Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,144 results · page 11 of 23
Aug 12, 2024Zohocorp ManageEngine ADAudit Plus versions below 8110 are vulnerable to authenticated SQL Injection in attack surface analyzer's export option.CVE-2024-5487 · Other software · ManageEngine · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 8.3
Zohocorp ManageEngine ADAudit Plus versions below 8110 are vulnerable to authenticated SQL Injection in attack surface analyzer's export option.
- Product
- ADAudit Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2024An Incorrect Access Control vulnerability in "/admin/programm/<program_id>/export/statistics" in Feripro <= v2.2.3 allows remote attackers to export an XLSX filCVE-2024-41518 · Other software · feripro · reported by MITREHigh 7.5
An Incorrect Access Control vulnerability in "/admin/programm/<program_id>/export/statistics" in Feripro <= v2.2.3 allows remote attackers to export an XLSX file with information about registrations and participants.
- Product
- feripro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2024In the Linux kernel, the following vulnerability has been resolved: drm/fbdev-dma: Only set smem_start is enable per module option Only export struct fb_info.CVE-2024-41094 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: drm/fbdev-dma: Only set smem_start is enable per module option Only export struct fb_info.fix.smem_start if that is required by the user and the memory does not come from vmalloc(). Setting struct fb_info.fix.smem_start breaks systems where DMA memory is backed by vmalloc address space. An example error is shown below. [ 3.536043] ------------[ cut here ]------------ [ 3.540716] virt_to_phys used for non-linear address: 000000007fc4f540 (0xffff800086001000) [ 3.552628] WARNING: CPU: 4 PID: 61 at arch/arm64/mm/physaddr.c:12 __virt_to_phys+0x68/0x98 [ 3.565455] Modules linked in: [ 3.568525] CPU: 4 PID: 61 Comm: kworker/u12:5 Not tainted 6.6.23-06226-g4986cc3e1b75-dirty #250 [ 3.577310] Hardware name: NXP i.MX95 19X19 board (DT) [ 3.582452] Workqueue: events_unbound deferred_probe_work_func [ 3.588291] pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 3.595233] pc : __virt_to_phys+0x68/0x98 [ 3.599246] lr : __virt_to_phys+0x68/0x98 [ 3.603276] sp : ffff800083603990 [ 3.677939] Call trace: [ 3.680393] __virt_to_phys+0x68/0x98 [ 3.684067] drm_fbdev_dma_hel
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jul 26, 2024An issue in Solar-Log 1000 before v2.8.2 and build 52-23.04.2013 was discovered to store plaintext passwords in the export.html, email.html, and sms.html files CVE-2024-40116 · Other software · solar-log · reported by MITREHigh 8.1
An issue in Solar-Log 1000 before v2.8.2 and build 52-23.04.2013 was discovered to store plaintext passwords in the export.html, email.html, and sms.html files -- fixed with 3.0.0-60 11.10.2013 for SL 200, 500, 1000 / not existing for SL 250, 300, 1200, 2000, SL 50 Gateway, SL Base.
- Product
- solar-log_1000_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsolar-log.com
Jul 24, 2024An information disclosure vulnerability in GitLab CE/EE in project/group exports affecting all versions from 15.4 prior to 17.0.5, 17.1 prior to 17.1.3, and 17.CVE-2024-7060 · Websites & servers · GitLab · reported by cve@gitlab.comLow 2.6
An information disclosure vulnerability in GitLab CE/EE in project/group exports affecting all versions from 15.4 prior to 17.0.5, 17.1 prior to 17.1.3, and 17.2 prior to 17.2.1 allows unauthorized users to view the resultant export.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2024Template Kit – Export: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37550 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Envato Template Kit – Export allows Stored XSS.This issue affects Template Kit – Export: from n/a through 1.0.22.
- Product
- Template Kit – Export
- Affected
- up to 1.0.22
- What to do
- Affects up to 1.0.22. Update Template Kit – Export to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 15, 2024Improper filtering of fields when using the export function in the ticket overview of the external interface in OTRS could allow an authorized user to download CVE-2024-6540 · Other software · OTRS AG · reported by security@otrs.comMedium 5.7
Improper filtering of fields when using the export function in the ticket overview of the external interface in OTRS could allow an authorized user to download a list of tickets containing information about tickets of other customers. The problem only occurs if the TicketSearchLegacyEngine has been disabled by the administrator. This issue affects OTRS: 8.0.X, 2023.X, from 2024.X through 2024.4.x
- Product
- OTRS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2024OpenSearch Dashboards Reports allows ‘Report Owner’ export and share reports from OpenSearch Dashboards.CVE-2024-39900 · Other software · opensearch-project · reported by GitHubMedium 5.4
OpenSearch Dashboards Reports allows ‘Report Owner’ export and share reports from OpenSearch Dashboards. An issue in the OpenSearch reporting plugin allows unintended access to private tenant resources like notebooks. The system did not properly check if the user was the resource author when accessing resources in a private tenant, leading to potential data being revealed. The patches are included in OpenSearch 2.14.
- Product
- reporting
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2024In DevmemIntUnexportCtx of devicemem_server.c, there is a possible arbitrary code execution due to a race condition.CVE-2024-34725 · Computers, phones & browsers · Google · reported by security@android.comHigh 7
In DevmemIntUnexportCtx of devicemem_server.c, there is a possible arbitrary code execution due to a race condition. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Jul 3, 2024Insecure Permissions vulnerability in Micro-Star International Co., Ltd MSI Center v.2.0.36.0 allows a local attacker to escalate privileges via the Export SystCVE-2024-37726 · Other software · micro_star_international_co · reported by MITREMedium 6.8
Insecure Permissions vulnerability in Micro-Star International Co., Ltd MSI Center v.2.0.36.0 allows a local attacker to escalate privileges via the Export System Info function in MSI.CentralServer.exe
- Product
- msi_center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2024Improper verification of intent by broadcast receiver vulnerability in GalaxyStore prior to version 4.5.81.0 allows local attackers to launch unexported activitCVE-2024-34601 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5.9
Improper verification of intent by broadcast receiver vulnerability in GalaxyStore prior to version 4.5.81.0 allows local attackers to launch unexported activities of GalaxyStore.
- Product
- GalaxyStore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Jun 24, 2024An issue in Wavlink WN551K1 allows a remote attacker to obtain sensitive information via the ExportAllSettings.sh component.CVE-2024-38892 · Other software · wavlink · reported by MITREMedium 6.5
An issue in Wavlink WN551K1 allows a remote attacker to obtain sensitive information via the ExportAllSettings.sh component.
- Product
- wn551k1_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2024Export WP Page to Static HTML/CSS: Open RedirectCVE-2024-3597 · WordPress plugins & themes · reported by WordfenceHigh 7.1
The Export WP Page to Static HTML/CSS plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 2.2.2. This is due to insufficient validation on the redirect url supplied via the rc_exported_zip_file parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.
- Product
- Export WP Page to Static HTML/CSS
- Affected
- up to 2.2.2
- What to do
- Affects up to 2.2.2. Update Export WP Page to Static HTML/CSS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 19, 2024In the module "Bulk Export products to Google Merchant-Google Shopping" (bagoogleshopping) up to version 1.0.26 from Buy Addons for PrestaShop, a guest can perfCVE-2024-34993 · Other software · bamboosolutions · reported by MITREMedium 6.3
In the module "Bulk Export products to Google Merchant-Google Shopping" (bagoogleshopping) up to version 1.0.26 from Buy Addons for PrestaShop, a guest can perform SQL injection via`GenerateCategories::renderCategories().
- Product
- bulk_export
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2024A Prototype Pollution issue in flatten-json 1.0.1 allows an attacker to execute arbitrary code via module.exports.unflattenJSON (flatten-json/index.js:42)CVE-2024-36574 · Other software · amirziai · reported by MITREMedium 6.3
A Prototype Pollution issue in flatten-json 1.0.1 allows an attacker to execute arbitrary code via module.exports.unflattenJSON (flatten-json/index.js:42)
- Product
- flatten_json
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jun 17, 2024Improper removal of sensitive information in data source export feature in Devolutions Remote Desktop Manager 2024.1.32.0 and earlier on Windows allows an attacCVE-2024-6055 · Other software · Devolutions · reported by security@devolutions.netMedium 4.7
Improper removal of sensitive information in data source export feature in Devolutions Remote Desktop Manager 2024.1.32.0 and earlier on Windows allows an attacker that obtains the exported settings to recover powershell credentials configured on the data source via stealing the configuration file.
- Product
- Remote Desktop Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevolutions.netdevolutions.net
Jun 11, 2024Import and export users and customers: Missing AuthorizationCVE-2024-34815 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Javier Carazo Import and export users and customers import-users-from-csv-with-meta.This issue affects Import and export users and customers: from n/a through <= 1.26.5.
- Product
- Import and export users and customers
- Affected
- up to 1.26.5
- What to do
- Affects up to 1.26.5. Update Import and export users and customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 11, 2024Aspose.Words Exporter: Missing AuthorizationCVE-2024-32146 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Aspose.Cloud Marketplace Aspose.Words Exporter.This issue affects Aspose.Words Exporter: from n/a through 6.3.1.
- Product
- Aspose.Words Exporter
- Affected
- up to 6.3.1
- What to do
- Affects up to 6.3.1. Update Aspose.Words Exporter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 9, 2024Products, Order & Customers Export for WooCommerce: Missing AuthorizationCVE-2024-31276 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WPFactory Products, Order & Customers Export for WooCommerce.This issue affects Products, Order & Customers Export for WooCommerce: from n/a through 2.0.8.
- Product
- Products, Order & Customers Export for WooCommerce
- Affected
- up to 2.0.8
- What to do
- Affects up to 2.0.8. Update Products, Order & Customers Export for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 8, 2024Import and export users and customers: Missing AuthorizationCVE-2024-22151 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Codection Import and export users and customers.This issue affects Import and export users and customers: from n/a through 1.24.6.
- Product
- Import and export users and customers
- Affected
- up to 1.24.6
- What to do
- Affects up to 1.24.6. Update Import and export users and customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 7, 2024Market Exporter: Unauthorized loss of dataCVE-2024-5637 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Market Exporter plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'remove_files' function in all versions up to, and including, 2.0.19. This makes it possible for authenticated attackers, with Subscriber-level access and above, to use path traversal to delete arbitrary files on the server.
- Product
- Market Exporter
- Affected
- up to 2.0.19
- What to do
- Affects up to 2.0.19. Update Market Exporter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 5, 2024The OpenTelemetry Collector offers a vendor-agnostic implementation on how to receive, process and export telemetry data.CVE-2024-36129 · Other software · open-telemetry · reported by GitHubHigh 8.2
The OpenTelemetry Collector offers a vendor-agnostic implementation on how to receive, process and export telemetry data. An unsafe decompression vulnerability allows unauthenticated attackers to crash the collector via excessive memory consumption. OTel Collector version 0.102.1 fixes this issue. It is also fixed in the confighttp module version 0.102.0 and configgrpc module version 0.102.1.
- Product
- opentelemetry-collector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2024In ZKTeco ZKBio CVSecurity v6.1.1_R and earlier (fixed in 6.1.3_R) an authenticated user can bypass password checks while exporting data from the application.CVE-2024-35430 · Other software · zkteco · reported by MITREHigh 8.1
In ZKTeco ZKBio CVSecurity v6.1.1_R and earlier (fixed in 6.1.3_R) an authenticated user can bypass password checks while exporting data from the application.
- Product
- zkbio_cvsecurity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2024The Progress MOVEit Automation configuration export function prior to 2024.0.0 uses a cryptographic method with insufficient bit length.CVE-2024-4563 · Other software · Progress Software Corporation · reported by security@progress.comMedium 6.1
The Progress MOVEit Automation configuration export function prior to 2024.0.0 uses a cryptographic method with insufficient bit length.
- Product
- MOVEit Automation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.progress.comprogress.com
May 22, 2024Ghost before 5.82.0 allows CSV Injection during a member CSV export.CVE-2024-34448 · Other software · ghost · reported by MITREHigh 8.8
Ghost before 5.82.0 allows CSV Injection during a member CSV export.
- Product
- ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2024Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL Injection while exporting a full summary report.CVE-2023-49334 · Other software · ManageEngine · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 8.3
Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL Injection while exporting a full summary report.
- Product
- ADAudit Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
May 16, 2024Order Export & Order Import for WooCommerce: Deserialization of Untrusted DataCVE-2024-34751 · WordPress plugins & themes · reported by PatchstackMedium 4.4
Deserialization of Untrusted Data vulnerability in WebToffee Order Export & Order Import for WooCommerce.This issue affects Order Export & Order Import for WooCommerce: from n/a through 2.4.9.
- Product
- Order Export & Order Import for WooCommerce
- Affected
- up to 2.4.9
- What to do
- Affects up to 2.4.9. Update Order Export & Order Import for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 14, 2024Import and export users and customers: Stored Cross-Site ScriptingCVE-2024-4734 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.26.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- Import and export users and customers
- Affected
- up to 1.26.6.1
- What to do
- Affects up to 1.26.6.1. Update Import and export users and customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
May 14, 2024Import and export users and customers: Stored Cross-Site ScriptingCVE-2024-4656 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user agent header in all versions up to, and including, 1.26.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator access and higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Import and export users and customers
- Affected
- up to 1.26.6.1
- What to do
- Affects up to 1.26.6.1. Update Import and export users and customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
May 7, 2024J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the export function.CVE-2024-33146 · Other software · j2eefast · reported by MITRECritical 9.1
J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the export function.
- Product
- j2eefast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2024Improper export of android application components vulnerability in TelephonyUI prior to SMR May-2024 Release 1 allows local attackers to reboot the device withoCVE-2024-20860 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4
Improper export of android application components vulnerability in TelephonyUI prior to SMR May-2024 Release 1 allows local attackers to reboot the device without proper permission.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
May 6, 2024E-Mails exported as PDF were stored in a cache that did not consider specific session information for the related user account.CVE-2024-23193 · Other software · Open-Xchange GmbH · reported by security@open-xchange.comMedium 5.3
E-Mails exported as PDF were stored in a cache that did not consider specific session information for the related user account. Users of the same service node could access other users E-Mails in case they were exported as PDF for a brief moment until caches were cleared. Successful exploitation requires good timing and modification of multiple request parameters. Please deploy the provided updates and patch releases. The cache for PDF exports now takes user session information into consideration when performing authorization decisions. No publicly available exploits are known.
- Product
- OX App Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgdocumentation.open-xchange.com
May 4, 2024Import and export users and customers: Unauthorized modification of dataCVE-2024-1050 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Import and export users and customers plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_force_reset_password_delete_metas() function in all versions up to, and including, 1.26.5. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete all forced password resets. CVE-2024-34815 is a duplicate of this issue.
- Product
- Import and export users and customers
- Affected
- up to 1.26.5
- What to do
- Affects up to 1.26.5. Update Import and export users and customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 3, 2024 An improper export vulnerability was reported in the Motorola Enterprise MotoDpms Provider (com.motorola.server.enterprise.MotoDpmsProvider) that could allow aCVE-2024-3479 · Other software · Motorola · reported by psirt@lenovo.comLow 2.8
An improper export vulnerability was reported in the Motorola Enterprise MotoDpms Provider (com.motorola.server.enterprise.MotoDpmsProvider) that could allow a local attacker to read local data.
- Product
- Phones
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorden-us.support.motorola.comen-us.support.motorola.com
May 3, 2024 An implicit intent export vulnerability was reported in the Motorola Phone application, that could allow unauthorized access to a non-exported content providerCVE-2023-41828 · Other software · Motorola · reported by psirt@lenovo.comMedium 4.4
An implicit intent export vulnerability was reported in the Motorola Phone application, that could allow unauthorized access to a non-exported content provider.
- Product
- Phones
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorden-us.support.motorola.comen-us.support.motorola.com
May 3, 2024A PendingIntent hijacking vulnerability in Motorola Device Help (Genie) application that could allow local attackers to access files or interact with non-exportCVE-2023-41826 · Other software · Motorola · reported by psirt@lenovo.comMedium 5.1
A PendingIntent hijacking vulnerability in Motorola Device Help (Genie) application that could allow local attackers to access files or interact with non-exported software components without permission.
- Product
- Phones
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorden-us.support.motorola.comen-us.support.motorola.com
May 3, 2024 An improper export vulnerability was reported in the Motorola Phone Extension application, that could allow a local attacker to execute unauthorized ActivitiesCVE-2023-41823 · Other software · Motorola · reported by psirt@lenovo.comMedium 4.4
An improper export vulnerability was reported in the Motorola Phone Extension application, that could allow a local attacker to execute unauthorized Activities.
- Product
- Phones
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorden-us.support.motorola.comen-us.support.motorola.com
May 3, 2024 An improper export vulnerability was reported in the Motorola Interface Test Tool application that could allow a malicious local application to execute OS commCVE-2023-41822 · Other software · Motorola · reported by psirt@lenovo.comMedium 4.8
An improper export vulnerability was reported in the Motorola Interface Test Tool application that could allow a malicious local application to execute OS commands.
- Product
- Phones
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorden-us.support.motorola.comen-us.support.motorola.com
May 3, 2024 A an improper export vulnerability was reported in the Motorola Setup application that could allow a local attacker to read sensitive user information.CVE-2023-41821 · Other software · Motorola · reported by psirt@lenovo.comMedium 5
A an improper export vulnerability was reported in the Motorola Setup application that could allow a local attacker to read sensitive user information.
- Product
- Phones
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorden-us.support.motorola.comen-us.support.motorola.com
May 3, 2024An improper export vulnerability was reported in the Motorola Phone Calls application that could allow a local attacker to read unauthorized information.CVE-2023-41817 · Other software · Motorola · reported by psirt@lenovo.comLow 2.8
An improper export vulnerability was reported in the Motorola Phone Calls application that could allow a local attacker to read unauthorized information.
- Product
- Phones
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorden-us.support.motorola.comen-us.support.motorola.com
May 3, 2024 An improper export vulnerability was reported in the Motorola Services Main application that could allow a local attacker to write to a local database.CVE-2023-41816 · Other software · Motorola · reported by psirt@lenovo.comMedium 5
An improper export vulnerability was reported in the Motorola Services Main application that could allow a local attacker to write to a local database.
- Product
- Phones
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorden-us.support.motorola.comen-us.support.motorola.com
May 2, 2024A10 Thunder ADC FileMgmtExport Directory Traversal Arbitrary File Read and Deletion Vulnerability.CVE-2023-42130 · Other software · A10 · reported by zdi-disclosures@trendmicro.comHigh 8.8
A10 Thunder ADC FileMgmtExport Directory Traversal Arbitrary File Read and Deletion Vulnerability. This vulnerability allows remote attackers to read and delete arbitrary files on affected installations of A10 Thunder ADC. Authentication is required to exploit this vulnerability. The specific flaw exists within the FileMgmtExport class. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to read and delete files in the context of the service account. . Was ZDI-CAN-17905.
- Product
- Thunder ADC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.a10networks.comzerodayinitiative.com
May 2, 2024PDF-XChange Editor exportAsText Exposed Dangerous Method Remote Code Execution Vulnerability.CVE-2023-39493 · Other software · PDF-XChange · reported by zdi-disclosures@trendmicro.comHigh 7.8
PDF-XChange Editor exportAsText Exposed Dangerous Method Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the exportAsText method. The application exposes a JavaScript interface that allows writing arbitrary files. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-19649.
- Product
- PDF-XChange Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzerodayinitiative.comzerodayinitiative.com
May 2, 2024Kofax Power PDF exportAsText Exposed Dangerous Method Remote Code Execution Vulnerability.CVE-2023-37330 · Other software · Kofax · reported by zdi-disclosures@trendmicro.comHigh 7.8
Kofax Power PDF exportAsText Exposed Dangerous Method Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the exportAsText method. The application exposes a JavaScript interface that allows the attacker to write arbitrary files. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-20230.
- Product
- Power PDF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzerodayinitiative.comzerodayinitiative.com
May 2, 2024Foxit PDF Reader exportXFAData Exposed Dangerous Method Remote Code Execution Vulnerability.CVE-2023-27363 · Other software · Foxit · reported by zdi-disclosures@trendmicro.comHigh 7.8
Foxit PDF Reader exportXFAData Exposed Dangerous Method Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the exportXFAData method. The application exposes a JavaScript interface that allows writing arbitrary files. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-19697.
- Product
- PDF Reader
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfoxit.comzerodayinitiative.com
Apr 25, 2024Advanced Order Export For WooCommerce: Improper Control of Generation of Code ('Code Injection')CVE-2024-31266 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Improper Control of Generation of Code ('Code Injection') vulnerability in AlgolPlus Advanced Order Export For WooCommerce allows Code Injection.This issue affects Advanced Order Export For WooCommerce: from n/a through 3.4.4.
- Product
- Advanced Order Export For WooCommerce
- Affected
- up to 3.4.4
- What to do
- Affects up to 3.4.4. Update Advanced Order Export For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 24, 2024Import Export WordPress Users: Deserialization of Untrusted DataCVE-2024-32835 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Deserialization of Untrusted Data vulnerability in WebToffee Import Export WordPress Users.This issue affects Import Export WordPress Users: from n/a through 2.5.3.
- Product
- Import Export WordPress Users
- Affected
- up to 2.5.3
- What to do
- Affects up to 2.5.3. Update Import Export WordPress Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 24, 2024Import and export users and customers: Deserialization of Untrusted DataCVE-2024-32817 · WordPress plugins & themes · reported by PatchstackMedium 4.4
Deserialization of Untrusted Data vulnerability in Javier Carazo Import and export users and customers import-users-from-csv-with-meta.This issue affects Import and export users and customers: from n/a through <= 1.26.2.
- Product
- Import and export users and customers
- Affected
- up to 1.26.2
- What to do
- Affects up to 1.26.2. Update Import and export users and customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 18, 2024LearnPress Export Import: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32588 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress LearnPress Export Import allows Reflected XSS.This issue affects LearnPress Export Import: from n/a through 4.0.3.
- Product
- LearnPress Export Import
- Affected
- up to 4.0.3
- What to do
- Affects up to 4.0.3. Update LearnPress Export Import to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 12, 2024WordPress Comments Import & Export: Cross-Site Request Forgery (CSRF)CVE-2024-31235 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WebToffee WordPress Comments Import & Export.This issue affects WordPress Comments Import & Export: from n/a through 2.3.5.
- Product
- WordPress Comments Import & Export
- Affected
- up to 2.3.5
- What to do
- Affects up to 2.3.5. Update WordPress Comments Import & Export to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.