Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,628 results · page 24 of 73
Jan 9, 2025Custom DataBase Tables: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22539 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ka2 Custom DataBase Tables custom-database-tables allows Reflected XSS.This issue affects Custom DataBase Tables: from n/a through <= 2.1.34.
- Product
- Custom DataBase Tables
- Affected
- up to 2.1.34
- What to do
- Affects up to 2.1.34. Update Custom DataBase Tables to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 9, 2025WP Database Backup – Unlimited Database & Files Backup by Backup for WP: Sensitive Information ExposureCVE-2024-12330 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP Database Backup – Unlimited Database & Files Backup by Backup for WP plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.3 via publicly accessible back-up files. This makes it possible for unauthenticated attackers to extract sensitive data including all information stored in the database.
- Product
- WP Database Backup – Unlimited Database & Files Backup by Backup for WP
- Affected
- up to 7.3
- What to do
- Affects up to 7.3. Update WP Database Backup – Unlimited Database & Files Backup by Backup for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 8, 2025RedisTimeSeries is a time-series database (TSDB) module for Redis, by Redis.CVE-2024-51480 · Other software · RedisTimeSeries · reported by GitHubHigh 7
RedisTimeSeries is a time-series database (TSDB) module for Redis, by Redis. Executing one of these commands TS.QUERYINDEX, TS.MGET, TS.MRAGE, TS.MREVRANGE by an authenticated user, using specially crafted command arguments may cause an integer overflow, a subsequent heap overflow, and potentially lead to remote code execution. This vulnerability is fixed in 1.6.20, 1.8.15, 1.10.15, and 1.12.3.
- Product
- RedisTimeSeries
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025Contact Form 7 Database – CFDB7: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-22351 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in penguinarts Contact Form 7 Database – CFDB7 advanced-cf7-database allows SQL Injection.This issue affects Contact Form 7 Database – CFDB7: from n/a through <= 1.0.0.
- Product
- Contact Form 7 Database – CFDB7
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Contact Form 7 Database – CFDB7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 6, 2025Redis is an open source, in-memory database that persists on disk.CVE-2024-51741 · Other software · redis · reported by GitHubMedium 4.4
Redis is an open source, in-memory database that persists on disk. An authenticated with sufficient privileges may create a malformed ACL selector which, when accessed, triggers a server panic and subsequent denial of service. The problem is fixed in Redis 7.2.7 and 7.4.2.
- Product
- redis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2025Redis is an open source, in-memory database that persists on disk.CVE-2024-46981 · Other software · redis · reported by GitHubHigh 7
Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to manipulate the garbage collector and potentially lead to remote code execution. The problem is fixed in 7.4.2, 7.2.7, and 6.2.17. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.
- Product
- redis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 24, 2024Database Backup and check Tables Automated With Scheduler 2024: Directory TraversalCVE-2024-12850 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Database Backup and check Tables Automated With Scheduler 2024 plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.32 via the database_backup_ajax_download() function. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
- Product
- Database Backup and check Tables Automated With Scheduler 2024
- Affected
- up to 2.32
- What to do
- Affects up to 2.32. Update Database Backup and check Tables Automated With Scheduler 2024 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.svn.wordpress.orgplugins.trac.wordpress.org
Dec 18, 2024Use of a hard-coded password for a database administrator account created during Wapro ERP installation allows an attacker to retrieve embedded sensitive data sCVE-2024-4996 · Other software · Asseco Business Solutions S.A. · reported by cvd@cert.plCritical 9.3
Use of a hard-coded password for a database administrator account created during Wapro ERP installation allows an attacker to retrieve embedded sensitive data stored in the database. The password is same among all Wapro ERP installations. This issue affects Wapro ERP Desktop versions before 8.90.0.
- Product
- Wapro ERP Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024Nette Database through 3.2.4 allows SQL injection in certain situations involving an untrusted filter that is directly passed to the where method.CVE-2024-55586 · Other software · reported by MITRECritical 9.8
Nette Database through 3.2.4 allows SQL injection in certain situations involving an untrusted filter that is directly passed to the where method. NOTE: the vendor's position is that this is intended behavior.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2024Directus is a real-time API and App dashboard for managing SQL database content.CVE-2024-54151 · Other software · directus · reported by GitHubHigh 7.5
Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 11.0.0 and prior to version 11.3.0, when setting `WEBSOCKETS_GRAPHQL_AUTH` or `WEBSOCKETS_REST_AUTH` to "public", an unauthenticated user is able to do any of the supported operations (CRUD, subscriptions) with full admin privileges. This impacts any Directus instance that has either `WEBSOCKETS_GRAPHQL_AUTH` or `WEBSOCKETS_REST_AUTH` set to `public` allowing unauthenticated users to subscribe for changes on any collection or do REST CRUD operations on user defined collections ignoring permissions. Version 11.3.0 fixes the issue.
- Product
- directus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2024Database for CF7: Missing AuthorizationCVE-2023-49167 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in code4life Database for CF7 database-for-cf7 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Database for CF7: from n/a through <= 1.2.4.
- Product
- Database for CF7
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update Database for CF7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 6, 2024phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases.CVE-2024-54141 · Other software · thorsten · reported by GitHubHigh 8.6
phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Prior to 4.0.0, phpMyFAQ exposes the database (ie postgreSQL) server's credential when connection to DB fails. This vulnerability is fixed in 4.0.0.
- Product
- phpMyFAQ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2024Directus is a real-time API and App dashboard for managing SQL database content.CVE-2024-54128 · Other software · directus · reported by GitHubMedium 5.7
Directus is a real-time API and App dashboard for managing SQL database content. The Comment feature has implemented a filter to prevent users from adding restricted characters, such as HTML tags. However, this filter operates on the client-side, which can be bypassed, making the application vulnerable to HTML Injection. This vulerability is fixed in 10.13.4 and 11.2.0.
- Product
- directus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2024This vulnerability exists in the Tinxy mobile app due to storage of logged-in user information in plaintext on the device database.CVE-2024-12094 · Other software · Mogify Infotech · reported by vdisclose@cert-in.org.inMedium 5.4
This vulnerability exists in the Tinxy mobile app due to storage of logged-in user information in plaintext on the device database. An attacker with physical access to the rooted device could exploit this vulnerability by accessing its database leading to unauthorized access of user information such as username, email address and mobile number. Note: To exploit this vulnerability, the device must be rooted/jailbroken.
- Product
- Tinxy Android app
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2024In JetBrains YouTrack before 2024.3.51866 unauthenticated database backup download was possible via vulnerable query parameterCVE-2024-54153 · Other software · JetBrains · reported by cve@jetbrains.comLow 3.1
In JetBrains YouTrack before 2024.3.51866 unauthenticated database backup download was possible via vulnerable query parameter
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2024Vitess is a database clustering system for horizontal scaling of MySQL.CVE-2024-53257 · Other software · vitessio · reported by GitHubMedium 4.9
Vitess is a database clustering system for horizontal scaling of MySQL. The /debug/querylogz and /debug/env pages for vtgate and vttablet do not properly escape user input. The result is that queries executed by Vitess can write HTML into the monitoring page at will. These pages are rendered using text/template instead of rendering with a proper HTML templating engine. This vulnerability is fixed in 21.0.1, 20.0.4, and 19.0.8.
- Product
- vitess
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 28, 2024The uyuni-server-attestation systemd service needs a database_password environment variable.CVE-2024-22037 · Other software · SUSE · reported by meissner@suse.deMedium 5.7
The uyuni-server-attestation systemd service needs a database_password environment variable. This file has 640 permission, and cannot be shown users, but the environment is still exposed by systemd to non-privileged users.
- Product
- SUSE Manager Server 5.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 26, 2024When a URL is added to the map element, it is recorded in the database with sequential IDs.CVE-2024-22117 · Other software · Zabbix · reported by security@zabbix.comLow 2.2
When a URL is added to the map element, it is recorded in the database with sequential IDs. Upon adding a new URL, the system retrieves the last sysmapelementurlid value and increments it by one. However, an issue arises when a user manually changes the sysmapelementurlid value by adding sysmapelementurlid + 1. This action prevents others from adding URLs to the map element.
- Product
- Zabbix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 25, 2024BoidCMS is a free and open-source flat file CMS for building simple websites and blogs, developed using PHP and uses JSON as a database.CVE-2024-53255 · Other software · BoidCMS · reported by GitHubMedium 5.3
BoidCMS is a free and open-source flat file CMS for building simple websites and blogs, developed using PHP and uses JSON as a database. In affected versions a reflected Cross-site Scripting (XSS) vulnerability exists in the /admin?page=media endpoint in the file parameter, allowing an attacker to inject arbitrary JavaScript code. This code could be used to steal the user's session cookie, perform phishing attacks, or deface the website. This issue has been addressed in version 2.1.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- BoidCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024PostHog database_schema Server-Side Request Forgery Information Disclosure Vulnerability.CVE-2024-9710 · Other software · PostHog · reported by zdi-disclosures@trendmicro.comHigh 8.3
PostHog database_schema Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PostHog. Authentication is required to exploit this vulnerability. The specific flaw exists within the implementation of the database_schema method. The issue results from the lack of proper validation of a URI prior to accessing resources. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-25351.
- Product
- PostHog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comzerodayinitiative.com
Nov 17, 2024A script injection vulnerability was found in the Debezium database connector, where it does not properly sanitize some parameters.CVE-2023-1419 · Other software · Red Hat · reported by Red HatMedium 5.9
A script injection vulnerability was found in the Debezium database connector, where it does not properly sanitize some parameters. This flaw allows an attacker to send a malicious request to inject a parameter that may allow the viewing of unauthorized data.
- Product
- Red Hat build of Debezium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Nov 15, 2024External Database Based Actions: Authentication bypassCVE-2024-10311 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The External Database Based Actions plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 0.1. This is due to a missing capability check in the 'edba_admin_handle' function. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to update the plugin settings and log in as any existing user on the site, such as an administrator.
- Product
- External Database Based Actions
- Affected
- up to 0.1
- What to do
- Affects up to 0.1. Update External Database Based Actions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 14, 2024Incorrect control of environment variables in PostgreSQL PL/Perl allows an unprivileged database user to change sensitive process environment variables (e.g.CVE-2024-10979 · Other software · postgresql · reported by f86ef6dc-4d3a-42ad-8f28-e6d5547a5007High 8.8
Incorrect control of environment variables in PostgreSQL PL/Perl allows an unprivileged database user to change sensitive process environment variables (e.g. PATH). That often suffices to enable arbitrary code execution, even if the attacker lacks a database server operating system user. Versions before PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21 are affected.
- Product
- postgresql
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpostgresql.orggithub.com
Nov 12, 2024Azure Database for PostgreSQL Flexible Server Extension Elevation of Privilege VulnerabilityCVE-2024-49042 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.2
Azure Database for PostgreSQL Flexible Server Extension Elevation of Privilege Vulnerability
- Product
- Azure Database for PostgreSQL Flexible Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024Azure Database for PostgreSQL Flexible Server Extension Elevation of Privilege VulnerabilityCVE-2024-43613 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.2
Azure Database for PostgreSQL Flexible Server Extension Elevation of Privilege Vulnerability
- Product
- Azure Database for PostgreSQL Flexible Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2024CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy.CVE-2024-10082 · Other software · Ericsson · reported by 85b1779b-6ecd-4f52-bcc5-73eac4659dcfHigh 8.7
CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Authentication method confusion allows logging in as the built-in root user from an external service. The built-in root user up until 6.24.1 is generated in a weak manner, cannot be disabled, and has universal access.This vulnerability allows an attacker who can create an account on an enabled external authentication service, to log in as the root user, and access and control everything that can be controlled via the web interface. The attacker needs to acquire the username of the root user to be successful. This issue affects CodeChecker: through 6.24.1.
- Product
- CodeChecker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2024CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy.CVE-2024-10081 · Other software · Ericsson · reported by 85b1779b-6ecd-4f52-bcc5-73eac4659dcfCritical 10
CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Authentication bypass occurs when the API URL ends with Authentication. This bypass allows superuser access to all API endpoints other than Authentication. These endpoints include the ability to add, edit, and remove products, among others. All endpoints, apart from the /Authentication is affected by the vulnerability. This issue affects CodeChecker: through 6.24.1.
- Product
- CodeChecker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2024Waybox Enel X web management application could execute arbitrary requests on the internal database via /admin/dbstore.php.CVE-2023-29119 · Other software · Enel X · reported by cve@asrg.ioCritical 9.6
Waybox Enel X web management application could execute arbitrary requests on the internal database via /admin/dbstore.php.
- Product
- JuiceBox Pro 3.0 22kW Cellular
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport-emobility.enelx.com
Nov 5, 2024Waybox Enel X web management application could execute arbitrary requests on the internal database via /admin/versions.php.CVE-2023-29118 · Other software · Enel X · reported by cve@asrg.ioCritical 9.6
Waybox Enel X web management application could execute arbitrary requests on the internal database via /admin/versions.php.
- Product
- JuiceBox Pro 3.0 22kW Cellular
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport-emobility.enelx.com
Oct 28, 2024MPXJ is an open source library to read and write project plans from a variety of file formats and databases.CVE-2024-49771 · Other software · joniles · reported by GitHubMedium 5.3
MPXJ is an open source library to read and write project plans from a variety of file formats and databases. The patch for the historical vulnerability CVE-2020-35460 in MPXJ is incomplete as there is still a possibility that a malicious path could be constructed which would not be picked up by the original fix and allow files to be written to arbitrary locations. The issue is addressed in MPXJ version 13.5.1.
- Product
- mpxj
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2024Movie Database: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-43300 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bert Movie Database movie-database allows Stored XSS.This issue affects Movie Database: from n/a through <= 1.0.11.
- Product
- Movie Database
- Affected
- up to 1.0.11
- What to do
- Affects up to 1.0.11. Update Movie Database to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 16, 2024Migration, Backup, Staging – WPvivid: Sensitive information disclosure of a WordPress site's databaseCVE-2020-36835 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to sensitive information disclosure of a WordPress site's database due to missing capability checks on the wp_ajax_wpvivid_add_remote AJAX action that allows low-level authenticated attackers to send back-ups to a remote location of their choice for review. This affects versions up to, and including 0.9.35.
- Product
- Migration, Backup, Staging – WPvivid
- Affected
- up to 0.9.35
- What to do
- Affects up to 0.9.35. Update Migration, Backup, Staging – WPvivid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwebarxsecurity.com
Oct 15, 2024Vulnerability in the Java VM component of Oracle Database Server.CVE-2024-21251 · Other software · Oracle Corporation · reported by secalert_us@oracle.comLow 3.1
Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 19.3-19.24, 21.3-21.15 and 23.4-23.5. Difficult to exploit vulnerability allows low privileged attacker having Create Session, Create Procedure privilege with network access via Oracle Net to compromise Java VM. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java VM accessible data. CVSS 3.1 Base Score 3.1 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N).
- Product
- Oracle Database Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2024Vulnerability in the XML Database component of Oracle Database Server.CVE-2024-21242 · Other software · Oracle Corporation · reported by secalert_us@oracle.comLow 3.5
Vulnerability in the XML Database component of Oracle Database Server. Supported versions that are affected are 19.3-19.24, 21.3-21.15 and 23.4-23.5. Easily exploitable vulnerability allows low privileged attacker having Create Session privilege with network access via HTTP to compromise XML Database. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of XML Database. CVSS 3.1 Base Score 3.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L).
- Product
- Oracle Database Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2024Vulnerability in the Oracle Database Core component of Oracle Database Server.CVE-2024-21233 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 4.3
Vulnerability in the Oracle Database Core component of Oracle Database Server. Supported versions that are affected are 19.3-19.24, 21.3-21.15 and 23.4-23.5. Easily exploitable vulnerability allows low privileged attacker having Create Session privilege with network access via Oracle Net to compromise Oracle Database Core. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Database Core accessible data. CVSS 3.1 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N).
- Product
- Oracle Database Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2024Enterprise Cloud Database from Ragic does not properly validate the file type for uploads.CVE-2024-9985 · Other software · Ragic · reported by twcert@cert.org.twCritical 10
Enterprise Cloud Database from Ragic does not properly validate the file type for uploads. Attackers with regular privileges can upload a webshell and use it to execute arbitrary code on the remote server.
- Product
- Enterprise Cloud Database
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Oct 15, 2024Enterprise Cloud Database from Ragic does not authenticate access to specific functionality, allowing unauthenticated remote attackers to use this functionalityCVE-2024-9984 · Other software · Ragic · reported by twcert@cert.org.twCritical 9.8
Enterprise Cloud Database from Ragic does not authenticate access to specific functionality, allowing unauthenticated remote attackers to use this functionality to obtain any user's session cookie.
- Product
- Enterprise Cloud Database
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Oct 15, 2024Enterprise Cloud Database from Ragic does not properly validate a specific page parameter, allowing unauthenticated remote attackers to exploit this vulnerabiliCVE-2024-9983 · Other software · Ragic · reported by twcert@cert.org.twHigh 7.5
Enterprise Cloud Database from Ragic does not properly validate a specific page parameter, allowing unauthenticated remote attackers to exploit this vulnerability to read arbitrary system files.
- Product
- Enterprise Cloud Database
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Oct 14, 2024SpiceDB is an open source database for scalably storing and querying fine-grained authorization data.CVE-2024-48909 · Other software · authzed · reported by GitHubLow 2
SpiceDB is an open source database for scalably storing and querying fine-grained authorization data. Starting in version 1.35.0 and prior to version 1.37.1, clients that have enabled `LookupResources2` and have caveats in the evaluation path for their requests can return a permissionship of `CONDITIONAL` with context marked as missing, even then the context was supplied. LookupResources2 is the new default in SpiceDB 1.37.0 and has been opt-in since SpiceDB 1.35.0. The bug is patched as part of SpiceDB 1.37.1. As a workaround, disable LookupResources2 via the `--enable-experimental-lookup-resources` flag by setting it to `false`.
- Product
- spicedb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2024IncidentReporting is a MediaWiki extension for moving incident reports from wikitext to database tables.CVE-2024-47815 · Other software · miraheze · reported by GitHubMedium 6
IncidentReporting is a MediaWiki extension for moving incident reports from wikitext to database tables. There are a variety of Cross-site Scripting issues, though all of them require elevated permissions. Some are available to anyone who has the `editincidents` right, some are available to those who can edit interface messages (typically administrators and interface admins), and one is available to those who can edit LocalSettings.php. These issues have been addressed in commit `43896a4` and all users are advised to upgrade. Users unable to upgrade should prevent access to the Special:IncidentReports page.
- Product
- IncidentReporting
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2024Directus is a real-time API and App dashboard for managing SQL database content.CVE-2024-47822 · Other software · directus · reported by GitHubMedium 4.2
Directus is a real-time API and App dashboard for managing SQL database content. Access tokens from query strings are not redacted and are potentially exposed in system logs which may be persisted. The access token in `req.query` is not redacted when the `LOG_STYLE` is set to `raw`. If these logs are not properly sanitized or protected, an attacker with access to it can potentially gain administrative control, leading to unauthorized data access and manipulation. This impacts systems where the `LOG_STYLE` is set to `raw`. The `access_token` in the query could potentially be a long-lived static token. Users with impacted systems should rotate their static tokens if they were provided using query string. This vulnerability has been patched in release version 10.13.2 and subsequent releases as well. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- directus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2024Saltcorn is an extensible, open source, no-code database application builder.CVE-2024-47818 · Other software · saltcorn · reported by GitHubMedium 6.5
Saltcorn is an extensible, open source, no-code database application builder. A logged-in user with any role can delete arbitrary files on the filesystem by calling the `sync/clean_sync_dir` endpoint. The `dir_name` POST parameter is not validated/sanitized and is used to construct the `syncDir` that is deleted by calling `fs.rm`. This issue has been addressed in release version 1.0.0-beta16 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- saltcorn
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2024Redis is an open source, in-memory database that persists on disk.CVE-2024-31449 · Other software · redis · reported by GitHubHigh 7
Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to trigger a stack buffer overflow in the bit library, which may potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This problem has been fixed in Redis versions 6.2.16, 7.2.6, and 7.4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- redis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2024Redis is an open source, in-memory database that persists on disk.CVE-2024-31228 · Other software · redis · reported by GitHubMedium 5.5
Redis is an open source, in-memory database that persists on disk. Authenticated users can trigger a denial-of-service by using specially crafted, long string match patterns on supported commands such as `KEYS`, `SCAN`, `PSUBSCRIBE`, `FUNCTION LIST`, `COMMAND LIST` and ACL definitions. Matching of extremely long patterns may result in unbounded recursion, leading to stack overflow and process crash. This problem has been fixed in Redis versions 6.2.16, 7.2.6, and 7.4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- redis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2024Redis is an open source, in-memory database that persists on disk.CVE-2024-31227 · Other software · redis · reported by GitHubMedium 4.4
Redis is an open source, in-memory database that persists on disk. An authenticated with sufficient privileges may create a malformed ACL selector which, when accessed, triggers a server panic and subsequent denial of service. The problem exists in Redis 7 prior to versions 7.2.6 and 7.4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- redis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2024BlueCMS 1.6 suffers from Arbitrary File Deletion via the file_name parameter in an /admin/database.php?act=del request.CVE-2024-45894 · Other software · Bluecms Project · reported by MITREMedium 4.9
BlueCMS 1.6 suffers from Arbitrary File Deletion via the file_name parameter in an /admin/database.php?act=del request.
- Product
- Bluecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Oct 1, 2024Cleartext storage of passwords in Infinera TNMS (Transcend Network Management System) Server 19.10.3 allows attackers (with access to the database or exported cCVE-2024-25658 · Other software · Nokia · reported by MITREMedium 6.5
Cleartext storage of passwords in Infinera TNMS (Transcend Network Management System) Server 19.10.3 allows attackers (with access to the database or exported configuration files) to obtain SNMP users' usernames and passwords in cleartext.
- Product
- Transcend Network Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2024Alisonic Sibylla devices are vulnerable to SQL injection attacks, which could allow complete access to the database.CVE-2024-8630 · Other software · Alisonic · reported by ics-cert@hq.dhs.govCritical 9.3
Alisonic Sibylla devices are vulnerable to SQL injection attacks, which could allow complete access to the database.
- Product
- Sibylla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2024spicedb is an Open Source, Google Zanzibar-inspired permissions database to enable fine-grained authorization for customer applications.CVE-2024-46989 · Other software · authzed · reported by GitHubLow 3.7
spicedb is an Open Source, Google Zanzibar-inspired permissions database to enable fine-grained authorization for customer applications. Multiple caveats over the same indirect subject type on the same relation can result in no permission being returned when permission is expected. If the resource has multiple groups, and each group is caveated, it is possible for the returned permission to be "no permission" when permission is expected. Permission is returned as NO_PERMISSION when PERMISSION is expected on the CheckPermission API. This issue has been addressed in release version 1.35.3. Users are advised to upgrade. Users unable to upgrade should not use caveats or avoid the use of caveats on an indirect subject type with multiple entries.
- Product
- spicedb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2024Directus is a real-time API and App dashboard for managing SQL database content.CVE-2024-46990 · Other software · directus · reported by GitHubMedium 5
Directus is a real-time API and App dashboard for managing SQL database content. When relying on blocking access to localhost using the default `0.0.0.0` filter a user may bypass this block by using other registered loopback devices (like `127.0.0.2` - `127.127.127.127`). This issue has been addressed in release versions 10.13.3 and 11.1.0. Users are advised to upgrade. Users unable to upgrade may block this bypass by manually adding the `127.0.0.0/8` CIDR range which will block access to any `127.X.X.X` ip instead of just `127.0.0.1`.
- Product
- directus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.