Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,701 results · page 10 of 35
Jan 30, 2025In versions 3.1.0 and lower of the Splunk Supporting Add-on for Active Directory, also known as SA-ldapsearch, a vulnerable regular expression pattern could leaCVE-2025-0367 · Other software · Splunk · reported by prodsec@splunk.comMedium 6.5
In versions 3.1.0 and lower of the Splunk Supporting Add-on for Active Directory, also known as SA-ldapsearch, a vulnerable regular expression pattern could lead to a Regular Expression Denial of Service (ReDoS) attack.
- Product
- Splunk Supporting Add-on for Active Directory
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2025Small Package Quotes – Worldwide Express Edition: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-24667 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in enituretechnology Small Package Quotes – Worldwide Express Edition small-package-quotes-wwe-edition allows SQL Injection.This issue affects Small Package Quotes – Worldwide Express Edition: from n/a through <= 5.2.17.
- Product
- Small Package Quotes – Worldwide Express Edition
- Affected
- up to 5.2.17
- What to do
- Affects up to 5.2.17. Update Small Package Quotes – Worldwide Express Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 27, 2025LTL Freight Quotes – Worldwide Express Edition: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-24664 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in enituretechnology LTL Freight Quotes – Worldwide Express Edition ltl-freight-quotes-worldwide-express-edition allows SQL Injection.This issue affects LTL Freight Quotes – Worldwide Express Edition: from n/a through <= 5.0.20.
- Product
- LTL Freight Quotes – Worldwide Express Edition
- Affected
- up to 5.0.20
- What to do
- Affects up to 5.0.20. Update LTL Freight Quotes – Worldwide Express Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025ASTEVAL is an evaluator of Python expressions and statements.CVE-2025-24359 · Other software · lmfit · reported by GitHubHigh 8.4
ASTEVAL is an evaluator of Python expressions and statements. Prior to version 1.0.6, if an attacker can control the input to the `asteval` library, they can bypass asteval's restrictions and execute arbitrary Python code in the context of the application using the library. The vulnerability is rooted in how `asteval` performs handling of `FormattedValue` AST nodes. In particular, the `on_formattedvalue` value uses the dangerous format method of the str class. The code allows an attacker to manipulate the value of the string used in the dangerous call `fmt.format(__fstring__=val)`. This vulnerability can be exploited to access protected attributes by intentionally triggering an `AttributeError` exception. The attacker can then catch the exception and use its `obj` attribute to gain arbitrary access to sensitive or protected object properties. Version 1.0.6 fixes this issue.
- Product
- asteval
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2025Vulnerability in Oracle Application Express (component: General).CVE-2025-21557 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 5.4
Vulnerability in Oracle Application Express (component: General). Supported versions that are affected are 23.2 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Application Express. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Application Express, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Application Express accessible data as well as unauthorized read access to a subset of Oracle Application Express accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
- Product
- Oracle Application Express
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2025An issue in parse-uri v1.0.9 allows attackers to cause a Regular expression Denial of Service (ReDoS) via a crafted URL.CVE-2024-36751 · Other software · reported by MITREMedium 6.5
An issue in parse-uri v1.0.9 allows attackers to cause a Regular expression Denial of Service (ReDoS) via a crafted URL.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jan 15, 2025In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Prevent integer overflow issue In the expression "cmd.wqe_size * cmd.wr_countCVE-2024-57890 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Prevent integer overflow issue In the expression "cmd.wqe_size * cmd.wr_count", both variables are u32 values that come from the user so the multiplication can lead to integer wrapping. Then we pass the result to uverbs_request_next_ptr() which also could potentially wrap. The "cmd.sge_count * sizeof(struct ib_uverbs_sge)" multiplication can also overflow on 32bit systems although it's fine on 64bit systems. This patch does two things. First, I've re-arranged the condition in uverbs_request_next_ptr() so that the use controlled variable "len" is on one side of the comparison by itself without any math. Then I've modified all the callers to use size_mul() for the multiplications.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jan 13, 2025Email Subscribers by Icegram Express: Does not sanitise and escape some of its Workflow settingsCVE-2024-12568 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Email Subscribers by Icegram Express WordPress plugin before 5.7.45 does not sanitise and escape some of its Workflow settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Email Subscribers by Icegram Express
- Fixed in
- 5.7.45
- What to do
- Update Email Subscribers by Icegram Express to 5.7.45 or newer.
Jan 13, 2025Email Subscribers by Icegram Express: Does not sanitise and escape some of its form settingsCVE-2024-12567 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Email Subscribers by Icegram Express WordPress plugin before 5.7.45 does not sanitise and escape some of its form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Email Subscribers by Icegram Express
- Fixed in
- 5.7.45
- What to do
- Update Email Subscribers by Icegram Express to 5.7.45 or newer.
Jan 13, 2025Email Subscribers by Icegram Express: Does not sanitise and escape some of form settingsCVE-2024-12566 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Email Subscribers by Icegram Express WordPress plugin before 5.7.45 does not sanitise and escape some of form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Email Subscribers by Icegram Express
- Fixed in
- 5.7.45
- What to do
- Update Email Subscribers by Icegram Express to 5.7.45 or newer.
Jan 13, 2025Email Subscribers by Icegram Express: Does not sanitise and escape some of its Text Block optionsCVE-2024-11636 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Email Subscribers by Icegram Express WordPress plugin before 5.7.45 does not sanitise and escape some of its Text Block options, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Email Subscribers by Icegram Express
- Fixed in
- 5.7.45
- What to do
- Update Email Subscribers by Icegram Express to 5.7.45 or newer.
Jan 7, 2025An issue in the validate_email function in CTFd/utils/validators/__init__.py of CTFd 3.7.3 allows attackers to cause a Regular expression Denial of Service (ReDCVE-2024-46242 · Other software · reported by MITREHigh 7.5
An issue in the validate_email function in CTFd/utils/validators/__init__.py of CTFd 3.7.3 allows attackers to cause a Regular expression Denial of Service (ReDoS) via supplying a crafted string as e-mail address during registration.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2025Email Subscribers by Icegram Express: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-12311 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Email Subscribers by Icegram Express WordPress plugin before 5.7.44 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
- Product
- Email Subscribers by Icegram Express
- Fixed in
- 5.7.44
- What to do
- Update Email Subscribers by Icegram Express to 5.7.44 or newer.
Jan 4, 2025IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.0.3 could allow a remote attacker to cause a denial of service using a complex regular expressiCVE-2024-41766 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.5
IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.0.3 could allow a remote attacker to cause a denial of service using a complex regular expression.
- Product
- Engineering Lifecycle Optimization Publishing
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2024A vulnerability was found in python-sql where unary operators do not escape non-Expression.CVE-2024-9774 · Other software · reported by Red HatMedium 6.5
A vulnerability was found in python-sql where unary operators do not escape non-Expression.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Dec 20, 2024IBM Cognos Analytics 11.2.0 through 11.2.4 FP4 and 12.0.0 through 12.0.4 is vulnerable to an Expression Language (EL) Injection vulnerability.CVE-2024-51466 · Other software · IBM · reported by psirt@us.ibm.comCritical 9
IBM Cognos Analytics 11.2.0 through 11.2.4 FP4 and 12.0.0 through 12.0.4 is vulnerable to an Expression Language (EL) Injection vulnerability. A remote attacker could exploit this vulnerability to expose sensitive information, consume memory resources, and/or cause the server to crash when using a specially crafted EL statement.
- Product
- Cognos Analytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2024A deserialization of untrusted data vulnerability exists in NI DAQExpress that may result in remote code execution.CVE-2024-12741 · Other software · NI · reported by security@ni.comHigh 8.4
A deserialization of untrusted data vulnerability exists in NI DAQExpress that may result in remote code execution. Successful exploitation requires an attacker to get a user to open a specially crafted project file. This vulnerability affects DAQExpress 5.1 and prior versions. Please note that DAQExpress is an EOL product and will not receive any updates.
- Product
- DAQExpress
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2024J&T Express Malaysia: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54305 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jtexpress J&T Express Malaysia jt-express allows Reflected XSS.This issue affects J&T Express Malaysia: from n/a through <= 2.0.13.
- Product
- J&T Express Malaysia
- Affected
- up to 2.0.13
- What to do
- Affects up to 2.0.13. Update J&T Express Malaysia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce: Missing AuthorizationCVE-2022-46811 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in VillaTheme(villatheme.com) ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce: from n/a through 1.0.21.
- Product
- ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce
- Affected
- up to 1.0.21
- What to do
- Affects up to 1.0.21. Update ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Minify HTML: Regular Expression Denial of Service (ReDoS)CVE-2024-12579 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Minify HTML plugin for WordPress is vulnerable to Regular Expression Denial of Service (ReDoS) in all versions up to, and including, 2.1.10. This is due to processing user-supplied input as a regular expression. This makes it possible for unauthenticated attackers to create comments that can cause catastrophic backtracking and break pages.
- Product
- Minify HTML
- Affected
- up to 2.1.10
- What to do
- Affects up to 2.1.10. Update Minify HTML to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 10, 2024Angular Expressions provides expressions for the Angular.JS web framework as a standalone module.CVE-2024-54152 · Other software · peerigon · reported by GitHubCritical 9.3
Angular Expressions provides expressions for the Angular.JS web framework as a standalone module. Prior to version 1.4.3, an attacker can write a malicious expression that escapes the sandbox to execute arbitrary code on the system. With a more complex (undisclosed) payload, one can get full access to Arbitrary code execution on the system. The problem has been patched in version 1.4.3 of Angular Expressions. Two possible workarounds are available. One may either disable access to `__proto__` globally or make sure that one uses the function with just one argument.
- Product
- angular-expressions
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2024Sharkdropship dropshipping for Aliexpress, eBay, Amazon, etsy: Missing AuthorizationCVE-2023-49848 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Marc dooder Sharkdropship dropshipping for Aliexpress, eBay, Amazon, etsy woo-aliexpress-dropshipping allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sharkdropship dropshipping for Aliexpress, eBay, Amazon, etsy: from n/a through <= 2.1.1.
- Product
- Sharkdropship dropshipping for Aliexpress, eBay, Amazon, etsy
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update Sharkdropship dropshipping for Aliexpress, eBay, Amazon, etsy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Sharkdropship for AliExpress Dropship and Affiliate: Missing AuthorizationCVE-2023-30870 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in wooproductimporter Sharkdropship for AliExpress Dropship and Affiliate allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sharkdropship for AliExpress Dropship and Affiliate: from n/a through 2.2.3.
- Product
- Sharkdropship for AliExpress Dropship and Affiliate
- Affected
- up to 2.2.3
- What to do
- Affects up to 2.2.3. Update Sharkdropship for AliExpress Dropship and Affiliate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 5, 2024path-to-regexp turns path strings into a regular expressions.CVE-2024-52798 · Other software · pillarjs · reported by GitHubHigh 7.7
path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. The regular expression that is vulnerable to backtracking can be generated in the 0.1.x release of path-to-regexp. Upgrade to 0.1.12. This vulnerability exists because of an incomplete fix for CVE-2024-45296.
- Product
- path-to-regexp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 28, 2024Express Payments Module: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-52474 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Сервис “Экспресс Платежи” Express Payments Module express-pay allows Blind SQL Injection.This issue affects Express Payments Module: from n/a through <= 1.1.8.
- Product
- Express Payments Module
- Affected
- up to 1.1.8
- What to do
- Affects up to 1.1.8. Update Express Payments Module to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 19, 2024Versions of the package @eslint/plugin-kit before 0.2.3 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization.CVE-2024-21539 · Other software · eslint · reported by report@snyk.ioHigh 7.7
Versions of the package @eslint/plugin-kit before 0.2.3 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by exploiting this vulnerability.
- Product
- rewrite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecurity.snyk.io
Nov 15, 2024A vulnerability in the REST API of Cisco Expressway Series and Cisco TelePresence VCS could allow an unauthenticated, remote attacker to conduct a croCVE-2022-20853 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.4
A vulnerability in the REST API of Cisco Expressway Series and Cisco TelePresence VCS could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. This vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected system. An attacker could exploit this vulnerability by persuading a user of the REST API to follow a crafted link. A successful exploit could allow the attacker to cause the affected system to reload. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
- Product
- Cisco TelePresence Video Communication Server (VCS) Expressway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.comsec.cloudapps.cisco.com
Nov 15, 2024A vulnerability in the certificate validation of Cisco Expressway-C and Cisco TelePresence VCS could allow an unauthenticated, remote attacker to gainCVE-2022-20814 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.4
A vulnerability in the certificate validation of Cisco Expressway-C and Cisco TelePresence VCS could allow an unauthenticated, remote attacker to gain unauthorized access to sensitive data. The vulnerability is due to a lack of validation of the SSL server certificate that an affected device receives when it establishes a connection to a Cisco Unified Communications Manager device. An attacker could exploit this vulnerability by using a man-in-the-middle technique to intercept the traffic between the devices, and then using a self-signed certificate to impersonate the endpoint. A successful exploit could allow the attacker to view the intercepted traffic in clear text or alter the contents of the traffic. Note: Cisco Expressway-E is not affected by this vulnerability.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
- Product
- Cisco TelePresence Video Communication Server (VCS) Expressway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.comsec.cloudapps.cisco.com
Nov 8, 2024Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper inpCVE-2024-21538 · Other software · cross-spawn · reported by report@snyk.ioHigh 7.7
Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.
- Product
- cross-spawn
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2024An issue was discovered on Epson Expression Home XP255 20.08.FM10I8 devices.CVE-2019-20460 · Other software · epson · reported by MITREHigh 8.8
An issue was discovered on Epson Expression Home XP255 20.08.FM10I8 devices. POST requests don't require (anti-)CSRF tokens or other mechanisms for validating that the request is from a legitimate source. In addition, CSRF attacks can be used to send text directly to the RAW printer interface. For example, an attack could deliver a worrisome printout to an end user.
- Product
- xp-255
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2024An issue in Espressif Esp idf v5.3.0 allows attackers to cause a Denial of Service (DoS) via a crafted data channel packet.CVE-2024-51428 · Other software · expressif · reported by MITREHigh 7.5
An issue in Espressif Esp idf v5.3.0 allows attackers to cause a Denial of Service (DoS) via a crafted data channel packet.
- Product
- esp_idf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2024An issue was discovered on Epson Expression Home XP255 20.08.FM10I8 devices.CVE-2019-20459 · Other software · epson · reported by MITREHigh 8.4
An issue was discovered on Epson Expression Home XP255 20.08.FM10I8 devices. With the SNMPv1 public community, all values can be read, and with the epson community, all the changeable values can be written/updated, as demonstrated by permanently disabling the network card or changing the DNS servers.
- Product
- xp-255
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2024An issue was discovered on Epson Expression Home XP255 20.08.FM10I8 devices.CVE-2019-20458 · Other software · epson · reported by MITREHigh 8.8
An issue was discovered on Epson Expression Home XP255 20.08.FM10I8 devices. By default, the device comes (and functions) without a password. The user is at no point prompted to set up a password on the device (leaving a number of devices without a password). In this case, anyone connecting to the web admin panel is capable of becoming admin without using any credentials.
- Product
- xp-255
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2024In agentscope <=v0.0.4, the file agentscope\web\workstation\workflow_utils.py has the function is_callable_expression.CVE-2024-48050 · Other software · modelscope · reported by MITRECritical 9.8
In agentscope <=v0.0.4, the file agentscope\web\workstation\workflow_utils.py has the function is_callable_expression. Within this function, the line result = eval(s) poses a security risk as it can directly execute user-provided commands.
- Product
- agentscope
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comrumbling-slice-eb0.notion.site
Oct 29, 2024A vulnerability has been identified in the Express response.links function, allowing for arbitrary resource injection in the Link header when unsanitized data iCVE-2024-10491 · Other software · express · reported by 36c7be3b-2937-45df-85ea-ca7133ea542cMedium 4
A vulnerability has been identified in the Express response.links function, allowing for arbitrary resource injection in the Link header when unsanitized data is used. The issue arises from improper sanitization in `Link` header values, which can allow a combination of characters like `,`, `;`, and `<>` to preload malicious resources. This vulnerability is especially relevant for dynamic parameters.
- Product
- express
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2024A bug in query analysis of certain complex self-referential $lookup subpipelines may result in literal values in expressions for encrypted fields to be sent to CVE-2024-8013 · Other software · MongoDB Inc · reported by cna@mongodb.comLow 2.2
A bug in query analysis of certain complex self-referential $lookup subpipelines may result in literal values in expressions for encrypted fields to be sent to the server as plaintext instead of ciphertext. Should this occur, no documents would be returned or written. This issue affects mongocryptd binary (v5.0 versions prior to 5.0.29, v6.0 versions prior to 6.0.17, v7.0 versions prior to 7.0.12 and v7.3 versions prior to 7.3.4) and mongo_crypt_v1.so shared libraries (v6.0 versions prior to 6.0.17, v7.0 versions prior to 7.0.12 and v7.3 versions prior to 7.3.4) released alongside MongoDB Enterprise Server versions.
- Product
- mongocryptd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2024In the Linux kernel, the following vulnerability has been resolved: PCI: keystone: Fix if-statement expression in ks_pcie_quirk() This code accidentally uses CVE-2024-47756 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: PCI: keystone: Fix if-statement expression in ks_pcie_quirk() This code accidentally uses && where || was intended. It potentially results in a NULL dereference. Thus, fix the if-statement expression to use the correct condition. [kwilczynski: commit log]
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Oct 18, 2024The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input.CVE-2024-9264 · Other software · Grafana · reported by security@grafana.comCritical 9.4
The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack. The `duckdb` binary must be present in Grafana's $PATH for this attack to function; by default, this binary is not installed in Grafana distributions.
- Product
- Grafana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgrafana.comsecurity.netapp.com
Oct 15, 2024Vulnerability in Oracle Application Express (component: General).CVE-2024-21261 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 4.9
Vulnerability in Oracle Application Express (component: General). Supported versions that are affected are 23.2 and 24.1. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Application Express. While the vulnerability is in Oracle Application Express, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Application Express accessible data as well as unauthorized read access to a subset of Oracle Application Express accessible data. CVSS 3.1 Base Score 4.9 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N).
- Product
- Oracle Application Express
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2024Improper regular expression in Vue's parseHTML function leads to a potential regular expression denial of service vulnerability.CVE-2024-9506 · Other software · vue · reported by 36c7be3b-2937-45df-85ea-ca7133ea542cLow 3.7
Improper regular expression in Vue's parseHTML function leads to a potential regular expression denial of service vulnerability.
- Product
- vue
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2024In Progress Telerik Reporting versions prior to 2024 Q3 (18.2.24.924), a code execution attack is possible using object injection via insecure expression evaluaCVE-2024-8048 · Other software · Progress Software · reported by security@progress.comHigh 7.8
In Progress Telerik Reporting versions prior to 2024 Q3 (18.2.24.924), a code execution attack is possible using object injection via insecure expression evaluation.
- Product
- Telerik Reporting
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.telerik.comsecurity.netapp.com
Oct 8, 2024An issue in the getcolor function in utils.py of xhtml2pdf v0.2.13 allows attackers to cause a Regular expression Denial of Service (ReDOS) via supplying a crafCVE-2024-25885 · Other software · xhtml2pdf · reported by MITREHigh 7.5
An issue in the getcolor function in utils.py of xhtml2pdf v0.2.13 allows attackers to cause a Regular expression Denial of Service (ReDOS) via supplying a crafted string.
- Product
- xhtml2pdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2024URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Express.CVE-2024-9266 · Other software · expressjs · reported by 36c7be3b-2937-45df-85ea-ca7133ea542cMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Express. This vulnerability affects the use of the Express Response object. This issue impacts Express: from 3.4.5 before 4.0.0.
- Product
- express
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2024A vulnerability in the restricted shell of Cisco Expressway Series could allow an authenticated, local attacker to perform command injection attacks on the undeCVE-2024-20492 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6
A vulnerability in the restricted shell of Cisco Expressway Series could allow an authenticated, local attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit this vulnerability, the attacker must have Administrator-level credentials with read-write privileges on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a series of crafted CLI commands. A successful exploit could allow the attacker to escape the restricted shell and gain root privileges on the underlying operating system of the affected device. Note: Cisco Expressway Series refers to Cisco Expressway Control (Expressway-C) devices and Cisco Expressway Edge (Expressway-E) devices.
- Product
- Cisco TelePresence Video Communication Server (VCS) Expressway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Oct 2, 2024Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce: Arbitrary shortcode executionCVE-2024-8254 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.7.34. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes.
- Product
- Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce
- Affected
- up to 5.7.34
- What to do
- Affects up to 5.7.34. Update Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 30, 2024basic-auth-connect is Connect's Basic Auth middleware in its own module.CVE-2024-47178 · Other software · expressjs · reported by GitHubHigh 8.7
basic-auth-connect is Connect's Basic Auth middleware in its own module. basic-auth-connect < 1.1.0 uses a timing-unsafe equality comparison that can leak timing information. This issue has been fixed in basic-auth-connect 1.1.0.
- Product
- basic-auth-connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 26, 2024Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce: Unauthorized access of dataCVE-2024-8771 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'preview_email_template_design' function in all versions up to, and including, 5.7.34. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract sensitive data including the content of private, password protected, pending, and draft posts and pages.
- Product
- Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce
- Affected
- up to 5.7.34
- What to do
- Affects up to 5.7.34. Update Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 10, 2024body-parser is Node.js body parsing middleware.CVE-2024-45590 · Other software · expressjs · reported by GitHubHigh 7.5
body-parser is Node.js body parsing middleware. body-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service. This issue is patched in 1.20.3.
- Product
- body-parser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024serve-static serves static files.CVE-2024-43800 · Other software · expressjs · reported by GitHubMedium 5
serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect() may execute untrusted code. This issue is patched in serve-static 1.16.0.
- Product
- serve-static
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024Express.js minimalist web framework for node.CVE-2024-43796 · Other software · expressjs · reported by GitHubMedium 5
Express.js minimalist web framework for node. In express < 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code. This issue is patched in express 4.20.0.
- Product
- express
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.