Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
38,829 results · page 292 of 777
Nov 28, 2024Pathomation: Unrestricted Upload of File with Dangerous TypeCVE-2024-52490 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in pathomation Pathomation pathomation allows Upload a Web Shell to a Web Server.This issue affects Pathomation: from n/a through <= 2.5.1.
- Product
- Pathomation
- Affected
- up to 2.5.1
- What to do
- Affects up to 2.5.1. Update Pathomation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 28, 2024Wawp: Authentication Bypass Using an Alternate Path or ChannelCVE-2024-52475 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in Information Technology Wawp automation-web-platform allows Authentication Bypass.This issue affects Wawp: from n/a through < 3.0.18.
- Product
- Wawp
- What to do
- Update Wawp to the newest version.
Nov 28, 2024Express Payments Module: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-52474 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Сервис “Экспресс Платежи” Express Payments Module express-pay allows Blind SQL Injection.This issue affects Express Payments Module: from n/a through <= 1.1.8.
- Product
- Express Payments Module
- Affected
- up to 1.1.8
- What to do
- Affects up to 1.1.8. Update Express Payments Module to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 28, 2024Widget Options – The #1 WordPress Widget & Block Control: Remote Code ExecutionCVE-2024-8672 · WordPress plugins & themes · reported by WordfenceCritical 9.9
The Widget Options – The #1 WordPress Widget & Block Control Plugin plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.0.7 via the display logic functionality that extends several page builders. This is due to the plugin allowing users to supply input that will be passed through eval() without any filtering or capability checks. This makes it possible for authenticated attackers, with contributor-level access and above, to execute code on the server. Special note: We suggested the vendor implement an allowlist of functions and limit the ability to execute commands to just administrators, however, they did not take our advice. We are considering this patched, however, we believe it could still be further hardened and there may be residual risk with how the issue is currently patched.
- Product
- Widget Options – The #1 WordPress Widget & Block Control
- Affected
- up to 4.0.7
- What to do
- Affects up to 4.0.7. Update Widget Options – The #1 WordPress Widget & Block Control to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 28, 2024Contest Gallery: Privilege escalationCVE-2024-11103 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Contest Gallery plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 24.0.7. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.
- Product
- Contest Gallery
- Affected
- up to 24.0.7
- What to do
- Affects up to 24.0.7. Update Contest Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 28, 2024Tumult Hype Animations: Arbitrary file uploadsCVE-2024-11082 · WordPress plugins & themes · reported by WordfenceCritical 9.9
The Tumult Hype Animations plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the hypeanimations_panel() function in all versions up to, and including, 1.9.15. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- Tumult Hype Animations
- Affected
- up to 1.9.15
- What to do
- Affects up to 1.9.15. Update Tumult Hype Animations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Nov 28, 2024JobSearch WP Job Board: Privilege escalationCVE-2024-11925 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The JobSearch WP Job Board plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.6.7. This is due to the plugin not properly verifying a users identity when verifying an email address through the user_account_activation function. This makes it possible for unauthenticated attackers to log in as any user, including site administrators if the users email is known.
- Product
- JobSearch WP Job Board
- Affected
- up to 2.6.7
- What to do
- Affects up to 2.6.7. Update JobSearch WP Job Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Nov 27, 2024Insufficient data validation in Mojo in Google Chrome prior to 129.0.6668.89 allowed a remote attacker who had compromised the renderer process to perform an ouCVE-2024-9369 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comCritical 9.6
Insufficient data validation in Mojo in Google Chrome prior to 129.0.6668.89 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Nov 27, 2024OpenVidReview 1.0 is vulnerable to Incorrect Access Control.CVE-2024-46054 · Other software · openvidreview_project · reported by MITRECritical 9.8
OpenVidReview 1.0 is vulnerable to Incorrect Access Control. The /upload route is accessible without authentication, allowing any user to upload files.
- Product
- openvidreview
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 27, 2024The HttpRequest object allows to get the HTTP headers from the server's response after sending the request.CVE-2024-42330 · Other software · Zabbix · reported by security@zabbix.comCritical 9.1
The HttpRequest object allows to get the HTTP headers from the server's response after sending the request. The problem is that the returned strings are created directly from the data returned by the server and are not correctly encoded for JavaScript. This allows to create internal strings that can be used to access hidden properties of objects.
- Product
- Zabbix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.zabbix.comlists.debian.org
Nov 27, 2024A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerability.CVE-2024-42327 · Other software · Zabbix · reported by security@zabbix.comCritical 9.9
A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerability. An SQLi exists in the CUser class in the addRelatedObjects function, this function is being called from the CUser.get function which is available for every user who has API access.
- Product
- Zabbix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 27, 2024A Improper Control of Generation of Code ('Code Injection') vulnerability in plugin management in iota C.ai Conversational Platform from 1.0.0 through 2.1.3 allCVE-2024-52959 · Other software · Galaxy Software Services Corporation · reported by ART@zuso.aiCritical 9.3
A Improper Control of Generation of Code ('Code Injection') vulnerability in plugin management in iota C.ai Conversational Platform from 1.0.0 through 2.1.3 allows remote authenticated users to perform arbitrary system commands via a DLL file.
- Product
- iota C.ai Conversational Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 27, 2024A improper verification of cryptographic signature vulnerability in plugin management in iota C.ai Conversational Platform from 1.0.0 through 2.1.3 allows remotCVE-2024-52958 · Other software · Galaxy Software Services Corporation · reported by ART@zuso.aiCritical 9.3
A improper verification of cryptographic signature vulnerability in plugin management in iota C.ai Conversational Platform from 1.0.0 through 2.1.3 allows remote authenticated users to load a malicious DLL via upload plugin function.
- Product
- iota C.ai Conversational Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 26, 2024A directory traversal vulnerability in Hewlett Packard Enterprise Insight Remote Support may allow remote code execution.CVE-2024-53676 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.8
A directory traversal vulnerability in Hewlett Packard Enterprise Insight Remote Support may allow remote code execution.
- Product
- HPE Insight Remote Support
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hpe.comgithub.com
Nov 26, 2024qiwen-file v1.4.0 was discovered to contain a SQL injection vulnerability via the component /mapper/NoticeMapper.xml.CVE-2024-50942 · Other software · qiwenshare · reported by MITRECritical 9.8
qiwen-file v1.4.0 was discovered to contain a SQL injection vulnerability via the component /mapper/NoticeMapper.xml.
- Product
- qiwen-file
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comqiwenshare.com
Nov 26, 2024Improper neutralization of input during web page generation ('Cross-site Scripting') in Copilot Studio by an unauthorized attacker leads to elevation of privileCVE-2024-49038 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.3
Improper neutralization of input during web page generation ('Cross-site Scripting') in Copilot Studio by an unauthorized attacker leads to elevation of privilege over a network.
- Product
- Microsoft Copilot Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 26, 2024Valor Apps Easy Folder Listing Pro has a deserialization vulnerability that allows an unauthenticated, remote attacker to execute arbitrary code with the privilCVE-2024-11145 · Other software · Valor Apps · reported by 9119a7d8-5eab-497f-8521-727c672e3725Critical 9.3
Valor Apps Easy Folder Listing Pro has a deserialization vulnerability that allows an unauthenticated, remote attacker to execute arbitrary code with the privileges of the Joomla! application. Fixed in versions 3.8 and 4.5.
- Product
- Easy Folder Listing Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvalorapps.com
Nov 26, 2024Insufficiently Protected Credentials vulnerability in OpenText™ AccuRev allows Authentication Bypass.CVE-2019-17082 · Other software · OpenText™ · reported by security@opentext.comCritical 9
Insufficiently Protected Credentials vulnerability in OpenText™ AccuRev allows Authentication Bypass. When installed on a Linux or Solaris system the vulnerability could allow anyone who knows a valid AccuRev username can use the AccuRev client to login and gain access to AccuRev source control without knowing the user’s password. This issue affects AccuRev: 2017.1.
- Product
- AccuRev
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.microfocus.com
Nov 26, 2024`NSC_DeriveKey` inadvertently assumed that the `phKey` parameter is always non-NULL.CVE-2024-11705 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.1
`NSC_DeriveKey` inadvertently assumed that the `phKey` parameter is always non-NULL. When it was passed as NULL, a segmentation fault (SEGV) occurred, leading to crashes. This behavior conflicted with the PKCS#11 v3.0 specification, which allows `phKey` to be NULL for certain mechanisms. This vulnerability affects Firefox < 133 and Thunderbird < 133.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Nov 26, 2024A double-free issue could have occurred in `sec_pkcs7_decoder_start_decrypt()` when handling an error path.CVE-2024-11704 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.8
A double-free issue could have occurred in `sec_pkcs7_decoder_start_decrypt()` when handling an error path. Under specific conditions, the same symmetric key could have been freed twice, potentially leading to memory corruption. This vulnerability affects Firefox < 133, Thunderbird < 133, Firefox ESR < 128.7, and Thunderbird < 128.7.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Nov 26, 2024A flaw in handling fullscreen transitions may have inadvertently caused the application to become stuck in fullscreen mode when a modal dialog was opened duringCVE-2024-11698 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.8
A flaw in handling fullscreen transitions may have inadvertently caused the application to become stuck in fullscreen mode when a modal dialog was opened during the transition. This issue left users unable to exit fullscreen mode using standard actions like pressing "Esc" or accessing right-click menus, resulting in a disrupted browsing experience until the browser is restarted. *This bug only affects the application when running on macOS. Other operating systems are unaffected.* This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Thunderbird < 133, and Thunderbird < 128.5.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Nov 26, 2024The executable file warning was not presented when downloading .library-ms files.CVE-2024-11693 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.8
The executable file warning was not presented when downloading .library-ms files. *Note: This issue only affected Windows operating systems. Other operating systems are unaffected.* This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Thunderbird < 133, and Thunderbird < 128.5.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Nov 26, 2024A CWE-306 "Missing Authentication for Critical Function" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6.3), EKICVE-2024-50375 · Other software · Advantech · reported by prodsec@nozominetworks.comCritical 9.8
A CWE-306 "Missing Authentication for Critical Function" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6.3), EKI-6333AC-2GD (<= v1.6.3) and EKI-6333AC-1GPO (<= v1.2.1). The vulnerability can be exploited by remote unauthenticated users capable of interacting with the default "edgserver" service enabled on the access point.
- Product
- EKI-6333AC-2G
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 26, 2024A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactureCVE-2024-50374 · Other software · Advantech · reported by prodsec@nozominetworks.comCritical 9.8
A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6.3), EKI-6333AC-2GD (<= v1.6.3) and EKI-6333AC-1GPO (<= v1.2.1). The vulnerability can be exploited by remote unauthenticated users capable of interacting with the default "edgserver" service enabled on the access point and malicious commands are executed with root privileges. No authentication is enabled on the service and the source of the vulnerability resides in processing code associated to the "capture_packages" operation.
- Product
- EKI-6333AC-2G
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 26, 2024A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactureCVE-2024-50373 · Other software · Advantech · reported by prodsec@nozominetworks.comCritical 9.8
A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6.3), EKI-6333AC-2GD (<= v1.6.3) and EKI-6333AC-1GPO (<= v1.2.1). The vulnerability can be exploited by remote unauthenticated users capable of interacting with the default "edgserver" service enabled on the access point and malicious commands are executed with root privileges. No authentication is enabled on the service and the source of the vulnerability resides in processing code associated to the "restore_config_from_utility" operation.
- Product
- EKI-6333AC-2G
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 26, 2024A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactureCVE-2024-50372 · Other software · Advantech · reported by prodsec@nozominetworks.comCritical 9.8
A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6.3), EKI-6333AC-2GD (<= v1.6.3) and EKI-6333AC-1GPO (<= v1.2.1). The vulnerability can be exploited by remote unauthenticated users capable of interacting with the default "edgserver" service enabled on the access point and malicious commands are executed with root privileges. No authentication is enabled on the service and the source of the vulnerability resides in processing code associated to the "backup_config_to_utility" operation.
- Product
- EKI-6333AC-2G
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 26, 2024A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactureCVE-2024-50371 · Other software · Advantech · reported by prodsec@nozominetworks.comCritical 9.8
A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6.3), EKI-6333AC-2GD (<= v1.6.3) and EKI-6333AC-1GPO (<= v1.2.1). The vulnerability can be exploited by remote unauthenticated users capable of interacting with the default "edgserver" service enabled on the access point and malicious commands are executed with root privileges. No authentication is enabled on the service and the source of the vulnerability resides in processing code associated to the "wlan_scan" operation.
- Product
- EKI-6333AC-2G
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 26, 2024A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactureCVE-2024-50370 · Other software · Advantech · reported by prodsec@nozominetworks.comCritical 9.8
A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6.3), EKI-6333AC-2GD (<= v1.6.3) and EKI-6333AC-1GPO (<= v1.2.1). The vulnerability can be exploited by remote unauthenticated users capable of interacting with the default "edgserver" service enabled on the access point and malicious commands are executed with root privileges. No authentication is enabled on the service and the source of the vulnerability resides in processing code associated to the "cfg_cmd_set_eth_conf" operation.
- Product
- EKI-6333AC-2G
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 26, 2024AppPresser – Mobile App Framework: Privilege escalationCVE-2024-11024 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The AppPresser – Mobile App Framework plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.4.6. This is due to the plugin not properly validating a user's password reset code prior to updating their password. This makes it possible for unauthenticated attackers, with knowledge of a user's email address, to reset the user's password and gain access to their account.
- Product
- AppPresser – Mobile App Framework
- Affected
- up to 4.4.6
- What to do
- Affects up to 4.4.6. Update AppPresser – Mobile App Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 26, 2024ProjectSend Improper Authentication VulnerabilityCVE-2024-11680 · Other software · ProjectSend · reported by VulnCheckExploitedCritical 9.8
ProjectSend contains an improper authentication vulnerability that allows a remote, unauthenticated attacker to enable unauthorized modification of the application's configuration via crafted HTTP requests to options.php. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript.
- Product
- ProjectSend
- On CISA’s list since
- Dec 3, 2024 (federal fix deadline Dec 24, 2024)
- What to do
- Attackers are using this now. Install ProjectSend’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA cataloggithub.comgithub.com
Nov 26, 2024Wrong configuration in Touch Pal application can collect user behavior data without awareness by the user.CVE-2018-11922 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comCritical 9.8
Wrong configuration in Touch Pal application can collect user behavior data without awareness by the user.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 26, 2024In multiple functions that process 802.11 frames, out-of-bounds reads can occur due to insufficient validation.CVE-2017-17772 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comCritical 9.8
In multiple functions that process 802.11 frames, out-of-bounds reads can occur due to insufficient validation.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 26, 2024On some hardware revisions where VP9 decoding is hardware-accelerated, the frame size is not programmed correctly into the decoder hardware which can lead to anCVE-2017-11076 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comCritical 9.8
On some hardware revisions where VP9 decoding is hardware-accelerated, the frame size is not programmed correctly into the decoder hardware which can lead to an invalid memory access by the decoder.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 26, 2024API keys for some cloud services are hardcoded in the "main" binary.CVE-2024-36248 · Other software · Sharp Corporation · reported by vultures@jpcert.or.jpCritical 9.1
API keys for some cloud services are hardcoded in the "main" binary. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].
- Product
- Multiple MFPs (multifunction printers)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 26, 2024There are several hidden accounts.CVE-2024-35244 · Other software · Sharp Corporation · reported by vultures@jpcert.or.jpCritical 9.1
There are several hidden accounts. Some of them are intended for maintenance engineers, and with the knowledge of their passwords (e.g., by examining the coredump), these accounts can be used to re-configure the device. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].
- Product
- Multiple MFPs (multifunction printers)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 26, 2024"sessionlist.html" and "sys_trayentryreboot.html" are accessible with no authentication.CVE-2024-33610 · Other software · Sharp Corporation · reported by vultures@jpcert.or.jpCritical 9.1
"sessionlist.html" and "sys_trayentryreboot.html" are accessible with no authentication. "sessionlist.html" provides logged-in users' session information including session cookies, and "sys_trayentryreboot.html" allows to reboot the device. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].
- Product
- Multiple MFPs (multifunction printers)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 26, 2024The web interface of the affected devices processes a cookie value improperly, leading to a stack buffer overflow.CVE-2024-28038 · Other software · Sharp Corporation · reported by vultures@jpcert.or.jpCritical 9
The web interface of the affected devices processes a cookie value improperly, leading to a stack buffer overflow. More precisely, giving too long character string to MFPSESSIONID parameter results in a stack buffer overflow. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].
- Product
- Multiple MFPs (multifunction printers)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 26, 2024Spam protection, Anti-Spam, FireWall by CleanTalk: Unauthorized Arbitrary Plugin InstallationCVE-2024-10542 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Spam protection, Anti-Spam, FireWall by CleanTalk plugin for WordPress is vulnerable to unauthorized Arbitrary Plugin Installation due to an authorization bypass via reverse DNS spoofing on the checkWithoutToken function in all versions up to, and including, 6.43.2. This makes it possible for unauthenticated attackers to install and activate arbitrary plugins which can be leveraged to achieve remote code execution if another vulnerable plugin is installed and activated.
- Product
- Spam protection, Anti-Spam, FireWall by CleanTalk
- Affected
- up to 6.43.2
- What to do
- Affects up to 6.43.2. Update Spam protection, Anti-Spam, FireWall by CleanTalk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 25, 2024A NoSQL injection vulnerability in Adapt Learning Adapt Authoring Tool <= 0.11.3 allows unauthenticated attackers to reset user and administrator account passwoCVE-2024-50672 · Other software · adapt_authoring_tool · reported by MITRECritical 9.8
A NoSQL injection vulnerability in Adapt Learning Adapt Authoring Tool <= 0.11.3 allows unauthenticated attackers to reset user and administrator account passwords via the "Reset password" feature. The vulnerability occurs due to insufficient validation of user input, which is used as a query in Mongoose's find() function. This makes it possible for attackers to perform a full takeover of the administrator account. Attackers can then use the newly gained administrative privileges to upload a custom plugin to perform remote code execution (RCE) on the server hosting the web application.
- Product
- adapt_authoring_tool
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 25, 2024An issue in the upload_documents method of libre-chat v0.0.6 allows attackers to execute a path traversal via supplying a crafted filename in an uploaded file.CVE-2024-52787 · Other software · librechat · reported by MITRECritical 9.1
An issue in the upload_documents method of libre-chat v0.0.6 allows attackers to execute a path traversal via supplying a crafted filename in an uploaded file.
- Product
- librechat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Nov 24, 2024Affected devices beacon to eCharge cloud infrastructure asking if there are any command they should run.CVE-2024-11666 · Other software · hardy-barth · reported by research@onekey.comCritical 9
Affected devices beacon to eCharge cloud infrastructure asking if there are any command they should run. This communication is established over an insecure channel since peer verification is disabled everywhere. Therefore, remote unauthenticated users suitably positioned on the network between an EV charger controller and eCharge infrastructure can execute arbitrary commands with elevated privileges on affected devices. This issue affects cph2_echarge_firmware: through 2.0.4.
- Product
- cph2_echarge_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 24, 2024An issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24405.CVE-2024-53915 · Other software · veritas · reported by MITRECritical 9.8
An issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24405. It allows remote attackers to execute arbitrary code because untrusted data, received on a .NET Remoting TCP port, is deserialized.
- Product
- enterprise_vault
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 24, 2024An issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24344.CVE-2024-53914 · Other software · veritas · reported by MITRECritical 9.8
An issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24344. It allows remote attackers to execute arbitrary code because untrusted data, received on a .NET Remoting TCP port, is deserialized.
- Product
- enterprise_vault
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 24, 2024An issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24343.CVE-2024-53913 · Other software · veritas · reported by MITRECritical 9.8
An issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24343. It allows remote attackers to execute arbitrary code because untrusted data, received on a .NET Remoting TCP port, is deserialized.
- Product
- enterprise_vault
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 24, 2024An issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24341.CVE-2024-53912 · Other software · veritas · reported by MITRECritical 9.8
An issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24341. It allows remote attackers to execute arbitrary code because untrusted data, received on a .NET Remoting TCP port, is deserialized.
- Product
- enterprise_vault
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 24, 2024An issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24339.CVE-2024-53911 · Other software · veritas · reported by MITRECritical 9.8
An issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24339. It allows remote attackers to execute arbitrary code because untrusted data, received on a .NET Remoting TCP port, is deserialized.
- Product
- enterprise_vault
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 24, 2024An issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24336.CVE-2024-53910 · Other software · veritas · reported by MITRECritical 9.8
An issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24336. It allows remote attackers to execute arbitrary code because untrusted data, received on a .NET Remoting TCP port, is deserialized.
- Product
- enterprise_vault
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 24, 2024An issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24334.CVE-2024-53909 · Other software · veritas · reported by MITRECritical 9.8
An issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24334. It allows remote attackers to execute arbitrary code because untrusted data, received on a .NET Remoting TCP port, is deserialized.
- Product
- enterprise_vault
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 23, 2024In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, uncontrolled long string inputs to ldap_escape() function on 32-bit systems can cCVE-2024-11236 · Websites & servers · PHP Group · reported by security@php.netCritical 9.8
In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, uncontrolled long string inputs to ldap_escape() function on 32-bit systems can cause an integer overflow, resulting in an out-of-bounds write.
- Product
- PHP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Nov 23, 2024WPGYM - Wordpress Gym Management System: Arbitrary file uploadsCVE-2024-9942 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WPGYM - Wordpress Gym Management System plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the MJ_gmgt_user_avatar_image_upload() function in all versions up to, and including, 67.1.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- WPGYM - Wordpress Gym Management System
- Affected
- up to 67.1.0
- What to do
- Affects up to 67.1.0. Update WPGYM - Wordpress Gym Management System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.