Updated 10 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

526new WordPress flaws this week

391,181entries in the database

1,637 results · page 9 of 33

Sep 26, 2024Monica AI Assistant desktop application v2.3.0 is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor.CVE-2024-45989 · Other software · butterflyeffectpte · reported by MITREMedium 4
Monica AI Assistant desktop application v2.3.0 is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor. A prompt injection allows an attacker to modify chatbot answer with an unloaded image that exfiltrates the user's sensitive chat data of the current session to a malicious third-party or attacker-controlled server.
Product
monica
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com monica.im
Sep 21, 2024Gladys Assistant before 4.45.1 allows Privilege Escalation (a user changing their own role) because req.body.role can be used in updateMySelf in server/api/contCVE-2024-47210 · Other software · gladysassistant · reported by MITREHigh 8.8
Gladys Assistant before 4.45.1 allows Privilege Escalation (a user changing their own role) because req.body.role can be used in updateMySelf in server/api/controllers/user.controller.js.
Product
gladys_assistant
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 13, 2024BT: Unchecked user input in bap_broadcast_assistantCVE-2024-5931 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgMedium 6.3
BT: Unchecked user input in bap_broadcast_assistant
Product
Zephyr
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Sep 9, 2024The Affiliate Super Assistent: Arbitrary shortcode executionCVE-2024-8478 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The The Affiliate Super Assistent plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.5.3. This is due to the software allowing users to supply arbitrary shortcodes in comments when the 'Parse comments' option is enabled. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Product
The Affiliate Super Assistent
Affected
up to 1.5.3
What to do
Affects up to 1.5.3. Update The Affiliate Super Assistent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 4, 2024Improper handling of insufficient permissions in Samsung Assistant prior to version 9.1.00.7 allows remote attackers to access location data.CVE-2024-34661 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4.3
Improper handling of insufficient permissions in Samsung Assistant prior to version 9.1.00.7 allows remote attackers to access location data. User interaction is required for triggering this vulnerability.
Product
Samsung Assistant
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com
Aug 20, 2024Dell SupportAssist for Home PCs Installer exe version 4.0.3 contains a privilege escalation vulnerability in the installer.CVE-2024-38305 · Other software · Dell · reported by security_alert@emc.comHigh 7.3
Dell SupportAssist for Home PCs Installer exe version 4.0.3 contains a privilege escalation vulnerability in the installer. A local low-privileged authenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary executables on the operating system with elevated privileges.
Product
SupportAssist for Home PCs
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record dell.com
Aug 13, 2024Media Library Assistant: Arbitrary file uploadsCVE-2024-6823 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Media Library Assistant plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation involving the mla-inline-edit-upload-scripts AJAX action in all versions up to, and including, 3.18. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Media Library Assistant
Affected
up to 3.18
What to do
Affects up to 3.18. Update Media Library Assistant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 8, 2024VRCX is an assistant/companion application for VRChat.CVE-2024-42366 · Other software · vrcx-team · reported by GitHubCritical 9
VRCX is an assistant/companion application for VRChat. In versions prior to 2024.03.23, a CefSharp browser with over-permission and cross-site scripting via overlay notification can be combined to result in remote command execution. These vulnerabilities are patched in VRCX 2023.12.24. In addition to the patch, VRCX maintainers worked with the VRC team and blocked the older version of VRCX on the VRC's API side. Users who use the older version of VRCX must update their installation to continue using VRCX.
Product
VRCX
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 2, 2024Media Library Assistant: Reflected Cross-Site ScriptingCVE-2024-5544 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the order parameter in all versions up to, and including, 3.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Media Library Assistant
Affected
up to 3.17
What to do
Affects up to 3.17. Update Media Library Assistant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 28, 2024The CycloneDX core module provides a model representation of the SBOM along with utilities to assist in creating, validating, and parsing SBOMs.CVE-2024-38374 · Other software · CycloneDX · reported by GitHubHigh 7.5
The CycloneDX core module provides a model representation of the SBOM along with utilities to assist in creating, validating, and parsing SBOMs. Before deserializing CycloneDX Bill of Materials in XML format, _cyclonedx-core-java_ leverages XPath expressions to determine the schema version of the BOM. The `DocumentBuilderFactory` used to evaluate XPath expressions was not configured securely, making the library vulnerable to XML External Entity (XXE) injection. This vulnerability has been fixed in cyclonedx-core-java version 9.0.4.
Product
cyclonedx-core-java
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 20, 2024Media Library Assistant: Time-based SQL InjectionCVE-2024-5605 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Media Library Assistant plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter within the mla_tag_cloud Shortcode in all versions up to, and including, 3.16 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Media Library Assistant
Affected
up to 3.16
What to do
Affects up to 3.16. Update Media Library Assistant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 30, 2024A vulnerability has been discovered in Diño Physics School Assistant version 2.3.CVE-2024-35359 · Other software · dino_physics_school_assistant_project · reported by MITRECritical 9.8
A vulnerability has been discovered in Diño Physics School Assistant version 2.3. The vulnerability impacts an unidentified code within the file /classes/Master.php?f=view_item. Manipulating the argument id can result in SQL injection.
Product
dino_physics_school_assistant
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record vuln.pentester.stream vuln.pentester.stream
May 30, 2024A vulnerability has been discovered in Diño Physics School Assistant version 2.3.CVE-2024-35353 · Other software · dino_physics_school_assistant_project · reported by MITRECritical 9.8
A vulnerability has been discovered in Diño Physics School Assistant version 2.3. The vulnerability impacts an unidentified code within the file /classes/Users.php?f=save. Manipulating the argument id can result in improper authorization.
Product
dino_physics_school_assistant
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record vuln.pentester.stream vuln.pentester.stream
May 30, 2024A vulnerability has been discovered in Diño Physics School Assistant version 2.3.CVE-2024-35352 · Other software · dino_physics_school_assistant_project · reported by MITREMedium 6.1
A vulnerability has been discovered in Diño Physics School Assistant version 2.3. This vulnerability impacts unidentified code within the file /classes/Users.php?f=save. Manipulating the parameter middlename results in cross-site scripting.
Product
dino_physics_school_assistant
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record vuln.pentester.stream vuln.pentester.stream
May 30, 2024A vulnerability has been discovered in Diño Physics School Assistant version 2.3.CVE-2024-35351 · Other software · dino_physics_school_assistant_project · reported by MITREMedium 5.4
A vulnerability has been discovered in Diño Physics School Assistant version 2.3. This vulnerability impacts unidentified code within the file /classes/SystemSettings.php?f=update_settings. Manipulating the parameter name results in cross-site scripting.
Product
dino_physics_school_assistant
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record vuln.pentester.stream vuln.pentester.stream
May 30, 2024A vulnerability has been discovered in Diño Physics School Assistant version 2.3.CVE-2024-35350 · Other software · dino_physics_school_assistant_project · reported by MITRECritical 9.8
A vulnerability has been discovered in Diño Physics School Assistant version 2.3. The vulnerability impacts an unidentified code within the file /admin/?page=borrow/view_borrow. Manipulating the argument id can result in SQL injection.
Product
dino_physics_school_assistant
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record vuln.pentester.stream vuln.pentester.stream
May 30, 2024A vulnerability has been discovered in Diño Physics School Assistant version 2.3.CVE-2024-35349 · Other software · dino_physics_school_assistant_project · reported by MITRECritical 9.8
A vulnerability has been discovered in Diño Physics School Assistant version 2.3. The vulnerability impacts an unidentified code within the file /admin/category/view_category.php. Manipulating the argument id can result in SQL injection.
Product
dino_physics_school_assistant
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record vuln.pentester.stream vuln.pentester.stream
May 30, 2024A vulnerability has been discovered in Diño Physics School Assistant version 2.3.CVE-2024-35358 · Other software · dino_physics_school_assistant_project · reported by MITREMedium 6.5
A vulnerability has been discovered in Diño Physics School Assistant version 2.3. The vulnerability impacts an unidentified code within the file /classes/Master.php?f=view_category. Manipulating the argument id can result in SQL injection.
Product
dino_physics_school_assistant
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record vuln.pentester.stream vuln.pentester.stream
May 30, 2024A vulnerability has been discovered in Diño Physics School Assistant version 2.3.CVE-2024-35357 · Other software · dino_physics_school_assistant_project · reported by MITREMedium 5.3
A vulnerability has been discovered in Diño Physics School Assistant version 2.3. The vulnerability impacts an unidentified code within the file /classes/Master.php?f=delete_item. Manipulating the argument id can result in SQL injection.
Product
dino_physics_school_assistant
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record vuln.pentester.stream vuln.pentester.stream
May 30, 2024A vulnerability has been discovered in Diño Physics School Assistant version 2.3.CVE-2024-35356 · Other software · dino_physics_school_assistant_project · reported by MITREMedium 6.3
A vulnerability has been discovered in Diño Physics School Assistant version 2.3. The vulnerability impacts an unidentified code within the file /classes/Master.php?f=save_item. Manipulating the argument id can result in SQL injection.
Product
dino_physics_school_assistant
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record vuln.pentester.stream vuln.pentester.stream
May 30, 2024A vulnerability has been discovered in Diño Physics School Assistant version 2.3.CVE-2024-35355 · Other software · dino_physics_school_assistant_project · reported by MITRECritical 9.8
A vulnerability has been discovered in Diño Physics School Assistant version 2.3. The vulnerability impacts an unidentified code within the file /classes/Master.php?f=delete_category. Manipulating the argument id can result in SQL injection.
Product
dino_physics_school_assistant
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record vuln.pentester.stream vuln.pentester.stream
May 30, 2024A vulnerability has been discovered in Diño Physics School Assistant version 2.3.CVE-2024-35354 · Other software · dino_physics_school_assistant_project · reported by MITRECritical 9.8
A vulnerability has been discovered in Diño Physics School Assistant version 2.3. The vulnerability impacts an unidentified code within the file /classes/Master.php?f=save_category. Manipulating the argument id can result in SQL injection.
Product
dino_physics_school_assistant
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record vuln.pentester.stream vuln.pentester.stream
May 30, 2024A vulnerability has been discovered in Diño Physics School Assistant version 2.3.CVE-2024-35345 · Other software · dino_physics_school_assistant_project · reported by MITREMedium 5.4
A vulnerability has been discovered in Diño Physics School Assistant version 2.3. The vulnerability impacts unidentified code within the file /classes/Users.php. Manipulating the argument id results in cross-site scripting.
Product
dino_physics_school_assistant
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record vuln.pentester.stream vuln.pentester.stream
May 23, 2024D-Link Network Assistant Uncontrolled Search Path Element Local Privilege Escalation Vulnerability.CVE-2024-5292 · Network & remote access · D-Link · reported by zdi-disclosures@trendmicro.comHigh 7.8
D-Link Network Assistant Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of D-Link Network Assistant. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the DNACore service. The service loads a file from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-21426.
Product
Network Assistant
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zerodayinitiative.com zerodayinitiative.com
May 21, 2024Media Library Assistant: Reflected Cross-Site ScriptingCVE-2024-3519 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the lang parameter in all versions up to, and including, 3.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Media Library Assistant
Affected
up to 3.15
What to do
Affects up to 3.15. Update Media Library Assistant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 21, 2024Media Library Assistant: SQL InjectionCVE-2024-3518 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Media Library Assistant plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode(s) in all versions up to, and including, 3.15 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor access or higher, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Media Library Assistant
Affected
up to 3.15
What to do
Affects up to 3.15. Update Media Library Assistant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 2, 2024Intel Driver & Support Assistant Link Following Local Privilege Escalation Vulnerability.CVE-2023-50197 · Other software · Intel · reported by zdi-disclosures@trendmicro.comHigh 7.8
Intel Driver & Support Assistant Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Intel Driver & Support Assistant. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the DSA Service. By creating a symbolic link, an attacker can abuse the service to write a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-21845.
Product
Driver & Support Assistant
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zerodayinitiative.com zerodayinitiative.com
May 2, 2024Intel Driver & Support Assistant Link Following Local Privilege Escalation Vulnerability.CVE-2023-42099 · Other software · Intel · reported by zdi-disclosures@trendmicro.comHigh 7.8
Intel Driver & Support Assistant Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Intel Driver & Support Assistant. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the DSA Service. By creating a symbolic link, an attacker can abuse the service to delete a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-21846.
Product
Driver & Support Assistant
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zerodayinitiative.com zerodayinitiative.com
Apr 29, 2024Assistant – Every Day Productivity Apps: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-33538 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Fastline Media LLC Assistant – Every Day Productivity Apps.This issue affects Assistant – Every Day Productivity Apps: from n/a through 1.4.9.1.
Product
Assistant – Every Day Productivity Apps
Affected
up to 1.4.9.1
What to do
Affects up to 1.4.9.1. Update Assistant – Every Day Productivity Apps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 26, 2024Danswer is the AI Assistant connected to company's docs, apps, and people.CVE-2024-32881 · Other software · danswer-ai · reported by GitHubCritical 9.8
Danswer is the AI Assistant connected to company's docs, apps, and people. Danswer is vulnerable to unauthorized access to GET/SET of Slack Bot Tokens. Anyone with network access can steal slack bot tokens and set them. This implies full compromise of the customer's slack bot, leading to internal Slack access. This issue was patched in version 3.63.
Product
danswer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 9, 2024Media Library Assistant: SQL InjectionCVE-2024-2871 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Media Library Assistant plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode(s) in all versions up to, and including, 3.13 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor access or higher, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Media Library Assistant
Affected
up to 3.13
What to do
Affects up to 3.13. Update Media Library Assistant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 29, 2024Media Library Assistant: Stored Cross-Site ScriptingCVE-2024-2475 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 3.13 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Media Library Assistant
Affected
up to 3.13
What to do
Affects up to 3.13. Update Media Library Assistant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 27, 2024Knowledge Base for Documentation, FAQs with AI Assistance: Deserialization of Untrusted DataCVE-2024-24842 · WordPress plugins & themes · reported by PatchstackHigh 8.7
Deserialization of Untrusted Data vulnerability in Echo Plugins Knowledge Base for Documentation, FAQs with AI Assistance.This issue affects Knowledge Base for Documentation, FAQs with AI Assistance: from n/a through 11.30.2.
Product
Knowledge Base for Documentation, FAQs with AI Assistance
Affected
up to 11.30.2
What to do
Affects up to 11.30.2. Update Knowledge Base for Documentation, FAQs with AI Assistance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 25, 2024This vulnerability allows remote attackers to traverse paths via file upload on the affected LG LED Assistant.CVE-2024-2863 · Other software · LG Electronics · reported by product.security@lge.comMedium 5.3
This vulnerability allows remote attackers to traverse paths via file upload on the affected LG LED Assistant.
Product
LG LED Assistant
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lgsecurity.lge.com lgsecurity.lge.com
Mar 25, 2024 This vulnerability allows remote attackers to reset the password of anonymous users without authorization on the affected LG LED Assistant.CVE-2024-2862 · Other software · LG Electronics · reported by product.security@lge.comCritical 9.1
This vulnerability allows remote attackers to reset the password of anonymous users without authorization on the affected LG LED Assistant.
Product
LG LED Assistant
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lgsecurity.lge.com lgsecurity.lge.com
Mar 2, 2024AI Engine: Chatbots, Generators, Assistants, GPT 4 and more!: Stored Cross-Site ScriptingCVE-2024-0378 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The AI Engine: Chatbots, Generators, Assistants, GPT 4 and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the AI chat data when discussion tracking is enabled in all versions up to, and including, 2.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
AI Engine: Chatbots, Generators, Assistants, GPT 4 and more!
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update AI Engine: Chatbots, Generators, Assistants, GPT 4 and more! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 14, 2024Out-of-bounds read in some Intel(R) QAT software drivers for Windows before version QAT1.7-W-1.11.0 may allow an authenticated user to potentially enable denialCVE-2023-41252 · Other software · Intel · reported by secure@intel.comMedium 6.5
Out-of-bounds read in some Intel(R) QAT software drivers for Windows before version QAT1.7-W-1.11.0 may allow an authenticated user to potentially enable denial of service via local access.
Product
Quickassist Technology Driver
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record intel.com intel.com
Feb 14, 2024Incorrect default permissions in some ACAT software maintained by Intel(R) before version 2.0.0 may allow an authenticated user to potentially enable escalationCVE-2023-41231 · Other software · intel · reported by secure@intel.comMedium 6.7
Incorrect default permissions in some ACAT software maintained by Intel(R) before version 2.0.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
Product
assistive_context-aware_toolkit
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record intel.com intel.com
Feb 14, 2024Improper access control in some Intel(R) DSA software before version 23.4.33 may allow an authenticated user to potentially enable escalation of privilege via lCVE-2023-39425 · Other software · intel · reported by secure@intel.comHigh 8.8
Improper access control in some Intel(R) DSA software before version 23.4.33 may allow an authenticated user to potentially enable escalation of privilege via local access.
Product
driver\&support_assistant
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record intel.com intel.com
Feb 14, 2024Improper access control in some Intel(R) DSA software before version 23.4.33 may allow an authenticated user to potentially enable denial of service via local aCVE-2023-25073 · Other software · Intel · reported by secure@intel.comMedium 5.5
Improper access control in some Intel(R) DSA software before version 23.4.33 may allow an authenticated user to potentially enable denial of service via local access.
Product
Driver & Support Assistant
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record intel.com intel.com
Feb 14, 2024 In Dell SupportAssist for Home PCs (between v3.0 and v3.14.1) and SupportAssist for Business PCs (between v3.0 and v3.4.1), a security concern has been identifCVE-2023-44283 · Other software · Dell · reported by security_alert@emc.comHigh 7.8
In Dell SupportAssist for Home PCs (between v3.0 and v3.14.1) and SupportAssist for Business PCs (between v3.0 and v3.4.1), a security concern has been identified, impacting locally authenticated users on their respective PCs. This issue may potentially enable privilege escalation and the execution of arbitrary code, in the Windows system context, and confined to that specific local PC.
Product
SupportAssist for Home PCs
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record dell.com dell.com
Feb 14, 2024 Dell SupportAssist for Business PCs version 3.4.0 contains a local Authentication Bypass vulnerability that allows locally authenticated non-admin users to gaiCVE-2023-39249 · Other software · Dell · reported by security_alert@emc.comMedium 6.3
Dell SupportAssist for Business PCs version 3.4.0 contains a local Authentication Bypass vulnerability that allows locally authenticated non-admin users to gain temporary privilege within the SupportAssist User Interface on their respective PC. The Run as Admin temporary privilege feature enables IT/System Administrators to perform driver scans and Dell-recommended driver installations without requiring them to log out of the local non-admin user session. However, the granted privilege is limited solely to the SupportAssist User Interface and automatically expires after 15 minutes.
Product
SupportAssist Client Consumer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record dell.com dell.com
Feb 14, 2024 Dell SupportAssist for Home PCs Installer Executable file version prior to 3.13.2.19 used for initial installation has a high vulnerability that can result in CVE-2023-25535 · Other software · Dell · reported by security_alert@emc.comHigh 7.2
Dell SupportAssist for Home PCs Installer Executable file version prior to 3.13.2.19 used for initial installation has a high vulnerability that can result in local privilege escalation (LPE). This vulnerability only affects first-time installations done prior to 8th March 2023
Product
SupportAssist Client Consumer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record dell.com dell.com
Feb 12, 2024 Dell Unity, versions prior to 5.4, contain a path traversal vulnerability in its svc_supportassist utility.CVE-2024-22226 · Other software · Dell · reported by security_alert@emc.comLow 3.3
Dell Unity, versions prior to 5.4, contain a path traversal vulnerability in its svc_supportassist utility. An authenticated attacker could potentially exploit this vulnerability, to gain unauthorized write access to the files stored on the server filesystem, with elevated privileges.
Product
Unity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record dell.com dell.com
Feb 12, 2024 Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability in its svc_supportassist utility.CVE-2024-22225 · Other software · Dell · reported by security_alert@emc.comHigh 7.8
Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability in its svc_supportassist utility. An authenticated attacker could potentially exploit this vulnerability, leading to execution of arbitrary operating system commands with root privileges.
Product
Unity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record dell.com dell.com
Feb 8, 2024An issue was discovered in Atos Unify OpenScape Xpressions WebAssistant V7 before V7R1 FR5 HF42 P911.CVE-2023-40266 · Email & office · Mitel · reported by MITRECritical 9.8
An issue was discovered in Atos Unify OpenScape Xpressions WebAssistant V7 before V7R1 FR5 HF42 P911. It allows path traversal.
Product
Unify Openscape Xpressions Webassistant
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record networks.unify.com networks.unify.com
Feb 8, 2024An issue was discovered in Atos Unify OpenScape Xpressions WebAssistant V7 before V7R1 FR5 HF42 P911.CVE-2023-40265 · Email & office · Mitel · reported by MITREHigh 8.8
An issue was discovered in Atos Unify OpenScape Xpressions WebAssistant V7 before V7R1 FR5 HF42 P911. It allows authenticated remote code execution via file upload.
Product
Unify Openscape Xpressions Webassistant
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record networks.unify.com networks.unify.com
Feb 5, 2024AI Engine: Chatbots, Generators, Assistants, GPT 4 and more!: Arbitrary file uploadsCVE-2024-0699 · WordPress plugins & themes · reported by WordfenceMedium 6.6
The AI Engine: Chatbots, Generators, Assistants, GPT 4 and more! plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'add_image_from_url' function in all versions up to, and including, 2.1.4. This makes it possible for authenticated attackers, with Editor access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. CVE-2024-29100 is likely a duplicate of this issue.
Product
AI Engine: Chatbots, Generators, Assistants, GPT 4 and more!
Affected
up to 2.1.4
What to do
Affects up to 2.1.4. Update AI Engine: Chatbots, Generators, Assistants, GPT 4 and more! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 5, 202410Web AI Assistant – AI content writing assistant: Unauthorized modification of dataCVE-2023-6985 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The 10Web AI Assistant – AI content writing assistant plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the install_plugin AJAX action in all versions up to, and including, 1.0.18. This makes it possible for authenticated attackers, with subscriber-level access and above, to install arbitrary plugins that can be used to gain further access to a compromised site.
Product
10Web AI Assistant – AI content writing assistant
Affected
up to 1.0.18
What to do
Affects up to 1.0.18. Update 10Web AI Assistant – AI content writing assistant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 18, 2024jupyter-lsp is a coding assistance tool for JupyterLab (code navigation + hover suggestions + linters + autocompletion + rename) using Language Server Protocol.CVE-2024-22415 · Other software · jupyter-lsp · reported by GitHubHigh 7.3
jupyter-lsp is a coding assistance tool for JupyterLab (code navigation + hover suggestions + linters + autocompletion + rename) using Language Server Protocol. Installations of jupyter-lsp running in environments without configured file system access control (on the operating system level), and with jupyter-server instances exposed to non-trusted network are vulnerable to unauthorised access and modification of file system beyond the jupyter root directory. This issue has been patched in version 2.2.2 and all users are advised to upgrade. Users unable to upgrade should uninstall jupyter-lsp.
Product
jupyterlab-lsp
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.