Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,721 results · page 20 of 55
May 2, 2024Softing edgeConnector Siemens ConditionRefresh Resource Exhaustion Denial-of-Service Vulnerability.CVE-2023-27334 · Other software · Softing · reported by zdi-disclosures@trendmicro.comHigh 7.5
Softing edgeConnector Siemens ConditionRefresh Resource Exhaustion Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Softing edgeConnector Siemens. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of OPC UA ConditionRefresh requests. By sending a large number of requests, an attacker can consume all available resources on the server. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-20498.
- Product
- edgeConnector Siemens
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordindustrial.softing.comzerodayinitiative.com
Apr 30, 2024In FRRouting (FRR) through 9.1, it is possible for the get_edge() function in ospf_te.c in the OSPF daemon to return a NULL pointer.CVE-2024-34088 · Other software · frrouting · reported by MITREHigh 7.5
In FRRouting (FRR) through 9.1, it is possible for the get_edge() function in ospf_te.c in the OSPF daemon to return a NULL pointer. In cases where calling functions do not handle the returned NULL value, the OSPF daemon crashes, leading to denial of service.
- Product
- frrouting
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2024Knowledge Base documentation & wiki plugin – BasePress: Missing AuthorizationCVE-2024-33588 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in codeSavory Knowledge Base documentation & wiki plugin – BasePress.This issue affects Knowledge Base documentation & wiki plugin – BasePress: from n/a through 2.16.1.
- Product
- Knowledge Base documentation & wiki plugin – BasePress
- Affected
- up to 2.16.1
- What to do
- Affects up to 2.16.1. Update Knowledge Base documentation & wiki plugin – BasePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 29, 2024Knowledge Base documentation & wiki plugin – BasePress: Server-Side Request Forgery (SSRF)CVE-2024-33590 · WordPress plugins & themes · reported by PatchstackMedium 5
Server-Side Request Forgery (SSRF) vulnerability in codeSavory Knowledge Base documentation & wiki plugin – BasePress.This issue affects Knowledge Base documentation & wiki plugin – BasePress: from n/a through 2.16.1.
- Product
- Knowledge Base documentation & wiki plugin – BasePress
- Affected
- up to 2.16.1
- What to do
- Affects up to 2.16.1. Update Knowledge Base documentation & wiki plugin – BasePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 19, 2024Microsoft Edge (Chromium-based) Security Feature Bypass VulnerabilityCVE-2024-29991 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5
Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 19, 2024FFmpeg v.n6.1-3-g466799d4f5 allows a heap-based buffer overflow via the ff_gaussian_blur_8 function in libavfilter/edge_template.c:116:5 component.CVE-2023-50009 · Other software · ffmpeg · reported by MITREHigh 8
FFmpeg v.n6.1-3-g466799d4f5 allows a heap-based buffer overflow via the ff_gaussian_blur_8 function in libavfilter/edge_template.c:116:5 component.
- Product
- ffmpeg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 18, 2024Microsoft Edge (Chromium-based) Information Disclosure VulnerabilityCVE-2024-29987 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 18, 2024Microsoft Edge for Android (Chromium-based) Information Disclosure VulnerabilityCVE-2024-29986 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.4
Microsoft Edge for Android (Chromium-based) Information Disclosure Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 18, 2024Envoy is a cloud-native, open source edge and service proxy.CVE-2024-32475 · Other software · envoyproxy · reported by GitHubHigh 7.5
Envoy is a cloud-native, open source edge and service proxy. When an upstream TLS cluster is used with `auto_sni` enabled, a request containing a `host`/`:authority` header longer than 255 characters triggers an abnormal termination of Envoy process. Envoy does not gracefully handle an error when setting SNI for outbound TLS connection. The error can occur when Envoy attempts to use the `host`/`:authority` header value longer than 255 characters as SNI for outbound TLS connection. SNI length is limited to 255 characters per the standard. Envoy always expects this operation to succeed and abnormally aborts the process when it fails. This vulnerability is fixed in 1.30.1, 1.29.4, 1.28.3, and 1.27.5.
- Product
- envoy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2024BetterDocs – Best Documentation, FAQ & Knowledge Base Plugin with AI Support & Instant Answer For Elementor & Gutenberg: Stored Cross-Site ScriptingCVE-2024-2845 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The BetterDocs – Best Documentation, FAQ & Knowledge Base Plugin with AI Support & Instant Answer For Elementor & Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 3.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- BetterDocs – Best Documentation, FAQ & Knowledge Base Plugin with AI Support & Instant Answer For Elementor & Gutenberg
- Affected
- up to 3.4.2
- What to do
- Affects up to 3.4.2. Update BetterDocs – Best Documentation, FAQ & Knowledge Base Plugin with AI Support & Instant Answer For Elementor & Gutenberg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 5, 2024 A potential vulnerability were reported in the BIOS of some Desktop, Smart Edge, and ThinkStation products that could allow a local attacker with elevated privCVE-2023-25494 · Other software · Lenovo · reported by psirt@lenovo.comMedium 6.7
A potential vulnerability were reported in the BIOS of some Desktop, Smart Edge, and ThinkStation products that could allow a local attacker with elevated privileges to write to NVRAM variables.
- Product
- Desktop BIOS, Smart Edge BIOS, ThinkStation BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lenovo.comsupport.lenovo.com
Apr 5, 2024A potential vulnerability was reported in the BIOS update tool driver for some Desktop, Smart Edge, Smart Office, and ThinkStation products that could allow a lCVE-2023-25493 · Other software · Lenovo · reported by psirt@lenovo.comMedium 6.7
A potential vulnerability was reported in the BIOS update tool driver for some Desktop, Smart Edge, Smart Office, and ThinkStation products that could allow a local user with elevated privileges to execute arbitrary code.
- Product
- BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lenovo.comsupport.lenovo.com
Apr 4, 2024Yubico ykman-gui (aka YubiKey Manager GUI) before 1.2.6 on Windows, when Edge is not used, allows privilege escalation because browser windows can open as AdminCVE-2024-31498 · Other software · yubico · reported by MITREHigh 8.8
Yubico ykman-gui (aka YubiKey Manager GUI) before 1.2.6 on Windows, when Edge is not used, allows privilege escalation because browser windows can open as Administrator.
- Product
- yubikey_manager_gui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2024Microsoft Edge (Chromium-based) Spoofing VulnerabilityCVE-2024-29981 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.3
Microsoft Edge (Chromium-based) Spoofing Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 4, 2024Microsoft Edge (Chromium-based) Webview2 Spoofing VulnerabilityCVE-2024-29049 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.1
Microsoft Edge (Chromium-based) Webview2 Spoofing Vulnerability
- Product
- Microsoft Edge (Chromium-based) Extended Stable
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 4, 2024Envoy is a cloud-native, open source edge and service proxy.CVE-2024-30255 · Other software · envoyproxy · reported by GitHubMedium 5.3
Envoy is a cloud-native, open source edge and service proxy. The HTTP/2 protocol stack in Envoy versions prior to 1.29.3, 1.28.2, 1.27.4, and 1.26.8 are vulnerable to CPU exhaustion due to flood of CONTINUATION frames. Envoy's HTTP/2 codec allows the client to send an unlimited number of CONTINUATION frames even after exceeding Envoy's header map limits. This allows an attacker to send a sequence of CONTINUATION frames without the END_HEADERS bit set causing CPU utilization, consuming approximately 1 core per 300Mbit/s of traffic and culminating in denial of service through CPU exhaustion. Users should upgrade to version 1.29.3, 1.28.2, 1.27.4, or 1.26.8 to mitigate the effects of the CONTINUATION flood. As a workaround, disable HTTP/2 protocol for downstream connections.
- Product
- envoy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Apr 4, 2024Envoy is a cloud-native, open-source edge and service proxy.CVE-2024-27919 · Other software · envoyproxy · reported by GitHubHigh 7.5
Envoy is a cloud-native, open-source edge and service proxy. In versions 1.29.0 and 1.29.1, theEnvoy HTTP/2 protocol stack is vulnerable to the flood of CONTINUATION frames. Envoy's HTTP/2 codec does not reset a request when header map limits have been exceeded. This allows an attacker to send an sequence of CONTINUATION frames without the END_HEADERS bit set causing unlimited memory consumption. This can lead to denial of service through memory exhaustion. Users should upgrade to versions 1.29.2 to mitigate the effects of the CONTINUATION flood. Note that this vulnerability is a regression in Envoy version 1.29.0 and 1.29.1 only. As a workaround, downgrade to version 1.28.1 or earlier or disable HTTP/2 protocol for downstream connections.
- Product
- envoy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Apr 3, 2024Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an improper privilege management security vulnerability.CVE-2024-0172 · Other software · Dell · reported by security_alert@emc.comHigh 7.9
Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an improper privilege management security vulnerability. An unauthenticated local attacker could potentially exploit this vulnerability, leading to privilege escalation.
- Product
- PowerEdge Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2024VMware SD-WAN Edge contains a missing authentication and protection mechanism vulnerability.CVE-2024-22247 · Other software · vmware · reported by security@vmware.comMedium 4.8
VMware SD-WAN Edge contains a missing authentication and protection mechanism vulnerability. A malicious actor with physical access to the SD-WAN Edge appliance during activation can potentially exploit this vulnerability to access the BIOS configuration. In addition, the malicious actor may be able to exploit the default boot priority configured.
- Product
- sd-wan_edge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2024VMware SD-WAN Edge contains an unauthenticated command injection vulnerability potentially leading to remote code execution.CVE-2024-22246 · Other software · vmware · reported by security@vmware.comHigh 7.4
VMware SD-WAN Edge contains an unauthenticated command injection vulnerability potentially leading to remote code execution. A malicious actor with local access to the Edge Router UI during activation may be able to perform a command injection attack that could lead to full control of the router.
- Product
- sd-wan_edge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2024A vulnerability in the IPv4 Software-Defined Access (SD-Access) fabric edge node feature of Cisco IOS XE Software could allow an unauthenticated, remote attackeCVE-2024-20314 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 8.6
A vulnerability in the IPv4 Software-Defined Access (SD-Access) fabric edge node feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause high CPU utilization and stop all traffic processing, resulting in a denial of service (DoS) condition on an affected device. This vulnerability is due to improper handling of certain IPv4 packets. An attacker could exploit this vulnerability by sending certain IPv4 packets to an affected device. A successful exploit could allow the attacker to cause the device to exhaust CPU resources and stop processing traffic, resulting in a DoS condition.
- Product
- Cisco IOS XE Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.comsec.cloudapps.cisco.com
Mar 27, 2024Knowledge Base for Documentation, FAQs with AI Assistance: Deserialization of Untrusted DataCVE-2024-24842 · WordPress plugins & themes · reported by PatchstackHigh 8.7
Deserialization of Untrusted Data vulnerability in Echo Plugins Knowledge Base for Documentation, FAQs with AI Assistance.This issue affects Knowledge Base for Documentation, FAQs with AI Assistance: from n/a through 11.30.2.
- Product
- Knowledge Base for Documentation, FAQs with AI Assistance
- Affected
- up to 11.30.2
- What to do
- Affects up to 11.30.2. Update Knowledge Base for Documentation, FAQs with AI Assistance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 22, 2024Microsoft Edge (Chromium-based) Spoofing VulnerabilityCVE-2024-29057 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.3
Microsoft Edge (Chromium-based) Spoofing Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 22, 2024Microsoft Edge (Chromium-based) Security Feature Bypass VulnerabilityCVE-2024-26247 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.7
Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 21, 2024The SolarEdge mySolarEdge application before 2.20.1 for Android has a certificate verification issue that allows a Machine-in-the-middle (MitM) attacker to readCVE-2024-28756 · Other software · solaredge · reported by MITREMedium 5.9
The SolarEdge mySolarEdge application before 2.20.1 for Android has a certificate verification issue that allows a Machine-in-the-middle (MitM) attacker to read and alter all network traffic between the application and the server.
- Product
- mysolaredge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2024Microsoft Edge for Android (Chromium-based) Information Disclosure VulnerabilityCVE-2024-26196 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.3
Microsoft Edge for Android (Chromium-based) Information Disclosure Vulnerability
- Product
- Microsoft Edge for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 19, 2024Dell PowerEdge Server BIOS contains an Improper SMM communication buffer verification vulnerability.CVE-2024-25942 · Other software · Dell · reported by security_alert@emc.comMedium 4.4
Dell PowerEdge Server BIOS contains an Improper SMM communication buffer verification vulnerability. A physical high privileged attacker could potentially exploit this vulnerability leading to arbitrary writes to SMRAM.
- Product
- PowerEdge Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2024Dell PowerEdge Server BIOS contains a heap-based buffer overflow vulnerability.CVE-2024-22453 · Other software · Dell · reported by security_alert@emc.comHigh 7.2
Dell PowerEdge Server BIOS contains a heap-based buffer overflow vulnerability. A local high privileged attacker could potentially exploit this vulnerability to write to otherwise unauthorized memory.
- Product
- PowerEdge Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 14, 2024Microsoft Edge (Chromium-based) Security Feature Bypass VulnerabilityCVE-2024-26246 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comLow 3.9
Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
- Product
- Microsoft Edge for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 14, 2024Microsoft Edge (Chromium-based) Security Feature Bypass VulnerabilityCVE-2024-26163 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.7
Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 14, 2024 The affected product is vulnerable to a cleartext transmission of sensitive information vulnerability, which may allow an attacker to capture packets to craft CVE-2024-0860 · Other software · Softing · reported by ics-cert@hq.dhs.govHigh 8
The affected product is vulnerable to a cleartext transmission of sensitive information vulnerability, which may allow an attacker to capture packets to craft their own requests.
- Product
- edgeConnector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2024A path traversal vulnerability exists in Arcserve Unified Data Protection 9.2 and 8.1 in edge-app-base-webui.jar!com.ca.arcserve.edge.app.base.ui.server.servletCVE-2024-0800 · Other software · Arcserve · reported by vulnreport@tenable.comHigh 8.8
A path traversal vulnerability exists in Arcserve Unified Data Protection 9.2 and 8.1 in edge-app-base-webui.jar!com.ca.arcserve.edge.app.base.ui.server.servlet.ImportNodeServlet.
- Product
- Unified Data Protection
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Mar 13, 2024An authentication bypass vulnerability exists in Arcserve Unified Data Protection 9.2 and 8.1 in the edge-app-base-webui.jar!com.ca.arcserve.edge.app.base.ui.seCVE-2024-0799 · Other software · Arcserve · reported by vulnreport@tenable.comCritical 9.8
An authentication bypass vulnerability exists in Arcserve Unified Data Protection 9.2 and 8.1 in the edge-app-base-webui.jar!com.ca.arcserve.edge.app.base.ui.server.EdgeLoginServiceImpl.doLogin() function within wizardLogin.
- Product
- Unified Data Protection
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Mar 13, 2024Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an improper parameter initialization vulnerability.CVE-2024-0173 · Other software · Dell · reported by security_alert@emc.comLow 3.8
Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an improper parameter initialization vulnerability. A local low privileged attacker could potentially exploit this vulnerability to read the contents of non-SMM stack memory.
- Product
- PowerEdge Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2024Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain a TOCTOU race condition vulnerability.CVE-2024-0163 · Other software · Dell · reported by security_alert@emc.comMedium 5.3
Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain a TOCTOU race condition vulnerability. A local low privileged attacker could potentially exploit this vulnerability to gain access to otherwise unauthorized resources.
- Product
- PowerEdge BIOS Intel 16G
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2024Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an Improper SMM communication buffer verification vulnerability.CVE-2024-0162 · Other software · Dell · reported by security_alert@emc.comMedium 5.3
Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an Improper SMM communication buffer verification vulnerability. A local low privileged attacker could potentially exploit this vulnerability leading to out-of-bound read/writes to SMRAM.
- Product
- PowerEdge BIOS Intel 16G
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2024Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an improper parameter initialization vulnerability.CVE-2024-0154 · Other software · Dell · reported by security_alert@emc.comLow 3.8
Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an improper parameter initialization vulnerability. A local low privileged attacker could potentially exploit this vulnerability to read the contents of non-SMM stack memory.
- Product
- PowerEdge Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2024Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an Improper SMM communication buffer verification vulnerability.CVE-2024-0161 · Other software · Dell · reported by security_alert@emc.comHigh 7.2
Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an Improper SMM communication buffer verification vulnerability. A local low privileged attacker could potentially exploit this vulnerability leading to arbitrary writes to SMRAM.
- Product
- PowerEdge Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2024Microsoft Edge for Android Spoofing VulnerabilityCVE-2024-26167 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.3
Microsoft Edge for Android Spoofing Vulnerability
- Product
- Microsoft Edge for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 5, 2024IBM Watson CP4D Data Stores 4.6.0 through 4.6.3 could allow a user with physical access and specific knowledge of the system to modify files or data on the systCVE-2023-26282 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.2
IBM Watson CP4D Data Stores 4.6.0 through 4.6.3 could allow a user with physical access and specific knowledge of the system to modify files or data on the system. IBM X-Force ID: 248415.
- Product
- Watson CP4D Data Stores
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comhttps
Mar 4, 2024Multiple SQL Injection vulnerabilities exist in the reporting application of the Arista Edge Threat Management - Arista NG Firewall (NGFW).CVE-2024-27889 · Other software · Arista Networks · reported by psirt@arista.comHigh 8.8
Multiple SQL Injection vulnerabilities exist in the reporting application of the Arista Edge Threat Management - Arista NG Firewall (NGFW). A user with advanced report application access rights can exploit the SQL injection, allowing them to execute commands on the underlying operating system with elevated privileges.
- Product
- Arista Edge Threat Management - Arista NG Firewall (NGFW)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2024IBM Watson CP4D Data Stores 4.6.0, 4.6.1, and 4.6.2 could allow an attacker with specific knowledge about the system to manipulate data due to improper input vaCVE-2023-28512 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.9
IBM Watson CP4D Data Stores 4.6.0, 4.6.1, and 4.6.2 could allow an attacker with specific knowledge about the system to manipulate data due to improper input validation. IBM X-Force ID: 250396.
- Product
- Watson CP4D Data Stores
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Feb 29, 2024 The vulnerability, if exploited, could allow a malicious entity with access to the file system to achieve arbitrary code execution and privilege escalation by CVE-2023-6132 · Other software · AVEVA · reported by ics-cert@hq.dhs.govHigh 7.3
The vulnerability, if exploited, could allow a malicious entity with access to the file system to achieve arbitrary code execution and privilege escalation by tricking AVEVA Edge to load an unsafe DLL.
- Product
- AVEVA Edge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2024In OpenEdge Authentication Gateway and AdminServer prior to 11.7.19, 12.2.14, 12.8.1 on all platforms supported by the OpenEdge product, an authentication bypasCVE-2024-1403 · Other software · Progress · reported by security@progress.comCritical 10
In OpenEdge Authentication Gateway and AdminServer prior to 11.7.19, 12.2.14, 12.8.1 on all platforms supported by the OpenEdge product, an authentication bypass vulnerability has been identified. The vulnerability is a bypass to authentication based on a failure to properly handle username and password. Certain unexpected content passed into the credentials can lead to unauthorized access without proper authentication.
- Product
- OpenEdge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.progress.comprogress.com
Feb 23, 2024Microsoft Edge (Chromium-based) Information Disclosure VulnerabilityCVE-2024-26192 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.2
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Feb 23, 2024Microsoft Edge (Chromium-based) Spoofing VulnerabilityCVE-2024-26188 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.3
Microsoft Edge (Chromium-based) Spoofing Vulnerability
- Product
- Microsoft Edge for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Feb 23, 2024Microsoft Edge (Chromium-based) Information Disclosure VulnerabilityCVE-2024-21423 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.8
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Feb 16, 2024Vulnerability in the Oracle Knowledge Management product of Oracle E-Business Suite (component: Internal Operations).CVE-2024-20943 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 5.4
Vulnerability in the Oracle Knowledge Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Knowledge Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Knowledge Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Knowledge Management accessible data as well as unauthorized read access to a subset of Oracle Knowledge Management accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
- Product
- Knowledge Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2024Envoy is a high-performance edge/middle/service proxy.CVE-2024-23327 · Other software · envoyproxy · reported by GitHubHigh 7.5
Envoy is a high-performance edge/middle/service proxy. When PPv2 is enabled both on a listener and subsequent cluster, the Envoy instance will segfault when attempting to craft the upstream PPv2 header. This occurs when the downstream request has a command type of LOCAL and does not have the protocol block. This issue has been addressed in releases 1.29.1, 1.28.1, 1.27.3, and 1.26.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- envoy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2024Envoy is a high-performance edge/middle/service proxy.CVE-2024-23325 · Other software · envoyproxy · reported by GitHubHigh 7.5
Envoy is a high-performance edge/middle/service proxy. Envoy crashes in Proxy protocol when using an address type that isn’t supported by the OS. Envoy is susceptible to crashing on a host with IPv6 disabled and a listener config with proxy protocol enabled when it receives a request where the client presents its IPv6 address. It is valid for a client to present its IPv6 address to a target server even though the whole chain is connected via IPv4. This issue has been addressed in released 1.29.1, 1.28.1, 1.27.3, and 1.26.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- envoy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.