Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
38,829 results · page 295 of 777
Nov 16, 2024User Management: Unrestricted Upload of File with Dangerous TypeCVE-2024-52403 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in Saad Iqbal User Management user-management allows Upload a Web Shell to a Web Server.This issue affects User Management: from n/a through <= 1.1.
- Product
- User Management
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update User Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 16, 2024Gallerio: Unrestricted Upload of File with Dangerous TypeCVE-2024-52400 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in Subhasis Laha Gallerio gallerio allows Upload a Web Shell to a Web Server.This issue affects Gallerio: from n/a through <= 1.01.
- Product
- Gallerio
- Affected
- up to 1.01
- What to do
- Affects up to 1.01. Update Gallerio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 16, 2024Writer Helper: Unrestricted Upload of File with Dangerous TypeCVE-2024-52399 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in Clarisse K. Writer Helper writer-helper allows Upload a Web Shell to a Web Server.This issue affects Writer Helper: from n/a through <= 3.1.6.
- Product
- Writer Helper
- Affected
- up to 3.1.6
- What to do
- Affects up to 3.1.6. Update Writer Helper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 16, 2024CDI: Unrestricted Upload of File with Dangerous TypeCVE-2024-52398 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in Halyra CDI collect-and-deliver-interface-for-woocommerce.This issue affects CDI: from n/a through <= 5.5.3.
- Product
- CDI
- Affected
- up to 5.5.3
- What to do
- Affects up to 5.5.3. Update CDI to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 16, 2024Backup and Staging by WP Time Capsule: Arbitrary file uploadsCVE-2024-8856 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Backup and Staging by WP Time Capsule plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the the UploadHandler.php file and no direct file access prevention in all versions up to, and including, 1.22.21. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- Backup and Staging by WP Time Capsule
- Affected
- up to 1.22.21
- What to do
- Affects up to 1.22.21. Update Backup and Staging by WP Time Capsule to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordhacked.beplugins.trac.wordpress.org
Nov 15, 2024When the Global Pointer (GP) relative addressing is enabled (CONFIG_RISCV_GP=y), the gp reg points at 0x800 bytes past the start of the .sdata section which is CVE-2024-11263 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgCritical 9.3
When the Global Pointer (GP) relative addressing is enabled (CONFIG_RISCV_GP=y), the gp reg points at 0x800 bytes past the start of the .sdata section which is then used by the linker to relax accesses to global symbols.
- Product
- Zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2024An arbitrary file upload vulnerability in the component /Production/UploadFile of NUS-M9 ERP Management Software v3.0.0 allows attackers to execute arbitrary coCVE-2024-44758 · Other software · erp · reported by MITRECritical 9.8
An arbitrary file upload vulnerability in the component /Production/UploadFile of NUS-M9 ERP Management Software v3.0.0 allows attackers to execute arbitrary code via uploading crafted files.
- Product
- management_software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2024In OpenBSD 7.5 before errata 008 and OpenBSD 7.4 before errata 021, avoid possible mbuf double free in NFS client and server implementation, do not use uninitiCVE-2024-10934 · Other software · OpenBSD · reported by 9119a7d8-5eab-497f-8521-727c672e3725Critical 9.2
In OpenBSD 7.5 before errata 008 and OpenBSD 7.4 before errata 021, avoid possible mbuf double free in NFS client and server implementation, do not use uninitialized variable in error handling of NFS server.
- Product
- OpenBSD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordftp.openbsd.orgftp.openbsd.org
Nov 15, 2024Multiple Buffer overflows in the MMS Client in MZ Automation LibIEC61850 before commit 1f52be9ddeae00e69cd43e4cac3cb4f0c880c4f0 allow a malicious server to causCVE-2024-45971 · Other software · mz-automation · reported by MITRECritical 9.8
Multiple Buffer overflows in the MMS Client in MZ Automation LibIEC61850 before commit 1f52be9ddeae00e69cd43e4cac3cb4f0c880c4f0 allow a malicious server to cause a stack-based buffer overflow via the MMS IdentifyResponse message.
- Product
- lib60870
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2024Multiple Buffer overflows in the MMS Client in MZ Automation LibIEC61850 before commit ac925fae8e281ac6defcd630e9dd756264e9c5bc allow a malicious server to causCVE-2024-45970 · Other software · mz-automation · reported by MITRECritical 9.8
Multiple Buffer overflows in the MMS Client in MZ Automation LibIEC61850 before commit ac925fae8e281ac6defcd630e9dd756264e9c5bc allow a malicious server to cause a stack-based buffer overflow via the MMS FileDirResponse message.
- Product
- lib60870
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2024Budget Control Gateway acts as an entry point for incoming requests and routes them to the appropriate microservices for Budget Control.CVE-2024-52528 · Other software · BudgetControl · reported by GitHubCritical 9.3
Budget Control Gateway acts as an entry point for incoming requests and routes them to the appropriate microservices for Budget Control. Budget Control Gateway does not properly validate auth tokens, which allows attackers to bypass intended restrictions. This vulnerability is fixed in 1.5.2.
- Product
- Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2024Multiple parameters have SQL injection vulnerability in JEPaaS 7.2.8 via /je/login/btnLog/insertBtnLog, which could allow a remote user to submit a specially crCVE-2024-51164 · Other software · jepaas · reported by MITRECritical 9.1
Multiple parameters have SQL injection vulnerability in JEPaaS 7.2.8 via /je/login/btnLog/insertBtnLog, which could allow a remote user to submit a specially crafted query, allowing an attacker to retrieve all the information stored in the DB.
- Product
- jepaas
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabcc111.github.iogitee.com
Nov 15, 2024KASO v9.0 was discovered to contain a SQL injection vulnerability via the person_id parameter at /cardcase/editcard.jsp.CVE-2024-50724 · Other software · kaso · reported by MITRECritical 9.8
KASO v9.0 was discovered to contain a SQL injection vulnerability via the person_id parameter at /cardcase/editcard.jsp.
- Product
- kaso
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2024The user avatar upload function in python_book V1.0 has an arbitrary file upload vulnerability.CVE-2024-50649 · Other software · python_book · reported by MITRECritical 9.8
The user avatar upload function in python_book V1.0 has an arbitrary file upload vulnerability.
- Product
- python_book
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2024yshopmall V1.0 has an arbitrary file upload vulnerability, which can enable RCE or even take over the server when improperly configured to parse JSP files.CVE-2024-50648 · Other software · yshopmall · reported by MITRECritical 9.8
yshopmall V1.0 has an arbitrary file upload vulnerability, which can enable RCE or even take over the server when improperly configured to parse JSP files.
- Product
- yshopmall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2024A vulnerability in the web UI of Cisco IND could allow an authenticated, remote attacker to execute arbitrary commands with administrative privileges on the undCVE-2023-20036 · Network & remote access · Cisco · reported by psirt@cisco.comCritical 9.9
A vulnerability in the web UI of Cisco IND could allow an authenticated, remote attacker to execute arbitrary commands with administrative privileges on the underlying operating system of an affected device. This vulnerability is due to improper input validation when uploading a Device Pack. An attacker could exploit this vulnerability by altering the request that is sent when uploading a Device Pack. A successful exploit could allow the attacker to execute arbitrary commands as NT AUTHORITY\SYSTEM on the underlying operating system of an affected device. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
- Product
- Cisco Industrial Network Director
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Nov 15, 2024A vulnerability in the external authentication mechanism of Cisco Modeling Labs could allow an unauthenticated, remote attacker to access the web interface withCVE-2023-20154 · Network & remote access · Cisco · reported by psirt@cisco.comCritical 9.1
A vulnerability in the external authentication mechanism of Cisco Modeling Labs could allow an unauthenticated, remote attacker to access the web interface with administrative privileges. This vulnerability is due to the improper handling of certain messages that are returned by the associated external authentication server. An attacker could exploit this vulnerability by logging in to the web interface of an affected server. Under certain conditions, the authentication mechanism would be bypassed and the attacker would be logged in as an administrator. A successful exploit could allow the attacker to obtain administrative privileges on the web interface of an affected server, including the ability to access and modify every simulation and all user-created data. To exploit this vulnerability, the attacker would need valid user credentials that are stored on the associated external authentication server. Cisco has released software updates that address this vulnerability. There are workarounds that address this vulnerability.
- Product
- Cisco Modeling Labs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Nov 15, 2024Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in Task Manager component in Synology BeePhotos before CVE-2024-10443 · Network & remote access · Synology · reported by security@synology.comCritical 9.8
Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in Task Manager component in Synology BeePhotos before 1.0.2-10026 and 1.1.0-10053 and Synology Photos before 1.6.2-0720 and 1.7.0-0795 allows remote attackers to execute arbitrary code via unspecified vectors.
- Product
- BeePhotos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsynology.comsynology.com
Nov 15, 2024A remote command execution vulnerability exists in gogs/gogs versions <=0.12.7 when deployed on a Windows server.CVE-2022-1884 · Other software · gogs · reported by security@huntr.devCritical 9.8
A remote command execution vulnerability exists in gogs/gogs versions <=0.12.7 when deployed on a Windows server. The vulnerability arises due to improper validation of the `tree_path` parameter during file uploads. An attacker can set `tree_path=.git.` to upload a file into the .git directory, allowing them to write or rewrite the `.git/config` file. If the `core.sshCommand` is set, this can lead to remote command execution.
- Product
- gogs/gogs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2024An improper restriction of external entities (XXE) vulnerability in dompdf/dompdf's SVG parser allows for Server-Side Request Forgery (SSRF) and deserializationCVE-2021-3902 · Other software · dompdf · reported by security@huntr.devCritical 9.8
An improper restriction of external entities (XXE) vulnerability in dompdf/dompdf's SVG parser allows for Server-Side Request Forgery (SSRF) and deserialization attacks. This issue affects all versions prior to 2.0.0. The vulnerability can be exploited even if the isRemoteEnabled option is set to false. It allows attackers to perform SSRF, disclose internal image files, and cause PHAR deserialization attacks.
- Product
- dompdf/dompdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2024DomPDF before version 2.0.0 is vulnerable to PHAR deserialization due to a lack of checking on the protocol before passing it into the file_get_contents() functCVE-2021-3838 · Other software · dompdf · reported by security@huntr.devCritical 9.8
DomPDF before version 2.0.0 is vulnerable to PHAR deserialization due to a lack of checking on the protocol before passing it into the file_get_contents() function. An attacker who can upload files of any type to the server can pass in the phar:// protocol to unserialize the uploaded file and instantiate arbitrary PHP objects. This can lead to remote code execution, especially when DOMPdf is used with frameworks with documented POP chains like Laravel or vulnerable developer code.
- Product
- dompdf/dompdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2024The Really Simple Security (Free, Pro, and Pro Multisite) plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1.CVE-2024-10924 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Really Simple Security (Free, Pro, and Pro Multisite) plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1. This is due to improper user check error handling in the two-factor REST API actions with the 'check_login_and_get_user' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, when the "Two-Factor Authentication" setting is enabled (disabled by default).
- Affected
- 9.0.0 to 9.1.1.1
- What to do
- Affects 9.0.0 to 9.1.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 14, 2024GeoVision Devices OS Command Injection VulnerabilityCVE-2024-11120 · Other software · GeoVision · reported by twcert@cert.org.twExploitedCritical 9.8
Multiple GeoVision devices contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to inject and execute arbitrary system commands. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
- Product
- Multiple Devices
- On CISA’s list since
- May 7, 2025 (federal fix deadline May 28, 2025)
- What to do
- Attackers are using this now. Install GeoVision’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogtwcert.org.twtwcert.org.tw
Nov 14, 2024The ventilator does not perform proper file integrity checks when adopting firmware updates.CVE-2024-48974 · Other software · Baxter · reported by productsecurity@baxter.comCritical 9.3
The ventilator does not perform proper file integrity checks when adopting firmware updates. This makes it possible for an attacker to force unauthorized changes to the device's configuration settings and/or compromise device functionality by pushing a compromised/illegitimate firmware file. This could disrupt the function of the device and/or cause unauthorized information disclosure.
- Product
- Life2000 Ventilation System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2024The debug port on the ventilator's serial interface is enabled by default.CVE-2024-48973 · Other software · Baxter · reported by productsecurity@baxter.comCritical 9.3
The debug port on the ventilator's serial interface is enabled by default. This could allow an attacker to send and receive messages over the debug port (which are unencrypted; see 3.2.1) that result in unauthorized disclosure of information and/or have unintended impacts on device settings and performance.
- Product
- Life2000 Ventilation System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2024The Clinician Password and Serial Number Clinician Password are hard-coded into the ventilator in plaintext form.CVE-2024-48971 · Other software · Baxter · reported by productsecurity@baxter.comCritical 9.3
The Clinician Password and Serial Number Clinician Password are hard-coded into the ventilator in plaintext form. This could allow an attacker to obtain the password off the ventilator and use it to gain unauthorized access to the device, with clinician privileges.
- Product
- Life2000 Ventilation System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2024The ventilator's microcontroller lacks memory protection.CVE-2024-48970 · Other software · Baxter · reported by productsecurity@baxter.comCritical 9.3
The ventilator's microcontroller lacks memory protection. An attacker could connect to the internal JTAG interface and read or write to flash memory using an off-the-shelf debugging tool, which could disrupt the function of the device and/or cause unauthorized information disclosure.
- Product
- Life2000 Ventilation System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2024The ventilator and the Service PC lack sufficient audit logging capabilities to allow for detection of malicious activity and subsequent forensic examination.CVE-2024-48967 · Other software · Baxter · reported by productsecurity@baxter.comCritical 10
The ventilator and the Service PC lack sufficient audit logging capabilities to allow for detection of malicious activity and subsequent forensic examination. An attacker with access to the ventilator and/or the Service PC could, without detection, make unauthorized changes to ventilator settings that result in unauthorized disclosure of information and/or have unintended impacts on device performance.
- Product
- Life2000 Ventilation System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2024The software tools used by service personnel to test & calibrate the ventilator do not support user authentication.CVE-2024-48966 · Other software · Baxter · reported by productsecurity@baxter.comCritical 10
The software tools used by service personnel to test & calibrate the ventilator do not support user authentication. An attacker with access to the Service PC where the tools are installed could obtain diagnostic information through the test tool or manipulate the ventilator's settings and embedded software via the calibration tool, without having to authenticate to either tool. This could result in unauthorized disclosure of information and/or have unintended impacts on device settings and performance.
- Product
- Life2000 Ventilation System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2024A misconfiguration in the fingerprint authentication mechanism of Binance: BTC, Crypto and NFTS v2.85.4, allows attackers to bypass authentication when adding aCVE-2024-31695 · Other software · binance · reported by MITRECritical 9.8
A misconfiguration in the fingerprint authentication mechanism of Binance: BTC, Crypto and NFTS v2.85.4, allows attackers to bypass authentication when adding a new fingerprint.
- Product
- btc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2024Improper data protection on the ventilator's serial interface could allow an attacker to send and receive messages that result in unauthorized disclosure of infCVE-2024-9834 · Other software · Baxter · reported by productsecurity@baxter.comCritical 9.3
Improper data protection on the ventilator's serial interface could allow an attacker to send and receive messages that result in unauthorized disclosure of information and/or have unintended impacts on device settings and performance.
- Product
- Life2000 Ventilation System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2024There is no limit on the number of failed login attempts permitted with the Clinician Password or the Serial Number Clinician Password.CVE-2024-9832 · Other software · Baxter · reported by productsecurity@baxter.comCritical 9.3
There is no limit on the number of failed login attempts permitted with the Clinician Password or the Serial Number Clinician Password. An attacker could execute a brute-force attack to gain unauthorized access to the ventilator, and then make changes to device settings that could disrupt the function of the device and/or result in unauthorized information disclosure.
- Product
- Life2000 Ventilation System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2024Hive Support: Unrestricted Upload of File with Dangerous TypeCVE-2024-52370 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in Hive Support Hive Support hive-support allows Upload a Web Shell to a Web Server.This issue affects Hive Support: from n/a through <= 1.1.1.
- Product
- Hive Support
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update Hive Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 14, 2024KBucket: Unrestricted Upload of File with Dangerous TypeCVE-2024-52369 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in Optimal Access KBucket kbucket allows Upload a Web Shell to a Web Server.This issue affects KBucket: from n/a through <= 4.2.2.
- Product
- KBucket
- Affected
- up to 4.2.2
- What to do
- Affects up to 4.2.2. Update KBucket to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 14, 2024Podlove Podcast Publisher: Deserialization of Untrusted DataCVE-2024-52393 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Deserialization of Untrusted Data vulnerability in Eric Teubert Podlove Podcast Publisher podlove-podcasting-plugin-for-wordpress.This issue affects Podlove Podcast Publisher: from n/a through <= 4.1.15.
- Product
- Podlove Podcast Publisher
- Affected
- up to 4.1.15
- What to do
- Affects up to 4.1.15. Update Podlove Podcast Publisher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 14, 2024Sage AI: Chatbots, OpenAI GPT-4 Bulk Articles, Dalle-3 Image Generation: Unrestricted Upload of File with Dangerous TypeCVE-2024-52384 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in wpmonks Sage AI: Chatbots, OpenAI GPT-4 Bulk Articles, Dalle-3 Image Generation ai-content-generator allows Upload a Web Shell to a Web Server.This issue affects Sage AI: Chatbots, OpenAI GPT-4 Bulk Articles, Dalle-3 Image Generation: from n/a through <= 2.4.9.
- Product
- Sage AI: Chatbots, OpenAI GPT-4 Bulk Articles, Dalle-3 Image Generation
- Affected
- up to 2.4.9
- What to do
- Affects up to 2.4.9. Update Sage AI: Chatbots, OpenAI GPT-4 Bulk Articles, Dalle-3 Image Generation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 14, 2024Matix Popup Builder: Missing AuthorizationCVE-2024-52382 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Missing Authorization vulnerability in medmatech Matix Popup Builder medma-matix allows Privilege Escalation.This issue affects Matix Popup Builder: from n/a through <= 1.0.0.
- Product
- Matix Popup Builder
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Matix Popup Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 14, 2024Picsmize: Unrestricted Upload of File with Dangerous TypeCVE-2024-52380 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in softpulseinfotech Picsmize picsmize allows Upload a Web Shell to a Web Server.This issue affects Picsmize: from n/a through <= 1.0.0.
- Product
- Picsmize
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Picsmize to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 14, 2024kineticPay for WooCommerce: Unrestricted Upload of File with Dangerous TypeCVE-2024-52379 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in faizalbahasan kineticPay for WooCommerce kineticpay-for-woocommerce allows Upload a Web Shell to a Web Server.This issue affects kineticPay for WooCommerce: from n/a through <= 2.0.8.
- Product
- kineticPay for WooCommerce
- Affected
- up to 2.0.8
- What to do
- Affects up to 2.0.8. Update kineticPay for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 14, 2024Instant Image Generator: Unrestricted Upload of File with Dangerous TypeCVE-2024-52377 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in bdthemes Instant Image Generator ai-image allows Upload a Web Shell to a Web Server.This issue affects Instant Image Generator: from n/a through <= 1.5.2.
- Product
- Instant Image Generator
- Affected
- up to 1.5.2
- What to do
- Affects up to 1.5.2. Update Instant Image Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 14, 2024Boat Rental Plugin for: Unrestricted Upload of File with Dangerous TypeCVE-2024-52376 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in cmsMinds Boat Rental Plugin for WordPress boat-rental-system allows Upload a Web Shell to a Web Server.This issue affects Boat Rental Plugin for WordPress: from n/a through <= 1.0.1.
- Product
- Boat Rental Plugin for
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Boat Rental Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 14, 2024Datasets Manager by Arttia Creative: Unrestricted Upload of File with Dangerous TypeCVE-2024-52375 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in Arttia Creative Datasets Manager by Arttia Creative datasets-manager-by-arttia-creative.This issue affects Datasets Manager by Arttia Creative: from n/a through <= 1.5.
- Product
- Datasets Manager by Arttia Creative
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update Datasets Manager by Arttia Creative to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 14, 2024Do That Task: Unrestricted Upload of File with Dangerous TypeCVE-2024-52374 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in DoThatTask Do That Task do-that-task allows Upload a Web Shell to a Web Server.This issue affects Do That Task: from n/a through <= 1.5.5.
- Product
- Do That Task
- Affected
- up to 1.5.5
- What to do
- Affects up to 1.5.5. Update Do That Task to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 14, 2024Devexhub Gallery: Unrestricted Upload of File with Dangerous TypeCVE-2024-52373 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in Team Devexhub Devexhub Gallery devexhub-gallery allows Upload a Web Shell to a Web Server.This issue affects Devexhub Gallery: from n/a through <= 2.0.1.
- Product
- Devexhub Gallery
- Affected
- up to 2.0.1
- What to do
- Affects up to 2.0.1. Update Devexhub Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 14, 2024Easy CSV Importer BETA: Unrestricted Upload of File with Dangerous TypeCVE-2024-52372 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in WebTechGlobal Easy CSV Importer BETA easy-csv-importer allows Upload a Web Shell to a Web Server.This issue affects Easy CSV Importer BETA: from n/a through <= 7.0.0.
- Product
- Easy CSV Importer BETA
- Affected
- up to 7.0.0
- What to do
- Affects up to 7.0.0. Update Easy CSV Importer BETA to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 14, 2024A Python command injection vulnerability exists in the `SagemakerLLM` class's `complete()` method within `./private_gpt/components/llm/custom/sagemaker.py` of tCVE-2024-4343 · Other software · imartinez · reported by security@huntr.devCritical 9.8
A Python command injection vulnerability exists in the `SagemakerLLM` class's `complete()` method within `./private_gpt/components/llm/custom/sagemaker.py` of the imartinez/privategpt application, versions up to and including 0.3.0. The vulnerability arises due to the use of the `eval()` function to parse a string received from a remote AWS SageMaker LLM endpoint into a dictionary. This method of parsing is unsafe as it can execute arbitrary Python code contained within the response. An attacker can exploit this vulnerability by manipulating the response from the AWS SageMaker LLM endpoint to include malicious Python code, leading to potential execution of arbitrary commands on the system hosting the application. The issue is fixed in version 0.6.0.
- Product
- imartinez/privategpt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2024A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload.CVE-2024-37285 · Other software · Elastic · reported by security@elastic.coCritical 9.1
A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. A successful attack requires a malicious user to have a combination of both specific Elasticsearch indices privileges https://www.elastic.co/guide/en/elasticsearch/reference/current/defining-roles.html#roles-indices-priv and Kibana privileges https://www.elastic.co/guide/en/fleet/current/fleet-roles-and-privileges.html assigned to them. The following Elasticsearch indices permissions are required * write privilege on the system indices .kibana_ingest* * The allow_restricted_indices flag is set to true Any of the following Kibana privileges are additionally required * Under Fleet the All privilege is granted * Under Integration the Read or All privilege is granted * Access to the fleet-setup privilege is gained through the Fleet Server’s service account token
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2024Chartify – WordPress Chart: Local File InclusionCVE-2024-10571 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Chartify – WordPress Chart Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.9.5 via the 'source' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
- Product
- Chartify – WordPress Chart
- Affected
- up to 2.9.5
- What to do
- Affects up to 2.9.5. Update Chartify – WordPress Chart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordabrahack.complugins.trac.wordpress.org
Nov 14, 2024Unchecked return value can allow Apache Traffic Server to retain privileges on startup.CVE-2024-50306 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.1
Unchecked return value can allow Apache Traffic Server to retain privileges on startup. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.5, from 10.0.0 through 10.0.1. Users are recommended to upgrade to version 9.2.6 or 10.0.2, which fixes the issue.
- Product
- Apache Traffic Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.debian.org
Nov 13, 2024Cybele Software Thinfinity Workspace before v7.0.2.113 was discovered to contain an access control issue in the API endpoint where Web Sockets connections are eCVE-2024-40404 · Other software · cybelesoft · reported by MITRECritical 9.8
Cybele Software Thinfinity Workspace before v7.0.2.113 was discovered to contain an access control issue in the API endpoint where Web Sockets connections are established.
- Product
- thinfinity_workspace
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.