Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
15,186 results · page 87 of 304
Feb 3, 2025Information disclosure vulnerability in Geovision GV-ASManager web application with the version v6.1.0.0 or less, which discloses account information, includingCVE-2024-56902 · Other software · reported by MITREHigh 7.5
Information disclosure vulnerability in Geovision GV-ASManager web application with the version v6.1.0.0 or less, which discloses account information, including cleartext password.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2025A Cross-Site Request Forgery (CSRF) vulnerability in Geovision GV-ASWeb application with the version 6.1.1.0 or less that allows attackers to arbitrarily createCVE-2024-56901 · Other software · reported by MITREHigh 8.8
A Cross-Site Request Forgery (CSRF) vulnerability in Geovision GV-ASWeb application with the version 6.1.1.0 or less that allows attackers to arbitrarily create Administrator accounts via a crafted GET request method. This vulnerability is used in chain with CVE-2024-56903 for a successful CSRF attack.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2025The com.enflick.android.TextNow (aka TextNow: Call + Text Unlimited) application 24.17.0.2 for Android enables any installed application (with no permissions) tCVE-2024-36437 · Other software · reported by MITREMedium 6.5
The com.enflick.android.TextNow (aka TextNow: Call + Text Unlimited) application 24.17.0.2 for Android enables any installed application (with no permissions) to place phone calls without user interaction by sending a crafted intent via the com.enflick.android.TextNow.activities.DialerActivity component.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.complay.google.com
Jan 31, 2025Dumb Drop is a file upload application.CVE-2025-24891 · Other software · DumbWareio · reported by GitHubCritical 9.6
Dumb Drop is a file upload application. Users with permission to upload to the service are able to exploit a path traversal vulnerability to overwrite arbitrary system files. As the container runs as root by default, there is no limit to what can be overwritten. With this, it's possible to inject malicious payloads into files ran on schedule or upon certain service actions. As the service is not required to run with authentication enabled, this may permit wholly unprivileged users root access. Otherwise, anybody with a PIN.
- Product
- DumbDrop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 31, 2025A Host header injection vulnerability exists in CTFd 3.7.5, due to the application failing to properly validate or sanitize the Host header.CVE-2025-23001 · Other software · reported by MITREMedium 6.1
A Host header injection vulnerability exists in CTFd 3.7.5, due to the application failing to properly validate or sanitize the Host header. An attacker can manipulate the Host header in HTTP requests, which may lead to phishing attacks, reset password, or cache poisoning. NOTE: the Supplier's position is that the end user is supposed to edit the NGINX configuration template to set server_name (with this setting, Host header injection cannot occur).
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.ctfd.iocodetoanbug.com
Jan 30, 2025An improper input validation the CSRF filter results in unsanitized user input written to the application logs.CVE-2025-24504 · Other software · Broadcom · reported by secure@symantec.comMedium 5.3
An improper input validation the CSRF filter results in unsanitized user input written to the application logs.
- Product
- Symantec Privileged Access Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2025A flaw was found in the Wildfly Server Role Based Access Control (RBAC) provider.CVE-2025-23367 · Other software · Red Hat · reported by Red HatMedium 6.5
A flaw was found in the Wildfly Server Role Based Access Control (RBAC) provider. When authorization to control management operations is secured using the Role Based Access Control provider, a user without the required privileges can suspend or resume the server. A user with a Monitor or Auditor role is supposed to have only read access permissions and should not be able to suspend the server. The vulnerability is caused by the Suspend and Resume handlers not performing authorization checks to validate whether the current user has the required permissions to proceed with the action.
- Product
- Red Hat JBoss Enterprise Application Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Jan 29, 2025The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations.CVE-2025-24795 · Other software · snowflakedb · reported by GitHubMedium 4.4
The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Snowflake discovered and remediated a vulnerability in the Snowflake Connector for Python. On Linux systems, when temporary credential caching is enabled, the Snowflake Connector for Python will cache temporary credentials locally in a world-readable file. This vulnerability affects versions 2.3.7 through 3.13.0. Snowflake fixed the issue in version 3.13.1.
- Product
- snowflake-connector-python
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2025The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations.CVE-2025-24794 · Other software · snowflakedb · reported by GitHubMedium 6.7
The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Snowflake discovered and remediated a vulnerability in the Snowflake Connector for Python. The OCSP response cache uses pickle as the serialization format, potentially leading to local privilege escalation. This vulnerability affects versions 2.7.12 through 3.13.0. Snowflake fixed the issue in version 3.13.1.
- Product
- snowflake-connector-python
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2025The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations.CVE-2025-24793 · Other software · snowflakedb · reported by GitHubHigh 7
The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Snowflake discovered and remediated a vulnerability in the Snowflake Connector for Python. A function from the snowflake.connector.pandas_tools module is vulnerable to SQL injection. This vulnerability affects versions 2.2.5 through 3.13.0. Snowflake fixed the issue in version 3.13.1.
- Product
- snowflake-connector-python
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2025An issue was discovered in Akamai Enterprise Application Access (EAA) before 2025-01-17.CVE-2025-24527 · Other software · Akamai · reported by MITREHigh 8
An issue was discovered in Akamai Enterprise Application Access (EAA) before 2025-01-17. If an admin knows another tenant's 128-bit connector GUID, they can execute debug commands on that connector.
- Product
- Enterprise Application Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtechdocs.akamai.comtechdocs.akamai.com
Jan 29, 2025Zohocorp ManageEngine Applications Manager versions 174000 and prior are vulnerable to the incorrect authorization in the update user function.CVE-2024-41140 · Other software · ManageEngine · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 8.1
Zohocorp ManageEngine Applications Manager versions 174000 and prior are vulnerable to the incorrect authorization in the update user function.
- Product
- Applications Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2025Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists.CVE-2025-23213 · Other software · TandoorRecipes · reported by GitHubHigh 8.7
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. The file upload feature allows to upload arbitrary files, including html and svg. Both can contain malicious content (XSS Payloads). This vulnerability is fixed in 1.5.28.
- Product
- recipes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2025Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists.CVE-2025-23212 · Other software · TandoorRecipes · reported by GitHubHigh 7.7
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. The external storage feature allows any user to enumerate the name and content of files on the server. This vulnerability is fixed in 1.5.28.
- Product
- recipes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2025Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists.CVE-2025-23211 · Other software · TandoorRecipes · reported by GitHubCritical 9.9
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. A Jinja2 SSTI vulnerability allows any user to execute commands on the server. In the case of the provided Docker Compose file as root. This vulnerability is fixed in 1.5.24.
- Product
- recipes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2025Cross Site Scripting vulnerability in AdGuard Application v.7.18.1 (4778) and before allows an attacker to execute arbitrary code via a crafted payload to the fCVE-2024-48662 · Other software · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in AdGuard Application v.7.18.1 (4778) and before allows an attacker to execute arbitrary code via a crafted payload to the fontMatrix component.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2025A vulnerability in OTRS Application Server and reverse proxy settings allows session hijacking due to missing attributes for sensitive cookie settings in HTTPS CVE-2025-24390 · Other software · OTRS AG · reported by security@otrs.comMedium 6.8
A vulnerability in OTRS Application Server and reverse proxy settings allows session hijacking due to missing attributes for sensitive cookie settings in HTTPS sessions. This issue affects: * OTRS 7.0.X * OTRS 8.0.X * OTRS 2023.X * OTRS 2024.X
- Product
- OTRS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 25, 2025IBM Maximo Application Suite 8.10.12, 8.11.0, 9.0.1, and 9.1.0 - Monitor Component does not neutralize output that is written to logs, which could allow an attaCVE-2024-35150 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM Maximo Application Suite 8.10.12, 8.11.0, 9.0.1, and 9.1.0 - Monitor Component does not neutralize output that is written to logs, which could allow an attacker to inject false log entries.
- Product
- Maximo Application Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 25, 2025IBM Maximo Application Suite 8.10.10, 8.11.7, and 9.0 - Monitor Component is vulnerable to SQL injection.CVE-2024-35148 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.3
IBM Maximo Application Suite 8.10.10, 8.11.7, and 9.0 - Monitor Component is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database.
- Product
- Maximo Application Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 25, 2025IBM Maximo Application Suite 9.0.0 - Monitor Component is vulnerable to cross-site scripting.CVE-2024-35145 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.1
IBM Maximo Application Suite 9.0.0 - Monitor Component is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
- Product
- Maximo Application Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 25, 2025IBM Maximo Application Suite 8.10, 8.11, and 9.0 - Monitor Component stores source code on the web server that could aid in further attacks against the system.CVE-2024-35144 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM Maximo Application Suite 8.10, 8.11, and 9.0 - Monitor Component stores source code on the web server that could aid in further attacks against the system.
- Product
- Maximo Application Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 24, 2025Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.CVE-2025-24025 · Other software · coollabsio · reported by GitHubLow 1.3
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.380, the tags page allows users to search for tags. If the search does not return any results, the query gets reflected on the error modal, which leads to cross-site scripting. Version 4.0.0-beta.380 fixes the issue.
- Product
- coolify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 24, 2025Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.CVE-2025-22612 · Other software · coollabsio · reported by GitHubCritical 10
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.374, the missing authorization allows an authenticated user to retrieve any existing private keys on a coolify instance in plain text. If the server configuration of IP / domain, port (most likely 22) and user (root) matches with the victim's server configuration, then the attacker can execute arbitrary commands on the remote server. Version 4.0.0-beta.374 fixes the issue.
- Product
- coolify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 24, 2025Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.CVE-2025-22611 · Other software · coollabsio · reported by GitHubCritical 9.9
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.361, the missing authorization allows any authenticated user to escalate his or any other team members privileges to any role, including the owner role. He's also able to kick every other member out of the team, including admins and owners. This allows the attacker to access the `Terminal` feature and execute remote commands. Version 4.0.0-beta.361 fixes the issue.
- Product
- coolify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 24, 2025Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.CVE-2025-22610 · Other software · coollabsio · reported by GitHubMedium 5.7
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.361, the missing authorization allows any authenticated user to fetch the global coolify instance OAuth configuration. This exposes the "client id" and "client secret" for every custom OAuth provider. The attacker can also modify the global OAuth configuration. Version 4.0.0-beta.361 fixes the issue.
- Product
- coolify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 24, 2025Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.CVE-2025-22609 · Other software · coollabsio · reported by GitHubCritical 10
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.361, the missing authorization allows any authenticated user to attach any existing private key on a coolify instance to his own server. If the server configuration of IP / domain, port (most likely 22) and user (root) matches with the victim's server configuration, then the attacker can use the `Terminal` feature and execute arbitrary commands on the victim's server. Version 4.0.0-beta.361 fixes the issue.
- Product
- coolify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 24, 2025Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.CVE-2025-22608 · Other software · coollabsio · reported by GitHubMedium 6.5
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.361, the missing authorization allows any authenticated user to revoke any team invitations on a Coolify instance by only providing a predictable and incrementing ID, resulting in a Denial-of-Service attack (DOS). Version 4.0.0-beta.361 fixes the issue.
- Product
- coolify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 24, 2025Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.CVE-2025-22607 · Other software · coollabsio · reported by GitHubMedium 4.7
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.361, the missing authorization allows any authenticated user to fetch the details page for any GitHub / GitLab configuration on a Coolify instance by only knowing the UUID of the model. This exposes the "client id", "client secret" and "webhook secret." Version 4.0.0-beta.361 fixes this issue.
- Product
- coolify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 24, 2025Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.CVE-2025-22606 · Other software · coollabsio · reported by GitHubHigh 8.5
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In version 4.0.0-beta.358 and possibly earlier versions, when creating or updating a "project," it is possible to inject arbitrary shell commands by altering the project name. If a name includes unescaped characters, such as single quotes (`'`), it breaks out of the intended command structure, allowing attackers to execute arbitrary commands on the host system. This vulnerability allows attackers to execute arbitrary commands on the host server, which could result in full system compromise; create, modify, or delete sensitive system files; and escalate privileges depending on the permissions of the executed process. Attackers with access to project management features could exploit this flaw to gain unauthorized control over the host environment. Version 4.0.0-beta.359 fixes this issue.
- Product
- coolify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 24, 2025Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.CVE-2025-22605 · Other software · coollabsio · reported by GitHubHigh 8.5
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Starting in version 4.0.0-beta.18 and prior to 4.0.0-beta.253, a vulnerability in the execution of commands on remote servers allows an authenticated user to execute arbitrary code on the local Coolify container, gaining access to data and private keys or tokens of other users/teams. The ability to inject malicious commands into the Coolify container gives authenticated attackers the ability to fully retrieve and control the data and availability of the software. Centrally hosted Coolify instances (open registration and/or multiple teams with potentially untrustworthy users) are especially at risk, as sensitive data of all users and connected servers can be leaked by any user. Additionally, attackers are able to modify the running software, potentially deploying malicious images to remote nodes or generally changing its behavior. Version 4.0.0-beta.253 patches this issue.
- Product
- coolify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2025IBM Tivoli Application Dependency Discovery Manager 7.3.0.0 through 7.3.0.11 is vulnerable to stored cross-site scripting.CVE-2025-23227 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.4
IBM Tivoli Application Dependency Discovery Manager 7.3.0.0 through 7.3.0.11 is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
- Product
- Tivoli Application Dependency Discovery Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2025It has been found that the Beta10 software does not provide for proper authorisation control in multiple areas of the application.CVE-2025-0637 · Other software · Beta10 · reported by cve-coordination@incibe.esCritical 9.8
It has been found that the Beta10 software does not provide for proper authorisation control in multiple areas of the application. This deficiency could allow a malicious actor, without authentication, to access private areas and/or areas intended for other roles. The vulnerability has been identified at least in the file or path ‘/app/tools.html’.
- Product
- Beta10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2025SQL Injection vulnerability in the default configuration of the Logitime WebClock application <= 5.43.0 allows an unauthenticated user to run arbitrary code on CVE-2024-55971 · Other software · reported by MITRECritical 10
SQL Injection vulnerability in the default configuration of the Logitime WebClock application <= 5.43.0 allows an unauthenticated user to run arbitrary code on the backend database server.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorden.logitime.comnl.logitime.com
Jan 22, 2025Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway.CVE-2025-24030 · Other software · envoyproxy · reported by GitHubHigh 7.1
Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. A user with access to the Kubernetes cluster can use a path traversal attack to execute Envoy Admin interface commands on proxies managed by any version of Envoy Gateway prior to 1.2.6. The admin interface can be used to terminate the Envoy process and extract the Envoy configuration (possibly containing confidential data). Version 1.2.6 fixes the issue. As a workaround, the `EnvoyProxy` API can be used to apply a bootstrap config patch that restricts access strictly to the prometheus stats endpoint. Find below an example of such a bootstrap patch.
- Product
- gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2025Vulnerability in the Oracle Life Sciences Argus Safety product of Oracle Health Sciences Applications (component: Login).CVE-2025-21570 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.1
Vulnerability in the Oracle Life Sciences Argus Safety product of Oracle Health Sciences Applications (component: Login). The supported version that is affected is 8.2.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Life Sciences Argus Safety. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Life Sciences Argus Safety, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Life Sciences Argus Safety accessible data as well as unauthorized read access to a subset of Oracle Life Sciences Argus Safety accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
- Product
- Oracle Life Sciences Argus Safety
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2025Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft (component: Run Control Management).CVE-2025-21563 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 4.3
Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft (component: Run Control Management). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise CC Common Application Objects. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise CC Common Application Objects accessible data. CVSS 3.1 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N).
- Product
- PeopleSoft Enterprise CC Common Application Objects
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2025Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft (component: Run Control Management).CVE-2025-21562 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 4.3
Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft (component: Run Control Management). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise CC Common Application Objects. Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise CC Common Application Objects accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
- Product
- PeopleSoft Enterprise CC Common Application Objects
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2025Vulnerability in Oracle Application Express (component: General).CVE-2025-21557 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 5.4
Vulnerability in Oracle Application Express (component: General). Supported versions that are affected are 23.2 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Application Express. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Application Express, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Application Express accessible data as well as unauthorized read access to a subset of Oracle Application Express accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
- Product
- Oracle Application Express
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2025Vulnerability in the Oracle Communications Order and Service Management product of Oracle Communications Applications (component: Security).CVE-2025-21554 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 5.3
Vulnerability in the Oracle Communications Order and Service Management product of Oracle Communications Applications (component: Security). Supported versions that are affected are 7.4.0, 7.4.1 and 7.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Order and Service Management. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Communications Order and Service Management accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
- Product
- Oracle Communications Order and Service Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2025Vulnerability in the Oracle Financial Services Behavior Detection Platform product of Oracle Financial Services Applications (component: Web UI).CVE-2025-21550 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.1
Vulnerability in the Oracle Financial Services Behavior Detection Platform product of Oracle Financial Services Applications (component: Web UI). Supported versions that are affected are 8.0.8.1, 8.1.2.7 and 8.1.2.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Behavior Detection Platform. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Financial Services Behavior Detection Platform, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Financial Services Behavior Detection Platform accessible data as well as unauthorized read access to a subset of Oracle Financial Services Behavior Detection Platform accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
- Product
- Oracle Financial Services Behavior Detection Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2025Vulnerability in the Oracle Hospitality OPERA 5 product of Oracle Hospitality Applications (component: Opera Servlet).CVE-2025-21547 · Other software · Oracle Corporation · reported by secalert_us@oracle.comCritical 9.1
Vulnerability in the Oracle Hospitality OPERA 5 product of Oracle Hospitality Applications (component: Opera Servlet). Supported versions that are affected are 5.6.19.20, 5.6.25.8, 5.6.26.6 and 5.6.27.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality OPERA 5. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality OPERA 5 accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Hospitality OPERA 5. CVSS 3.1 Base Score 9.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H).
- Product
- Oracle Hospitality OPERA 5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2025Vulnerability in the Oracle Communications Order and Service Management product of Oracle Communications Applications (component: Security).CVE-2025-21544 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 5.4
Vulnerability in the Oracle Communications Order and Service Management product of Oracle Communications Applications (component: Security). Supported versions that are affected are 7.4.0, 7.4.1 and 7.5.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Communications Order and Service Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Communications Order and Service Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Communications Order and Service Management accessible data as well as unauthorized read access to a subset of Oracle Communications Order and Service Management accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
- Product
- Oracle Communications Order and Service Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2025Vulnerability in the Oracle Communications Order and Service Management product of Oracle Communications Applications (component: Security).CVE-2025-21542 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.3
Vulnerability in the Oracle Communications Order and Service Management product of Oracle Communications Applications (component: Security). Supported versions that are affected are 7.4.0, 7.4.1 and 7.5.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Communications Order and Service Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Communications Order and Service Management accessible data as well as unauthorized read access to a subset of Oracle Communications Order and Service Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Communications Order and Service Management. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
- Product
- Oracle Communications Order and Service Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 20251003 Mortgage Application: Full Path DisclosureCVE-2024-13536 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The 1003 Mortgage Application plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.87. This is due the /inc/class/fnm/export.php file being publicly accessible with error logging enabled. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
- Product
- 1003 Mortgage Application
- Affected
- up to 1.87
- What to do
- Affects up to 1.87. Update 1003 Mortgage Application to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 20, 2025Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager.CVE-2025-23214 · Other software · azukaar · reported by GitHubMedium 6.9
Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. By monitoring the error code returned in the login, it is possible to figure out whether a user exist or not in the database. Patched in 0.17.7.
- Product
- Cosmos-Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2025Improper permission settings for mobile applications (com.transsion.carlcare) may lead to information leakage risk.CVE-2025-0590 · Other software · TECNO · reported by 907edf6c-bf03-423e-ab1a-8da27e1aa1eaHigh 7.5
Improper permission settings for mobile applications (com.transsion.carlcare) may lead to information leakage risk.
- Product
- com.transsion.carlcare
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.tecno.comsecurity.tecno.com
Jan 17, 2025Under certain log settings the IAM or CORE service will log credentials in the iam logfile in Fortra Application Hub (Formerly named Helpsystems One) prior to vCVE-2024-11923 · Other software · Fortra · reported by df4dee71-de3a-4139-9588-11b62fe6c0ffMedium 5.5
Under certain log settings the IAM or CORE service will log credentials in the iam logfile in Fortra Application Hub (Formerly named Helpsystems One) prior to version 1.3
- Product
- Fortra Application Hub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2025Multiple bash files were present in the application's private directory.CVE-2024-54681 · Other software · Ossur · reported by ics-cert@hq.dhs.govLow 2
Multiple bash files were present in the application's private directory. Bash files can be used on their own, by an attacker that has already full access to the mobile platform to compromise the translations for the application.
- Product
- Mobile Logic Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2025A valid set of credentials in a .js file and a static token for communication were obtained from the decompiled IPA.CVE-2024-53683 · Other software · Ossur · reported by ics-cert@hq.dhs.govMedium 5.6
A valid set of credentials in a .js file and a static token for communication were obtained from the decompiled IPA. An attacker could use the information to disrupt normal use of the application by changing the translation files and thus weaken the integrity of normal use.
- Product
- Mobile Logic Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2025Hard-coded credentials were included as part of the application binary.CVE-2024-45832 · Other software · Ossur · reported by ics-cert@hq.dhs.govLow 2
Hard-coded credentials were included as part of the application binary. These credentials served as part of the application authentication flow and communication with the mobile application. An attacker could access unauthorized information.
- Product
- Mobile Logic Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.