Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
15 results
Oct 29, 2024The Vagrant VMWare Utility Windows installer targeted a custom location with a non-protected path that could be modified by an unprivileged user, introducing poCVE-2024-10228 · Other software · HashiCorp · reported by security@hashicorp.comLow 3.8
The Vagrant VMWare Utility Windows installer targeted a custom location with a non-protected path that could be modified by an unprivileged user, introducing potential for unauthorized file system writes. This vulnerability, CVE-2024-10228, was fixed in Vagrant VMWare Utility 1.0.23
- Product
- Vagrant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2023HashiCorp Vagrant's Windows installer targeted a custom location with a non-protected path that could be junctioned, introducing potential for unauthorized fileCVE-2023-5834 · Other software · HashiCorp · reported by security@hashicorp.comLow 3.8
HashiCorp Vagrant's Windows installer targeted a custom location with a non-protected path that could be junctioned, introducing potential for unauthorized file system writes. Fixed in Vagrant 2.4.0.
- Product
- Vagrant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.hashicorp.comdiscuss.hashicorp.com
Jan 26, 2023All versions of the package vagrant.js are vulnerable to Command Injection via the boxAdd function due to improper input sanitization.CVE-2022-25962 · Other software · Vagrant.js Project · reported by report@snyk.ioHigh 7.4
All versions of the package vagrant.js are vulnerable to Command Injection via the boxAdd function due to improper input sanitization.
- Product
- Vagrant.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.snyk.iosecurity.snyk.io
Oct 11, 2022An issue was discovered in Hashicorp Packer before 2.3.1.CVE-2022-42717 · Other software · Hashicorp · reported by MITREHigh 7.8
An issue was discovered in Hashicorp Packer before 2.3.1. The recommended sudoers configuration for Vagrant on Linux is insecure. If the host has been configured according to this documentation, non-privileged users on the host can leverage a wildcard in the sudoers configuration to execute arbitrary commands as root.
- Product
- Vagrant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.hashicorp.comgithub.com
Jul 28, 2022In JetBrains IntelliJ IDEA before 2022.2 local code execution via a Vagrant executable was possibleCVE-2022-37009 · Other software · JetBrains · reported by cve@jetbrains.comLow 3.9
In JetBrains IntelliJ IDEA before 2022.2 local code execution via a Vagrant executable was possible
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
Mar 8, 2021The `com.bmuschko:gradle-vagrant-plugin` Gradle plugin contains an information disclosure vulnerability due to the logging of the system environment variables.CVE-2021-21361 · Other software · JLLeitschuh · reported by GitHubMedium 5.3
The `com.bmuschko:gradle-vagrant-plugin` Gradle plugin contains an information disclosure vulnerability due to the logging of the system environment variables. When this Gradle plugin is executed in public CI/CD, this can lead to sensitive credentials being exposed to malicious actors. This is fixed in version 3.0.0.
- Product
- security-research
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 29, 2018It is possible to exploit an unsanitized PATH in the suid binary that ships with vagrant-vmware-fusion 4.0.25 through 5.0.4 in order to escalate to root privileCVE-2017-16873 · Other software · Hashicorp · reported by MITREHigh 7.8
It is possible to exploit an unsanitized PATH in the suid binary that ships with vagrant-vmware-fusion 4.0.25 through 5.0.4 in order to escalate to root privileges.
- Product
- Vagrant VMware Fusion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 29, 2018Hashicorp vagrant-vmware-fusion 5.0.4 allows local users to steal root privileges if VMware Fusion is not installed.CVE-2017-16839 · Other software · Hashicorp · reported by MITREHigh 7
Hashicorp vagrant-vmware-fusion 5.0.4 allows local users to steal root privileges if VMware Fusion is not installed.
- Product
- Vagrant VMware Fusion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 29, 2018The vagrant update process in Hashicorp vagrant-vmware-fusion 5.0.2 through 5.0.4 allows local users to steal root privileges via a crafted update request when CVE-2017-16512 · Other software · Hashicorp · reported by MITREHigh 7.8
The vagrant update process in Hashicorp vagrant-vmware-fusion 5.0.2 through 5.0.4 allows local users to steal root privileges via a crafted update request when no updates are available.
- Product
- Vagrant VMware Fusion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2017If HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 5.0.3 is installed but VMware Fusion is not, a local attacker can create a fake applicatioCVE-2017-16777 · Other software · Hashicorp · reported by MITREHigh 7.8
If HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 5.0.3 is installed but VMware Fusion is not, a local attacker can create a fake application directory and exploit the suid sudo helper in order to escalate to root.
- Product
- Vagrant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordm4.rkw.ioexploit-db.com
Nov 6, 2017In HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 5.0.1, a local attacker or malware can silently subvert the plugin update process in orderCVE-2017-16001 · Other software · Hashicorp · reported by MITREHigh 7.8
In HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 5.0.1, a local attacker or malware can silently subvert the plugin update process in order to escalate to root privileges.
- Product
- Vagrant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordm4.rkw.ioexploit-db.com
Oct 31, 2017In HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 5.0.0, a local attacker or malware can silently subvert the plugin update process in orderCVE-2017-15884 · Other software · Hashicorp · reported by MITREHigh 7
In HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 5.0.0, a local attacker or malware can silently subvert the plugin update process in order to escalate to root privileges.
- Product
- Vagrant VMware Fusion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordm4.rkw.ioexploit-db.com
Oct 19, 2017An insecure suid wrapper binary in the HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 4.0.24 and earlier allows a non-root user to obtain a CVE-2017-12579 · Other software · Hashicorp · reported by MITREHigh 7.8
An insecure suid wrapper binary in the HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 4.0.24 and earlier allows a non-root user to obtain a root shell.
- Product
- Vagrant VMware Fusion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordm4.rkw.ioexploit-db.com
Aug 8, 2017HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) before 4.0.24 uses weak permissions for the sudo helper scripts, allows local users to executCVE-2017-11741 · Other software · Hashicorp · reported by MITREHigh 8.8
HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) before 4.0.24 uses weak permissions for the sudo helper scripts, allows local users to execute arbitrary code with root privileges by overwriting one of the scripts.
- Product
- Vagrant VMware Fusion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2017The sudo helper in the HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) before 4.0.21 allows local users to gain root privileges by leveragingCVE-2017-7642 · Other software · Hashicorp · reported by MITREHigh 7.8
The sudo helper in the HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) before 4.0.21 allows local users to gain root privileges by leveraging failure to verify the path to the encoded ruby script or scrub the PATH variable.
- Product
- Vagrant VMware Fusion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orggithub.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.