Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,618 results · page 20 of 73
Nov 21, 2024Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership: Unauthorized profile picture updatesCVE-2024-10528 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to unauthorized profile picture updates due to a missing capability check on the wp_ajax_um_resize_image() and ajax_resize_image() functions in all versions up to, and including, 2.8.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to update the profile pictures of other users.
- Product
- Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership
- Affected
- up to 2.8.9
- What to do
- Affects up to 2.8.9. Update Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 20, 2024A discrepancy between responses for valid and invalid e-mail accounts in the Forgot your Login? module of eSoft Planner 3.24.08271-USA allows attackers to enumeCVE-2024-48533 · Other software · esoft · reported by MITREMedium 5.3
A discrepancy between responses for valid and invalid e-mail accounts in the Forgot your Login? module of eSoft Planner 3.24.08271-USA allows attackers to enumerate valid user e-mail accounts.
- Product
- planner
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2024Webriti Custom Login: Cross-Site Request Forgery (CSRF)CVE-2024-51634 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in a.ankit Webriti Custom Login webriti-custom-login-page allows Reflected XSS.This issue affects Webriti Custom Login: from n/a through <= 0.3.
- Product
- Webriti Custom Login
- Affected
- up to 0.3
- What to do
- Affects up to 0.3. Update Webriti Custom Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 18, 2024NUS-M9 ERP Management Software v3.0.0 was discovered to contain a SQL injection vulnerability via the usercode parameter at /UserWH/checkLogin.CVE-2024-44756 · Other software · erp · reported by MITRECritical 9.8
NUS-M9 ERP Management Software v3.0.0 was discovered to contain a SQL injection vulnerability via the usercode parameter at /UserWH/checkLogin.
- Product
- management_software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 18, 2024wp-login customizer: Cross-Site Request Forgery (CSRF)CVE-2024-52424 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in sureshdsk wp-login customizer wp-login-customizer allows Stored XSS.This issue affects wp-login customizer: from n/a through <= 1.0.
- Product
- wp-login customizer
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update wp-login customizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 16, 2024Login using WordPress Users ( WP as SAML IDP ): Time-based SQL InjectionCVE-2024-9887 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Login using WordPress Users ( WP as SAML IDP ) plugin for WordPress is vulnerable to time-based SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.15.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Login using WordPress Users ( WP as SAML IDP )
- Affected
- up to 1.15.6
- What to do
- Affects up to 1.15.6. Update Login using WordPress Users ( WP as SAML IDP ) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Nov 15, 2024Multiple parameters have SQL injection vulnerability in JEPaaS 7.2.8 via /je/login/btnLog/insertBtnLog, which could allow a remote user to submit a specially crCVE-2024-51164 · Other software · jepaas · reported by MITRECritical 9.1
Multiple parameters have SQL injection vulnerability in JEPaaS 7.2.8 via /je/login/btnLog/insertBtnLog, which could allow a remote user to submit a specially crafted query, allowing an attacker to retrieve all the information stored in the DB.
- Product
- jepaas
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabcc111.github.iogitee.com
Nov 14, 2024There is no limit on the number of failed login attempts permitted with the Clinician Password or the Serial Number Clinician Password.CVE-2024-9832 · Other software · Baxter · reported by productsecurity@baxter.comCritical 9.3
There is no limit on the number of failed login attempts permitted with the Clinician Password or the Serial Number Clinician Password. An attacker could execute a brute-force attack to gain unauthorized access to the ventilator, and then make changes to device settings that could disrupt the function of the device and/or result in unauthorized information disclosure.
- Product
- Life2000 Ventilation System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2024Jenkins OpenId Connect Authentication Plugin 4.418.vccc7061f5b_6d and earlier does not invalidate the previous session on login.CVE-2024-52553 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comHigh 8.8
Jenkins OpenId Connect Authentication Plugin 4.418.vccc7061f5b_6d and earlier does not invalidate the previous session on login.
- Product
- Jenkins OpenId Connect Authentication Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2024The login form of baltic-it TOPqw Webportal v1.35.283.2 (fixed in version 1.35.283.4) at /Apps/TOPqw/Login.aspx is vulnerable to SQL injection.CVE-2024-45876 · Other software · balticit · reported by MITREMedium 6.5
The login form of baltic-it TOPqw Webportal v1.35.283.2 (fixed in version 1.35.283.4) at /Apps/TOPqw/Login.aspx is vulnerable to SQL injection. The vulnerability exists in the POST parameter txtUsername, which allows for manipulation of SQL queries.
- Product
- topwq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024AJAX Login and Registration modal popup + inline form: Reflected Cross-Site ScriptingCVE-2024-8874 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The AJAX Login and Registration modal popup + inline form plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.24. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- AJAX Login and Registration modal popup + inline form
- Affected
- up to 2.24
- What to do
- Affects up to 2.24. Update AJAX Login and Registration modal popup + inline form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 11, 2024SAP NetWeaver AS Java allows an unauthenticated attacker to brute force the login functionality in order to identify the legitimate user IDs.CVE-2024-47592 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.3
SAP NetWeaver AS Java allows an unauthenticated attacker to brute force the login functionality in order to identify the legitimate user IDs. This has an impact on confidentiality but not on integrity or availability.
- Product
- SAP NetWeaver Application Server Java (Logon Application)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2024Cross Site Scripting vulnerability in Online Shop Store v.1.0 allows a remote attacker to execute arbitrary code via the login.php component.CVE-2024-51213 · Other software · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in Online Shop Store v.1.0 allows a remote attacker to execute arbitrary code via the login.php component.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2024Loginplus: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51782 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sanjay Prasad Loginplus loginplus allows Stored XSS.This issue affects Loginplus: from n/a through <= 1.2.
- Product
- Loginplus
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Loginplus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2024A session fixation issue was discovered in the NGINX OpenID Connect reference implementation, where a nonce was not checked at login time.CVE-2024-10318 · Network & remote access · F5 · reported by f5sirt@f5.comMedium 5.1
A session fixation issue was discovered in the NGINX OpenID Connect reference implementation, where a nonce was not checked at login time. This flaw allows an attacker to fix a victim's session to an attacker-controlled account. As a result, although the attacker cannot log in as the victim, they can force the session to associate it with the attacker-controlled account, leading to potential misuse of the victim's session.
- Product
- NGINX OpenID Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2024Social Share, Social Login and Social Comments Plugin – Super Socializer: Authentication bypassCVE-2024-9946 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Social Share, Social Login and Social Comments Plugin – Super Socializer plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 7.13.68. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for unauthenticated attackers to log in as any existing user on the site, if they have access to the email and the user does not have an already-existing account for the service returning the token. An attacker cannot authenticate as an administrator by default, but these accounts are also at risk if authentication for administrators has explicitly been allowed via the social login. The vulnerability was partially patched in version 7.13.68.
- Product
- Social Share, Social Login and Social Comments Plugin – Super Socializer
- Affected
- up to 7.13.68
- What to do
- Affects up to 7.13.68. Update Social Share, Social Login and Social Comments Plugin – Super Socializer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 6, 2024Heateor Social Login: Authentication bypassCVE-2024-10020 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Heateor Social Login WordPress plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.1.35. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for unauthenticated attackers to log in as any existing user on the site, if they have access to the email and the user does not have an already-existing account for the service returning the token. An attacker cannot authenticate as an administrator by default, but these accounts are also at risk if authentication for administrators has explicitly been allowed via the social login.
- Product
- Heateor Social Login
- Affected
- up to 1.1.35
- What to do
- Affects up to 1.1.35. Update Heateor Social Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 5, 2024WebLaudos v20.8 (118) was discovered to contain a cross-site scripting (XSS) vulnerability via the login page.CVE-2024-48312 · Other software · weblaudos · reported by MITREMedium 5.4
WebLaudos v20.8 (118) was discovered to contain a cross-site scripting (XSS) vulnerability via the login page.
- Product
- weblaudos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2024WooCommerce - Social Login: Authentication bypassCVE-2024-10114 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The WooCommerce - Social Login plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.7.7. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email and the user does not have an already-existing account for the service returning the token.
- Product
- WooCommerce - Social Login
- Affected
- up to 2.7.7
- What to do
- Affects up to 2.7.7. Update WooCommerce - Social Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordfence.comwpwebelite.com
Nov 5, 2024The Loginizer Security and Loginizer plugins for WordPress are vulnerable to authentication bypass in all versions up to, and including, 1.9.2.CVE-2024-10097 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Loginizer Security and Loginizer plugins for WordPress are vulnerable to authentication bypass in all versions up to, and including, 1.9.2. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email and the user does not have an already-existing account for the service returning the token.
- Affected
- up to 1.9.2
- What to do
- Affects up to 1.9.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordloginizer.complugins.trac.wordpress.org
Nov 4, 2024SQL Injection in loginform.php in ProjectWorld's Travel Management System v1.0 allows remote attackers to bypass authentication via SQL Injection in the 'usernaCVE-2024-51327 · Other software · projectworlds · reported by MITRECritical 9.8
SQL Injection in loginform.php in ProjectWorld's Travel Management System v1.0 allows remote attackers to bypass authentication via SQL Injection in the 'username' and 'password' fields.
- Product
- travel_management_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comprojectworlds.in
Nov 4, 2024This vulnerability exists in the Wave 2.0 due to missing restrictions for excessive failed authentication attempts on its API based login.CVE-2024-51558 · Other software · Brokerage Technology Solutions · reported by vdisclose@cert-in.org.inCritical 9.3
This vulnerability exists in the Wave 2.0 due to missing restrictions for excessive failed authentication attempts on its API based login. A remote attacker could exploit this vulnerability by conducting a brute force attack against legitimate user OTP, MPIN or password, which could lead to gain unauthorized access and compromise other user accounts.
- Product
- Wave 2.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2024Cross Site Scripting vulnerability in Camtrace v.9.16.2.1 allows a remote attacker to execute arbitrary code via the login.php.CVE-2024-48410 · Other software · camtrace · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in Camtrace v.9.16.2.1 allows a remote attacker to execute arbitrary code via the login.php.
- Product
- camtrace
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2024Altai Technologies Ltd Altai IX500 Indoor 22 802.11ac Wave 2 AP After login, there are file reads in the background, and attackers can obtain sensitive informatCVE-2024-51399 · Other software · altaitechnologies · reported by MITREMedium 5.7
Altai Technologies Ltd Altai IX500 Indoor 22 802.11ac Wave 2 AP After login, there are file reads in the background, and attackers can obtain sensitive information such as user credentials, system configuration, and database connection strings, which can lead to data breaches and identity theft.
- Product
- ix500_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2024IBOS v4.5.5 has an arbitrary file deletion vulnerability via \system\modules\dashboard\controllers\LoginController.php.CVE-2024-28265 · Other software · ibos · reported by MITRECritical 9.1
IBOS v4.5.5 has an arbitrary file deletion vulnerability via \system\modules\dashboard\controllers\LoginController.php.
- Product
- ibos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2024TP Link MR200 V4 Firmware version 210201 was discovered to contain a null-pointer-dereference in the web administration panel on /cgi/login via the sign, ActionCVE-2024-22733 · Network & remote access · tp-link · reported by MITREHigh 7.5
TP Link MR200 V4 Firmware version 210201 was discovered to contain a null-pointer-dereference in the web administration panel on /cgi/login via the sign, Action or LoginStatus query parameters which could lead to a denial of service by a local or remote unauthenticated attacker.
- Product
- tl-mr200_v4_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2024Login As Users: Missing AuthorizationCVE-2024-43982 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in Geek Code Lab Login As Users allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Login As Users: from n/a through 1.4.3.
- Product
- Login As Users
- Affected
- up to 1.4.3
- What to do
- Affects up to 1.4.3. Update Login As Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024An issue in the component /logins of oasys v1.1 allows attackers to access sensitive information via a burst attack.CVE-2024-48270 · Other software · misstt123 · reported by MITREHigh 7.5
An issue in the component /logins of oasys v1.1 allows attackers to access sensitive information via a burst attack.
- Product
- oasys
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2024Clickjacking vulnerability in Clibo Manager v1.1.9.12 in the '/public/login' directory, a login panel.CVE-2024-10454 · Other software · Clibo Manager · reported by cve-coordination@incibe.esMedium 6.1
Clickjacking vulnerability in Clibo Manager v1.1.9.12 in the '/public/login' directory, a login panel. This vulnerability occurs due to the absence of an X-Frame-Options server-side header. An attacker could overlay a transparent iframe to perform click hijacking on victims.
- Product
- Clibo Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2024Token Login: Authentication Bypass Using an Alternate Path or ChannelCVE-2024-50488 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in yespbs Token Login token-login allows Authentication Bypass.This issue affects Token Login: from n/a through <= 1.0.3.
- Product
- Token Login
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update Token Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 28, 2024Swoop 1-Click Login: Passwordless Authentication: Authentication Bypass by Primary WeaknessCVE-2024-50478 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass by Primary Weakness vulnerability in Swoop 1-Click Login: Passwordless Authentication allows Authentication Bypass.This issue affects 1-Click Login: Passwordless Authentication: 1.4.5.
- Product
- Swoop 1-Click Login: Passwordless Authentication
- What to do
- Update Swoop 1-Click Login: Passwordless Authentication to the newest version.
Oct 26, 2024Wp Social Login and Register Social Counter: Authentication bypassCVE-2024-9501 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 3.0.7. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email and the user does not have an already-existing account for the service returning the token.
- Product
- Wp Social Login and Register Social Counter
- Affected
- up to 3.0.7
- What to do
- Affects up to 3.0.7. Update Wp Social Login and Register Social Counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 26, 2024WP Awesome Login: Stored Cross-Site ScriptingCVE-2024-9456 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Awesome Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 0.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
- Product
- WP Awesome Login
- Affected
- up to 0.4.0
- What to do
- Affects up to 0.4.0. Update WP Awesome Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Oct 25, 2024Cross Site Scripting vulnerability in Blood Bank v.1 allows a remote attacker to execute arbitrary code via a crafted script to the login.php component.CVE-2024-48654 · Other software · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in Blood Bank v.1 allows a remote attacker to execute arbitrary code via a crafted script to the login.php component.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 24, 2024WP Adminify – Custom WordPress Dashboard, Login and Admin Customizer: Stored Cross-Site ScriptingCVE-2024-8959 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Adminify – Custom WordPress Dashboard, Login and Admin Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 4.0.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
- Product
- WP Adminify – Custom WordPress Dashboard, Login and Admin Customizer
- Affected
- up to 4.0.1.6
- What to do
- Affects up to 4.0.1.6. Update WP Adminify – Custom WordPress Dashboard, Login and Admin Customizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Oct 23, 2024A vulnerability in the login authentication functionality of the Remote Access SSL VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco FirCVE-2024-20493 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.3
A vulnerability in the login authentication functionality of the Remote Access SSL VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to deny further VPN user authentications for several minutes, resulting in a temporary denial of service (DoS) condition. This vulnerability is due to ineffective handling of memory resources during the authentication process. An attacker could exploit this vulnerability by sending crafted packets, which could cause resource exhaustion of the authentication process. A successful exploit could allow the attacker to deny authentication for Remote Access SSL VPN users for several minutes, resulting in a temporary DoS condition.
- Product
- Cisco Adaptive Security Appliance (ASA) Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Oct 22, 2024Accounts enumeration vulnerability in the Login Component of Reolink Duo 2 WiFi Camera (Firmware Version v3.0.0.1889_23031701) allows remote attackers to determCVE-2024-48644 · Other software · reolink · reported by MITREMedium 5.3
Accounts enumeration vulnerability in the Login Component of Reolink Duo 2 WiFi Camera (Firmware Version v3.0.0.1889_23031701) allows remote attackers to determine valid user accounts via login attempts. This can lead to the enumeration of user accounts and potentially facilitate other attacks, such as brute-forcing of passwords. The vulnerability arises from the application responding differently to login attempts with valid and invalid usernames.
- Product
- duo_2_wifi_camera_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2024Ajax Rating with Custom Login: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-49246 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in anand23 Ajax Rating with Custom Login ajax-rating-with-custom-login allows SQL Injection.This issue affects Ajax Rating with Custom Login: from n/a through <= 1.1.
- Product
- Ajax Rating with Custom Login
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Ajax Rating with Custom Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 16, 2024A discrepancy in error messages for invalid login attempts in Webmin Usermin v2.100 allows attackers to enumerate valid user accounts.CVE-2024-44762 · Other software · webmin · reported by MITREMedium 5.3
A discrepancy in error messages for invalid login attempts in Webmin Usermin v2.100 allows attackers to enumerate valid user accounts.
- Product
- usermin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2024Nextend Social Login Pro: Authentication bypassCVE-2024-9893 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Nextend Social Login Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 3.1.14. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email and the user does not have an already-existing account for the service returning the token.
- Product
- Nextend Social Login Pro
- Affected
- up to 3.1.14
- What to do
- Affects up to 3.1.14. Update Nextend Social Login Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordnextendweb.comwordpress.org
Oct 10, 2024Simple Membership After Login Redirection: URL Redirection to Untrusted Site ('Open Redirect')CVE-2024-47354 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in wp.insider Simple Membership After Login Redirection simple-membership-after-login-redirection.This issue affects Simple Membership After Login Redirection: from n/a through <= 1.6.
- Product
- Simple Membership After Login Redirection
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update Simple Membership After Login Redirection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2024The Syracom Secure Login (2FA) plugin for Jira, Confluence, and Bitbucket through 3.1.4.5 allows remote attackers to easily brute-force the 2FA PIN via the plugCVE-2024-48942 · Other software · syracom · reported by MITREMedium 5.9
The Syracom Secure Login (2FA) plugin for Jira, Confluence, and Bitbucket through 3.1.4.5 allows remote attackers to easily brute-force the 2FA PIN via the plugins/servlet/twofactor/public/pinvalidation endpoint. The last 30 and the next 30 tokens are valid.
- Product
- secure_login
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsyracom-bee.atlassian.net
Oct 9, 2024The Syracom Secure Login (2FA) plugin for Jira, Confluence, and Bitbucket through 3.1.4.5 allows remote attackers to bypass 2FA by interacting with the /rest enCVE-2024-48941 · Other software · syracom · reported by MITREMedium 5.4
The Syracom Secure Login (2FA) plugin for Jira, Confluence, and Bitbucket through 3.1.4.5 allows remote attackers to bypass 2FA by interacting with the /rest endpoint of Jira, Confluence, or Bitbucket. In the default configuration, /rest is allowlisted.
- Product
- secure_login
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsyracom-bee.atlassian.net
Oct 9, 2024A cross-site scripting (XSS) vulnerability in LemonLDAP::NG before 2.19.3 allows remote attackers to inject arbitrary web script or HTML into the login page viaCVE-2024-48933 · Other software · lemonldap-ng · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in LemonLDAP::NG before 2.19.3 allows remote attackers to inject arbitrary web script or HTML into the login page via a username if userControl has been set to a non-default value that allows special HTML characters.
- Product
- lemonldap-ng
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.ow2.orglists.debian.org
Oct 8, 2024A SQL injection vulnerability in login portal in AnteeoWMS before v4.7.34 allows unauthenticated attackers to execute arbitrary SQL commands via the username paCVE-2024-44349 · Other software · anteeowms · reported by MITRECritical 9.8
A SQL injection vulnerability in login portal in AnteeoWMS before v4.7.34 allows unauthenticated attackers to execute arbitrary SQL commands via the username parameter and disclosure of some data in the underlying DB.
- Product
- anteeowms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.cybergon.comcybergon.com
Oct 8, 2024Limit Login Attempts (Spam Protection): IP Address SpoofingCVE-2022-4534 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Limit Login Attempts (Spam Protection) plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 5.3. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can supply the X-Forwarded-For header with with a different IP Address that will be logged and can be used to bypass settings that may have blocked out an IP address or country from logging in.
- Product
- Limit Login Attempts (Spam Protection)
- Affected
- up to 5.3
- What to do
- Affects up to 5.3. Update Limit Login Attempts (Spam Protection) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 4, 2024Improper Authentication vulnerability in Microchip TimeProvider 4100 (login modules) allows Session Hijacking.This issue affects TimeProvider 4100: from 1.0 befCVE-2024-43685 · Other software · Microchip · reported by dc3f6da9-85b5-4a73-84a2-2ec90b40fca5High 8.7
Improper Authentication vulnerability in Microchip TimeProvider 4100 (login modules) allows Session Hijacking.This issue affects TimeProvider 4100: from 1.0 before 2.4.7.
- Product
- TimeProvider 4100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgruppotim.itmicrochip.com
Oct 4, 2024This vulnerability exists in Shilpi Client Dashboard due to missing restrictions for incorrect login attempts on its API based login.CVE-2024-47656 · Other software · Shilpi Computers · reported by vdisclose@cert-in.org.inCritical 9.3
This vulnerability exists in Shilpi Client Dashboard due to missing restrictions for incorrect login attempts on its API based login. A remote attacker could exploit this vulnerability by conducting a brute force attack on password, which could lead to gain unauthorized access to other user accounts.
- Product
- Client Dashboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2024This vulnerability exists in Shilpi Client Dashboard due to implementation of inadequate authentication mechanism in the login module wherein access to any userCVE-2024-47652 · Other software · Shilpi Computers · reported by vdisclose@cert-in.org.inHigh 7.6
This vulnerability exists in Shilpi Client Dashboard due to implementation of inadequate authentication mechanism in the login module wherein access to any users account is granted with just their corresponding mobile number. A remote attacker could exploit this vulnerability by providing mobile number of targeted user, to obtain complete access to the targeted user account.
- Product
- Client Dashboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2024Login Logout Shortcode: Stored Cross-Site ScriptingCVE-2024-9421 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Login Logout Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' parameter in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Login Logout Shortcode
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Login Logout Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.