Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,210 results · page 8 of 45
Jan 24, 2025DLL hijacking vulnerabilities, caused by an uncontrolled search path in the USBXpress Win 98SE Dev Kit installer can lead to privilege escalation and arbitrary CVE-2024-9499 · Other software · silabs.com · reported by product-security@silabs.comHigh 8.6
DLL hijacking vulnerabilities, caused by an uncontrolled search path in the USBXpress Win 98SE Dev Kit installer can lead to privilege escalation and arbitrary code execution when running the impacted installer.
- Product
- USBXpress Win 98SE Dev Kit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 24, 2025DLL hijacking vulnerabilities, caused by an uncontrolled search path in the USBXpress SDK installer can lead to privilege escalation and arbitrary code eCVE-2024-9498 · Other software · silabs.com · reported by product-security@silabs.comHigh 8.6
DLL hijacking vulnerabilities, caused by an uncontrolled search path in the USBXpress SDK installer can lead to privilege escalation and arbitrary code execution when running the impacted installer.
- Product
- USBXpress SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 24, 2025DLL hijacking vulnerabilities, caused by an uncontrolled search path in the USBXpress 4 SDK installer can lead to privilege escalation and arbitrary codeCVE-2024-9497 · Other software · silabs.com · reported by product-security@silabs.comHigh 8.6
DLL hijacking vulnerabilities, caused by an uncontrolled search path in the USBXpress 4 SDK installer can lead to privilege escalation and arbitrary code execution when running the impacted installer.
- Product
- USBXpress 4 SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 24, 2025DLL hijacking vulnerabilities, caused by an uncontrolled search path in the USBXpress Dev Kit installer can lead to privilege escalation and arbitrary coCVE-2024-9496 · Other software · silabs.com · reported by product-security@silabs.comHigh 8.6
DLL hijacking vulnerabilities, caused by an uncontrolled search path in the USBXpress Dev Kit installer can lead to privilege escalation and arbitrary code execution when running the impacted installer.
- Product
- USBXpress Dev Kit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 24, 2025DLL hijacking vulnerabilities, caused by an uncontrolled search path in the CP210x VCP Windows installer can lead to privilege escalation and arbitrary codCVE-2024-9495 · Other software · silabs.com · reported by product-security@silabs.comHigh 8.6
DLL hijacking vulnerabilities, caused by an uncontrolled search path in the CP210x VCP Windows installer can lead to privilege escalation and arbitrary code execution when running the impacted installer.
- Product
- CP210x VCP Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 24, 2025DLL hijacking vulnerabilities, caused by an uncontrolled search path in the CP210 VCP Win 2k installer can lead to privilege escalation and arbitrary coCVE-2024-9494 · Other software · silabs.com · reported by product-security@silabs.comHigh 8.6
DLL hijacking vulnerabilities, caused by an uncontrolled search path in the CP210 VCP Win 2k installer can lead to privilege escalation and arbitrary code execution when running the impacted installer.
- Product
- CP210 VCP Win 2k
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 24, 2025DLL hijacking vulnerabilities, caused by an uncontrolled search path in the ToolStick installer can lead to privilege escalation and arbitrary code executioCVE-2024-9493 · Other software · silabs.com · reported by product-security@silabs.comHigh 8.6
DLL hijacking vulnerabilities, caused by an uncontrolled search path in the ToolStick installer can lead to privilege escalation and arbitrary code execution when running the impacted installer.
- Product
- ToolStick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 24, 2025DLL hijacking vulnerabilities, caused by an uncontrolled search path in Flash Programming Utility installer can lead to privilege escalation and arbitrary code CVE-2024-9492 · Other software · silabs.com · reported by product-security@silabs.comHigh 8.6
DLL hijacking vulnerabilities, caused by an uncontrolled search path in Flash Programming Utility installer can lead to privilege escalation and arbitrary code execution when running the impacted installer.
- Product
- Flash Programming Utility
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 24, 2025DLL hijacking vulnerabilities, caused by an uncontrolled search path in Configuration Wizard 2 installer can lead to privilege escalation and arbitrary code exeCVE-2024-9491 · Other software · silabs.com · reported by product-security@silabs.comHigh 8.6
DLL hijacking vulnerabilities, caused by an uncontrolled search path in Configuration Wizard 2 installer can lead to privilege escalation and arbitrary code execution when running the impacted installer.
- Product
- Configuration Wizard 2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 24, 2025DLL hijacking vulnerabilities, caused by an uncontrolled search path in Silicon Labs (8-bit) IDE installer can lead to privilege escalation and arbitrary code eCVE-2024-9490 · Other software · silabs.com · reported by product-security@silabs.comHigh 8.6
DLL hijacking vulnerabilities, caused by an uncontrolled search path in Silicon Labs (8-bit) IDE installer can lead to privilege escalation and arbitrary code execution when running the impacted installer.
- Product
- Silicon Labs IDE (8-bit)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2025A DLL hijacking vulnerability in iTop VPN v16.0 allows attackers to execute arbitrary code via placing a crafted DLL file into the path \ProgramData\iTop VPN\DoCVE-2024-53588 · Other software · reported by MITREHigh 7.8
A DLL hijacking vulnerability in iTop VPN v16.0 allows attackers to execute arbitrary code via placing a crafted DLL file into the path \ProgramData\iTop VPN\Downloader\vpn6.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2025In multiple locations, there is a possible way to obtain access to a folder due to a tapjacking/overlay attack.CVE-2024-43765 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In multiple locations, there is a possible way to obtain access to a folder due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2025Clickjacking vulnerability in typecho v1.2.1.CVE-2024-57369 · Other software · Typecho · reported by MITREMedium 6.4
Clickjacking vulnerability in typecho v1.2.1.
- Product
- Typecho
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comroyblume.github.io
Jan 13, 2025SAP BusinessObjects Business Intelligence Platform allows an unauthenticated attacker to perform session hijacking over the network without any user interactionCVE-2025-0061 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 8.7
SAP BusinessObjects Business Intelligence Platform allows an unauthenticated attacker to perform session hijacking over the network without any user interaction, due to an information disclosure vulnerability. Attacker can access and modify all the data of the application.
- Product
- SAP BusinessObjects Business Intelligence Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2025Local privilege escalation due to DLL hijacking vulnerability.CVE-2024-55543 · Other software · Acronis · reported by security@acronis.comHigh 7.8
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect 16 (Windows) before build 39169.
- Product
- Acronis Cyber Protect 16
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity-advisory.acronis.com
Jan 2, 2025Local privilege escalation due to DLL hijacking vulnerability.CVE-2024-55540 · Other software · Acronis · reported by security@acronis.comHigh 7.8
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect 16 (Windows) before build 39169.
- Product
- Acronis Cyber Protect 16
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity-advisory.acronis.com
Dec 28, 2024A connection hijacking vulnerability exists in some Huawei home routers.CVE-2023-52718 · Other software · Huawei · reported by psirt@huawei.comMedium 6.4
A connection hijacking vulnerability exists in some Huawei home routers. Successful exploitation of this vulnerability may cause DoS or information leakage.(Vulnerability ID:HWPSIRT-2023-34408) This vulnerability has been assigned a (CVE)ID:CVE-2023-52718
- Product
- PT9030-15
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2024Some Huawei home routers have a connection hijacking vulnerability.CVE-2023-7266 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
Some Huawei home routers have a connection hijacking vulnerability. Successful exploitation of this vulnerability may cause DoS or information leakage.(Vulnerability ID:HWPSIRT-2023-76605) This vulnerability has been assigned a (CVE)ID:CVE-2023-7266
- Product
- TC7001-10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2024IBM InfoSphere Information Server 11.7 could allow a remote attacker to hijack the clicking action of the victim.CVE-2021-29827 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.2
IBM InfoSphere Information Server 11.7 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim.
- Product
- InfoSphere Information Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 29, 2024MSA FieldServer Gateway 5.0.0 through 6.5.2 allows cross-origin WebSocket hijacking.CVE-2024-45495 · Other software · reported by MITREMedium 4.3
MSA FieldServer Gateway 5.0.0 through 6.5.2 allows cross-origin WebSocket hijacking.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus.msasafety.comus.msasafety.com
Nov 26, 2024Malicious websites may have been able to perform user intent confirmation through tapjacking.CVE-2024-11700 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.1
Malicious websites may have been able to perform user intent confirmation through tapjacking. This could have led to users unknowingly approving the launch of external applications, potentially exposing them to underlying vulnerabilities. This vulnerability affects Firefox < 133 and Thunderbird < 133.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Nov 22, 2024Panda Security Dome VPN DLL Hijacking Local Privilege Escalation Vulnerability.CVE-2024-7244 · Other software · Panda Security · reported by zdi-disclosures@trendmicro.comHigh 7.8
Panda Security Dome VPN DLL Hijacking Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Panda Security Dome. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the VPN process. The process does not restrict DLL search to trusted paths, which can result in the loading of a malicious DLL. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-23428.
- Product
- Dome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024A vulnerability in Brocade Fabric OS versions before 9.2.2 could allow man-in-the-middle attackers to conduct remote Service Session Hijacking that may arise frCVE-2024-7516 · Other software · Brocade · reported by sirt@brocade.comHigh 7
A vulnerability in Brocade Fabric OS versions before 9.2.2 could allow man-in-the-middle attackers to conduct remote Service Session Hijacking that may arise from the attacker's ability to forge an SSH key while the Brocade Fabric OS Switch is performing various remote operations initiated by a switch admin.
- Product
- Fabric OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2024Clickjacking vulnerability in Clibo Manager v1.1.9.12 in the '/public/login' directory, a login panel.CVE-2024-10454 · Other software · Clibo Manager · reported by cve-coordination@incibe.esMedium 6.1
Clickjacking vulnerability in Clibo Manager v1.1.9.12 in the '/public/login' directory, a login panel. This vulnerability occurs due to the absence of an X-Frame-Options server-side header. An attacker could overlay a transparent iframe to perform click hijacking on victims.
- Product
- Clibo Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2024Nginx UI is a web user interface for the Nginx web server.CVE-2024-49368 · Other software · 0xJacky · reported by GitHubHigh 8.9
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.0.0-beta.36, when Nginx UI configures logrotate, it does not verify the input and directly passes it to exec.Command, causing arbitrary command execution. Version 2.0.0-beta.36 fixes this issue.
- Product
- nginx-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2024Nginx UI is a web user interface for the Nginx web server.CVE-2024-49367 · Other software · 0xJacky · reported by GitHubMedium 5.5
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.0.0-beta.36, the log path of nginxui is controllable. This issue can be combined with the directory traversal at `/api/configs` to read directories and file contents on the server. Version 2.0.0-beta.36 fixes the issue.
- Product
- nginx-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2024Nginx UI is a web user interface for the Nginx web server.CVE-2024-49366 · Other software · 0xJacky · reported by GitHubHigh 7.7
Nginx UI is a web user interface for the Nginx web server. Nginx UI v2.0.0-beta.35 and earlier gets the value from the json field without verification, and can construct a value value in the form of `../../`. Arbitrary files can be written to the server, which may result in loss of permissions. Version 2.0.0-beta.26 fixes the issue.
- Product
- nginx-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2024Local privilege escalation due to DLL hijacking vulnerability.CVE-2024-49391 · Other software · Acronis · reported by security@acronis.comHigh 7.3
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Files (Windows) before build 9.0.0x24.
- Product
- Acronis Cyber Files
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity-advisory.acronis.com
Oct 17, 2024Local privilege escalation due to DLL hijacking vulnerability.CVE-2024-49390 · Other software · Acronis · reported by security@acronis.comHigh 7.3
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Files (Windows) before build 9.0.0x24.
- Product
- Acronis Cyber Files
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity-advisory.acronis.com
Oct 17, 2024Sensitive information disclosure due to spell-jacking.CVE-2024-49386 · Other software · Acronis · reported by security@acronis.comMedium 5.7
Sensitive information disclosure due to spell-jacking. The following products are affected: Acronis Cyber Files (Windows) before build 9.0.0x24.
- Product
- Acronis Cyber Files
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity-advisory.acronis.com
Oct 15, 2024The devices are vulnerable to session hijacking due to insufficient entropy in its session ID generation algorithm.CVE-2024-47945 · Other software · RITTAL GmbH & Co. KG · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfCritical 9.8
The devices are vulnerable to session hijacking due to insufficient entropy in its session ID generation algorithm. The session IDs are predictable, with only 32,768 possible values per user, which allows attackers to pre-generate valid session IDs, leading to unauthorized access to user sessions. This is not only due to the use of an (insecure) rand() function call but also because of missing initialization via srand(). As a result only the PIDs are effectively used as seed.
- Product
- IoT Interface & CMC III Processing Unit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordr.sec-consult.comrittal.com
Oct 11, 2024A DLL hijack vulnerability was reported in Lenovo stARstudio that could allow a local attacker to execute code with elevated privileges.CVE-2024-9046 · Other software · Lenovo · reported by psirt@lenovo.comHigh 7.8
A DLL hijack vulnerability was reported in Lenovo stARstudio that could allow a local attacker to execute code with elevated privileges.
- Product
- stARstudio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2024A DLL hijack vulnerability was reported in Lenovo Lock Screen that could allow a local attacker to execute code with elevated privileges.CVE-2024-4132 · Other software · Lenovo · reported by psirt@lenovo.comHigh 7.8
A DLL hijack vulnerability was reported in Lenovo Lock Screen that could allow a local attacker to execute code with elevated privileges.
- Product
- Lock Screen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2024A DLL hijack vulnerability was reported in Lenovo Emulator that could allow a local attacker to execute code with elevated privileges.CVE-2024-4131 · Other software · Lenovo · reported by psirt@lenovo.comHigh 7.8
A DLL hijack vulnerability was reported in Lenovo Emulator that could allow a local attacker to execute code with elevated privileges.
- Product
- Emulator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2024A DLL hijack vulnerability was reported in Lenovo App Store that could allow a local attacker to execute code with elevated privileges.CVE-2024-4130 · Other software · Lenovo · reported by psirt@lenovo.comHigh 7.8
A DLL hijack vulnerability was reported in Lenovo App Store that could allow a local attacker to execute code with elevated privileges.
- Product
- App Store
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2024A DLL hijack vulnerability was reported in Lenovo Super File that could allow a local attacker to execute code with elevated privileges.CVE-2024-4089 · Other software · Lenovo · reported by psirt@lenovo.comHigh 7.8
A DLL hijack vulnerability was reported in Lenovo Super File that could allow a local attacker to execute code with elevated privileges.
- Product
- SuperFile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2024A DLL hijack vulnerability was reported in Lenovo Service Framework that could allow a local attacker to execute code with elevated privileges.CVE-2024-33582 · Other software · Lenovo · reported by psirt@lenovo.comHigh 7.8
A DLL hijack vulnerability was reported in Lenovo Service Framework that could allow a local attacker to execute code with elevated privileges.
- Product
- Service Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2024A DLL hijack vulnerability was reported in Lenovo PC Manager AI intelligent scenario that could allow a local attacker to execute code with elevated privileges.CVE-2024-33581 · Other software · Lenovo · reported by psirt@lenovo.comHigh 7.8
A DLL hijack vulnerability was reported in Lenovo PC Manager AI intelligent scenario that could allow a local attacker to execute code with elevated privileges.
- Product
- PC Manager AI intelligent scenario
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2024A DLL hijack vulnerability was reported in Lenovo Personal Cloud that could allow a local attacker to execute code with elevated privileges.CVE-2024-33580 · Other software · Lenovo · reported by psirt@lenovo.comHigh 7.8
A DLL hijack vulnerability was reported in Lenovo Personal Cloud that could allow a local attacker to execute code with elevated privileges.
- Product
- Personal Cloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2024A DLL hijack vulnerability was reported in Lenovo Baiying that could allow a local attacker to execute code with elevated privileges.CVE-2024-33579 · Other software · Lenovo · reported by psirt@lenovo.comHigh 7.8
A DLL hijack vulnerability was reported in Lenovo Baiying that could allow a local attacker to execute code with elevated privileges.
- Product
- Baiying
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2024A DLL hijack vulnerability was reported in Lenovo Leyun that could allow a local attacker to execute code with elevated privileges.CVE-2024-33578 · Other software · Lenovo · reported by psirt@lenovo.comHigh 7.8
A DLL hijack vulnerability was reported in Lenovo Leyun that could allow a local attacker to execute code with elevated privileges.
- Product
- Leyun
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2024A DLL hijacking vulnerability in VegaBird Vooki 5.2.9 allows attackers to execute arbitrary code / maintain persistence via placing a crafted DLL file in the saCVE-2024-45874 · Other software · vegabird · reported by MITRECritical 9.8
A DLL hijacking vulnerability in VegaBird Vooki 5.2.9 allows attackers to execute arbitrary code / maintain persistence via placing a crafted DLL file in the same directory as Vooki.exe.
- Product
- vooki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2024A DLL hijacking vulnerability in VegaBird Yaazhini 2.0.2 allows attackers to execute arbitrary code / maintain persistence via placing a crafted DLL file in theCVE-2024-45873 · Other software · vegabird · reported by MITRECritical 9.8
A DLL hijacking vulnerability in VegaBird Yaazhini 2.0.2 allows attackers to execute arbitrary code / maintain persistence via placing a crafted DLL file in the same directory as Yaazhini.exe.
- Product
- yaazhini
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2024Improper Authentication vulnerability in Microchip TimeProvider 4100 (login modules) allows Session Hijacking.This issue affects TimeProvider 4100: from 1.0 befCVE-2024-43685 · Other software · Microchip · reported by dc3f6da9-85b5-4a73-84a2-2ec90b40fca5High 8.7
Improper Authentication vulnerability in Microchip TimeProvider 4100 (login modules) allows Session Hijacking.This issue affects TimeProvider 4100: from 1.0 before 2.4.7.
- Product
- TimeProvider 4100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgruppotim.itmicrochip.com
Oct 3, 2024The AVGUI.exe of AVG/Avast Antivirus before versions before 24.1 can allow a local attacker to escalate privileges via an COM hijack in a time-of-check to time-CVE-2024-5803 · Other software · AVG/Avast · reported by security@nortonlifelock.comHigh 7.5
The AVGUI.exe of AVG/Avast Antivirus before versions before 24.1 can allow a local attacker to escalate privileges via an COM hijack in a time-of-check to time-of-use (TOCTOU) when self protection is disabled.
- Product
- Antivirus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2024A missing delay in directory upload UI could have made it possible for an attacker to trick a user into granting permission via clickjacking.CVE-2024-9397 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.1
A missing delay in directory upload UI could have made it possible for an attacker to trick a user into granting permission via clickjacking. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Thunderbird < 128.3, and Thunderbird < 131.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Sep 27, 2024Cleartext Storage of Sensitive Information in a Cookie vulnerability in Oceanic Software ValeApp allows Protocol Manipulation, : JSON Hijacking (aka JavaScript CVE-2024-8644 · Other software · Oceanic Software · reported by iletisim@usom.gov.trCritical 9.3
Cleartext Storage of Sensitive Information in a Cookie vulnerability in Oceanic Software ValeApp allows Protocol Manipulation, : JSON Hijacking (aka JavaScript Hijacking). This issue affects ValeApp: before v2.0.0.
- Product
- ValeApp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Sep 27, 2024Session Fixation vulnerability in Oceanic Software ValeApp allows Brute Force, Session Hijacking.CVE-2024-8643 · Other software · Oceanic Software · reported by iletisim@usom.gov.trCritical 9.3
Session Fixation vulnerability in Oceanic Software ValeApp allows Brute Force, Session Hijacking. This issue affects ValeApp: before v2.0.0.
- Product
- ValeApp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Sep 26, 2024A DLL Hijacking caused by drive remapping combined with a poisoning of the activation cache in Microsoft Windows 10, Windows 11, Windows Server 2016, Windows SeCVE-2024-6769 · Computers, phones & browsers · Microsoft · reported by df4dee71-de3a-4139-9588-11b62fe6c0ffHigh 8.4
A DLL Hijacking caused by drive remapping combined with a poisoning of the activation cache in Microsoft Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, and Windows Server 2022 allows a malicious authenticated attacker to elevate from a medium integrity process to a high integrity process without the intervention of a UAC prompt.
- Product
- Windows 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2024Local privilege escalation due to DLL hijacking vulnerability.CVE-2024-8766 · Other software · Acronis · reported by security@acronis.comMedium 6.7
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 38235, Acronis Cyber Protect 16 (Windows) before build 39169.
- Product
- Acronis Cyber Protect Cloud Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity-advisory.acronis.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.