Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
85 results · page 1 of 2
Oct 20, 2026Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all wildcard constraint and without calling CVE-2026-105949 · Other software · Red Hat · reported by Red HatHigh 8.8
Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all wildcard constraint and without calling setDenyUncoveredHttpMethods(true). The servlet routes requests using Path.of(pathInfo).getFileName(), which strips all leading segments and trailing slashes. Requests like POST /kafkacruisecontrol/x/rebalance bypass authentication entirely but still dispatch to admin endpoints. All 15 admin endpoints become reachable without authentication. In AMQ Streams, the Strimzi operator's NetworkPolicy restricts Cruise Control port 9090 to operator pods only, reducing effective severity to Important.
- Product
- streams for Apache Kafka 2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Sep 30, 2026UltrafastSecp256k1 is a high-performance, multi-backend secp256k1 engine with reproducible audit evidence, compatibility shims, and profile-based review scopes.CVE-2026-55174 · Other software · shrec · reported by GitHubMedium 5.9
UltrafastSecp256k1 is a high-performance, multi-backend secp256k1 engine with reproducible audit evidence, compatibility shims, and profile-based review scopes. Prior to version 4.2.0, UltrafastSecp256k1's ECDSA adaptor pre-signature verification accepts forged adaptor pre-signatures whose "r" value is not cryptographically bound to the adaptor point "T". This issue has been patched in version 4.2.0.
- Product
- UltrafastSecp256k1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026LTSecurity LTK3500SF contains a hard-coded credentials vulnerability where the root and guest account passwords are stored in /etc/shadow as weak hashes recoverCVE-2026-47116 · Other software · LTSecurity · reported by VulnCheckCritical 9.2
LTSecurity LTK3500SF contains a hard-coded credentials vulnerability where the root and guest account passwords are stored in /etc/shadow as weak hashes recoverable with dictionary-based cracking tools. The recovered credentials authenticate against the device's Telnet and SSH services and grant root-level access to the operating system. These services are not confirmed to start automatically at boot, so exploitation requires Telnet or SSH to be running, whether enabled by the device configuration or started manually.
- Product
- LTK3500SF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Aug 26, 2026The Grav API plugin (getgrav/grav-plugin-api) before 1.0.18 does not apply the API-key scope cap in the injectSecurityTab() function of BlueprintController whenCVE-2026-80204 · Other software · getgrav · reported by VulnCheckCritical 9.3
The Grav API plugin (getgrav/grav-plugin-api) before 1.0.18 does not apply the API-key scope cap in the injectSecurityTab() function of BlueprintController when deciding whether a page's security/permissions blueprint section is editable. Because the function performs raw isSuperAdmin()/hasPermission() checks without a request parameter, it cannot enforce scopeAllows(). A caller holding a scoped API key may therefore see (and potentially edit) page permission fields beyond the scope granted to the key. The end-to-end write-time impact was not fully confirmed by the reporter.
- Product
- grav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Aug 2, 2026ArcadeDB before 26.7.3 binds the real LocalDatabase object into JavaScript trigger contexts with HostAccess.ALL, allowing schema-admins to call getSecurity().crCVE-2026-67356 · Other software · ArcadeData · reported by VulnCheckHigh 8.7
ArcadeDB before 26.7.3 binds the real LocalDatabase object into JavaScript trigger contexts with HostAccess.ALL, allowing schema-admins to call getSecurity().createUser() without permission checks. Attackers with UPDATE_SCHEMA permission can create triggers that execute JavaScript to create server-wide admin users, escalating privileges beyond their authorization level.
- Product
- arcadedb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jun 10, 2026An improper validation of credentials vulnerability in the CommvaultSecurityIQ integration for Cortex XSOAR and Cortex XSIAM allows an unauthenticated attacker CVE-2026-0274 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comHigh 8.1
An improper validation of credentials vulnerability in the CommvaultSecurityIQ integration for Cortex XSOAR and Cortex XSIAM allows an unauthenticated attacker to access and modify protected resources.
- Product
- Cortex XSIAM CommvaultSecurityIQ Marketplace
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.paloaltonetworks.com
Jan 16, 2026lucy-xss-filter before commit 7c1de6d allows an attacker to induce server-side HEAD requests to arbitrary URLs when the ObjectSecurityListener or EmbedSecurityLCVE-2026-23768 · Other software · NAVER · reported by cve@navercorp.comMedium 6.1
lucy-xss-filter before commit 7c1de6d allows an attacker to induce server-side HEAD requests to arbitrary URLs when the ObjectSecurityListener or EmbedSecurityListener option is enabled and embed or object tags are used with a src attribute missing a file extension.
- Product
- lucy-xss-filter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcve.naver.comgithub.com
Dec 9, 2025An XSS vulnerability in pxc_portSecCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request tCVE-2025-41746 · Other software · Phoenix Contact · reported by info@cert.vde.comHigh 7.1
An XSS vulnerability in pxc_portSecCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request to the device in order to change parameters available via web based management (WBM). The vulnerability does not provide access to system-level resources such as operating system internals or privileged functions. Access is limited to device configuration parameters that are available in the context of the web application. The session cookie is secured by the httpOnly Flag. Therefore an attacker is not able to take over the session of an authenticated user.
- Product
- FL SWITCH 2005
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2025In the Linux kernel, the following vulnerability has been resolved: net: netsec: fix error handling in netsec_register_mdio() If phy_device_register() fails, CVE-2022-50624 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: net: netsec: fix error handling in netsec_register_mdio() If phy_device_register() fails, phy_device_free() need be called to put refcount, so memory of phy device and device name can be freed in callback function. If get_phy_device() fails, mdiobus_unregister() need be called, or it will cause warning in mdiobus_free() and kobject is leaked.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Sep 13, 2024In the Linux kernel, the following vulnerability has been resolved: selinux,smack: don't bypass permissions check in inode_setsecctx hook Marek Gresko reportsCVE-2024-46695 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Critical 9.8
In the Linux kernel, the following vulnerability has been resolved: selinux,smack: don't bypass permissions check in inode_setsecctx hook Marek Gresko reports that the root user on an NFS client is able to change the security labels on files on an NFS filesystem that is exported with root squashing enabled. The end of the kerneldoc comment for __vfs_setxattr_noperm() states: * This function requires the caller to lock the inode's i_mutex before it * is executed. It also assumes that the caller will make the appropriate * permission checks. nfsd_setattr() does do permissions checking via fh_verify() and nfsd_permission(), but those don't do all the same permissions checks that are done by security_inode_setxattr() and its related LSM hooks do. Since nfsd_setattr() is the only consumer of security_inode_setsecctx(), simplest solution appears to be to replace the call to __vfs_setxattr_noperm() with a call to __vfs_setxattr_locked(). This fixes the above issue and has the added benefit of causing nfsd to recall conflicting delegations on a file when a client tries to change its security label.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jun 15, 2024A vulnerability classified as critical has been found in Netentsec NS-ASG Application Security Gateway 6.3.CVE-2024-6007 · Other software · Netentsec · reported by VulDBMedium 5.3
A vulnerability classified as critical has been found in Netentsec NS-ASG Application Security Gateway 6.3. This affects an unknown part of the file /protocol/iscgwtunnel/deleteiscgwrouteconf.php. The manipulation of the argument messagecontent leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-268695. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- NS-ASG Application Security Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 8, 2024A vulnerability, which was classified as critical, was found in Netentsec NS-ASG Application Security Gateway 6.3.CVE-2024-5773 · Other software · Netentsec · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, was found in Netentsec NS-ASG Application Security Gateway 6.3. Affected is an unknown function of the file /protocol/firewall/deletemacbind.php. The manipulation of the argument messagecontent leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-267456. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- NS-ASG Application Security Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 8, 2024A vulnerability, which was classified as critical, has been found in Netentsec NS-ASG Application Security Gateway 6.3.CVE-2024-5772 · Other software · Netentsec · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, has been found in Netentsec NS-ASG Application Security Gateway 6.3. This issue affects some unknown processing of the file /protocol/iscuser/deleteiscuser.php. The manipulation of the argument messagecontent leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-267455. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- NS-ASG Application Security Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2024A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3.CVE-2024-5590 · Other software · Netentsec · reported by VulDBMedium 5.3
A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3. It has been declared as critical. This vulnerability affects unknown code of the file /protocol/iscuser/uploadiscuser.php of the component JSON Content Handler. The manipulation of the argument messagecontent leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-266848. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- NS-ASG Application Security Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2024A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3.CVE-2024-5589 · Other software · Netentsec · reported by VulDBMedium 5.3
A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3. It has been classified as critical. This affects an unknown part of the file /admin/config_MT.php?action=delete. The manipulation of the argument Mid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-266847. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- NS-ASG Application Security Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2024Insecure storage of the ICT MIFARE and DESFire encryption keys in the firmware binary allows malicious actors to create credentials for any site code and card nCVE-2024-29941 · Other software · Integrated Control Technology · reported by 56c94bcb-ac34-4d7f-b660-d297a6b7ff82High 8
Insecure storage of the ICT MIFARE and DESFire encryption keys in the firmware binary allows malicious actors to create credentials for any site code and card number that is using the default ICT encryption.
- Product
- TSEC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2024A vulnerability classified as critical was found in Netentsec NS-ASG Application Security Gateway 6.3.CVE-2024-3458 · Other software · Netentsec · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in Netentsec NS-ASG Application Security Gateway 6.3. This vulnerability affects unknown code of the file /admin/add_ikev2.php. The manipulation of the argument TunnelId leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-259714 is the identifier assigned to this vulnerability.
- Product
- NS-ASG Application Security Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2024A vulnerability classified as critical has been found in Netentsec NS-ASG Application Security Gateway 6.3.CVE-2024-3457 · Other software · Netentsec · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in Netentsec NS-ASG Application Security Gateway 6.3. This affects an unknown part of the file /admin/config_ISCGroupNoCache.php. The manipulation of the argument GroupId leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-259713 was assigned to this vulnerability.
- Product
- NS-ASG Application Security Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2024A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3.CVE-2024-3456 · Other software · Netentsec · reported by VulDBMedium 6.3
A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/config_Anticrack.php. The manipulation of the argument GroupId leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259712.
- Product
- NS-ASG Application Security Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2024A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3.CVE-2024-3455 · Other software · Netentsec · reported by VulDBMedium 6.3
A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/add_postlogin.php. The manipulation of the argument SingleLoginId leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259711.
- Product
- NS-ASG Application Security Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2024netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/edit_virtual_site_info.php.CVE-2024-30867 · Other software · netentsec · reported by MITRECritical 9.8
netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/edit_virtual_site_info.php.
- Product
- ns-asg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2024netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /WebPages/history.php.CVE-2024-30863 · Other software · Netentsec · reported by MITREMedium 6.3
netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /WebPages/history.php.
- Product
- Ns-asg Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2024netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /3g/index.php.CVE-2024-30862 · Other software · netentsec · reported by MITREHigh 8.8
netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /3g/index.php.
- Product
- ns-asg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2024netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/configguide/ipsec_guide_1.php.CVE-2024-30861 · Other software · Netentsec · reported by MITREMedium 5.3
netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/configguide/ipsec_guide_1.php.
- Product
- Ns-asg Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2024netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/export_excel_user.php.CVE-2024-30860 · Other software · netentsec · reported by MITREHigh 8.8
netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/export_excel_user.php.
- Product
- application_security_gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2024netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/config_ISCGroupSSLCert.php.CVE-2024-30859 · Other software · netentsec · reported by MITREHigh 8.8
netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/config_ISCGroupSSLCert.php.
- Product
- application_security_gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2024netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/edit_fire_wall.php.CVE-2024-30858 · Other software · ns_asg · reported by MITRECritical 9.8
netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/edit_fire_wall.php.
- Product
- ns_asg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2024netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /3g/menu.php.CVE-2024-30866 · Other software · netentsec · reported by MITREMedium 5.4
netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /3g/menu.php.
- Product
- ns-asg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2024netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/edit_user_login.php.CVE-2024-30865 · Other software · netentsec · reported by MITRECritical 9.8
netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/edit_user_login.php.
- Product
- ns-asg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2024netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/config_ISCGroupTimePolicy.php.CVE-2024-30864 · Other software · Netentsec · reported by MITREMedium 6.3
netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/config_ISCGroupTimePolicy.php.
- Product
- Ns-asg Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2024netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /include/authrp.php.CVE-2024-30872 · Other software · Netentsec · reported by MITREMedium 5.1
netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /include/authrp.php.
- Product
- Ns-asg Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2024netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /WebPages/applyhardware.php.CVE-2024-30871 · Other software · netentsec · reported by MITREHigh 8.8
netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /WebPages/applyhardware.php.
- Product
- application_security_gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2024netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/address_interpret.php.CVE-2024-30870 · Other software · netentsec · reported by MITREHigh 8.8
netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/address_interpret.php.
- Product
- application_security_gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2024netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/add_getlogin.php.CVE-2024-30868 · Other software · netentsec · reported by MITRECritical 9.8
netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/add_getlogin.php.
- Product
- ns-asg_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2024A vulnerability has been found in Netentsec NS-ASG Application Security Gateway 6.3 and classified as critical.CVE-2024-3041 · Other software · Netentsec · reported by VulDBMedium 6.3
A vulnerability has been found in Netentsec NS-ASG Application Security Gateway 6.3 and classified as critical. This vulnerability affects unknown code of the file /protocol/log/listloginfo.php. The manipulation leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-258430 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- NS-ASG Application Security Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2024A vulnerability, which was classified as critical, was found in Netentsec NS-ASG Application Security Gateway 6.3.CVE-2024-3040 · Other software · Netentsec · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, was found in Netentsec NS-ASG Application Security Gateway 6.3. This affects an unknown part of the file /admin/list_crl_conf. The manipulation of the argument CRLId leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-258429 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- NS-ASG Application Security Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2024A vulnerability has been found in Netentsec NS-ASG Application Security Gateway 6.3 and classified as critical.CVE-2024-2649 · Other software · Netentsec · reported by VulDBMedium 6.3
A vulnerability has been found in Netentsec NS-ASG Application Security Gateway 6.3 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /protocol/iscdevicestatus/deleteonlineuser.php. The manipulation of the argument messagecontent leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-257287. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- NS-ASG Application Security Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2024A vulnerability, which was classified as problematic, was found in Netentsec NS-ASG Application Security Gateway 6.3.CVE-2024-2648 · Other software · Netentsec · reported by VulDBMedium 4.3
A vulnerability, which was classified as problematic, was found in Netentsec NS-ASG Application Security Gateway 6.3. Affected is an unknown function of the file /nac/naccheck.php. The manipulation of the argument username leads to improper neutralization of data within xpath expressions. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-257286 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- NS-ASG Application Security Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2024A vulnerability, which was classified as critical, has been found in Netentsec NS-ASG Application Security Gateway 6.3.CVE-2024-2647 · Other software · Netentsec · reported by VulDBHigh 7.3
A vulnerability, which was classified as critical, has been found in Netentsec NS-ASG Application Security Gateway 6.3. This issue affects some unknown processing of the file /admin/singlelogin.php. The manipulation of the argument loginId leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-257285 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- NS-ASG Application Security Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2024A vulnerability classified as critical was found in Netentsec NS-ASG Application Security Gateway 6.3.CVE-2024-2646 · Other software · Netentsec · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in Netentsec NS-ASG Application Security Gateway 6.3. This vulnerability affects unknown code of the file /vpnweb/index.php?para=index. The manipulation of the argument check_VirtualSiteId leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-257284. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- NS-ASG Application Security Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2024A vulnerability classified as problematic has been found in Netentsec NS-ASG Application Security Gateway 6.3.CVE-2024-2645 · Other software · Netentsec · reported by VulDBMedium 4.3
A vulnerability classified as problematic has been found in Netentsec NS-ASG Application Security Gateway 6.3. This affects an unknown part of the file /vpnweb/resetpwd/resetpwd.php. The manipulation of the argument UserId leads to improper neutralization of data within xpath expressions. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-257283. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- NS-ASG Application Security Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2024A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3.CVE-2024-2644 · Other software · Netentsec · reported by VulDBMedium 6.3
A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3. It has been rated as critical. Affected by this issue is some unknown functionality of the file /protocol/firewall/addfirewall.php. The manipulation of the argument FireWallTableArray leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-257282 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- NS-ASG Application Security Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2024A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3.CVE-2024-2330 · Other software · Netentsec · reported by VulDBMedium 6.3
A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3. It has been classified as critical. This affects an unknown part of the file /protocol/index.php. The manipulation of the argument IPAddr leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-256281 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- NS-ASG Application Security Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2024A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3 and classified as critical.CVE-2024-2329 · Other software · Netentsec · reported by VulDBMedium 6.3
A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/list_resource_icon.php?action=delete. The manipulation of the argument IconId leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-256280. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- NS-ASG Application Security Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 29, 2024A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3.CVE-2024-2022 · Other software · Netentsec · reported by VulDBMedium 6.3
A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/list_ipAddressPolicy.php. The manipulation of the argument GroupId leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-255301 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- NS-ASG Application Security Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 29, 2024A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3.CVE-2024-2021 · Other software · Netentsec · reported by VulDBMedium 6.3
A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3. It has been classified as critical. Affected is an unknown function of the file /admin/list_localuser.php. The manipulation of the argument ResId leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-255300. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- NS-ASG Application Security Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2024An integer overflow vulnerability exists in the fstReaderIterBlocks2 time_table tsec_nitems functionality of GTKWave 3.3.115.CVE-2023-35128 · Other software · GTKWave · reported by talos-cna@cisco.comHigh 7
An integer overflow vulnerability exists in the fstReaderIterBlocks2 time_table tsec_nitems functionality of GTKWave 3.3.115. A specially crafted .fst file can lead to memory corruption. A victim would need to open a malicious file to trigger this vulnerability.
- Product
- GTKWave
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orgtalosintelligence.com
Dec 29, 2023A vulnerability classified as critical has been found in Netentsec NS-ASG Application Security Gateway 6.3.1.CVE-2023-7161 · Other software · Netentsec · reported by VulDBHigh 7.3
A vulnerability classified as critical has been found in Netentsec NS-ASG Application Security Gateway 6.3.1. This affects an unknown part of the file index.php?para=index of the component Login. The manipulation of the argument check_VirtualSiteId leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249183.
- Product
- NS-ASG Application Security Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 24, 2023A vulnerability classified as problematic was found in Netentsec NS-ASG Application Security Gateway 6.3.CVE-2023-7094 · Other software · Netentsec · reported by VulDBMedium 5.3
A vulnerability classified as problematic was found in Netentsec NS-ASG Application Security Gateway 6.3. Affected by this vulnerability is an unknown functionality of the file /protocol/nsasg6.0.tgz. The manipulation leads to information disclosure. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-248941 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- NS-ASG Application Security Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2023A vulnerability classified as critical has been found in Netentsec NS-ASG Application Security Gateway 6.3.1.CVE-2023-6903 · Other software · Netentsec · reported by VulDBHigh 7.3
A vulnerability classified as critical has been found in Netentsec NS-ASG Application Security Gateway 6.3.1. This affects an unknown part of the file /admin/singlelogin.php?submit=1. The manipulation of the argument loginId leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-248265 was assigned to this vulnerability.
- Product
- NS-ASG Application Security Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.