Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,845 results · page 9 of 37
Jan 22, 2025XLSXviewer: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-23562 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in pitinca XLSXviewer xlsx-viewer allows Path Traversal.This issue affects XLSXviewer: from n/a through <= 2.1.1.
- Product
- XLSXviewer
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update XLSXviewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 21, 2025A Server-Side Request Forgery (SSRF) vulnerability has been identified in the Web Services feature of newer Lexmark devices.CVE-2023-50733 · Other software · Lexmark · reported by 7bc73191-a2b6-4c63-9918-753964601853High 8.6
A Server-Side Request Forgery (SSRF) vulnerability has been identified in the Web Services feature of newer Lexmark devices.
- Product
- various
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2025CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy.CVE-2024-53829 · Other software · Ericsson · reported by 85b1779b-6ecd-4f52-bcc5-73eac4659dcfHigh 8.2
CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Cross-site request forgery allows an unauthenticated attacker to hijack the authentication of a logged in user, and use the web API with the same permissions, including but not limited to adding, removing or editing products. The attacker needs to know the ID of the available products to modify or delete them. The attacker cannot directly exfiltrate data (view) from CodeChecker, due to being limited to form-based CSRF. This issue affects CodeChecker: through 6.24.4.
- Product
- CodeChecker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2025MeinTurnierplan.de Widget Viewer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23941 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in meinturnierplan MeinTurnierplan.de Widget Viewer meinturnierplande-widget-viewer allows Stored XSS.This issue affects MeinTurnierplan.de Widget Viewer: from n/a through <= 1.1.
- Product
- MeinTurnierplan.de Widget Viewer
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update MeinTurnierplan.de Widget Viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025Chess Tempo Viewer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23868 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mliebelt Chess Tempo Viewer chesstempoviewer allows Stored XSS.This issue affects Chess Tempo Viewer: from n/a through <= 0.9.5.
- Product
- Chess Tempo Viewer
- Affected
- up to 0.9.5
- What to do
- Affects up to 0.9.5. Update Chess Tempo Viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025Marmoset Viewer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23767 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in revoxis Marmoset Viewer marmoset-viewer allows Stored XSS.This issue affects Marmoset Viewer: from n/a through <= 1.9.3.
- Product
- Marmoset Viewer
- Affected
- up to 1.9.3
- What to do
- Affects up to 1.9.3. Update Marmoset Viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025WP PT-Viewer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23438 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vincent Mimoun-Prat WP PT-Viewer wp-ptviewer allows Reflected XSS.This issue affects WP PT-Viewer: from n/a through <= 2.0.2.
- Product
- WP PT-Viewer
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update WP PT-Viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 15, 2025In Phiewer 4.1.0, a dylib injection leads to Command Execution which allow attackers to inject dylib file potentially leading to remote control and unauthorizedCVE-2024-53407 · Other software · Phiewer · reported by MITRELow 3.3
In Phiewer 4.1.0, a dylib injection leads to Command Execution which allow attackers to inject dylib file potentially leading to remote control and unauthorized access to sensitive user data.
- Product
- Phiewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2025TRUSTist REVIEWer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22567 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in trustist TRUSTist REVIEWer trustist-reviewer allows Reflected XSS.This issue affects TRUSTist REVIEWer: from n/a through <= 2.0.
- Product
- TRUSTist REVIEWer
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update TRUSTist REVIEWer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 12, 2025Luxion KeyShot Viewer KSP File Parsing Memory Corruption Remote Code Execution Vulnerability.CVE-2025-0412 · Other software · Luxion · reported by zdi-disclosures@trendmicro.comHigh 7.8
Luxion KeyShot Viewer KSP File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of KSP files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22139.
- Product
- KeyShot Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.keyshot.comzerodayinitiative.com
Jan 9, 20253DVieweronline: Stored Cross-Site ScriptingCVE-2024-12514 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The 3DVieweronline plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's '3Dvo-model' shortcode in all versions up to, and including, 2.2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- 3DVieweronline
- Affected
- up to 2.2.2
- What to do
- Affects up to 2.2.2. Update 3DVieweronline to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 7, 2025Error Log Viewer By WP Guru: Arbitrary File ReadCVE-2024-12849 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Error Log Viewer By WP Guru plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.0.1.3 via the wp_ajax_nopriv_elvwp_log_download AJAX action. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
- Product
- Error Log Viewer By WP Guru
- Affected
- up to 1.0.1.3
- What to do
- Affects up to 1.0.1.3. Update Error Log Viewer By WP Guru to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 31, 2024Embed PDF Viewer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56256 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Andy Fragen Embed PDF Viewer embed-pdf-viewer.This issue affects Embed PDF Viewer: from n/a through <= 2.3.1.
- Product
- Embed PDF Viewer
- Affected
- up to 2.3.1
- What to do
- Affects up to 2.3.1. Update Embed PDF Viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 20, 2024Path Traversal vulnerability in the eSignaViewer component in eSigna product versions 1.0 to 1.5 on all platforms allow an unauthenticated attacker to access arCVE-2024-12014 · Other software · Lleidanet PKI · reported by cve-coordination@incibe.esLow 2
Path Traversal vulnerability in the eSignaViewer component in eSigna product versions 1.0 to 1.5 on all platforms allow an unauthenticated attacker to access arbitrary files in the document system via manipulation of file paths and object identifiers.
- Product
- eSigna
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2024eewee admin custom: Cross-Site Request Forgery (CSRF)CVE-2024-54248 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in eewee eewee admin custom eewee-admincustom allows Privilege Escalation.This issue affects eewee admin custom: from n/a through <= 1.8.2.4.
- Product
- eewee admin custom
- Affected
- up to 1.8.2.4
- What to do
- Affects up to 1.8.2.4. Update eewee admin custom to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Eyewear prescription form: Missing AuthorizationCVE-2024-54239 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Missing Authorization vulnerability in dugudlabs Eyewear prescription form eyewear-prescription-form allows Privilege Escalation.This issue affects Eyewear prescription form: from n/a through <= 4.0.18.
- Product
- Eyewear prescription form
- Affected
- up to 4.0.18
- What to do
- Affects up to 4.0.18. Update Eyewear prescription form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 12, 2024360 Javascript Viewer: Stored Cross-Site ScriptingCVE-2024-12271 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The 360 Javascript Viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ref’ parameter in all versions up to, and including, 1.7.29 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- 360 Javascript Viewer
- Affected
- up to 1.7.29
- What to do
- Affects up to 1.7.29. Update 360 Javascript Viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 11, 2024Last Viewed Posts by WPBeginner: Sensitive Information ExposureCVE-2024-12294 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Last Viewed Posts by WPBeginner plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.1 via the 'get_legacy_cookies' function. This makes it possible for unauthenticated attackers to extract sensitive data including titles and permalinks of private, password-protected, pending, and draft posts.
- Product
- Last Viewed Posts by WPBeginner
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Last Viewed Posts by WPBeginner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 11, 2024Insufficient permissions in the TeamViewer Patch & Asset Management component prior to version 24.12 on Windows allows a local authenticated user to delete arbiCVE-2024-12363 · Other software · TeamViewer · reported by psirt@teamviewer.comHigh 7.1
Insufficient permissions in the TeamViewer Patch & Asset Management component prior to version 24.12 on Windows allows a local authenticated user to delete arbitrary files. TeamViewer Patch & Asset Management is part of TeamViewer Remote Management.
- Product
- Patch & Asset Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2024360 Javascript Viewer: Missing AuthorizationCVE-2023-48779 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in 3DWeb 360 Javascript Viewer 360deg-javascript-viewer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 360 Javascript Viewer: from n/a through <= 1.7.11.
- Product
- 360 Javascript Viewer
- Affected
- up to 1.7.11
- What to do
- Affects up to 1.7.11. Update 360 Javascript Viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 2, 2024In WhatsUp Gold versions released before 2024.0.1, a SQL Injection vulnerability allows an authenticated low-privileged user (at least Report Viewer permissionsCVE-2024-46908 · Other software · Progress Software Corporation · reported by security@progress.comHigh 8.8
In WhatsUp Gold versions released before 2024.0.1, a SQL Injection vulnerability allows an authenticated low-privileged user (at least Report Viewer permissions required) to achieve privilege escalation to the admin account.
- Product
- WhatsUp Gold
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.progress.comdocs.progress.com
Dec 2, 2024In WhatsUp Gold versions released before 2024.0.1, a SQL Injection vulnerability allows an authenticated low-privileged user (at least Report Viewer permissionsCVE-2024-46907 · Other software · Progress Software Corporation · reported by security@progress.comHigh 8.8
In WhatsUp Gold versions released before 2024.0.1, a SQL Injection vulnerability allows an authenticated low-privileged user (at least Report Viewer permissions required) to achieve privilege escalation to the admin account.
- Product
- WhatsUp Gold
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.progress.comdocs.progress.com
Dec 2, 2024In WhatsUp Gold versions released before 2024.0.1, a SQL Injection vulnerability allows an authenticated low-privileged user (at least Report Viewer permissionsCVE-2024-46906 · Other software · Progress Software Corporation · reported by security@progress.comHigh 8.8
In WhatsUp Gold versions released before 2024.0.1, a SQL Injection vulnerability allows an authenticated low-privileged user (at least Report Viewer permissions required) to achieve privilege escalation to the admin account.
- Product
- WhatsUp Gold
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.progress.comdocs.progress.com
Dec 2, 2024Wc Recently viewed products: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52484 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in deepintowp Wc Recently viewed products wc-recently-viewed-products allows Reflected XSS.This issue affects Wc Recently viewed products: from n/a through <= 1.0.1.
- Product
- Wc Recently viewed products
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Wc Recently viewed products to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 22, 2024FastStone Image Viewer GIF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.CVE-2024-9114 · Other software · FastStone · reported by zdi-disclosures@trendmicro.comHigh 7.8
FastStone Image Viewer GIF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of FastStone Image Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of GIF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25145.
- Product
- Image Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024FastStone Image Viewer TGA File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.CVE-2024-9113 · Other software · FastStone · reported by zdi-disclosures@trendmicro.comHigh 7.8
FastStone Image Viewer TGA File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of FastStone Image Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TGA files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25140.
- Product
- Image Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024FastStone Image Viewer PSD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.CVE-2024-9112 · Other software · FastStone · reported by zdi-disclosures@trendmicro.comHigh 7.8
FastStone Image Viewer PSD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of FastStone Image Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PSD files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25102.
- Product
- Image Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024Trimble SketchUp Viewer SKP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability.CVE-2024-7508 · Other software · Trimble · reported by zdi-disclosures@trendmicro.comHigh 7.8
Trimble SketchUp Viewer SKP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-19575.
- Product
- SketchUp Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024Trimble SketchUp Viewer SKP File Parsing Memory Corruption Remote Code Execution Vulnerability.CVE-2024-9731 · Other software · Trimble · reported by zdi-disclosures@trendmicro.comHigh 7.8
Trimble SketchUp Viewer SKP File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24145.
- Product
- SketchUp Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024Trimble SketchUp Viewer SKP File Parsing Memory Corruption Remote Code Execution Vulnerability.CVE-2024-9730 · Other software · Trimble · reported by zdi-disclosures@trendmicro.comHigh 7.8
Trimble SketchUp Viewer SKP File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24146.
- Product
- SketchUp Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability.CVE-2024-9729 · Other software · Trimble · reported by zdi-disclosures@trendmicro.comHigh 7.8
Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24144.
- Product
- SketchUp Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability.CVE-2024-9728 · Other software · Trimble · reported by zdi-disclosures@trendmicro.comHigh 7.8
Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24112.
- Product
- SketchUp Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability.CVE-2024-9727 · Other software · Trimble · reported by zdi-disclosures@trendmicro.comHigh 7.8
Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24111.
- Product
- SketchUp Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024Trimble SketchUp Viewer SKP File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability.CVE-2024-9726 · Other software · Trimble · reported by zdi-disclosures@trendmicro.comHigh 7.8
Trimble SketchUp Viewer SKP File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24110.
- Product
- SketchUp Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability.CVE-2024-9725 · Other software · Trimble · reported by zdi-disclosures@trendmicro.comHigh 7.8
Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24109.
- Product
- SketchUp Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability.CVE-2024-9724 · Other software · Trimble · reported by zdi-disclosures@trendmicro.comHigh 7.8
Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24108.
- Product
- SketchUp Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability.CVE-2024-9723 · Other software · Trimble · reported by zdi-disclosures@trendmicro.comHigh 7.8
Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24107.
- Product
- SketchUp Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability.CVE-2024-9722 · Other software · Trimble · reported by zdi-disclosures@trendmicro.comHigh 7.8
Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24106.
- Product
- SketchUp Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability.CVE-2024-9721 · Other software · Trimble · reported by zdi-disclosures@trendmicro.comHigh 7.8
Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24105.
- Product
- SketchUp Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024Trimble SketchUp Viewer SKP File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability.CVE-2024-9720 · Other software · Trimble · reported by zdi-disclosures@trendmicro.comHigh 7.8
Trimble SketchUp Viewer SKP File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24104.
- Product
- SketchUp Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability.CVE-2024-9719 · Other software · Trimble · reported by zdi-disclosures@trendmicro.comHigh 7.8
Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24103.
- Product
- SketchUp Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024Trimble SketchUp Viewer SKP File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability.CVE-2024-9718 · Other software · Trimble · reported by zdi-disclosures@trendmicro.comHigh 7.8
Trimble SketchUp Viewer SKP File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24102.
- Product
- SketchUp Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024Trimble SketchUp Viewer SKP File Parsing Uninitialized Variable Remote Code Execution Vulnerability.CVE-2024-9717 · Other software · Trimble · reported by zdi-disclosures@trendmicro.comHigh 7.8
Trimble SketchUp Viewer SKP File Parsing Uninitialized Variable Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP files. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24101.
- Product
- SketchUp Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability.CVE-2024-9716 · Other software · Trimble · reported by zdi-disclosures@trendmicro.comHigh 7.8
Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24100.
- Product
- SketchUp Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability.CVE-2024-9715 · Other software · Trimble · reported by zdi-disclosures@trendmicro.comHigh 7.8
Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24098.
- Product
- SketchUp Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability.CVE-2024-9714 · Other software · Trimble · reported by zdi-disclosures@trendmicro.comHigh 7.8
Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24097.
- Product
- SketchUp Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2024File Upload vulnerability in Xi'an Daxi Information technology OfficeWeb365 v.8.6.1.0 and v7.18.23.0 allows a remote attacker to execute arbitrary code via the CVE-2024-48694 · Other software · xian_daxi_information_technology · reported by MITRECritical 9.8
File Upload vulnerability in Xi'an Daxi Information technology OfficeWeb365 v.8.6.1.0 and v7.18.23.0 allows a remote attacker to execute arbitrary code via the pw/savedraw component.
- Product
- officeweb_365
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordavd.aliyun.comgithub.com
Nov 19, 2024Lewe Bootstrap Visuals: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51810 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in George Lewe Lewe Bootstrap Visuals shortcode-bootstrap-visuals allows Stored XSS.This issue affects Lewe Bootstrap Visuals: from n/a through <= 3.0.1.
- Product
- Lewe Bootstrap Visuals
- Affected
- up to 3.0.1
- What to do
- Affects up to 3.0.1. Update Lewe Bootstrap Visuals to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 15, 2024Real3D Flipbook Lite – 3D FlipBook, PDF Viewer, PDF Embedder: Arbitrary file uploadsCVE-2024-9849 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Real3D Flipbook Lite – 3D FlipBook, PDF Viewer, PDF Embedder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'r3dfb_save_thumbnail_callback' function in all versions up to, and including, 4.8. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- Real3D Flipbook Lite – 3D FlipBook, PDF Viewer, PDF Embedder
- Affected
- up to 4.8
- What to do
- Affects up to 4.8. Update Real3D Flipbook Lite – 3D FlipBook, PDF Viewer, PDF Embedder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 15, 2024WP Log Viewer: Unauthorized use of functionalityCVE-2024-11085 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The WP Log Viewer plugin for WordPress is vulnerable to unauthorized use of functionality due to a missing capability check on several AJAX actions in all versions up to, and including, 1.2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to access logs, update plugin-related user settings and general plugin settings.
- Product
- WP Log Viewer
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update WP Log Viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.