Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,242 results · page 11 of 25
Mar 21, 2024 SQL injection vulnerability exists in GetDIAE_slogListParameters.CVE-2024-23975 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.8
SQL injection vulnerability exists in GetDIAE_slogListParameters.
- Product
- DIAEnergie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2024 SQL injection vulnerability exists in GetDIAE_unListParameters.CVE-2024-23494 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.8
SQL injection vulnerability exists in GetDIAE_unListParameters.
- Product
- DIAEnergie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2024 SQL injection vulnerability exists in the script Handler_CFG.ashx.CVE-2024-28891 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.8
SQL injection vulnerability exists in the script Handler_CFG.ashx.
- Product
- DIAEnergie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2024Privileges are not fully verified server-side, which can be abused by a user with limited privileges to bypass authorization and access privileged functionalityCVE-2024-28029 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.8
Privileges are not fully verified server-side, which can be abused by a user with limited privileges to bypass authorization and access privileged functionality.
- Product
- DIAEnergie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2024 SQL injection vulnerability exists in the script DIAE_tagHandler.ashx.CVE-2024-25937 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.8
SQL injection vulnerability exists in the script DIAE_tagHandler.ashx.
- Product
- DIAEnergie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2024electron-builder is a solution to package and build a ready for distribution Electron, Proton Native app for macOS, Windows and Linux.CVE-2024-27303 · Other software · electron-userland · reported by GitHubHigh 7.3
electron-builder is a solution to package and build a ready for distribution Electron, Proton Native app for macOS, Windows and Linux. A vulnerability that only affects eletron-builder prior to 24.13.2 in Windows, the NSIS installer makes a system call to open cmd.exe via NSExec in the `.nsh` installer script. NSExec by default searches the current directory of where the installer is located before searching `PATH`. This means that if an attacker can place a malicious executable file named cmd.exe in the same folder as the installer, the installer will run the malicious file. Version 24.13.2 fixes this issue. No known workaround exists. The code executes at the installer-level before the app is present on the system, so there's no way to check if it exists in a current installer.
- Product
- electron-builder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 29, 2024 Delta Electronics CNCSoft-B versions 1.0.0.4 and prior are vulnerable to a stack-based buffer overflow, which may allow an attacker to execute arbitrary code.CVE-2024-1941 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 7.8
Delta Electronics CNCSoft-B versions 1.0.0.4 and prior are vulnerable to a stack-based buffer overflow, which may allow an attacker to execute arbitrary code.
- Product
- CNCSoft-B
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 29, 2024Delta Electronics CNCSoft-B DOPSoft prior to v4.0.0.82 insecurely loads libraries, which may allow an attacker to use DLL hijacking and take over the system wCVE-2024-1595 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 7.8
Delta Electronics CNCSoft-B DOPSoft prior to v4.0.0.82 insecurely loads libraries, which may allow an attacker to use DLL hijacking and take over the system where the software is installed.
- Product
- CNCSoft-B v1.0.0.4 DOPSoft
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2024 This vulnerability allows remote attackers to traverse the directory on the affected webOS of LG Signage.CVE-2024-1886 · Other software · LG Electronics · reported by product.security@lge.comLow 3
This vulnerability allows remote attackers to traverse the directory on the affected webOS of LG Signage.
- Product
- LG Signage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlgsecurity.lge.comlgsecurity.lge.com
Feb 26, 2024This vulnerability allows remote attackers to execute arbitrary code on the affected webOS of LG Signage.CVE-2024-1885 · Other software · LG Electronics · reported by product.security@lge.comMedium 6.3
This vulnerability allows remote attackers to execute arbitrary code on the affected webOS of LG Signage.
- Product
- LG Signage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlgsecurity.lge.comlgsecurity.lge.com
Feb 21, 2024The TD Bank TD Advanced Dashboard client through 3.0.3 for macOS allows arbitrary code execution because of the lack of electron::fuses::IsRunAsNodeEnabled (i.eCVE-2023-50975 · Other software · tdbank · reported by MITREHigh 8.4
The TD Bank TD Advanced Dashboard client through 3.0.3 for macOS allows arbitrary code execution because of the lack of electron::fuses::IsRunAsNodeEnabled (i.e., ELECTRON_RUN_AS_NODE can be used in production). This makes it easier for a compromised process to access banking information.
- Product
- td-advanced-dashboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comnewsroom.ripeda.com
Feb 20, 2024kedi ElectronCord is a bot management tool for Discord.CVE-2024-26136 · Other software · kedi · reported by GitHubHigh 7.5
kedi ElectronCord is a bot management tool for Discord. Commit aaaeaf4e6c99893827b2eea4dd02f755e1e24041 exposes an account access token in the `config.json` file. Malicious actors could potentially exploit this vulnerability to gain unauthorized access to sensitive information or perform malicious actions on behalf of the repository owner. As of time of publication, it is unknown whether the owner of the repository has rotated the token or taken other mitigation steps aside from informing users of the situation.
- Product
- ElectronCord
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2024electron-pdf version 20.0.0 allows an external attacker to remotely obtain arbitrary local files.CVE-2024-1648 · Other software · electron-pdf · reported by help@fluidattacks.comHigh 7.5
electron-pdf version 20.0.0 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the HTML content entered by the user.
- Product
- electron-pdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comnpmjs.com
Feb 1, 2024Miro Desktop 0.8.18 on macOS allows local Electron code injection via a complex series of steps that might be usable in some environments (bypass a kTCCServiceSCVE-2024-23746 · Other software · Miro · reported by MITRECritical 9.8
Miro Desktop 0.8.18 on macOS allows local Electron code injection via a complex series of steps that might be usable in some environments (bypass a kTCCServiceSystemPolicyAppBundles requirement via a file copy, an app.app/Contents rename, an asar modification, and a rename back to app.app/Contents).
- Product
- Miro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbook.hacktricks.xyzgithub.com
Jan 26, 2024Path Traversal: '/../filedir' vulnerability in Biges Safe Life Technologies Electronics Inc.CVE-2023-6919 · Other software · Biges Safe Life Technologies Electronics Inc. · reported by iletisim@usom.gov.trHigh 7.5
Path Traversal: '/../filedir' vulnerability in Biges Safe Life Technologies Electronics Inc. VGuard allows Absolute Path Traversal. This issue affects VGuard: before V500.0003.R008.4011.C0012.B351.C.
- Product
- VGuard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Jan 23, 2024Electronic Delivery Check System (Ministry of Agriculture, Forestry and Fisheries The Agriculture and Rural Development Project Version) March, Heisei 31 era edCVE-2024-22380 · Other software · Ministry of Agriculture, Forestry and Fisheries · reported by vultures@jpcert.or.jpMedium 5.5
Electronic Delivery Check System (Ministry of Agriculture, Forestry and Fisheries The Agriculture and Rural Development Project Version) March, Heisei 31 era edition Ver.14.0.001.002 and earlier improperly restricts XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files on the system may be read by an attacker.
- Product
- Electronic Delivery Check System (Ministry of Agriculture, Forestry and Fisheries The Agriculture and Rural Development Project Version) March, Heisei 31 era ed
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2024Electronic Deliverables Creation Support Tool (Construction Edition) prior to Ver1.0.4 and Electronic Deliverables Creation Support Tool (Design & Survey EditioCVE-2024-21796 · Other software · Ministry of Defense · reported by vultures@jpcert.or.jpMedium 5.5
Electronic Deliverables Creation Support Tool (Construction Edition) prior to Ver1.0.4 and Electronic Deliverables Creation Support Tool (Design & Survey Edition) prior to Ver1.0.4 improperly restrict XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files on the system may be read by an attacker.
- Product
- Electronic Deliverables Creation Support Tool (Construction Edition)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2024Electronic Delivery Check System (Doboku) Ver.18.1.0 and earlier, Electronic Delivery Check System (Dentsu) Ver.12.1.0 and earlier, Electronic Delivery Check SyCVE-2024-21765 · Other software · Ministry of Land, Infrastructure, Transport and Tourism, Japan · reported by vultures@jpcert.or.jpMedium 5.5
Electronic Delivery Check System (Doboku) Ver.18.1.0 and earlier, Electronic Delivery Check System (Dentsu) Ver.12.1.0 and earlier, Electronic Delivery Check System (Kikai) Ver.10.1.0 and earlier, and Electronic delivery item Inspection Support SystemVer.4.0.31 and earlier improperly restrict XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files on the system may be read by an attacker.
- Product
- Electronic Delivery Check System (Doboku)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2024A heap buffer-overflow exists in Delta Electronics ISPSoft.CVE-2023-5131 · Other software · Delta Electronics · reported by disclosures@exodusintel.comHigh 8.2
A heap buffer-overflow exists in Delta Electronics ISPSoft. An anonymous attacker can exploit this vulnerability by enticing a user to open a specially crafted DVP file to achieve code execution.
- Product
- ISPSoft
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.exodusintel.comblog.exodusintel.com
Jan 18, 2024A buffer overflow vulnerability exists in Delta Electronics WPLSoft.CVE-2023-5130 · Other software · Delta Electronics · reported by disclosures@exodusintel.comHigh 8.2
A buffer overflow vulnerability exists in Delta Electronics WPLSoft. An anonymous attacker can exploit this vulnerability by enticing a user to open a specially crafted DVP file to achieve code execution.
- Product
- WPLSoft
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.exodusintel.comblog.exodusintel.com
Jan 18, 2024A stack based buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft when parsing the wTitleTextLen field of a DPS file.CVE-2023-43824 · Other software · Delta Electronics · reported by disclosures@exodusintel.comHigh 8.8
A stack based buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft when parsing the wTitleTextLen field of a DPS file. A remote, unauthenticated attacker can exploit this vulnerability by enticing a user to open a specially crafted DPS file to achieve remote code execution.
- Product
- DOPSoft
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.exodusintel.comblog.exodusintel.com
Jan 18, 2024A stack based buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft when parsing the wTTitleLen field of a DPS file.CVE-2023-43823 · Other software · Delta Electronics · reported by disclosures@exodusintel.comHigh 8.8
A stack based buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft when parsing the wTTitleLen field of a DPS file. A remote, unauthenticated attacker can exploit this vulnerability by enticing a user to open a specially crafted DPS file to achieve remote code execution.
- Product
- DOPSoft
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.exodusintel.comblog.exodusintel.com
Jan 18, 2024A stack based buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft when parsing the wLogTitlesTimeLen field of a DPS file.CVE-2023-43822 · Other software · Delta Electronics · reported by disclosures@exodusintel.comHigh 8.8
A stack based buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft when parsing the wLogTitlesTimeLen field of a DPS file. A remote, unauthenticated attacker can exploit this vulnerability by enticing a user to open a specially crafted DPS file to achieve remote code execution.
- Product
- DOPSoft
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.exodusintel.comblog.exodusintel.com
Jan 18, 2024A stack based buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft when parsing the wLogTitlesActionLen field of a DPS file.CVE-2023-43821 · Other software · Delta Electronics · reported by disclosures@exodusintel.comHigh 8.8
A stack based buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft when parsing the wLogTitlesActionLen field of a DPS file. A remote, unauthenticated attacker can exploit this vulnerability by enticing a user to open a specially crafted DPS file to achieve remote code execution.
- Product
- DOPSoft
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.exodusintel.comblog.exodusintel.com
Jan 18, 2024A stack based buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft when parsing the wLogTitlesPrevValueLen field of a DPS file.CVE-2023-43820 · Other software · Delta Electronics · reported by disclosures@exodusintel.comHigh 8.8
A stack based buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft when parsing the wLogTitlesPrevValueLen field of a DPS file. A remote, unauthenticated attacker can exploit this vulnerability by enticing a user to open a specially crafted DPS file to achieve remote code execution.
- Product
- DOPSoft
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.exodusintel.comblog.exodusintel.com
Jan 18, 2024A stack based buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft when parsing the InitialMacroLen field of a DPS file.CVE-2023-43819 · Other software · Delta Electronics · reported by disclosures@exodusintel.comHigh 8.8
A stack based buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft when parsing the InitialMacroLen field of a DPS file. A remote, unauthenticated attacker can exploit this vulnerability by enticing a user to open a specially crafted DPS file to achieve remote code execution.
- Product
- DOPSoft
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.exodusintel.comblog.exodusintel.com
Jan 18, 2024A buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft.CVE-2023-43818 · Other software · Delta Electronics · reported by disclosures@exodusintel.comHigh 8.8
A buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft. A remote, unauthenticated attacker can exploit this vulnerability by enticing a user to open a specially crafted DPS file to achieve remote code execution.
- Product
- DOPSoft
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.exodusintel.comblog.exodusintel.com
Jan 18, 2024A buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft version 2 when parsing the wMailContentLen field of a DPS file.CVE-2023-43817 · Other software · Delta Electronics · reported by disclosures@exodusintel.comHigh 7.5
A buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft version 2 when parsing the wMailContentLen field of a DPS file. An anonymous attacker can exploit this vulnerability by enticing a user to open a specially crafted DPS file to achieve code execution.
- Product
- DOPSoft
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.exodusintel.comblog.exodusintel.com
Jan 18, 2024A buffer overflow vulnerability exists in Delta Electronics Delta Industrial Automation DOPSoft version 2 when parsing the wKPFStringLen field of a DPS file.CVE-2023-43816 · Other software · Delta Electronics · reported by disclosures@exodusintel.comMedium 6.3
A buffer overflow vulnerability exists in Delta Electronics Delta Industrial Automation DOPSoft version 2 when parsing the wKPFStringLen field of a DPS file. An anonymous attacker can exploit this vulnerability by enticing a user to open a specially crafted DPS file to achieve code execution.
- Product
- DOPSoft
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.exodusintel.comblog.exodusintel.com
Jan 18, 2024A buffer overflow vulnerability exists in Delta Electronics Delta Industrial Automation DOPSoft version 2 when parsing the wScreenDESCTextLen field of a DPS filCVE-2023-43815 · Other software · Delta Electronics · reported by disclosures@exodusintel.comHigh 7.1
A buffer overflow vulnerability exists in Delta Electronics Delta Industrial Automation DOPSoft version 2 when parsing the wScreenDESCTextLen field of a DPS file. An anonymous attacker can exploit this vulnerability by enticing a user to open a specially crafted DPS file to achieve code execution.
- Product
- DOPSoft
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.exodusintel.comblog.exodusintel.com
Jan 8, 2024A vulnerability was found in Guangzhou Yingke Electronic Technology Ncast up to 2017 and classified as problematic.CVE-2024-0305 · Other software · Guangzhou Yingke Electronic Technology · reported by VulDBMedium 5.3
A vulnerability was found in Guangzhou Yingke Electronic Technology Ncast up to 2017 and classified as problematic. Affected by this issue is some unknown functionality of the file /manage/IPSetup.php of the component Guest Login. The manipulation leads to information disclosure. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249872.
- Product
- Ncast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 1, 2024STMicroelectronics STSAFE-A1xx middleware before 3.3.7 allows MCU code execution if an adversary has the ability to read from and write to the I2C bus.CVE-2023-50096 · Other software · ST · reported by MITREHigh 7.5
STMicroelectronics STSAFE-A1xx middleware before 3.3.7 allows MCU code execution if an adversary has the ability to read from and write to the I2C bus. This is caused by an StSafeA_ReceiveBytes buffer overflow in the X-CUBE-SAFEA1 Software Package for STSAFE-A sample applications (1.2.0), and thus can affect user-written code that was derived from a published sample application.
- Product
- X-cube-safea1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 14, 2023An attacker with physical access to the Kantech Gen1 ioSmart card reader with firmware version prior to 1.07.02 in certain circumstances can recover the reader'CVE-2023-0248 · Other software · Sensormatic Electronics, a subsidiary of Johnson Controls, Inc. · reported by productsecurity@jci.comHigh 7.5
An attacker with physical access to the Kantech Gen1 ioSmart card reader with firmware version prior to 1.07.02 in certain circumstances can recover the reader's communication memory between the card and reader.
- Product
- ioSmart Gen1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcisa.govjohnsoncontrols.com
Dec 12, 2023Denial-of-service (DoS) vulnerability exists in NetBIOS service of HMI GC-A2 series.CVE-2023-49713 · Other software · JTEKT ELECTRONICS CORPORATION · reported by vultures@jpcert.or.jpHigh 7.5
Denial-of-service (DoS) vulnerability exists in NetBIOS service of HMI GC-A2 series. If a remote unauthenticated attacker sends a specially crafted packets to specific ports, a denial-of-service (DoS) condition may occur.
- Product
- GC-A22W-CW
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpelectronics.jtekt.co.jp
Dec 12, 2023Denial-of-service (DoS) vulnerability exists in rfe service of HMI GC-A2 series.CVE-2023-49143 · Other software · JTEKT ELECTRONICS CORPORATION · reported by vultures@jpcert.or.jpHigh 7.5
Denial-of-service (DoS) vulnerability exists in rfe service of HMI GC-A2 series. If a remote unauthenticated attacker sends a specially crafted packets to specific ports, a denial-of-service (DoS) condition may occur.
- Product
- GC-A22W-CW
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpelectronics.jtekt.co.jp
Dec 12, 2023Denial-of-service (DoS) vulnerability exists in commplex-link service of HMI GC-A2 series.CVE-2023-49140 · Other software · JTEKT ELECTRONICS CORPORATION · reported by vultures@jpcert.or.jpHigh 7.5
Denial-of-service (DoS) vulnerability exists in commplex-link service of HMI GC-A2 series. If a remote unauthenticated attacker sends a specially crafted packets to specific ports, a denial-of-service (DoS) condition may occur.
- Product
- GC-A22W-CW
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpelectronics.jtekt.co.jp
Dec 12, 2023Denial-of-service (DoS) vulnerability exists in FTP service of HMI GC-A2 series.CVE-2023-41963 · Other software · JTEKT ELECTRONICS CORPORATION · reported by vultures@jpcert.or.jpHigh 7.5
Denial-of-service (DoS) vulnerability exists in FTP service of HMI GC-A2 series. If a remote unauthenticated attacker sends a specially crafted packets to specific ports, a denial-of-service (DoS) condition may occur.
- Product
- GC-A22W-CW
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpelectronics.jtekt.co.jp
Dec 4, 2023 Delta Electronics DOPSoft is vulnerable to a stack-based buffer overflow, which may allow for arbitrary code execution if an attacker can lead a legitimate useCVE-2023-5944 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 7.8
Delta Electronics DOPSoft is vulnerable to a stack-based buffer overflow, which may allow for arbitrary code execution if an attacker can lead a legitimate user to execute a specially crafted file.
- Product
- DOPSoft
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiastudio.deltaww.comcisa.gov
Dec 1, 2023Electron is an open source framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.CVE-2023-44402 · Other software · electron · reported by GitHubMedium 6.1
Electron is an open source framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. This only impacts apps that have the `embeddedAsarIntegrityValidation` and `onlyLoadAppFromAsar` fuses enabled. Apps without these fuses enabled are not impacted. This issue is specific to macOS as these fuses are only currently supported on macOS. Specifically this issue can only be exploited if your app is launched from a filesystem the attacker has write access too. i.e. the ability to edit files inside the `.app` bundle on macOS which these fuses are supposed to protect against. There are no app side workarounds, you must update to a patched version of Electron.
- Product
- electron
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 30, 2023In Delta Electronics InfraSuite Device Master v.1.0.7, A vulnerability exists that allows an unauthenticated attacker to disclose user information through a sinCVE-2023-47279 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 7.5
In Delta Electronics InfraSuite Device Master v.1.0.7, A vulnerability exists that allows an unauthenticated attacker to disclose user information through a single UDP packet, obtain plaintext credentials, or perform NTLM relaying.
- Product
- InfraSuite Device Master
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 30, 2023LOYTEC electronics GmbH LINX-212 and LINX-151 devices (all versions) are vulnerable to Incorrect Access Control via registry.xml file.CVE-2023-46389 · Other software · Loytec · reported by MITREHigh 7.5
LOYTEC electronics GmbH LINX-212 and LINX-151 devices (all versions) are vulnerable to Incorrect Access Control via registry.xml file. This vulnerability allows remote attackers to disclose sensitive information on LINX configuration.
- Product
- Linx-212 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Nov 30, 2023LOYTEC electronics GmbH LINX-212 and LINX-151 devices (all versions) are vulnerable to Insecure Permissions via dpal_config.zml file.CVE-2023-46388 · Other software · Loytec · reported by MITREHigh 7.5
LOYTEC electronics GmbH LINX-212 and LINX-151 devices (all versions) are vulnerable to Insecure Permissions via dpal_config.zml file. This vulnerability allows remote attackers to disclose smtp client account credentials and bypass email authentication.
- Product
- Linx-212 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Nov 30, 2023LOYTEC electronics GmbH LINX-212 and LINX-151 devices (all versions) are vulnerable to Incorrect Access Control via dpal_config.zml file.CVE-2023-46387 · Other software · Loytec · reported by MITREHigh 7.5
LOYTEC electronics GmbH LINX-212 and LINX-151 devices (all versions) are vulnerable to Incorrect Access Control via dpal_config.zml file. This vulnerability allows remote attackers to disclose sensitive information on Loytec device data point configuration.
- Product
- Linx-212 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Nov 30, 2023LOYTEC electronics GmbH LINX-212 and LINX-151 devices (all versions) are vulnerable to Insecure Permissions via registry.xml file.CVE-2023-46386 · Other software · Loytec · reported by MITREHigh 7.5
LOYTEC electronics GmbH LINX-212 and LINX-151 devices (all versions) are vulnerable to Insecure Permissions via registry.xml file. This vulnerability allows remote attackers to disclose smtp client account credentials and bypass email authentication.
- Product
- Linx-212 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Nov 30, 2023LOYTEC electronics GmbH LINX Configurator (all versions) is vulnerable to Insecure Permissions.CVE-2023-46385 · Other software · Loytec · reported by MITREHigh 7.5
LOYTEC electronics GmbH LINX Configurator (all versions) is vulnerable to Insecure Permissions. An admin credential is passed as a value of URL parameters without encryption, so it allows remote attackers to steal the password and gain full control of Loytec device configuration.
- Product
- L-inx Configurator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Nov 30, 2023LOYTEC electronics GmbH LINX Configurator (all versions) is vulnerable to Insecure Permissions.CVE-2023-46384 · Other software · Loytec · reported by MITREHigh 7.5
LOYTEC electronics GmbH LINX Configurator (all versions) is vulnerable to Insecure Permissions. Cleartext storage of credentials allows remote attackers to disclose admin password and bypass an authentication to login Loytec device.
- Product
- L-inx Configurator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Nov 30, 2023LOYTEC electronics GmbH LINX Configurator (all versions) uses HTTP Basic Authentication, which transmits usernames and passwords in base64-encoded cleartext andCVE-2023-46383 · Other software · Loytec · reported by MITREHigh 7.5
LOYTEC electronics GmbH LINX Configurator (all versions) uses HTTP Basic Authentication, which transmits usernames and passwords in base64-encoded cleartext and allows remote attackers to steal the password and gain full control of Loytec device configuration.
- Product
- L-inx Configurator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Nov 30, 2023In Delta Electronics InfraSuite Device Master v.1.0.7, a vulnerability exists that allows an unauthenticated attacker to execute code with local administrator pCVE-2023-47207 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govCritical 9.8
In Delta Electronics InfraSuite Device Master v.1.0.7, a vulnerability exists that allows an unauthenticated attacker to execute code with local administrator privileges.
- Product
- InfraSuite Device Master
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 30, 2023In Delta Electronics InfraSuite Device Master v.1.0.7, a vulnerability exists that allows an attacker to write to any file to any location of the filesystem, whCVE-2023-46690 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.8
In Delta Electronics InfraSuite Device Master v.1.0.7, a vulnerability exists that allows an attacker to write to any file to any location of the filesystem, which could lead to remote code execution.
- Product
- InfraSuite Device Master
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 30, 2023In Delta Electronics InfraSuite Device Master v.1.0.7, a vulnerability exists that allows an unauthenticated attacker to execute arbitrary code through a singleCVE-2023-39226 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govCritical 9.8
In Delta Electronics InfraSuite Device Master v.1.0.7, a vulnerability exists that allows an unauthenticated attacker to execute arbitrary code through a single UDP packet.
- Product
- InfraSuite Device Master
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.