Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,618 results · page 22 of 73
Aug 7, 2024Attackers with a valid username and password can exploit a python code injection vulnerability during the natural login flow.CVE-2024-6891 · Other software · Journyx · reported by bbf0bd87-ece2-41be-b873-96928ee8fab9High 8.8
Attackers with a valid username and password can exploit a python code injection vulnerability during the natural login flow.
- Product
- Journyx (jtime)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkorelogic.comseclists.org
Aug 6, 2024Insertion of sensitive information into sent data issue exists in Cybozu Office 10.0.0 to 10.8.6, which may allow a user who can login to the product to view daCVE-2024-39817 · Other software · Cybozu, Inc. · reported by vultures@jpcert.or.jpMedium 6.5
Insertion of sensitive information into sent data issue exists in Cybozu Office 10.0.0 to 10.8.6, which may allow a user who can login to the product to view data that the user does not have access by conducting 'search' under certain conditions in Custom App.
- Product
- Cybozu Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpkb.cybozu.support
Jul 28, 2024The login functionality of WinMatrix3 Web package from Simopro Technology lacks proper validation of user input, allowing unauthenticated remote attackers to inCVE-2024-7201 · Other software · Simopro Technology · reported by twcert@cert.org.twCritical 9.8
The login functionality of WinMatrix3 Web package from Simopro Technology lacks proper validation of user input, allowing unauthenticated remote attackers to inject SQL commands to read, modify, and delete database contents.
- Product
- WinMatrix3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Jul 25, 2024The "reset password" login page accepted an HTML injection via URL parameters.CVE-2024-3938 · Other software · dotCMS · reported by security@dotcms.comMedium 5.4
The "reset password" login page accepted an HTML injection via URL parameters. This has already been rectified via patch, and as such it cannot be demonstrated via Demo site link. Those interested to see the vulnerability may spin up a http://localhost:8082/dotAdmin/#/public/login?resetEmailSent=true&resetEmail=%3Ch1%3E%3Ca%20href%3D%22https:%2F%2Fgoogle.com%22%3ECLICK%20ME%3C%2Fa%3E%3C%2Fh1%3E This will result in a view along these lines: * OWASP Top 10 - A03: Injection * CVSS Score: 5.4 * AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator * https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N&... https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator
- Product
- dotCMS core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2024Hide My WP Ghost: Does not prevent redirects to the login page via the auth_redirect WordPress functionCVE-2024-6420 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Hide My WP Ghost WordPress plugin before 5.2.02 does not prevent redirects to the login page via the auth_redirect WordPress function, allowing an unauthenticated visitor to access the hidden login page.
- Product
- Hide My WP Ghost
- Fixed in
- 5.2.02
- What to do
- Update Hide My WP Ghost to 5.2.02 or newer.
Jul 22, 2024Cross Site Scripting vulnerability in Act-On 2023 allows a remote attacker to execute arbitrary code via the newUser parameter in the login.jsp component.CVE-2024-24507 · Other software · Act-on · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in Act-On 2023 allows a remote attacker to execute arbitrary code via the newUser parameter in the login.jsp component.
- Product
- Act-on
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jul 22, 2024Use of hard-coded MSSQL credentials in PerkinElmer ProcessPlus on Windows allows an attacker to login remove on all prone installations.This issue affects ProceCVE-2024-6912 · Other software · PerkinElmer · reported by office@cyberdanube.comCritical 9.3
Use of hard-coded MSSQL credentials in PerkinElmer ProcessPlus on Windows allows an attacker to login remove on all prone installations.This issue affects ProcessPlus: through 1.11.6507.0.
- Product
- ProcessPlus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgcyberdanube.com
Jul 22, 2024SQL injection vulnerability in Hospital Management System Project in ASP.Net MVC 1 allows aremote attacker to execute arbitrary code via the btn_login_b_Click fCVE-2024-40502 · Other software · hospital_management_system_project · reported by MITRECritical 9.8
SQL injection vulnerability in Hospital Management System Project in ASP.Net MVC 1 allows aremote attacker to execute arbitrary code via the btn_login_b_Click function of the Loginpage.aspx
- Product
- hospital_management_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorditsourcecode.comitsourcecode.com
Jul 22, 2024Login with phone number: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-37429 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hamid Alinia Login with phone number login-with-phone-number.This issue affects Login with phone number: from n/a through <= 1.7.35.
- Product
- Login with phone number
- Affected
- up to 1.7.35
- What to do
- Affects up to 1.7.35. Update Login with phone number to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 21, 2024Login Logo Editor: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37523 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in AMP-MODE Login Logo Editor allows Stored XSS.This issue affects Login Logo Editor: from n/a through 1.3.3.
- Product
- Login Logo Editor
- Affected
- up to 1.3.3
- What to do
- Affects up to 1.3.3. Update Login Logo Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 20, 2024WooCommerce - Social Login: Unauthenticated privilege escalationCVE-2024-6637 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The WooCommerce - Social Login plugin for WordPress is vulnerable to unauthenticated privilege escalation in all versions up to, and including, 2.7.3. This is due to a lack of brute force controls on a weak one-time password. This makes it possible for unauthenticated attackers to brute force the one-time password for any user, except an Administrator, if they know the email of user.
- Product
- WooCommerce - Social Login
- Affected
- up to 2.7.3
- What to do
- Affects up to 2.7.3. Update WooCommerce - Social Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Jul 20, 2024WooCommerce - Social Login: Unauthorized modification of dataCVE-2024-6636 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WooCommerce - Social Login plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'woo_slg_login_email' function in all versions up to, and including, 2.7.3. This makes it possible for unauthenticated attackers to change the default role to Administrator while registering for an account.
- Product
- WooCommerce - Social Login
- Affected
- up to 2.7.3
- What to do
- Affects up to 2.7.3. Update WooCommerce - Social Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Jul 20, 2024WooCommerce - Social Login: Authentication bypassCVE-2024-6635 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The WooCommerce - Social Login plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.7.3. This is due to insufficient controls in the 'woo_slg_login_email' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, excluding an administrator, if they know the email of user.
- Product
- WooCommerce - Social Login
- Affected
- up to 2.7.3
- What to do
- Affects up to 2.7.3. Update WooCommerce - Social Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Jul 19, 2024Insecure Permissions vulnerability in lin-CMS Springboot v.0.2.1 and before allows a remote attacker to obtain sensitive information via the login method in theCVE-2024-41600 · Other software · Talelin · reported by MITREHigh 7.5
Insecure Permissions vulnerability in lin-CMS Springboot v.0.2.1 and before allows a remote attacker to obtain sensitive information via the login method in the UserController.java component.
- Product
- Lin-cms-spring-boot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 19, 2024Insecure Permissions vulnerability in lin-CMS v.0.2.0 and before allows a remote attacker to obtain sensitive information via the login method in the UserControCVE-2024-41601 · Other software · talelin · reported by MITREHigh 7.5
Insecure Permissions vulnerability in lin-CMS v.0.2.0 and before allows a remote attacker to obtain sensitive information via the login method in the UserController.java component.
- Product
- lin-cms-java-core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2024Online Clinic Management System In PHP With Free Source code v1.0 was discovered to contain a SQL injection vulnerability via the user parameter at login.php.CVE-2024-40393 · Other software · Angeljudesuarez · reported by MITRECritical 9.8
Online Clinic Management System In PHP With Free Source code v1.0 was discovered to contain a SQL injection vulnerability via the user parameter at login.php.
- Product
- Online Clinic Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2024WPS Hide Login: Does not prevent redirects to the login page via the auth_redirect WordPress functionCVE-2024-6289 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WPS Hide Login WordPress plugin before 1.9.16.4 does not prevent redirects to the login page via the auth_redirect WordPress function, allowing an unauthenticated visitor to access the hidden login page.
- Product
- WPS Hide Login
- Fixed in
- 1.9.16.4
- What to do
- Update WPS Hide Login to 1.9.16.4 or newer.
Jul 12, 2024Livechat messages can be leaked by combining two NoSQL injections affecting livechat:loginByToken (pre-authentication) and livechat:loadHistory.CVE-2024-37405 · Other software · Rocket.Chat · reported by support@hackerone.comMedium 6.5
Livechat messages can be leaked by combining two NoSQL injections affecting livechat:loginByToken (pre-authentication) and livechat:loadHistory.
- Product
- Rocket.Chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comhackerone.com
Jul 11, 2024Branda – White Label WordPress, Custom Login Page Customizer: Full Path DisclosureCVE-2024-6554 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Branda – White Label WordPress, Custom Login Page Customizer plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.4.18. This is due the plugin utilizing composer without preventing direct access to the files. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
- Product
- Branda – White Label WordPress, Custom Login Page Customizer
- Affected
- up to 3.4.18
- What to do
- Affects up to 3.4.18. Update Branda – White Label WordPress, Custom Login Page Customizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 10, 2024TrustedLogin Vendor: Insertion of Sensitive Information into Log FileCVE-2024-37270 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information into Log File vulnerability in TrustedLogin TrustedLogin Vendor.This issue affects TrustedLogin Vendor: from n/a before 1.1.1.
- Product
- TrustedLogin Vendor
- Fixed in
- 1.1.1
- What to do
- Update TrustedLogin Vendor to 1.1.1 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 10, 2024IBM Security QRadar EDR 3.12 could disclose sensitive information due to an observable login response discrepancy.CVE-2023-33859 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM Security QRadar EDR 3.12 could disclose sensitive information due to an observable login response discrepancy. IBM X-Force ID: 257697.
- Product
- Security QRadar EDR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jul 10, 2024Login by Auth0: Reflected Cross-Site ScriptingCVE-2023-6813 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Login by Auth0 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘wle’ parameter in all versions up to, and including, 4.6.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Login by Auth0
- Affected
- up to 4.6.0
- What to do
- Affects up to 4.6.0. Update Login by Auth0 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jul 10, 2024Cross-site scripting vulnerability exists in session_login.cgi of Webmin versions prior to 1.970 and Usermin versions prior to 1.820.CVE-2024-36453 · Other software · Webmin · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability exists in session_login.cgi of Webmin versions prior to 1.970 and Usermin versions prior to 1.820. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the website using the product. As a result, a webpage may be altered or sensitive information such as a credential may be disclosed.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2024Longse NVR (Network Video Recorder) model NVR3608PGE2W, as well as products based on this device, are transmitting user's login and password to a remote controlCVE-2024-5631 · Other software · Longse Technology · reported by cvd@cert.plMedium 6
Longse NVR (Network Video Recorder) model NVR3608PGE2W, as well as products based on this device, are transmitting user's login and password to a remote control service without using any encryption. This enables an on-path attacker to eavesdrop the credentials and subsequently obtain access to the video stream. The credentials are being sent when a user decides to change his password in router's portal.
- Product
- NVR3608PGE2W
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2024The Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction plugin for WordPress CVE-2024-6069 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the pieregister_install_addon function in all versions up to, and including, 3.8.3.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to install arbitrary plugins. As a result attackers might achieve code execution on the targeted server
- Affected
- up to 3.8.3.4
- What to do
- Affects up to 3.8.3.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 9, 2024WooCommerce Social Login: Deserialization of Untrusted DataCVE-2024-37502 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Deserialization of Untrusted Data vulnerability in wpweb WooCommerce Social Login woo-social-login.This issue affects WooCommerce Social Login: from n/a through <= 2.6.3.
- Product
- WooCommerce Social Login
- Affected
- up to 2.6.3
- What to do
- Affects up to 2.6.3. Update WooCommerce Social Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 9, 2024In SAP Commerce, a user can misuse the forgotten password functionality to gain access to a Composable Storefront B2B site for which early login and registratioCVE-2024-39597 · Websites & servers · SAP_SE · reported by cna@sap.comHigh 7.2
In SAP Commerce, a user can misuse the forgotten password functionality to gain access to a Composable Storefront B2B site for which early login and registration is activated, without requiring the merchant to approve the account beforehand. If the site is not configured as isolated site, this can also grant access to other non-isolated early login sites, even if registration is not enabled for those other sites.
- Product
- SAP Commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 4, 2024Kaiten 57.128.8 allows remote attackers to enumerate user accounts via a crafted POST request, because a login response contains a user_email field only if the CVE-2024-39211 · Other software · kaiten · reported by MITREMedium 5.3
Kaiten 57.128.8 allows remote attackers to enumerate user accounts via a crafted POST request, because a login response contains a user_email field only if the user account exists.
- Product
- kaiten
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2024The webserver utilizes basic authentication for its user login to the configuration interface.CVE-2023-41926 · Other software · Kiloview · reported by cert@ncsc.nlHigh 8.8
The webserver utilizes basic authentication for its user login to the configuration interface. As encryption is disabled on port 80, it enables potential eavesdropping on user traffic, making it possible to intercept their credentials.
- Product
- P1/P2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.ncsc.nladvisories.ncsc.nl
Jul 1, 2024Default credential in install package in ABB ASPECT; NEXUS Series; MATRIX Series version 3.07 allows attacker to login to product instances wrongly configured.CVE-2024-4007 · Other software · ABB · reported by cybersecurity@ch.abb.comHigh 8.7
Default credential in install package in ABB ASPECT; NEXUS Series; MATRIX Series version 3.07 allows attacker to login to product instances wrongly configured.
- Product
- ASPECT Enterprise (ASP-ENT-x)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsearch.abb.comsearch.abb.com
Jun 29, 2024UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for: Time-based SQL InjectionCVE-2024-6265 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘uwp_sort_by’ parameter in all versions up to, and including, 1.2.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for
- Affected
- up to 1.2.10
- What to do
- Affects up to 1.2.10. Update UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 26, 2024Intrado 911 Emergency Gateway login form is vulnerable to an unauthenticated blind time-based SQL injection, which may allow an unauthenticated remote attacker CVE-2024-1839 · Other software · Intrado · reported by 9119a7d8-5eab-497f-8521-727c672e3725Critical 10
Intrado 911 Emergency Gateway login form is vulnerable to an unauthenticated blind time-based SQL injection, which may allow an unauthenticated remote attacker to execute malicious code, exfiltrate data, or manipulate the database.
- Product
- 911 Emergency Gateway (EGW)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 21, 2024Branda – White Label WordPress, Custom Login Page Customizer: Stored Cross-Site ScriptingCVE-2024-5191 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Branda – White Label WordPress, Custom Login Page Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘mime_types’ parameter in all versions up to, and including, 3.4.17 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Branda – White Label WordPress, Custom Login Page Customizer
- Affected
- up to 3.4.17
- What to do
- Affects up to 3.4.17. Update Branda – White Label WordPress, Custom Login Page Customizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 20, 2024For Kiuwan installations with SSO (single sign-on) enabled, an unauthenticated reflected cross-site scripting attack can be performed on the login page "loginCVE-2023-49111 · Other software · Kiuwan · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfMedium 6.5
For Kiuwan installations with SSO (single sign-on) enabled, an unauthenticated reflected cross-site scripting attack can be performed on the login page "login.html". This is possible due to the request parameter "message" values being directly included in a JavaScript block in the response. This is especially critical in business environments using AD SSO authentication, e.g. via ADFS, where attackers could potentially steal AD passwords. This issue affects Kiuwan SAST: <master.1808.p685.q13371
- Product
- SAST
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordr.sec-consult.comkiuwan.com
Jun 19, 2024In the module "Login as customer PRO" (loginascustomerpro) <1.2.7 from Weblir for PrestaShop, a guest can access direct link to connect to each customer accountCVE-2024-36677 · Websites & servers · prestashop · reported by MITREHigh 7.5
In the module "Login as customer PRO" (loginascustomerpro) <1.2.7 from Weblir for PrestaShop, a guest can access direct link to connect to each customer account of the Shop if the module is not installed OR if a secret accessible to administrator is stolen.
- Product
- loginascustomerpro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.friendsofpresta.orgsecurity.friendsofpresta.org
Jun 19, 2024SiteGuard WP Plugin provides a functionality to customize the path to the login page wp-login.php and implements a measure to avoid redirection from other URLs.CVE-2024-37881 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 5.3
SiteGuard WP Plugin provides a functionality to customize the path to the login page wp-login.php and implements a measure to avoid redirection from other URLs. However, SiteGuard WP Plugin versions prior to 1.7.7 missed to implement a measure to avoid redirection from wp-register.php. As a result, the customized path to the login page may be exposed.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordjvn.jpplugins.trac.wordpress.org
Jun 18, 2024Login with phone number: Unauthorized password resetsCVE-2024-6125 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Login with phone number plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 1.7.34. This is due to the plugin generating too weak a reset code, and the code used to reset the password has no attempt or time limit. This makes it possible for unauthenticated attackers to reset the password of arbitrary users by guessing a 6-digit numeric reset code.
- Product
- Login with phone number
- Affected
- up to 1.7.34
- What to do
- Affects up to 1.7.34. Update Login with phone number to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jun 18, 2024A unique key should be generated for a user's QR login key and their auto-login key, so the same key cannot be used interchangeably between the two.CVE-2024-38277 · Other software · Moodle · reported by patrick@puiterwijk.orgMedium 5.4
A unique key should be generated for a user's QR login key and their auto-login key, so the same key cannot be used interchangeably between the two.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orglists.fedoraproject.org
Jun 16, 2024Netatalk before 3.2.1 has an off-by-one error, and resultant heap-based buffer overflow and segmentation violation, because of incorrectly using FPLoginExt in BCVE-2024-38440 · Other software · netatalk · reported by MITREHigh 7.5
Netatalk before 3.2.1 has an off-by-one error, and resultant heap-based buffer overflow and segmentation violation, because of incorrectly using FPLoginExt in BN_bin2bn in etc/uams/uams_dhx_pam.c. The original issue 1097 report stated: 'The latest version of Netatalk (v3.2.0) contains a security vulnerability. This vulnerability arises due to a lack of validation for the length field after parsing user-provided data, leading to an out-of-bounds heap write of one byte (\0). Under specific configurations, this can result in reading metadata of the next heap block, potentially causing a Denial of Service (DoS) under certain heap layouts or with ASAN enabled. ... The vulnerability is located in the FPLoginExt operation of Netatalk, in the BN_bin2bn function found in /etc/uams/uams_dhx_pam.c ... if (!(bn = BN_bin2bn((unsigned char *)ibuf, KEYSIZE, NULL))) ... threads ... [#0] Id 1, Name: "afpd", stopped 0x7ffff4304e58 in ?? (), reason: SIGSEGV ... [#0] 0x7ffff4304e58 mov BYTE PTR [r14+0x8], 0x0 ... mov rdx, QWORD PTR [rsp+0x18] ... afp_login_ext(obj=<optimized out>, ibuf=0x62d000010424 "", ibuflen=0xffffffffffff0015, rbuf=<optimized out>, rbuflen=<optimized out>) ... afp_over_dsi(obj=0x
- Product
- netatalk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2024Netatalk before 3.2.1 has an off-by-one error and resultant heap-based buffer overflow because of setting ibuf[PASSWDLEN] to '\0' in FPLoginExt in login in etc/CVE-2024-38439 · Other software · netatalk · reported by MITRECritical 9.8
Netatalk before 3.2.1 has an off-by-one error and resultant heap-based buffer overflow because of setting ibuf[PASSWDLEN] to '\0' in FPLoginExt in login in etc/uams/uams_pam.c. 2.4.1 and 3.1.19 are also fixed versions.
- Product
- netatalk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2024WooCommerce - Social Login: PHP Object InjectionCVE-2024-5871 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WooCommerce - Social Login plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.6.2 via deserialization of untrusted input from the 'woo_slg_verify' vulnerable parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
- Product
- WooCommerce - Social Login
- Affected
- up to 2.6.2
- What to do
- Affects up to 2.6.2. Update WooCommerce - Social Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Jun 15, 2024WooCommerce - Social Login: Email VerificationCVE-2024-5868 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WooCommerce - Social Login plugin for WordPress is vulnerable to Email Verification in all versions up to, and including, 2.6.2 via the use of insufficiently random activation code. This makes it possible for unauthenticated attackers to bypass the email verification.
- Product
- WooCommerce - Social Login
- Affected
- up to 2.6.2
- What to do
- Affects up to 2.6.2. Update WooCommerce - Social Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Jun 14, 2024Hardcoded credentials in TerraMaster TOS firmware through 5.1 allow a remote attacker to successfully login to the mail or webmail server.CVE-2024-34539 · Other software · terra-master · reported by MITRECritical 9.4
Hardcoded credentials in TerraMaster TOS firmware through 5.1 allow a remote attacker to successfully login to the mail or webmail server. These credentials can also be used to login to the administration panel and to perform privileged actions.
- Product
- tos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordshinnai.altervista.orgshinnai.altervista.org
Jun 14, 2024LB-LINK BL-W1210M v2.0 was discovered to contain a clickjacking vulnerability via the Administrator login page.CVE-2024-33377 · Other software · lb-link · reported by MITREHigh 8.1
LB-LINK BL-W1210M v2.0 was discovered to contain a clickjacking vulnerability via the Administrator login page. Attackers can cause victim users to perform arbitrary operations via interaction with crafted elements on the web page.
- Product
- bl-w1210m
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comredfoxsec.com
Jun 14, 2024Attackers can bypass the web login authentication process to gain access to the printer's system information and upload malicious drivers to the printer.CVE-2024-3496 · Other software · Toshiba Tec Corporation · reported by ecc0f906-8666-484c-bcf8-c3b7520a72f0High 8.8
Attackers can bypass the web login authentication process to gain access to the printer's system information and upload malicious drivers to the printer. As for the affected products/models/versions, see the reference URL.
- Product
- Toshiba Tec e-Studio multi-function peripheral (MFP)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2024TOTOLINK A3700R V9.1.2u.6165_20211012 was discovered to contain a stack overflow via the password parameter in function loginAuth .CVE-2024-37632 · Other software · totolink · reported by MITRECritical 9.8
TOTOLINK A3700R V9.1.2u.6165_20211012 was discovered to contain a stack overflow via the password parameter in function loginAuth .
- Product
- a3700r_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2024WPS Hide Login: Login Page DisclosureCVE-2024-2473 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WPS Hide Login plugin for WordPress is vulnerable to Login Page Disclosure in all versions up to, and including, 1.9.15.2. This is due to a bypass that is created when the 'action=postpass' parameter is supplied. This makes it possible for attackers to easily discover any login page that may have been hidden by the plugin.
- Product
- WPS Hide Login
- Affected
- up to 1.9.15.2
- What to do
- Affects up to 1.9.15.2. Update WPS Hide Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Jun 10, 2024MelaPress Login Security: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2024-35650 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Melapress MelaPress Login Security melapress-login-security.This issue affects MelaPress Login Security: from n/a through <= 1.3.0.
- Product
- MelaPress Login Security
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update MelaPress Login Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 8, 2024Heateor Social Login: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-35706 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Team Heateor Heateor Social Login allows Cross-Site Scripting (XSS).This issue affects Heateor Social Login: from n/a through 1.1.32.
- Product
- Heateor Social Login
- Affected
- up to 1.1.32
- What to do
- Affects up to 1.1.32. Update Heateor Social Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 8, 2024Heateor Social Login: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-35707 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Team Heateor Heateor Social Login allows Stored XSS.This issue affects Heateor Social Login: from n/a through 1.1.32.
- Product
- Heateor Social Login
- Affected
- up to 1.1.32
- What to do
- Affects up to 1.1.32. Update Heateor Social Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.