bluetooth controller and thus severity is considered low. This issue affects Apache NimBLE: through 1.7.0. Users are recommended to upgrade to version 1.8.0, which fixes the issue.
- Product
- Apache NimBLE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 26, 2024Improper Validation of Array Index vulnerability in Apache NimBLE.CVE-2024-47249 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5
Improper Validation of Array Index vulnerability in Apache NimBLE. Lack of input validation for HCI events from controller could result in out-of-bound memory corruption and crash. This issue requires broken or bogus Bluetooth controller and thus severity is considered low. This issue affects Apache NimBLE: through 1.7.0. Users are recommended to upgrade to version 1.8.0, which fixes the issue.
- Product
- Apache NimBLE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.apache.org
Nov 26, 2024Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Apache NimBLE.CVE-2024-47248 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.3
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Apache NimBLE. Specially crafted MESH message could result in memory corruption when non-default build configuration is used. This issue affects Apache NimBLE: through 1.7.0. Users are recommended to upgrade to version 1.8.0, which fixes the issue.
- Product
- Apache NimBLE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.apache.org
Nov 22, 2024The Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart, Blog, Video Gallery) plugin foCVE-2024-11601 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart, Blog, Video Gallery) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.1. This is due to missing or incorrect nonce validation on the save_options() function. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Please note this is limited to option values that can be saved as arrays.
- Affected
- up to 2.6.1
- What to do
- Affects up to 2.6.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 22, 2024The Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart, Blogs) plugin for WordPress isCVE-2024-11104 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart, Blogs) plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the save_options() function in all versions up to, and including, 2.6.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary options on the WordPress site. Please note this is limited to option values that can be saved as arrays.
- Affected
- up to 2.6.2
- What to do
- Affects up to 2.6.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 17, 2024Bitcoin Core before 0.15.0 allows a denial of service (OOM kill of a daemon process) via a flood of minimum difficulty headers.CVE-2024-52916 · Other software · bitcoin · reported by MITREHigh 7.5
Bitcoin Core before 0.15.0 allows a denial of service (OOM kill of a daemon process) via a flood of minimum difficulty headers.
- Product
- bitcoin_core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbitcoincore.orgen.bitcoin.it
Nov 12, 2024Animate versions 23.0.7, 24.0.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context ofCVE-2024-49528 · Other software · Adobe · reported by AdobeHigh 7.8
Animate versions 23.0.7, 24.0.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Animate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024Animate versions 23.0.7, 24.0.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory.CVE-2024-49527 · Other software · Adobe · reported by AdobeMedium 5.5
Animate versions 23.0.7, 24.0.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Animate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024Animate versions 23.0.7, 24.0.4 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the cCVE-2024-49526 · Other software · Adobe · reported by AdobeHigh 7.8
Animate versions 23.0.7, 24.0.4 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Animate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2024Tumult Hype Animations: Unauthorized access of dataCVE-2024-10543 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Tumult Hype Animations plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the hypeanimations_getcontent function in all versions up to, and including, 1.9.14. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve animation information.
- Product
- Tumult Hype Animations
- Affected
- up to 1.9.14
- What to do
- Affects up to 1.9.14. Update Tumult Hype Animations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 4, 2024An XML External Entity (XXE) vulnerability in Dmoz2CSV in openimaj v1.3.10 allows attackers to access sensitive information or execute arbitrary code via supplyCVE-2024-51136 · Other software · openimaj · reported by MITRECritical 9.8
An XML External Entity (XXE) vulnerability in Dmoz2CSV in openimaj v1.3.10 allows attackers to access sensitive information or execute arbitrary code via supplying a crafted XML file.
- Product
- openimaj
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2024WP donimedia carousel: Unrestricted Upload of File with Dangerous TypeCVE-2024-50511 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in donimedia WP donimedia carousel wp-donimedia-carousel allows Upload a Web Shell to a Web Server.This issue affects WP donimedia carousel: from n/a through <= 1.0.1.
- Product
- WP donimedia carousel
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update WP donimedia carousel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 17, 2024Animator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49308 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Toast Plugins Animator scroll-triggered-animations allows Reflected XSS.This issue affects Animator: from n/a through <= 3.0.15.
- Product
- Animator
- Affected
- up to 3.0.15
- What to do
- Affects up to 3.0.15. Update Animator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 16, 2024Azz Anonim Posting: Unrestricted Upload of File with Dangerous TypeCVE-2024-49257 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in Denis Azz Anonim Posting azz-anonim-posting allows Upload a Web Shell to a Web Server.This issue affects Azz Anonim Posting: from n/a through <= 0.9.
- Product
- Azz Anonim Posting
- Affected
- up to 0.9
- What to do
- Affects up to 0.9. Update Azz Anonim Posting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2024An Unimplemented or Unsupported Feature in UI vulnerability in the CLI of Juniper Networks Junos OS Evolved on QFX5000 Series allows an unauthenticated, adjacenCVE-2024-47498 · Network & remote access · Juniper Networks · reported by sirt@juniper.netHigh 7.1
An Unimplemented or Unsupported Feature in UI vulnerability in the CLI of Juniper Networks Junos OS Evolved on QFX5000 Series allows an unauthenticated, adjacent attacker to cause a Denial-of-Service (DoS). Several configuration statements meant to enforce limits on MAC learning and moves can be configured but do not take effect. This can lead to control plane overload situations which will severely impact the ability of the device to processes legitimate traffic. This issue affects Junos OS Evolved on QFX5000 Series: * All versions before 21.4R3-S8-EVO, * 22.2-EVO versions before 22.2R3-S5-EVO, * 22.4-EVO versions before 22.4R3-EVO, * 23.2-EVO versions before 23.2R2-EVO.
- Product
- Junos OS Evolved
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupportportal.juniper.net
Oct 9, 2024Animate versions 23.0.7, 24.0.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory.CVE-2024-47420 · Other software · Adobe · reported by AdobeMedium 5.5
Animate versions 23.0.7, 24.0.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Animate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2024Animate versions 23.0.7, 24.0.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory.CVE-2024-47419 · Other software · Adobe · reported by AdobeMedium 5.5
Animate versions 23.0.7, 24.0.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Animate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2024Animate versions 23.0.7, 24.0.4 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the cCVE-2024-47418 · Other software · Adobe · reported by AdobeHigh 7.8
Animate versions 23.0.7, 24.0.4 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Animate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2024Animate versions 23.0.7, 24.0.4 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the contCVE-2024-47417 · Other software · Adobe · reported by AdobeHigh 7.8
Animate versions 23.0.7, 24.0.4 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Animate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2024Animate versions 23.0.7, 24.0.4 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in theCVE-2024-47416 · Other software · Adobe · reported by AdobeHigh 7.8
Animate versions 23.0.7, 24.0.4 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Animate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2024Animate versions 23.0.7, 24.0.4 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the cCVE-2024-47415 · Other software · Adobe · reported by AdobeHigh 7.8
Animate versions 23.0.7, 24.0.4 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Animate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2024Animate versions 23.0.7, 24.0.4 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the cCVE-2024-47414 · Other software · Adobe · reported by AdobeHigh 7.8
Animate versions 23.0.7, 24.0.4 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Animate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2024Animate versions 23.0.7, 24.0.4 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the cCVE-2024-47413 · Other software · Adobe · reported by AdobeHigh 7.8
Animate versions 23.0.7, 24.0.4 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Animate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2024Animate versions 23.0.7, 24.0.4 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the cCVE-2024-47412 · Other software · Adobe · reported by AdobeHigh 7.8
Animate versions 23.0.7, 24.0.4 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Animate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2024Animate versions 23.0.7, 24.0.4 and earlier are affected by an Access of Uninitialized Pointer vulnerability that could result in arbitrary code execution in thCVE-2024-47411 · Other software · Adobe · reported by AdobeHigh 7.8
Animate versions 23.0.7, 24.0.4 and earlier are affected by an Access of Uninitialized Pointer vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Animate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2024Animate versions 23.0.7, 24.0.4 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the conCVE-2024-47410 · Other software · Adobe · reported by AdobeHigh 7.8
Animate versions 23.0.7, 24.0.4 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Animate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2024R Animated Icon: Stored Cross-Site ScriptingCVE-2024-9272 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The R Animated Icon Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
- Product
- R Animated Icon
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update R Animated Icon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Sep 30, 2024Confetti Fall Animation: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47641 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Muhammad Shakeel Confetti Fall Animation confetti-fall-animation allows Stored XSS.This issue affects Confetti Fall Animation: from n/a through <= 1.3.0.
- Product
- Confetti Fall Animation
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update Confetti Fall Animation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2024LayUI is a native minimalist modular Web UI component library.CVE-2024-47075 · Other software · layui · reported by GitHubMedium 6.4
LayUI is a native minimalist modular Web UI component library. Versions prior to 2.9.17 have a DOM Clobbering vulnerability that can lead to Cross-site Scripting (XSS) on web pages where attacker-controlled HTML elements (e.g., `img` tags with unsanitized `name` attributes) are present. Version 2.9.17 fixes this issue.
- Product
- layui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2024Confetti Fall Animation: Stored Cross-Site ScriptingCVE-2024-8919 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Confetti Fall Animation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'confetti-fall-animation' shortcode in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Confetti Fall Animation
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update Confetti Fall Animation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 17, 2024Under the default configuration, Devise-Two-Factor versions >= 2.2.0 & < 6.0.0 generate TOTP shared secrets that are 120 bits instead of the 128-bit minimum defCVE-2024-8796 · Other software · devise-two-factor · reported by disclosure@synopsys.comMedium 6
Under the default configuration, Devise-Two-Factor versions >= 2.2.0 & < 6.0.0 generate TOTP shared secrets that are 120 bits instead of the 128-bit minimum defined by RFC 4226. Using a shared secret shorter than the minimum to generate a multi-factor authentication code could make it easier for an attacker to guess the shared secret and generate valid TOTP codes.
- Product
- devise-two-factor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024Express.js minimalist web framework for node.CVE-2024-43796 · Other software · expressjs · reported by GitHubMedium 5
Express.js minimalist web framework for node. In express < 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code. This issue is patched in express 4.20.0.
- Product
- express
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.