Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
15,186 results · page 88 of 304
Jan 14, 2025Gradio is an open-source Python package that allows quick building of demos and web application for machine learning models, API, or any arbitrary Python functiCVE-2025-23042 · Other software · gradio-app · reported by GitHubHigh 8.7
Gradio is an open-source Python package that allows quick building of demos and web application for machine learning models, API, or any arbitrary Python function. Gradio's Access Control List (ACL) for file paths can be bypassed by altering the letter case of a blocked file or directory path. This vulnerability arises due to the lack of case normalization in the file path validation logic. On case-insensitive file systems, such as those used by Windows and macOS, this flaw enables attackers to circumvent security restrictions and access sensitive files that should be protected. This issue can lead to unauthorized data access, exposing sensitive information and undermining the integrity of Gradio's security model. Given Gradio's popularity for building web applications, particularly in machine learning and AI, this vulnerability may pose a substantial threat if exploited in production environments. This issue has been addressed in release version 5.6.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- gradio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2025A flaw was found in the HAL Console in the Wildfly component, which does not neutralize or incorrectly neutralizes user-controllable input before it is placed iCVE-2025-23366 · Other software · Red Hat · reported by Red HatMedium 6.5
A flaw was found in the HAL Console in the Wildfly component, which does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output used as a web page that is served to other users. The attacker must be authenticated as a user that belongs to management groups “SuperUser”, “Admin”, or “Maintainer”.
- Product
- Red Hat JBoss Enterprise Application Platform 7
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Jan 14, 2025XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it.CVE-2025-23025 · Other software · xwiki · reported by GitHubCritical 9
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. NOTE: The Realtime WYSIWYG Editor extension was **experimental**, and thus **not recommended**, in the versions affected by this vulnerability. It has become enabled by default, and thus recommended, starting with XWiki 16.9.0. A user with only **edit right** can join a realtime editing session where others, that where already there or that may join later, have **script** or **programming** access rights. This user can then insert **script rendering macros** that are executed for those users in the realtime session that have script or programming rights. The inserted scripts can be used to gain more access rights. This vulnerability has been patched in XWiki 15.10.2, 16.4.1 and 16.6.0-rc-1. Users are advised to upgrade. Users unable to upgrade may either disable the realtime WYSIWYG editing by disabling the ``xwiki-realtime`` CKEditor plugin from the WYSIWYG editor administration section or uninstall the Realtime WYSIWYG Editorextension (org.xwiki.platform:xwiki-platform-realtime-wysiwyg-ui).
- Product
- xwiki-platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordextensions.xwiki.orgextensions.xwiki.org
Jan 14, 2025A race condition in Ivanti Application Control Engine before version 10.14.4.0 allows a local authenticated attacker to bypass the application blocking functionCVE-2024-10630 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75High 7.8
A race condition in Ivanti Application Control Engine before version 10.14.4.0 allows a local authenticated attacker to bypass the application blocking functionality.
- Product
- Application Control Engine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2025Howyar UEFI Application "Reloader" (32-bit and 64-bit) is vulnerable to execution of unsigned software in a hardcoded path.CVE-2024-7344 · Other software · Radix · reported by cret@cert.orgHigh 8.2
Howyar UEFI Application "Reloader" (32-bit and 64-bit) is vulnerable to execution of unsigned software in a hardcoded path.
- Product
- SmartRecovery
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2025SAP NetWeaver Application Server for ABAP and ABAP Platform allows an authenticated attacker to obtain illegitimate access to the system by exploiting improper CVE-2025-0070 · Network & remote access · SAP_SE · reported by cna@sap.comCritical 9.9
SAP NetWeaver Application Server for ABAP and ABAP Platform allows an authenticated attacker to obtain illegitimate access to the system by exploiting improper authentication checks, resulting in privilege escalation. On successful exploitation, this can result in potential security concerns. This results in a high impact on confidentiality, integrity, and availability.
- Product
- SAP NetWeaver Application Server for ABAP and ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2025An obsolete functionality in SAP NetWeaver Application Server ABAP did not perform necessary authorization checks.CVE-2025-0068 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
An obsolete functionality in SAP NetWeaver Application Server ABAP did not perform necessary authorization checks. Because of this, an authenticated attacker could obtain information that would otherwise be restricted. It has no impact on integrity or availability on the application.
- Product
- SAP NetWeaver Application Server ABAP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2025Due to a missing authorization check on service endpoints in the SAP NetWeaver Application Server Java, an attacker with standard user role can create JCo conneCVE-2025-0067 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.3
Due to a missing authorization check on service endpoints in the SAP NetWeaver Application Server Java, an attacker with standard user role can create JCo connection entries, which are used for remote function calls from or to the application server. This could lead to low impact on confidentiality, integrity, and availability of the application.
- Product
- SAP NetWeaver Application Server Java
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2025Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP store user input in the local browser storage to improve usability.CVE-2025-0059 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6
Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP store user input in the local browser storage to improve usability. An attacker with administrative privileges or access to the victim�s user directory on the Operating System level would be able to read this data. Depending on the user input provided in transactions, the disclosed data could range from non-critical data to highly sensitive data, causing high impact on confidentiality of the application.
- Product
- SAP NetWeaver Application Server ABAP (applications based on SAP GUI for HTML)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2025SAP NetWeaver AS JAVA (User Admin Application) is vulnerable to stored cross site scripting vulnerability.CVE-2025-0057 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.8
SAP NetWeaver AS JAVA (User Admin Application) is vulnerable to stored cross site scripting vulnerability. An attacker posing as an admin can upload a photo with malicious JS content. When a victim visits the vulnerable component, the attacker can read and modify information within the scope of victim's web browser.
- Product
- SAP NetWeaver AS JAVA (User Admin Application)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2025SAP NetWeaver Application Server for ABAP and ABAP Platform allows an attacker to gain unauthorized access to system information.CVE-2025-0053 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.3
SAP NetWeaver Application Server for ABAP and ABAP Platform allows an attacker to gain unauthorized access to system information. By using a specific URL parameter, an unauthenticated attacker could retrieve details such as system configuration. This has a limited impact on the confidentiality of the application and may be leveraged to facilitate further attacks or exploits.
- Product
- SAP NetWeaver Application Server for ABAP and ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2025next-forge is a Next.js project boilerplate for modern web application.CVE-2025-23027 · Other software · haydenbleasel · reported by GitHubMedium 6.3
next-forge is a Next.js project boilerplate for modern web application. The BASEHUB_TOKEN commited in apps/web/.env.example. Users should avoid use of this token and should remove any access it may have in their systems.
- Product
- next-forge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2025An NTLM hash leak in Venki Supravizio BPM up to 18.0.1 allows authenticated attackers with Application Administrator access to escalate privileges on the underlCVE-2024-46480 · Other software · Venki · reported by MITREHigh 8.4
An NTLM hash leak in Venki Supravizio BPM up to 18.0.1 allows authenticated attackers with Application Administrator access to escalate privileges on the underlying host system.
- Product
- Supravizio BPM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2025Multiple SQL Injection vulnerabilities exist in the reporting application.CVE-2024-9134 · Other software · Arista Networks · reported by psirt@arista.comHigh 8.3
Multiple SQL Injection vulnerabilities exist in the reporting application. A user with advanced report application access rights can exploit the SQL injection, allowing them to execute commands on the underlying operating system with elevated privileges.
- Product
- Arista Edge Threat Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2025A user with advanced report application access rights can perform actions for which they are not authorizedCVE-2024-47520 · Other software · Arista Networks · reported by psirt@arista.comHigh 7.6
A user with advanced report application access rights can perform actions for which they are not authorized
- Product
- Arista Edge Threat Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 20251003 Mortgage Application: Missing AuthorizationCVE-2025-22592 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in 8blocks 1003 Mortgage Application 1003-mortgage-application allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects 1003 Mortgage Application: from n/a through <= 1.87.
- Product
- 1003 Mortgage Application
- Affected
- up to 1.87
- What to do
- Affects up to 1.87. Update 1003 Mortgage Application to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 20251003 Mortgage Application: Missing AuthorizationCVE-2025-22591 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in 8blocks 1003 Mortgage Application 1003-mortgage-application allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 1003 Mortgage Application: from n/a through <= 1.87.
- Product
- 1003 Mortgage Application
- Affected
- up to 1.87
- What to do
- Affects up to 1.87. Update 1003 Mortgage Application to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 6, 2025The com.asianmobile.callcolor (aka Color Phone Call Screen App) application through 24 for Android enables any application (with no permissions) to place phone CVE-2024-53936 · Other software · reported by MITREMedium 6.3
The com.asianmobile.callcolor (aka Color Phone Call Screen App) application through 24 for Android enables any application (with no permissions) to place phone calls without user interaction by sending a crafted intent via the com.asianmobile.callcolor.ui.component.call.CallActivity component.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2025The com.callos14.callscreen.colorphone (aka iCall OS17 - Color Phone Flash) application through 4.3 for Android enables any application (with no permissions) toCVE-2024-53935 · Other software · reported by MITREMedium 6.5
The com.callos14.callscreen.colorphone (aka iCall OS17 - Color Phone Flash) application through 4.3 for Android enables any application (with no permissions) to place phone calls without user interaction by sending a crafted intent via the com.callos14.callscreen.colorphone.DialerActivity component.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2025The com.windymob.callscreen.ringtone.callcolor.colorphone (aka Color Phone Call Screen Themes) application through 1.1.2 for Android enables any application (wiCVE-2024-53934 · Other software · reported by MITREHigh 7.7
The com.windymob.callscreen.ringtone.callcolor.colorphone (aka Color Phone Call Screen Themes) application through 1.1.2 for Android enables any application (with no permissions) to place phone calls without user interaction by sending a crafted intent via the com.frovis.androidbase.call.DialerActivity component.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2025The com.callerscreen.colorphone.themes.callflash (aka Color Call Theme & Call Screen) application through 1.0.7 for Android enables any application (with no perCVE-2024-53933 · Other software · reported by MITREMedium 6.3
The com.callerscreen.colorphone.themes.callflash (aka Color Call Theme & Call Screen) application through 1.0.7 for Android enables any application (with no permissions) to place phone calls without user interaction by sending a crafted intent via the com.android.call.color.app.activities.DialerActivity component.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2025The com.remi.colorphone.callscreen.calltheme.callerscreen (aka Color Phone: Call Screen Theme) application through 21.1.9 for Android enables any application (wCVE-2024-53932 · Other software · reported by MITRECritical 9.1
The com.remi.colorphone.callscreen.calltheme.callerscreen (aka Color Phone: Call Screen Theme) application through 21.1.9 for Android enables any application (with no permissions) to place phone calls without user interaction by sending a crafted intent via the com.remi.colorphone.callscreen.calltheme.callerscreen.dialer.DialerActivity component.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2025The com.glitter.caller.screen (aka iCaller, Caller Theme & Dialer) application through 1.1 for Android enables any application (with no permissions) to place phCVE-2024-53931 · Other software · reported by MITRECritical 9.1
The com.glitter.caller.screen (aka iCaller, Caller Theme & Dialer) application through 1.1 for Android enables any application (with no permissions) to place phone calls without user interaction by sending a crafted intent via the com.glitter.caller.screen.DialerActivity component.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2025AAT (Another Activity Tracker) is a GPS-tracking application for tracking sportive activities, with emphasis on cycling.CVE-2025-21615 · Other software · bailuk · reported by GitHubMedium 5.5
AAT (Another Activity Tracker) is a GPS-tracking application for tracking sportive activities, with emphasis on cycling. Versions lower than v1.26 of AAT are vulnerable to data exfiltration from malicious apps installed on the same device.
- Product
- AAT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2025OpenVPN Connect before version 3.5.0 can contain the configuration profile's clear-text private key which is logged in the application log, which an unauthorizeCVE-2024-8474 · Other software · OpenVPN · reported by security@openvpn.netHigh 7.5
OpenVPN Connect before version 3.5.0 can contain the configuration profile's clear-text private key which is logged in the application log, which an unauthorized actor can use to decrypt the VPN traffic
- Product
- OpenVPN Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2025Memory corruption occurs when invoking any IOCTL-calling application that executes all MCDM driver IOCTL calls.CVE-2024-45550 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory corruption occurs when invoking any IOCTL-calling application that executes all MCDM driver IOCTL calls.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2025Uncontrolled resource consumption when a driver, an application or a SMMU client tries to access the global registers through SMMU.CVE-2024-43064 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.5
Uncontrolled resource consumption when a driver, an application or a SMMU client tries to access the global registers through SMMU.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 3, 2025Next.js is a React framework for building full-stack web applications.CVE-2024-56332 · Other software · vercel · reported by GitHubMedium 5.3
Next.js is a React framework for building full-stack web applications. Starting in version 13.0.0 and prior to versions 13.5.8, 14.2.21, and 15.1.2, Next.js is vulnerable to a Denial of Service (DoS) attack that allows attackers to construct requests that leaves requests to Server Actions hanging until the hosting provider cancels the function execution. This vulnerability can also be used as a Denial of Wallet (DoW) attack when deployed in providers billing by response times. (Note: Next.js server is idle during that time and only keeps the connection open. CPU and memory footprint are low during that time.). Deployments without any protection against long running Server Action invocations are especially vulnerable. Hosting providers like Vercel or Netlify set a default maximum duration on function execution to reduce the risk of excessive billing. This is the same issue as if the incoming HTTP request has an invalid `Content-Length` header or never closes. If the host has no other mitigations to those then this vulnerability is novel. This vulnerability affects only Next.js deployments using Server Actions. The issue was resolved in Next.js 13.5.8, 14.2.21, and 15.1.2. We recomme
- Product
- next.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 3, 2025Karmada is a Kubernetes management system that allows users to run cloud-native applications across multiple Kubernetes clusters and clouds.CVE-2024-56514 · Other software · karmada-io · reported by GitHubMedium 5.3
Karmada is a Kubernetes management system that allows users to run cloud-native applications across multiple Kubernetes clusters and clouds. Prior to version 1.12.0, both in karmadactl and karmada-operator, it is possible to supply a filesystem path, or an HTTP(s) URL to retrieve the custom resource definitions(CRDs) needed by Karmada. The CRDs are downloaded as a gzipped tarfile and are vulnerable to a TarSlip vulnerability. An attacker able to supply a malicious CRD file into a Karmada initialization could write arbitrary files in arbitrary paths of the filesystem. From Karmada version 1.12.0, when processing custom CRDs files, CRDs archive verification is utilized to enhance file system robustness. A workaround is available. Someone who needs to set flag `--crd` to customize the CRD files required for Karmada initialization when using `karmadactl init` to set up Karmada can manually inspect the CRD files to check whether they contain sequences such as `../` that would alter file paths, to determine if they potentially include malicious files. When using karmada-operator to set up Karmada, one must upgrade one's karmada-operator to one of the fixed versions.
- Product
- karmada
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 3, 2025Karmada is a Kubernetes management system that allows users to run cloud-native applications across multiple Kubernetes clusters and clouds.CVE-2024-56513 · Other software · karmada-io · reported by GitHubHigh 8.7
Karmada is a Kubernetes management system that allows users to run cloud-native applications across multiple Kubernetes clusters and clouds. Prior to version 1.12.0, the PULL mode clusters registered with the `karmadactl register` command have excessive privileges to access control plane resources. By abusing these permissions, an attacker able to authenticate as the karmada-agent to a karmada cluster would be able to obtain administrative privileges over the entire federation system including all registered member clusters. Since Karmada v1.12.0, command `karmadactl register` restricts the access permissions of pull mode member clusters to control plane resources. This way, an attacker able to authenticate as the karmada-agent cannot control other member clusters in Karmada. As a workaround, one may restrict the access permissions of pull mode member clusters to control plane resources according to Karmada Component Permissions Docs.
- Product
- karmada
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2025phpMyFAQ is an open source FAQ web application.CVE-2024-56199 · Other software · thorsten · reported by GitHubMedium 5.2
phpMyFAQ is an open source FAQ web application. Starting no later than version 3.2.10 and prior to version 4.0.2, an attacker can inject malicious HTML content into the FAQ editor at `http[:]//localhost/admin/index[.]php?action=editentry`, resulting in a complete disruption of the FAQ page's user interface. By injecting malformed HTML elements styled to cover the entire screen, an attacker can render the page unusable. This injection manipulates the page structure by introducing overlapping buttons, images, and iframes, breaking the intended layout and functionality. Exploiting this issue can lead to Denial of Service for legitimate users, damage to the user experience, and potential abuse in phishing or defacement attacks. Version 4.0.2 contains a patch for the vulnerability.
- Product
- phpMyFAQ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2025ApplyOnline – Application Form Builder and Manager: Missing AuthorizationCVE-2023-46080 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Farhan Noor ApplyOnline – Application Form Builder and Manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ApplyOnline – Application Form Builder and Manager: from n/a through 2.5.3.
- Product
- ApplyOnline – Application Form Builder and Manager
- Affected
- up to 2.5.3
- What to do
- Affects up to 2.5.3. Update ApplyOnline – Application Form Builder and Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2024Veritas / Arctera Data Insight before 7.1.1 allows Application Administrators to conduct SQL injection attacks.CVE-2024-46542 · Other software · Veritas · reported by MITREMedium 6.5
Veritas / Arctera Data Insight before 7.1.1 allows Application Administrators to conduct SQL injection attacks.
- Product
- Data Insight
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 30, 2024Password Pusher is an open source application to communicate sensitive information over the web.CVE-2024-56733 · Other software · pglombardo · reported by GitHubMedium 5.7
Password Pusher is an open source application to communicate sensitive information over the web. A vulnerability has been reported in versions 1.50.3 and prior where an attacker can copy the session cookie before a user logs out, potentially allowing session hijacking. Although the session token is replaced and invalidated upon logout, if an attacker manages to capture the session cookie before this process, they can use the token to gain unauthorized access to the user's session until the token expires or is manually cleared. This vulnerability hinges on the attacker's ability to access the session cookie during an active session, either through a man-in-the-middle attack, by exploiting another vulnerability like XSS, or via direct access to the victim's device. Although there is no direct resolution to this vulnerability, it is recommended to always use the latest version of Password Pusher to best mitigate risk. If self-hosting, ensure Password Pusher is hosted exclusively over SSL connections to encrypt traffic and prevent session cookies from being intercepted in transit. Additionally, implement best practices in local security to safeguard user systems, browsers, and data aga
- Product
- PasswordPusher
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 30, 2024Infinix devices contain a pre-loaded "com.rlk.weathers" application, that exposes an unsecured content provider.CVE-2024-12993 · Other software · Infinix Mobile · reported by cvd@cert.plMedium 4.8
Infinix devices contain a pre-loaded "com.rlk.weathers" application, that exposes an unsecured content provider. An attacker can communicate with the provider and reveal the user’s location without any privileges. After multiple attempts to contact the vendor we did not receive any answer. We suppose this issue affects all Infinix Mobile devices.
- Product
- com.rlk.weathers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 23, 2024A flaw was found in the skupper console, a read-only interface that renders cluster network, traffic details, and metrics for a network application that a userCVE-2024-12582 · Other software · Red Hat · reported by Red HatHigh 7.1
A flaw was found in the skupper console, a read-only interface that renders cluster network, traffic details, and metrics for a network application that a user sets up across a hybrid multi-cloud environment. When the default authentication method is used, a random password is generated for the "admin" user and is persisted in either a Kubernetes secret or a podman volume in a plaintext file. This authentication method can be manipulated by an attacker, leading to the reading of any user-readable file in the container filesystem, directly impacting data confidentiality. Additionally, the attacker may induce skupper to read extremely large files into memory, resulting in resource exhaustion and a denial of service attack.
- Product
- Service Interconnect 1 for RHEL 9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Dec 23, 2024Signing cookies is an application security feature that adds a digital signature to cookie data to verify its authenticity and integrity.CVE-2024-23945 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.9
Signing cookies is an application security feature that adds a digital signature to cookie data to verify its authenticity and integrity. The signature helps prevent malicious actors from modifying the cookie value, which can lead to security vulnerabilities and exploitation. Apache Hive’s service component accidentally exposes the signed cookie to the end user when there is a mismatch in signature between the current and expected cookie. Exposing the correct cookie signature can lead to further exploitation. The vulnerable CookieSigner logic was introduced in Apache Hive by HIVE-9710 (1.2.0) and in Apache Spark by SPARK-14987 (2.0.0). The affected components are the following: * org.apache.hive:hive-service * org.apache.spark:spark-hive-thriftserver_2.11 * org.apache.spark:spark-hive-thriftserver_2.12
- Product
- Apache Hive
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 20, 2024A reflected cross-site scripting vulnerability in MONITORAPP Application Insight Web Application Firewall (AIWAF) <= 4.1.6 and <=5.0 was identified on the subpaCVE-2021-40959 · Other software · reported by MITREMedium 6.1
A reflected cross-site scripting vulnerability in MONITORAPP Application Insight Web Application Firewall (AIWAF) <= 4.1.6 and <=5.0 was identified on the subpage `/process_management/process_status.xhr.php`. This vulnerability allows an attacker to inject malicious scripts that execute in the context of the victim's session.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2024Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks.CVE-2024-38819 · Other software · reported by security@vmware.comHigh 7.5
Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordspring.iosecurity.netapp.com
Dec 19, 2024ACE vulnerability in JaninoEventEvaluator by QOS.CH logback-core upto including version 0.1 to 1.3.14 and 1.4.0 to 1.5.12 in Java applications allows CVE-2024-12798 · Other software · QOS.CH Sarl · reported by vulnerability@ncsc.chMedium 5.9
ACE vulnerability in JaninoEventEvaluator by QOS.CH logback-core upto including version 0.1 to 1.3.14 and 1.4.0 to 1.5.12 in Java applications allows attacker to execute arbitrary code by compromising an existing logback configuration file or by injecting an environment variable before program execution. Malicious logback configuration files can allow the attacker to execute arbitrary code using the JaninoEventEvaluator extension. A successful attack requires the user to have write access to a configuration file. Alternatively, the attacker could inject a malicious environment variable pointing to a malicious configuration file. In both cases, the attack requires existing privilege.
- Product
- Logback-core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlogback.qos.chlogback.qos.ch
Dec 19, 2024Incorrect authorization vulnerability in HTTP POST method in Govee Home application on Android and iOS allows remote attacker to control devices owned by other CVE-2023-4617 · Other software · Govee · reported by cvd@cert.plCritical 10
Incorrect authorization vulnerability in HTTP POST method in Govee Home application on Android and iOS allows remote attacker to control devices owned by other users via changing "device", "sku" and "type" fields' values. This issue affects Govee Home applications on Android and iOS in versions before 5.9.
- Product
- Govee Home
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2024Next.js is a React framework for building full-stack web applications.CVE-2024-51479 · Other software · vercel · reported by GitHubHigh 7.5
Next.js is a React framework for building full-stack web applications. In affected versions if a Next.js application is performing authorization in middleware based on pathname, it was possible for this authorization to be bypassed for pages directly under the application's root directory. For example: * [Not affected] `https://example.com/` * [Affected] `https://example.com/foo` * [Not affected] `https://example.com/foo/bar`. This issue is patched in Next.js `14.2.15` and later. If your Next.js application is hosted on Vercel, this vulnerability has been automatically mitigated, regardless of Next.js version. There are no official workarounds for this vulnerability.
- Product
- next.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2024Uncontrolled Resource Consumption vulnerability in the examples web application provided with Apache Tomcat leads to denial of service.CVE-2024-54677 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.3
Uncontrolled Resource Consumption vulnerability in the examples web application provided with Apache Tomcat leads to denial of service. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.9.97. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.
- Product
- Apache Tomcat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Dec 17, 2024Locally installed application can bypass the permission check and perform system operations that require permission.CVE-2021-26280 · Other software · vivo · reported by security@vivo.comHigh 7.9
Locally installed application can bypass the permission check and perform system operations that require permission.
- Product
- Permission manager module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2024A flaw was found in Radare2, which contains a command injection vulnerability caused by insufficient input validation when handling Pebble Application files.CVE-2024-11858 · Other software · Radare · reported by patrick@puiterwijk.orgHigh 8.6
A flaw was found in Radare2, which contains a command injection vulnerability caused by insufficient input validation when handling Pebble Application files. Maliciously crafted inputs can inject shell commands during command parsing, leading to unintended behavior during file processing
- Product
- Radare2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2024An information-disclosure vulnerability exists in Fortra's GoAnywhere MFT application prior to version 7.7.0 that allows external access to the resources in cerCVE-2024-9945 · Other software · Fortra · reported by df4dee71-de3a-4139-9588-11b62fe6c0ffMedium 5.3
An information-disclosure vulnerability exists in Fortra's GoAnywhere MFT application prior to version 7.7.0 that allows external access to the resources in certain admin root folders.
- Product
- GoAnywhere MFT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2024Laravel Pulse is a real-time application performance monitoring tool and dashboard for Laravel applications.CVE-2024-55661 · Other software · laravel · reported by GitHubHigh 8.7
Laravel Pulse is a real-time application performance monitoring tool and dashboard for Laravel applications. A vulnerability has been discovered in Laravel Pulse prior to version 1.3.1 that could allow remote code execution through the public `remember()` method in the `Laravel\Pulse\Livewire\Concerns\RemembersQueries` trait. This method is accessible via Livewire components and can be exploited to call arbitrary callables within the application. An authenticated user with access to Laravel Pulse dashboard can execute arbitrary code by calling any function or static method in which the callable is a function or static method and the callable has no parameters or no strict parameter types. The vulnerable to component is `remember(callable $query, string $key = '')` method in `Laravel\Pulse\Livewire\Concerns\RemembersQueries`, and the vulnerability affects all Pulse card components that use this trait. Version 1.3.1 contains a patch.
- Product
- pulse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2024phpMyFAQ is an open source FAQ web application.CVE-2024-55889 · Other software · thorsten · reported by GitHubMedium 4.9
phpMyFAQ is an open source FAQ web application. Prior to version 3.2.10, a vulnerability exists in the FAQ Record component where a privileged attacker can trigger a file download on a victim's machine upon page visit by embedding it in an <iframe> element without user interaction or explicit consent. Version 3.2.10 fixes the issue.
- Product
- phpMyFAQ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2024Improper input handling in the 'Host Header' allows an unauthenticated attacker to store a payload in web application logs.CVE-2024-11986 · Other software · CrushFTP, LLC · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158Critical 9.6
Improper input handling in the 'Host Header' allows an unauthenticated attacker to store a payload in web application logs. When an Administrator views the logs using the application's standard functionality, it enables the execution of the payload, resulting in Stored XSS or 'Cross-Site Scripting'.
- Product
- CrushFTP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2024The WPMobile.App — Android and iOS Mobile Application: Arbitrary shortcode executionCVE-2024-12420 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The The WPMobile.App — Android and iOS Mobile Application plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 11.52. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
- Product
- The WPMobile.App — Android and iOS Mobile Application
- Affected
- up to 11.52
- What to do
- Affects up to 11.52. Update The WPMobile.App — Android and iOS Mobile Application to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.