Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,762 results · page 13 of 56
Aug 4, 2025Paramount Macrium Reflect through 2025-06-26 allows attackers to execute arbitrary code with administrator privileges via a crafted .mrimgx or .mrbax backup filCVE-2025-53394 · Other software · reported by MITREHigh 7.7
Paramount Macrium Reflect through 2025-06-26 allows attackers to execute arbitrary code with administrator privileges via a crafted .mrimgx or .mrbax backup file and a renamed executable placed in the same directory. When a user with administrative privileges opens the crafted backup file and proceeds to mount it, Reflect launches the renamed executable (e.g., explorer.exe), which is under attacker control. This occurs because of insufficient validation of companion files referenced during backup mounting.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmacrium.commacrium.com
Aug 4, 2025RUCKUS Network Director (RND) before 4.5 allows spoofing of an administrator JWT by an attacker who knows the hardcoded value of a certain secret key.CVE-2025-44963 · Other software · RUCKUS · reported by MITRECritical 9
RUCKUS Network Director (RND) before 4.5 allows spoofing of an administrator JWT by an attacker who knows the hardcoded value of a certain secret key.
- Product
- Network Director
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordclaroty.comkb.cert.org
Aug 4, 2025Austrian Archaeological Institute (AI) OpenAtlas v8.11.0 as discovered to contain a hardcoded Administrator password.CVE-2025-51536 · Other software · Craws · reported by MITRECritical 9.8
Austrian Archaeological Institute (AI) OpenAtlas v8.11.0 as discovered to contain a hardcoded Administrator password.
- Product
- Openatlas
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec4you-pentest.comsec4you-pentest.com
Aug 1, 2025Partner Software's Partner Software Product and corresponding Partner Web application use the same default username and password for the administrator account aCVE-2025-6077 · Other software · Partner Software · reported by cret@cert.orgCritical 9.8
Partner Software's Partner Software Product and corresponding Partner Web application use the same default username and password for the administrator account across all versions.
- Product
- Partner Web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpartnersoftware.comkb.cert.org
Aug 1, 2025An authenticated SQL injection vulnerability exists in OpenEMR ≤ 4.1.1 Patch 14 that allows a low-privileged attacker to extract administrator credentials and sCVE-2013-10044 · Other software · OpenEMR Foundation · reported by VulnCheckHigh 8.7
An authenticated SQL injection vulnerability exists in OpenEMR ≤ 4.1.1 Patch 14 that allows a low-privileged attacker to extract administrator credentials and subsequently escalate privileges. Once elevated, the attacker can exploit an unrestricted file upload flaw to achieve remote code execution, resulting in full compromise of the application and its host system.
- Product
- OpenEMR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comraw.githubusercontent.com
Jul 30, 2025The e-School from Ventem has a Missing Authorization vulnerability, allowing remote attackers with regular privilege to access administrator functions, includinCVE-2025-8322 · Other software · Ventem · reported by twcert@cert.org.twHigh 8.7
The e-School from Ventem has a Missing Authorization vulnerability, allowing remote attackers with regular privilege to access administrator functions, including creating, modifying, and deleting accounts. They can even escalate any account to system administrator privilege.
- Product
- e-School
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Jul 29, 2025Access to TSplus Remote Access Admin Tool is restricted to administrators (unless "Disable UAC" option is enabled) and requires a PIN code.CVE-2025-5922 · Other software · TSplus · reported by cvd@cert.plMedium 4.8
Access to TSplus Remote Access Admin Tool is restricted to administrators (unless "Disable UAC" option is enabled) and requires a PIN code. In versions below v18.40.6.17 the PIN's hash is stored in a system registry accessible to regular users, making it possible to perform a brute-force attack using rainbow tables, since the hash is not salted. LTS (Long-Term Support) versions also received patches in v17.2025.6.27 and v16.2025.6.27 releases.
- Product
- TSplus Remote Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2025Absolute Path Traversal in Samsung DMS(Data Management Server) allows authenticated attacker (Administrator) to read sensitive filesCVE-2025-53079 · Computers, phones & browsers · Samsung Electronics · reported by PSIRT@samsung.comMedium 4.9
Absolute Path Traversal in Samsung DMS(Data Management Server) allows authenticated attacker (Administrator) to read sensitive files
- Product
- Data Management Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungda.com
Jul 28, 2025An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users.CVE-2025-54768 · Other software · Xorux · reported by bbf0bd87-ece2-41be-b873-96928ee8fab9Medium 5.3
An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users. The endpoint can be used to download logs from the appliance configuration, exposing sensitive information.
- Product
- LPAR2RRD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkorelogic.comlpar2rrd.com
Jul 28, 2025An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users.CVE-2025-54766 · Other software · Xorux · reported by bbf0bd87-ece2-41be-b873-96928ee8fab9Medium 5.3
An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users. The endpoint can be used to export the appliance configuration, exposing sensitive information.
- Product
- XorMon-NG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkorelogic.comxormon.com
Jul 28, 2025An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users.CVE-2025-54765 · Other software · Xorux · reported by bbf0bd87-ece2-41be-b873-96928ee8fab9Medium 5.3
An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users. The endpoint can be used to import the appliance configuration, allowing an attacker to control the configuration of the appliance, to include granting themselves administrative level permissions.
- Product
- XorMon-NG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkorelogic.comxormon.com
Jul 25, 2025CNCF Harbor 2.13.x before 2.13.1 and 2.12.x before 2.12.4 allows information disclosure by administrators who can exploit an ORM Leak present in the /api/v2.0/uCVE-2025-30086 · Other software · reported by MITREMedium 4.9
CNCF Harbor 2.13.x before 2.13.1 and 2.12.x before 2.12.4 allows information disclosure by administrators who can exploit an ORM Leak present in the /api/v2.0/users endpoint to leak users' password hash and salt values. The q URL parameter allows a user to filter users by any column, and filter password=~ could be abused to leak out a user's password hash character by character. An attacker with administrator access could exploit this to leak highly sensitive information stored in the Harbor database. All endpoints that support the q URL parameter are vulnerable to this ORM leak attack.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2025Okta On-Premises Provisioning (OPP) agents log certain user data during administrator-initiated password resets.CVE-2025-7371 · Other software · Okta · reported by psirt@okta.comMedium 6.8
Okta On-Premises Provisioning (OPP) agents log certain user data during administrator-initiated password resets. This vulnerability allows an attacker with access to the local servers running OPP agents to retrieve user personal information and temporary passwords created during password reset. You are affected by this vulnerability if the following preconditions are met: Local server running OPP agent with versions >=2.2.1 and <= 2.3.0, and User account has had an administrator-initiated password reset while using the affected versions.
- Product
- Okta On-Premises Provisioning Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025A post-auth SQL injection vulnerability in WebAdmin of Sophos Firewall versions older than 21.0 MR1 (21.0.1) can potentially lead to administrators achieving arCVE-2024-13973 · Network & remote access · Sophos · reported by security-alert@sophos.comMedium 6.8
A post-auth SQL injection vulnerability in WebAdmin of Sophos Firewall versions older than 21.0 MR1 (21.0.1) can potentially lead to administrators achieving arbitrary code execution.
- Product
- Sophos Firewall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025File access paths in configuration files uploaded by users with administrator access are not validated.CVE-2025-50151 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.8
File access paths in configuration files uploaded by users with administrator access are not validated. This issue affects Apache Jena version up to 5.4.0. Users are recommended to upgrade to version 5.5.0, which does not allow arbitrary configuration upload.
- Product
- Apache Jena
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Jul 21, 2025Users with administrator access can create databases files outside the files area of the Fuseki server.CVE-2025-49656 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
Users with administrator access can create databases files outside the files area of the Fuseki server. This issue affects Apache Jena version up to 5.4.0. Users are recommended to upgrade to version 5.5.0, which fixes the issue.
- Product
- Apache Jena
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Jul 21, 2025WinMatrix3 Web package developed by Simopro Technology has an Arbitrary File Upload vulnerability, allowing remote attackers with administrator privileges to upCVE-2025-7917 · Other software · Simopro Technology · reported by twcert@cert.org.twHigh 8.6
WinMatrix3 Web package developed by Simopro Technology has an Arbitrary File Upload vulnerability, allowing remote attackers with administrator privileges to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.
- Product
- WinMatrix3 Web package
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Jul 18, 2025Incorrect access control in Software GmbH Agorum core open v11.9.2 & v11.10.1 allows authenticated attackers to escalate privileges to Administrator and access CVE-2025-52166 · Other software · reported by MITREMedium 6.5
Incorrect access control in Software GmbH Agorum core open v11.9.2 & v11.10.1 allows authenticated attackers to escalate privileges to Administrator and access sensitive components and information.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2025Successful exploitation of the vulnerability could allow an unauthenticated attacker to obtain a valid session ID with administrator privileges by spoofing the CVE-2025-52689 · Other software · Alcatel-Lucent · reported by 5f57b9bf-260d-4433-bf07-b6a79e9bb7d4Critical 9.8
Successful exploitation of the vulnerability could allow an unauthenticated attacker to obtain a valid session ID with administrator privileges by spoofing the login request, potentially allowing the attacker to modify the behaviour of the access point.
- Product
- OmniAccess Stellar Products
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.uhg.sgal-enterprise.com
Jul 16, 2025Successful exploitation of the vulnerability could allow an attacker with administrator credentials for the access point to inject malicious JavaScript into theCVE-2025-52687 · Other software · Alcatel-Lucent · reported by 5f57b9bf-260d-4433-bf07-b6a79e9bb7d4Low 2.4
Successful exploitation of the vulnerability could allow an attacker with administrator credentials for the access point to inject malicious JavaScript into the payload of web traffics, potentially leading to session hijacking and denial-of-service (DoS).
- Product
- OmniAccess Stellar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordal-enterprise.comcsa.gov.sg
Jul 12, 2025A vulnerability exists on all versions of Ivanti Policy Secure below 22.6R1 where an authenticated administrator can perform an arbitrary file read via a maliciCVE-2023-39339 · Network & remote access · Ivanti · reported by support@hackerone.comMedium 4.9
A vulnerability exists on all versions of Ivanti Policy Secure below 22.6R1 where an authenticated administrator can perform an arbitrary file read via a maliciously crafted web request.
- Product
- Policy Secure
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2025A vulnerability has been identified in TIA Administrator (All versions < V3.0.6).CVE-2025-23365 · Other software · Siemens · reported by productcert@siemens.comHigh 8.5
A vulnerability has been identified in TIA Administrator (All versions < V3.0.6). The affected application allows low-privileged users to trigger installations by overwriting cache files and modifying the downloads path. This would allow an attacker to escalate privilege and exceute arbitrary code.
- Product
- TIA Administrator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.com
Jul 8, 2025A vulnerability has been identified in TIA Administrator (All versions < V3.0.6).CVE-2025-23364 · Other software · Siemens · reported by productcert@siemens.comMedium 6.9
A vulnerability has been identified in TIA Administrator (All versions < V3.0.6). The affected application improperly validates code signing certificates. This could allow an attacker to bypass the check and exceute arbitrary code during installations.
- Product
- TIA Administrator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.com
Jul 7, 2025Due to insufficient sanitization in the SAP BusinessObjects Content Administrator Workbench, attackers could craft malicious URLs and execute scripts in a victiCVE-2025-42985 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.1
Due to insufficient sanitization in the SAP BusinessObjects Content Administrator Workbench, attackers could craft malicious URLs and execute scripts in a victim�s browser. This could potentially lead to the exposure or modification of web client data, resulting in low impact on confidentiality and integrity, with no impact on application availability.
- Product
- SAP BusinessObjects Content Administrator workbench
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2025A critical vulnerability in SAP NetWeaver Application server for Java Log Viewer enables authenticated administrator users to exploit unsafe Java object deseriaCVE-2025-42963 · Network & remote access · SAP_SE · reported by cna@sap.comCritical 9.1
A critical vulnerability in SAP NetWeaver Application server for Java Log Viewer enables authenticated administrator users to exploit unsafe Java object deserialization. Successful exploitation can lead to full operating system compromise, granting attackers complete control over the affected system. This results in a severe impact on the confidentiality, integrity, and availability of the application and host environment.
- Product
- SAP NetWeaver Application Server for Java (Log Viewer )
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2025A remote attacker with administrator account can gain full control of the device due to improper neutralization of special elements used in an OS Command ('OS CCVE-2025-3626 · Other software · Frauscher · reported by info@cert.vde.comCritical 9.1
A remote attacker with administrator account can gain full control of the device due to improper neutralization of special elements used in an OS Command ('OS Command Injection') while uploading a config file via webUI.
- Product
- FDS102
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 4, 2025In the Production Environment extension in Netmake ScriptCase through 9.12.006 (23), the Administrator password reset mechanism is mishandled.CVE-2025-47227 · Other software · ScriptCase · reported by MITREHigh 7.5
In the Production Environment extension in Netmake ScriptCase through 9.12.006 (23), the Administrator password reset mechanism is mishandled. Making both a GET and a POST request to login.php.is sufficient. An unauthenticated attacker can then bypass authentication via administrator account takeover.
- Product
- ScriptCase
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comscriptcase.net
Jul 2, 2025Secret Server version 11.7 and earlier is vulnerable to a SQL report creation vulnerability that allows an administrator to gain access to restricted tables.CVE-2025-6943 · Other software · Delinea · reported by 1443cd92-d354-46d2-9290-d812316ca43aLow 3.8
Secret Server version 11.7 and earlier is vulnerable to a SQL report creation vulnerability that allows an administrator to gain access to restricted tables.
- Product
- Secret Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.delinea.comdocs.delinea.com
Jul 2, 2025A missing double-check feature in the WebGUI for CLI deactivation in Infinera G42 version R6.1.3 allows an authenticated administrator to make other managemenCVE-2025-27026 · Other software · Infinera · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158Medium 4.9
A missing double-check feature in the WebGUI for CLI deactivation in Infinera G42 version R6.1.3 allows an authenticated administrator to make other management interfaces unavailable via local and network interfaces. The CLI deactivation via the WebGUI does not only stop CLI interface but deactivates also Linux Shell, WebGUI and Physical Serial Console access. No confirmation is asked at deactivation time. Loosing access to these services device administrators are at risk of completely loosing device control.
- Product
- G42
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordeuvd.enisa.europa.eucvcn.gov.it
Jun 27, 2025Improper signature verification in AMD CPU ROM microcode patch loader may allow an attacker with local administrator privilege to load malicious microcode, poteCVE-2024-36347 · Other software · AMD · reported by psirt@amd.comMedium 6.4
Improper signature verification in AMD CPU ROM microcode patch loader may allow an attacker with local administrator privilege to load malicious microcode, potentially resulting in loss of integrity of x86 instruction execution, loss of confidentiality and integrity of data in x86 CPU privileged context and compromise of SMM execution environment.
- Product
- AMD EPYC™ 7001 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2025Under certain conditions, an authenticated user request may execute with stale privileges following an intentional change by an authorized administrator.CVE-2025-6707 · Other software · MongoDB Inc · reported by cna@mongodb.comMedium 4.2
Under certain conditions, an authenticated user request may execute with stale privileges following an intentional change by an authorized administrator. This issue affects MongoDB Server v5.0 version prior to 5.0.31, MongoDB Server v6.0 version prior to 6.0.24, MongoDB Server v7.0 version prior to 7.0.21 and MongoDB Server v8.0 version prior to 8.0.5.
- Product
- MongoDB Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2025An unauthenticated attacker who knows the target device's serial number, can generate the default administrator password for the device.CVE-2024-51978 · Other software · Brother Industries, Ltd · reported by cve@rapid7.comCritical 9.8
An unauthenticated attacker who knows the target device's serial number, can generate the default administrator password for the device. An unauthenticated attacker can first discover the target device's serial number via CVE-2024-51977 over HTTP/HTTPS/IPP, or via a PJL request, or via an SNMP request.
- Product
- DCP-J928N-W/B
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordassets.contentstack.iogithub.com
Jun 12, 2025A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary CVE-2025-4230 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comHigh 8.4
A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To be able to exploit this issue, the user must have access to the PAN-OS CLI. The security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators. Cloud NGFW and Prisma® Access are not affected by this vulnerability.
- Product
- Cloud NGFW
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.paloaltonetworks.com
Jun 12, 2025A cross-site scripting vulnerability exists in AVEVA PI Connector for CygNet Versions 1.6.14 and prior that, if exploited, could allow an administrator miscrCVE-2025-4417 · Other software · AVEVA · reported by ics-cert@hq.dhs.govMedium 6.9
A cross-site scripting vulnerability exists in AVEVA PI Connector for CygNet Versions 1.6.14 and prior that, if exploited, could allow an administrator miscreant with local access to the connector admin portal to persist arbitrary JavaScript code that will be executed by other users who visit affected pages.
- Product
- PI Connector for CygNet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025An OS command injection vulnerability within the update functionality may allow an authenticated administrator to execute unauthorized arbitrary OS commands.CVE-2024-13089 · Other software · Nozomi Networks · reported by prodsec@nozominetworks.comHigh 7.5
An OS command injection vulnerability within the update functionality may allow an authenticated administrator to execute unauthorized arbitrary OS commands. Users with administrative privileges may upload update packages to upgrade the versions of Nozomi Networks Guardian and CMC. While these updates are signed and their signatures are validated prior to installation, an improper signature validation check has been identified. This issue could potentially enable users to execute commands remotely on the appliance, thereby impacting confidentiality, integrity, and availability.
- Product
- Guardian
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.nozominetworks.com
Jun 2, 2025The VAPIX Device Configuration framework allowed a privilege escalation, enabling a lower-privileged user to gain administrator privileges.CVE-2025-0324 · Other software · Axis Communications AB · reported by product-security@axis.comCritical 9.4
The VAPIX Device Configuration framework allowed a privilege escalation, enabling a lower-privileged user to gain administrator privileges.
- Product
- AXIS OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2025An unauthenticated HTTP GET request to the /client.php endpoint will disclose the default administrator user credentials.CVE-2025-48045 · Other software · MICI Network Co. Ltd. · reported by cve@rapid7.comHigh 8.7
An unauthenticated HTTP GET request to the /client.php endpoint will disclose the default administrator user credentials.
- Product
- NetFax Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 28, 2025Incorrect access control in M2Soft CROWNIX Report & ERS affected v7.x to v7.4.3.599 and v8.x to v8.0.3.79 allows unauthorized attackers to obtain Administrator CVE-2024-57336 · Other software · reported by MITREMedium 6.5
Incorrect access control in M2Soft CROWNIX Report & ERS affected v7.x to v7.4.3.599 and v8.x to v8.0.3.79 allows unauthorized attackers to obtain Administrator account access.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2025An access control vulnerability was discovered in Grafana OSS where an Organization administrator could permanently delete the Server administrator account.CVE-2025-3580 · Other software · Grafana · reported by security@grafana.comMedium 5.5
An access control vulnerability was discovered in Grafana OSS where an Organization administrator could permanently delete the Server administrator account. This vulnerability exists in the DELETE /api/org/users/ endpoint. The vulnerability can be exploited when: 1. An Organization administrator exists 2. The Server administrator is either: - Not part of any organization, or - Part of the same organization as the Organization administrator Impact: - Organization administrators can permanently delete Server administrator accounts - If the only Server administrator is deleted, the Grafana instance becomes unmanageable - No super-user permissions remain in the system - Affects all users, organizations, and teams managed in the instance The vulnerability is particularly serious as it can lead to a complete loss of administrative control over the Grafana instance.
- Product
- Grafana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2025Stored Absolute Path Traversal vulnerabilities in ASPECT could expose sensitive data if administrator credentials become compromised.CVE-2024-13945 · Other software · ABB · reported by cybersecurity@ch.abb.comHigh 8.4
Stored Absolute Path Traversal vulnerabilities in ASPECT could expose sensitive data if administrator credentials become compromised. This issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.
- Product
- ASPECT-Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2025Predictable filename vulnerabilities in ASPECT may expose sensitive information to a potential attacker if administrator credentials become compromisedThis issuCVE-2024-51553 · Other software · ABB · reported by cybersecurity@ch.abb.comHigh 7
Predictable filename vulnerabilities in ASPECT may expose sensitive information to a potential attacker if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.
- Product
- ASPECT-Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2025Weak password storage vulnerabilities exist in ASPECT if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: through 3.*; NEXUS SeCVE-2024-51552 · Other software · ABB · reported by cybersecurity@ch.abb.comHigh 7.1
Weak password storage vulnerabilities exist in ASPECT if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.
- Product
- ASPECT-Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2025Large content vulnerabilities are present in ASPECT exposing a device to disk overutilization on a system if administrator credentials become compromisedThis isCVE-2024-48848 · Other software · ABB · reported by cybersecurity@ch.abb.comHigh 7
Large content vulnerabilities are present in ASPECT exposing a device to disk overutilization on a system if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.
- Product
- ASPECT-Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2025An issue in Ocuco Innovation - JOBMANAGER.EXE v2.10.24.16 allows attackers to bypass authentication and escalate privileges to Administrator via a crafted TCP pCVE-2024-41199 · Other software · Ocuco · reported by MITREHigh 7.2
An issue in Ocuco Innovation - JOBMANAGER.EXE v2.10.24.16 allows attackers to bypass authentication and escalate privileges to Administrator via a crafted TCP packet.
- Product
- Innovation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgist.githubusercontent.com
May 22, 2025An issue in Ocuco Innovation - REPORTS.EXE v2.10.24.13 allows attackers to bypass authentication and escalate privileges to Administrator via a crafted TCP packCVE-2024-41198 · Other software · Ocuco · reported by MITRECritical 9.8
An issue in Ocuco Innovation - REPORTS.EXE v2.10.24.13 allows attackers to bypass authentication and escalate privileges to Administrator via a crafted TCP packet.
- Product
- Innovation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgist.githubusercontent.com
May 22, 2025An issue in Ocuco Innovation - INVCLIENT.EXE v2.10.24.5 allows attackers to bypass authentication and escalate privileges to Administrator via a crafted TCP pacCVE-2024-41197 · Other software · Ocuco · reported by MITRECritical 9.8
An issue in Ocuco Innovation - INVCLIENT.EXE v2.10.24.5 allows attackers to bypass authentication and escalate privileges to Administrator via a crafted TCP packet.
- Product
- Innovation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgist.githubusercontent.com
May 22, 2025An issue in Ocuco Innovation - REPORTSERVER.EXE v2.10.24.13 allows attackers to bypass authentication and escalate privileges to Administrator via a crafted TCPCVE-2024-41196 · Other software · Ocuco · reported by MITRECritical 9.8
An issue in Ocuco Innovation - REPORTSERVER.EXE v2.10.24.13 allows attackers to bypass authentication and escalate privileges to Administrator via a crafted TCP packet.
- Product
- Innovation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcwe.mitre.orgdrive.google.com
May 22, 2025An issue in Ocuco Innovation - INNOVASERVICEINTF.EXE v2.10.24.17 allows attackers to bypass authentication and escalate privileges to Administrator via a crafteCVE-2024-41195 · Other software · Ocuco · reported by MITRECritical 9.8
An issue in Ocuco Innovation - INNOVASERVICEINTF.EXE v2.10.24.17 allows attackers to bypass authentication and escalate privileges to Administrator via a crafted TCP packet.
- Product
- Innovation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgist.githubusercontent.com
May 22, 2025Stored Cross Site Scripting vulnerabilities exist in ASPECT if administrator creden-tials become compromisedThis issue affects ASPECT-Enterprise: through 3.*; NCVE-2024-13958 · Other software · ABB · reported by cybersecurity@ch.abb.comMedium 4.6
Stored Cross Site Scripting vulnerabilities exist in ASPECT if administrator creden-tials become compromisedThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.
- Product
- ASPECT-Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2025SSRF Server Side Request Forgery vulnerabilities exist in ASPECT if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: through 3.CVE-2024-13957 · Other software · ABB · reported by cybersecurity@ch.abb.comHigh 7
SSRF Server Side Request Forgery vulnerabilities exist in ASPECT if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.
- Product
- ASPECT-Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.