Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

1,809 results · page 23 of 37

Sep 25, 2024In Progress Telerik UI for WPF versions prior to 2024 Q3 (2024.3.924), a code execution attack is possible through an insecure deserialization vulnerability.CVE-2024-8316 · Other software · Progress Software · reported by security@progress.comHigh 7.8
In Progress Telerik UI for WPF versions prior to 2024 Q3 (2024.3.924), a code execution attack is possible through an insecure deserialization vulnerability.
Product
Telerik UI for WPF
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.telerik.com
Sep 25, 2024In Progress Telerik UI for WPF versions prior to 2024 Q3 (2024.3.924), a code execution attack is possible through an insecure deserialization vulnerability.CVE-2024-7576 · Other software · Progress Software · reported by security@progress.comHigh 7.8
In Progress Telerik UI for WPF versions prior to 2024 Q3 (2024.3.924), a code execution attack is possible through an insecure deserialization vulnerability.
Product
Telerik UI for WPF
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.telerik.com
Sep 23, 2024Easy Digital Downloads – Simple eCommerce for Selling Digital Files: Deserialization of untrusted inputCVE-2022-2439 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Easy Digital Downloads – Simple eCommerce for Selling Digital Files plugin for WordPress is vulnerable to deserialization of untrusted input via the 'upload[file]' parameter in versions up to, and including 3.3.3. This makes it possible for authenticated administrative users to call files using a PHAR wrapper, that will deserialize and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present.
Product
Easy Digital Downloads – Simple eCommerce for Selling Digital Files
Affected
up to 3.3.3
What to do
Affects up to 3.3.3. Update Easy Digital Downloads – Simple eCommerce for Selling Digital Files to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2024Insecure deserialization in sqlitedict up to v2.1.0 allows attackers to execute arbitrary code.CVE-2024-35515 · Other software · sqlitedict · reported by MITRECritical 9.8
Insecure deserialization in sqlitedict up to v2.1.0 allows attackers to execute arbitrary code.
Product
sqlitedict
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com wha13.github.io
Sep 17, 2024A vulnerability in the FAISS.deserialize_from_bytes function of langchain-ai/langchain allows for pickle deserialization of untrusted data.CVE-2024-5998 · Other software · langchain-ai · reported by security@huntr.devHigh 7.8
A vulnerability in the FAISS.deserialize_from_bytes function of langchain-ai/langchain allows for pickle deserialization of untrusted data. This can lead to the execution of arbitrary commands via the os.system function. The issue affects the latest version of the product.
Product
langchain-ai/langchain
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com huntr.com
Sep 16, 2024Deserialization of Untrusted Data vulnerability in Apache Seata.CVE-2024-22399 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Deserialization of Untrusted Data vulnerability in Apache Seata. When developers disable authentication on the Seata-Server and do not use the Seata client SDK dependencies, they may construct uncontrolled serialized malicious requests by directly sending bytecode based on the Seata private protocol. This issue affects Apache Seata: 2.0.0, from 1.0.0 through 1.8.0. Users are recommended to upgrade to version 2.1.0/1.8.1, which fixes the issue.
Product
Apache Seata
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
Sep 13, 2024In the Linux kernel, the following vulnerability has been resolved: perf/aux: Fix AUX buffer serialization Ole reported that event->mmap_mutex is strictly insCVE-2024-46713 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: perf/aux: Fix AUX buffer serialization Ole reported that event->mmap_mutex is strictly insufficient to serialize the AUX buffer, add a per RB mutex to fully serialize it. Note that in the lock order comment the perf_event::mmap_mutex order was already wrong, that is, it nesting under mmap_lock is not new with this patch.
Product
Linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org git.kernel.org
Sep 13, 2024WP Editor: Deserialization of untrusted inputCVE-2022-2446 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP Editor plugin for WordPress is vulnerable to deserialization of untrusted input via the 'current_theme_root' parameter in versions up to, and including 1.2.9. This makes it possible for authenticated attackers with administrative privileges to call files using a PHAR wrapper that will deserialize and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacker is successful in uploading a file with the serialized payload.
Product
WP Editor
Affected
up to 1.2.9
What to do
Affects up to 1.2.9. Update WP Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 13, 2024ColdFusion versions 2023.9, 2021.15 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution CVE-2024-41874 · Websites & servers · Adobe · reported by AdobeCritical 9.8
ColdFusion versions 2023.9, 2021.15 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability by providing crafted input to the application, which when deserialized, leads to execution of malicious code. Exploitation of this issue does not require user interaction.
Product
ColdFusion
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record helpx.adobe.com
Sep 12, 2024Deserialization of untrusted data can occur in versions 2.4.0 or newer of the Cleanlab project, enabling a maliciously crafted datalab.pkl file to run arbitraryCVE-2024-45857 · Other software · Cleanlab · reported by 6f8de1f0-f67e-45a6-b68f-98777fdb759cHigh 7.8
Deserialization of untrusted data can occur in versions 2.4.0 or newer of the Cleanlab project, enabling a maliciously crafted datalab.pkl file to run arbitrary code on an end user’s system when the data directory is loaded.
Product
cleanlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hiddenlayer.com
Sep 12, 2024Deserialization of untrusted data can occur in versions 23.10.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run arbiCVE-2024-45855 · Other software · mindsdb · reported by 6f8de1f0-f67e-45a6-b68f-98777fdb759cHigh 7.1
Deserialization of untrusted data can occur in versions 23.10.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run arbitrary code on the server when using ‘finetune’ on it.
Product
mindsdb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hiddenlayer.com
Sep 12, 2024Deserialization of untrusted data can occur in versions 23.10.3.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run arbiCVE-2024-45854 · Other software · mindsdb · reported by 6f8de1f0-f67e-45a6-b68f-98777fdb759cHigh 7.1
Deserialization of untrusted data can occur in versions 23.10.3.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run arbitrary code on the server when a ‘describe’ query is run on it.
Product
mindsdb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hiddenlayer.com
Sep 12, 2024Deserialization of untrusted data can occur in versions 23.10.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run arbiCVE-2024-45853 · Other software · mindsdb · reported by 6f8de1f0-f67e-45a6-b68f-98777fdb759cHigh 7.1
Deserialization of untrusted data can occur in versions 23.10.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run arbitrary code on the server when used for a prediction.
Product
mindsdb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hiddenlayer.com
Sep 12, 2024Deserialization of untrusted data can occur in versions 23.3.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded model to run arbitrary code CVE-2024-45852 · Other software · mindsdb · reported by 6f8de1f0-f67e-45a6-b68f-98777fdb759cHigh 8.8
Deserialization of untrusted data can occur in versions 23.3.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded model to run arbitrary code on the server when interacted with.
Product
mindsdb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hiddenlayer.com
Sep 11, 2024Deserialization of untrusted data in the agent portal of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to acCVE-2024-29847 · Network & remote access · Ivanti · reported by support@hackerone.comCritical 9.8
Deserialization of untrusted data in the agent portal of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to achieve remote code execution.
Product
EPM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forums.ivanti.com
Sep 9, 2024A deserialization vulnerability in Thinkphp v6.1.3 to v8.0.4 allows attackers to execute arbitrary code.CVE-2024-44902 · Other software · thinkphp · reported by MITRECritical 9.8
A deserialization vulnerability in Thinkphp v6.1.3 to v8.0.4 allows attackers to execute arbitrary code.
Product
thinkphp
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Sep 9, 2024A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload.CVE-2024-37288 · Other software · Elastic · reported by security@elastic.coCritical 9.9
A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. This issue only affects users that use Elastic Security’s built-in AI tools https://www.elastic.co/guide/en/security/current/ai-for-security.html and have configured an Amazon Bedrock connector https://www.elastic.co/guide/en/security/current/assistant-connect-to-bedrock.html .
Product
Kibana
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record discuss.elastic.co
Sep 7, 2024Veeam Backup and Replication Deserialization VulnerabilityCVE-2024-40711 · Other software · Veeam · reported by support@hackerone.comExploitedRansomwareCritical 9.8
Veeam Backup and Replication contains a deserialization vulnerability allowing an unauthenticated user to perform remote code execution.
Product
Backup & Replication
On CISA’s list since
Oct 17, 2024 (federal fix deadline Nov 7, 2024)
What to do
Attackers are using this now. Install Veeam’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog veeam.com labs.watchtowr.com
Sep 6, 2024H2O.ai H2O through 3.46.0.4 allows attackers to arbitrarily set the JDBC URL, leading to deserialization attacks, file reads, and command execution.CVE-2024-45758 · Other software · h2oai · reported by MITRECritical 9.1
H2O.ai H2O through 3.46.0.4 allows attackers to arbitrarily set the JDBC URL, leading to deserialization attacks, file reads, and command execution. Exploitation can occur when an attacker has access to post to the ImportSQLTable URI with a JSON document containing a connection_url property with any typical JDBC Connection URL attack payload such as one that uses queryInterceptors.
Product
h2o-3
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com spear-shield.notion.site
Aug 29, 2024Delta Electronics DTN Soft version 2.0.1 and prior are vulnerable to an attacker achieving remote code execution through a deserialization of untrusted data vulCVE-2024-8255 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.4
Delta Electronics DTN Soft version 2.0.1 and prior are vulnerable to an attacker achieving remote code execution through a deserialization of untrusted data vulnerability.
Product
DTN Soft
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov
Aug 29, 2024JobSearch: Deserialization of Untrusted DataCVE-2024-43931 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in eyecix JobSearch allows Object Injection.This issue affects JobSearch: from n/a through 2.5.3.
Product
JobSearch
Affected
up to 2.5.3
What to do
Affects up to 2.5.3. Update JobSearch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 29, 2024Theme Editor: Deserialization of untrusted inputCVE-2022-2440 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Theme Editor plugin for WordPress is vulnerable to deserialization of untrusted input via the 'images_array' parameter in versions up to, and including 2.8. This makes it possible for authenticated attackers with administrative privileges to call files using a PHAR wrapper that will deserialize and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacker is successful in uploading a file with the serialized payload.
Product
Theme Editor
Affected
up to 2.8
What to do
Affects up to 2.8. Update Theme Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 19, 2024myCred: Deserialization of Untrusted DataCVE-2024-43354 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Saad Iqbal myCred mycred.This issue affects myCred: from n/a through <= 2.7.2.
Product
myCred
Affected
up to 2.7.2
What to do
Affects up to 2.7.2. Update myCred to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 19, 2024Crew HRM: Deserialization of Untrusted DataCVE-2024-43252 · WordPress plugins & themes · reported by PatchstackCritical 9
Deserialization of Untrusted Data vulnerability in Crew HRM Crew HRM hr-management.This issue affects Crew HRM: from n/a through <= 1.1.1.
Product
Crew HRM
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Crew HRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 19, 2024Ultimate Membership Pro: Deserialization of Untrusted DataCVE-2024-43242 · WordPress plugins & themes · reported by PatchstackCritical 9
Deserialization of Untrusted Data vulnerability in azzaroco Ultimate Membership Pro indeed-membership-pro.This issue affects Ultimate Membership Pro: from n/a through <= 12.7.
Product
Ultimate Membership Pro
Affected
up to 12.7
What to do
Affects up to 12.7. Update Ultimate Membership Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 19, 2024GiveWP: Deserialization of Untrusted DataCVE-2024-37099 · WordPress plugins & themes · reported by PatchstackCritical 10
Deserialization of Untrusted Data vulnerability in Liquid Web GiveWP allows Object Injection.This issue affects GiveWP: from n/a through 3.14.1.
Product
GiveWP
Affected
up to 3.14.1
What to do
Affects up to 3.14.1. Update GiveWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2024SolarWinds Web Help Desk Deserialization of Untrusted Data VulnerabilityCVE-2024-28986 · Other software · SolarWinds · reported by psirt@solarwinds.comExploitedCritical 9.8
SolarWinds Web Help Desk contains a deserialization of untrusted data vulnerability that could allow for remote code execution.
Product
Web Help Desk
On CISA’s list since
Aug 15, 2024 (federal fix deadline Sep 5, 2024)
What to do
Attackers are using this now. Install SolarWinds’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.solarwinds.com solarwinds.com
Aug 13, 2024Participants Database: Deserialization of Untrusted DataCVE-2024-43141 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Roland Barker, xnau webdesign Participants Database allows Object Injection.This issue affects Participants Database: from n/a through 2.5.9.2.
Product
Participants Database
Affected
up to 2.5.9.2
What to do
Affects up to 2.5.9.2. Update Participants Database to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 7, 2024An insecure deserialization vulnerability in web component of EPMM prior to 12.1.0.1 allows an authenticated remote attacker to execute arbitrary commands on thCVE-2024-36131 · Network & remote access · Ivanti · reported by support@hackerone.comHigh 8.8
An insecure deserialization vulnerability in web component of EPMM prior to 12.1.0.1 allows an authenticated remote attacker to execute arbitrary commands on the underlying operating system of the appliance.
Product
EPMM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forums.ivanti.com
Aug 1, 2024Better Find and Replace: Deserialization of Untrusted DataCVE-2024-39636 · WordPress plugins & themes · reported by PatchstackHigh 8.3
Deserialization of Untrusted Data vulnerability in CodeSolz Better Find and Replace.This issue affects Better Find and Replace: from n/a through 1.6.1.
Product
Better Find and Replace
Affected
up to 1.6.1
What to do
Affects up to 1.6.1. Update Better Find and Replace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 1, 2024Timetable and Event Schedule: Deserialization of Untrusted DataCVE-2024-39630 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Deserialization of Untrusted Data vulnerability in MotoPress Timetable and Event Schedule allows Object Injection.This issue affects Timetable and Event Schedule: from n/a through 2.4.13.
Product
Timetable and Event Schedule
Affected
up to 2.4.13
What to do
Affects up to 2.4.13. Update Timetable and Event Schedule to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 24, 2024In Progress® Telerik® Report Server versions prior to 2024 Q2 (10.1.24.709), a remote code execution attack is possible through an insecure deserialization vulnCVE-2024-6327 · Other software · Progress Software Corporation · reported by security@progress.comCritical 9.9
In Progress® Telerik® Report Server versions prior to 2024 Q2 (10.1.24.709), a remote code execution attack is possible through an insecure deserialization vulnerability.
Product
Telerik Report Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.telerik.com telerik.com
Jul 22, 2024A deserialization of untrusted data vulnerability exists in NI VeriStand Waveform Streaming Server that may result in remote code execution.CVE-2024-6794 · Other software · NI · reported by security@ni.comCritical 9.8
A deserialization of untrusted data vulnerability exists in NI VeriStand Waveform Streaming Server that may result in remote code execution. Successful exploitation requires an attacker to send a specially crafted message. These vulnerabilities affect NI VeriStand 2024 Q2 and prior versions.
Product
VeriStand
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ni.com ni.com
Jul 22, 2024A deserialization of untrusted data vulnerability exists in NI VeriStand DataLogging Server that may result in remote code execution.CVE-2024-6793 · Other software · NI · reported by security@ni.comCritical 9.8
A deserialization of untrusted data vulnerability exists in NI VeriStand DataLogging Server that may result in remote code execution. Successful exploitation requires an attacker to send a specially crafted message. These vulnerabilities affect NI VeriStand 2024 Q2 and prior versions.
Product
VeriStand
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ni.com ni.com
Jul 22, 2024A deserialization of untrusted data vulnerability exists in NI VeriStand that may result in remote code execution.CVE-2024-6675 · Other software · NI · reported by security@ni.comHigh 7.8
A deserialization of untrusted data vulnerability exists in NI VeriStand that may result in remote code execution. Successful exploitation requires an attacker to get a user to open a specially crafted project file. This vulnerability affects VeriStand 2024 Q2 and prior versions.
Product
VeriStand
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ni.com ni.com
Jul 22, 2024Search & Replace: Deserialization of Untrusted DataCVE-2024-38759 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Deserialization of Untrusted Data vulnerability in WP MEDIA SAS Search & Replace search-and-replace.This issue affects Search & Replace: from n/a through 3.2.2.
Product
Search & Replace
Affected
up to 3.2.2
What to do
Affects up to 3.2.2. Update Search & Replace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 18, 2024Improper Restriction of XML External Entity Reference vulnerability in PruvaSoft Informatics Apinizer Management Console allows Data Serialization External EntiCVE-2024-5625 · Other software · PruvaSoft Informatics · reported by iletisim@usom.gov.trMedium 6.5
Improper Restriction of XML External Entity Reference vulnerability in PruvaSoft Informatics Apinizer Management Console allows Data Serialization External Entities Blowup. This issue affects Apinizer Management Console: before 2024.05.1.
Product
Apinizer Management Console
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record siberguvenlik.gov.tr usom.gov.tr
Jul 9, 2024Microsoft SharePoint Deserialization VulnerabilityCVE-2024-38094 · Email & office · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.2
Microsoft SharePoint contains a deserialization vulnerability that allows for remote code execution.
Product
SharePoint
On CISA’s list since
Oct 22, 2024 (federal fix deadline Nov 12, 2024)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
Jul 9, 2024WooCommerce Social Login: Deserialization of Untrusted DataCVE-2024-37502 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Deserialization of Untrusted Data vulnerability in wpweb WooCommerce Social Login woo-social-login.This issue affects WooCommerce Social Login: from n/a through <= 2.6.3.
Product
WooCommerce Social Login
Affected
up to 2.6.3
What to do
Affects up to 2.6.3. Update WooCommerce Social Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 25, 2024In WhatsUp Gold versions released before 2023.1.3, Distributed Edition installations can be exploited by using a deserialization tool to achieve a Remote Code ECVE-2024-5016 · Other software · Progress Software Corporation · reported by security@progress.comHigh 7.2
In WhatsUp Gold versions released before 2023.1.3, Distributed Edition installations can be exploited by using a deserialization tool to achieve a Remote Code Execution as SYSTEM. The vulnerability exists in the main message processing routines NmDistributed.DistributedServiceBehavior.OnMessage for server and NmDistributed.DistributedClient.OnMessage for clients.
Product
WhatsUp Gold
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.progress.com progress.com
Jun 19, 2024Page Builder: Live Composer: Deserialization of Untrusted DataCVE-2024-35780 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Deserialization of Untrusted Data vulnerability in Live Composer Team Page Builder: Live Composer.This issue affects Page Builder: Live Composer: from n/a through 1.5.42.
Product
Page Builder: Live Composer
Affected
up to 1.5.42
What to do
Affects up to 1.5.42. Update Page Builder: Live Composer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 14, 2024Insecure Deserialization in some workflows of the IPS Manager allows unauthenticated remote attackers to perform arbitrary code execution and access to the vulnCVE-2024-5671 · Other software · Trellix · reported by trellixpsirt@trellix.comCritical 9.8
Insecure Deserialization in some workflows of the IPS Manager allows unauthenticated remote attackers to perform arbitrary code execution and access to the vulnerable Trellix IPS Manager.
Product
Intrusion Prevention System (IPS) Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record thrive.trellix.com thrive.trellix.com
Jun 12, 2024Dell Common Event Enabler, version 8.9.10.0 and prior, contain an insecure deserialization vulnerability in CAVATools.CVE-2024-28964 · Other software · Dell · reported by security_alert@emc.comHigh 7.8
Dell Common Event Enabler, version 8.9.10.0 and prior, contain an insecure deserialization vulnerability in CAVATools. A local unauthenticated attacker could potentially exploit this vulnerability, leading to arbitrary code execution in the context of the logged in user. Exploitation of this issue requires a victim to open a malicious file.
Product
Common Event Enabler
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record dell.com dell.com
Jun 10, 2024nukeviet v.4.5 and before and nukeviet-egov v.1.2.02 and before have a Deserialization vulnerability which results in code execution via /admin/extensions/downlCVE-2024-36528 · Other software · nukeviet · reported by MITREHigh 8.8
nukeviet v.4.5 and before and nukeviet-egov v.1.2.02 and before have a Deserialization vulnerability which results in code execution via /admin/extensions/download.php and /admin/extensions/upload.php.
Product
nukeviet
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mat4mee.notion.site mat4mee.notion.site
Jun 6, 2024Untrusted data deserialization vulnerability has been found in Mentor - Employee Portal, affecting version 3.83.35.CVE-2024-5675 · Other software · Summar Software · reported by cve-coordination@incibe.esCritical 10
Untrusted data deserialization vulnerability has been found in Mentor - Employee Portal, affecting version 3.83.35. This vulnerability could allow an attacker to execute arbitrary code, by injecting a malicious payload into the “ViewState” field.
Product
Mentor – Employee Portal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record incibe.es incibe.es
Jun 5, 2024An out-of-bounds read in the 'bson' module of PyMongo 4.6.2 or earlier allows deserialization of malformed BSON provided by a Server to raise an exception whichCVE-2024-5629 · Other software · MongoDB Inc · reported by cna@mongodb.comMedium 4.7
An out-of-bounds read in the 'bson' module of PyMongo 4.6.2 or earlier allows deserialization of malformed BSON provided by a Server to raise an exception which may contain arbitrary application memory.
Product
PyMongo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jira.mongodb.org lists.debian.org
Jun 4, 2024Element Pack Pro: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Deserialization of Untrusted DataCVE-2024-33568 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Deserialization of Untrusted Data vulnerability in BdThemes Element Pack Pro allows Path Traversal, Object Injection.This issue affects Element Pack Pro: from n/a before 7.19.3.
Product
Element Pack Pro
Fixed in
7.19.3
What to do
Update Element Pack Pro to 7.19.3 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Deserialization of untrusted data can occur in versions 0.6 or newer of the skops python library, enabling a maliciously crafted model to run arbitrary code on CVE-2024-37065 · Other software · Skops-dev · reported by 6f8de1f0-f67e-45a6-b68f-98777fdb759cHigh 7.8
Deserialization of untrusted data can occur in versions 0.6 or newer of the skops python library, enabling a maliciously crafted model to run arbitrary code on an end user's system when loaded.
Product
Skops
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hiddenlayer.com hiddenlayer.com
Jun 4, 2024Deserialization of untrusted data can occur in versions 3.7.0 or newer of Ydata's ydata-profiling open-source library, enabling a malicously crafted report to rCVE-2024-37062 · Other software · YdataAI · reported by 6f8de1f0-f67e-45a6-b68f-98777fdb759cHigh 7.8
Deserialization of untrusted data can occur in versions 3.7.0 or newer of Ydata's ydata-profiling open-source library, enabling a malicously crafted report to run arbitrary code on an end user's system when loaded.
Product
ydata-profiling
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hiddenlayer.com hiddenlayer.com
Jun 4, 2024Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.27.0 or newer, enabling a maliciously crafted Recipe to executeCVE-2024-37060 · Other software · MLflow · reported by 6f8de1f0-f67e-45a6-b68f-98777fdb759cHigh 8.8
Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.27.0 or newer, enabling a maliciously crafted Recipe to execute arbitrary code on an end user’s system when run.
Product
MLflow
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hiddenlayer.com hiddenlayer.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.