Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
15,186 results · page 86 of 304
Feb 18, 2025An authenticated user in the "bestinformed Web" application can execute commands on the underlying server running the application.CVE-2025-0422 · Other software · Cordaware · reported by vulnerability@ncsc.chHigh 8.6
An authenticated user in the "bestinformed Web" application can execute commands on the underlying server running the application. (Remote Code Execution) For this, the user must be able to create "ScriptVars" with the type „script" and preview them by, for example, creating a new "Info". By default, admin users have those permissions, but with the granular permission system, those permissions may be assigned to other users. An attacker is able to execute commands on the server running the "bestinformed Web" application if an account with the correct permissions was compromised before.
- Product
- bestinformed Web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2025The standard user uses the run as function to start the MEAC applications with administrative privileges.CVE-2025-0867 · Other software · SICK AG · reported by psirt@sick.deCritical 9.9
The standard user uses the run as function to start the MEAC applications with administrative privileges. To ensure that the system can startup on its own, the credentials of the administrator were stored. Consequently, the EPC2 user can execute any command with administrative privileges. This allows a privilege escalation to the administrative level.
- Product
- SICK MEAC300
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2025Logic vulnerability in the mobile application (com.transsion.carlcare) may lead to the risk of account takeover.CVE-2025-1298 · Other software · TECNO · reported by 907edf6c-bf03-423e-ab1a-8da27e1aa1eaCritical 9.8
Logic vulnerability in the mobile application (com.transsion.carlcare) may lead to the risk of account takeover.
- Product
- com.transsion.carlcare
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.tecno.comsecurity.tecno.com
Feb 13, 2025Zulip is an open source team chat application.CVE-2025-25195 · Other software · zulip · reported by GitHubMedium 4.3
Zulip is an open source team chat application. A weekly cron job (added in 50256f48314250978f521ef439cafa704e056539) demotes channels to being "inactive" after they have not received traffic for 180 days. However, upon doing so, an event was sent to all users in the organization, not just users in the channel. This event contained the name of the private channel. Similarly, the same commit (50256f48314250978f521ef439cafa704e056539) added functionality to notify clients when channels stopped being "inactive." The first message sent to a private channel which had not previously had any messages for over 180 days (and were thus already marked "inactive") would leak an event to all users in the organization; this event also contained the name of the private channel. Commits 75be449d456d29fef27e9d1828bafa30174284b4 and a2a1a7f8d152296c8966f1380872c0ac69e5c87e fixed the issue. This vulnerability only existed in `main`, and was not part of any published versions.
- Product
- zulip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2025With a specially crafted Python script, an attacker could send continuous startMeasurement commands over an unencrypted Bluetooth connection to the affected dCVE-2025-24836 · Other software · Qardio · reported by ics-cert@hq.dhs.govMedium 6.1
With a specially crafted Python script, an attacker could send continuous startMeasurement commands over an unencrypted Bluetooth connection to the affected device. This would prevent the device from connecting to a clinician's app to take patient readings and ostensibly flood it with requests, resulting in a denial-of-service condition.
- Product
- Heart Health IOS Mobile Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2025An attacker could obtain firmware files and reverse engineer their intended use leading to loss of confidentiality and integrity of the hardware devices enablCVE-2025-23421 · Other software · Qardio · reported by ics-cert@hq.dhs.govMedium 6.9
An attacker could obtain firmware files and reverse engineer their intended use leading to loss of confidentiality and integrity of the hardware devices enabled by the Qardio iOS and Android applications.
- Product
- Heart Health IOS Mobile Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2025The Qardio Arm iOS application exposes sensitive data such as usernames and passwords in a plist file.CVE-2025-20615 · Other software · Qardio · reported by ics-cert@hq.dhs.govMedium 6.2
The Qardio Arm iOS application exposes sensitive data such as usernames and passwords in a plist file. This allows an attacker to log in to production-level development accounts and access an engineering backdoor in the application. The engineering backdoor allows the attacker to send hex-based commands over a UI-based terminal.
- Product
- Heart Health IOS Mobile Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2025The SecureDrop Client is a desktop application for journalists to communicate with sources and work with submissions on the SecureDrop Workstation.CVE-2025-24889 · Other software · freedomofpress · reported by GitHubMedium 4.5
The SecureDrop Client is a desktop application for journalists to communicate with sources and work with submissions on the SecureDrop Workstation. Prior to versions 0.14.1 and 1.0.1, an attacker who has already gained code execution in a virtual machine on the SecureDrop Workstation could gain code execution in the `sd-log` virtual machine by sending a specially crafted log entry. The vulnerability is not exploitable remotely and requires an attacker to already have code execution on one of the other virtual machines (VMs) of the system. Due to the Workstation's underlying usage of Qubes for strong isolation, the vulnerability would have allowed lateral movement between any log-enabled VM and the `sd-log` VM, but no further. The SecureDrop workstation collects logs centrally in an isolated virtual machine named `sd-log` for easy export for support and debugging purposes. The `sd-log` VM is completely isolated from the internet and ingests logs via a narrow Qubes RPC policy that allows for specific inter-VM communication via the Xen vchan protocol used by Qubes's qrexec mechanism. A path traversal bug was found in the logic used to choose where to write the log file for a specific
- Product
- securedrop-client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2025The SecureDrop Client is a desktop application for journalists to communicate with sources and work with submissions on the SecureDrop Workstation.CVE-2025-24888 · Other software · freedomofpress · reported by GitHubHigh 8.1
The SecureDrop Client is a desktop application for journalists to communicate with sources and work with submissions on the SecureDrop Workstation. Prior to version 0.14.1, a malicious SecureDrop Server could obtain code execution on the SecureDrop Client virtual machine (`sd-app`). SecureDrop Server itself has multiple layers of built-in hardening, and is a dedicated physical machine exposed on the internet only via Tor hidden services for the Source and Journalist interfaces, and optionally via remote SSH access over another Tor hidden service. A newsroom's SecureDrop Workstation communicates only with its own dedicated SecureDrop Server. The SecureDrop Client runs in a dedicated Qubes virtual machine, named `sd-app`, as part of the SecureDrop Workstation. The private OpenPGP key used to decrypt submissions and replies is stored in a separate virtual machine and never accessed directly. The vulnerability lies in the code responsible for downloading replies. The filename of the reply is obtained from the `Content-Disposition` HTTP header and used to write the encrypted reply on disk. Note that filenames are generated and sanitized server-side, and files are downloaded in an encry
- Product
- securedrop-client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A directory traversal vulnerability exists in the Mavenir SCE Application Provisioning Portal, version PORTAL-LBS-R_1_0_24_0, which allows an administrative useCVE-2024-34521 · Other software · reported by MITRELow 3.5
A directory traversal vulnerability exists in the Mavenir SCE Application Provisioning Portal, version PORTAL-LBS-R_1_0_24_0, which allows an administrative user to access system files with the file permissions of the privileged system user running the application.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025An authorization bypass vulnerability exists in the Mavenir SCE Application Provisioning Portal, version PORTAL-LBS-R_1_0_24_0, which allows an authenticated 'gCVE-2024-34520 · Other software · reported by MITREHigh 8.8
An authorization bypass vulnerability exists in the Mavenir SCE Application Provisioning Portal, version PORTAL-LBS-R_1_0_24_0, which allows an authenticated 'guest' user to perform unauthorized administrative actions, such as accessing the 'add user' feature, by bypassing client-side access controls.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025Rack provides an interface for developing web applications in Ruby.CVE-2025-25184 · Other software · rack · reported by GitHubMedium 5.7
Rack provides an interface for developing web applications in Ruby. Prior to versions 2.2.11, 3.0.12, and 3.1.10, Rack::CommonLogger can be exploited by crafting input that includes newline characters to manipulate log entries. The supplied proof-of-concept demonstrates injecting malicious content into logs. When a user provides the authorization credentials via Rack::Auth::Basic, if success, the username will be put in env['REMOTE_USER'] and later be used by Rack::CommonLogger for logging purposes. The issue occurs when a server intentionally or unintentionally allows a user creation with the username contain CRLF and white space characters, or the server just want to log every login attempts. If an attacker enters a username with CRLF character, the logger will log the malicious username with CRLF characters into the logfile. Attackers can break log formats or insert fraudulent entries, potentially obscuring real activity or injecting malicious data into log files. Versions 2.2.11, 3.0.12, and 3.1.10 contain a fix.
- Product
- rack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2025An issue in AnkiDroid Android Application v2.17.6 allows attackers to retrieve internal files from the /data/data/com.ichi2.anki/ directory and save it into pubCVE-2024-44336 · Other software · reported by MITREMedium 5.3
An issue in AnkiDroid Android Application v2.17.6 allows attackers to retrieve internal files from the /data/data/com.ichi2.anki/ directory and save it into publicly available storage.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2025GeoNetwork is a catalog application to manage spatially referenced resources.CVE-2024-32037 · Other software · geonetwork · reported by GitHubNone
GeoNetwork is a catalog application to manage spatially referenced resources. In versions prior to 4.2.10 and 4.4.5, the search end-point response headers contain information about Elasticsearch software in use. This information is valuable from a security point of view because it allows software used by the server to be easily identified. GeoNetwork 4.4.5 and 4.2.10 fix this issue. No known workarounds are available.
- Product
- core-geonetwork
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.geonetwork-opensource.orggithub.com
Feb 11, 2025Ash Authentication is an authentication framework for Elixir applications.CVE-2025-25202 · Other software · team-alembic · reported by GitHubMedium 6.3
Ash Authentication is an authentication framework for Elixir applications. Applications which have been bootstrapped by the igniter installer present since AshAuthentication v4.1.0 and who have used the magic link strategy _or_ are manually revoking tokens are affected by revoked tokens being allowed to verify as valid. Unless one hase implemented any kind of custom token revocation feature in your application, then one will not be affected. The impact here for users using builtin functionality is that magic link tokens are reusable until they expire. With that said, magic link tokens are only valid for 10 minutes, so the surface area for abuse is extremely low here. The flaw is patched in version 4.4.9. Additionally a compile time warning is shown to users with remediation instructions if they upgrade. 4.4.9 ships with an upgrader, so those who use `mix igniter.upgrade ash_authentication` will have the necessary patch applied. Otherwise, one may run the upgrader manually as described in the error message. As a workaround, delete the generated `:revoked?` generic action in the token resource. This will cause it to use the one internal to Ash Authentication which has always been cor
- Product
- ash_authentication
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2025Substance3D - Stager versions 3.1.0 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service.CVE-2025-21155 · Other software · Adobe · reported by AdobeMedium 5.5
Substance3D - Stager versions 3.1.0 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Substance3D - Stager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2025InDesign Desktop versions ID20.0, ID19.5.1 and earlier are affected by an Improper Input Validation vulnerability that could result in an application denial-of-CVE-2025-21126 · Other software · Adobe · reported by AdobeMedium 5.5
InDesign Desktop versions ID20.0, ID19.5.1 and earlier are affected by an Improper Input Validation vulnerability that could result in an application denial-of-service condition. An attacker could exploit this vulnerability to cause the application to crash, resulting in a denial of service. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- InDesign Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2025InDesign Desktop versions ID20.0, ID19.5.1 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-seCVE-2025-21125 · Other software · Adobe · reported by AdobeMedium 5.5
InDesign Desktop versions ID20.0, ID19.5.1 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- InDesign Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2025OS command injection in the admin web console of Ivanti CSA before version 5.0.5 allows a remote authenticated attacker with admin privileges to achieve remote CVE-2024-47908 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75Critical 9.1
OS command injection in the admin web console of Ivanti CSA before version 5.0.5 allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- Product
- Cloud Services Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2025Path traversal in Ivanti CSA before version 5.0.5 allows a remote unauthenticated attacker to access restricted functionality.CVE-2024-11771 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75Medium 5.3
Path traversal in Ivanti CSA before version 5.0.5 allows a remote unauthenticated attacker to access restricted functionality.
- Product
- Cloud Services Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2025Due to a missing authorization check, an attacker who is logged in to application can view/ delete �My Overtime Requests� which could allow the attacker to acceCVE-2025-25241 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.4
Due to a missing authorization check, an attacker who is logged in to application can view/ delete �My Overtime Requests� which could allow the attacker to access employee information. This leads to low impact on confidentiality, integrity of the application. There is no impact on availability.
- Product
- SAP Fiori Apps Reference Library (My Overtime Requests)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2025SAP NetWeaver Application Server Java allows an attacker to access an endpoint that can disclose information about deployed server components, including their XCVE-2025-24869 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
SAP NetWeaver Application Server Java allows an attacker to access an endpoint that can disclose information about deployed server components, including their XML definitions. This information should ideally be restricted to customer administrators, even though they may not need it. These XML files are not entirely SAP-internal as they are deployed with the server. In such a scenario, sensitive information could be exposed without compromising its integrity or availability.
- Product
- SAP NetWeaver Application Server Java
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2025The User Account and Authentication service (UAA) for SAP HANA extended application services, advanced model (SAP HANA XS advanced model) allows an unauthenticaCVE-2025-24868 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 7.1
The User Account and Authentication service (UAA) for SAP HANA extended application services, advanced model (SAP HANA XS advanced model) allows an unauthenticated attacker to craft a malicious link, that, when clicked by a victim, redirects the browser to a malicious site due to insufficient redirect URL validation. On successful exploitation attacker can cause limited impact on confidentiality, integrity, and availability of the system.
- Product
- SAP HANA extended application services, advanced model (User Account and Authentication Services)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2025SAP NetWeaver Application Server Java does not sufficiently handle user input, resulting in a stored cross-site scripting vulnerability.CVE-2025-0054 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.4
SAP NetWeaver Application Server Java does not sufficiently handle user input, resulting in a stored cross-site scripting vulnerability. The application allows attackers with basic user privileges to store a Javascript payload on the server, which could be later executed in the victim's web browser. With this the attacker might be able to read or modify information associated with the vulnerable web page.
- Product
- SAP NetWeaver Application Server Java
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2025Netty, an asynchronous, event-driven network application framework, has a vulnerability in versions up to and including 4.1.118.Final.CVE-2025-25193 · Other software · netty · reported by GitHubMedium 5.5
Netty, an asynchronous, event-driven network application framework, has a vulnerability in versions up to and including 4.1.118.Final. An unsafe reading of environment file could potentially cause a denial of service in Netty. When loaded on an Windows application, Netty attempts to load a file that does not exist. If an attacker creates such a large file, the Netty application crash. A similar issue was previously reported as CVE-2024-47535. This issue was fixed, but the fix was incomplete in that null-bytes were not counted against the input limit. Commit d1fbda62d3a47835d3fb35db8bd42ecc205a5386 contains an updated fix.
- Product
- netty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2025Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final and prior to version 4.1.118.Final.CVE-2025-24970 · Other software · netty · reported by GitHubHigh 7.5
Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final and prior to version 4.1.118.Final. When a special crafted packet is received via SslHandler it doesn't correctly handle validation of such a packet in all cases which can lead to a native crash. Version 4.1.118.Final contains a patch. As workaround its possible to either disable the usage of the native SSLEngine or change the code manually.
- Product
- netty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2025Vulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication when using HTTPS endpoinCVE-2024-42513 · Other software · Siemens · reported by MITREMedium 5.3
Vulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication when using HTTPS endpoints.
- Product
- Industrial Edge for Machine Tools (formerly known as "SINUMERIK Edge")
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfiles.opcfoundation.orgcert-portal.siemens.com
Feb 10, 2025Vulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication when the deprecated BasiCVE-2024-42512 · Other software · Siemens · reported by MITREHigh 8.6
Vulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication when the deprecated Basic128Rsa15 security policy is enabled.
- Product
- SIMATIC Energy Manager PRO V7.2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfiles.opcfoundation.orgcert-portal.siemens.com
Feb 7, 2025Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks.CVE-2025-25187 · Other software · laurent22 · reported by GitHubHigh 7.8
Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. This vulnerability is caused by adding note titles to the document using React's `dangerouslySetInnerHTML`, without first escaping HTML entities. Joplin lacks a Content-Security-Policy with a restrictive `script-src`. This allows arbitrary JavaScript execution via inline `onclick`/`onload` event handlers in unsanitized HTML. Additionally, Joplin's main window is created with `nodeIntegration` set to `true`, allowing arbitrary JavaScript execution to result in arbitrary code execution. Anyone who 1) receives notes from unknown sources and 2) uses <kbd>ctrl</kbd>-<kbd>p</kbd> to search is impacted. This issue has been addressed in version 3.1.24 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- joplin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.mozilla.orggithub.com
Feb 7, 2025Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks.CVE-2025-24028 · Other software · laurent22 · reported by GitHubHigh 7.8
Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. This vulnerability is caused by differences between how Joplin's HTML sanitizer handles comments and how the browser handles comments. This affects both the Rich Text Editor and the Markdown viewer. However, unlike the Rich Text Editor, the Markdown viewer is `cross-origin isolated`, which prevents JavaScript from directly accessing functions/variables in the toplevel Joplin `window`. This issue is not present in Joplin 3.1.24 and may have been introduced in `9b50539`. This is an XSS vulnerability that impacts users that open untrusted notes in the Rich Text Editor. This vulnerability has been addressed in version 3.2.12 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- joplin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 7, 2025Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks.CVE-2024-55630 · Other software · laurent22 · reported by GitHubLow 3.3
Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Joplin's HTML sanitizer allows the `name` attribute to be specified. If `name` is set to the same value as an existing `document` property (e.g. `querySelector`), that property is replaced with the element. This vulnerability's only known impact is denial of service. The note viewer fails to refresh until closed and re-opened with a different note. This issue has been addressed in version 3.2.8 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- joplin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorden.wikipedia.orggithub.com
Feb 6, 2025Stored Cross Site Scripting(XSS) vulnerability in Egavilan Media Resumes Management and Job Application Website 1.0 allows remote attackers to inject arbitrary CVE-2020-36085 · Other software · reported by MITREMedium 6.3
Stored Cross Site Scripting(XSS) vulnerability in Egavilan Media Resumes Management and Job Application Website 1.0 allows remote attackers to inject arbitrary code via First and Last Name in Apply For This Job Form.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2025A Stored Cross-Site Scripting (Stored XSS) vulnerability has been found in the Holded application.CVE-2025-1076 · Other software · Holded · reported by cve-coordination@incibe.esMedium 4.8
A Stored Cross-Site Scripting (Stored XSS) vulnerability has been found in the Holded application. This vulnerability could allow an attacker to store a JavaScript payload within the editable ‘name’ and ‘icon’ parameters of the Activities functionality.
- Product
- Holded
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2025Sandbox escape in the JavaScript Task feature of Google Cloud Application Integration allows an actor to execute arbitrary unsandboxed code via crafted JavaScriCVE-2025-0982 · Computers, phones & browsers · Google Cloud · reported by cve-coordination@google.comCritical 9.4
Sandbox escape in the JavaScript Task feature of Google Cloud Application Integration allows an actor to execute arbitrary unsandboxed code via crafted JavaScript code executed by the Rhino engine. Effective January 24, 2025, Application Integration will no longer support Rhino as the JavaScript execution engine. No further fix actions are needed.
- Product
- Application Integration
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2025Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment fraCVE-2025-24805 · Other software · MobSF · reported by GitHubHigh 8.5
Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework. A local user with minimal privileges is able to make use of an access token for materials for scopes which it should not be accepted. This issue has been addressed in version 4.3.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- Mobile-Security-Framework-MobSF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2025Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment fraCVE-2025-24804 · Other software · MobSF · reported by GitHubMedium 4.8
Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework. According to Apple's documentation for bundle ID's, it must contain only alphanumeric characters (A–Z, a–z, and 0–9), hyphens (-), and periods (.). However, an attacker can manually modify this value in the `Info.plist` file and add special characters to the `<key>CFBundleIdentifier</key>` value. When the application parses the wrong characters in the bundle ID, it encounters an error. As a result, it will not display content and will throw a 500 error instead. The only way to make the pages work again is to manually remove the malicious application from the system. This issue has been addressed in version 4.3.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- Mobile-Security-Framework-MobSF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.apple.comgithub.com
Feb 5, 2025Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment fraCVE-2025-24803 · Other software · MobSF · reported by GitHubHigh 8.4
Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework. According to Apple's documentation for bundle ID's, it must contain only alphanumeric characters (A–Z, a–z, and 0–9), hyphens (-), and periods (.). However, an attacker can manually modify this value in the `Info.plist` file and add special characters to the `<key>CFBundleIdentifier</key>` value. The `dynamic_analysis.html` file does not sanitize the received bundle value from Corellium and as a result, it is possible to break the HTML context and achieve Stored XSS. This issue has been addressed in version 4.3.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- Mobile-Security-Framework-MobSF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.apple.comgithub.com
Feb 5, 2025When SIP session Application Level Gateway mode (ALG) profile with Passthru Mode enabled and SIP router ALG profile are configured on a Message Routing type virCVE-2025-20045 · Network & remote access · F5 · reported by f5sirt@f5.comHigh 8.7
When SIP session Application Level Gateway mode (ALG) profile with Passthru Mode enabled and SIP router ALG profile are configured on a Message Routing type virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- Product
- BIG-IP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2025A vulnerability in a policy-based Cisco Application Visibility and Control (AVC) implementation of Cisco AsyncOS Software for Cisco Secure Web Appliance could aCVE-2025-20183 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.8
A vulnerability in a policy-based Cisco Application Visibility and Control (AVC) implementation of Cisco AsyncOS Software for Cisco Secure Web Appliance could allow an unauthenticated, remote attacker to evade the antivirus scanner and download a malicious file onto an endpoint. The vulnerability is due to improper handling of a crafted range request header. An attacker could exploit this vulnerability by sending an HTTP request with a crafted range request header through the affected device. A successful exploit could allow the attacker to evade the antivirus scanner and download malware onto the endpoint without detection by Cisco Secure Web Appliance.
- Product
- Cisco Secure Web Appliance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Feb 4, 2025In Ashlar-Vellum Cobalt versions prior to v12 SP2 Build (1204.200), the affected application lacks proper validation of user-supplied data when parsing CO filesCVE-2023-40222 · Other software · Ashlar-Vellum · reported by ics-cert@hq.dhs.govHigh 8.4
In Ashlar-Vellum Cobalt versions prior to v12 SP2 Build (1204.200), the affected application lacks proper validation of user-supplied data when parsing CO files. This could lead to a heap-based buffer overflow. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process.
- Product
- Cobalt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2025In Ashlar-Vellum Cobalt versions prior to v12 SP2 Build (1204.200), the affected application lacks proper validation of user-supplied data when parsing XE filesCVE-2023-39943 · Other software · Ashlar-Vellum · reported by ics-cert@hq.dhs.govHigh 8.4
In Ashlar-Vellum Cobalt versions prior to v12 SP2 Build (1204.200), the affected application lacks proper validation of user-supplied data when parsing XE files. This could lead to an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process.
- Product
- Cobalt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2025reNgine is an automated reconnaissance framework for web applications.CVE-2025-24968 · Other software · yogeshojha · reported by GitHubHigh 8.8
reNgine is an automated reconnaissance framework for web applications. An unrestricted project deletion vulnerability allows attackers with specific roles, such as `penetration_tester` or `auditor` to delete all projects in the system. This can lead to a complete system takeover by redirecting the attacker to the onboarding page, where they can add or modify users, including Sys Admins, and configure critical settings like API keys and user preferences. This issue affects all versions up to and including 2.20. Users are advised to monitor the project for future releases which address this issue. There are no known workarounds.
- Product
- rengine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2025reNgine is an automated reconnaissance framework for web applications.CVE-2025-24967 · Other software · yogeshojha · reported by GitHubHigh 7.4
reNgine is an automated reconnaissance framework for web applications. A stored cross-site scripting (XSS) vulnerability exists in the admin panel's user management functionality. An attacker can exploit this issue by injecting malicious payloads into the username field during user creation. This vulnerability allows unauthorized script execution whenever the admin views or interacts with the affected user entry, posing a significant risk to sensitive admin functionalities. This issue affects all versions up to and including 2.20. Users are advised to monitor the project for future releases which address this issue. There are no known workarounds.
- Product
- rengine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2025reNgine is an automated reconnaissance framework for web applications.CVE-2025-24966 · Other software · yogeshojha · reported by GitHubMedium 5.3
reNgine is an automated reconnaissance framework for web applications. HTML Injection occurs when an application improperly validates or sanitizes user inputs, allowing attackers to inject arbitrary HTML code. In this scenario, the vulnerability exists in the "Add Target" functionality of the application, where the Target Organization and Target Description fields accept HTML payloads. The injected HTML is rendered and executed in the target area, potentially leading to malicious actions. Exploitation of HTML Injection can compromise the application's integrity and user trust. Attackers can execute unauthorized actions, steal sensitive information, or trick users into performing harmful actions. The organization's reputation, customer trust, and regulatory compliance could be negatively affected. This issue affects all versions up to and including 2.2.0. Users are advised to monitor the project for future releases which address this issue. There are no known workarounds.
- Product
- rengine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2025DumpDrop is a stupid simple file upload application that provides an interface for dragging and dropping files.CVE-2025-24971 · Other software · DumbWareio · reported by GitHubCritical 9.5
DumpDrop is a stupid simple file upload application that provides an interface for dragging and dropping files. An OS Command Injection vulnerability was discovered in the DumbDrop application, `/upload/init` endpoint. This vulnerability could allow an attacker to execute arbitrary code remotely when the **Apprise Notification** enabled. This issue has been addressed in commit `4ff8469d` and all users are advised to patch. There are no known workarounds for this vulnerability.
- Product
- DumbDrop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2025Authentik project is vulnerable to Stored XSS attacks through uploading crafted SVG files that are used as application icons.CVE-2024-11623 · Other software · goauthentik · reported by cvd@cert.plMedium 4.8
Authentik project is vulnerable to Stored XSS attacks through uploading crafted SVG files that are used as application icons. This action could only be performed by an authenticated admin user. The issue was fixed in 2024.10.4 release.
- Product
- authentik
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.pldocs.goauthentik.io
Feb 4, 2025Improper Export of Android Application Components in Settings prior to SMR Feb-2025 Release 1 allows local attackers to enable ADB.CVE-2025-20906 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5.5
Improper Export of Android Application Components in Settings prior to SMR Feb-2025 Release 1 allows local attackers to enable ADB.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.com
Feb 4, 2025Authentication Bypass Using an Alternate Path in Galaxy Store prior to version 4.5.87.6 allows physical attackers to install arbitrary applications to bypass reCVE-2025-20895 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comLow 3.2
Authentication Bypass Using an Alternate Path in Galaxy Store prior to version 4.5.87.6 allows physical attackers to install arbitrary applications to bypass restrictions of Setupwizard.
- Product
- Galaxy Store
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.com
Feb 3, 2025reNgine is an automated reconnaissance framework for web applications.CVE-2025-24962 · Other software · yogeshojha · reported by GitHubHigh 8.7
reNgine is an automated reconnaissance framework for web applications. In affected versions a user can inject commands via the nmap_cmd parameters. This issue has been addressed in commit `c28e5c8d` and is expected in the next versioned release. Users are advised to filter user input and monitor the project for a new release.
- Product
- rengine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2025reNgine is an automated reconnaissance framework for web applications.CVE-2025-24899 · Other software · yogeshojha · reported by GitHubHigh 7.1
reNgine is an automated reconnaissance framework for web applications. A vulnerability was discovered in reNgine, where **an insider attacker with any role** (such as Auditor, Penetration Tester, or Sys Admin) **can extract sensitive information from other reNgine users.** After running a scan and obtaining vulnerabilities from a target, the attacker can retrieve details such as `username`, `password`, `email`, `role`, `first name`, `last name`, `status`, and `activity information` by making a GET request to `/api/listVulnerability/`. This issue has been addressed in version 2.2.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- rengine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.