Updated 9 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,769exploited flaws on CISA’s list

30added in the last 30 days

460new WordPress flaws this week

394,717entries in the database

17,729 results · page 232 of 355

Feb 23, 2024Improper input validation in some Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageability firmware may allow an unauthenticated user to pCVE-2021-33146 · Other software · intel · reported by secure@intel.comMedium 5.3
Improper input validation in some Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageability firmware may allow an unauthenticated user to potentially enable information disclosure via network access.
Product
ethernet_controller_i225_manageability_firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record intel.com intel.com
Feb 23, 2024Improper input validation in some Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageability firmware may allow an unauthenticated user to pCVE-2021-33141 · Other software · intel · reported by secure@intel.comHigh 8.6
Improper input validation in some Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageability firmware may allow an unauthenticated user to potentially enable denial of service via network access.
Product
ethernet_adapter
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record intel.com intel.com
Feb 23, 2024Admin side data storage for Contact Form 7: Unauthorized modification of dataCVE-2024-1779 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Admin side data storage for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the zt_dcfcf_change_status() function in all versions up to, and including, 1.1.1. This makes it possible for unauthenticated attackers to alter the message read status of messages.
Product
Admin side data storage for Contact Form 7
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Admin side data storage for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 23, 2024Admin side data storage for Contact Form 7: Unauthorized modification of dataCVE-2024-1778 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Admin side data storage for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the zt_dcfcf_change_bookmark() function in all versions up to, and including, 1.1.1. This makes it possible for unauthenticated attackers to alter bookmark statuses.
Product
Admin side data storage for Contact Form 7
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Admin side data storage for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 22, 2024The Access Point functionality in eapol_auth_key_handle in eapol.c in iNet wireless daemon (IWD) before 2.14 allows attackers to gain unauthorized access to a pCVE-2023-52161 · Other software · intel · reported by MITREHigh 7.5
The Access Point functionality in eapol_auth_key_handle in eapol.c in iNet wireless daemon (IWD) before 2.14 allows attackers to gain unauthorized access to a protected Wi-Fi network. An attacker can complete the EAPOL handshake by skipping Msg2/4 and instead sending Msg4/4 with an all-zero key.
Product
inet_wireless_daemon
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org iwd.wiki.kernel.org
Feb 22, 2024An attacker could have executed unauthorized scripts on top origin sites using a JavaScript URI when opening an external URL with a custom Firefox scheme.CVE-2024-26283 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 7.8
An attacker could have executed unauthorized scripts on top origin sites using a JavaScript URI when opening an external URL with a custom Firefox scheme. This vulnerability affects Firefox for iOS < 123.
Product
Firefox for iOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Feb 22, 2024Upon scanning a JavaScript URI with the QR code scanner, an attacker could have executed unauthorized scripts on the current top origin sites in the URL bar.CVE-2024-26281 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 4.7
Upon scanning a JavaScript URI with the QR code scanner, an attacker could have executed unauthorized scripts on the current top origin sites in the URL bar. This vulnerability affects Firefox for iOS < 123.
Product
Firefox for iOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Feb 22, 2024An attacker could have executed unauthorized scripts on top origin sites using a JavaScript URI when opening an external URL with a custom Firefox scheme and a CVE-2024-1563 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.1
An attacker could have executed unauthorized scripts on top origin sites using a JavaScript URI when opening an external URL with a custom Firefox scheme and a timeout race condition. This vulnerability affects Focus for iOS < 122.
Product
Focus for iOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Feb 22, 2024An unauthenticated remote attacker can bypass the brute force prevention mechanism and disturb the webservice for all users.CVE-2024-1104 · Other software · Areal Topkapi · reported by info@cert.vde.comHigh 7.5
An unauthenticated remote attacker can bypass the brute force prevention mechanism and disturb the webservice for all users.
Product
Webserv2
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record areal-topkapi.com areal-topkapi.com
Feb 22, 2024Event Tickets and Registration: Unauthorized access of dataCVE-2024-1053 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'email' action in all versions up to, and including, 5.8.1. This makes it possible for authenticated attackers, with contributor-level access and above, to email the attendees list to themselves.
Product
Event Tickets and Registration
Affected
up to 5.8.1
What to do
Affects up to 5.8.1. Update Event Tickets and Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 21, 2024A SQL Injection vulnerability in /pmb/opac_css/includes/sessions.inc.php in PMB 7.4.7 and earlier allows remote unauthenticated attackers to inject arbitrary SQCVE-2023-52153 · Other software · pmb_project · reported by MITRECritical 9.8
A SQL Injection vulnerability in /pmb/opac_css/includes/sessions.inc.php in PMB 7.4.7 and earlier allows remote unauthenticated attackers to inject arbitrary SQL commands via the PmbOpac-LOGIN cookie value.
Product
pmb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nexacybersecurity.blogspot.com nexacybersecurity.blogspot.com
Feb 21, 2024A SQL Injection vulnerability in /admin/convert/export.class.php in PMB 7.4.7 and earlier versions allows remote unauthenticated attackers to execute arbitrary CVE-2023-51828 · Other software · pmb_project · reported by MITRECritical 9.8
A SQL Injection vulnerability in /admin/convert/export.class.php in PMB 7.4.7 and earlier versions allows remote unauthenticated attackers to execute arbitrary SQL commands via the query parameter in get_next_notice function.
Product
pmb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nexacybersecurity.blogspot.com nexacybersecurity.blogspot.com
Feb 21, 2024SQL Injection vulnerability in PMB Services PMB v.7.4.7 and before allows a remote unauthenticated attacker to execute arbitrary code via the query parameter inCVE-2023-37177 · Other software · pmb_services · reported by MITRECritical 9.8
SQL Injection vulnerability in PMB Services PMB v.7.4.7 and before allows a remote unauthenticated attacker to execute arbitrary code via the query parameter in the /admin/convert/export_z3950.php endpoint.
Product
pmb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nexacybersecurity.blogspot.com nexacybersecurity.blogspot.com
Feb 21, 2024An issue in He3 App for macOS version 2.0.17, allows remote attackers to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments settings.CVE-2024-25249 · Other software · He3app · reported by MITRECritical 9.8
An issue in He3 App for macOS version 2.0.17, allows remote attackers to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments settings.
Product
He3 App
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 21, 2024The TD Bank TD Advanced Dashboard client through 3.0.3 for macOS allows arbitrary code execution because of the lack of electron::fuses::IsRunAsNodeEnabled (i.eCVE-2023-50975 · Other software · tdbank · reported by MITREHigh 8.4
The TD Bank TD Advanced Dashboard client through 3.0.3 for macOS allows arbitrary code execution because of the lack of electron::fuses::IsRunAsNodeEnabled (i.e., ELECTRON_RUN_AS_NODE can be used in production). This makes it easier for a compromised process to access banking information.
Product
td-advanced-dashboard
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com newsroom.ripeda.com
Feb 21, 2024A vulnerability in the Live Data server of Cisco Unified Intelligence Center could allow an unauthenticated, local attacker to read and modify data in a repositCVE-2024-20325 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.1
A vulnerability in the Live Data server of Cisco Unified Intelligence Center could allow an unauthenticated, local attacker to read and modify data in a repository that belongs to an internal service on an affected device. This vulnerability is due to insufficient access control implementations on cluster configuration CLI requests. An attacker could exploit this vulnerability by sending a cluster configuration CLI request to specific directories on an affected device. A successful exploit could allow the attacker to read and modify data that is handled by an internal service on the affected device.
Product
Cisco Unified Intelligence Center
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sec.cloudapps.cisco.com sec.cloudapps.cisco.com
Feb 21, 2024Simple Job Board: Unauthorized access of data|CVE-2024-0593 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Simple Job Board plugin for WordPress is vulnerable to unauthorized access of data| due to insufficient authorization checking on the fetch_quick_job() function in all versions up to, and including, 2.10.8. This makes it possible for unauthenticated attackers to fetch arbitrary posts, which can be password protected or private and contain sensitive information.
Product
Simple Job Board
Affected
up to 2.10.8
What to do
Affects up to 2.10.8. Update Simple Job Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 20, 2024WooCommerce Google Sheet Connector: Unauthorized modification of dataCVE-2024-1562 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WooCommerce Google Sheet Connector plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the execute_post_data function in all versions up to, and including, 1.3.11. This makes it possible for unauthenticated attackers to update plugin settings.
Product
WooCommerce Google Sheet Connector
Affected
up to 1.3.11
What to do
Affects up to 1.3.11. Update WooCommerce Google Sheet Connector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 20, 2024Plugin Groups: Unauthorized modification of dataCVE-2024-1108 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Plugin Groups plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the admin_init() function in all versions up to, and including, 2.0.6. This makes it possible for unauthenticated attackers to change the settings of the plugin, which can also cause a denial of service due to a misconfiguration.
Product
Plugin Groups
Affected
up to 2.0.6
What to do
Affects up to 2.0.6. Update Plugin Groups to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 17, 2024Vulnerability of permission verification in the content sharing pop-up module.Successful exploitation of this vulnerability may cause unauthorized file sharing.CVE-2023-52373 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
Vulnerability of permission verification in the content sharing pop-up module.Successful exploitation of this vulnerability may cause unauthorized file sharing.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com device.harmonyos.com
Feb 17, 2024Stack overflow vulnerability in the network acceleration module.Successful exploitation of this vulnerability may cause unauthorized file access.CVE-2023-52370 · Other software · Huawei · reported by psirt@huawei.comCritical 9.8
Stack overflow vulnerability in the network acceleration module.Successful exploitation of this vulnerability may cause unauthorized file access.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com device.harmonyos.com
Feb 15, 2024An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in Fortinet FortiManager version 7.4.0 through 7.4.1 and before 7.2.5, ForCVE-2023-44253 · Network & remote access · Fortinet · reported by psirt@fortinet.comMedium 5
An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in Fortinet FortiManager version 7.4.0 through 7.4.1 and before 7.2.5, FortiAnalyzer version 7.4.0 through 7.4.1 and before 7.2.5 and FortiAnalyzer-BigData before 7.2.5 allows an adom administrator to enumerate other adoms and device names via crafted HTTP or HTTPS requests.
Product
FortiManager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fortiguard.com github.com
Feb 14, 2024Web sessions in the management interface in Palo Alto Networks PAN-OS software do not expire in certain situations, making it susceptible to unauthorized accessCVE-2024-0008 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comMedium 6.6
Web sessions in the management interface in Palo Alto Networks PAN-OS software do not expire in certain situations, making it susceptible to unauthorized access.
Product
PAN-OS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.paloaltonetworks.com security.paloaltonetworks.com
Feb 14, 2024 CWE-287: Improper Authentication vulnerability exists that could cause unauthorized tampering of device configuration over NFC communication.CVE-2024-0568 · Other software · Schneider Electric · reported by cybersecurity@se.comHigh 8.8
CWE-287: Improper Authentication vulnerability exists that could cause unauthorized tampering of device configuration over NFC communication.
Product
Harmony Control Relay RMNF22TB30
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record download.schneider-electric.com download.schneider-electric.com
Feb 14, 2024 CWE-798: Use of Hard-coded Credentials vulnerability exists that could cause unauthorized access to a project file protected with application password when opeCVE-2023-6409 · Other software · Schneider Electric · reported by cybersecurity@se.comHigh 7.7
CWE-798: Use of Hard-coded Credentials vulnerability exists that could cause unauthorized access to a project file protected with application password when opening the file with EcoStruxure Control Expert.
Product
EcoStruxure Control Expert
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record download.schneider-electric.com download.schneider-electric.com
Feb 14, 2024 CWE-522: Insufficiently Protected Credentials vulnerability exists that could cause unauthorized access to the project file in EcoStruxure Control Expert when CVE-2023-27975 · Other software · Schneider Electric · reported by cybersecurity@se.comHigh 7.1
CWE-522: Insufficiently Protected Credentials vulnerability exists that could cause unauthorized access to the project file in EcoStruxure Control Expert when a local user tampers with the memory of the engineering workstation.
Product
EcoStruxure Control Expert
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record download.schneider-electric.com download.schneider-electric.com
Feb 14, 2024IBM Jazz for Service Management 1.1.3.20 could allow an unauthorized user to obtain sensitive file information using forced browsing due to improper access contCVE-2023-46186 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM Jazz for Service Management 1.1.3.20 could allow an unauthorized user to obtain sensitive file information using forced browsing due to improper access controls. IBM X-Force ID: 269929.
Product
Jazz for Service Management
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com
Feb 14, 2024Improper access control in some Intel(R) SUR software before version 2.4.10587 may allow an unauthenticated user to potentially enable denial of service via adjCVE-2023-39941 · Other software · Intel · reported by secure@intel.comHigh 7.1
Improper access control in some Intel(R) SUR software before version 2.4.10587 may allow an unauthenticated user to potentially enable denial of service via adjacent access.
Product
System Usage Report For Gameplay
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record intel.com intel.com
Feb 14, 2024Improper initialization for the Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.240 may allow an unauthenticated user to potenCVE-2023-35061 · Other software · reported by secure@intel.comLow 2.3
Improper initialization for the Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.240 may allow an unauthenticated user to potentially enable information disclosure via adjacent access.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record intel.com intel.com
Feb 14, 2024Improper input validation for some Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.240 may allow an unauthenticated user to poCVE-2023-34983 · Other software · Intel · reported by secure@intel.comMedium 4.3
Improper input validation for some Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.240 may allow an unauthenticated user to potentially enable denial of service via adjacent access.
Product
Killer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record intel.com intel.com
Feb 14, 2024Buffer underflow in some Intel(R) PCM software before version 202307 may allow an unauthenticated user to potentially enable denial of service via network accesCVE-2023-34351 · Other software · intel · reported by secure@intel.comHigh 7.5
Buffer underflow in some Intel(R) PCM software before version 202307 may allow an unauthenticated user to potentially enable denial of service via network access.
Product
pcm
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record intel.com intel.com
Feb 14, 2024Improper access control for some Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.240 may allow an unauthenticated user to poteCVE-2023-33875 · Other software · Intel · reported by secure@intel.comHigh 7.1
Improper access control for some Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.240 may allow an unauthenticated user to potentially enable denial of service via local access..
Product
Killer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record intel.com intel.com
Feb 14, 2024Improper validation of specified type of input for some Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.240 may allow an unautCVE-2023-32651 · Other software · Intel · reported by secure@intel.comMedium 4.3
Improper validation of specified type of input for some Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.240 may allow an unauthenticated user to potentially enable denial of service via adjacent access.
Product
Killer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record intel.com intel.com
Feb 14, 2024Protection mechanism failure for some Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.240 may allow an unauthenticated user toCVE-2023-32644 · Other software · Intel · reported by secure@intel.comMedium 4.3
Protection mechanism failure for some Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.240 may allow an unauthenticated user to potentially enable denial of service via adjacent access.
Product
Killer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record intel.com intel.com
Feb 14, 2024Insufficient adherence to expected conventions for some Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.240 may allow an unautCVE-2023-32642 · Other software · Intel · reported by secure@intel.comMedium 4.3
Insufficient adherence to expected conventions for some Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.240 may allow an unauthenticated user to potentially enable denial of service via adjacent access.
Product
Killer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record intel.com intel.com
Feb 14, 2024Insufficiently protected credentials in some Intel(R) Server Product OpenBMC firmware before versions egs-1.05 may allow an unauthenticated user to enable inforCVE-2023-32280 · Other software · intel · reported by secure@intel.comMedium 5.3
Insufficiently protected credentials in some Intel(R) Server Product OpenBMC firmware before versions egs-1.05 may allow an unauthenticated user to enable information disclosure via network access.
Product
eagle_stream
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record intel.com intel.com
Feb 14, 2024Improper initialization for some Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.240 may allow an unauthenticated user to poteCVE-2023-28720 · Other software · Intel · reported by secure@intel.comMedium 6.1
Improper initialization for some Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.240 may allow an unauthenticated user to potentially enable denial of service via adjacent access..
Product
Killer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record intel.com intel.com
Feb 14, 2024Improper input validation for some Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.240 may allow an unauthenticated user to poCVE-2023-28374 · Other software · Intel · reported by secure@intel.comMedium 6.1
Improper input validation for some Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.240 may allow an unauthenticated user to potentially enable denial of service via adjacent access.
Product
Killer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record intel.com intel.com
Feb 14, 2024Unchecked return value in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an unauthenticated user to potentially enable denialCVE-2023-26591 · Other software · Intel · reported by secure@intel.comLow 2
Unchecked return value in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an unauthenticated user to potentially enable denial of service via physical access.
Product
Thunderbolt DCH Driver
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record intel.com intel.com
Feb 14, 2024Uncaught exception for some Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.240 may allow an unauthenticated user to potentialCVE-2023-26586 · Other software · Intel · reported by secure@intel.comMedium 4.3
Uncaught exception for some Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.240 may allow an unauthenticated user to potentially enable denial of service via adjacent access.
Product
Killer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record intel.com intel.com
Feb 14, 2024Improper input validation in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an unauthenticated user to potentially enable infCVE-2023-24463 · Other software · Intel · reported by secure@intel.comMedium 4.3
Improper input validation in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an unauthenticated user to potentially enable information disclosure via adjacent access.
Product
Thunderbolt DCH Driver
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record intel.com intel.com
Feb 14, 2024Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier allows a network-adjacent unauthenticated attacker to execute an arbiCVE-2024-23789 · Other software · SHARP CORPORATION · reported by vultures@jpcert.or.jpHigh 8.8
Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier allows a network-adjacent unauthenticated attacker to execute an arbitrary OS command on the affected product.
Product
Energy Management Controller with Cloud Services
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jp.sharp jp.sharp
Feb 14, 2024Path traversal vulnerability in Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier allows a network-adjacent unauthenticCVE-2024-23787 · Other software · SHARP CORPORATION · reported by vultures@jpcert.or.jpMedium 6.5
Path traversal vulnerability in Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier allows a network-adjacent unauthenticated attacker to obtain an arbitrary file in the affected product.
Product
Energy Management Controller with Cloud Services
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jp.sharp jp.sharp
Feb 14, 2024Cross-site scripting vulnerability in Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier allows a network-adjacent unautCVE-2024-23786 · Other software · SHARP CORPORATION · reported by vultures@jpcert.or.jpCritical 9.3
Cross-site scripting vulnerability in Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier allows a network-adjacent unauthenticated attacker to execute an arbitrary script on the web browser of the user who is accessing the management page of the affected product.
Product
Energy Management Controller with Cloud Services
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jp.sharp jp.sharp
Feb 14, 2024Cross-site request forgery vulnerability in Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier allows a remote unauthentCVE-2024-23785 · Other software · SHARP CORPORATION · reported by vultures@jpcert.or.jpMedium 6.5
Cross-site request forgery vulnerability in Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier allows a remote unauthenticated attacker to change the product settings.
Product
Energy Management Controller with Cloud Services
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jp.sharp jp.sharp
Feb 13, 2024Improper input validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows may allow an unauthenticated user toCVE-2024-24691 · Other software · Zoom Video Communications, Inc. · reported by security@zoom.usCritical 9.6
Improper input validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access.
Product
Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zoom.com zoom.com
Feb 13, 2024A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an attacker to gain unauthorized read permission to files by deploying arCVE-2024-1082 · Other software · GitHub · reported by product-cna@github.comMedium 6.3
A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an attacker to gain unauthorized read permission to files by deploying arbitrary symbolic links to a GitHub Pages site with a specially crafted artifact tarball. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.12 and was fixed in versions 3.8.15, 3.9.10, 3.10.7, 3.11.5. This vulnerability was reported via the GitHub Bug Bounty program.
Product
Enterprise Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.github.com docs.github.com
Feb 13, 2024An unauthenticated attacker can send a ping request from one network to another through an error in the origin verification even though the ports are separated CVE-2024-24782 · Other software · HIMA · reported by info@cert.vde.comMedium 4.3
An unauthenticated attacker can send a ping request from one network to another through an error in the origin verification even though the ports are separated by VLAN.
Product
F30 03X YY (COM)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.vde.com cert.vde.com
Feb 13, 2024An unauthenticated remote attacker can use an uncontrolled resource consumption vulnerability to DoS the affected devices through excessive traffic on a single CVE-2024-24781 · Other software · HIMA · reported by info@cert.vde.comHigh 7.5
An unauthenticated remote attacker can use an uncontrolled resource consumption vulnerability to DoS the affected devices through excessive traffic on a single ethernet port.
Product
F30 03X YY (COM)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.vde.com cert.vde.com
Feb 12, 2024SAP NetWeaver AS Java (CAF - Guided Procedures) - version 7.50, allows an unauthenticated attacker to submit a malicious request with a crafted XML file over thCVE-2024-24743 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 8.6
SAP NetWeaver AS Java (CAF - Guided Procedures) - version 7.50, allows an unauthenticated attacker to submit a malicious request with a crafted XML file over the network, which when parsed will enable him to access sensitive files and data but not modify them. There are expansion limits in place so that availability is not affected.
Product
SAP NetWeaver AS Java (Guided Procedures)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record me.sap.com sap.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.