Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
15,189 results · page 89 of 304
Dec 13, 2024phpMyFAQ is an open source FAQ web application.CVE-2024-55889 · Other software · thorsten · reported by GitHubMedium 4.9
phpMyFAQ is an open source FAQ web application. Prior to version 3.2.10, a vulnerability exists in the FAQ Record component where a privileged attacker can trigger a file download on a victim's machine upon page visit by embedding it in an <iframe> element without user interaction or explicit consent. Version 3.2.10 fixes the issue.
- Product
- phpMyFAQ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2024Improper input handling in the 'Host Header' allows an unauthenticated attacker to store a payload in web application logs.CVE-2024-11986 · Other software · CrushFTP, LLC · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158Critical 9.6
Improper input handling in the 'Host Header' allows an unauthenticated attacker to store a payload in web application logs. When an Administrator views the logs using the application's standard functionality, it enables the execution of the payload, resulting in Stored XSS or 'Cross-Site Scripting'.
- Product
- CrushFTP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2024The WPMobile.App — Android and iOS Mobile Application: Arbitrary shortcode executionCVE-2024-12420 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The The WPMobile.App — Android and iOS Mobile Application plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 11.52. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
- Product
- The WPMobile.App — Android and iOS Mobile Application
- Affected
- up to 11.52
- What to do
- Affects up to 11.52. Update The WPMobile.App — Android and iOS Mobile Application to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 12, 2024A logic vulnerability in the the mobile application (com.transsion.applock) can lead to bypassing the application password.CVE-2024-12603 · Other software · TECNO · reported by 907edf6c-bf03-423e-ab1a-8da27e1aa1eaCritical 9.8
A logic vulnerability in the the mobile application (com.transsion.applock) can lead to bypassing the application password.
- Product
- com.transsion.applock
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.tecno.comsecurity.tecno.com
Dec 12, 2024http4k is a functional toolkit for Kotlin HTTP applications.CVE-2024-55875 · Other software · http4k · reported by GitHubCritical 9.8
http4k is a functional toolkit for Kotlin HTTP applications. Prior to version 6.50.0.0, there is a potential XXE (XML External Entity Injection) vulnerability when http4k handling malicious XML contents within requests, which might allow attackers to read local sensitive information on server, trigger Server-side Request Forgery and even execute code under some circumstances. The original fix shipped in v5.41.0.0 / v4.50.0.0 closed the documented external-entity attack class (SSRF, local-file disclosure, code execution) by setting `ACCESS_EXTERNAL_DTD=""`, `ACCESS_EXTERNAL_SCHEMA=""`, and `isExpandEntityReferences=false` on the default `DocumentBuilderFactory`. A residual gap remained: the parser still accepted documents containing `<!DOCTYPE>` declarations even though external entity resolution was blocked. This left open billion-laughs-style internal entity expansion DoS attacks against any application using `Body.xml()` or `Document.asXmlDocument()` on untrusted XML. v6.50.0.0 closes this residual by adding `disallow-doctype-decl=true` and `FEATURE_SECURE_PROCESSING=true` to `defaultXmlParsingConfig`. Any document containing a `<!DOCTYPE>` is now rejected at parse time.
- Product
- http4k
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2024The application uses several hard-coded credentials to encrypt config files during backup, to decrypt the new firmware during an update and some passwords allowCVE-2024-28146 · Other software · Image Access GmbH · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfHigh 8.4
The application uses several hard-coded credentials to encrypt config files during backup, to decrypt the new firmware during an update and some passwords allow a direct connection to the database server of the affected device.
- Product
- Scan2Net
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordr.sec-consult.comimageaccess.de
Dec 12, 2024The password change function at /cgi/admin.cgi does not require the current/old password, which makes the application vulnerable to account takeover.CVE-2024-28143 · Other software · Image Access GmbH · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfHigh 8.4
The password change function at /cgi/admin.cgi does not require the current/old password, which makes the application vulnerable to account takeover. An attacker can use this to forcefully set a new password within the -rsetpass+-aaction+- parameter for a user without knowing the old password, e.g. by exploiting a CSRF issue.
- Product
- Scan2Net
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordr.sec-consult.comimageaccess.de
Dec 11, 2024PenDoc is a penetration testing reporting application.CVE-2024-55652 · Other software · pwndoc · reported by GitHubMedium 6.5
PenDoc is a penetration testing reporting application. Prior to commit 1d4219c596f4f518798492e48386a20c6e9a2fe6, an attacker can write a malicious docx template containing expressions that escape the JavaScript sandbox to execute arbitrary code on the system. An attacker who can control the contents of the template document is able to execute arbitrary code on the system. By default, only users with the `admin` role are able to create or update templates. Commit 1d4219c596f4f518798492e48386a20c6e9a2fe6 patches the issue.
- Product
- pwndoc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2024Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorizationCVE-2024-45337 · Other software · golang.org/x/crypto · reported by security@golang.orgCritical 9.1
Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since th
- Product
- golang.org/x/crypto/ssh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2024Under specific circumstances, insecure permissions in Ivanti Application Control before version 2024.3 HF1, 2024.1 HF2, or 2023.3 HF3 allows a local authenticatCVE-2024-11598 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75High 7.8
Under specific circumstances, insecure permissions in Ivanti Application Control before version 2024.3 HF1, 2024.1 HF2, or 2023.3 HF3 allows a local authenticated attacker to achieve local privilege escalation.
- Product
- Application Control
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2024The web application is not protected against cross-site request forgery attacks.CVE-2024-28141 · Other software · Image Access GmbH · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfMedium 6.3
The web application is not protected against cross-site request forgery attacks. Therefore, an attacker can trick users into performing actions on the application when they visit an attacker-controlled website or click on a malicious link. E.g. an attacker can forge malicious links to reset the admin password or create new users.
- Product
- Scan2Net
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordr.sec-consult.comimageaccess.de
Dec 10, 2024Substance3D - Modeler versions 1.14.1 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-serviceCVE-2024-53006 · Other software · Adobe · reported by AdobeMedium 5.5
Substance3D - Modeler versions 1.14.1 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Substance3D - Modeler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024Substance3D - Modeler versions 1.14.1 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-serviceCVE-2024-52833 · Other software · Adobe · reported by AdobeMedium 5.5
Substance3D - Modeler versions 1.14.1 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Substance3D - Modeler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024InDesign Desktop versions ID19.5, ID18.5.4 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-seCVE-2024-53952 · Other software · Adobe · reported by AdobeMedium 5.5
InDesign Desktop versions ID19.5, ID18.5.4 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial of service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- InDesign Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024Media Encoder versions 25.0, 24.6.3 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service.CVE-2024-49554 · Other software · Adobe · reported by AdobeMedium 5.5
Media Encoder versions 25.0, 24.6.3 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial of service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Media Encoder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024Insufficient server-side controls in Secure Application Manager of Ivanti Connect Secure before version 22.7R2.4 allows a remote authenticated attacker to bypasCVE-2024-9844 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75High 7.1
Insufficient server-side controls in Secure Application Manager of Ivanti Connect Secure before version 22.7R2.4 allows a remote authenticated attacker to bypass restrictions.
- Product
- Connect Secure
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024Insecure permissions in Ivanti Sentry before versions 9.20.2 and 10.0.2 or 10.1.0 allow a local authenticated attacker to modify sensitive application componentCVE-2024-8540 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75High 8.8
Insecure permissions in Ivanti Sentry before versions 9.20.2 and 10.0.2 or 10.1.0 allow a local authenticated attacker to modify sensitive application components.
- Product
- Sentry
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024SQL injection in the admin web console of Ivanti CSA before version 5.0.3 allows a remote authenticated attacker with admin privileges to run arbitrary SQL statCVE-2024-11773 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75Critical 9.1
SQL injection in the admin web console of Ivanti CSA before version 5.0.3 allows a remote authenticated attacker with admin privileges to run arbitrary SQL statements.
- Product
- Cloud Services Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024Command injection in the admin web console of Ivanti CSA before version 5.0.3 allows a remote authenticated attacker with admin privileges to achieve remote codCVE-2024-11772 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75Critical 9.1
Command injection in the admin web console of Ivanti CSA before version 5.0.3 allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- Product
- Cloud Services Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024An authentication bypass in the admin web console of Ivanti CSA before 5.0.3 allows a remote unauthenticated attacker to gain administrative accessCVE-2024-11639 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75Critical 10
An authentication bypass in the admin web console of Ivanti CSA before 5.0.3 allows a remote unauthenticated attacker to gain administrative access
- Product
- Cloud Services Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2024In certain conditions, SAP NetWeaver Application Server ABAP allows an authenticated attacker to craft a Remote Function Call (RFC) request to restricted destinCVE-2024-54198 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 8.5
In certain conditions, SAP NetWeaver Application Server ABAP allows an authenticated attacker to craft a Remote Function Call (RFC) request to restricted destinations, which can be used to expose credentials for a remote service. These credentials can then be further exploited to completely compromise the remote service, potentially resulting in a significant impact on the confidentiality, integrity, and availability of the application.
- Product
- SAP NetWeaver Application Server ABAP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2024SAP NetWeaver Application Server for ABAP and ABAP Platform allows an authenticated attacker to gain higher access levels than they should have by exploiting imCVE-2024-47585 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
SAP NetWeaver Application Server for ABAP and ABAP Platform allows an authenticated attacker to gain higher access levels than they should have by exploiting improper authorization checks, resulting in privilege escalation. While authorizations for import and export are distinguished, a single authorization is applied for both, which may contribute to these risks. On successful exploitation, this can result in potential security concerns. However, it has no impact on the integrity and availability of the application and may have only a low impact on data confidentiality.
- Product
- SAP NetWeaver Application Server for ABAP and ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2024SAP HCM Approve Timesheets Version 4 application does not perform necessary authorization checks for an authenticated user, resulting in escalation of privilegeCVE-2024-47581 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
SAP HCM Approve Timesheets Version 4 application does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.There is low impact on integrity of the application. Confidentiality and availibility are not impacted.
- Product
- SAP HCM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2024Adobe Document Service allows an attacker with administrator privileges to send a crafted request from a vulnerable web application.CVE-2024-47578 · Network & remote access · SAP_SE · reported by cna@sap.comCritical 9.1
Adobe Document Service allows an attacker with administrator privileges to send a crafted request from a vulnerable web application. It is usually used to target internal systems behind firewalls that are normally inaccessible to an attacker from the external network, resulting in a Server-Side Request Forgery vulnerability. On successful exploitation, the attacker can read or modify any file and/or make the entire system unavailable.
- Product
- SAP NetWeaver AS for JAVA (Adobe Document Services)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2024SAP Product Lifecycle Costing Client (versions below 4.7.1) application loads on demand a DLL that is available with Windows OS.CVE-2024-47576 · Network & remote access · SAP_SE · reported by cna@sap.comLow 3.3
SAP Product Lifecycle Costing Client (versions below 4.7.1) application loads on demand a DLL that is available with Windows OS. This DLL is loaded from the computer running SAP Product Lifecycle Costing Client application. That particular DLL could be replaced by a malicious one, that could execute commands as being part of SAP Product Lifecycle Costing Client Application. On a successful attack, it can cause a low impact to confidentiality but no impact to the integrity and availability of the application.
- Product
- SAP Product Lifecycle Costing
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2024A vulnerability was found in OIDC-Client.CVE-2024-12369 · Other software · Red Hat · reported by Red HatMedium 4.2
A vulnerability was found in OIDC-Client. When using the RH SSO OIDC adapter with EAP 7.x or when using the elytron-oidc-client subsystem with EAP 8.x, authorization code injection attacks can occur, allowing an attacker to inject a stolen authorization code into the attacker's own session with the client with a victim's identity. This is usually done with a Man-in-the-Middle (MitM) or phishing attack.
- Product
- Red Hat JBoss Enterprise Application Platform 8
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Dec 8, 2024Zammad before 6.4.1 places sensitive data (such as auth_microsoft_office365_credentials and application_secret) in log files.CVE-2024-55578 · Other software · Zammad · reported by MITREMedium 4.3
Zammad before 6.4.1 places sensitive data (such as auth_microsoft_office365_credentials and application_secret) in log files.
- Product
- Zammad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 6, 2024The HTTP host header can be manipulated and cause the application to behave in unexpected ways.CVE-2024-30129 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.3
The HTTP host header can be manipulated and cause the application to behave in unexpected ways. Any changes made to the header would cause the request to be sent to a completely different domain/IP address.
- Product
- Nomad server on Domino
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Dec 6, 2024phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases.CVE-2024-54141 · Other software · thorsten · reported by GitHubHigh 8.6
phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Prior to 4.0.0, phpMyFAQ exposes the database (ie postgreSQL) server's credential when connection to DB fails. This vulnerability is fixed in 4.0.0.
- Product
- phpMyFAQ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2024Web browser interface may manipulate application username/password in clear text or Base64 encoding providing a higher probability of unintended credentails exCVE-2024-6515 · Other software · ABB · reported by cybersecurity@ch.abb.comHigh 8.7
Web browser interface may manipulate application username/password in clear text or Base64 encoding providing a higher probability of unintended credentails exposure. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02
- Product
- ASPECT-Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2024Username Enumeration vulnerabilities allow access to application level username add, delete, modify and list functions.CVE-2024-51545 · Other software · ABB · reported by cybersecurity@ch.abb.comCritical 9.3
Username Enumeration vulnerabilities allow access to application level username add, delete, modify and list functions. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02
- Product
- ASPECT-Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2024Information Disclosure vulnerabilities allow access to application configuration information.CVE-2024-51543 · Other software · ABB · reported by cybersecurity@ch.abb.comHigh 8.8
Information Disclosure vulnerabilities allow access to application configuration information. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02
- Product
- ASPECT-Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2024MD5 Checksum Bypass vulnerabilities where found exploiting a weakness in the way an application dependency calculates or validates MD5 checksum hashes.CVE-2024-48847 · Other software · ABB · reported by cybersecurity@ch.abb.comHigh 8.8
MD5 Checksum Bypass vulnerabilities where found exploiting a weakness in the way an application dependency calculates or validates MD5 checksum hashes. Affected products: ABB ASPECT - Enterprise v3.08.01; NEXUS Series v3.08.01; MATRIX Series v3.08.01
- Product
- ASPECT-Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2024The Mister org.mistergroup.shouldianswer application 1.4.264 for Android enables any installed application (with no permissions) to place phone calls without usCVE-2024-37575 · Other software · reported by MITREHigh 7.5
The Mister org.mistergroup.shouldianswer application 1.4.264 for Android enables any installed application (with no permissions) to place phone calls without user interaction by sending a crafted intent via the org.mistergroup.shouldianswer.ui.default_dialer.DefaultDialerActivity component.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2024The GriceMobile com.grice.call application 4.5.2 for Android enables any installed application (with no permissions) to place phone calls without user interactiCVE-2024-37574 · Other software · reported by MITREHigh 8.2
The GriceMobile com.grice.call application 4.5.2 for Android enables any installed application (with no permissions) to place phone calls without user interaction by sending a crafted intent via the com.iui.mobile.presentation.MobileActivity.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2024Infinix devices contain a pre-loaded "com.transsion.agingfunction" application, that exposes an unsecured broadcast receiver.CVE-2024-10576 · Other software · Infinix Mobile · reported by cvd@cert.plCritical 9.4
Infinix devices contain a pre-loaded "com.transsion.agingfunction" application, that exposes an unsecured broadcast receiver. An attacker can communicate with the receiver and force the device to perform a factory reset without any Android system permissions. After multiple attempts to contact the vendor we did not receive any answer. We suppose this issue affects all Infinix Mobile devices.
- Product
- com.transsion.agingfunction
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2024An Improper Certificate Validation on the UniFi iOS App managing a standalone UniFi Access Point (not using UniFi Network Application) could allow a malicious aCVE-2024-45205 · Network & remote access · Ubiquiti · reported by support@hackerone.comHigh 7.1
An Improper Certificate Validation on the UniFi iOS App managing a standalone UniFi Access Point (not using UniFi Network Application) could allow a malicious actor with access to an adjacent network to take control of this UniFi Access Point. Affected Products: UniFi iOS App (Version 10.17.7 and earlier) Mitigation: UniFi iOS App (Version 10.18.0 or later).
- Product
- UniFi iOS App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2024IBM Cognos Controller 11.0.0 and 11.0.1 exposes server details that could allow an attacker to obtain information of the application environment to conduct CVE-2024-25035 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM Cognos Controller 11.0.0 and 11.0.1 exposes server details that could allow an attacker to obtain information of the application environment to conduct further attacks.
- Product
- Cognos Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2024Improper Verification of Cryptographic Signature in SmartSwitch prior to SMR Dec-2024 Release 1 allows local attackers to install malicious applications.CVE-2024-49413 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comHigh 7.1
Improper Verification of Cryptographic Signature in SmartSwitch prior to SMR Dec-2024 Release 1 allows local attackers to install malicious applications.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.com
Dec 2, 2024rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications.CVE-2024-53988 · Other software · rails · reported by GitHubLow 2.3
rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. There is a possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer 1.6.0 when used with Rails >= 7.1.0. A possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer may allow an attacker to inject content if HTML5 sanitization is enabled and the application developer has overridden the sanitizer's allowed tags where the "math", "mtext", "table", and "style" elements are allowed and either either "mglyph" or "malignmark" are allowed. This vulnerability is fixed in 1.6.1.
- Product
- rails-html-sanitizer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2024rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications.CVE-2024-53987 · Other software · rails · reported by GitHubLow 2.3
rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. There is a possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer 1.6.0 when used with Rails >= 7.1.0. A possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer may allow an attacker to inject content if HTML5 sanitization is enabled and the application developer has overridden the sanitizer's allowed tags where the "style" element is explicitly allowed and the "svg" or "math" element is not allowed. This vulnerability is fixed in 1.6.1.
- Product
- rails-html-sanitizer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2024rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications.CVE-2024-53986 · Other software · rails · reported by GitHubLow 2.3
rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. There is a possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer 1.6.0 when used with Rails >= 7.1.0. A possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer may allow an attacker to inject content if HTML5 sanitization is enabled and the application developer has overridden the sanitizer's allowed tags where the "math" and "style" elements are both explicitly allowed. This vulnerability is fixed in 1.6.1.
- Product
- rails-html-sanitizer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2024rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications.CVE-2024-53985 · Other software · rails · reported by GitHubLow 2.3
rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. There is a possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer 1.6.0 when used with Rails >= 7.1.0 and Nokogiri < 1.15.7, or 1.16.x < 1.16.8. The XSS vulnerability with certain configurations of Rails::HTML::Sanitizer may allow an attacker to inject content if HTML5 sanitization is enabled and the application developer has overridden the sanitizer's allowed tags with both "math" and "style" elements or both both "svg" and "style" elements. This vulnerability is fixed in 1.6.1.
- Product
- rails-html-sanitizer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2024rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications.CVE-2024-53989 · Other software · rails · reported by GitHubLow 2.3
rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. There is a possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer 1.6.0 when used with Rails >= 7.1.0. A possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer may allow an attacker to inject content if HTML5 sanitization is enabled and the application developer has overridden the sanitizer's allowed tags for the the "noscript" element. This vulnerability is fixed in 1.6.1.
- Product
- rails-html-sanitizer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2024The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses.CVE-2024-53990 · Other software · AsyncHttpClient · reported by GitHubCritical 9.2
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. When making any HTTP request, the automatically enabled and self-managed CookieStore (aka cookie jar) will silently replace explicitly defined Cookies with any that have the same name from the cookie jar. For services that operate with multiple users, this can result in one user's Cookie being used for another user's requests.
- Product
- async-http-client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 29, 2024An integer overflow in the component /libavformat/westwood_vqa.c of FFmpeg n6.1.1 allows attackers to cause a denial of service in the application via a craftedCVE-2024-36616 · Other software · Ffmpeg · reported by MITREMedium 6.5
An integer overflow in the component /libavformat/westwood_vqa.c of FFmpeg n6.1.1 allows attackers to cause a denial of service in the application via a crafted VQA file.
- Product
- Ffmpeg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Nov 29, 2024Multiple FCNT Android devices provide the original security features such as "privacy mode" where arbitrary applications can be set not to be displayed, etc.CVE-2024-53701 · Other software · FCNT LLC · reported by vultures@jpcert.or.jpLow 3.1
Multiple FCNT Android devices provide the original security features such as "privacy mode" where arbitrary applications can be set not to be displayed, etc. Under certain conditions, and when an attacker can directly operate the device which its screen is unlocked by a user, the provided security features' setting pages may be exposed and/or the settings may be altered, without authentication. For example, specific applications in the device configured to be hidden may be displayed and/or activated.
- Product
- arrows N F-51C
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 28, 2024A low privileged remote attacker can insert a SQL injection in the web application due to improper handling of HTTP request input data which allows to exfiltratCVE-2024-8308 · Other software · Siempelkamp · reported by info@cert.vde.comMedium 6.5
A low privileged remote attacker can insert a SQL injection in the web application due to improper handling of HTTP request input data which allows to exfiltrate all data.
- Product
- UmweltOffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 27, 2024Centurion ERP (Enterprise Rescource Planning) is a simple application developed to provide open source IT management with a large emphasis on the IT Service ManCVE-2024-53855 · Other software · nofusscomputing · reported by GitHubLow 1.9
Centurion ERP (Enterprise Rescource Planning) is a simple application developed to provide open source IT management with a large emphasis on the IT Service Management (ITSM) modules. A user who is authenticated and has view permissions for a ticket, can view the tickets of another organization they are not apart of. Users with following permissions are applicable: 1. `view_ticket_change` permission can view change tickets from organizations they are not apart of. 2. `view_ticket_incident` permission can view incident tickets from organizations they are not apart of. 3. `view_ticket_request` permission can view request tickets from organizations they are not apart of. 4. `view_ticket_problem` permission can view problem tickets from organizations they are not apart of. The access to view the tickets from different organizations is only applicable when browsing the API endpoints for the tickets in question. The Centurion UI is not affected. Project Tasks, although a "ticket type" are also **Not** affected. This issue has been addressed in release version 1.3.1 and users are advised to upgrade. Users unable to upgrade may remove the ticket view permissions from users which would alle
- Product
- centurion_erp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 27, 2024bunkerweb is an Open-source and next-generation Web Application Firewall (WAF).CVE-2024-53264 · Other software · bunkerity · reported by GitHubMedium 5.1
bunkerweb is an Open-source and next-generation Web Application Firewall (WAF). A open redirect vulnerability exists in the loading endpoint, allowing attackers to redirect authenticated users to arbitrary external URLs via the "next" parameter. The loading endpoint accepts and uses an unvalidated "next" parameter for redirects. Ex. visiting: `/loading?next=https://google.com` while authenticated will cause the page will redirect to google.com. This vulnerability could be used in phishing attacks by redirecting users from a legitimate application URL to malicious sites. This issue has been addressed in version 1.5.11. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- bunkerweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.