Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,569 results · page 9 of 32
Sep 10, 2024A low privileged remote attacker can perform configuration changes of the ospf service through OSPF_INTERFACE.SIMPLE_KEY, OSPF_INTERFACE.DIGEST_KEY environment CVE-2024-43389 · Other software · PHOENIX CONTACT · reported by info@cert.vde.comHigh 8.1
A low privileged remote attacker can perform configuration changes of the ospf service through OSPF_INTERFACE.SIMPLE_KEY, OSPF_INTERFACE.DIGEST_KEY environment variables which can lead to a DoS.
- Product
- FL MGUARD 2102
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2024A potentially exploitable type confusion could be triggered when looking up a property name on an object being used as the `with` environment.CVE-2024-8381 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.8
A potentially exploitable type confusion could be triggered when looking up a property name on an object being used as the `with` environment. This vulnerability affects Firefox < 130, Firefox ESR < 128.2, Firefox ESR < 115.15, Thunderbird < 128.2, and Thunderbird < 115.15.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Sep 3, 2024VMware Fusion (13.x before 13.6) contains a code-execution vulnerability due to the usage of an insecure environment variable.CVE-2024-38811 · Other software · vmware · reported by security@vmware.comHigh 8.8
VMware Fusion (13.x before 13.6) contains a code-execution vulnerability due to the usage of an insecure environment variable. A malicious actor with standard user privileges may exploit this vulnerability to execute code in the context of the Fusion application.
- Product
- fusion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2024jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture.CVE-2024-43805 · Other software · jupyterlab · reported by GitHubHigh 7.6
jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. This vulnerability depends on user interaction by opening a malicious notebook with Markdown cells, or Markdown file using JupyterLab preview feature. A malicious user can access any data that the attacked user has access to as well as perform arbitrary requests acting as the attacked user. JupyterLab v3.6.8, v4.2.5 and Jupyter Notebook v7.2.2 have been patched to resolve this issue. Users are advised to upgrade. There is no workaround for the underlying DOM Clobbering susceptibility. However, select plugins can be disabled on deployments which cannot update in a timely fashion to minimise the risk. These are: 1. `@jupyterlab/mathjax-extension:plugin` - users will loose ability to preview mathematical equations. 2. `@jupyterlab/markdownviewer-extension:plugin` - users will loose ability to open Markdown previews. 3. `@jupyterlab/mathjax2-extension:plugin` (if installed with optional `jupyterlab-mathjax2` package) - an older version of the mathjax plugin for JupyterLab 4.x. To disable these extensions run: ```jupyter labextension disable @jupyterlab/markdow
- Product
- jupyterlab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2024Lack of stack protection exploit mechanisms in ASP Secure OS Trusted Execution Environment (TEE) may allow a privileged attacker with access to AMD signing keysCVE-2021-46746 · Other software · AMD · reported by psirt@amd.comMedium 5.2
Lack of stack protection exploit mechanisms in ASP Secure OS Trusted Execution Environment (TEE) may allow a privileged attacker with access to AMD signing keys to c006Frrupt the return address, causing a stack-based buffer overrun, potentially leading to a denial of service.
- Product
- AMD EPYC™ 7001 Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2024An issue in the Hardware info module of IT Solutions Enjay CRM OS v1.0 allows attackers to escape the restricted terminal environment and gain root-level privilCVE-2024-41309 · Other software · enjay · reported by MITREHigh 7.8
An issue in the Hardware info module of IT Solutions Enjay CRM OS v1.0 allows attackers to escape the restricted terminal environment and gain root-level privileges on the underlying system.
- Product
- crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordthe-it-wonders.blogspot.com
Aug 7, 2024An issue in the Ping feature of IT Solutions Enjay CRM OS v1.0 allows attackers to escape the restricted terminal environment and gain root-level privileges on CVE-2024-41308 · Other software · enjay · reported by MITREHigh 7.8
An issue in the Ping feature of IT Solutions Enjay CRM OS v1.0 allows attackers to escape the restricted terminal environment and gain root-level privileges on the underlying system.
- Product
- crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordthe-it-wonders.blogspot.com
Aug 2, 2024WD Discovery versions prior to 5.0.589 contain a misconfiguration in the Node.js environment settings that could allow code execution by utilizing the 'ELECTRONCVE-2024-22169 · Network & remote access · Western Digital · reported by psirt@wdc.comHigh 7.1
WD Discovery versions prior to 5.0.589 contain a misconfiguration in the Node.js environment settings that could allow code execution by utilizing the 'ELECTRON_RUN_AS_NODE' environment variable. Any malicious application operating with standard user permissions can exploit this vulnerability, enabling code execution within WD Discovery application's context. WD Discovery version 5.0.589 addresses this issue by disabling certain features and fuses in Electron. The attack vector for this issue requires the victim to have the WD Discovery app installed on their device.
- Product
- WD Discovery
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2024IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 temporarily stores data from different environments that could be obtained by a malicious user.CVE-2024-39732 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.1
IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 temporarily stores data from different environments that could be obtained by a malicious user. IBM X-Force ID: 295791.
- Product
- Datacap Navigator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jul 4, 2024Robotmk before 2.0.1 allows a local user to escalate privileges (e.g., to SYSTEM) if automated Python environment setup is enabled, because the "shared holotreeCVE-2024-39934 · Other software · robotmk · reported by MITREHigh 7.8
Robotmk before 2.0.1 allows a local user to escalate privileges (e.g., to SYSTEM) if automated Python environment setup is enabled, because the "shared holotree usage" feature allows any user to edit any Python environment.
- Product
- robotmk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 3, 2024Fides is an open-source privacy engineering platform, and `SERVER_SIDE_FIDES_API_URL` is a server-side configuration environment variable used by the Fides PrivCVE-2024-31223 · Other software · ethyca · reported by GitHubMedium 5.3
Fides is an open-source privacy engineering platform, and `SERVER_SIDE_FIDES_API_URL` is a server-side configuration environment variable used by the Fides Privacy Center to communicate with the Fides webserver backend. The value of this variable is a URL which typically includes a private IP address, private domain name, and/or port. A vulnerability present starting in version 2.19.0 and prior to version 2.39.2rc0 allows an unauthenticated attacker to make a HTTP GET request from the Privacy Center that discloses the value of this server-side URL. This could result in disclosure of server-side configuration giving an attacker information on server-side ports, private IP addresses, and/or private domain names. The vulnerability has been patched in Fides version 2.39.2rc0. No known workarounds are available.
- Product
- fides
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2024Command go env is documented as outputting a shell script containing the Go environment.CVE-2023-24531 · Other software · Go toolchain · reported by security@golang.orgCritical 9.8
Command go env is documented as outputting a shell script containing the Go environment. However, go env doesn't sanitize values, so executing its output as a shell script can cause various bad bahaviors, including executing arbitrary commands or inserting new environment variables. This issue is relatively minor because, in general, if an attacker can set arbitrary environment variables on a system, they have better attack vectors than making "go env" print them out.
- Product
- cmd/go
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2024IBM Storage Protect for Virtual Environments: Data Protection for VMware 8.1.0.0 through 8.1.22.0 could allow a remote authenticated attacker to bypass securityCVE-2024-38329 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.7
IBM Storage Protect for Virtual Environments: Data Protection for VMware 8.1.0.0 through 8.1.22.0 could allow a remote authenticated attacker to bypass security restrictions, caused by improper validation of user permission. By sending a specially crafted request, an attacker could exploit this vulnerability to change its settings, trigger backups, restore backups, and also delete all previous backups via log rotation. IBM X-Force ID: 294994.
- Product
- Storage Protect for Virtual Environments: Data Protection for VMware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jun 12, 2024There is a vulnerability in AVEVA PI Web API that could allow malicious code to execute on the PI Web API environment under the privileges of an interactive useCVE-2024-3468 · Other software · AVEVA · reported by ics-cert@hq.dhs.govHigh 8.4
There is a vulnerability in AVEVA PI Web API that could allow malicious code to execute on the PI Web API environment under the privileges of an interactive user that was socially engineered to use API XML import functionality with content supplied by an attacker.
- Product
- PI Web API
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2024There is a vulnerability in AVEVA PI Asset Framework Client that could allow malicious code to execute on the PI System Explorer environment under the privilegeCVE-2024-3467 · Other software · AVEVA · reported by ics-cert@hq.dhs.govHigh 7
There is a vulnerability in AVEVA PI Asset Framework Client that could allow malicious code to execute on the PI System Explorer environment under the privileges of an interactive user that was socially engineered to import XML supplied by an attacker.
- Product
- PI Asset Framework Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2024This issue was addressed with improved environment sanitization.CVE-2024-27806 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
This issue was addressed with improved environment sanitization. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Monterey 12.7.5, macOS Sonoma 14.5, macOS Ventura 13.6.7, tvOS 17.5, watchOS 10.5. An app may be able to access sensitive user data.
- Product
- iOS and iPadOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Jun 10, 2024An issue was addressed with improved validation of environment variables.CVE-2024-27805 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
An issue was addressed with improved validation of environment variables. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Monterey 12.7.5, macOS Sonoma 14.5, macOS Ventura 13.6.7, tvOS 17.5, watchOS 10.5. An app may be able to access sensitive user data.
- Product
- iOS and iPadOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Jun 6, 2024A remote code execution vulnerability exists in mintplex-labs/anything-llm due to improper handling of environment variables.CVE-2024-3104 · Other software · mintplex-labs · reported by security@huntr.devCritical 9.8
A remote code execution vulnerability exists in mintplex-labs/anything-llm due to improper handling of environment variables. Attackers can exploit this vulnerability by injecting arbitrary environment variables via the `POST /api/system/update-env` endpoint, which allows for the execution of arbitrary code on the host running anything-llm. The vulnerability is present in the latest version of anything-llm, with the latest commit identified as fde905aac1812b84066ff72e5f2f90b56d4c3a59. This issue has been fixed in version 1.0.0. Successful exploitation could lead to code execution on the host, enabling attackers to read and modify data accessible to the user running the service, potentially leading to a denial of service.
- Product
- mintplex-labs/anything-llm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 31, 2024In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore database activityCVE-2024-34005 · Other software · moodle · reported by patrick@puiterwijk.orgMedium 6.5
In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore database activity modules and direct access to the web server outside of the Moodle webroot could execute a local file include.
- Product
- moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 31, 2024In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore wiki modules and CVE-2024-34004 · Other software · Moodle · reported by patrick@puiterwijk.orgMedium 6.5
In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore wiki modules and direct access to the web server outside of the Moodle webroot could execute a local file include.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 31, 2024In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore workshop modules CVE-2024-34003 · Other software · moodle · reported by patrick@puiterwijk.orgMedium 5.9
In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore workshop modules and direct access to the web server outside of the Moodle webroot could execute a local file include.
- Product
- moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 31, 2024In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore feedback modules CVE-2024-34002 · Other software · Moodle · reported by patrick@puiterwijk.orgMedium 6.5
In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore feedback modules and direct access to the web server outside of the Moodle webroot could execute a local file include.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 31, 2024Use of Default Cryptographic Key vulnerability in Baxter Welch Allyn Connex Spot Monitor may allow Configuration/Environment Manipulation.This issue affects WelCVE-2024-1275 · Other software · Baxter · reported by productsecurity@baxter.comCritical 9.1
Use of Default Cryptographic Key vulnerability in Baxter Welch Allyn Connex Spot Monitor may allow Configuration/Environment Manipulation.This issue affects Welch Allyn Connex Spot Monitor in all versions prior to 1.52.
- Product
- Welch Allyn Connex Spot Monitor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 21, 2024In the Linux kernel, the following vulnerability has been resolved: padata: Fix refcnt handling in padata_free_shell() In a high-load arm64 environment, the pCVE-2023-52854 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: padata: Fix refcnt handling in padata_free_shell() In a high-load arm64 environment, the pcrypt_aead01 test in LTP can lead to system UAF (Use-After-Free) issues. Due to the lengthy analysis of the pcrypt_aead01 function call, I'll describe the problem scenario using a simplified model: Suppose there's a user of padata named `user_function` that adheres to the padata requirement of calling `padata_free_shell` after `serial()` has been invoked, as demonstrated in the following code: ```c struct request { struct padata_priv padata; struct completion *done; }; void parallel(struct padata_priv *padata) { do_something(); } void serial(struct padata_priv *padata) { struct request *request = container_of(padata, struct request, padata); complete(request->done); } void user_function() { DECLARE_COMPLETION(done) padata->parallel = parallel; padata->serial = serial; padata_do_parallel(); wait_for_completion(&done); padata_free_shell(); } ``` In the corresponding padata.c file, there's the following code: ```c static void padata_serial_worker(struct work_struct
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
May 21, 2024In the Linux kernel, the following vulnerability has been resolved: drm/amd: check num of link levels when update pcie param In SR-IOV environment, the value CVE-2023-52812 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: drm/amd: check num of link levels when update pcie param In SR-IOV environment, the value of pcie_table->num_of_link_levels will be 0, and num_of_levels - 1 will cause array index out of bounds
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
May 14, 2024An flaw was found in the OpenStack Platform (RHOSP) director, a toolset for installing and managing a complete RHOSP environment.CVE-2024-4840 · Other software · Red Hat · reported by Red HatMedium 5.5
An flaw was found in the OpenStack Platform (RHOSP) director, a toolset for installing and managing a complete RHOSP environment. Plaintext passwords may be stored in log files, which can expose sensitive information to anyone with access to the logs.
- Product
- Red Hat OpenStack Platform 17.1 for RHEL 9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
May 14, 2024KioWare for Windows (versions all through 8.34) allows to escape the environment by downloading PDF files, which then by default are opened in an external PDF vCVE-2024-3459 · Other software · Kioware · reported by cvd@cert.plHigh 8.4
KioWare for Windows (versions all through 8.34) allows to escape the environment by downloading PDF files, which then by default are opened in an external PDF viewer. By using built-in functions of that viewer it is possible to launch a web browser, search through local files and, subsequently, launch any program with user privileges.
- Product
- Kioware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2024@hoppscotch/cli is a CLI to run Hoppscotch Test Scripts in CI environments.CVE-2024-34347 · Other software · hoppscotch · reported by GitHubHigh 8.3
@hoppscotch/cli is a CLI to run Hoppscotch Test Scripts in CI environments. Prior to 0.8.0, the @hoppscotch/js-sandbox package provides a Javascript sandbox that uses the Node.js vm module. However, the vm module is not safe for sandboxing untrusted Javascript code. This is because code inside the vm context can break out if it can get a hold of any reference to an object created outside of the vm. In the case of @hoppscotch/js-sandbox, multiple references to external objects are passed into the vm context to allow pre-request scripts interactions with environment variables and more. But this also allows the pre-request script to escape the sandbox. This vulnerability is fixed in 0.8.0.
- Product
- hoppscotch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2024Coder allows oragnizations to provision remote development environments via Terraform.CVE-2024-27918 · Other software · coder · reported by GitHubHigh 8.2
Coder allows oragnizations to provision remote development environments via Terraform. Prior to versions 2.6.1, 2.7.3, and 2.8.4, a vulnerability in Coder's OIDC authentication could allow an attacker to bypass the `CODER_OIDC_EMAIL_DOMAIN` verification and create an account with an email not in the allowlist. Deployments are only affected if the OIDC provider allows users to create accounts on the provider. During OIDC registration, the user's email was improperly validated against the allowed `CODER_OIDC_EMAIL_DOMAIN`s. This could allow a user with a domain that only partially matched an allowed domain to successfully login or register. An attacker could register a domain name that exploited this vulnerability and register on a Coder instance with a public OIDC provider. Coder instances with OIDC enabled and protected by the `CODER_OIDC_EMAIL_DOMAIN` configuration are affected. Coder instances using a private OIDC provider are not affected, as arbitrary users cannot register through a private OIDC provider without first having an account on the provider. Public OIDC providers are impacted. GitHub authentication and external authentication are not impacted. This vulnerability is
- Product
- coder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2024Qiskit IBM Runtime is an environment that streamlines quantum computations and provides optimal implementations of the Qiskit quantum computing SDK.CVE-2024-29032 · Other software · Qiskit · reported by GitHubMedium 5.3
Qiskit IBM Runtime is an environment that streamlines quantum computations and provides optimal implementations of the Qiskit quantum computing SDK. Starting in version 0.1.0 and prior to version 0.21.2, deserializing json data using `qiskit_ibm_runtime.RuntimeDecoder` can lead to arbitrary code execution given a correctly formatted input string. Version 0.21.2 contains a fix for this issue.
- Product
- qiskit-ibm-runtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2024High traffic environments may result in NULL Pointer Dereference vulnerability in Silicon Labs's Ember ZNet SDK before v7.4.0, causing a system crash.CVE-2023-51394 · Other software · silabs.com · reported by product-security@silabs.comMedium 5.3
High traffic environments may result in NULL Pointer Dereference vulnerability in Silicon Labs's Ember ZNet SDK before v7.4.0, causing a system crash.
- Product
- Ember ZNet SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.silabs.comcommunity.silabs.com
Feb 19, 2024On Linux, Node.js ignores certain environment variables if those may have been set by an unprivileged user while the process is running with elevated privilegesCVE-2024-21892 · Other software · NodeJS · reported by support@hackerone.comHigh 7.8
On Linux, Node.js ignores certain environment variables if those may have been set by an unprivileged user while the process is running with elevated privileges with the only exception of CAP_NET_BIND_SERVICE. Due to a bug in the implementation of this exception, Node.js incorrectly applies this exception even when certain other capabilities have been set. This allows unprivileged users to inject code that inherits the process's elevated privileges.
- Product
- Node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comhackerone.com
Feb 6, 2024In JetBrains Rider before 2023.3.3 logging of environment variables containing secret values was possibleCVE-2024-24939 · Other software · JetBrains · reported by cve@jetbrains.comLow 3.3
In JetBrains Rider before 2023.3.3 logging of environment variables containing secret values was possible
- Product
- Rider
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
Feb 6, 2024Memory corruption in Trusted Execution Environment while deinitializing an object used for license validation.CVE-2023-33046 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory corruption in Trusted Execution Environment while deinitializing an object used for license validation.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Feb 5, 2024Engrampa is an archive manager for the MATE environment.CVE-2023-52138 · Other software · mate-desktop · reported by GitHubHigh 8.2
Engrampa is an archive manager for the MATE environment. Engrampa is found to be vulnerable to a Path Traversal vulnerability that can be leveraged to achieve full Remote Command Execution (RCE) on the target. While handling CPIO archives, the Engrampa Archive manager follows symlink, cpio by default will follow stored symlinks while extracting and the Archiver will not check the symlink location, which leads to arbitrary file writes to unintended locations. When the victim extracts the archive, the attacker can craft a malicious cpio or ISO archive to achieve RCE on the target system. This vulnerability was fixed in commit 63d5dfa.
- Product
- engrampa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 1, 2024Miro Desktop 0.8.18 on macOS allows local Electron code injection via a complex series of steps that might be usable in some environments (bypass a kTCCServiceSCVE-2024-23746 · Other software · Miro · reported by MITRECritical 9.8
Miro Desktop 0.8.18 on macOS allows local Electron code injection via a complex series of steps that might be usable in some environments (bypass a kTCCServiceSystemPolicyAppBundles requirement via a file copy, an app.app/Contents rename, an asar modification, and a rename back to app.app/Contents).
- Product
- Miro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbook.hacktricks.xyzgithub.com
Jan 25, 2024Atril Document Viewer is the default document reader of the MATE desktop environment for Linux.CVE-2023-52076 · Other software · mate-desktop · reported by GitHubHigh 8.5
Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A path traversal and arbitrary file write vulnerability exists in versions of Atril prior to 1.26.2. This vulnerability is capable of writing arbitrary files anywhere on the filesystem to which the user opening a crafted document has access. The only limitation is that this vulnerability cannot be exploited to overwrite existing files, but that doesn't stop an attacker from achieving Remote Command Execution on the target system. Version 1.26.2 of Atril contains a patch for this vulnerability.
- Product
- atril
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2024JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook and Architecture.CVE-2024-22421 · Other software · jupyterlab · reported by GitHubHigh 7.6
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook and Architecture. Users of JupyterLab who click on a malicious link may get their `Authorization` and `XSRFToken` tokens exposed to a third party when running an older `jupyter-server` version. JupyterLab versions 4.1.0b2, 4.0.11, and 3.6.7 are patched. No workaround has been identified, however users should ensure to upgrade `jupyter-server` to version 2.7.2 or newer which includes a redirect vulnerability fix.
- Product
- jupyterlab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2024JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook and Architecture.CVE-2024-22420 · Other software · jupyterlab · reported by GitHubMedium 6.5
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook and Architecture. This vulnerability depends on user interaction by opening a malicious Markdown file using JupyterLab preview feature. A malicious user can access any data that the attacked user has access to as well as perform arbitrary requests acting as the attacked user. JupyterLab version 4.0.11 has been patched. Users are advised to upgrade. Users unable to upgrade should disable the table of contents extension.
- Product
- jupyterlab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2024Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which wasCVE-2023-50447 · Other software · python · reported by MITREHigh 8.1
Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter).
- Product
- pillow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comdevhub.checkmarx.com
Jan 18, 2024 IBM OpenPages with Watson 8.3 and 9.0 could provide weaker than expected security in a OpenPages environment using Native authentication.CVE-2023-38738 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.8
IBM OpenPages with Watson 8.3 and 9.0 could provide weaker than expected security in a OpenPages environment using Native authentication. If OpenPages is using Native authentication an attacker with access to the OpenPages database could through a series of specially crafted steps could exploit this weakness and gain unauthorized access to other OpenPages accounts. IBM X-Force ID: 262594.
- Product
- OpenPages with Watson
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jan 11, 2024Hyperledger Aries Cloud Agent Python (ACA-Py) is a foundation for building decentralized identity applications and services running in non-mobile environments.CVE-2024-21669 · Other software · hyperledger · reported by GitHubCritical 9.9
Hyperledger Aries Cloud Agent Python (ACA-Py) is a foundation for building decentralized identity applications and services running in non-mobile environments. When verifying W3C Format Verifiable Credentials using JSON-LD with Linked Data Proofs (LDP-VCs), the result of verifying the presentation `document.proof` was not factored into the final `verified` value (`true`/`false`) on the presentation record. The flaw enables holders of W3C Format Verifiable Credentials using JSON-LD with Linked Data Proofs (LDPs) to present incorrectly constructed proofs, and allows malicious verifiers to save and replay a presentation from such holders as their own. This vulnerability has been present since version 0.7.0 and fixed in version 0.10.5.
- Product
- aries-cloudagent-python
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2024The issue was addressed with improved validation of environment variables.CVE-2023-40394 · Computers, phones & browsers · Apple · reported by product-security@apple.comLow 3.3
The issue was addressed with improved validation of environment variables. This issue is fixed in iOS 16.6 and iPadOS 16.6. An app may be able to access sensitive user data.
- Product
- iOS and iPadOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Jan 3, 2024An issue was discovered in O-RAN Software Community ric-plt-e2mgr in the G-Release environment, allows remote attackers to cause a denial of service (DoS) via aCVE-2023-42358 · Other software · O-ran-sc · reported by MITREHigh 7.7
An issue was discovered in O-RAN Software Community ric-plt-e2mgr in the G-Release environment, allows remote attackers to cause a denial of service (DoS) via a crafted request to the E2Manager API component.
- Product
- Ric-plt-e2mgr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjira.o-ran-sc.orgjira.o-ran-sc.org
Dec 6, 2023Code injection in Remote Desktop Manager 2023.3.9.3 and earlier on macOS allows an attacker to execute code via the DYLIB_INSERT_LIBRARIES environment variable.CVE-2023-6288 · Other software · Devolutions · reported by security@devolutions.netHigh 7.8
Code injection in Remote Desktop Manager 2023.3.9.3 and earlier on macOS allows an attacker to execute code via the DYLIB_INSERT_LIBRARIES environment variable.
- Product
- Remote Desktop Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevolutions.netdevolutions.net
Nov 29, 2023The language file parsing process could be manipulated to expose environment variables.CVE-2023-40626 · Websites & servers · Joomla! Project · reported by security@joomla.orgHigh 7.5
The language file parsing process could be manipulated to expose environment variables. Environment variables might contain sensible information.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.joomla.orgdeveloper.joomla.org
Nov 15, 2023Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in a runtime environment, and the enforcement of privCVE-2023-48224 · Other software · ethyca · reported by GitHubHigh 8.2
Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in a runtime environment, and the enforcement of privacy regulations in code. The Fides Privacy Center allows data subject users to submit privacy and consent requests to data controller users of the Fides web application. Privacy requests allow data subjects to submit a request to access all person data held by the data controller, or delete/erase it. Consent request allows data subject users to modify their privacy preferences for how the data controller uses their personal data e.g. data sales and sharing consent opt-in/opt-out. If `subject_identity_verification_required` in the `[execution]` section of `fides.toml` or the env var `FIDES__EXECUTION__SUBJECT_IDENTITY_VERIFICATION_REQUIRED` is set to `True` on the fides webserver backend, data subjects are sent a one-time code to their email address or phone number, depending on messaging configuration, and the one-time code must be entered in the Privacy Center UI by the data subject before the privacy or consent request is submitted. It was identified that the one-time code values for these requests were generated by the p
- Product
- fides
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2023In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user who also has direct access to the web server CVE-2023-5550 · Other software · moodle · reported by patrick@puiterwijk.orgMedium 6.5
In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user who also has direct access to the web server outside of the Moodle webroot could utilise a local file include to achieve remote code execution.
- Product
- moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.moodle.orgbugzilla.redhat.com
Nov 9, 2023A CWE-526: Exposure of Sensitive Information Through Environmental Variables vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, Telit CinteCVE-2023-47615 · Other software · Telit Cinterion · reported by vulnerability@kaspersky.comLow 3.3
A CWE-526: Exposure of Sensitive Information Through Environmental Variables vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, Telit Cinterion PDS5/6/8, Telit Cinterion ELS61/81, Telit Cinterion PLS62 that could allow a local, low privileged attacker to get access to a sensitive data on the targeted system.
- Product
- BGS5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordics-cert.kaspersky.comics-cert.kaspersky.com
Nov 8, 2023Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in your runtime environment, and the enforcement of pCVE-2023-47114 · Other software · ethyca · reported by GitHubMedium 4.3
Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in your runtime environment, and the enforcement of privacy regulations in your code. The Fides web application allows data subject users to request access to their personal data. If the request is approved by the data controller user operating the Fides web application, the data subject's personal data can then retrieved from connected systems and data stores before being bundled together as a data subject access request package for the data subject to download. Supported data formats for the package include json and csv, but the most commonly used format is a series of HTML files compressed in a ZIP file. Once downloaded and unzipped, the data subject user can browse the HTML files on their local machine. It was identified that there was no validation of input coming from e.g. the connected systems and data stores which is later reflected in the downloaded data. This can result in an HTML injection that can be abused e.g. for phishing attacks or malicious JavaScript code execution, but only in the context of the data subject's browser accessing a HTML page using the `file://
- Product
- fides
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.