Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
38,829 results · page 299 of 777
Oct 30, 2024icecms <=3.4.7 has a File Upload vulnerability in FileUtils.java,uploadFile.CVE-2024-48202 · Other software · thecosy · reported by MITRECritical 9.8
icecms <=3.4.7 has a File Upload vulnerability in FileUtils.java,uploadFile.
- Product
- icecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2024Delta Electronics InfraSuite Device Master versions prior to 1.0.12 are affected by a deserialization vulnerability that targets the Device-Gateway, which couldCVE-2024-10456 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govCritical 9.3
Delta Electronics InfraSuite Device Master versions prior to 1.0.12 are affected by a deserialization vulnerability that targets the Device-Gateway, which could allow deserialization of arbitrary .NET objects prior to authentication.
- Product
- InfraSuite Device Master
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2024In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doGRETunnel function.CVE-2024-51298 · Network & remote access · draytek · reported by MITRECritical 9.8
In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doGRETunnel function.
- Product
- vigor3900
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2024The LevelOne WBR-6012 router's web application has a vulnerability in its firmware version R0.40e6, allowing attackers to change the administrator password and CVE-2024-33699 · Other software · LevelOne · reported by talos-cna@cisco.comCritical 9.9
The LevelOne WBR-6012 router's web application has a vulnerability in its firmware version R0.40e6, allowing attackers to change the administrator password and gain higher privileges without the current password.
- Product
- WBR-6012
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Oct 30, 2024The LevelOne WBR-6012 router with firmware R0.40e6 has an authentication bypass vulnerability in its web application due to reliance on client IP addresses for CVE-2024-23309 · Other software · LevelOne · reported by talos-cna@cisco.comCritical 9
The LevelOne WBR-6012 router with firmware R0.40e6 has an authentication bypass vulnerability in its web application due to reliance on client IP addresses for authentication. Attackers could spoof an IP address to gain unauthorized access without needing a session token.
- Product
- WBR-6012
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Oct 30, 2024W3SPEEDSTER: Remote Code ExecutionCVE-2024-8512 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The W3SPEEDSTER plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 7.26 via the 'script' parameter of the hookBeforeStartOptimization() function. This is due to the plugin passing user supplied input to eval(). This makes it possible for authenticated attackers, with Administrator-level access and above, to execute code on the server.
- Product
- W3SPEEDSTER
- Affected
- up to 7.26
- What to do
- Affects up to 7.26. Update W3SPEEDSTER to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 30, 2024WP donimedia carousel: Unrestricted Upload of File with Dangerous TypeCVE-2024-50511 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in donimedia WP donimedia carousel wp-donimedia-carousel allows Upload a Web Shell to a Web Server.This issue affects WP donimedia carousel: from n/a through <= 1.0.1.
- Product
- WP donimedia carousel
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update WP donimedia carousel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2024AR For Woocommerce: Unrestricted Upload of File with Dangerous TypeCVE-2024-50510 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in webandprint AR For Woocommerce ar-for-woocommerce allows Upload a Web Shell to a Web Server.This issue affects AR For Woocommerce: from n/a through <= 6.3.
- Product
- AR For Woocommerce
- Affected
- up to 6.3
- What to do
- Affects up to 6.3. Update AR For Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2024DS.DownloadList: Deserialization of Untrusted DataCVE-2024-50507 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Daschmi DS.DownloadList dsdownloadlist allows Object Injection.This issue affects DS.DownloadList: from n/a through <= 1.3.
- Product
- DS.DownloadList
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update DS.DownloadList to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2024User Toolkit: Authentication Bypass Using an Alternate Path or ChannelCVE-2024-50503 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in Deryck User Toolkit user-toolkit allows Authentication Bypass.This issue affects User Toolkit: from n/a through <= 1.2.3.
- Product
- User Toolkit
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update User Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2024CyberPanel (aka Cyber Panel) before 2.3.5 allows Command Injection via completePath in the ProcessUtilities.outputExecutioner() sink.CVE-2024-51568 · Other software · cyber_panel · reported by MITRECritical 10
CyberPanel (aka Cyber Panel) before 2.3.5 allows Command Injection via completePath in the ProcessUtilities.outputExecutioner() sink. There is /filemanager/upload (aka File Manager upload) unauthenticated remote code execution via shell metacharacters.
- Product
- cyber_panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcwe.mitre.orgcyberpanel.net
Oct 29, 2024CyberPanel Incorrect Default Permissions VulnerabilityCVE-2024-51567 · Other software · CyberPersons · reported by MITREExploitedRansomwareCritical 10
CyberPanel contains an incorrect default permissions vulnerability that allows a remote, unauthenticated attacker to execute commands as root.
- Product
- CyberPanel
- On CISA’s list since
- Nov 7, 2024 (federal fix deadline Nov 28, 2024)
- What to do
- Attackers are using this now. Install CyberPersons’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogcwe.mitre.orgcwe.mitre.org
Oct 29, 2024CyberPanel Incorrect Default Permissions VulnerabilityCVE-2024-51378 · Other software · CyberPersons · reported by MITREExploitedRansomwareCritical 10
CyberPanel contains an incorrect default permissions vulnerability that allows for authentication bypass and the execution of arbitrary commands using shell metacharacters in the statusfile property.
- Product
- CyberPanel
- On CISA’s list since
- Dec 4, 2024 (federal fix deadline Dec 25, 2024)
- What to do
- Attackers are using this now. Install CyberPersons’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogcwe.mitre.orgcwe.mitre.org
Oct 29, 2024A NoSQL injection vulnerability in AquilaCMS 1.409.20 and prior allows unauthenticated attackers to reset user and administrator account passwords via the "ReseCVE-2024-48573 · Other software · aquila · reported by MITRECritical 9.8
A NoSQL injection vulnerability in AquilaCMS 1.409.20 and prior allows unauthenticated attackers to reset user and administrator account passwords via the "Reset password" feature.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2024A remote code execution (RCE) vulnerability in the component /PluXml/core/admin/parametres_edittpl.php of PluXml v5.8.16 and lower allows attackers to execute aCVE-2024-48138 · Other software · pluxml · reported by MITRECritical 9.8
A remote code execution (RCE) vulnerability in the component /PluXml/core/admin/parametres_edittpl.php of PluXml v5.8.16 and lower allows attackers to execute arbitrary code via injecting a crafted payload into a template.
- Product
- pluxml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2024In Jitsi Meet before 2.0.9779, the functionality to share a video file was implemented in an insecure way, resulting in clients loading videos from an arbitraryCVE-2024-44081 · Other software · jitsi · reported by MITRECritical 9.8
In Jitsi Meet before 2.0.9779, the functionality to share a video file was implemented in an insecure way, resulting in clients loading videos from an arbitrary URL if a message from another participant contains a URL encoded in the expected format.
- Product
- meet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2024A Deserialization of Untrusted Data vulnerability in chainer v7.8.1.post1 leads to execution of arbitrary code.CVE-2024-48206 · Other software · chainer · reported by MITRECritical 9.8
A Deserialization of Untrusted Data vulnerability in chainer v7.8.1.post1 leads to execution of arbitrary code.
- Product
- chainer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comrumbling-slice-eb0.notion.site
Oct 29, 2024In PyTorch <=2.4.1, the RemoteModule has Deserialization RCE.CVE-2024-48063 · Other software · pytorch · reported by MITRECritical 9.8
In PyTorch <=2.4.1, the RemoteModule has Deserialization RCE. NOTE: this is disputed by multiple parties because this is intended behavior in PyTorch distributed computing.
- Product
- pytorch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Oct 29, 2024Crypto: Authentication bypassCVE-2024-9989 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Crypto plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.18. This is due to a limited arbitrary method call to 'crypto_connect_ajax_process::log_in' function in the 'crypto_connect_ajax_process' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username.
- Product
- Crypto
- Affected
- up to 2.18
- What to do
- Affects up to 2.18. Update Crypto to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 29, 2024Crypto: Authentication bypassCVE-2024-9988 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Crypto plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.19. This is due to missing validation on the user being supplied in the 'crypto_connect_ajax_process::register' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username.
- Product
- Crypto
- Affected
- up to 2.19
- What to do
- Affects up to 2.19. Update Crypto to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 29, 2024ServiceNow has addressed an input validation vulnerability that was identified in the Now Platform.CVE-2024-8923 · Other software · ServiceNow · reported by psirt@servicenow.comCritical 9.3
ServiceNow has addressed an input validation vulnerability that was identified in the Now Platform. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. ServiceNow deployed an update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. Further, the vulnerability is addressed in the listed patches and hot fixes.
- Product
- Now Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.servicenow.com
Oct 29, 2024Waitress is a Web Server Gateway Interface server for Python 2 and 3.CVE-2024-49768 · Other software · Pylons · reported by GitHubCritical 9.1
Waitress is a Web Server Gateway Interface server for Python 2 and 3. A remote client may send a request that is exactly recv_bytes (defaults to 8192) long, followed by a secondary request using HTTP pipelining. When request lookahead is disabled (default) we won't read any more requests, and when the first request fails due to a parsing error, we simply close the connection. However when request lookahead is enabled, it is possible to process and receive the first request, start sending the error message back to the client while we read the next request and queue it. This will allow the secondary request to be serviced by the worker thread while the connection should be closed. Waitress 3.0.1 fixes the race condition. As a workaround, disable channel_request_lookahead, this is set to 0 by default disabling this feature.
- Product
- waitress
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2024A vulnerability in the GraphCypherQAChain class of langchain-ai/langchain version 0.2.5 allows for SQL injection through prompt injection.CVE-2024-8309 · Other software · langchain-ai · reported by security@huntr.devCritical 9.8
A vulnerability in the GraphCypherQAChain class of langchain-ai/langchain version 0.2.5 allows for SQL injection through prompt injection. This vulnerability can lead to unauthorized data manipulation, data exfiltration, denial of service (DoS) by deleting all data, breaches in multi-tenant security environments, and data integrity issues. Attackers can create, update, or delete nodes and relationships without proper authorization, extract sensitive data, disrupt services, access data across different tenants, and compromise the integrity of the database.
- Product
- langchain-ai/langchain
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2024A path traversal vulnerability exists in the `getFullPath` method of langchain-ai/langchainjs version 0.2.5.CVE-2024-7774 · Other software · langchain-ai · reported by security@huntr.devCritical 9.1
A path traversal vulnerability exists in the `getFullPath` method of langchain-ai/langchainjs version 0.2.5. This vulnerability allows attackers to save files anywhere in the filesystem, overwrite existing text files, read `.txt` files, and delete files. The vulnerability is exploited through the `setFileContent`, `getParsedFile`, and `mdelete` methods, which do not properly sanitize user input.
- Product
- langchain-ai/langchainjs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2024An improper access control vulnerability in lunary-ai/lunary version 1.3.2 allows an attacker to update the SAML configuration without authorization.CVE-2024-7475 · Other software · lunary-ai · reported by security@huntr.devCritical 9.1
An improper access control vulnerability in lunary-ai/lunary version 1.3.2 allows an attacker to update the SAML configuration without authorization. This vulnerability can lead to manipulation of authentication processes, fraudulent login requests, and theft of user information. Appropriate access controls should be implemented to ensure that the SAML configuration can only be updated by authorized users.
- Product
- lunary-ai/lunary
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2024A vulnerability in the GraphCypherQAChain class of langchain-ai/langchainjs versions 0.2.5 and all versions with this class allows for prompt injection, leadingCVE-2024-7042 · Other software · langchain-ai · reported by security@huntr.devCritical 9.8
A vulnerability in the GraphCypherQAChain class of langchain-ai/langchainjs versions 0.2.5 and all versions with this class allows for prompt injection, leading to SQL injection. This vulnerability permits unauthorized data manipulation, data exfiltration, denial of service (DoS) by deleting all data, breaches in multi-tenant security environments, and data integrity issues. Attackers can create, update, or delete nodes and relationships without proper authorization, extract sensitive data, disrupt services, access data across different tenants, and compromise the integrity of the database.
- Product
- langchain-ai/langchainjs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2024mudler/LocalAI version 2.17.1 allows for arbitrary file write due to improper handling of automatic archive extraction.CVE-2024-6868 · Other software · mudler · reported by security@huntr.devCritical 9.8
mudler/LocalAI version 2.17.1 allows for arbitrary file write due to improper handling of automatic archive extraction. When model configurations specify additional files as archives (e.g., .tar), these archives are automatically extracted after downloading. This behavior can be exploited to perform a 'tarslip' attack, allowing files to be written to arbitrary locations on the server, bypassing checks that normally restrict files to the models directory. This vulnerability can lead to remote code execution (RCE) by overwriting backend assets used by the server.
- Product
- mudler/localai
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2024A vulnerability in the discussion image upload function of the Lollms application, version v9.9, allows for the uploading of SVG files.CVE-2024-6581 · Other software · parisneo · reported by security@huntr.devCritical 9
A vulnerability in the discussion image upload function of the Lollms application, version v9.9, allows for the uploading of SVG files. Due to incomplete filtering in the sanitize_svg function, this can lead to cross-site scripting (XSS) vulnerabilities, which in turn pose a risk of remote code execution. The sanitize_svg function only removes script elements and 'on*' event attributes, but does not account for other potential vectors for XSS within SVG files. This vulnerability can be exploited when authorized users access a malicious URL containing the crafted SVG file.
- Product
- parisneo/lollms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2024A path traversal vulnerability exists in the latest version of gaizhenbiao/chuanhuchatgpt.CVE-2024-5982 · Other software · gaizhenbiao · reported by security@huntr.devCritical 9.8
A path traversal vulnerability exists in the latest version of gaizhenbiao/chuanhuchatgpt. The vulnerability arises from unsanitized input handling in multiple features, including user upload, directory creation, and template loading. Specifically, the load_chat_history function in modules/models/base_model.py allows arbitrary file uploads, potentially leading to remote code execution (RCE). The get_history_names function in utils.py permits arbitrary directory creation. Additionally, the load_template function in utils.py can be exploited to leak the first column of CSV files. These issues stem from improper sanitization of user inputs concatenated with directory paths using os.path.join.
- Product
- gaizhenbiao/chuanhuchatgpt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2024A file overwrite vulnerability exists in gaizhenbiao/chuanhuchatgpt versions <= 20240410.CVE-2024-5823 · Other software · gaizhenbiao · reported by security@huntr.devCritical 9.1
A file overwrite vulnerability exists in gaizhenbiao/chuanhuchatgpt versions <= 20240410. This vulnerability allows an attacker to gain unauthorized access to overwrite critical configuration files within the system. Exploiting this vulnerability can lead to unauthorized changes in system behavior or security settings. Additionally, tampering with these configuration files can result in a denial of service (DoS) condition, disrupting normal system operation.
- Product
- gaizhenbiao/chuanhuchatgpt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2024PegaPoll: Missing AuthorizationCVE-2024-50490 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Missing Authorization vulnerability in lowcage PegaPoll pegapoll allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects PegaPoll: from n/a through <= 1.0.2.
- Product
- PegaPoll
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update PegaPoll to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2024Exam Matrix: Incorrect Privilege AssignmentCVE-2024-50485 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in Udit Rawat Exam Matrix exam-matrix allows Privilege Escalation.This issue affects Exam Matrix: from n/a through <= 1.5.
- Product
- Exam Matrix
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update Exam Matrix to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2024GRÜN spendino Spendenformular: Missing AuthorizationCVE-2024-50476 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Missing Authorization vulnerability in GRÜN Software Group GmbH GRÜN spendino Spendenformular spendino allows Privilege Escalation.This issue affects GRÜN spendino Spendenformular: from n/a through <= 1.0.1.
- Product
- GRÜN spendino Spendenformular
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update GRÜN spendino Spendenformular to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2024Signup Page: Missing AuthorizationCVE-2024-50475 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Missing Authorization vulnerability in Scott Gamon Signup Page signup-page allows Privilege Escalation.This issue affects Signup Page: from n/a through <= 1.0.
- Product
- Signup Page
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Signup Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2024Ajar in5 Embed: Unrestricted Upload of File with Dangerous TypeCVE-2024-50473 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in Ajar Productions Ajar in5 Embed ajar-productions-in5-embed allows Upload a Web Shell to a Web Server.This issue affects Ajar in5 Embed: from n/a through <= 3.1.3.
- Product
- Ajar in5 Embed
- Affected
- up to 3.1.3
- What to do
- Affects up to 3.1.3. Update Ajar in5 Embed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2024SurveyJS: Unrestricted Upload of File with Dangerous TypeCVE-2024-50427 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in devsoftbaltic SurveyJS surveyjs.This issue affects SurveyJS: from n/a through <= 1.9.136.
- Product
- SurveyJS
- Affected
- up to 1.9.136
- What to do
- Affects up to 1.9.136. Update SurveyJS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2024aDirectory: Unrestricted Upload of File with Dangerous TypeCVE-2024-50420 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in aDirectory aDirectory adirectory allows Upload a Web Shell to a Web Server.This issue affects aDirectory: from n/a through <= 1.3.
- Product
- aDirectory
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update aDirectory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2024Sudan Payment Gateway for WooCommerce: Unrestricted Upload of File with Dangerous TypeCVE-2024-50494 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in Amin Omer Sudan Payment Gateway for WooCommerce wc-sudan-payment-gateway allows Upload a Web Shell to a Web Server.This issue affects Sudan Payment Gateway for WooCommerce: from n/a through <= 1.2.2.
- Product
- Sudan Payment Gateway for WooCommerce
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Sudan Payment Gateway for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2024Automatic Translation: Unrestricted Upload of File with Dangerous TypeCVE-2024-50493 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in masterhomepage Automatic Translation automatic-translation allows Upload a Web Shell to a Web Server.This issue affects Automatic Translation: from n/a through <= 1.0.4.
- Product
- Automatic Translation
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update Automatic Translation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2024Multi Purpose Mail Form: Unrestricted Upload of File with Dangerous TypeCVE-2024-50484 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in Lindeni Mahlalela Multi Purpose Mail Form multi-purpose-mail-form allows Upload a Web Shell to a Web Server.This issue affects Multi Purpose Mail Form: from n/a through <= 1.0.2.
- Product
- Multi Purpose Mail Form
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Multi Purpose Mail Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2024Woocommerce Product Design: Unrestricted Upload of File with Dangerous TypeCVE-2024-50482 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in Chetan Khandla Woocommerce Product Design woo-product-design allows Upload a Web Shell to a Web Server.This issue affects Woocommerce Product Design: from n/a through <= 1.0.0.
- Product
- Woocommerce Product Design
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Woocommerce Product Design to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2024Marketing Automation by AZEXO: Unrestricted Upload of File with Dangerous TypeCVE-2024-50480 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in azexo Marketing Automation by AZEXO marketing-automation-by-azexo allows Upload a Web Shell to a Web Server.This issue affects Marketing Automation by AZEXO: from n/a through <= 1.27.80.
- Product
- Marketing Automation by AZEXO
- Affected
- up to 1.27.80
- What to do
- Affects up to 1.27.80. Update Marketing Automation by AZEXO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 28, 2024In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix user-after-free from session log off There is racy issue between smb2 session lCVE-2024-50086 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Critical 9.8
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix user-after-free from session log off There is racy issue between smb2 session log off and smb2 session setup. It will cause user-after-free from session log off. This add session_lock when setting SMB2_SESSION_EXPIRED and referece count to session struct not to free session while it is being used.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Oct 28, 2024In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: fix UaF read in mptcp_pm_nl_rm_addr_or_subflow Syzkaller reported this splat: CVE-2024-50085 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Critical 9.8
In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: fix UaF read in mptcp_pm_nl_rm_addr_or_subflow Syzkaller reported this splat: ================================================================== BUG: KASAN: slab-use-after-free in mptcp_pm_nl_rm_addr_or_subflow+0xb44/0xcc0 net/mptcp/pm_netlink.c:881 Read of size 4 at addr ffff8880569ac858 by task syz.1.2799/14662 CPU: 0 UID: 0 PID: 14662 Comm: syz.1.2799 Not tainted 6.12.0-rc2-syzkaller-00307-g36c254515dc6 #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:377 [inline] print_report+0xc3/0x620 mm/kasan/report.c:488 kasan_report+0xd9/0x110 mm/kasan/report.c:601 mptcp_pm_nl_rm_addr_or_subflow+0xb44/0xcc0 net/mptcp/pm_netlink.c:881 mptcp_pm_nl_rm_subflow_received net/mptcp/pm_netlink.c:914 [inline] mptcp_nl_remove_id_zero_address+0x305/0x4a0 net/mptcp/pm_netlink.c:1572 mptcp_pm_nl_del_addr_doit+0x5c9/0x770 net/mptcp/pm_netlink.c:1603 genl_family_rcv_msg_doit+0
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Oct 28, 2024IBM Flexible Service Processor (FSP) FW860.00 through FW860.B3, FW950.00 through FW950.C0, FW1030.00 through FW1030.61, FW1050.00 through FW1050.21, and FW1060.CVE-2024-45656 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.8
IBM Flexible Service Processor (FSP) FW860.00 through FW860.B3, FW950.00 through FW950.C0, FW1030.00 through FW1030.61, FW1050.00 through FW1050.21, and FW1060.00 through FW1060.10 has static credentials which may allow network users to gain service privileges to the FSP.
- Product
- Flexible Service Processor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2024A permissions issue was addressed by removing vulnerable code and adding additional checks.CVE-2024-44217 · Computers, phones & browsers · Apple · reported by product-security@apple.comCritical 9.1
A permissions issue was addressed by removing vulnerable code and adding additional checks. This issue is fixed in iOS 18 and iPadOS 18. Password autofill may fill in passwords after failing authentication.
- Product
- iOS and iPadOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2024AR For: Unrestricted Upload of File with Dangerous TypeCVE-2024-50496 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in webandprint AR For WordPress ar-for-wordpress allows Upload a Web Shell to a Web Server.This issue affects AR For WordPress: from n/a through <= 6.6.
- Product
- AR For
- Affected
- up to 6.6
- What to do
- Affects up to 6.6. Update AR For to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 28, 2024Plugin Propagator: Unrestricted Upload of File with Dangerous TypeCVE-2024-50495 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in nunomorgadinho Plugin Propagator wp-propagator allows Upload a Web Shell to a Web Server.This issue affects Plugin Propagator: from n/a through <= 0.1.
- Product
- Plugin Propagator
- Affected
- up to 0.1
- What to do
- Affects up to 0.1. Update Plugin Propagator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 28, 2024LyLme Spage <=1.6.0 is vulnerable to SQL Injection via /admin/group.php.CVE-2024-48356 · Other software · lylme · reported by MITRECritical 9.8
LyLme Spage <=1.6.0 is vulnerable to SQL Injection via /admin/group.php.
- Product
- lylme_spage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2024A custom URL scheme handling issue was addressed with improved input validation.CVE-2024-40867 · Computers, phones & browsers · Apple · reported by product-security@apple.comCritical 9.6
A custom URL scheme handling issue was addressed with improved input validation. This issue is fixed in iOS 18.1 and iPadOS 18.1. A remote attacker may be able to break out of Web Content sandbox.
- Product
- iOS and iPadOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comseclists.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.