Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,767exploited flaws on CISA’s list

33added in the last 30 days

485new WordPress flaws this week

392,772entries in the database

8,188 results · page 81 of 164

Aug 28, 2024A vulnerability in the restricted security domain implementation of Cisco Application Policy Infrastructure Controller (APIC) could allow an authenticated, remoCVE-2024-20279 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4.3
A vulnerability in the restricted security domain implementation of Cisco Application Policy Infrastructure Controller (APIC) could allow an authenticated, remote attacker to modify the behavior of default system policies, such as quality of service (QoS) policies, on an affected system. This vulnerability is due to improper access control when restricted security domains are used to implement multi-tenancy. An attacker with a valid user account associated with a restricted security domain could exploit this vulnerability. A successful exploit could allow the attacker to read, modify, or delete child policies created under default system policies, which are implicitly used by all tenants in the fabric, resulting in disruption of network traffic. Exploitation is not possible for policies under tenants that an attacker has no authorization to access.
Product
Cisco Application Policy Infrastructure Controller (APIC)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sec.cloudapps.cisco.com
Aug 28, 2024A vulnerability identified in NetIQ Advance Authentication that doesn't enforce account lockout when brute force attack is performed on API based login.CVE-2021-22530 · Other software · OpenText · reported by security@opentext.comHigh 8.2
A vulnerability identified in NetIQ Advance Authentication that doesn't enforce account lockout when brute force attack is performed on API based login. This issue may lead to user account compromise if successful or may impact server performance. This issue impacts all NetIQ Advance Authentication before 6.3.5.1
Product
NetIQ Advance Authentication
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record netiq.com
Aug 27, 2024Apollo Federation is an architecture for declaratively composing APIs into a unified graph.CVE-2024-43414 · Other software · apollographql · reported by GitHubHigh 7.5
Apollo Federation is an architecture for declaratively composing APIs into a unified graph. Each team can own their slice of the graph independently, empowering them to deliver autonomously and incrementally. Instances of @apollo/query-planner >=2.0.0 and <2.8.5 are impacted by a denial-of-service vulnerability. @apollo/gateway versions >=2.0.0 and < 2.8.5 and Apollo Router <1.52.1 are also impacted through their use of @apollo/query-panner. If @apollo/query-planner is asked to plan a sufficiently complex query, it may loop infinitely and never complete. This results in unbounded memory consumption and either a crash or out-of-memory (OOM) termination. This issue can be triggered if you have at least one non-@key field that can be resolved by multiple subgraphs. To identify these shared fields, the schema for each subgraph must be reviewed. The mechanism to identify shared fields varies based on the version of Federation your subgraphs are using. You can check if your subgraphs are using Federation 1 or Federation 2 by reviewing their schemas. Federation 2 subgraph schemas will contain a @link directive referencing the version of Federation being used while Federation 1 subgraphs w
Product
federation
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com apollographql.com
Aug 27, 2024A path traversal issue in API endpoint in M-Files Server before version 24.8.13981.0 and LTS 24.2.13421.15 SR2 and LTS 23.8.12892.0 SR6 allows authenticated useCVE-2024-6789 · Other software · M-Files Corporation · reported by security@m-files.comHigh 8.4
A path traversal issue in API endpoint in M-Files Server before version 24.8.13981.0 and LTS 24.2.13421.15 SR2 and LTS 23.8.12892.0 SR6 allows authenticated user to read files
Product
M-Files Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record empower.m-files.com product.m-files.com
Aug 26, 2024Rustix is a set of safe Rust bindings to POSIX-ish APIs.CVE-2024-43806 · Other software · bytecodealliance · reported by GitHubMedium 6.5
Rustix is a set of safe Rust bindings to POSIX-ish APIs. When using `rustix::fs::Dir` using the `linux_raw` backend, it's possible for the iterator to "get stuck" when an IO error is encountered. Combined with a memory over-allocation issue in `rustix::fs::Dir::read_more`, this can cause quick and unbounded memory explosion (gigabytes in a few seconds if used on a hot path) and eventually lead to an OOM crash of the application. The symptoms were initially discovered in https://github.com/imsnif/bandwhich/issues/284. That post has lots of details of our investigation. Full details can be read on the GHSA-c827-hfw6-qwvm repo advisory. If a program tries to access a directory with its file descriptor after the file has been unlinked (or any other action that leaves the `Dir` iterator in the stuck state), and the implementation does not break after seeing an error, it can cause a memory explosion. As an example, Linux's various virtual file systems (e.g. `/proc`, `/sys`) can contain directories that spontaneously pop in and out of existence. Attempting to iterate over them using `rustix::fs::Dir` directly or indirectly (e.g. with the `procfs` crate) can trigger this fault condition if
Product
rustix
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 26, 2024A cross-site scripting (XSS) vulnerability in the Config-Create function of fastapi-admin pro v0.1.4 allows attackers to execute arbitrary web scripts or HTML vCVE-2024-42818 · Other software · fastapi-admin · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in the Config-Create function of fastapi-admin pro v0.1.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Product Name parameter.
Product
fastapi-admin_pro
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fastapi-admin-pro.long2ice.io github.com
Aug 26, 2024A cross-site scripting (XSS) vulnerability in the Create Product function of fastapi-admin pro v0.1.4 allows attackers to execute arbitrary web scripts or HTML CVE-2024-42816 · Other software · fastapi-admin · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in the Create Product function of fastapi-admin pro v0.1.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Product Name parameter.
Product
fastapi-admin_pro
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fastapi-admin-pro.long2ice.io github.com
Aug 23, 2024Homepage is a highly customizable homepage with Docker and service API integrations.CVE-2024-42364 · Other software · gethomepage · reported by GitHubMedium 6.5
Homepage is a highly customizable homepage with Docker and service API integrations. The default setup of homepage 0.9.1 is vulnerable to DNS rebinding. Homepage is setup without certificate and authentication by default, leaving it to vulnerable to DNS rebinding. In this attack, an attacker will ask a user to visit his/her website. The attacker website will then change the DNS records of their domain from their IP address to the internal IP address of the homepage instance. To tell which IP addresses are valid, we can rebind a subdomain to each IP address we want to check, and see if there is a response. Once potential candidates have been found, the attacker can launch the attack by reading the response of the webserver after the IP address has changed. When the attacker domain is fetched, the response will be from the homepage instance, not the attacker website, because the IP address has been changed. Due to a lack of authentication, a user’s private information such as API keys (fixed after first report) and other private information can then be extracted by the attacker website.
Product
homepage
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securitylab.github.com
Aug 22, 2024IBM OpenPages with Watson 8.3 and 9.0 could allow authenticated users access to sensitive information through improper authorization controls on APIs.CVE-2024-35151 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM OpenPages with Watson 8.3 and 9.0 could allow authenticated users access to sensitive information through improper authorization controls on APIs.
Product
OpenPages with Watson
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com
Aug 22, 2024Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2 fail to restrict the input in POST /api/v4/users which allows a user to manCVE-2024-42411 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 5.3
Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2 fail to restrict the input in POST /api/v4/users which allows a user to manipulate the creation date in POST /api/v4/users tricking the admin into believing their account is much older.
Product
Mattermost
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com
Aug 21, 2024Insufficient data validation in V8 API in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption via a crafted ChCVE-2024-7974 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
Insufficient data validation in V8 API in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: Medium)
Product
Chrome
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record chromereleases.googleblog.com issues.chromium.org
Aug 21, 2024Multiple vulnerabilities in the REST API of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to conduct blind SQL injection atCVE-2024-20417 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.5
Multiple vulnerabilities in the REST API of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to conduct blind SQL injection attacks. These vulnerabilities are due to insufficient validation of user-supplied input in REST API calls. An attacker could exploit these vulnerabilities by sending crafted input to an affected device. A successful exploit could allow the attacker to view or modify data on the affected device.
Product
Cisco Identity Services Engine Software
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sec.cloudapps.cisco.com
Aug 21, 2024An issue was discovered in the Docusign API package 8.142.14 for Salesforce.CVE-2024-39344 · Other software · salesforce · reported by MITREHigh 8.1
An issue was discovered in the Docusign API package 8.142.14 for Salesforce. The Apttus_DocuApi__DocusignAuthentication__mdt object is installed via the marketplace from this package and stores some configuration information in a manner that could be compromised. With the default settings when installed for all users, the object can be accessible and (via its fields) could disclose some keys. These disclosed components can be combined to create a valid session via the Docusign API. This will generally lead to a complete compromise of the Docusign account because the session is for an administrator service account and may have permission to re-authenticate as specific users with the same authorization flow.
Product
docusign_api_package_for_salesforce
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record deneyed.com login.salesforce.com
Aug 20, 2024In the Linux kernel, the following vulnerability has been resolved: devres: Fix memory leakage caused by driver API devm_free_percpu() It will cause memory leCVE-2024-43871 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: devres: Fix memory leakage caused by driver API devm_free_percpu() It will cause memory leakage when use driver API devm_free_percpu() to free memory allocated by devm_alloc_percpu(), fixed by using devres_release() instead of devres_destroy() within devm_free_percpu().
Product
Linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org git.kernel.org
Aug 20, 2024The mail template feature lacks an escaping mechanism, causing XSS vectors in multiple extensions.CVE-2024-27186 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 6.1
The mail template feature lacks an escaping mechanism, causing XSS vectors in multiple extensions.
Product
Joomla! CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record developer.joomla.org
Aug 18, 2024In Microcks before 1.10.0, the POST /api/import and POST /api/export endpoints allow non-administrator access.CVE-2024-44076 · Other software · microcks · reported by MITRECritical 9.8
In Microcks before 1.10.0, the POST /api/import and POST /api/export endpoints allow non-administrator access.
Product
microcks
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 18, 2024Pi-hole before 6 allows unauthenticated admin/api.php?setTempUnit= calls to change the temperature units of the web dashboard.CVE-2024-44069 · Other software · Pi-hole · reported by MITREHigh 7.5
Pi-hole before 6 allows unauthenticated admin/api.php?setTempUnit= calls to change the temperature units of the web dashboard. NOTE: the supplier reportedly does "not consider the bug a security issue" but the specific motivation for letting arbitrary persons change the value (Celsius, Fahrenheit, or Kelvin), seen by the device owner, is unclear.
Product
Pi-hole
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com kiyell.com
Aug 17, 2024In the Linux kernel, the following vulnerability has been resolved: virtio_net: Fix napi_skb_cache_put warning After the commit bdacf3e34945 ("net: Use nestedCVE-2024-43835 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: virtio_net: Fix napi_skb_cache_put warning After the commit bdacf3e34945 ("net: Use nested-BH locking for napi_alloc_cache.") was merged, the following warning began to appear: WARNING: CPU: 5 PID: 1 at net/core/skbuff.c:1451 napi_skb_cache_put+0x82/0x4b0 __warn+0x12f/0x340 napi_skb_cache_put+0x82/0x4b0 napi_skb_cache_put+0x82/0x4b0 report_bug+0x165/0x370 handle_bug+0x3d/0x80 exc_invalid_op+0x1a/0x50 asm_exc_invalid_op+0x1a/0x20 __free_old_xmit+0x1c8/0x510 napi_skb_cache_put+0x82/0x4b0 __free_old_xmit+0x1c8/0x510 __free_old_xmit+0x1c8/0x510 __pfx___free_old_xmit+0x10/0x10 The issue arises because virtio is assuming it's running in NAPI context even when it's not, such as in the netpoll case. To resolve this, modify virtnet_poll_tx() to only set NAPI when budget is available. Same for virtnet_poll_cleantx(), which always assumed that it was in a NAPI context.
Product
Linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org git.kernel.org
Aug 16, 2024A security issue was discovered in ingress-nginx where an actor with permission to create Ingress objects (in the `networking.k8s.io` or `extensions` API group)CVE-2024-7646 · Other software · Kubernetes · reported by jordan@liggitt.netHigh 8.8
A security issue was discovered in ingress-nginx where an actor with permission to create Ingress objects (in the `networking.k8s.io` or `extensions` API group) can bypass annotation validation to inject arbitrary commands and obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster.
Product
ingress-nginx
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 15, 2024Vulnerability in Xiexe XSOverlay before build 647 allows non-local websites to send the malicious commands to the WebSocket API, resulting in the arbitrary codeCVE-2024-23168 · Other software · xiexe · reported by MITRECritical 9.8
Vulnerability in Xiexe XSOverlay before build 647 allows non-local websites to send the malicious commands to the WebSocket API, resulting in the arbitrary code execution.
Product
xsoverlay
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com store.steampowered.com
Aug 14, 2024MStore API – Create Native Android & iOS Apps On The Cloud: Authentication bypassCVE-2024-7628 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 4.15.2. This is due to the use of loose comparison in the 'verify_id_token' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to an @flutter.io email address or phone number. This also requires firebase to be configured on the website and the user to have set up firebase for their account.
Product
MStore API – Create Native Android & iOS Apps On The Cloud
Affected
up to 4.15.2
What to do
Affects up to 4.15.2. Update MStore API – Create Native Android & iOS Apps On The Cloud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 14, 2024SequenceServer lets you rapidly set up a BLAST+ server with an intuitive user interface for personal or group use.CVE-2024-42360 · Other software · wurmlab · reported by GitHubCritical 9.8
SequenceServer lets you rapidly set up a BLAST+ server with an intuitive user interface for personal or group use. Several HTTP endpoints did not properly sanitize user input and/or query parameters. This could be exploited to inject and run unwanted shell commands. This vulnerability has been fixed in 3.1.2.
Product
sequenceserver
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 14, 2024Uncontrolled search path for some Intel(R) MPI Library software before version 2021.12 may allow an authenticated user to potentially enable escalation of priviCVE-2024-28876 · Other software · intel · reported by secure@intel.comMedium 5.4
Uncontrolled search path for some Intel(R) MPI Library software before version 2021.12 may allow an authenticated user to potentially enable escalation of privilege via local access.
Product
oneapi_hpc_toolkit
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record intel.com
Aug 14, 2024Uncontrolled search path for some Intel(R) oneAPI Compiler software before version 2024.1 may allow an authenticated user to potentially enable escalation of prCVE-2024-21857 · Other software · intel · reported by secure@intel.comMedium 5.4
Uncontrolled search path for some Intel(R) oneAPI Compiler software before version 2024.1 may allow an authenticated user to potentially enable escalation of privilege via local access.
Product
oneapi_compiler_software
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record intel.com
Aug 14, 2024Uncontrolled search path for some Intel(R) oneAPI Math Kernel Library software before version 2024.1 may allow an authenticated user to potentially enable escalCVE-2024-21766 · Other software · intel · reported by secure@intel.comMedium 5.4
Uncontrolled search path for some Intel(R) oneAPI Math Kernel Library software before version 2024.1 may allow an authenticated user to potentially enable escalation of privilege via local access.
Product
oneapi_math_kernel_library
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record intel.com
Aug 13, 2024Windows IP Routing Management Snapin Remote Code Execution VulnerabilityCVE-2024-38116 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Windows IP Routing Management Snapin Remote Code Execution Vulnerability
Product
Windows 10 Version 1809
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Aug 13, 2024Windows IP Routing Management Snapin Remote Code Execution VulnerabilityCVE-2024-38115 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Windows IP Routing Management Snapin Remote Code Execution Vulnerability
Product
Windows 11 Version 24H2
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Aug 13, 2024Windows IP Routing Management Snapin Remote Code Execution VulnerabilityCVE-2024-38114 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Windows IP Routing Management Snapin Remote Code Execution Vulnerability
Product
Windows 11 Version 24H2
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Aug 13, 2024Some OCC API endpoints in SAP Commerce Cloud allows Personally Identifiable Information (PII) data, such as passwords, email addresses, mobile numbers, coupon cCVE-2024-33003 · Websites & servers · SAP_SE · reported by cna@sap.comHigh 7.4
Some OCC API endpoints in SAP Commerce Cloud allows Personally Identifiable Information (PII) data, such as passwords, email addresses, mobile numbers, coupon codes, and voucher codes, to be included in the request URL as query or path parameters. On successful exploitation, this could lead to a High impact on confidentiality and integrity of the application.
Product
SAP Commerce Cloud
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record me.sap.com url.sap
Aug 12, 2024NVIDIA CV-CUDA for Ubuntu 20.04, Ubuntu 22.04, and Jetpack contains a vulnerability in Python APIs where a user may cause an uncontrolled resource consumption iCVE-2024-0115 · Other software · NVIDIA · reported by psirt@nvidia.comMedium 6.1
NVIDIA CV-CUDA for Ubuntu 20.04, Ubuntu 22.04, and Jetpack contains a vulnerability in Python APIs where a user may cause an uncontrolled resource consumption issue by a long running CV-CUDA Python process. A successful exploit of this vulnerability may lead to denial of service and data loss.
Product
NVIDIA CV-CUDA
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nvidia.custhelp.com
Aug 8, 2024Dorsett Controls Central Server update server has potential information leaks with an unprotected file that contains passwords and API keys.CVE-2024-39287 · Other software · Dorsett Controls · reported by ics-cert@hq.dhs.govMedium 6.9
Dorsett Controls Central Server update server has potential information leaks with an unprotected file that contains passwords and API keys.
Product
InfoScan
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record portal.dtscada.com cisa.gov
Aug 7, 2024The "soap_cgi.pyc" API handler allows the XML body of SOAP requests to contain references to external entities.CVE-2024-6893 · Other software · Journyx · reported by bbf0bd87-ece2-41be-b873-96928ee8fab9High 7.5
The "soap_cgi.pyc" API handler allows the XML body of SOAP requests to contain references to external entities. This allows an unauthenticated attacker to read local files, perform server-side request forgery, and overwhelm the web server resources.
Product
Journyx (jtime)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record korelogic.com seclists.org
Aug 7, 2024In Apache CloudStack 4.19.1.0, a regression in the network listing API allows unauthorised list access of network details for domain admin and normal user accouCVE-2024-42222 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 4.3
In Apache CloudStack 4.19.1.0, a regression in the network listing API allows unauthorised list access of network details for domain admin and normal user accounts. This vulnerability compromises tenant isolation, potentially leading to unauthorised access to network details, configurations and data. Affected users are advised to upgrade to version 4.19.1.1 to address this issue. Users on older versions of CloudStack considering to upgrade, can skip 4.19.1.0 and upgrade directly to 4.19.1.1.
Product
Apache CloudStack
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cloudstack.apache.org github.com
Aug 7, 2024CloudStack account-users by default use username and password based authentication for API and UI access.CVE-2024-42062 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.2
CloudStack account-users by default use username and password based authentication for API and UI access. Account-users can generate and register randomised API and secret keys and use them for the purpose of API-based automation and integrations. Due to an access permission validation issue that affects Apache CloudStack versions 4.10.0 up to 4.19.1.0, domain admin accounts were found to be able to query all registered account-users API and secret keys in an environment, including that of a root admin. An attacker who has domain admin access can exploit this to gain root admin and other-account privileges and perform malicious operations that can result in compromise of resources integrity and confidentiality, data loss, denial of service and availability of CloudStack managed infrastructure. Users are recommended to upgrade to Apache CloudStack 4.18.2.3 or 4.19.1.1, or later, which addresses this issue. Additionally, all account-user API and secret keys should be regenerated.
Product
Apache CloudStack
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cloudstack.apache.org lists.apache.org
Aug 6, 2024Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Soft AP daemon accessed via the PAPI protocol.CVE-2024-42400 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comMedium 5.3
Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Soft AP daemon accessed via the PAPI protocol. Successful exploitation of these vulnerabilities results in the ability to interrupt the normal operation of the affected Access Point.
Product
HPE Aruba Networking InstantOS and Aruba Access Points running ArubaOS 10
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hpe.com
Aug 6, 2024Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Soft AP daemon accessed via the PAPI protocol.CVE-2024-42399 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comMedium 5.3
Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Soft AP daemon accessed via the PAPI protocol. Successful exploitation of these vulnerabilities results in the ability to interrupt the normal operation of the affected Access Point.
Product
HPE Aruba Networking InstantOS and Aruba Access Points running ArubaOS 10
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hpe.com
Aug 6, 2024Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Soft AP daemon accessed via the PAPI protocol.CVE-2024-42398 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comMedium 5.3
Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Soft AP daemon accessed via the PAPI protocol. Successful exploitation of these vulnerabilities results in the ability to interrupt the normal operation of the affected Access Point.
Product
HPE Aruba Networking InstantOS and Aruba Access Points running ArubaOS 10
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hpe.com
Aug 6, 2024Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the AP Certificate Management daemon accessed via the PAPI protocol.CVE-2024-42397 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comMedium 5.3
Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the AP Certificate Management daemon accessed via the PAPI protocol. Successful exploitation of these vulnerabilities results in the ability to interrupt the normal operation of the affected Access Point.
Product
HPE Aruba Networking InstantOS and Aruba Access Points running ArubaOS 10
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hpe.com
Aug 6, 2024Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the AP Certificate Management daemon accessed via the PAPI protocol.CVE-2024-42396 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comMedium 5.3
Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the AP Certificate Management daemon accessed via the PAPI protocol. Successful exploitation of these vulnerabilities results in the ability to interrupt the normal operation of the affected Access Point.
Product
HPE Aruba Networking InstantOS and Aruba Access Points running ArubaOS 10
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hpe.com
Aug 6, 2024PrivX before 34.0 allows data exfiltration and denial of service via the REST API.CVE-2024-30170 · Other software · privx · reported by MITRECritical 9.1
PrivX before 34.0 allows data exfiltration and denial of service via the REST API. This is fixed in minor versions 33.1, 32.3, 31.3, and later, and in major version 34.0 and later,
Product
privx
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record info.ssh.com privx.docs.ssh.com
Aug 2, 2024The specific API in HWATAIServiSign Windows Version from CHANGING Information Technology does not properly validate the length of server-side inputs.CVE-2024-40723 · Other software · CHANGING Information Technology · reported by twcert@cert.org.twMedium 4.3
The specific API in HWATAIServiSign Windows Version from CHANGING Information Technology does not properly validate the length of server-side inputs. When a user visits a spoofed website, unauthenticated remote attackers can cause a stack-based buffer overflow in the HWATAIServiSign, temporarily disrupting its service.
Product
HWATAIServiSign Windows Version
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record twcert.org.tw twcert.org.tw
Aug 2, 2024The specific API in TCBServiSign Windows Version from CHANGING Information Technology does does not properly validate the length of server-side input.CVE-2024-40722 · Other software · CHANGING Information Technology · reported by twcert@cert.org.twMedium 4.3
The specific API in TCBServiSign Windows Version from CHANGING Information Technology does does not properly validate the length of server-side input. When a user visits a spoofed website, unauthenticated remote attackers can cause a stack-based buffer overflow in the TCBServiSign, temporarily disrupting its service.
Product
TCBServiSign Windows Version
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record twcert.org.tw twcert.org.tw
Aug 2, 2024The specific API in TCBServiSign Windows Version from CHANGING Information Technology does not properly validate server-side input.CVE-2024-40721 · Other software · CHANGING Information Technology · reported by twcert@cert.org.twHigh 8.8
The specific API in TCBServiSign Windows Version from CHANGING Information Technology does not properly validate server-side input. When a user visits a spoofed website, unauthenticated remote attackers can cause the TCBServiSign to load a DLL from an arbitrary path.
Product
TCBServiSign Windows Version
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record twcert.org.tw twcert.org.tw
Aug 2, 2024The specific API in TCBServiSign Windows Version from CHANGING Information Technology does not properly validate server-side input.CVE-2024-40720 · Other software · CHANGING Information Technology · reported by twcert@cert.org.twHigh 8.8
The specific API in TCBServiSign Windows Version from CHANGING Information Technology does not properly validate server-side input. When a user visits a spoofed website, unauthenticated remote attackers can modify the `HKEY_CURRENT_USER` registry to execute arbitrary commands.
Product
TCBServiSign Windows Version
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record twcert.org.tw twcert.org.tw
Jul 31, 2024A denial-of-service vulnerability could allow an authenticated user to trigger an internal service restart via a specially crafted API request.CVE-2022-4003 · Other software · Motorola · reported by psirt@lenovo.comLow 2.7
A denial-of-service vulnerability could allow an authenticated user to trigger an internal service restart via a specially crafted API request.
Product
Q14 Mesh Router Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record en-us.support.motorola.com
Jul 31, 2024A command injection vulnerability could allow an authenticated user to execute operating system commands as root via a specially crafted API request.CVE-2022-4002 · Other software · Motorola · reported by psirt@lenovo.comHigh 7.2
A command injection vulnerability could allow an authenticated user to execute operating system commands as root via a specially crafted API request.
Product
Q14 Mesh Router Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record en-us.support.motorola.com
Jul 31, 2024An authentication bypass vulnerability could allow an attacker to access API functions without authentication.CVE-2022-4001 · Other software · Motorola · reported by psirt@lenovo.comHigh 7.3
An authentication bypass vulnerability could allow an attacker to access API functions without authentication.
Product
Q14 Mesh Router Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record en-us.support.motorola.com
Jul 31, 2024Pheonix App is a Python application designed to streamline various tasks, from managing files to playing mini-games.CVE-2024-41951 · Other software · AkshuDev · reported by GitHubMedium 4.4
Pheonix App is a Python application designed to streamline various tasks, from managing files to playing mini-games. The issue is that the map of encoding/decoding languages are visible in code. The Problem was patched in 0.2.4.
Product
PheonixAppAPI
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Jul 31, 2024The Weave server API allows remote users to fetch files from a specific directory, but due to a lack of input validation, it is possible to traverse and leak arCVE-2024-7340 · Other software · weights_\&_biases · reported by reefs@jfrog.comHigh 8.8
The Weave server API allows remote users to fetch files from a specific directory, but due to a lack of input validation, it is possible to traverse and leak arbitrary files remotely. In various common scenarios, this allows a low-privileged user to assume the role of the server admin.
Product
weave
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com research.jfrog.com
Jul 30, 2024In versions of Akana API Platform prior to 2024.1.0 overly verbose errors can be found in SAML integrationsCVE-2024-5250 · Other software · Akana · reported by security@puppet.comLow 3.5
In versions of Akana API Platform prior to 2024.1.0 overly verbose errors can be found in SAML integrations
Product
Akana API Platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record portal.perforce.com portal.perforce.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.