Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
38,726 results · page 286 of 775
Dec 16, 2024LaunchPage.app Importer: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55977 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BinaryCarpenter LaunchPage.app Importer launchpage-app-importer allows SQL Injection.This issue affects LaunchPage.app Importer: from n/a through <= 1.1.
- Product
- LaunchPage.app Importer
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update LaunchPage.app Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Critical Site Intel: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55976 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mikeleembruggen Critical Site Intel critical-site-intel-stats allows SQL Injection.This issue affects Critical Site Intel: from n/a through <= 1.0.
- Product
- Critical Site Intel
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Critical Site Intel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024eTemplates: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55972 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in chriscarvache eTemplates etemplates allows SQL Injection.This issue affects eTemplates: from n/a through <= 0.2.1.
- Product
- eTemplates
- Affected
- up to 0.2.1
- What to do
- Affects up to 0.2.1. Update eTemplates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Insertify: Cross-Site Request Forgery (CSRF)CVE-2024-54372 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Cross-Site Request Forgery (CSRF) vulnerability in Sourov Amin Insertify insertify allows Code Injection.This issue affects Insertify: from n/a through <= 1.1.4.
- Product
- Insertify
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update Insertify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Video & Photo Gallery for Ultimate Member: Unrestricted Upload of File with Dangerous TypeCVE-2024-54370 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in SuitePlugins Video & Photo Gallery for Ultimate Member gallery-for-ultimate-member allows Upload a Web Shell to a Web Server.This issue affects Video & Photo Gallery for Ultimate Member: from n/a through <= 1.1.0.
- Product
- Video & Photo Gallery for Ultimate Member
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Video & Photo Gallery for Ultimate Member to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Zita Site Builder: Missing AuthorizationCVE-2024-54369 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Missing Authorization vulnerability in ThemeHunk Zita Site Builder ai-site-builder allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Zita Site Builder: from n/a through <= 1.0.2.
- Product
- Zita Site Builder
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Zita Site Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024GitSync: Cross-Site Request Forgery (CSRF)CVE-2024-54368 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Cross-Site Request Forgery (CSRF) vulnerability in rubengarzajr GitSync git-sync allows Code Injection.This issue affects GitSync: from n/a through <= 1.1.0.
- Product
- GitSync
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update GitSync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024ForumWP: Deserialization of Untrusted DataCVE-2024-54367 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Ultimate Member ForumWP forumwp allows Object Injection.This issue affects ForumWP: from n/a through <= 2.1.0.
- Product
- ForumWP
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update ForumWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Wp NssUser Register: Incorrect Privilege AssignmentCVE-2024-54363 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in saiful.total Wp NssUser Register wp-nssuser-register allows Privilege Escalation.This issue affects Wp NssUser Register: from n/a through <= 1.0.0.
- Product
- Wp NssUser Register
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Wp NssUser Register to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Instant Appointment: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-54361 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in tenteeglobal Instant Appointment instant-appointment allows SQL Injection.This issue affects Instant Appointment: from n/a through <= 1.2.
- Product
- Instant Appointment
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Instant Appointment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2501.0001), Opcenter Intelligence (All versions < V2501.0001), Opcenter QuCVE-2024-49775 · Other software · Siemens · reported by productcert@siemens.comCritical 9.3
A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2501.0001), Opcenter Intelligence (All versions < V2501.0001), Opcenter Quality (All versions < V2512), Opcenter RDnL (All versions < V2410), SIMATIC PCS neo V4.0 (All versions), SIMATIC PCS neo V4.1 (All versions < V4.1 Update 3), SIMATIC PCS neo V5.0 (All versions < V5.0 Update 1), SINEC NMS (All versions if operated in conjunction with UMC < V2.15), Totally Integrated Automation Portal (TIA Portal) V16 (All versions), Totally Integrated Automation Portal (TIA Portal) V17 (All versions), Totally Integrated Automation Portal (TIA Portal) V18 (All versions), Totally Integrated Automation Portal (TIA Portal) V19 (All versions). Affected products contain a heap-based buffer overflow vulnerability in the integrated UMC component. This could allow an unauthenticated remote attacker to execute arbitrary code.
- Product
- Opcenter Execution Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.com
Dec 16, 2024TenderDocTransfer from Chunghwa Telecom has a Reflected Cross-site scripting vulnerability.CVE-2024-12641 · Other software · Chunghwa Telecom · reported by twcert@cert.org.twCritical 9.6
TenderDocTransfer from Chunghwa Telecom has a Reflected Cross-site scripting vulnerability. The application sets up a simple local web server and provides APIs for communication with the target website. Due to the lack of CSRF protection for the APIs, unauthenticated remote attackers could use specific APIs through phishing to execute arbitrary JavaScript code in the user’s browser. Since the web server set by the application supports Node.Js features, attackers can further leverage this to run OS commands.
- Product
- TenderDocTransfer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Dec 14, 2024DocIO in Syncfusion Essential Studio for ASP.NET MVC before 27.1.55 throws XMLException during the resaving of a DOCX document with an external reference XML, aCVE-2024-55969 · Other software · reported by MITRECritical 9.1
DocIO in Syncfusion Essential Studio for ASP.NET MVC before 27.1.55 throws XMLException during the resaving of a DOCX document with an external reference XML, aka I640714.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2024In Menlo On-Premise Appliance before 2.88, web policy may not be consistently applied properly to intentionally malformed client requests.CVE-2023-29476 · Other software · reported by MITRECritical 9.1
In Menlo On-Premise Appliance before 2.88, web policy may not be consistently applied properly to intentionally malformed client requests. This is fixed in 2.88.2+, 2.89.1+, and 2.90.1+.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2024Cleo Multiple Products Unauthenticated File Upload VulnerabilityCVE-2024-55956 · Other software · Cleo · reported by MITREExploitedRansomwareCritical 9.8
Cleo Harmony, VLTrader, and LexiCom, which are managed file transfer products, contain an unrestricted file upload vulnerability that could allow an unauthenticated user to import and execute arbitrary bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory.
- Product
- Multiple Products
- On CISA’s list since
- Dec 17, 2024 (federal fix deadline Jan 7, 2025)
- What to do
- Attackers are using this now. Install Cleo’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogsupport.cleo.comsupport.cleo.com
Dec 13, 2024vBSSO-lite: Authentication Bypass Using an Alternate Path or ChannelCVE-2024-54297 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in extremeidea vBSSO-lite vbsso-lite allows Authentication Bypass.This issue affects vBSSO-lite: from n/a through <= 1.4.3.
- Product
- vBSSO-lite
- Affected
- up to 1.4.3
- What to do
- Affects up to 1.4.3. Update vBSSO-lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024CoSchool LMS: Authentication Bypass Using an Alternate Path or ChannelCVE-2024-54296 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in Codexpert, Inc CoSchool LMS coschool allows Authentication Bypass.This issue affects CoSchool LMS: from n/a through <= 1.4.3.
- Product
- CoSchool LMS
- Affected
- up to 1.4.3
- What to do
- Affects up to 1.4.3. Update CoSchool LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024ListApp Mobile Manager: Authentication Bypass Using an Alternate Path or ChannelCVE-2024-54295 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in FluxBuilder ListApp Mobile Manager listapp-mobile-manager allows Authentication Bypass.This issue affects ListApp Mobile Manager: from n/a through <= 1.7.7.
- Product
- ListApp Mobile Manager
- Affected
- up to 1.7.7
- What to do
- Affects up to 1.7.7. Update ListApp Mobile Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Firebase OTP Authentication: Authentication Bypass Using an Alternate Path or ChannelCVE-2024-54294 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in Appgenix Infotech Firebase OTP Authentication authentication-via-otp-using-firebase allows Authentication Bypass.This issue affects Firebase OTP Authentication: from n/a through <= 1.0.1.
- Product
- Firebase OTP Authentication
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Firebase OTP Authentication to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024CE21 Suite: Incorrect Privilege AssignmentCVE-2024-54293 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in CE21 CE21 Suite ce21-suite allows Privilege Escalation.This issue affects CE21 Suite: from n/a through <= 2.2.0.
- Product
- CE21 Suite
- Affected
- up to 2.2.0
- What to do
- Affects up to 2.2.0. Update CE21 Suite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Appsplate: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-54292 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in appsplate Appsplate appsplate allows SQL Injection.This issue affects Appsplate: from n/a through <= 2.1.3.
- Product
- Appsplate
- Affected
- up to 2.1.3
- What to do
- Affects up to 2.1.3. Update Appsplate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Mail Picker: Deserialization of Untrusted DataCVE-2024-54273 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in PickPlugins Mail Picker mail-picker allows Object Injection.This issue affects Mail Picker: from n/a through <= 1.0.14.
- Product
- Mail Picker
- Affected
- up to 1.0.14
- What to do
- Affects up to 1.0.14. Update Mail Picker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Import Export For WooCommerce: Unrestricted Upload of File with Dangerous TypeCVE-2024-54262 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in sidngr Import Export For WooCommerce import-export-for-woocommerce allows Upload a Web Shell to a Web Server.This issue affects Import Export For WooCommerce: from n/a through <= 1.6.2.
- Product
- Import Export For WooCommerce
- Affected
- up to 1.6.2
- What to do
- Affects up to 1.6.2. Update Import Export For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024TAX SERVICE Electronic HDM: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-54261 · WordPress plugins & themes · reported by PatchstackCritical 10
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in HK Digital Agency LLC TAX SERVICE Electronic HDM virtual-hdm-for-taxservice-am allows SQL Injection.This issue affects TAX SERVICE Electronic HDM: from n/a through <= 1.2.2.
- Product
- TAX SERVICE Electronic HDM
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update TAX SERVICE Electronic HDM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Eyewear prescription form: Missing AuthorizationCVE-2024-54239 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Missing Authorization vulnerability in dugudlabs Eyewear prescription form eyewear-prescription-form allows Privilege Escalation.This issue affects Eyewear prescription form: from n/a through <= 4.0.18.
- Product
- Eyewear prescription form
- Affected
- up to 4.0.18
- What to do
- Affects up to 4.0.18. Update Eyewear prescription form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Limit Login Attempts: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-54234 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wp-buy Limit Login Attempts wp-limit-failed-login-attempts allows SQL Injection.This issue affects Limit Login Attempts: from n/a through <= 5.5.
- Product
- Limit Login Attempts
- Affected
- up to 5.5
- What to do
- Affects up to 5.5. Update Limit Login Attempts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024JS Help Desk – Best Help Desk & Support: Missing AuthorizationCVE-2022-46838 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Missing Authorization vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.7.1.
- Product
- JS Help Desk – Best Help Desk & Support
- Affected
- up to 2.7.1
- What to do
- Affects up to 2.7.1. Update JS Help Desk – Best Help Desk & Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Improper input handling in the 'Host Header' allows an unauthenticated attacker to store a payload in web application logs.CVE-2024-11986 · Other software · CrushFTP, LLC · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158Critical 9.6
Improper input handling in the 'Host Header' allows an unauthenticated attacker to store a payload in web application logs. When an Administrator views the logs using the application's standard functionality, it enables the execution of the payload, resulting in Stored XSS or 'Cross-Site Scripting'.
- Product
- CrushFTP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2024ComfyUI-Ace-Nodes is vulnerable to Code Injection.CVE-2024-21577 · Other software · hay86 · reported by report@snyk.ioCritical 10
ComfyUI-Ace-Nodes is vulnerable to Code Injection. The ACE_ExpressionEval node contains an eval() in its entrypoint function that accepts arbitrary user-controlled data. A user can create a workflow that results in executing arbitrary code on the server.
- Product
- ComfyUI-Ace-Nodes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2024ComfyUI-Bmad-Nodes is vulnerable to Code Injection.CVE-2024-21576 · Other software · bmad4ever · reported by report@snyk.ioCritical 10
ComfyUI-Bmad-Nodes is vulnerable to Code Injection. The issue stems from a validation bypass in the BuildColorRangeHSVAdvanced, FilterContour and FindContour custom nodes. In the entrypoint function to each node, there’s a call to eval which can be triggered by generating a workflow that injects a crafted string into the node. This can result in executing arbitrary code on the server.
- Product
- ComfyUI-Bmad-Nodes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2024Super Backup & Clone - Migrate for: Arbitrary file uploadsCVE-2024-9290 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Super Backup & Clone - Migrate for WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and a missing capability check on the ibk_restore_migrate_check() function in all versions up to, and including, 2.3.3. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- Super Backup & Clone - Migrate for
- Affected
- up to 2.3.3
- What to do
- Affects up to 2.3.3. Update Super Backup & Clone - Migrate for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Dec 13, 2024Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RTI Connext Professional (Queuing Service) allows SQL InjeCVE-2024-52057 · Other software · RTI · reported by 3f572a00-62e2-4423-959a-7ea25eff1638Critical 9.1
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RTI Connext Professional (Queuing Service) allows SQL Injection.This issue affects Connext Professional: from 7.0.0 before 7.3.0, from 6.1.0 before 6.1.2.17, from 6.0.0 before 6.0.*, from 5.2.0 before 5.3.*.
- Product
- Connext Professional
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2024A logic vulnerability in the the mobile application (com.transsion.applock) can lead to bypassing the application password.CVE-2024-12603 · Other software · TECNO · reported by 907edf6c-bf03-423e-ab1a-8da27e1aa1eaCritical 9.8
A logic vulnerability in the the mobile application (com.transsion.applock) can lead to bypassing the application password.
- Product
- com.transsion.applock
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.tecno.comsecurity.tecno.com
Dec 12, 2024XWiki Platform is a generic wiki platform.CVE-2024-55879 · Other software · xwiki · reported by GitHubCritical 9.1
XWiki Platform is a generic wiki platform. Starting in version 2.3 and prior to versions 15.10.9, 16.3.0, any user with script rights can perform arbitrary remote code execution by adding instances of `XWiki.ConfigurableClass` to any page. This compromises the confidentiality, integrity and availability of the whole XWiki installation. This has been patched in XWiki 15.10.9 and 16.3.0. No known workarounds are available except upgrading.
- Product
- xwiki-platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2024XWiki Platform is a generic wiki platform.CVE-2024-55877 · Other software · xwiki · reported by GitHubCritical 9.9
XWiki Platform is a generic wiki platform. Starting in version 9.7-rc-1 and prior to versions 15.10.11, 16.4.1, and 16.5.0, any user with an account can perform arbitrary remote code execution by adding instances of `XWiki.WikiMacroClass` to any page. This compromises the confidentiality, integrity and availability of the whole XWiki installation. This vulnerability has been fixed in XWiki 15.10.11, 16.4.1 and 16.5.0. It is possible to manually apply the patch to the page `XWiki.XWikiSyntaxMacrosList` as a workaround.
- Product
- xwiki-platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2024http4k is a functional toolkit for Kotlin HTTP applications.CVE-2024-55875 · Other software · http4k · reported by GitHubCritical 9.8
http4k is a functional toolkit for Kotlin HTTP applications. Prior to version 6.50.0.0, there is a potential XXE (XML External Entity Injection) vulnerability when http4k handling malicious XML contents within requests, which might allow attackers to read local sensitive information on server, trigger Server-side Request Forgery and even execute code under some circumstances. The original fix shipped in v5.41.0.0 / v4.50.0.0 closed the documented external-entity attack class (SSRF, local-file disclosure, code execution) by setting `ACCESS_EXTERNAL_DTD=""`, `ACCESS_EXTERNAL_SCHEMA=""`, and `isExpandEntityReferences=false` on the default `DocumentBuilderFactory`. A residual gap remained: the parser still accepted documents containing `<!DOCTYPE>` declarations even though external entity resolution was blocked. This left open billion-laughs-style internal entity expansion DoS attacks against any application using `Body.xml()` or `Document.asXmlDocument()` on untrusted XML. v6.50.0.0 closes this residual by adding `disallow-doctype-decl=true` and `FEATURE_SECURE_PROCESSING=true` to `defaultXmlParsingConfig`. Any document containing a `<!DOCTYPE>` is now rejected at parse time.
- Product
- http4k
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2024Deserialization of untrusted data in Microsoft Update Catalog allows an unauthorized attacker to elevate privileges on the website’s webserver.CVE-2024-49147 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.3
Deserialization of untrusted data in Microsoft Update Catalog allows an unauthorized attacker to elevate privileges on the website’s webserver.
- Product
- Microsoft Update Catalog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2024XWiki Platform is a generic wiki platform.CVE-2024-55662 · Other software · xwiki · reported by GitHubCritical 9.9
XWiki Platform is a generic wiki platform. Starting in version 3.3-milestone-1 and prior to versions 15.10.9 and 16.3.0, on instances where `Extension Repository Application` is installed, any user can execute any code requiring `programming` rights on the server. This vulnerability has been fixed in XWiki 15.10.9 and 16.3.0. Since `Extension Repository Application` is not mandatory, it can be safely disabled on instances that do not use it as a workaround. It is also possible to manually apply the patches from commit 8659f17d500522bf33595e402391592a35a162e8 to the page `ExtensionCode.ExtensionSheet` and to the page `ExtensionCode.ExtensionAuthorsDisplayer`.
- Product
- xwiki-platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2024ComfyUI-Impact-Pack is vulnerable to Path Traversal.CVE-2024-21575 · Other software · ltdrdata · reported by report@snyk.ioCritical 9.2
ComfyUI-Impact-Pack is vulnerable to Path Traversal. The issue stems from missing validation of the `image.filename` field in a POST request sent to the `/upload/temp` endpoint added by the extension to the server. This results in writing arbitrary files to the file system which may, under some conditions, result in remote code execution (RCE).
- Product
- ComfyUI-Impact-Pack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2024The issue stems from a missing validation of the pip field in a POST request sent to the /customnode/install endpoint used to install custom nodes which is addeCVE-2024-21574 · Other software · ltdrdata · reported by report@snyk.ioCritical 10
The issue stems from a missing validation of the pip field in a POST request sent to the /customnode/install endpoint used to install custom nodes which is added to the server by the extension. This allows an attacker to craft a request that triggers a pip install on a user controlled package or URL, resulting in remote code execution (RCE) on the server.
- Product
- ComfyUI-Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2024Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce: Unauthorized arbitrary plugin installation and activationCVE-2024-10124 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation and activation due to a missing capability check on the tp_install() function in all versions up to, and including, 1.1.1. This makes it possible for unauthenticated attackers to install and activate arbitrary plugins which can be leveraged to achieve remote code execution if another vulnerable plugin is installed and activated. This vulnerability was partially patched in version 1.1.1.
- Product
- Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 11, 2024Sign In With Google: Authentication bypassCVE-2024-11015 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Sign In With Google plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.8.0. This is due to the 'authenticate_user' user function not implementing sufficient null value checks when setting the access token and user information. This makes it possible for unauthenticated attackers to log in as the first user who has signed in using Google OAuth, which could be the site administrator.
- Product
- Sign In With Google
- Affected
- up to 1.8.0
- What to do
- Affects up to 1.8.0. Update Sign In With Google to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 11, 2024The issue was addressed with improved memory handling.CVE-2024-54534 · Computers, phones & browsers · Apple · reported by product-security@apple.comCritical 9.8
The issue was addressed with improved memory handling. This issue is fixed in Safari 18.2, iOS 18.2 and iPadOS 18.2, iPadOS 17.7.6, macOS Sequoia 15.2, tvOS 18.2, visionOS 2.2, watchOS 11.2. Processing maliciously crafted web content may lead to memory corruption.
- Product
- Safari
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Dec 11, 2024An out-of-bounds access issue was addressed with improved bounds checking.CVE-2024-54506 · Computers, phones & browsers · Apple · reported by product-security@apple.comCritical 9.8
An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.2. An attacker may be able to cause unexpected system termination or arbitrary code execution in DCP firmware.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comseclists.org
Dec 11, 2024A logic issue was addressed with improved state management.CVE-2024-54465 · Computers, phones & browsers · Apple · reported by product-security@apple.comCritical 9.8
A logic issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.2. An app may be able to elevate privileges.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comseclists.org
Dec 11, 2024The issue was addressed with improved bounds checks.CVE-2024-44299 · Computers, phones & browsers · Apple · reported by product-security@apple.comCritical 9.8
The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1. An attacker may be able to cause unexpected system termination or arbitrary code execution in DCP firmware.
- Product
- iOS and iPadOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Dec 11, 2024The issue was addressed with improved bounds checks.CVE-2024-44242 · Computers, phones & browsers · Apple · reported by product-security@apple.comCritical 9.8
The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1. An attacker may be able to cause unexpected system termination or arbitrary code execution in DCP firmware.
- Product
- iOS and iPadOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Dec 11, 2024The issue was addressed with improved bounds checks.CVE-2024-44241 · Computers, phones & browsers · Apple · reported by product-security@apple.comCritical 9.8
The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1. An attacker may be able to cause unexpected system termination or arbitrary code execution in DCP firmware.
- Product
- iOS and iPadOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Dec 11, 2024In the Mullvad VPN client 2024.6 (Desktop), 2024.8 (iOS), and 2024.8-beta1 (Android), the exception-handling alternate stack can be exhausted, leading to heap-bCVE-2024-55884 · Other software · reported by MITRECritical 9
In the Mullvad VPN client 2024.6 (Desktop), 2024.8 (iOS), and 2024.8-beta1 (Android), the exception-handling alternate stack can be exhausted, leading to heap-based out-of-bounds writes in enable() in exception_logging/unix.rs, aka MLLVD-CR-24-01. NOTE: achieving code execution is considered non-trivial.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnews.ycombinator.com
Dec 11, 2024GLPI is a free asset and IT management software package.CVE-2024-50339 · Other software · glpi-project · reported by GitHubCritical 9.3
GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.17, an unauthenticated user can retrieve all the sessions IDs and use them to steal any valid session. Version 10.0.17 contains a patch for this issue.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.