Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
787 results · page 9 of 16
Sep 16, 2024This issue was addressed with improved redaction of sensitive information.CVE-2024-44158 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 17.7 and iPadOS 17.7, macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7. A shortcut may output sensitive user data without consent.
- Product
- iOS and iPadOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Sep 16, 2024A privacy issue was addressed with improved private data redaction for log entries.CVE-2024-44152 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.5
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15. An app may be able to access user-sensitive data.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comseclists.org
Sep 16, 2024This issue was addressed with improved redaction of sensitive information.CVE-2024-44134 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sequoia 15. An app may be able to read sensitive location information.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comseclists.org
Sep 16, 2024A privacy issue was addressed with improved private data redaction for log entries.CVE-2024-40791 · Computers, phones & browsers · Apple · reported by product-security@apple.comLow 3.3
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 17.7 and iPadOS 17.7, iOS 18 and iPadOS 18, macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7. An app may be able to access information about a user's contacts.
- Product
- iOS and iPadOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Aug 29, 2024IntoTheDark: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43958 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gianni Porto IntoTheDark allows Reflected XSS.This issue affects IntoTheDark: from n/a through 1.0.5.
- Product
- IntoTheDark
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update IntoTheDark to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 28, 2024Roughly Enough Items (REI) v.16.0.729 and before contains an Improper Validation of Specified Index, Position, or Offset in Input vulnerability.CVE-2024-42698 · Other software · Shedaniel · reported by MITREMedium 4.3
Roughly Enough Items (REI) v.16.0.729 and before contains an Improper Validation of Specified Index, Position, or Offset in Input vulnerability. The specific issue is a failure to validate slot index and decrement stack count in the Roughly Enough Items (REI) mod for Minecraft, which allows in-game item duplication.
- Product
- Roughlyenoughitems
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Aug 22, 2024Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2, when shared channels are enabled, fail to redact remote users' original emCVE-2024-32939 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 4.3
Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2, when shared channels are enabled, fail to redact remote users' original email addresses stored in user props when email addresses are otherwise configured not to be visible in the local server."
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2024ERP commit 44bd04 was discovered to contain a SQL injection vulnerability via the id parameter at /index.php/basedata/contact/delete?action=delete.CVE-2024-42565 · Other software · jerryhanjj · reported by MITRECritical 9.8
ERP commit 44bd04 was discovered to contain a SQL injection vulnerability via the id parameter at /index.php/basedata/contact/delete?action=delete.
- Product
- erp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2024ERP commit 44bd04 was discovered to contain a SQL injection vulnerability via the id parameter at /index.php/basedata/inventory/delete?action=delete.CVE-2024-42564 · Other software · entab · reported by MITREHigh 7.6
ERP commit 44bd04 was discovered to contain a SQL injection vulnerability via the id parameter at /index.php/basedata/inventory/delete?action=delete.
- Product
- erp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2024This vulnerability exists in Airveda Air Quality Monitor PM2.5 PM10 due to transmission of sensitive information in plain text during AP pairing mode.CVE-2024-7408 · Other software · Airveda · reported by vdisclose@cert-in.org.inHigh 8.6
This vulnerability exists in Airveda Air Quality Monitor PM2.5 PM10 due to transmission of sensitive information in plain text during AP pairing mode. An attacker in close proximity could exploit this vulnerability by capturing Wi-Fi traffic of Airveda-AP. Successful exploitation of this vulnerability could allow the attacker to cause Evil Twin attack on the targeted system.
- Product
- Air Quality Monitor PM2.5 PM10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2024This issue was addressed with improved redaction of sensitive information.CVE-2024-40798 · Computers, phones & browsers · Apple · reported by product-security@apple.comLow 3.3
This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 16.7.9 and iPadOS 16.7.9, macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS Ventura 13.6.8. An app may be able to read Safari's browsing history.
- Product
- iOS and iPadOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Jul 29, 2024A privacy issue was addressed with improved private data redaction for log entries.CVE-2024-40796 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.3
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 16.7.9 and iPadOS 16.7.9, macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS Ventura 13.6.8. Private browsing may leak some browsing history.
- Product
- iOS and iPadOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Jul 29, 2024A privacy issue was addressed with improved private data redaction for log entries.CVE-2024-27881 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.3
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS Ventura 13.6.8. An app may be able to access information about a user’s contacts.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Jul 29, 2024An information disclosure issue was addressed with improved private data redaction for log entries.CVE-2024-27863 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
An information disclosure issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, tvOS 17.6, visionOS 1.3, watchOS 10.6. A local attacker may be able to determine kernel memory layout.
- Product
- iOS and iPadOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Jul 29, 2024A privacy issue was addressed with improved private data redaction for log entries.CVE-2024-27809 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sonoma 14.4. An app may be able to access user-sensitive data.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Jul 29, 2024A privacy issue was addressed with improved private data redaction for log entries.CVE-2023-42943 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sonoma 14. An app may be able to read sensitive location information.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Jul 22, 2024An incorrect permission in the installation directory for the shared NI SystemLink Server KeyValueDatabase service may result in information disclosure via locaCVE-2024-6122 · Other software · NI · reported by security@ni.comMedium 5.5
An incorrect permission in the installation directory for the shared NI SystemLink Server KeyValueDatabase service may result in information disclosure via local access. This affects NI SystemLink Server 2024 Q1 and prior versions. It also affects NI FlexLogger 2023 Q2 and prior versions which installed this shared service.
- Product
- SystemLink Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2024In the Linux kernel, the following vulnerability has been resolved: drm/komeda: check for error-valued pointer komeda_pipeline_get_state() may return an errorCVE-2024-39505 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: drm/komeda: check for error-valued pointer komeda_pipeline_get_state() may return an error-valued pointer, thus check the pointer for negative or null value before dereferencing.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jun 25, 2024Lack of privilege checking when processing a redaction in Conduit versions v0.6.0 and lower, allowing a local user to redact any message from users on the same CVE-2024-6302 · Other software · The Conduit Contributors · reported by cve@gitlab.comHigh 8.1
Lack of privilege checking when processing a redaction in Conduit versions v0.6.0 and lower, allowing a local user to redact any message from users on the same server, given that they are able to send redaction events.
- Product
- Conduit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2024Incomplete cleanup when performing redactions in Conduit, allowing an attacker to check whether certain strings were present in the PDU before redactionCVE-2024-6300 · Other software · The Conduit Contributors · reported by cve@gitlab.comLow 3.7
Incomplete cleanup when performing redactions in Conduit, allowing an attacker to check whether certain strings were present in the PDU before redaction
- Product
- Conduit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2024The EmbedAI application is susceptible to security issues that enable Data Poisoning attacks.CVE-2024-5185 · Other software · SamurAIGPT · reported by disclosure@synopsys.comHigh 8.3
The EmbedAI application is susceptible to security issues that enable Data Poisoning attacks. This weakness could result in the application becoming compromised, leading to unauthorized entries or data poisoning attacks, which are delivered by a CSRF vulnerability due to the absence of a secure session management implementation and weak CORS policies weakness. An attacker can direct a user to a malicious webpage that exploits a CSRF vulnerability within the EmbedAI application. By leveraging this CSRF vulnerability, the attacker can deceive the user into inadvertently uploading and integrating incorrect data into the application’s language model.
- Product
- EmbedAI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsynopsys.comsynopsys.com
May 16, 2024Penci Soledad Data Migrator: Local File InclusionCVE-2024-3551 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Penci Soledad Data Migrator plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.0 via the 'data' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. This is limited to just PHP files.
- Product
- Penci Soledad Data Migrator
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update Penci Soledad Data Migrator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
May 14, 2024This issue was addressed with improved redaction of sensitive information.CVE-2024-23229 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Monterey 12.7.5, macOS Sonoma 14.4, macOS Ventura 13.6.5. A malicious application may be able to access Find My data.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
May 2, 2024PDF-XChange Editor createDataObject Directory Traversal Remote Code Execution Vulnerability.CVE-2023-39506 · Other software · PDF-XChange · reported by zdi-disclosures@trendmicro.comHigh 7.8
PDF-XChange Editor createDataObject Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the createDataObject method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-20594.
- Product
- PDF-XChange Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzerodayinitiative.comzerodayinitiative.com
Apr 9, 2024Soledad: Cross-Site Request Forgery (CSRF)CVE-2024-31369 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in PenciDesign Soledad.This issue affects Soledad: from n/a through 8.4.2.
- Product
- Soledad
- Affected
- up to 8.4.2
- What to do
- Affects up to 8.4.2. Update Soledad to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 9, 2024Soledad: Missing AuthorizationCVE-2024-31368 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in PenciDesign Soledad.This issue affects Soledad: from n/a through 8.4.2.
- Product
- Soledad
- Affected
- up to 8.4.2
- What to do
- Affects up to 8.4.2. Update Soledad to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 9, 2024Soledad: Missing AuthorizationCVE-2024-31367 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in PenciDesign Soledad.This issue affects Soledad: from n/a through 8.4.2.
- Product
- Soledad
- Affected
- up to 8.4.2
- What to do
- Affects up to 8.4.2. Update Soledad to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 28, 2024This issue was addressed with improved redaction of sensitive information.CVE-2023-42936 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Monterey 12.7.2, macOS Ventura 13.6.3, iOS 17.2 and iPadOS 17.2, tvOS 17.2, watchOS 10.2, macOS Sonoma 14.2. An app may be able to access user-sensitive data.
- Product
- iOS and iPadOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Mar 19, 2024`AppendEncodedAttributeValue(), ExtraSpaceNeededForAttrEncoding()` and `AppendEncodedCharacters()` could have experienced integer overflows, causing underallocaCVE-2024-2608 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.4
`AppendEncodedAttributeValue(), ExtraSpaceNeededForAttrEncoding()` and `AppendEncodedCharacters()` could have experienced integer overflows, causing underallocation of an output buffer leading to an out of bounds write. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird < 115.9.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orglists.debian.org
Mar 7, 2024A privacy issue was addressed with improved private data redaction for log entries.CVE-2024-23291 · Computers, phones & browsers · Apple · reported by product-security@apple.comLow 3.3
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, tvOS 17.4, watchOS 10.4. A malicious app may be able to observe user data in log entries related to accessibility notifications.
- Product
- iOS and iPadOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Mar 7, 2024A privacy issue was addressed with improved private data redaction for log entries.CVE-2024-23283 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, macOS Monterey 12.7.4, macOS Sonoma 14.4, macOS Ventura 13.6.5. An app may be able to access user-sensitive data.
- Product
- iOS and iPadOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Mar 7, 2024A privacy issue was addressed with improved private data redaction for log entries.CVE-2024-23279 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sonoma 14.4. An app may be able to access user-sensitive data.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comseclists.org
Mar 7, 2024A privacy issue was addressed with improved private data redaction for log entries.CVE-2024-23231 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, macOS Ventura 13.6.5, watchOS 10.4. An app may be able to access user-sensitive data.
- Product
- iOS and iPadOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Mar 7, 2024This issue was addressed with improved redaction of sensitive information.CVE-2024-23227 · Computers, phones & browsers · Apple · reported by product-security@apple.comLow 3.3
This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Monterey 12.7.4, macOS Sonoma 14.4, macOS Ventura 13.6.5. An app may be able to read sensitive location information.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Mar 7, 2024A privacy issue was addressed with improved private data redaction for log entries.CVE-2024-23205 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4. An app may be able to access sensitive user data.
- Product
- iOS and iPadOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Mar 7, 2024This issue was addressed with improved redaction of sensitive information.CVE-2023-28826 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, macOS Monterey 12.7.4, macOS Sonoma 14.1, macOS Ventura 13.6.5. An app may be able to access sensitive user data.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Mar 5, 2024A privacy issue was addressed with improved private data redaction for log entries.CVE-2024-23243 · Computers, phones & browsers · Apple · reported by product-security@apple.comLow 3.3
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 17.4 and iPadOS 17.4. An app may be able to read sensitive location information.
- Product
- iOS and iPadOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comseclists.org
Feb 23, 2024In the Linux kernel, the following vulnerability has been resolved: EDAC/thunderx: Fix possible out-of-bounds string access Enabling -Wstringop-overflow globaCVE-2023-52464 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: EDAC/thunderx: Fix possible out-of-bounds string access Enabling -Wstringop-overflow globally exposes a warning for a common bug in the usage of strncat(): drivers/edac/thunderx_edac.c: In function 'thunderx_ocx_com_threaded_isr': drivers/edac/thunderx_edac.c:1136:17: error: 'strncat' specified bound 1024 equals destination size [-Werror=stringop-overflow=] 1136 | strncat(msg, other, OCX_MESSAGE_SIZE); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ... 1145 | strncat(msg, other, OCX_MESSAGE_SIZE); ... 1150 | strncat(msg, other, OCX_MESSAGE_SIZE); ... Apparently the author of this driver expected strncat() to behave the way that strlcat() does, which uses the size of the destination buffer as its third argument rather than the length of the source buffer. The result is that there is no check on the size of the allocated buffer. Change it to strlcat(). [ bp: Trim compiler output, fixup commit message. ]
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Feb 22, 2024A reflected Cross-Site Scripting (XSS) vulnerability in FUEL CMS 1.5.2allows attackers to run arbitrary code via crafted string after the group_id parameter.CVE-2024-25369 · Other software · Thedaylightstudio · reported by MITREMedium 5.4
A reflected Cross-Site Scripting (XSS) vulnerability in FUEL CMS 1.5.2allows attackers to run arbitrary code via crafted string after the group_id parameter.
- Product
- Fuel CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2024This issue was addressed with improved redaction of sensitive information.CVE-2023-42946 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
This issue was addressed with improved redaction of sensitive information. This issue is fixed in tvOS 17.1, watchOS 10.1, macOS Sonoma 14.1, iOS 17.1 and iPadOS 17.1. An app may be able to leak sensitive user information.
- Product
- tvOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Feb 21, 2024A privacy issue was addressed with improved private data redaction for log entries.CVE-2023-42878 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in watchOS 10.1, macOS Sonoma 14.1, iOS 17.1 and iPadOS 17.1. An app may be able to access sensitive user data.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Feb 17, 2024An issue was discovered in REDAXO version 5.15.1, allows attackers to execute arbitrary code and obtain sensitive information via modules.modules.php.CVE-2024-25298 · Other software · redaxo · reported by MITREHigh 7.2
An issue was discovered in REDAXO version 5.15.1, allows attackers to execute arbitrary code and obtain sensitive information via modules.modules.php.
- Product
- redaxo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2024Redaxo v5.15.1 was discovered to contain a remote code execution (RCE) vulnerability via the component /pages/templates.php.CVE-2024-25301 · Other software · Redaxo · reported by MITREHigh 7.2
Redaxo v5.15.1 was discovered to contain a remote code execution (RCE) vulnerability via the component /pages/templates.php.
- Product
- Redaxo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2024A cross-site scripting (XSS) vulnerability in Redaxo v5.15.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the NCVE-2024-25300 · Other software · Redaxo · reported by MITREMedium 4.8
A cross-site scripting (XSS) vulnerability in Redaxo v5.15.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter in the Template section.
- Product
- Redaxo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2024Ellucian Banner 9.17 allows Insecure Direct Object Reference (IDOR) via a modified bannerId to the /StudentSelfService/ssb/studentCard/retrieveData endpoint.CVE-2023-49339 · Other software · Ellucian · reported by MITREMedium 6.5
Ellucian Banner 9.17 allows Insecure Direct Object Reference (IDOR) via a modified bannerId to the /StudentSelfService/ssb/studentCard/retrieveData endpoint.
- Product
- Banner
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comellucian.com
Jan 22, 2024This issue was addressed with improved redaction of sensitive information.CVE-2024-23210 · Computers, phones & browsers · Apple · reported by product-security@apple.comLow 3.3
This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, tvOS 17.3, watchOS 10.3. An app may be able to view a user's phone number in system logs.
- Product
- iOS and iPadOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Jan 22, 2024This issue was addressed with improved redaction of sensitive information.CVE-2024-23207 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 17.3 and iPadOS 17.3, macOS Monterey 12.7.3, macOS Sonoma 14.3, macOS Ventura 13.6.4, watchOS 10.3. An app may be able to access sensitive user data.
- Product
- iOS and iPadOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Jan 22, 2024A privacy issue was addressed with improved private data redaction for log entries.CVE-2023-42937 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 16.7.5 and iPadOS 16.7.5, watchOS 10.2, macOS Ventura 13.6.4, macOS Sonoma 14.2, macOS Monterey 12.7.3, iOS 17.2 and iPadOS 17.2. An app may be able to access sensitive user data.
- Product
- iOS and iPadOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Jan 19, 2024swftools 0.9.2 was discovered to contain a heap-use-after-free via the function bufferWriteData in swftools/lib/action/compile.c.CVE-2024-22920 · Other software · Swftools · reported by MITREHigh 7.8
swftools 0.9.2 was discovered to contain a heap-use-after-free via the function bufferWriteData in swftools/lib/action/compile.c.
- Product
- Swftools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2024A privacy issue was addressed with improved private data redaction for log entries.CVE-2023-42830 · Computers, phones & browsers · Apple · reported by product-security@apple.comLow 3.3
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4. An app may be able to read sensitive location information.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.