Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,481 results · page 9 of 30
Sep 11, 2024When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it miCVE-2024-8096 · Other software · curl · reported by 2499f714-1537-4658-8207-48ae4bb9eae9Medium 6.5
When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it might fail to detect some OCSP problems and instead wrongly consider the response as fine. If the returned status reports another error than 'revoked' (like for example 'unauthorized') it is not treated as a bad certficate.
- Product
- curl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2024A code injection vulnerability that permits a low-privileged user to upload arbitrary files to the server, leading to remote code execution on VSPC server.CVE-2024-39714 · Other software · Veeam · reported by support@hackerone.comCritical 9.9
A code injection vulnerability that permits a low-privileged user to upload arbitrary files to the server, leading to remote code execution on VSPC server.
- Product
- Veeam Service Provider Console
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2024Ringer server is the server code for the Ringer messaging app.CVE-2024-45050 · Other software · Lif-Platforms · reported by GitHubHigh 7.1
Ringer server is the server code for the Ringer messaging app. Prior to version 1.3.1, there is an issue with the messages loading route where Ringer Server does not check to ensure that the user loading the conversation is actually a member of that conversation. This allows any user with a Lif Account to load any conversation between two users without permission. This issue had been patched in version 1.3.1. There is no action required for users. Lif Platforms will update their servers with the patch.
- Product
- New-Ringer-Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2024A Cross-Site Scripting vulnerable identified in NetIQ Advance Authentication that impacts the server functionality and disclose sensitive information.CVE-2021-38122 · Other software · OpenText · reported by security@opentext.comMedium 6.2
A Cross-Site Scripting vulnerable identified in NetIQ Advance Authentication that impacts the server functionality and disclose sensitive information. This issue affects NetIQ Advance Authentication before 6.3.5.1
- Product
- NetIQ Advance Authentication
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2024Tenda AX1806 v1.0.0.1 contains a stack overflow via the serverName parameter in the function form_fast_setting_internet_set.CVE-2024-44565 · Network & remote access · tenda · reported by MITRECritical 9.8
Tenda AX1806 v1.0.0.1 contains a stack overflow via the serverName parameter in the function form_fast_setting_internet_set.
- Product
- ax1806_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddetailed-stetson-767.notion.site
Aug 15, 2024An issue in Super easy enterprise management system v.1.0.0 and before allows a local attacker to obtain the server absolute path by entering a single quotationCVE-2024-42680 · Other software · Cysoft168 · reported by MITREMedium 5.5
An issue in Super easy enterprise management system v.1.0.0 and before allows a local attacker to obtain the server absolute path by entering a single quotation mark.
- Product
- Super Easy Enterprise Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2024XXE in SmartDeviceServer in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to read arbitrary files on the server.CVE-2024-38653 · Network & remote access · Ivanti · reported by support@hackerone.comHigh 7.5
XXE in SmartDeviceServer in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to read arbitrary files on the server.
- Product
- Avalanche
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2024A vulnerability in the JSON file handling of gaizhenbiao/chuanhuchatgpt version 20240410 allows any user to delete any JSON file on the server, including criticCVE-2024-6255 · Other software · gaizhenbiao · reported by security@huntr.devHigh 8.2
A vulnerability in the JSON file handling of gaizhenbiao/chuanhuchatgpt version 20240410 allows any user to delete any JSON file on the server, including critical configuration files such as `config.json` and `ds_config_chatbot.json`. This issue arises due to improper validation of file paths, enabling directory traversal attacks. An attacker can exploit this vulnerability to disrupt the functioning of the system, manipulate settings, or potentially cause data loss or corruption.
- Product
- gaizhenbiao/chuanhuchatgpt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2024Nimble Commander suffers from a privilege escalation vulnerability due to the server (info.filesmanager.Files.PrivilegedIOHelperV2) performing improper/insufficCVE-2024-7062 · Other software · Nimble Commander · reported by 41c37e40-543d-43a2-b660-2fee83ea851aHigh 8.8
Nimble Commander suffers from a privilege escalation vulnerability due to the server (info.filesmanager.Files.PrivilegedIOHelperV2) performing improper/insufficient validation of a client’s authorization before executing an operation. Consequently, it is possible to execute system-level commands as the root user, such as changing permissions and ownership, obtaining a handle (file descriptor) of an arbitrary file, and terminating processes, among other operations.
- Product
- Nimble Commander
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpentraze.compentraze.com
Jul 23, 2024A malicious client can send many DNS messages over TCP, potentially causing the server to become unstable while the attack is in progress.CVE-2024-0760 · Other software · ISC · reported by security-officer@isc.orgHigh 7.5
A malicious client can send many DNS messages over TCP, potentially causing the server to become unstable while the attack is in progress. The server may recover after the attack ceases. Use of ACLs will not mitigate the attack. This issue affects BIND 9 versions 9.18.1 through 9.18.27, 9.19.0 through 9.19.24, and 9.18.11-S1 through 9.18.27-S1.
- Product
- BIND 9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Jul 18, 2024HCL BigFix Compliance server can respond with an HTTP status of 500, indicating a server-side error that may cause the server process to die.CVE-2024-30125 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.2
HCL BigFix Compliance server can respond with an HTTP status of 500, indicating a server-side error that may cause the server process to die.
- Product
- BigFix Compliance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Jul 18, 2024On versions before 2.1.4, a user could log in and perform a template injection attack resulting in Remote Code Execution on the server, The attacker must succesCVE-2024-29178 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.8
On versions before 2.1.4, a user could log in and perform a template injection attack resulting in Remote Code Execution on the server, The attacker must successfully log into the system to launch an attack, so this is a moderate-impact vulnerability. Mitigation: all users should upgrade to 2.1.4
- Product
- Apache StreamPark
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comlists.apache.org
Jul 16, 2024There is an SSRF vulnerability in the Fluid Topics platform that affects versions prior to 4.3, where the server can be forced to make arbitrary requests to intCVE-2023-31456 · Other software · reported by MITREMedium 5.4
There is an SSRF vulnerability in the Fluid Topics platform that affects versions prior to 4.3, where the server can be forced to make arbitrary requests to internal and external resources by an authenticated user.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordantidot.netdoc.fluidtopics.com
Jul 10, 2024A vulnerability in gaizhenbiao/chuanhuchatgpt version 20240410 allows an attacker to create arbitrary folders at any location on the server, including the root CVE-2024-6037 · Other software · gaizhenbiao · reported by security@huntr.devCritical 9.1
A vulnerability in gaizhenbiao/chuanhuchatgpt version 20240410 allows an attacker to create arbitrary folders at any location on the server, including the root directory (C: dir). This can lead to uncontrolled resource consumption, resulting in resource exhaustion, denial of service (DoS), server unavailability, and potential data loss or corruption.
- Product
- gaizhenbiao/chuanhuchatgpt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2024A vulnerability in gaizhenbiao/chuanhuchatgpt version 20240410 allows any user to restart the server at will by sending a specific request to the `/queue/join?`CVE-2024-6036 · Other software · gaizhenbiao · reported by security@huntr.devCritical 9.1
A vulnerability in gaizhenbiao/chuanhuchatgpt version 20240410 allows any user to restart the server at will by sending a specific request to the `/queue/join?` endpoint with `"fn_index":66`. This unrestricted server restart capability can severely disrupt service availability, cause data loss or corruption, and potentially compromise system integrity.
- Product
- gaizhenbiao/chuanhuchatgpt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2024PrivateBin is an online pastebin where the server has zero knowledge of pasted data.CVE-2024-39899 · Other software · PrivateBin · reported by GitHubMedium 5.3
PrivateBin is an online pastebin where the server has zero knowledge of pasted data. In v1.5, PrivateBin introduced the YOURLS server-side proxy. The idea was to allow using the YOURLs URL shortener without running the YOURLs instance without authentication and/or exposing the authentication token to the public, allowing anyone to shorten any URL. With the proxy mechanism, anyone can shorten any URL pointing to the configured PrivateBin instance. The vulnerability allowed other URLs to be shortened, as long as they contain the PrivateBin instance, defeating the limit imposed by the proxy. This vulnerability is fixed in 1.7.4.
- Product
- PrivateBin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 3, 2024The vulnerability allows an attacker to access sensitive files on the server by confusing the agent with incorrect file names.CVE-2024-5821 · Other software · stitionai · reported by security@huntr.devMedium 6.2
The vulnerability allows an attacker to access sensitive files on the server by confusing the agent with incorrect file names. When a user requests the content of a file with a misspelled name, the agent attempts to correct the command and inadvertently reveals the content of the intended file, such as /etc/passwd. This can lead to unauthorized access to sensitive information and potential server compromise.
- Product
- stitionai/devika
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2024The server supports at least one cipher suite which is on the NCSC-NL list of cipher suites to be phased out, increasing the risk of cryptographic weaknesses.CVE-2023-41927 · Other software · Kiloview · reported by cert@ncsc.nlMedium 5.3
The server supports at least one cipher suite which is on the NCSC-NL list of cipher suites to be phased out, increasing the risk of cryptographic weaknesses.
- Product
- P1/P2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.ncsc.nladvisories.ncsc.nl
Jul 1, 2024null pointer dereference in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows an attacker to crash the server via a malicious request.CVE-2024-38477 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
null pointer dereference in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows an attacker to crash the server via a malicious request. Users are recommended to upgrade to version 2.4.60, which fixes this issue.
- Product
- Apache HTTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhttpd.apache.orgsecurity.netapp.com
Jul 1, 2024Serving WebSocket protocol upgrades over a HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server process, degrading perCVE-2024-36387 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.4
Serving WebSocket protocol upgrades over a HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server process, degrading performance.
- Product
- Apache HTTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhttpd.apache.orgsecurity.netapp.com
Jun 27, 2024A Cross-Site Request Forgery (CSRF) vulnerability in version 0.5.0 of imartinez/privategpt allows an attacker to delete all uploaded files on the server.CVE-2024-5935 · Other software · imartinez · reported by security@huntr.devMedium 5.4
A Cross-Site Request Forgery (CSRF) vulnerability in version 0.5.0 of imartinez/privategpt allows an attacker to delete all uploaded files on the server. This can lead to data loss and service disruption for the application's users.
- Product
- imartinez/privategpt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2024TruDesk Help Desk/Ticketing Solution v1.1.11 is vulnerable to a Cross-Site Request Forgery (CSRF) attack which would allow an attacker to restart the server, caCVE-2021-45785 · Other software · trudesk_project · reported by MITREMedium 6.5
TruDesk Help Desk/Ticketing Solution v1.1.11 is vulnerable to a Cross-Site Request Forgery (CSRF) attack which would allow an attacker to restart the server, causing a DoS attack. The attacker must craft a webpage that would perform a GET request to the /api/v1/admin/restart endpoint, then the victim (who has sufficient privileges), would visit the page and the server restart would begin. The attacker must know the full URL that TruDesk is on in order to craft the webpage.
- Product
- trudesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record1d8.github.io1d8.github.io
Jun 24, 2024A session fixation vulnerability in Bludit allows an attacker to bypass the server's authentication if they can trick an administrator or any other user into auCVE-2024-24552 · Other software · Bludit · reported by vulnerability@ncsc.chMedium 5.7
A session fixation vulnerability in Bludit allows an attacker to bypass the server's authentication if they can trick an administrator or any other user into authorizing a session ID of their choosing.
- Product
- Bludit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordredguard.chredguard.ch
Jun 12, 2024IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to a denial of service as the server may crash when using aCVE-2024-31881 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to a denial of service as the server may crash when using a specially crafted query on certain columnar tables by an authenticated user. IBM X-Force ID: 287613.
- Product
- Db2 for Linux, UNIX and Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jun 12, 2024Arbitrary File Upload vulnerability in MegaBIP software allows attacker to upload any file to the server (including a PHP code file) without an authentication.CVE-2024-1659 · Other software · Jan Syski · reported by cvd@cert.plCritical 9.3
Arbitrary File Upload vulnerability in MegaBIP software allows attacker to upload any file to the server (including a PHP code file) without an authentication. This issue affects MegaBIP software versions through 5.10.
- Product
- MegaBIP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2024Remote Code Execution vulnerability in MegaBIP software allows to execute arbitrary code on the server without requiring authentication by saving crafted by theCVE-2024-1577 · Other software · Jan Syski · reported by cvd@cert.plCritical 9.3
Remote Code Execution vulnerability in MegaBIP software allows to execute arbitrary code on the server without requiring authentication by saving crafted by the attacker PHP code to one of the website files. This issue affects MegaBIP software versions through 5.11.2.
- Product
- MegaBIP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2024Allow attackers to intercept or falsify data exchanges between the client and the serverCVE-2024-2462 · Other software · Hitachi Energy · reported by cybersecurity@hitachienergy.comMedium 6.8
Allow attackers to intercept or falsify data exchanges between the client and the server
- Product
- FOXMAN-UN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpublisher.hitachienergy.compublisher.hitachienergy.com
Jun 10, 2024A Directory Traversal vulnerability in iceice666 ResourcePack Server before v1.0.8 allows a remote attacker to disclose files on the server, via setPath in ResoCVE-2024-35474 · Other software · reported by MITREMedium 6.5
A Directory Traversal vulnerability in iceice666 ResourcePack Server before v1.0.8 allows a remote attacker to disclose files on the server, via setPath in ResourcePackFileServer.kt.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jun 10, 2024Argument Injection Leading to Remote Code Execution in Realtime Graph Extension, allowing unauthenticated attackers to execute arbitrary code on the server.CVE-2024-35307 · Other software · Pandora FMS · reported by security@pandorafms.comCritical 9.4
Argument Injection Leading to Remote Code Execution in Realtime Graph Extension, allowing unauthenticated attackers to execute arbitrary code on the server. This issue affects Pandora FMS: from 700 through <777.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpandorafms.compandorafms.com
May 23, 2024Arbitrary File Read in OpenText Dimensions RM allows authenticated users to read files stored on the server via webservicesCVE-2024-5202 · Other software · OpenText · reported by security@opentext.comHigh 7.7
Arbitrary File Read in OpenText Dimensions RM allows authenticated users to read files stored on the server via webservices
- Product
- Dimensions RM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.microfocus.comportal.microfocus.com
May 23, 2024This does not validate a path generated with user input when downloading files, allowing unauthenticated user to download arbitrary files from the serverCVE-2024-4388 · WordPress plugins & themes · reported by WPScanHigh 7.5
This does not validate a path generated with user input when downloading files, allowing unauthenticated user to download arbitrary files from the server
- What to do
- Update the plugin to the newest version.
May 14, 2024An unauthenticated user can trigger a fatal assertion in the server while generating ftdc diagnostic metrics due to attempting to build a BSON object that exceeCVE-2024-3374 · Other software · MongoDB Inc · reported by cna@mongodb.comMedium 5.3
An unauthenticated user can trigger a fatal assertion in the server while generating ftdc diagnostic metrics due to attempting to build a BSON object that exceeds certain memory sizes. This issue affects MongoDB Server v5.0 versions prior to and including 5.0.16 and MongoDB Server v6.0 versions prior to and including 6.0.5.
- Product
- MongoDB Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjira.mongodb.orgjira.mongodb.org
May 14, 2024Improper validation of certain metadata input may result in the server not correctly serialising BSON.CVE-2024-3372 · Other software · MongoDB Inc · reported by cna@mongodb.comHigh 7.5
Improper validation of certain metadata input may result in the server not correctly serialising BSON. This can be performed pre-authentication and may cause unexpected application behavior including unavailability of serverStatus responses. This issue affects MongoDB Server v7.0 versions prior to 7.0.6, MongoDB Server v6.0 versions prior to 6.0.14 and MongoDB Server v.5.0 versions prior to 5.0.25.
- Product
- MongoDB Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjira.mongodb.orgjira.mongodb.org
May 14, 2024 An unauthenticated attacker can upload a malicious file to the server which when accessed by a victim can allow an attacker to completely compromise system.CVE-2024-33006 · Network & remote access · SAP_SE · reported by cna@sap.comCritical 9.6
An unauthenticated attacker can upload a malicious file to the server which when accessed by a victim can allow an attacker to completely compromise system.
- Product
- SAP NetWeaver Application Server ABAP and ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordme.sap.comsupport.sap.com
May 3, 2024Pterodactyl wings is the server control plane for Pterodactyl Panel.CVE-2024-34068 · Other software · pterodactyl · reported by GitHubMedium 6.4
Pterodactyl wings is the server control plane for Pterodactyl Panel. An authenticated user who has access to a game server is able to bypass the previously implemented access control (GHSA-6rg3-8h8x-5xfv) that prevents accessing internal endpoints of the node hosting Wings in the pull endpoint. This would allow malicious users to potentially access resources on local networks that would otherwise be inaccessible. This issue has been addressed in version 1.11.2 and users are advised to upgrade. Users unable to upgrade may enable the `api.disable_remote_download` option as a workaround.
- Product
- wings
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 3, 2024Pterodactyl wings is the server control plane for Pterodactyl Panel.CVE-2024-34066 · Other software · pterodactyl · reported by GitHubHigh 8.4
Pterodactyl wings is the server control plane for Pterodactyl Panel. If the Wings token is leaked either by viewing the node configuration or posting it accidentally somewhere, an attacker can use it to gain arbitrary file write and read access on the node the token is associated to. This issue has been addressed in version 1.11.12 and users are advised to upgrade. Users unable to upgrade may enable the `ignore_panel_config_updates` option as a workaround.
- Product
- wings
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2024ReCrystallize Server 5.10.0.0 allows administrators to upload files to the server.CVE-2024-28269 · Other software · recrystallize_software · reported by MITREHigh 7.2
ReCrystallize Server 5.10.0.0 allows administrators to upload files to the server. The file upload is not restricted, leading to the ability to upload of malicious files. This could result in a Remote Code Execution.
- Product
- recrystallive_server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsensepost.comrecrystallize.com
Apr 23, 2024The network server of fceux 2.7.0 has a path traversal vulnerability, allowing attackers to overwrite any files on the server without authentication by fake ROMCVE-2024-32258 · Other software · tasemulators · reported by MITREHigh 8.8
The network server of fceux 2.7.0 has a path traversal vulnerability, allowing attackers to overwrite any files on the server without authentication by fake ROM.
- Product
- fceux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 19, 2024CuteHttpFileServer v.3.1 version has an arbitrary file download vulnerability, which allows attackers to download arbitrary files on the server and obtain sensiCVE-2024-31552 · Other software · CuteHttpFileServer · reported by MITREHigh 7.1
CuteHttpFileServer v.3.1 version has an arbitrary file download vulnerability, which allows attackers to download arbitrary files on the server and obtain sensitive information.
- Product
- CuteHttpFileServer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2024mintplex-labs/anything-llm is vulnerable to improper input validation, allowing attackers to read and delete arbitrary files on the server.CVE-2024-3028 · Other software · mintplex-labs · reported by security@huntr.devHigh 7.2
mintplex-labs/anything-llm is vulnerable to improper input validation, allowing attackers to read and delete arbitrary files on the server. By manipulating the 'logo_filename' parameter in the 'system-preferences' API endpoint, an attacker can construct requests to read sensitive files or the application's '.env' file, and even delete files by setting the 'logo_filename' to the path of the target file and invoking the 'remove-logo' API endpoint. This vulnerability is due to the lack of proper sanitization of user-supplied input.
- Product
- mintplex-labs/anything-llm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2024A path traversal vulnerability exists in mlflow/mlflow version 2.9.2, allowing attackers to access arbitrary files on the server.CVE-2024-1483 · Other software · mlflow · reported by security@huntr.devHigh 7.5
A path traversal vulnerability exists in mlflow/mlflow version 2.9.2, allowing attackers to access arbitrary files on the server. By crafting a series of HTTP POST requests with specially crafted 'artifact_location' and 'source' parameters, using a local URI with '#' instead of '?', an attacker can traverse the server's directory structure. The issue occurs due to insufficient validation of user-supplied input in the server's handlers.
- Product
- mlflow/mlflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2024Default credentials on the Web Interface of Evolution Controller 2.x allows anyone to log in to the server directly to perform administrative functions.CVE-2024-29844 · Other software · CS Technologies Australia · reported by 430a6cef-dc26-47e3-9fa8-52fb7f19644eCritical 9.8
Default credentials on the Web Interface of Evolution Controller 2.x allows anyone to log in to the server directly to perform administrative functions. Upon installation or upon first login, the application does not ask the user to change the password. There is no warning or prompt to ask the user to change the default password.
- Product
- Evolution Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddirectcyber.com.audirectcyber.com.au
Apr 12, 2024The server in Circontrol Raption through 5.11.2 has a pre-authentication stack-based buffer overflow that can be exploited to gain run-time control of the devicCVE-2020-8006 · Other software · circontrol · reported by MITREHigh 8.8
The server in Circontrol Raption through 5.11.2 has a pre-authentication stack-based buffer overflow that can be exploited to gain run-time control of the device as root. The ocpp1.5 and pwrstudio binaries on the charging station do not use a number of common exploitation mitigations. In particular, there are no stack canaries and they do not use the Position Independent Executable (PIE) format.
- Product
- raption_server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcircontrol.comseclists.org
Apr 10, 2024HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the server.CVE-2024-31309 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the server. Version from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.3 are affected. Users can set a new setting (proxy.config.http2.max_continuation_frames_per_minute) to limit the number of CONTINUATION frames per minute. ATS does have a fixed amount of memory a request can use and ATS adheres to these limits in previous releases. Users are recommended to upgrade to versions 8.1.10 or 9.2.4 which fixes the issue.
- Product
- Apache Traffic Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Apr 8, 2024The application allows a high privilege attacker to append a malicious GET query parameter to Service invocations, which are reflected in the server response.CVE-2024-30214 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.8
The application allows a high privilege attacker to append a malicious GET query parameter to Service invocations, which are reflected in the server response. Under certain circumstances, if the parameter contains a JavaScript, the script could be processed on client side.
- Product
- SAP Business Connector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordme.sap.comsupport.sap.com
Apr 3, 2024SiYuan version 3.0.3 allows executing arbitrary commands on the server.CVE-2024-2692 · Other software · SiYuan · reported by help@fluidattacks.comCritical 9
SiYuan version 3.0.3 allows executing arbitrary commands on the server. This is possible because the application is vulnerable to Server Side XSS.
- Product
- SiYuan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comgithub.com
Apr 2, 2024Tenda AX1803 v1.0.0.1 contains a stack overflow via the serverName parameter in the function fromAdvSetMacMtuWan.CVE-2024-30621 · Network & remote access · tenda · reported by MITRECritical 9.8
Tenda AX1803 v1.0.0.1 contains a stack overflow via the serverName parameter in the function fromAdvSetMacMtuWan.
- Product
- ax1803_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2024An file upload vulnerability in Ivanti ITSM before 2023.4, allows an authenticated remote user to perform file writes to the server.CVE-2023-46808 · Network & remote access · Ivanti · reported by support@hackerone.comCritical 9.9
An file upload vulnerability in Ivanti ITSM before 2023.4, allows an authenticated remote user to perform file writes to the server. Successful exploitation may lead to execution of commands in the context of non-root user.
- Product
- ITSM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforums.ivanti.comforums.ivanti.com
Mar 28, 2024In JetBrains TeamCity before 2024.03 server administrators could remove arbitrary files from the server by installing toolsCVE-2024-31140 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.1
In JetBrains TeamCity before 2024.03 server administrators could remove arbitrary files from the server by installing tools
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
Mar 27, 2024libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS.CVE-2024-2466 · Other software · curl · reported by 2499f714-1537-4658-8207-48ae4bb9eae9Medium 6.5
libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS. libcurl would wrongly avoid using the set hostname function when the specified hostname was given as an IP address, therefore completely skipping the certificate check. This affects all uses of TLS protocols (HTTPS, FTPS, IMAPS, POPS3, SMTPS, etc).
- Product
- curl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.