Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,769exploited flaws on CISA’s list

30added in the last 30 days

460new WordPress flaws this week

394,717entries in the database

17,729 results · page 225 of 355

May 1, 2024There is a buffer overflow vulnerability in the underlying Utility daemon that could lead to unauthenticated remote code execution by sending specially crafted CVE-2024-26305 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.8
There is a buffer overflow vulnerability in the underlying Utility daemon that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.
Product
Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record arubanetworks.com arubanetworks.com
May 1, 2024There is a buffer overflow vulnerability in the underlying L2/L3 Management service that could lead to unauthenticated remote code execution by sending speciallCVE-2024-26304 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.8
There is a buffer overflow vulnerability in the underlying L2/L3 Management service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.
Product
Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record arubanetworks.com arubanetworks.com
Apr 30, 2024lunasvg v2.3.9 was discovered to contain a segmentation violation via the component composition_solid_source_over.CVE-2024-33768 · Other software · sammycage · reported by MITRECritical 9.8
lunasvg v2.3.9 was discovered to contain a segmentation violation via the component composition_solid_source_over.
Product
lunasvg
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 30, 2024lunasvg v2.3.9 was discovered to contain a segmentation violation via the component composition_solid_source.CVE-2024-33767 · Other software · Sammycage · reported by MITREMedium 5
lunasvg v2.3.9 was discovered to contain a segmentation violation via the component composition_solid_source.
Product
Lunasvg
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 30, 2024lunasvg v2.3.9 was discovered to contain an FPE (Floating Point Exception) at blend_transformed_tiled_argb.isra.0.CVE-2024-33766 · Other software · sammycage · reported by MITREMedium 5.3
lunasvg v2.3.9 was discovered to contain an FPE (Floating Point Exception) at blend_transformed_tiled_argb.isra.0.
Product
lunasvg
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 30, 2024lunasvg v2.3.9 was discovered to contain a stack-overflow at lunasvg/source/element.h.CVE-2024-33764 · Other software · sammycage · reported by MITREMedium 5.5
lunasvg v2.3.9 was discovered to contain a stack-overflow at lunasvg/source/element.h.
Product
lunasvg
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 30, 2024lunasvg v2.3.9 was discovered to contain a stack-buffer-underflow at lunasvg/source/layoutcontext.cpp.CVE-2024-33763 · Other software · sammycage · reported by MITREHigh 7.5
lunasvg v2.3.9 was discovered to contain a stack-buffer-underflow at lunasvg/source/layoutcontext.cpp.
Product
lunasvg
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 30, 2024XADMaster is an objective-C library for archive and file unarchiving and extraction.CVE-2024-22405 · Other software · MacPaw · reported by GitHubMedium 5.5
XADMaster is an objective-C library for archive and file unarchiving and extraction. When extracting a specially crafted zip archive XADMaster may not apply quarantine attribute correctly. Such behaviour may circumvent Gatekeeper checks on the system. Only macOS installations are affected. This issue was fixed in XADMaster 1.10.8. It is recommended to upgrade to the latest version. There are no known workarounds for this issue.
Product
XADMaster
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 30, 2024ACF Front End Editor: Unauthorized modification of dataCVE-2024-3072 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The ACF Front End Editor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update_texts() function in all versions up to, and including, 2.0.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary post title, content, and ACF data.
Product
ACF Front End Editor
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update ACF Front End Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 29, 2024LeadConnector: Unauthorized modification & loss of dataCVE-2024-1371 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The LeadConnector plugin for WordPress is vulnerable to unauthorized modification & loss of data due to a missing capability check on the lc_public_api_proxy() function in all versions up to, and including, 1.7. This makes it possible for unauthenticated attackers to delete arbitrary posts. CVE-2024-34378 is likely a duplicate of this issue.
Product
LeadConnector
Affected
up to 1.7
What to do
Affects up to 1.7. Update LeadConnector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 29, 2024Insecure Direct Object References (IDOR) vulnerability in Hospital Management System 1.0 allows attackers to manipulate user parameters for unauthorized access CVE-2024-28320 · Other software · hospital_management_system_project · reported by MITREHigh 7.6
Insecure Direct Object References (IDOR) vulnerability in Hospital Management System 1.0 allows attackers to manipulate user parameters for unauthorized access and modifications via crafted POST request to /patient/edit-user.php.
Product
hospital_management_system
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com sospiro014.github.io
Apr 29, 2024MacPaw The Unarchiver before 4.3.6 contains vulnerability related to missing quarantine attributes for extracted items.CVE-2023-46270 · Other software · reported by MITRELow 3.3
MacPaw The Unarchiver before 4.3.6 contains vulnerability related to missing quarantine attributes for extracted items.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record theunarchiver.com updates.devmate.com
Apr 29, 2024User Meta: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-33575 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in User Meta user-meta.This issue affects User Meta: from n/a through 3.0.
Product
User Meta
Affected
up to 3.0
What to do
Affects up to 3.0. Update User Meta to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 29, 2024Assistant – Every Day Productivity Apps: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-33538 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Fastline Media LLC Assistant – Every Day Productivity Apps.This issue affects Assistant – Every Day Productivity Apps: from n/a through 1.4.9.1.
Product
Assistant – Every Day Productivity Apps
Affected
up to 1.4.9.1
What to do
Affects up to 1.4.9.1. Update Assistant – Every Day Productivity Apps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 29, 2024Super 8 Live Chat online customer service platform fails to properly filter user input, allowing unauthenticated remote attackers to insert JavaScript code intoCVE-2024-4302 · Other software · Super 8 · reported by twcert@cert.org.twMedium 6.1
Super 8 Live Chat online customer service platform fails to properly filter user input, allowing unauthenticated remote attackers to insert JavaScript code into the chat box. When the message recipient views the message, they become susceptible to Cross-site Scripting (XSS) attacks.
Product
livechat SDK
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record twcert.org.tw twcert.org.tw
Apr 26, 2024Asus RT-N12+ B1 router stores user passwords in plaintext, which could allow local attackers to obtain unauthorized access and modify router settings.CVE-2024-28327 · Network & remote access · asus · reported by MITREHigh 8.4
Asus RT-N12+ B1 router stores user passwords in plaintext, which could allow local attackers to obtain unauthorized access and modify router settings.
Product
rt-n12\+_b1
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 26, 2024Asus RT-N12+ B1 router stores credentials in cleartext, which could allow local attackers to obtain unauthorized access and modify router settings.CVE-2024-28325 · Network & remote access · asus · reported by MITREMedium 6.1
Asus RT-N12+ B1 router stores credentials in cleartext, which could allow local attackers to obtain unauthorized access and modify router settings.
Product
rt-n12\+_b1
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 26, 2024Denial of service condition in M-Files Server in versions before 24.4.13592.4 and after 23.11 (excluding 24.2 LTS) allows unauthenticated user to consume computCVE-2024-4056 · Other software · M-Files Corporation · reported by security@m-files.comHigh 7.5
Denial of service condition in M-Files Server in versions before 24.4.13592.4 and after 23.11 (excluding 24.2 LTS) allows unauthenticated user to consume computing resources.
Product
M-Files Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record empower.m-files.com product.m-files.com
Apr 25, 2024Unauthenticated file upload allows remote code execution.CVE-2024-0916 · Other software · Webkul Software · reported by 41c37e40-543d-43a2-b660-2fee83ea851aCritical 10
Unauthenticated file upload allows remote code execution. This issue affects UvDesk Community: from 1.0.0 through 1.1.3.
Product
UvDesk Community
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com pentraze.com
Apr 25, 2024WP Setup Wizard: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-25917 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in CodeRevolution WP Setup Wizard.This issue affects WP Setup Wizard: from n/a through 1.0.8.1.
Product
WP Setup Wizard
Affected
up to 1.0.8.1
What to do
Affects up to 1.0.8.1. Update WP Setup Wizard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 25, 2024Classified Listing – Classified ads & Business Directory: Unauthorized loss of dataCVE-2024-3893 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the rtcl_fb_gallery_image_delete AJAX action in all versions up to, and including, 3.0.10.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary attachements.
Product
Classified Listing – Classified ads & Business Directory
Affected
up to 3.0.10.3
What to do
Affects up to 3.0.10.3. Update Classified Listing – Classified ads & Business Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 25, 2024 Brocade SANnav before v2.3.0a lacks protection mechanisms on port 2377/TCP and 7946/TCP, which could allow an unauthenticated attacker to sniff the SANnav DockCVE-2024-4159 · Other software · Brocade · reported by sirt@brocade.comMedium 4.3
Brocade SANnav before v2.3.0a lacks protection mechanisms on port 2377/TCP and 7946/TCP, which could allow an unauthenticated attacker to sniff the SANnav Docker information.
Product
Brocade SANnav
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.broadcom.com support.broadcom.com
Apr 25, 2024An out-of-bounds read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3, in certain conditions can allow an unauthenticated remote CVE-2024-23527 · Network & remote access · Ivanti · reported by support@hackerone.comHigh 7.5
An out-of-bounds read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3, in certain conditions can allow an unauthenticated remote attacker to read sensitive information in memory.
Product
Avalanche
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ivanti.com ivanti.com
Apr 24, 2024A vulnerability in the OSPF version 2 (OSPFv2) feature of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause an affected device toCVE-2024-20313 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.4
A vulnerability in the OSPF version 2 (OSPFv2) feature of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to improper validation of OSPF updates that are processed by a device. An attacker could exploit this vulnerability by sending a malformed OSPF update to the device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.
Product
Cisco IOS XE Software
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sec.cloudapps.cisco.com sec.cloudapps.cisco.com
Apr 24, 2024Post Grid: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-32816 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in PickPlugins Post Grid.This issue affects Post Grid: from n/a through 2.2.78.
Product
Post Grid
Affected
up to 2.2.78
What to do
Affects up to 2.2.78. Update Post Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024Email Customizer for WooCommerce: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-32781 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ThemeHigh Email Customizer for WooCommerce.This issue affects Email Customizer for WooCommerce: from n/a through 2.6.0.
Product
Email Customizer for WooCommerce
Affected
up to 2.6.0
What to do
Affects up to 2.6.0. Update Email Customizer for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024VikRentCar: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-32780 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in E4J s.R.L. VikRentCar.This issue affects VikRentCar: from n/a through 1.3.2.
Product
VikRentCar
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update VikRentCar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024Frontend Dashboard: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-32726 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in vinoth06. Frontend Dashboard.This issue affects Frontend Dashboard: from n/a through 2.2.2.
Product
Frontend Dashboard
Affected
up to 2.2.2
What to do
Affects up to 2.2.2. Update Frontend Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024StreamWeasels Twitch Integration: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-32716 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in StreamWeasels StreamWeasels Twitch Integration.This issue affects StreamWeasels Twitch Integration: from n/a through 1.7.8.
Product
StreamWeasels Twitch Integration
Affected
up to 1.7.8
What to do
Affects up to 1.7.8. Update StreamWeasels Twitch Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 23, 2024An unauthenticated remote attacker can deceive users into performing unintended actions due to improper restriction of rendered UI layers or frames.CVE-2024-3911 · Other software · Welotec · reported by info@cert.vde.comMedium 6.5
An unauthenticated remote attacker can deceive users into performing unintended actions due to improper restriction of rendered UI layers or frames.
Product
SMART EMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.vde.com cert.vde.com
Apr 23, 2024Quick Featured Images: Unauthorized modification of dataCVE-2024-3664 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Quick Featured Images plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the set_thumbnail and delete_thumbnail functions in all versions up to, and including, 13.7.0. This makes it possible for authenticated attackers, with contributor-level access and above, to delete thumbnails and add thumbnails to posts they did not author.
Product
Quick Featured Images
Affected
up to 13.7.0
What to do
Affects up to 13.7.0. Update Quick Featured Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 19, 2024SecuSTATION Camera V2.5.5.3116-S50-SMA-B20160811A and lower allows an unauthenticated attacker to download device configuration files via a crafted request.CVE-2024-31587 · Other software · secu · reported by MITREMedium 6.5
SecuSTATION Camera V2.5.5.3116-S50-SMA-B20160811A and lower allows an unauthenticated attacker to download device configuration files via a crafted request.
Product
secustation_firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 18, 2024A Heap Overflow vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3 allows a remote unauthenticated attacker to execute arbitrary comCVE-2024-29204 · Network & remote access · Ivanti · reported by support@hackerone.comCritical 9.8
A Heap Overflow vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3 allows a remote unauthenticated attacker to execute arbitrary commands
Product
Avalanche
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forums.ivanti.com forums.ivanti.com
Apr 18, 2024A Heap overflow vulnerability in WLInfoRailService component of Ivanti Avalanche before 6.4.3 allows an unauthenticated remote attacker to execute arbitrary comCVE-2024-24996 · Network & remote access · Ivanti · reported by support@hackerone.comCritical 9.8
A Heap overflow vulnerability in WLInfoRailService component of Ivanti Avalanche before 6.4.3 allows an unauthenticated remote attacker to execute arbitrary commands.
Product
Avalanche
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forums.ivanti.com forums.ivanti.com
Apr 18, 2024An Integer Overflow vulnerability in WLInfoRailService component of Ivanti Avalanche before 6.4.3 allows an unauthenticated remote attacker to perform denial ofCVE-2024-23531 · Network & remote access · Ivanti · reported by support@hackerone.comHigh 7.5
An Integer Overflow vulnerability in WLInfoRailService component of Ivanti Avalanche before 6.4.3 allows an unauthenticated remote attacker to perform denial of service attacks. In certain rare conditions this could also lead to reading content from memory.
Product
Avalanche
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forums.ivanti.com forums.ivanti.com
Apr 18, 2024An out-of-bounds read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3, in certain conditions can allow an unauthenticated remote CVE-2024-23530 · Network & remote access · Ivanti · reported by support@hackerone.comHigh 7.5
An out-of-bounds read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3, in certain conditions can allow an unauthenticated remote attacker to read sensitive information in memory.
Product
Avalanche
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forums.ivanti.com forums.ivanti.com
Apr 18, 2024An out-of-bounds read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3, in certain conditions can allow an unauthenticated remote CVE-2024-23529 · Network & remote access · Ivanti · reported by support@hackerone.comHigh 7.5
An out-of-bounds read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3, in certain conditions can allow an unauthenticated remote attacker to read sensitive information in memory.
Product
Avalanche
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forums.ivanti.com forums.ivanti.com
Apr 18, 2024An out-of-bounds read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3, in certain conditions can allow an unauthenticated remote CVE-2024-23528 · Network & remote access · Ivanti · reported by support@hackerone.comHigh 7.5
An out-of-bounds read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3, in certain conditions can allow an unauthenticated remote attacker to read sensitive information in memory.
Product
Avalanche
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forums.ivanti.com forums.ivanti.com
Apr 18, 2024An out-of-bounds read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3, in certain conditions can allow an unauthenticated remote CVE-2024-23526 · Network & remote access · Ivanti · reported by support@hackerone.comHigh 7.5
An out-of-bounds read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3, in certain conditions can allow an unauthenticated remote attacker to read sensitive information in memory.
Product
Avalanche
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forums.ivanti.com forums.ivanti.com
Apr 18, 2024A Heap Overflow vulnerability in WLInfoRailService component of Ivanti Avalanche before 6.4.3 allows a remote unauthenticated attacker to execute arbitrary commCVE-2024-22061 · Network & remote access · Ivanti · reported by support@hackerone.comCritical 9.8
A Heap Overflow vulnerability in WLInfoRailService component of Ivanti Avalanche before 6.4.3 allows a remote unauthenticated attacker to execute arbitrary commands
Product
Avalanche
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forums.ivanti.com forums.ivanti.com
Apr 18, 2024The device allows an unauthenticated attacker to bypass authentication and modify the cookie to reveal hidden pages that allows more critical operations to thCVE-2024-21872 · Other software · Electrolink · reported by ics-cert@hq.dhs.govHigh 8.7
The device allows an unauthenticated attacker to bypass authentication and modify the cookie to reveal hidden pages that allows more critical operations to the transmitter.
Product
Compact DAB Transmitter
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Apr 18, 2024An unauthenticated attacker can reset the board and stop transmitter operations by sending a specially-crafted GET request to the command.cgi gateway, resultiCVE-2024-21846 · Other software · Electrolink · reported by ics-cert@hq.dhs.govMedium 6.9
An unauthenticated attacker can reset the board and stop transmitter operations by sending a specially-crafted GET request to the command.cgi gateway, resulting in a denial-of-service scenario.
Product
Compact DAB Transmitter
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Apr 18, 2024The application is vulnerable to an unauthenticated parameter manipulation that allows an attacker to set the credentials to blank giving her access to the adCVE-2024-22179 · Other software · Electrolink · reported by ics-cert@hq.dhs.govHigh 8.7
The application is vulnerable to an unauthenticated parameter manipulation that allows an attacker to set the credentials to blank giving her access to the admin panel. Also vulnerable to account takeover and arbitrary password change.
Product
Compact DAB Transmitter
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Apr 18, 2024HCL Connections contains a broken access control vulnerability that may expose sensitive information to unauthorized users in certain scenarios.CVE-2024-30107 · Other software · HCL Software · reported by psirt@hcl.comLow 3.5
HCL Connections contains a broken access control vulnerability that may expose sensitive information to unauthorized users in certain scenarios.
Product
Connections
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcltechsw.com support.hcltechsw.com
Apr 18, 2024A vulnerability in the HTML parser of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.CVE-2024-20380 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.5
A vulnerability in the HTML parser of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to an issue in the C to Rust foreign function interface. An attacker could exploit this vulnerability by submitting a crafted file containing HTML content to be scanned by ClamAV on an affected device. An exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.
Product
ClamAV
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.clamav.net blog.clamav.net
Apr 17, 2024Radio Player: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-32506 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SoftLab Radio Player.This issue affects Radio Player: from n/a through 2.0.73.
Product
Radio Player
Affected
up to 2.0.73
What to do
Affects up to 2.0.73. Update Radio Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 16, 2024IBM Security Verify Privilege 11.6.25 could allow an unauthenticated actor to obtain sensitive information from the SOAP API.CVE-2024-31887 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.5
IBM Security Verify Privilege 11.6.25 could allow an unauthenticated actor to obtain sensitive information from the SOAP API. IBM X-Force ID: 287651.
Product
Security Verify Privilege
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com
Apr 16, 2024An Improper Handling of Exceptional Conditions vulnerability in Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to caCVE-2024-30380 · Network & remote access · Juniper Networks · reported by sirt@juniper.netHigh 7.1
An Improper Handling of Exceptional Conditions vulnerability in Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a Denial of Service (DoS), which causes the l2cpd process to crash by sending a specific TLV. The l2cpd process is responsible for layer 2 control protocols, such as STP, RSTP, MSTP, VSTP, ERP, and LLDP. The impact of the l2cpd crash is reinitialization of STP protocols (RSTP, MSTP or VSTP), and MVRP and ERP, leading to a Denial of Service. Continued receipt and processing of this specific TLV will create a sustained Denial of Service (DoS) condition. This issue affects: Junos OS: all versions before 20.4R3-S9, from 21.2 before 21.2R3-S7, from 21.3 before 21.3R3-S5, from 21.4 before 21.4R3-S4, from 22.1 before 22.1R3-S4, from 22.2 before 22.2R3-S2, from 22.3 before 22.3R2-S2, 22.3R3-S1, from 22.4 before 22.4R2-S2, 22.4R3, from 23.2 before 23.2R1-S1, 23.2R2; Junos OS Evolved: all versions before 21.2R3-S7, from 21.3 before 21.3R3-S5-EVO, from 21.4 before 21.4R3-S5-EVO, from 22.1 before 22.1R3-S4-EVO, from 22.2 before 22.2R3-S2-EVO, from 22.3 before 22.3R2-S2-EVO, 22.3R3-S1-EVO, from 22.4 before 22.4
Product
Junos OS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record supportportal.juniper.net first.org
Apr 16, 2024Citadela Listing: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-32086 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in AitThemes Citadela Listing.This issue affects Citadela Listing: from n/a through 5.18.1.
Product
Citadela Listing
Affected
up to 5.18.1
What to do
Affects up to 5.18.1. Update Citadela Listing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 16, 2024Customer Reviews for WooCommerce: Unauthorized access of dataCVE-2024-3869 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'woocommerce_json_search_coupons' function . This makes it possible for attackers with subscriber level access to view coupon codes.
Product
Customer Reviews for WooCommerce
Fixed in
5.47.0
What to do
Update Customer Reviews for WooCommerce to 5.47.0 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.