Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,269 results · page 8 of 26
Jan 14, 2025.NET and Visual Studio Remote Code Execution VulnerabilityCVE-2025-21172 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
.NET and Visual Studio Remote Code Execution Vulnerability
- Product
- .NET 8.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comherodevs.com
Dec 14, 2024DocIO in Syncfusion Essential Studio for ASP.NET MVC before 27.1.55 throws XMLException during the resaving of a DOCX document with an external reference XML, aCVE-2024-55969 · Other software · reported by MITRECritical 9.1
DocIO in Syncfusion Essential Studio for ASP.NET MVC before 27.1.55 throws XMLException during the resaving of a DOCX document with an external reference XML, aka I640714.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 14, 2024File Manager in Syncfusion Essential Studio for ASP.NET MVC before 27.1.55 has a traversal issue that is related to the request parameter, aka I644734.CVE-2024-55970 · Other software · reported by MITREHigh 7.5
File Manager in Syncfusion Essential Studio for ASP.NET MVC before 27.1.55 has a traversal issue that is related to the request parameter, aka I644734.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2024LA-Studio Element Kit for Elementor: Missing AuthorizationCVE-2023-50884 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LA-Studio Element Kit for Elementor: from n/a through <= 1.1.5.
- Product
- LA-Studio Element Kit for Elementor
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update LA-Studio Element Kit for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 4, 2024LA-Studio Element Kit for Elementor: Information ExposureCVE-2024-10787 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.4.4 via the 'elementor-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private and draft posts created by Elementor that they should not have access to.
- Product
- LA-Studio Element Kit for Elementor
- Affected
- up to 1.4.4
- What to do
- Affects up to 1.4.4. Update LA-Studio Element Kit for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 2, 2024Awesome Studio: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52456 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpoets Awesome Studio awesome-studio allows Reflected XSS.This issue affects Awesome Studio: from n/a through <= 2.4.4.
- Product
- Awesome Studio
- Affected
- up to 2.4.4
- What to do
- Affects up to 2.4.4. Update Awesome Studio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 28, 2024In Click Studios Passwordstate before build 9920, there is a potential permission escalation on the edit folder screen.CVE-2024-54124 · Other software · clickstudios · reported by MITREHigh 8.8
In Click Studios Passwordstate before build 9920, there is a potential permission escalation on the edit folder screen.
- Product
- passwordstate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordclickstudios.com.auclickstudios.com.au
Nov 26, 2024Improper neutralization of input during web page generation ('Cross-site Scripting') in Copilot Studio by an unauthorized attacker leads to elevation of privileCVE-2024-49038 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.3
Improper neutralization of input during web page generation ('Cross-site Scripting') in Copilot Studio by an unauthorized attacker leads to elevation of privilege over a network.
- Product
- Microsoft Copilot Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 23, 2024LA-Studio Element Kit for Elementor: Local File InclusionCVE-2024-10873 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.2 via the _load_template function. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
- Product
- LA-Studio Element Kit for Elementor
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update LA-Studio Element Kit for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 12, 2024Visual Studio Code Python Extension Remote Code Execution VulnerabilityCVE-2024-49050 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Visual Studio Code Python Extension Remote Code Execution Vulnerability
- Product
- Python extension for Visual Studio Code
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024Visual Studio Code Remote Extension Elevation of Privilege VulnerabilityCVE-2024-49049 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.1
Visual Studio Code Remote Extension Elevation of Privilege Vulnerability
- Product
- Visual Studio Code Remote - SSH Extension
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024Visual Studio Elevation of Privilege VulnerabilityCVE-2024-49044 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.7
Visual Studio Elevation of Privilege Vulnerability
- Product
- Microsoft Visual Studio 2022 version 17.6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024.NET and Visual Studio Denial of Service VulnerabilityCVE-2024-43499 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
.NET and Visual Studio Denial of Service Vulnerability
- Product
- Microsoft Visual Studio 2022 version 17.6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024.NET and Visual Studio Remote Code Execution VulnerabilityCVE-2024-43498 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.8
.NET and Visual Studio Remote Code Execution Vulnerability
- Product
- PowerShell 7.5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 8, 2024The pwrstudio web application of EV Charger (in the server in Circontrol Raption through 5.6.2) is vulnerable to OS command injection via three fields of the coCVE-2020-8007 · Other software · pwrstudio · reported by MITRECritical 9.8
The pwrstudio web application of EV Charger (in the server in Circontrol Raption through 5.6.2) is vulnerable to OS command injection via three fields of the configuration menu for ntpserver0, ntpserver1, and pingip.
- Product
- ev_charger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcircontrol.comseclists.org
Nov 1, 2024Sysmac Studio provided by OMRON Corporation contains an incorrect authorization vulnerability.CVE-2024-49501 · Other software · OMRON Corporation · reported by vultures@jpcert.or.jpMedium 5.7
Sysmac Studio provided by OMRON Corporation contains an incorrect authorization vulnerability. If this vulnerability is exploited, an attacker may access the program which is protected by Data Protection function.
- Product
- SYSMAC-SE2[][][]
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2024Studio-42 eLfinder 2.1.62 contains a filename restriction bypass leading to a persistent Cross-site Scripting (XSS) vulnerability.CVE-2023-52045 · Other software · std42 · reported by MITREMedium 6.1
Studio-42 eLfinder 2.1.62 contains a filename restriction bypass leading to a persistent Cross-site Scripting (XSS) vulnerability.
- Product
- elfinder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2024Studio-42 eLfinder 2.1.62 is vulnerable to Remote Code Execution (RCE) as there is no restriction for uploading files with the .php8 extension.CVE-2023-52044 · Other software · std42 · reported by MITRECritical 9.8
Studio-42 eLfinder 2.1.62 is vulnerable to Remote Code Execution (RCE) as there is no restriction for uploading files with the .php8 extension.
- Product
- elfinder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2024Directory Traversal in /SASStudio/sasexec/sessions/{sessionID}/workspace/{InternalPath} in SAS Studio 9.4 allows remote attacker to access internal files by manCVE-2024-48735 · Other software · sas · reported by MITREHigh 7.7
Directory Traversal in /SASStudio/sasexec/sessions/{sessionID}/workspace/{InternalPath} in SAS Studio 9.4 allows remote attacker to access internal files by manipulating default path during file download. NOTE: this is disputed by the vendor because these filesystem paths are allowed for authorized users.
- Product
- studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2024Unrestricted file upload in /SASStudio/SASStudio/sasexec/{sessionID}/{InternalPath} in SAS Studio 9.4 allows remote attacker to upload malicious files.CVE-2024-48734 · Other software · sas · reported by MITREHigh 8.8
Unrestricted file upload in /SASStudio/SASStudio/sasexec/{sessionID}/{InternalPath} in SAS Studio 9.4 allows remote attacker to upload malicious files. NOTE: this is disputed by the vendor because file upload is allowed for authorized users.
- Product
- studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2024SQL injection vulnerability in /SASStudio/sasexec/sessions/{sessionID}/sql in SAS Studio 9.4 allows remote attacker to execute arbitrary SQL commands via the POCVE-2024-48733 · Other software · sas · reported by MITREHigh 8.8
SQL injection vulnerability in /SASStudio/sasexec/sessions/{sessionID}/sql in SAS Studio 9.4 allows remote attacker to execute arbitrary SQL commands via the POST body request. NOTE: this is disputed by the vendor because SQL statement execution is allowed for authorized users.
- Product
- studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsupport.sas.com
Oct 25, 2024Sharp and Toshiba Tec MFPs improperly validate input data in URI data registration, resulting in a stored cross-site scripting vulnerability.CVE-2024-48870 · Other software · Toshiba Tec Corporation · reported by vultures@jpcert.or.jpMedium 6.2
Sharp and Toshiba Tec MFPs improperly validate input data in URI data registration, resulting in a stored cross-site scripting vulnerability. If crafted input is stored by an administrative user, malicious script may be executed on the web browsers of other victim users.
- Product
- e-STUDIO 908
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2024A vulnerability classified as critical has been found in mikexstudios Xcomic up to 0.8.2.CVE-2005-10003 · Other software · mikexstudios · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in mikexstudios Xcomic up to 0.8.2. This affects an unknown part. The manipulation of the argument cmd leads to os command injection. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 0.8.3 is able to address this issue. The patch is named 6ed8e3cc336e29f09c7e791863d0559939da98bf. It is recommended to upgrade the affected component.
- Product
- Xcomic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordxcomic.mikexstudios.comgithub.com
Oct 15, 2024IBM Watson Studio Local 1.2.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitteCVE-2024-49340 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM Watson Studio Local 1.2.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.
- Product
- Watson Studio Local
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2024A DLL hijack vulnerability was reported in Lenovo stARstudio that could allow a local attacker to execute code with elevated privileges.CVE-2024-9046 · Other software · Lenovo · reported by psirt@lenovo.comHigh 7.8
A DLL hijack vulnerability was reported in Lenovo stARstudio that could allow a local attacker to execute code with elevated privileges.
- Product
- stARstudio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2024CWE-269: Improper Privilege Management vulnerability exists that could cause unauthorized access, loss of confidentiality, integrity, and availability of the woCVE-2024-9002 · Other software · Schneider Electric · reported by cybersecurity@se.comHigh 7.8
CWE-269: Improper Privilege Management vulnerability exists that could cause unauthorized access, loss of confidentiality, integrity, and availability of the workstation when non-admin authenticated user tries to perform privilege escalation by tampering with the binaries
- Product
- Easergy Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.com
Oct 9, 2024Exposure of Sensitive Information to an Unauthorized Actor in Copilot Studio allows a unauthenticated attacker to view sensitive information through network attCVE-2024-43610 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.4
Exposure of Sensitive Information to an Unauthorized Actor in Copilot Studio allows a unauthenticated attacker to view sensitive information through network attack vector
- Product
- Microsoft Copilot Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2024Visual Studio Collector Service Denial of Service VulnerabilityCVE-2024-43603 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Visual Studio Collector Service Denial of Service Vulnerability
- Product
- Microsoft Visual Studio 2015 Update 3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2024Visual Studio Code for Linux Remote Code Execution VulnerabilityCVE-2024-43601 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Visual Studio Code for Linux Remote Code Execution Vulnerability
- Product
- Visual Studio Code for Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2024Visual C++ Redistributable Installer Elevation of Privilege VulnerabilityCVE-2024-43590 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Visual C++ Redistributable Installer Elevation of Privilege Vulnerability
- Product
- Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2024Missing authentication for critical function in Visual Studio Code extension for Arduino allows an unauthenticated attacker to perform remote code execution thrCVE-2024-43488 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Missing authentication for critical function in Visual Studio Code extension for Arduino allows an unauthenticated attacker to perform remote code execution through network attack vector.
- Product
- Visual Studio Code
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2024.NET and Visual Studio Denial of Service VulnerabilityCVE-2024-43485 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
.NET and Visual Studio Denial of Service Vulnerability
- Product
- .NET 6.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2024.NET, .NET Framework, and Visual Studio Denial of Service VulnerabilityCVE-2024-43484 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability
- Product
- .NET 6.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comsecurity.netapp.com
Oct 8, 2024.NET, .NET Framework, and Visual Studio Denial of Service VulnerabilityCVE-2024-43483 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability
- Product
- .NET 6.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2024.NET and Visual Studio Remote Code Execution VulnerabilityCVE-2024-38229 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.1
.NET and Visual Studio Remote Code Execution Vulnerability
- Product
- .NET 8.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comherodevs.com
Oct 5, 2024LA-Studio Element Kit for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47628 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Stored XSS.This issue affects LA-Studio Element Kit for Elementor: from n/a through <= 1.3.9.3.
- Product
- LA-Studio Element Kit for Elementor
- Affected
- up to 1.3.9.3
- What to do
- Affects up to 1.3.9.3. Update LA-Studio Element Kit for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 1, 2024Wiz Code Visual Studio Code extension in versions 1.0.0 up to 1.5.3 and Wiz (legacy) Visual Studio Code extension in versions 0.13.0 up to 0.17.8 are vulnerableCVE-2024-9145 · Other software · Wiz · reported by 9947ef80-c5d5-474a-bbab-97341a59000eHigh 7.1
Wiz Code Visual Studio Code extension in versions 1.0.0 up to 1.5.3 and Wiz (legacy) Visual Studio Code extension in versions 0.13.0 up to 0.17.8 are vulnerable to local command injection if the user opens a maliciously crafted Dockerfile located in a path that has been marked as a "trusted folder" within Visual Studio Code, and initiates a manual scan of the file.
- Product
- Wiz Code Visual Studio Code extension
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmarketplace.visualstudio.commarketplace.visualstudio.com
Sep 21, 2024An issue was discovered in vesoft NebulaGraph through 3.8.0.CVE-2024-47219 · Other software · vesoft · reported by MITRECritical 9.8
An issue was discovered in vesoft NebulaGraph through 3.8.0. It allows shell command injection.
- Product
- nebulagraph_studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2024An issue was discovered in vesoft NebulaGraph through 3.8.0.CVE-2024-47218 · Other software · versoft · reported by MITRECritical 9.8
An issue was discovered in vesoft NebulaGraph through 3.8.0. It allows bypassing authentication.
- Product
- nebulagraph_studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2024.NET and Visual Studio Denial of Service VulnerabilityCVE-2024-38168 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
.NET and Visual Studio Denial of Service Vulnerability
- Product
- .NET 8.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2024.NET and Visual Studio Information Disclosure VulnerabilityCVE-2024-38167 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
.NET and Visual Studio Information Disclosure Vulnerability
- Product
- Microsoft Visual Studio 2022 version 17.10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2024LA-Studio Element Kit for Elementor: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43210 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in LA-Studio LA-Studio Element Kit for Elementor allows Stored XSS.This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.3.9.2.
- Product
- LA-Studio Element Kit for Elementor
- Affected
- up to 1.3.9.2
- What to do
- Affects up to 1.3.9.2. Update LA-Studio Element Kit for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2024An authenticated attacker can bypass Server-Side Request Forgery (SSRF) protection in Microsoft Copilot Studio to leak sensitive information over a network.CVE-2024-38206 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.5
An authenticated attacker can bypass Server-Side Request Forgery (SSRF) protection in Microsoft Copilot Studio to leak sensitive information over a network.
- Product
- Microsoft Copilot Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2024Studio 42 elFinder 2.1.64 is vulnerable to Incorrect Access Control.CVE-2024-38909 · Other software · studio42 · reported by MITRECritical 9.8
Studio 42 elFinder 2.1.64 is vulnerable to Incorrect Access Control. Copying files with an unauthorized extension between server directories allows an arbitrary attacker to expose secrets, perform RCE, etc.
- Product
- elfinder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2024.NET and Visual Studio Denial of Service VulnerabilityCVE-2024-38095 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
.NET and Visual Studio Denial of Service Vulnerability
- Product
- PowerShell 7.4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jul 9, 2024.NET, .NET Framework, and Visual Studio Elevation of Privilege VulnerabilityCVE-2024-38081 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.3
.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability
- Product
- Microsoft Visual Studio 2022 version 17.4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jul 9, 2024SQL Server Native Client OLE DB Provider Remote Code Execution VulnerabilityCVE-2024-35272 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
- Product
- Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jul 9, 2024.NET and Visual Studio Remote Code Execution VulnerabilityCVE-2024-35264 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.1
.NET and Visual Studio Remote Code Execution Vulnerability
- Product
- .NET 6.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jul 9, 2024.NET and Visual Studio Denial of Service VulnerabilityCVE-2024-30105 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
.NET and Visual Studio Denial of Service Vulnerability
- Product
- .NET 8.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jul 2, 2024LA-Studio Element Kit for Elementor: Local File InclusionCVE-2024-37479 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Local File Inclusion vulnerability in LA-Studio LA-Studio Element Kit for Elementor via "LaStudioKit Progress Bar" widget in New Post, specifically in the "progress_type" attribute.This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.3.8.1.
- Product
- LA-Studio Element Kit for Elementor
- Affected
- up to 1.3.8.1
- What to do
- Affects up to 1.3.8.1. Update LA-Studio Element Kit for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.