Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
19,438 results · page 93 of 389
May 6, 2024MF Gig Calendar: Does not have CSRF checks in some placesCVE-2024-3756 · WordPress plugins & themes · reported by WPScanHigh 7.5
The MF Gig Calendar WordPress plugin through 1.2.1 does not have CSRF checks in some places, which could allow attackers to make logged in Contributors and above delete arbitrary events via a CSRF attack
- Product
- MF Gig Calendar
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update MF Gig Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 6, 2024MF Gig Calendar: Does not sanitise and escape some of its settingsCVE-2024-3755 · WordPress plugins & themes · reported by WPScanMedium 5.4
The MF Gig Calendar WordPress plugin through 1.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as editor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- MF Gig Calendar
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update MF Gig Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 6, 2024Crelly Slider: Does not sanitise and escape some of its settingsCVE-2024-3752 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Crelly Slider WordPress plugin through 1.4.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Crelly Slider
- Affected
- up to 1.4.5
- What to do
- Affects up to 1.4.5. Update Crelly Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 6, 2024Fancy Product Designer: Does not sanitise and escape some of its settingsCVE-2024-0904 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Fancy Product Designer WordPress plugin before 6.1.81 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Fancy Product Designer
- Fixed in
- 6.1.81
- What to do
- Update Fancy Product Designer to 6.1.81 or newer.
May 5, 2024WordOps through 3.20.0 has a wo/cli/plugins/stack_pref.py TOCTOU race condition because the conf_path os.open does not use a mode parameter during file creationCVE-2024-34528 · Other software · wordopsproject · reported by MITREHigh 7.7
WordOps through 3.20.0 has a wo/cli/plugins/stack_pref.py TOCTOU race condition because the conf_path os.open does not use a mode parameter during file creation.
- Product
- wordops
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2024btcd before 0.24.0 does not correctly implement the consensus rules outlined in BIP 68 and BIP 112, making it susceptible to consensus failures.CVE-2024-34478 · Other software · btcd · reported by MITREHigh 7.5
btcd before 0.24.0 does not correctly implement the consensus rules outlined in BIP 68 and BIP 112, making it susceptible to consensus failures. Specifically, it uses the transaction version as a signed integer when it is supposed to be treated as unsigned. There can be a chain split and loss of funds.
- Product
- btcd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddelvingbitcoin.orggithub.com
May 3, 2024IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 does not invalidate session after logout which could allow an authenticated user to impersonate another user onCVE-2023-40695 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.3
IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 264938.
- Product
- Cognos Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
May 3, 2024IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 does not set the secure attribute on authorization tokens or session cookies.CVE-2021-20450 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 196640.
- Product
- Cognos Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
May 3, 2024Mullvad VPN through 2024.1 on Android does not set a DNS server in the blocking state (after a hard failure to create a tunnel), and thus DNS traffic can leave CVE-2024-34446 · Other software · mullvad · reported by MITREHigh 7.5
Mullvad VPN through 2024.1 on Android does not set a DNS server in the blocking state (after a hard failure to create a tunnel), and thus DNS traffic can leave the device. Data showing that the affected device was the origin of sensitive DNS requests may be observed and logged by operators of unintended DNS servers.
- Product
- mullvad_vpn
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 3, 2024The 'control' in Parrot ANAFI USA firmware 1.10.4 does not check the MAV_MISSION_TYPE(0, 1, 2, 255), which allows attacker to cut off the connection between a cCVE-2024-33844 · Other software · parrot · reported by MITREHigh 7.5
The 'control' in Parrot ANAFI USA firmware 1.10.4 does not check the MAV_MISSION_TYPE(0, 1, 2, 255), which allows attacker to cut off the connection between a controller and the drone by sending MAVLink MISSION_COUNT command with a wrong MAV_MISSION_TYPE.
- Product
- anafi_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforum.developer.parrot.comforum.developer.parrot.com
May 3, 2024Carousel Slider: Does not validate and escape some of its Slide options before outputting them back in the page/post where the related Slide shortcode is embedCVE-2024-3703 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Carousel Slider WordPress plugin before 2.2.10 does not validate and escape some of its Slide options before outputting them back in the page/post where the related Slide shortcode is embed, which could allow users with the Editor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Carousel Slider
- Fixed in
- 2.2.10
- What to do
- Update Carousel Slider to 2.2.10 or newer.
May 3, 2024Gutenverse: Does not validate the htmlTag option in various of its block before outputting it back in a page/post where the block is embedCVE-2024-3692 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Gutenverse WordPress plugin before 1.9.1 does not validate the htmlTag option in various of its block before outputting it back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Gutenverse
- Fixed in
- 1.9.1
- What to do
- Update Gutenverse to 1.9.1 or newer.
May 3, 2024Responsive Contact Form Builder & Lead Generation: Does not sanitise and escape some of its settingsCVE-2024-3637 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Responsive Contact Form Builder & Lead Generation Plugin WordPress plugin through 1.8.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Responsive Contact Form Builder & Lead Generation
- Affected
- up to 1.8.9
- What to do
- Affects up to 1.8.9. Update Responsive Contact Form Builder & Lead Generation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 2, 2024D-Link DIR-X3260 prog.cgi SetIPv6PppoeSettings Stack-based Buffer Overflow Remote Code Execution Vulnerability.CVE-2023-51620 · Network & remote access · D-Link · reported by zdi-disclosures@trendmicro.comMedium 6.8
D-Link DIR-X3260 prog.cgi SetIPv6PppoeSettings Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-X3260 routers. Authentication is required to exploit this vulnerability. The specific flaw exists within the prog.cgi binary, which handles HNAP requests made to the lighttpd webserver listening on TCP ports 80 and 443. The issue results from the lack of proper validation of a user-supplied string before copying it to a fixed-size stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21669.
- Product
- DIR-X3260
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupportannouncement.us.dlink.comzerodayinitiative.com
May 2, 2024D-Link DIR-3040 prog.cgi SetIPv6PppoeSettings Stack-Based Buffer Overflow Remote Code Execution Vulnerability.CVE-2023-41225 · Network & remote access · D-Link · reported by zdi-disclosures@trendmicro.comMedium 6.8
D-Link DIR-3040 prog.cgi SetIPv6PppoeSettings Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-3040 routers. Authentication is required to exploit this vulnerability. The specific flaw exists within the prog.cgi binary, which handles HNAP requests made to the lighttpd webserver listening on TCP ports 80 and 443. The issue results from the lack of proper validation of a user-supplied string before copying it to a fixed-size stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21651.
- Product
- DIR-3040
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupportannouncement.us.dlink.comzerodayinitiative.com
May 2, 2024Jenkins Git server Plugin 114.v068a_c7cc2574 and earlier does not perform a permission check for read access to a Git repository over SSH, allowing attackers wiCVE-2024-34146 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 6.5
Jenkins Git server Plugin 114.v068a_c7cc2574 and earlier does not perform a permission check for read access to a Git repository over SSH, allowing attackers with a previously configured SSH public key but lacking Overall/Read permission to access these repositories.
- Product
- Jenkins Git server Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
May 2, 2024In Apache ActiveMQ 6.x, the default configuration doesn't secure the API web context (where the Jolokia JMX REST API and the Message REST API are located).CVE-2024-32114 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.5
In Apache ActiveMQ 6.x, the default configuration doesn't secure the API web context (where the Jolokia JMX REST API and the Message REST API are located). It means that anyone can use these layers without any required authentication. Potentially, anyone can interact with the broker (using Jolokia JMX REST API) and/or produce/consume messages or purge/delete destinations (using the Message REST API). To mitigate, users can update the default conf/jetty.xml configuration file to add authentication requirement: <bean id="securityConstraintMapping" class="org.eclipse.jetty.security.ConstraintMapping"> <property name="constraint" ref="securityConstraint" /> <property name="pathSpec" value="/" /> </bean> Or we encourage users to upgrade to Apache ActiveMQ 6.1.2 where the default configuration has been updated with authentication by default.
- Product
- Apache ActiveMQ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordactivemq.apache.orgactivemq.apache.org
May 2, 2024Counter Box: Does not have CSRF checks in some bulk actionsCVE-2024-3481 · WordPress plugins & themes · reported by WPScanMedium 5.2
The Counter Box WordPress plugin before 1.2.4 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such deleting counters via CSRF attacks
- Product
- Counter Box
- Fixed in
- 1.2.4
- What to do
- Update Counter Box to 1.2.4 or newer.
May 2, 2024Herd Effects: Does not have CSRF checks in some bulk actionsCVE-2024-3478 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Herd Effects WordPress plugin before 5.2.7 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting effects via CSRF attacks
- Product
- Herd Effects
- Fixed in
- 5.2.7
- What to do
- Update Herd Effects to 5.2.7 or newer.
May 2, 2024Popup Box: Does not have CSRF checks in some bulk actionsCVE-2024-3477 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Popup Box WordPress plugin before 2.2.7 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting popups via CSRF attacks
- Product
- Popup Box
- Fixed in
- 2.2.7
- What to do
- Update Popup Box to 2.2.7 or newer.
May 2, 2024Side Menu Lite: Does not have CSRF checks in some bulk actionsCVE-2024-3476 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Side Menu Lite WordPress plugin before 4.2.1 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting buttons via CSRF attacks
- Product
- Side Menu Lite
- Fixed in
- 4.2.1
- What to do
- Update Side Menu Lite to 4.2.1 or newer.
May 2, 2024Sticky Buttons: Does not have CSRF checks in some bulk actionsCVE-2024-3475 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Sticky Buttons WordPress plugin before 3.2.4 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting buttons via CSRF attacks
- Product
- Sticky Buttons
- Fixed in
- 3.2.4
- What to do
- Update Sticky Buttons to 3.2.4 or newer.
May 2, 2024Wow Skype Buttons: Does not have CSRF checks in some bulk actionsCVE-2024-3474 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Wow Skype Buttons WordPress plugin before 4.0.4 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting buttons via CSRF attacks
- Product
- Wow Skype Buttons
- Fixed in
- 4.0.4
- What to do
- Update Wow Skype Buttons to 4.0.4 or newer.
May 2, 2024Modal Window: Does not have CSRF check in placeCVE-2024-3472 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Modal Window WordPress plugin before 5.3.10 does not have CSRF check in place when bulk deleting modals, which could allow attackers to make a logged in admin delete them via a CSRF attack
- Product
- Modal Window
- Fixed in
- 5.3.10
- What to do
- Update Modal Window to 5.3.10 or newer.
May 2, 2024Button Generator: Does not have CSRF check in placeCVE-2024-3471 · WordPress plugins & themes · reported by WPScanLow 3.4
The Button Generator WordPress plugin before 3.0 does not have CSRF check in place when bulk deleting, which could allow attackers to make a logged in admin delete buttons via a CSRF attack
- Product
- Button Generator
- Fixed in
- 3.0
- What to do
- Update Button Generator to 3.0 or newer.
May 2, 2024Float menu: Does not have CSRF check in its bulk actionsCVE-2024-2405 · WordPress plugins & themes · reported by WPScanMedium 4.5
The Float menu WordPress plugin before 6.0.1 does not have CSRF check in its bulk actions, which could allow attackers to make logged in admin delete arbitrary menu via a CSRF attack.
- Product
- Float menu
- Fixed in
- 6.0.1
- What to do
- Update Float menu to 6.0.1 or newer.
May 1, 2024Anti-Cheat Expert's Windows kernel module "ACE-BASE.sys" version 1.0.2202.6217 does not perform proper access control when handling system resources.CVE-2024-22830 · Other software · windows-kernel · reported by MITREMedium 5.3
Anti-Cheat Expert's Windows kernel module "ACE-BASE.sys" version 1.0.2202.6217 does not perform proper access control when handling system resources. This allows a local attacker to escalate privileges from regular user to System or PPL level.
- Product
- ace-base-sys
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordintl.anticheatexpert.comdefencetech.it
May 1, 2024In the Linux kernel, the following vulnerability has been resolved: cifs: Fix writeback data corruption cifs writeback doesn't correctly handle the case whereCVE-2024-27036 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: cifs: Fix writeback data corruption cifs writeback doesn't correctly handle the case where cifs_extend_writeback() hits a point where it is considering an additional folio, but this would overrun the wsize - at which point it drops out of the xarray scanning loop and calls xas_pause(). The problem is that xas_pause() advances the loop counter - thereby skipping that page. What needs to happen is for xas_reset() to be called any time we decide we don't want to process the page we're looking at, but rather send the request we are building and start a new one. Fix this by copying and adapting the netfslib writepages code as a temporary measure, with cifs writeback intending to be offloaded to netfslib in the near future. This also fixes the issue with the use of filemap_get_folios_tag() causing retry of a bunch of pages which the extender already dealt with. This can be tested by creating, say, a 64K file somewhere not on cifs (otherwise copy-offload may get underfoot), mounting a cifs share with a wsize of 64000, copying the file to it and then comparing the original file and the copy: dd if=/dev/uran
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
May 1, 2024IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.11.0 and IBM QRadar Suite for Software 1.10.12.0 through 1.10.19.0 does not set the SameSite attribute fCVE-2022-38386 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.9
IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.11.0 and IBM QRadar Suite for Software 1.10.12.0 through 1.10.19.0 does not set the SameSite attribute for sensitive cookies which could allow an attacker to obtain sensitive information using man-in-the-middle techniques. IBM X-Force ID: 233778.
- Product
- Cloud Pak for Security
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
May 1, 2024In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: incorrect pppoe tuple pppoe traffic reaching ingress path does not mCVE-2024-27015 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: incorrect pppoe tuple pppoe traffic reaching ingress path does not match the flowtable entry because the pppoe header is expected to be at the network header offset. This bug causes a mismatch in the flow table lookup, so pppoe packets enter the classical forwarding path.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
May 1, 2024In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fix memleak in map from abort path The delete set command does not rCVE-2024-27011 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fix memleak in map from abort path The delete set command does not rely on the transaction object for element removal, therefore, a combination of delete element + delete set from the abort path could result in restoring twice the refcount of the mapping. Check for inactive element in the next generation for the delete element command in the abort path, skip restoring state if next generation bit has been already cleared. This is similar to the activate logic using the set walk iterator. [ 6170.286929] ------------[ cut here ]------------ [ 6170.286939] WARNING: CPU: 6 PID: 790302 at net/netfilter/nf_tables_api.c:2086 nf_tables_chain_destroy+0x1f7/0x220 [nf_tables] [ 6170.287071] Modules linked in: [...] [ 6170.287633] CPU: 6 PID: 790302 Comm: kworker/6:2 Not tainted 6.9.0-rc3+ #365 [ 6170.287768] RIP: 0010:nf_tables_chain_destroy+0x1f7/0x220 [nf_tables] [ 6170.287886] Code: df 48 8d 7d 58 e8 69 2e 3b df 48 8b 7d 58 e8 80 1b 37 df 48 8d 7d 68 e8 57 2e 3b df 48 8b 7d 68 e8 6e 1b 37 df 48 89 ef eb c4 <0f> 0b 48 83 c4 08 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc 0f [ 6170.287895] RSP: 0018
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
May 1, 2024In the Linux kernel, the following vulnerability has been resolved: comedi: vmk80xx: fix incomplete endpoint checking While vmk80xx does have endpoint checkinCVE-2024-27001 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: comedi: vmk80xx: fix incomplete endpoint checking While vmk80xx does have endpoint checking implemented, some things can fall through the cracks. Depending on the hardware model, URBs can have either bulk or interrupt type, and current version of vmk80xx_find_usb_endpoints() function does not take that fully into account. While this warning does not seem to be too harmful, at the very least it will crash systems with 'panic_on_warn' set on them. Fix the issue found by Syzkaller [1] by somewhat simplifying the endpoint checking process with usb_find_common_endpoints() and ensuring that only expected endpoint types are present. This patch has not been tested on real hardware. [1] Syzkaller report: usb 1-1: BOGUS urb xfer, pipe 1 != type 3 WARNING: CPU: 0 PID: 781 at drivers/usb/core/urb.c:504 usb_submit_urb+0xc4e/0x18c0 drivers/usb/core/urb.c:503 ... Call Trace: <TASK> usb_start_wait_urb+0x113/0x520 drivers/usb/core/message.c:59 vmk80xx_reset_device drivers/comedi/drivers/vmk80xx.c:227 [inline] vmk80xx_auto_attach+0xa1c/0x1a40 drivers/comedi/drivers/vmk80xx.c:818 comedi_auto_config+0x238/0x380 drivers/comed
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Apr 30, 2024Implementations of IPMI Authenticated sessions does not provide enough randomness to protect from session hijacking, allowing an attacker to use either predictaCVE-2024-3411 · Other software · Dell · reported by cret@cert.orgCritical 9.1
Implementations of IPMI Authenticated sessions does not provide enough randomness to protect from session hijacking, allowing an attacker to use either predictable IPMI Session ID or weak BMC Random Number to bypass security controls using spoofed IPMI packets to manage BMC device.
- Product
- iDRAC8
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2024ReCrystallize Server 5.10.0.0 uses a authorization mechanism that relies on the value of a cookie, but it does not bind the cookie value to a session ID.CVE-2024-26331 · Other software · recrystallize_software · reported by MITREHigh 7.5
ReCrystallize Server 5.10.0.0 uses a authorization mechanism that relies on the value of a cookie, but it does not bind the cookie value to a session ID. Attackers can easily modify the cookie value, within a browser or by implementing client-side code outside of a browser. Attackers can bypass the authentication mechanism by modifying the cookie to contain an expected value.
- Product
- recrystallize_server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsensepost.comrecrystallize.com
Apr 30, 2024Adive Framework 2.0.8, does not sufficiently encode user-controlled inputs, resulting in a persistent Cross-Site Scripting (XSS) vulnerability via the /adive/adCVE-2024-4337 · Other software · Adive · reported by cve-coordination@incibe.esHigh 7.6
Adive Framework 2.0.8, does not sufficiently encode user-controlled inputs, resulting in a persistent Cross-Site Scripting (XSS) vulnerability via the /adive/admin/nav/add, in multiple parameters. This vulnerability allows an attacker to retrieve the session details of an authenticated user.
- Product
- Adive Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2024Adive Framework 2.0.8, does not sufficiently encode user-controlled inputs, resulting in a persistent Cross-Site Scripting (XSS) vulnerability via the /adive/adCVE-2024-4336 · Other software · Adive · reported by cve-coordination@incibe.esHigh 7.6
Adive Framework 2.0.8, does not sufficiently encode user-controlled inputs, resulting in a persistent Cross-Site Scripting (XSS) vulnerability via the /adive/admin/tables/add, in multiple parameters. An attacker could retrieve the session details of an authenticated user.
- Product
- Adive Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2024Smart Forms: Does not sanitise and escape some of its settingsCVE-2024-1905 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Smart Forms WordPress plugin before 2.6.96 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Smart Forms
- Fixed in
- 2.6.96
- What to do
- Update Smart Forms to 2.6.96 or newer.
Apr 28, 2024In the Linux kernel, the following vulnerability has been resolved: smb3: fix temporary data corruption in collapse range collapse range doesn't discard the aCVE-2022-48668 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Low 3.3
In the Linux kernel, the following vulnerability has been resolved: smb3: fix temporary data corruption in collapse range collapse range doesn't discard the affected cached region so can risk temporarily corrupting the file data. This fixes xfstest generic/031 I also decided to merge a minor cleanup to this into the same patch (avoiding rereading inode size repeatedly unnecessarily) to make it clearer.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Apr 28, 2024In the Linux kernel, the following vulnerability has been resolved: smb3: fix temporary data corruption in insert range insert range doesn't discard the affecCVE-2022-48667 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Low 3.3
In the Linux kernel, the following vulnerability has been resolved: smb3: fix temporary data corruption in insert range insert range doesn't discard the affected cached region so can risk temporarily corrupting file data. Also includes some minor cleanup (avoiding rereading inode size repeatedly unnecessarily) to make it clearer.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Apr 26, 2024MM-email2image: Does not have CSRF check in some placesCVE-2024-3076 · WordPress plugins & themes · reported by WPScanLow 3.8
The MM-email2image WordPress plugin through 0.2.5 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
- Product
- MM-email2image
- Affected
- up to 0.2.5
- What to do
- Affects up to 0.2.5. Update MM-email2image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 26, 2024Eclipse Target Management: Terminal and Remote System Explorer (RSE) version <= 4.5.400 has a remote code execution vulnerability that does not require authentiCVE-2024-0740 · Other software · Eclipse Foundation · reported by emo@eclipse.orgCritical 9.8
Eclipse Target Management: Terminal and Remote System Explorer (RSE) version <= 4.5.400 has a remote code execution vulnerability that does not require authentication. The fixed version is included in Eclipse IDE 2024-03
- Product
- Eclipse Target Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.eclipse.orggitlab.eclipse.org
Apr 26, 2024WP Shortcodes Plugin — Shortcodes Ultimate: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-3188 · WordPress plugins & themes · reported by WPScanMedium 6.3
The WP Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 7.1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- WP Shortcodes Plugin — Shortcodes Ultimate
- Fixed in
- 7.1.0
- What to do
- Update WP Shortcodes Plugin — Shortcodes Ultimate to 7.1.0 or newer.
Apr 26, 2024MM-email2image: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-3075 · WordPress plugins & themes · reported by WPScanHigh 8.1
The MM-email2image WordPress plugin through 0.2.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- MM-email2image
- Affected
- up to 0.2.5
- What to do
- Affects up to 0.2.5. Update MM-email2image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 26, 2024ENL Newsletter: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-3060 · WordPress plugins & themes · reported by WPScanMedium 4.5
The ENL Newsletter WordPress plugin through 1.0.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing admin+ to perform SQL injection attacks
- Product
- ENL Newsletter
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update ENL Newsletter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 26, 2024ENL Newsletter: Does not have CSRF checks in some placesCVE-2024-3059 · WordPress plugins & themes · reported by WPScanMedium 5.7
The ENL Newsletter WordPress plugin through 1.0.1 does not have CSRF checks in some places, which could allow attackers to make logged in admins delete arbitrary Campaigns via a CSRF attack
- Product
- ENL Newsletter
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update ENL Newsletter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 26, 2024ENL Newsletter: Does not have CSRF check in some placesCVE-2024-3058 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ENL Newsletter WordPress plugin through 1.0.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
- Product
- ENL Newsletter
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update ENL Newsletter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 26, 2024Bannerlid: Does not escape generated URLs before outputting them in attributesCVE-2024-3048 · WordPress plugins & themes · reported by WPScanMedium 5.5
The Bannerlid WordPress plugin through 1.1.0 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as administrators
- Product
- Bannerlid
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Bannerlid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 26, 2024Call Now Button: Does not sanitise and escape some of its settingsCVE-2024-2908 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Call Now Button WordPress plugin before 1.4.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Call Now Button
- Fixed in
- 1.4.7
- What to do
- Update Call Now Button to 1.4.7 or newer.
Apr 26, 2024WP Chat App: Does not sanitise and escape some of its settingsCVE-2024-2837 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Chat App WordPress plugin before 3.6.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admins to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- WP Chat App
- Fixed in
- 3.6.4
- What to do
- Update WP Chat App to 3.6.4 or newer.
Apr 26, 2024Salon booking system: Does not sanitise and escape some of its settingsCVE-2024-2603 · WordPress plugins & themes · reported by WPScanMedium 6.3
The Salon booking system WordPress plugin through 9.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin (or editor depending on Salon booking system WordPress plugin through 9.6.5 configuration) to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Salon booking system
- Affected
- up to 9.6.5
- What to do
- Affects up to 9.6.5. Update Salon booking system to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.