Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
38,829 results · page 298 of 777
Nov 5, 2024Lylme Spage v1.9.5 is vulnerable to Incorrect Access Control.CVE-2024-48176 · Other software · lylme · reported by MITRECritical 9.8
Lylme Spage v1.9.5 is vulnerable to Incorrect Access Control. There is no limit on the number of login attempts, and the verification code will not be refreshed after a failed login, which allows attackers to blast the username and password and log into the system backend.
- Product
- lylme_spage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2024Command injection vulnerability in the underlying CLI service could lead to unauthenticated remote code execution by sending specially crafted packets destined CVE-2024-47460 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9
Command injection vulnerability in the underlying CLI service could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.
- Product
- HPE Aruba Networking Access Points, Instant AOS-8, and AOS-10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2024Command injection vulnerability in the underlying CLI service could lead to unauthenticated remote code execution by sending specially crafted packets destined CVE-2024-42509 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.8
Command injection vulnerability in the underlying CLI service could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.
- Product
- HPE Aruba Networking Access Points, Instant AOS-8, and AOS-10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2024In the Linux kernel, the following vulnerability has been resolved: nfsd: fix race between laundromat and free_stateid There is a race between laundromat handCVE-2024-50106 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Critical 9.8
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix race between laundromat and free_stateid There is a race between laundromat handling of revoked delegations and a client sending free_stateid operation. Laundromat thread finds that delegation has expired and needs to be revoked so it marks the delegation stid revoked and it puts it on a reaper list but then it unlock the state lock and the actual delegation revocation happens without the lock. Once the stid is marked revoked a racing free_stateid processing thread does the following (1) it calls list_del_init() which removes it from the reaper list and (2) frees the delegation stid structure. The laundromat thread ends up not calling the revoke_delegation() function for this particular delegation but that means it will no release the lock lease that exists on the file. Now, a new open for this file comes in and ends up finding that lease list isn't empty and calls nfsd_breaker_owns_lease() which ends up trying to derefence a freed delegation stateid. Leading to the followint use-after-free KASAN warning: kernel: ================================================================== kernel: BUG: KASAN: sl
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Nov 5, 2024An XML External Entity (XXE) vulnerability in HAPI FHIR before v6.4.0 allows attackers to access sensitive information or execute arbitrary code via supplying aCVE-2024-51132 · Other software · fhir · reported by MITRECritical 9.8
An XML External Entity (XXE) vulnerability in HAPI FHIR before v6.4.0 allows attackers to access sensitive information or execute arbitrary code via supplying a crafted request containing malicious XML entities.
- Product
- hapi_fhir
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2024A heap buffer overflow could be triggered by sending a specific packet to TCP port 7700.CVE-2023-29125 · Other software · Enel X · reported by cve@asrg.ioCritical 9
A heap buffer overflow could be triggered by sending a specific packet to TCP port 7700.
- Product
- JuiceBox Pro 3.0 22kW Cellular
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport-emobility.enelx.com
Nov 5, 2024Waybox Enel TCF Agent service could be used to get administrator’s privileges over the Waybox system.CVE-2023-29121 · Other software · Enel X · reported by cve@asrg.ioCritical 9.6
Waybox Enel TCF Agent service could be used to get administrator’s privileges over the Waybox system.
- Product
- JuiceBox Pro 3.0 22kW Cellular
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport-emobility.enelx.com
Nov 5, 2024Waybox Enel X web management application could be used to execute arbitrary OS commands and provide administrator’s privileges over the Waybox system.CVE-2023-29120 · Other software · Enel X · reported by cve@asrg.ioCritical 9.6
Waybox Enel X web management application could be used to execute arbitrary OS commands and provide administrator’s privileges over the Waybox system.
- Product
- JuiceBox Pro 3.0 22kW Cellular
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport-emobility.enelx.com
Nov 5, 2024Waybox Enel X web management application could execute arbitrary requests on the internal database via /admin/dbstore.php.CVE-2023-29119 · Other software · Enel X · reported by cve@asrg.ioCritical 9.6
Waybox Enel X web management application could execute arbitrary requests on the internal database via /admin/dbstore.php.
- Product
- JuiceBox Pro 3.0 22kW Cellular
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport-emobility.enelx.com
Nov 5, 2024Waybox Enel X web management application could execute arbitrary requests on the internal database via /admin/versions.php.CVE-2023-29118 · Other software · Enel X · reported by cve@asrg.ioCritical 9.6
Waybox Enel X web management application could execute arbitrary requests on the internal database via /admin/versions.php.
- Product
- JuiceBox Pro 3.0 22kW Cellular
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport-emobility.enelx.com
Nov 5, 2024The Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal, Social Share Buttons plugin for WordPress is CVE-2024-10687 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal, Social Share Buttons plugin for WordPress is vulnerable to time-based SQL Injection via the $collectedIds parameter in all versions up to, and including, 24.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Affected
- up to 24.0.3
- What to do
- Affects up to 24.0.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 4, 2024Refit is an automatic type-safe REST library for .NET Core, Xamarin and .NET The various header-related Refit attributes (Header, HeaderCollection and AuthorizeCVE-2024-51501 · Other software · reactiveui · reported by GitHubCritical 10
Refit is an automatic type-safe REST library for .NET Core, Xamarin and .NET The various header-related Refit attributes (Header, HeaderCollection and Authorize) are vulnerable to CRLF injection. The way HTTP headers are added to a request is via the `HttpHeaders.TryAddWithoutValidation` method. This method does not check for CRLF characters in the header value. This means that any headers added to a refit request are vulnerable to CRLF-injection. In general, CRLF-injection into a HTTP header (when using HTTP/1.1) means that one can inject additional HTTP headers or smuggle whole HTTP requests. If an application using the Refit library passes a user-controllable value through to a header, then that application becomes vulnerable to CRLF-injection. This is not necessarily a security issue for a command line application like the one above, but if such code were present in a web application then it becomes vulnerable to request splitting (as shown in the PoC) and thus Server Side Request Forgery. Strictly speaking this is a potential vulnerability in applications using Refit and not in Refit itself. This issue has been addressed in release versions 7.2.22 and 8.0.0 and all users are a
- Product
- refit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2024langflow <=1.0.18 is vulnerable to Remote Code Execution (RCE) as any component provided the code functionality and the components run on the local machine rathCVE-2024-48061 · Other software · Langflow · reported by MITRECritical 9.8
langflow <=1.0.18 is vulnerable to Remote Code Execution (RCE) as any component provided the code functionality and the components run on the local machine rather than in a sandbox.
- Product
- Langflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comrumbling-slice-eb0.notion.site
Nov 4, 2024In agentscope <=v0.0.4, the file agentscope\web\workstation\workflow_utils.py has the function is_callable_expression.CVE-2024-48050 · Other software · modelscope · reported by MITRECritical 9.8
In agentscope <=v0.0.4, the file agentscope\web\workstation\workflow_utils.py has the function is_callable_expression. Within this function, the line result = eval(s) poses a security risk as it can directly execute user-provided commands.
- Product
- agentscope
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comrumbling-slice-eb0.notion.site
Nov 4, 2024SQL Injection in loginform.php in ProjectWorld's Travel Management System v1.0 allows remote attackers to bypass authentication via SQL Injection in the 'usernaCVE-2024-51327 · Other software · projectworlds · reported by MITRECritical 9.8
SQL Injection in loginform.php in ProjectWorld's Travel Management System v1.0 allows remote attackers to bypass authentication via SQL Injection in the 'username' and 'password' fields.
- Product
- travel_management_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comprojectworlds.in
Nov 4, 2024An XML External Entity (XXE) vulnerability in Dmoz2CSV in openimaj v1.3.10 allows attackers to access sensitive information or execute arbitrary code via supplyCVE-2024-51136 · Other software · openimaj · reported by MITRECritical 9.8
An XML External Entity (XXE) vulnerability in Dmoz2CSV in openimaj v1.3.10 allows attackers to access sensitive information or execute arbitrary code via supplying a crafted XML file.
- Product
- openimaj
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2024RSVPMaker for Toastmasters: Unrestricted Upload of File with Dangerous TypeCVE-2024-50531 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in davidfcarr RSVPMaker for Toastmasters rsvpmaker-for-toastmasters allows Upload a Web Shell to a Web Server.This issue affects RSVPMaker for Toastmasters: from n/a through <= 6.2.4.
- Product
- RSVPMaker for Toastmasters
- Affected
- up to 6.2.4
- What to do
- Affects up to 6.2.4. Update RSVPMaker for Toastmasters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 4, 2024Stars SMTP Mailer: Unrestricted Upload of File with Dangerous TypeCVE-2024-50530 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in Myriad Solutionz Stars SMTP Mailer stars-smtp-mailer allows Upload a Web Shell to a Web Server.This issue affects Stars SMTP Mailer: from n/a through <= 2.2.1.
- Product
- Stars SMTP Mailer
- Affected
- up to 2.2.1
- What to do
- Affects up to 2.2.1. Update Stars SMTP Mailer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 4, 2024Training – Courses: Unrestricted Upload of File with Dangerous TypeCVE-2024-50529 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in rudrainn Training – Courses training allows Upload a Web Shell to a Web Server.This issue affects Training – Courses: from n/a through <= 2.0.1.
- Product
- Training – Courses
- Affected
- up to 2.0.1
- What to do
- Affects up to 2.0.1. Update Training – Courses to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 4, 2024Stacks Mobile App Builder: Unrestricted Upload of File with Dangerous TypeCVE-2024-50527 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in Stacks Stacks Mobile App Builder stacks-mobile-app-builder allows Upload a Web Shell to a Web Server.This issue affects Stacks Mobile App Builder: from n/a through <= 5.2.3.
- Product
- Stacks Mobile App Builder
- Affected
- up to 5.2.3
- What to do
- Affects up to 5.2.3. Update Stacks Mobile App Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 4, 2024Multi Purpose Mail Form: Unrestricted Upload of File with Dangerous TypeCVE-2024-50526 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in Lindeni Mahlalela Multi Purpose Mail Form multi-purpose-mail-form allows Upload a Web Shell to a Web Server.This issue affects Multi Purpose Mail Form: from n/a through <= 1.0.2.
- Product
- Multi Purpose Mail Form
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Multi Purpose Mail Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comgithub.com
Nov 4, 2024Helloprint: Unrestricted Upload of File with Dangerous TypeCVE-2024-50525 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in helloprint Helloprint helloprint allows Upload a Web Shell to a Web Server.This issue affects Helloprint: from n/a through <= 2.0.4.
- Product
- Helloprint
- Affected
- up to 2.0.4
- What to do
- Affects up to 2.0.4. Update Helloprint to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 4, 2024All Post Contact Form: Unrestricted Upload of File with Dangerous TypeCVE-2024-50523 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in RainbowLink Inc. All Post Contact Form allpost-contactform allows Upload a Web Shell to a Web Server.This issue affects All Post Contact Form: from n/a through <= 1.8.2.
- Product
- All Post Contact Form
- Affected
- up to 1.8.2
- What to do
- Affects up to 1.8.2. Update All Post Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 4, 2024This vulnerability exists in Aero due to improper implementation of OTP validation mechanism in certain API endpoints.CVE-2024-51561 · Other software · Brokerage Technology Solutions · reported by vdisclose@cert-in.org.inCritical 9.3
This vulnerability exists in Aero due to improper implementation of OTP validation mechanism in certain API endpoints. An authenticated remote attacker could exploit this vulnerability by intercepting and manipulating the responses exchanged during the second factor authentication process. Successful exploitation of this vulnerability could allow the attacker to bypass OTP verification for accessing other user accounts.
- Product
- Aero
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2024This vulnerability exists in the Wave 2.0 due to missing restrictions for excessive failed authentication attempts on its API based login.CVE-2024-51558 · Other software · Brokerage Technology Solutions · reported by vdisclose@cert-in.org.inCritical 9.3
This vulnerability exists in the Wave 2.0 due to missing restrictions for excessive failed authentication attempts on its API based login. A remote attacker could exploit this vulnerability by conducting a brute force attack against legitimate user OTP, MPIN or password, which could lead to gain unauthorized access and compromise other user accounts.
- Product
- Wave 2.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2024Improper Control of Generation of Code ('Code Injection'), Improper Neutralization of Special Elements used in a Command ('Command Injection'), Improper NeutralCVE-2024-10035 · Other software · BG-TEK Informatics Security Technologies · reported by iletisim@usom.gov.trCritical 9.2
Improper Control of Generation of Code ('Code Injection'), Improper Neutralization of Special Elements used in a Command ('Command Injection'), Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in BG-TEK Informatics Security Technologies CoslatV3 allows Command Injection, Privilege Escalation. This issue affects CoslatV3: through 3.1069. NOTE: The vendor was contacted and it was learned that the product is not supported.
- Product
- CoslatV3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Nov 4, 2024Media LIbrary Assistant: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')CVE-2024-51661 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Command Injection.This issue affects Media LIbrary Assistant: from n/a through <= 3.19.
- Product
- Media LIbrary Assistant
- Affected
- up to 3.19
- What to do
- Affects up to 3.19. Update Media LIbrary Assistant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 4, 2024Session Fixation vulnerability in Apache Kylin.CVE-2024-23590 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.1
Session Fixation vulnerability in Apache Kylin. This issue affects Apache Kylin: from 2.0.0 through 4.x. Users are recommended to upgrade to version 5.0.0 or above, which fixes the issue.
- Product
- Apache Kylin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Nov 1, 2024In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the restore function.CVE-2024-51252 · Network & remote access · draytek · reported by MITRECritical 9.8
In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the restore function.
- Product
- vigor3900_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2024LB-LINK BL-WR 1300H v.1.0.4 contains hardcoded credentials stored in /etc/shadow which are easily guessable.CVE-2024-51431 · Other software · lb-link · reported by MITRECritical 9.8
LB-LINK BL-WR 1300H v.1.0.4 contains hardcoded credentials stored in /etc/shadow which are easily guessable.
- Product
- bl-wr1300h_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2024IBOS v4.5.5 has an arbitrary file deletion vulnerability via \system\modules\dashboard\controllers\LoginController.php.CVE-2024-28265 · Other software · ibos · reported by MITRECritical 9.1
IBOS v4.5.5 has an arbitrary file deletion vulnerability via \system\modules\dashboard\controllers\LoginController.php.
- Product
- ibos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2024A SQL injection vulnerability exists in the `/api/v1/external-users` route of lunary-ai/lunary version v1.4.2.CVE-2024-7456 · Other software · lunary-ai · reported by security@huntr.devCritical 9.8
A SQL injection vulnerability exists in the `/api/v1/external-users` route of lunary-ai/lunary version v1.4.2. The `order by` clause of the SQL query uses `sql.unsafe` without prior sanitization, allowing for SQL injection. The `orderByClause` variable is constructed without server-side validation or sanitization, enabling an attacker to execute arbitrary SQL commands. Successful exploitation can lead to complete data loss, modification, or corruption.
- Product
- lunary-ai/lunary
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2024Qualitor v8.24 was discovered to contain a remote code execution (RCE) vulnerability via the gridValoresPopHidden parameter.CVE-2024-48359 · Other software · qualitor · reported by MITRECritical 9.8
Qualitor v8.24 was discovered to contain a remote code execution (RCE) vulnerability via the gridValoresPopHidden parameter.
- Product
- qualitor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comqualitor.com.br
Oct 31, 2024Glossarizer through 1.5.2 improperly tries to convert text into HTML.CVE-2024-42515 · Other software · pebbleroad · reported by MITRECritical 9.9
Glossarizer through 1.5.2 improperly tries to convert text into HTML. Even though the application itself escapes special characters (e.g., <>), the underlying library converts these encoded characters into legitimate HTML, thereby possibly causing stored XSS. Attackers can append a XSS payload to a word that has a corresponding glossary entry.
- Product
- glossarizer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comherolab.usd.de
Oct 31, 2024Webswing 23.2.2 allows remote attackers to modify client-side JavaScript code to achieve path traversal, likely leading to remote code execution via modificatioCVE-2024-39332 · Other software · webswing · reported by MITRECritical 9.8
Webswing 23.2.2 allows remote attackers to modify client-side JavaScript code to achieve path traversal, likely leading to remote code execution via modification of shell scripts on the server.
- Product
- webswing
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2024Studio-42 eLfinder 2.1.62 is vulnerable to Remote Code Execution (RCE) as there is no restriction for uploading files with the .php8 extension.CVE-2023-52044 · Other software · std42 · reported by MITRECritical 9.8
Studio-42 eLfinder 2.1.62 is vulnerable to Remote Code Execution (RCE) as there is no restriction for uploading files with the .php8 extension.
- Product
- elfinder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2024ZoneMinder is a free, open source closed-circuit television software application.CVE-2024-51482 · Other software · ZoneMinder · reported by GitHubCritical 9.9
ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder v1.37.* <= 1.37.64 is vulnerable to boolean-based SQL Injection in function of web/ajax/event.php. This is fixed in 1.37.65.
- Product
- zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2024YesWiki is a wiki system written in PHP.CVE-2024-51478 · Other software · YesWiki · reported by GitHubCritical 9.9
YesWiki is a wiki system written in PHP. Prior to 4.4.5, the use of a weak cryptographic algorithm and a hard-coded salt to hash the password reset key allows it to be recovered and used to reset the password of any account. This issue is fixed in 4.4.5.
- Product
- yeswiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2024DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the acme_process functioCVE-2024-51260 · Network & remote access · draytek · reported by MITRECritical 9.8
DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the acme_process function.
- Product
- vigor3900_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2024DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the ruequest_certificateCVE-2024-51255 · Network & remote access · draytek · reported by MITRECritical 9.8
DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the ruequest_certificate function.
- Product
- vigor3900_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2024DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG.CVE-2024-48910 · Other software · cure53 · reported by GitHubCritical 9.1
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify was vulnerable to prototype pollution. This vulnerability is fixed in 2.4.2.
- Product
- DOMPurify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2024DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the setup_cacertificate CVE-2024-51259 · Network & remote access · draytek · reported by MITRECritical 9.8
DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the setup_cacertificate function.
- Product
- vigor3900_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2024langflow v1.0.12 was discovered to contain a remote code execution (RCE) vulnerability via the PythonCodeTool component.CVE-2024-42835 · Other software · Langflow · reported by MITRECritical 9.8
langflow v1.0.12 was discovered to contain a remote code execution (RCE) vulnerability via the PythonCodeTool component.
- Product
- Langflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2024EKC Tournament Manager: Cross-Site Request Forgery (CSRF)CVE-2024-49674 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Cross-Site Request Forgery (CSRF) vulnerability in lukashuser EKC Tournament Manager ekc-tournament-manager allows Upload a Web Shell to a Web Server.This issue affects EKC Tournament Manager: from n/a through <= 2.2.1.
- Product
- EKC Tournament Manager
- Affected
- up to 2.2.1
- What to do
- Affects up to 2.2.1. Update EKC Tournament Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 31, 2024Podlove Podcast Publisher: Cross-Site Request Forgery (CSRF)CVE-2024-43984 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Cross-Site Request Forgery (CSRF) vulnerability in Podlove Podlove Podcast Publisher allows Code Injection.This issue affects Podlove Podcast Publisher: from n/a through 4.1.13.
- Product
- Podlove Podcast Publisher
- Affected
- up to 4.1.13
- What to do
- Affects up to 4.1.13. Update Podlove Podcast Publisher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 31, 2024AI Power: Complete AI Pack: Arbitrary file uploadsCVE-2024-10392 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The AI Power: Complete AI Pack plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'handle_image_upload' function in all versions up to, and including, 1.8.89. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- AI Power: Complete AI Pack
- Affected
- up to 1.8.89
- What to do
- Affects up to 1.8.89. Update AI Power: Complete AI Pack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 30, 2024JeecgBoot v3.7.1 was discovered to contain a SQL injection vulnerability via the component /onlDragDatasetHead/getTotalData.CVE-2024-48307 · Other software · jeecg · reported by MITRECritical 9.8
JeecgBoot v3.7.1 was discovered to contain a SQL injection vulnerability via the component /onlDragDatasetHead/getTotalData.
- Product
- jeecgboot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2024An issue in the PepeGxng smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact via the mint functioCVE-2024-51427 · Other software · ethereum · reported by MITRECritical 9.8
An issue in the PepeGxng smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact via the mint function. NOTE: this is disputed by third parties because the impact is limited to function calls.
- Product
- ethereum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2024An issue in the PepeGxng smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact via the Owned.setOwnCVE-2024-51424 · Other software · ethereum · reported by MITRECritical 9.8
An issue in the PepeGxng smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact via the Owned.setOwner function. NOTE: this is disputed by third parties because the impact is limited to function calls.
- Product
- ethereum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2024A deserialization vulnerability in the component \controller\Index.php of Thinkphp v6.1.3 to v8.0.4 allows attackers to execute arbitrary code.CVE-2024-48112 · Other software · thinkphp · reported by MITRECritical 9.8
A deserialization vulnerability in the component \controller\Index.php of Thinkphp v6.1.3 to v8.0.4 allows attackers to execute arbitrary code.
- Product
- thinkphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.