Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,711 results · page 13 of 35
Mar 15, 2024Discourse is an open source platform for community discussion.CVE-2024-28242 · Other software · discourse · reported by GitHubMedium 5.3
Discourse is an open source platform for community discussion. In affected versions an attacker can learn that secret categories exist when they have backgrounds set. The issue is patched in the latest stable, beta and tests-passed version of Discourse. Users are advised to upgrade. Users unable to upgrade should temporarily remove category backgrounds.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2024Discourse is an open source platform for community discussion.CVE-2024-27100 · Other software · discourse · reported by GitHubMedium 6.5
Discourse is an open source platform for community discussion. In affected versions the endpoints for suspending users, silencing users and exporting CSV files weren't enforcing limits on the sizes of the parameters that they accept. This could lead to excessive resource consumption which could render an instance inoperable. A site could be disrupted by either a malicious moderator on the same site or a malicious staff member on another site in the same multisite cluster. This issue is patched in the latest stable, beta and tests-passed versions of Discourse. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2024Discourse is an open source platform for community discussion.CVE-2024-27085 · Other software · discourse · reported by GitHubMedium 6.5
Discourse is an open source platform for community discussion. In affected versions users that are allowed to invite others can inject arbitrarily large data in parameters used in the invite route. The problem has been patched in the latest version of Discourse. Users are advised to upgrade. Users unable to upgrade should disable invites or restrict access to them using the `invite allowed groups` site setting.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2024Discourse is an open source platform for community discussion.CVE-2024-24827 · Other software · discourse · reported by GitHubMedium 5.3
Discourse is an open source platform for community discussion. Without a rate limit on the POST /uploads endpoint, it makes it easier for an attacker to carry out a DoS attack on the server since creating an upload can be a resource intensive process. Do note that the impact varies from site to site as various site settings like `max_image_size_kb`, `max_attachment_size_kb` and `max_image_megapixels` will determine the amount of resources used when creating an upload. The issue is patched in the latest stable, beta and tests-passed version of Discourse. Users are advised to upgrade. Users unable to upgrade should reduce `max_image_size_kb`, `max_attachment_size_kb` and `max_image_megapixels` as smaller uploads require less resources to process. Alternatively, `client_max_body_size` can be reduced in Nginx to prevent large uploads from reaching the server.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2024Discourse is an open source platform for community discussion.CVE-2024-24748 · Other software · discourse · reported by GitHubMedium 5.3
Discourse is an open source platform for community discussion. In affected versions an attacker can learn that a secret subcategory exists under a public category which has no public subcategories. The issue is patched in the latest stable, beta and tests-passed version of Discourse. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2024parse-server is a Parse Server for Node.js / Express.CVE-2024-27298 · Other software · parse-community · reported by GitHubCritical 10
parse-server is a Parse Server for Node.js / Express. This vulnerability allows SQL injection when Parse Server is configured to use the PostgreSQL database. The vulnerability has been fixed in 6.5.0 and 7.0.0-alpha.20.
- Product
- parse-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2024A vulnerability was found in LangChain langchain_community 0.0.26.CVE-2024-2057 · Other software · LangChain · reported by VulDBMedium 6.3
A vulnerability was found in LangChain langchain_community 0.0.26. It has been classified as critical. Affected is the function load_local in the library libs/community/langchain_community/retrievers/tfidf.py of the component TFIDFRetriever. The manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.0.27 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-255372.
- Product
- langchain_community
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2024In the module "Import/Update Bulk Product from any Csv/Excel File Pro" (ba_importer) up to version 1.1.28 from Buy Addons for PrestaShop, a guest can perform SQCVE-2024-25843 · Other software · communitydeveloper · reported by MITRECritical 9.8
In the module "Import/Update Bulk Product from any Csv/Excel File Pro" (ba_importer) up to version 1.1.28 from Buy Addons for PrestaShop, a guest can perform SQL injection in affected versions.
- Product
- import\/update_bulk_product_from_any_csv\/excel_file_pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaddons.prestashop.comsecurity.friendsofpresta.org
Feb 26, 2024User can send a chat that contains an XSS opportunity that will then run when the chat is sent and on subsequent page loads.CVE-2024-0435 · Other software · mintplex-labs · reported by security@huntr.devMedium 5.4
User can send a chat that contains an XSS opportunity that will then run when the chat is sent and on subsequent page loads. Given the minimum requirement for a user to send a chat is to be given access to a workspace via an admin the risk is low. Additionally, the location in which the XSS renders is only limited to the user who submits the XSS. Ultimately, this attack is limited to the user attacking themselves. There is no anonymous chat submission unless the user does not take the minimum steps required to protect their instance.
- Product
- mintplex-labs/anything-llm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2024SteVe v3.6.0 was discovered to use predictable transaction ID's when receiving a StartTransaction request.CVE-2024-25407 · Other software · Steve-community · reported by MITREHigh 7.5
SteVe v3.6.0 was discovered to use predictable transaction ID's when receiving a StartTransaction request. This vulnerability can allow attackers to cause a Denial of Service (DoS) by using the predicted transaction ID's to terminate other transactions.
- Product
- Steve
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2024CSV Injection vulnerability in '/members/moremember.pl' and '/admin/aqbudgets.pl' endpoints in Koha Library Management System version 23.05.05 and earlier allowCVE-2024-24337 · Other software · koha-community · reported by MITREHigh 8
CSV Injection vulnerability in '/members/moremember.pl' and '/admin/aqbudgets.pl' endpoints in Koha Library Management System version 23.05.05 and earlier allows attackers to to inject DDE commands into csv exports via the 'Budget' and 'Patrons Member' components.
- Product
- koha_library_software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnitipoom-jar.github.ionitipoom-jaroonchaipipat.github.io
Feb 12, 2024 Dell Unity, versions prior to 5.4, contains a Cross-site scripting vulnerability.CVE-2024-22230 · Other software · Dell · reported by security_alert@emc.comMedium 6.4
Dell Unity, versions prior to 5.4, contains a Cross-site scripting vulnerability. An authenticated attacker could potentially exploit this vulnerability, stealing session information, masquerading as the affected user or carry out any actions that this user could perform, or to generally control the victim's browser.
- Product
- Unity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2024 Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability in its svc_cifssupport utility.CVE-2024-22228 · Other software · Dell · reported by security_alert@emc.comHigh 7.8
Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability in its svc_cifssupport utility. An authenticated attacker could potentially exploit this vulnerability, escaping the restricted shell and execute arbitrary operating system commands with root privileges.
- Product
- Unity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2024 Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability in its svc_dc utility.CVE-2024-22227 · Other software · Dell · reported by security_alert@emc.comHigh 7.8
Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability in its svc_dc utility. An authenticated attacker could potentially exploit this vulnerability, leading to the ability execute commands with root privileges.
- Product
- Unity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2024 Dell Unity, versions prior to 5.4, contain a path traversal vulnerability in its svc_supportassist utility.CVE-2024-22226 · Other software · Dell · reported by security_alert@emc.comLow 3.3
Dell Unity, versions prior to 5.4, contain a path traversal vulnerability in its svc_supportassist utility. An authenticated attacker could potentially exploit this vulnerability, to gain unauthorized write access to the files stored on the server filesystem, with elevated privileges.
- Product
- Unity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2024 Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability in its svc_supportassist utility.CVE-2024-22225 · Other software · Dell · reported by security_alert@emc.comHigh 7.8
Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability in its svc_supportassist utility. An authenticated attacker could potentially exploit this vulnerability, leading to execution of arbitrary operating system commands with root privileges.
- Product
- Unity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2024 Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability in its svc_nas utility.CVE-2024-22224 · Other software · Dell · reported by security_alert@emc.comHigh 7.8
Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability in its svc_nas utility. An authenticated attacker could potentially exploit this vulnerability, escaping the restricted shell and execute arbitrary operating system commands with root privileges.
- Product
- Unity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2024 Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability within its svc_cbr utility.CVE-2024-22223 · Other software · Dell · reported by security_alert@emc.comHigh 7.8
Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability within its svc_cbr utility. An authenticated malicious user with local access could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the application's underlying OS, with the privileges of the vulnerable application.
- Product
- Unity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2024 Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability within its svc_udoctor utility.CVE-2024-22222 · Other software · Dell · reported by security_alert@emc.comHigh 7.8
Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability within its svc_udoctor utility. An authenticated malicious user with local access could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the application's underlying OS, with the privileges of the vulnerable application.
- Product
- Unity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2024 Dell Unity, versions prior to 5.4, contains SQL Injection vulnerability.CVE-2024-22221 · Other software · Dell · reported by security_alert@emc.comMedium 4.5
Dell Unity, versions prior to 5.4, contains SQL Injection vulnerability. An authenticated attacker could potentially exploit this vulnerability, leading to exposure of sensitive information.
- Product
- Unity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2024 Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability in its svc_cava utility.CVE-2024-0170 · Other software · Dell · reported by security_alert@emc.comHigh 7.8
Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability in its svc_cava utility. An authenticated attacker could potentially exploit this vulnerability, escaping the restricted shell and execute arbitrary operating system commands with root privileges.
- Product
- Unity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2024Dell Unity, version(s) 5.3 and prior, contain(s) an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability.CVE-2024-0169 · Other software · Dell · reported by security_alert@emc.comMedium 5.7
Dell Unity, version(s) 5.3 and prior, contain(s) an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure.
- Product
- Unity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2024 Dell Unity, versions prior to 5.4, contains a Command Injection Vulnerability in svc_oscheck utility.CVE-2024-0168 · Other software · Dell · reported by security_alert@emc.comHigh 7.8
Dell Unity, versions prior to 5.4, contains a Command Injection Vulnerability in svc_oscheck utility. An authenticated attacker could potentially exploit this vulnerability, leading to the ability to inject arbitrary operating system commands. This vulnerability allows an authenticated attacker to execute commands with root privileges.
- Product
- Unity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2024 Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability in the svc_topstats utility.CVE-2024-0167 · Other software · Dell · reported by security_alert@emc.comHigh 7.8
Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability in the svc_topstats utility. An authenticated attacker could potentially exploit this vulnerability, leading to the ability to overwrite arbitrary files on the file system with root privileges.
- Product
- Unity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2024 Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability in its svc_tcpdump utility.CVE-2024-0166 · Other software · Dell · reported by security_alert@emc.comHigh 7.8
Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability in its svc_tcpdump utility. An authenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands with elevated privileges.
- Product
- Unity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2024 Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability in its svc_acldb_dump utility.CVE-2024-0165 · Other software · Dell · reported by security_alert@emc.comHigh 7.8
Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability in its svc_acldb_dump utility. An authenticated attacker could potentially exploit this vulnerability, leading to execution of arbitrary operating system commands with root privileges.
- Product
- Unity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2024 Dell Unity, versions prior to 5.4, contain an OS Command Injection Vulnerability in its svc_topstats utility.CVE-2024-0164 · Other software · Dell · reported by security_alert@emc.comHigh 7.8
Dell Unity, versions prior to 5.4, contain an OS Command Injection Vulnerability in its svc_topstats utility. An authenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary commands with elevated privileges.
- Product
- Unity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2024An arbitrary file upload vulnerability in /upgrade/control.php of ZenTao Community Edition v18.10, ZenTao Biz v8.10, and ZenTao Max v4.10 allows attackers to exCVE-2024-24202 · Other software · easycorp · reported by MITRECritical 9.8
An arbitrary file upload vulnerability in /upgrade/control.php of ZenTao Community Edition v18.10, ZenTao Biz v8.10, and ZenTao Max v4.10 allows attackers to execute arbitrary code via uploading a crafted .txt file.
- Product
- zentao_max
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordclammy-blizzard-8ef.notion.siteclammy-blizzard-8ef.notion.site
Feb 6, 2024 Dell Data Protection Search 19.2.0 and above contain an exposed password opportunity in plain text when using LdapSettings.get_ldap_info in DP Search.CVE-2024-22433 · Other software · Dell · reported by security_alert@emc.comHigh 8.8
Dell Data Protection Search 19.2.0 and above contain an exposed password opportunity in plain text when using LdapSettings.get_ldap_info in DP Search. A remote unauthorized unauthenticated attacker could potentially exploit this vulnerability leading to a loss of Confidentiality, Integrity, Protection, and remote takeover of the system. This is a high-severity vulnerability as it allows an attacker to take complete control of DP Search to affect downstream protected devices.
- Product
- Data Protection Search
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 31, 2024Community by PeepSo – Social Network, Membership, Registration, User Profiles: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-22158 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PeepSo Community by PeepSo – Social Network, Membership, Registration, User Profiles allows Stored XSS.This issue affects Community by PeepSo – Social Network, Membership, Registration, User Profiles: from n/a before 6.3.1.0.
- Product
- Community by PeepSo – Social Network, Membership, Registration, User Profiles
- Fixed in
- 6.3.1.0
- What to do
- Update Community by PeepSo – Social Network, Membership, Registration, User Profiles to 6.3.1.0 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 26, 2024A vulnerability in the web-based management interface of Cisco Unity Connection could allow an authenticated, remote attacker to conduct a cross-site scripting CVE-2024-20305 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4.8
A vulnerability in the web-based management interface of Cisco Unity Connection could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
- Product
- Cisco Unity Connection
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.comsec.cloudapps.cisco.com
Jan 24, 2024 Dell Unity, versions prior to 5.4, contain a vulnerability whereby log messages can be spoofed by an authenticated attacker.CVE-2024-22229 · Other software · Dell · reported by security_alert@emc.comLow 3.1
Dell Unity, versions prior to 5.4, contain a vulnerability whereby log messages can be spoofed by an authenticated attacker. An attacker could exploit this vulnerability to forge log entries, create false alarms, and inject malicious content into logs that compromise logs integrity. A malicious attacker could also prevent the product from logging information while malicious actions are performed or implicate an arbitrary user for malicious activities.
- Product
- Unity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2024A vulnerability in the web-based management interface of Cisco Unity Connection could allow an unauthenticated, remote attacker to upload arbitrary files to an CVE-2024-20272 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.3
A vulnerability in the web-based management interface of Cisco Unity Connection could allow an unauthenticated, remote attacker to upload arbitrary files to an affected system and execute commands on the underlying operating system. This vulnerability is due to a lack of authentication in a specific API and improper validation of user-supplied data. An attacker could exploit this vulnerability by uploading arbitrary files to an affected system. A successful exploit could allow the attacker to store malicious files on the system, execute arbitrary commands on the operating system, and elevate privileges to root.
- Product
- Cisco Unity Connection
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.comsec.cloudapps.cisco.com
Jan 16, 2024A Cross Site Scripting (XSS) vulnerability in evewa3ajax.php in GRUEN eVEWA3 Community 31 through 53 allows attackers to obtain escalated privileges via a craftCVE-2023-25295 · Other software · Gruen · reported by MITREMedium 6.1
A Cross Site Scripting (XSS) vulnerability in evewa3ajax.php in GRUEN eVEWA3 Community 31 through 53 allows attackers to obtain escalated privileges via a crafted request to the login panel.
- Product
- Evewa3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.munz4u.deblog.munz4u.de
Jan 16, 2024Community by PeepSo: Does not sanitise and escape various parameters and generated URLs before outputting them back attributesCVE-2024-0187 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Community by PeepSo WordPress plugin before 6.3.1.2 does not sanitise and escape various parameters and generated URLs before outputting them back attributes, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Community by PeepSo
- Fixed in
- 6.3.1.2
- What to do
- Update Community by PeepSo to 6.3.1.2 or newer.
Jan 16, 2024Community by PeepSo: Does not have CSRF checkCVE-2023-7125 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Community by PeepSo WordPress plugin before 6.3.1.2 does not have CSRF check when creating a user post (visible on their wall in their profile page), which could allow attackers to make logged in users perform such action via a CSRF attack
- Product
- Community by PeepSo
- Fixed in
- 6.3.1.2
- What to do
- Update Community by PeepSo to 6.3.1.2 or newer.
Jan 12, 2024Discourse is a platform for community discussion.CVE-2024-21655 · Other software · discourse · reported by GitHubMedium 4.3
Discourse is a platform for community discussion. For fields that are client editable, limits on sizes are not imposed. This allows a malicious actor to cause a Discourse instance to use excessive disk space and also often excessive bandwidth. The issue is patched 3.1.4 and 3.2.0.beta4.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2024Rubygems.org is the Ruby community's gem hosting service.CVE-2024-21654 · Other software · rubygems · reported by GitHubMedium 4.8
Rubygems.org is the Ruby community's gem hosting service. Rubygems.org users with MFA enabled would normally be protected from account takeover in the case of email account takeover. However, a workaround on the forgotten password form allows an attacker to bypass the MFA requirement and takeover the account. This vulnerability has been patched in commit 0b3272a.
- Product
- rubygems.org
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2024Discourse is a platform for community discussion.CVE-2023-49099 · Other software · discourse · reported by GitHubLow 3.1
Discourse is a platform for community discussion. Under very specific circumstances, secure upload URLs associated with posts can be accessed by guest users even when login is required. This vulnerability has been patched in 3.2.0.beta4 and 3.1.4.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2024Discourse is a platform for community discussion.CVE-2023-48297 · Other software · discourse · reported by GitHubHigh 8.6
Discourse is a platform for community discussion. The message serializer uses the full list of expanded chat mentions (@all and @here) which can lead to a very long array of users. This issue was patched in versions 3.1.4 and beta 3.2.0.beta5.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2024GitLab Community and Enterprise Editions Improper Access Control VulnerabilityCVE-2023-7028 · Websites & servers · GitLab · reported by cve@gitlab.comExploitedCritical 10
GitLab Community and Enterprise Editions contain an improper access control vulnerability. This allows an attacker to trigger password reset emails to be sent to an unverified email address to ultimately facilitate an account takeover.
- Product
- GitLab CE/EE
- On CISA’s list since
- May 1, 2024 (federal fix deadline May 22, 2024)
- What to do
- Attackers are using this now. Install GitLab’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA cataloggitlab.comhackerone.com
Jan 3, 2024An issue was discovered in O-RAN Software Community ric-plt-e2mgr in the G-Release environment, allows remote attackers to cause a denial of service (DoS) via aCVE-2023-42358 · Other software · O-ran-sc · reported by MITREHigh 7.7
An issue was discovered in O-RAN Software Community ric-plt-e2mgr in the G-Release environment, allows remote attackers to cause a denial of service (DoS) via a crafted request to the E2Manager API component.
- Product
- Ric-plt-e2mgr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjira.o-ran-sc.orgjira.o-ran-sc.org
Dec 26, 2023SteVe Community ocpp-jaxb before 0.0.8 generates invalid timestamps such as ones with month 00 in certain situations (such as when an application receives a StaCVE-2023-52096 · Other software · Steve-community · reported by MITREHigh 7.5
SteVe Community ocpp-jaxb before 0.0.8 generates invalid timestamps such as ones with month 00 in certain situations (such as when an application receives a StartTransaction Open Charge Point Protocol message with a timestamp parameter of 1000000). This may lead to a SQL exception in applications, and may undermine the integrity of transaction records.
- Product
- Ocpp-jaxb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 21, 2023Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for: Authorization Bypass Through User-Controlled KeyCVE-2023-47191 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Authorization Bypass Through User-Controlled Key vulnerability in KaineLabs Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress.This issue affects Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress: from n/a through 1.2.2.
- Product
- Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 11, 2023An issue was discovered in Hyland Alfresco Community Edition through 7.2.0.CVE-2023-49964 · Other software · Hyland · reported by MITREHigh 8.8
An issue was discovered in Hyland Alfresco Community Edition through 7.2.0. By inserting malicious content in the folder.get.html.ftl file, an attacker may perform SSTI (Server-Side Template Injection) attacks, which can leverage FreeMarker exposed objects to bypass restrictions and achieve RCE (Remote Code Execution). NOTE: this issue exists because of an incomplete fix for CVE-2020-12873.
- Product
- Alfresco Content Services
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comalfresco.com
Nov 30, 2023Community by PeepSo – Social Network, Membership, Registration, User Profiles: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-48746 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PeepSo Community by PeepSo – Social Network, Membership, Registration, User Profiles allows Reflected XSS.This issue affects Community by PeepSo – Social Network, Membership, Registration, User Profiles: from n/a through 6.2.6.0.
- Product
- Community by PeepSo – Social Network, Membership, Registration, User Profiles
- Affected
- up to 6.2.6.0
- What to do
- Affects up to 6.2.6.0. Update Community by PeepSo – Social Network, Membership, Registration, User Profiles to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 30, 2023Community by PeepSo – Social Network, Membership, Registration, User Profiles: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-47850 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PeepSo Community by PeepSo – Social Network, Membership, Registration, User Profiles allows Stored XSS.This issue affects Community by PeepSo – Social Network, Membership, Registration, User Profiles: from n/a through 6.2.2.0.
- Product
- Community by PeepSo – Social Network, Membership, Registration, User Profiles
- Affected
- up to 6.2.2.0
- What to do
- Affects up to 6.2.2.0. Update Community by PeepSo – Social Network, Membership, Registration, User Profiles to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 28, 2023Cross Site Scripting (XSS) in Search filters in Prestashop Amazzing filter version up to version 3.2.5, allows remote attackers to inject arbitrary JavaScript cCVE-2023-48042 · Other software · Communitydeveloper · reported by MITREMedium 6.1
Cross Site Scripting (XSS) in Search filters in Prestashop Amazzing filter version up to version 3.2.5, allows remote attackers to inject arbitrary JavaScript code.
- Product
- Amazzing Filter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaddons.prestashop.commedium.com
Nov 22, 2023Cross-Site Request Forgery (CSRF) vulnerability in PeepSo Download Community by PeepSo plugin <= 6.1.6.0 versions.CVE-2023-39925 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in PeepSo Download Community by PeepSo plugin <= 6.1.6.0 versions.
- Fixed in
- 6.2.0.0
- What to do
- Update the plugin to 6.2.0.0 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 22, 2023 Dell Unity prior to 5.3 contains a 'man in the middle' vulnerability in the vmadapter component.CVE-2023-43082 · Other software · Dell · reported by security_alert@emc.comHigh 8.6
Dell Unity prior to 5.3 contains a 'man in the middle' vulnerability in the vmadapter component. If a customer has a certificate signed by a third-party public Certificate Authority, the vCenter CA could be spoofed by an attacker who can obtain a CA-signed certificate.
- Product
- Unity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.