Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
445 results · page 3 of 9
Dec 27, 2024In the Linux kernel, the following vulnerability has been resolved: erofs: handle NONHEAD !delta[1] lclusters gracefully syzbot reported a WARNING in iomap_itCVE-2024-53234 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: erofs: handle NONHEAD !delta[1] lclusters gracefully syzbot reported a WARNING in iomap_iter_done: iomap_fiemap+0x73b/0x9b0 fs/iomap/fiemap.c:80 ioctl_fiemap fs/ioctl.c:220 [inline] Generally, NONHEAD lclusters won't have delta[1]==0, except for crafted images and filesystems created by pre-1.0 mkfs versions. Previously, it would immediately bail out if delta[1]==0, which led to inadequate decompressed lengths (thus FIEMAP is impacted). Treat it as delta[1]=1 to work around these legacy mkfs versions. `lclusterbits > 14` is illegal for compact indexes, error out too.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Dec 20, 2024Delta Electronics DTM Soft deserializes objects, which could allow an attacker to execute arbitrary code.CVE-2024-12677 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.5
Delta Electronics DTM Soft deserializes objects, which could allow an attacker to execute arbitrary code.
- Product
- DTM Soft
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownloadcenter.deltaww.comcisa.gov
Nov 11, 2024If an attacker tricks a valid user into running Delta Electronics DIAScreen with a file containing malicious code, a stack-based buffer overflow in BACnetObjectCVE-2024-47131 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.4
If an attacker tricks a valid user into running Delta Electronics DIAScreen with a file containing malicious code, a stack-based buffer overflow in BACnetObjectInfo can be exploited, allowing the attacker to remotely execute arbitrary code.
- Product
- DIAScreen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2024If an attacker tricks a valid user into running Delta Electronics DIAScreen with a file containing malicious code, a stack-based buffer overflow in BACnetParameCVE-2024-39605 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.4
If an attacker tricks a valid user into running Delta Electronics DIAScreen with a file containing malicious code, a stack-based buffer overflow in BACnetParameter can be exploited, allowing the attacker to remotely execute arbitrary code.
- Product
- DIAScreen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2024If an attacker tricks a valid user into running Delta Electronics DIAScreen with a file containing malicious code, a stack-based buffer overflow in CEtherIPTagICVE-2024-39354 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.4
If an attacker tricks a valid user into running Delta Electronics DIAScreen with a file containing malicious code, a stack-based buffer overflow in CEtherIPTagItem can be exploited, allowing the attacker to remotely execute arbitrary code.
- Product
- DIAScreen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2024Delta Electronics InfraSuite Device Master versions prior to 1.0.12 are affected by a deserialization vulnerability that targets the Device-Gateway, which couldCVE-2024-10456 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govCritical 9.3
Delta Electronics InfraSuite Device Master versions prior to 1.0.12 are affected by a deserialization vulnerability that targets the Device-Gateway, which could allow deserialization of arbitrary .NET objects prior to authentication.
- Product
- InfraSuite Device Master
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2024In the Linux kernel, the following vulnerability has been resolved: tcp: check skb is non-NULL in tcp_rto_delta_us() We have some machines running stock UbuntCVE-2024-47684 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: tcp: check skb is non-NULL in tcp_rto_delta_us() We have some machines running stock Ubuntu 20.04.6 which is their 5.4.0-174-generic kernel that are running ceph and recently hit a null ptr dereference in tcp_rearm_rto(). Initially hitting it from the TLP path, but then later we also saw it getting hit from the RACK case as well. Here are examples of the oops messages we saw in each of those cases: Jul 26 15:05:02 rx [11061395.780353] BUG: kernel NULL pointer dereference, address: 0000000000000020 Jul 26 15:05:02 rx [11061395.787572] #PF: supervisor read access in kernel mode Jul 26 15:05:02 rx [11061395.792971] #PF: error_code(0x0000) - not-present page Jul 26 15:05:02 rx [11061395.798362] PGD 0 P4D 0 Jul 26 15:05:02 rx [11061395.801164] Oops: 0000 [#1] SMP NOPTI Jul 26 15:05:02 rx [11061395.805091] CPU: 0 PID: 9180 Comm: msgr-worker-1 Tainted: G W 5.4.0-174-generic #193-Ubuntu Jul 26 15:05:02 rx [11061395.814996] Hardware name: Supermicro SMC 2x26 os-gen8 64C NVME-Y 256G/H12SSW-NTR, BIOS 2.5.V1.2U.NVMe.UEFI 05/09/2023 Jul 26 15:05:02 rx [11061395.825952] RIP: 0010:tcp_rearm_rto+0xe4/0x160 Jul 26 15:05:02 rx [1
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Oct 10, 2024Delta Electronics CNCSoft-G2 lacks proper initialization of memory prior to accessing it.CVE-2024-47966 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.4
Delta Electronics CNCSoft-G2 lacks proper initialization of memory prior to accessing it. An attacker can manipulate users to visit a malicious page or file to leverage this vulnerability to execute code in the context of the current process.
- Product
- CNCSoft-G2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2024Delta Electronics CNCSoft-G2 lacks proper validation of user-supplied data, which can result in a read past the end of an allocated buffer.CVE-2024-47965 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.4
Delta Electronics CNCSoft-G2 lacks proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can manipulate users to visit a malicious page or file to leverage this vulnerability to execute code in the context of the current process.
- Product
- CNCSoft-G2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2024Delta Electronics CNCSoft-G2 lacks proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer.CVE-2024-47964 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.4
Delta Electronics CNCSoft-G2 lacks proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can manipulate users to visit a malicious page or file to leverage this vulnerability to execute code in the context of the current process.
- Product
- CNCSoft-G2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2024Delta Electronics CNCSoft-G2 lacks proper validation of user-supplied data, which can result in a write past the end of an allocated object.CVE-2024-47963 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.4
Delta Electronics CNCSoft-G2 lacks proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attacker can manipulate users to visit a malicious page or file to leverage this vulnerability to execute code in the context of the current process.
- Product
- CNCSoft-G2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2024Delta Electronics CNCSoft-G2 lacks proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer.CVE-2024-47962 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.4
Delta Electronics CNCSoft-G2 lacks proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can manipulate an insider to visit a malicious page or file to leverage this vulnerability to execute code in the context of the current process.
- Product
- CNCSoft-G2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2024execute_filter_delta in archive_read_support_format_rar.c in libarchive before 3.7.5 allows out-of-bounds access via a crafted archive file because src can moveCVE-2024-48958 · Other software · libarchive · reported by MITREHigh 7.8
execute_filter_delta in archive_read_support_format_rar.c in libarchive before 3.7.5 allows out-of-bounds access via a crafted archive file because src can move beyond dst.
- Product
- libarchive
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2024Delta Electronics DIAEnergie is vulnerable to an SQL injection in the script AM_RegReport.aspx.CVE-2024-43699 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govCritical 9.3
Delta Electronics DIAEnergie is vulnerable to an SQL injection in the script AM_RegReport.aspx. An unauthenticated attacker may be able to exploit this issue to obtain records contained in the targeted product.
- Product
- DIAEnergie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2024Delta Electronics DIAEnergie is vulnerable to an SQL injection in the script Handler_CFG.ashx.CVE-2024-42417 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.7
Delta Electronics DIAEnergie is vulnerable to an SQL injection in the script Handler_CFG.ashx. An authenticated attacker may be able to exploit this issue to cause delay in the targeted product.
- Product
- DIAEnergie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2024Delta Electronics DTN Soft version 2.0.1 and prior are vulnerable to an attacker achieving remote code execution through a deserialization of untrusted data vulCVE-2024-8255 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.4
Delta Electronics DTN Soft version 2.0.1 and prior are vulnerable to an attacker achieving remote code execution through a deserialization of untrusted data vulnerability.
- Product
- DTN Soft
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2024A crafted DPA file could force Delta Electronics DIAScreen to overflow a stack-based buffer, which could allow an attacker to execute arbitrary code.CVE-2024-7502 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.5
A crafted DPA file could force Delta Electronics DIAScreen to overflow a stack-based buffer, which could allow an attacker to execute arbitrary code.
- Product
- DIAScreen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2024Delta Electronics CNCSoft-G2 lacks proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer.CVE-2024-39883 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.4
Delta Electronics CNCSoft-G2 lacks proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. If a target visits a malicious page or opens a malicious file an attacker can leverage this vulnerability to execute code in the context of the current process.
- Product
- CNCSoft-G2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2024Delta Electronics CNCSoft-G2 lacks proper validation of user-supplied data, which can result in a read past the end of an allocated buffer.CVE-2024-39882 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.4
Delta Electronics CNCSoft-G2 lacks proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. If a target visits a malicious page or opens a malicious file an attacker can leverage this vulnerability to execute code in the context of the current process.
- Product
- CNCSoft-G2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2024Delta Electronics CNCSoft-G2 lacks proper validation of user-supplied data, which can result in a memory corruption condition.CVE-2024-39881 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.4
Delta Electronics CNCSoft-G2 lacks proper validation of user-supplied data, which can result in a memory corruption condition. If a target visits a malicious page or opens a malicious file an attacker can leverage this vulnerability to execute code in the context of the current process.
- Product
- CNCSoft-G2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2024Delta Electronics CNCSoft-G2 lacks proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer.CVE-2024-39880 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.4
Delta Electronics CNCSoft-G2 lacks proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. If a target visits a malicious page or opens a malicious file an attacker can leverage this vulnerability to execute code in the context of the current process.
- Product
- CNCSoft-G2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2024A denial of service vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior.CVE-2024-4549 · Other software · Delta Electronics · reported by vulnreport@tenable.comHigh 7.5
A denial of service vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior. When processing an 'ICS Restart!' message, CEBC.exe restarts the system.
- Product
- DIAEnergie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
May 6, 2024An SQLi vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior when CEBC.exe processes a 'RecalculateHDMWYC' message, which is split into 4CVE-2024-4548 · Other software · Delta Electronics · reported by vulnreport@tenable.comCritical 9.8
An SQLi vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior when CEBC.exe processes a 'RecalculateHDMWYC' message, which is split into 4 fields using the '~' character as the separator. An unauthenticated remote attacker can perform SQLi via the fourth field.
- Product
- DIAEnergie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
May 6, 2024A SQLi vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior when CEBC.exe processes a 'RecalculateScript' message, which is splitted intoCVE-2024-4547 · Other software · Delta Electronics · reported by vulnreport@tenable.comCritical 9.8
A SQLi vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior when CEBC.exe processes a 'RecalculateScript' message, which is splitted into 4 fields using the '~' character as the separator. An unauthenticated remote attacker can perform SQLi via the fourth field
- Product
- DIAEnergie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
May 2, 2024 Delta Electronics DIAEnergie has insufficient input validation which makes it possible to perform a path traversal attack and write outside of the intended dirCVE-2024-34033 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.8
Delta Electronics DIAEnergie has insufficient input validation which makes it possible to perform a path traversal attack and write outside of the intended directory. If a file name is specified that already exists on the file system, then the original file will be overwritten.
- Product
- DIAEnergie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2024 Delta Electronics DIAEnergie is vulnerable to an SQL injection vulnerability that exists in the GetDIACloudList endpoint.CVE-2024-34032 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.8
Delta Electronics DIAEnergie is vulnerable to an SQL injection vulnerability that exists in the GetDIACloudList endpoint. An authenticated attacker can exploit this issue to potentially compromise the system on which DIAEnergie is deployed.
- Product
- DIAEnergie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2024 Delta Electronics DIAEnergie is vulnerable to an SQL injection vulnerability that exists in the script Handler_CFG.ashx.CVE-2024-34031 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.8
Delta Electronics DIAEnergie is vulnerable to an SQL injection vulnerability that exists in the script Handler_CFG.ashx. An authenticated attacker can exploit this issue to potentially compromise the system on which DIAEnergie is deployed.
- Product
- DIAEnergie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2024 Delta Electronics CNCSoft-G2 lacks proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer.CVE-2024-4192 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 7.8
Delta Electronics CNCSoft-G2 lacks proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.
- Product
- CNCSoft-G2 DOPSoft
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2024The Delta Electronics DVW-W02W2-E2 devices expose a web administration interface to users.CVE-2024-3871 · Other software · Deltra Electronics · reported by research@onekey.comCritical 9.8
The Delta Electronics DVW-W02W2-E2 devices expose a web administration interface to users. This interface implements multiple features that are affected by command injections and stack overflows vulnerabilities. Successful exploitation of these flaws would allow remote unauthenticated attackers to gain remote code execution with elevated privileges on the affected devices. This issue affects DVW-W02W2-E2 through version 2.5.2.
- Product
- DVW-W02W2-E2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2024 SQL injection vulnerability exists in GetDIAE_usListParameters.CVE-2024-25574 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.8
SQL injection vulnerability exists in GetDIAE_usListParameters.
- Product
- DIAEnergie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2024 It is possible to perform a path traversal attack and write outside of the intended directory.CVE-2024-28171 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.1
It is possible to perform a path traversal attack and write outside of the intended directory. If a file name is specified that already exists on the file system, then the original file will be overwritten.
- Product
- DIAEnergie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2024 Improper neutralization of input within the affected product could lead to cross-site scripting.CVE-2024-28045 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govMedium 4.6
Improper neutralization of input within the affected product could lead to cross-site scripting.
- Product
- DIAEnergie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2024 SQL injection vulnerability exists in GetDIAE_astListParameters.CVE-2024-28040 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.8
SQL injection vulnerability exists in GetDIAE_astListParameters.
- Product
- DIAEnergie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2024 Path traversal attack is possible and write outside of the intended directory and may access sensitive information.CVE-2024-25567 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.1
Path traversal attack is possible and write outside of the intended directory and may access sensitive information. If a file name is specified that already exists on the file system, then the original file will be overwritten.
- Product
- DIAEnergie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2024 SQL injection vulnerability exists in GetDIAE_slogListParameters.CVE-2024-23975 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.8
SQL injection vulnerability exists in GetDIAE_slogListParameters.
- Product
- DIAEnergie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2024 SQL injection vulnerability exists in GetDIAE_unListParameters.CVE-2024-23494 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.8
SQL injection vulnerability exists in GetDIAE_unListParameters.
- Product
- DIAEnergie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2024 SQL injection vulnerability exists in the script Handler_CFG.ashx.CVE-2024-28891 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.8
SQL injection vulnerability exists in the script Handler_CFG.ashx.
- Product
- DIAEnergie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2024Privileges are not fully verified server-side, which can be abused by a user with limited privileges to bypass authorization and access privileged functionalityCVE-2024-28029 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.8
Privileges are not fully verified server-side, which can be abused by a user with limited privileges to bypass authorization and access privileged functionality.
- Product
- DIAEnergie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2024 SQL injection vulnerability exists in the script DIAE_tagHandler.ashx.CVE-2024-25937 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.8
SQL injection vulnerability exists in the script DIAE_tagHandler.ashx.
- Product
- DIAEnergie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 29, 2024 Delta Electronics CNCSoft-B versions 1.0.0.4 and prior are vulnerable to a stack-based buffer overflow, which may allow an attacker to execute arbitrary code.CVE-2024-1941 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 7.8
Delta Electronics CNCSoft-B versions 1.0.0.4 and prior are vulnerable to a stack-based buffer overflow, which may allow an attacker to execute arbitrary code.
- Product
- CNCSoft-B
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 29, 2024Delta Electronics CNCSoft-B DOPSoft prior to v4.0.0.82 insecurely loads libraries, which may allow an attacker to use DLL hijacking and take over the system wCVE-2024-1595 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 7.8
Delta Electronics CNCSoft-B DOPSoft prior to v4.0.0.82 insecurely loads libraries, which may allow an attacker to use DLL hijacking and take over the system where the software is installed.
- Product
- CNCSoft-B v1.0.0.4 DOPSoft
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2024A heap buffer-overflow exists in Delta Electronics ISPSoft.CVE-2023-5131 · Other software · Delta Electronics · reported by disclosures@exodusintel.comHigh 8.2
A heap buffer-overflow exists in Delta Electronics ISPSoft. An anonymous attacker can exploit this vulnerability by enticing a user to open a specially crafted DVP file to achieve code execution.
- Product
- ISPSoft
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.exodusintel.comblog.exodusintel.com
Jan 18, 2024A buffer overflow vulnerability exists in Delta Electronics WPLSoft.CVE-2023-5130 · Other software · Delta Electronics · reported by disclosures@exodusintel.comHigh 8.2
A buffer overflow vulnerability exists in Delta Electronics WPLSoft. An anonymous attacker can exploit this vulnerability by enticing a user to open a specially crafted DVP file to achieve code execution.
- Product
- WPLSoft
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.exodusintel.comblog.exodusintel.com
Jan 18, 2024A stack based buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft when parsing the wTitleTextLen field of a DPS file.CVE-2023-43824 · Other software · Delta Electronics · reported by disclosures@exodusintel.comHigh 8.8
A stack based buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft when parsing the wTitleTextLen field of a DPS file. A remote, unauthenticated attacker can exploit this vulnerability by enticing a user to open a specially crafted DPS file to achieve remote code execution.
- Product
- DOPSoft
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.exodusintel.comblog.exodusintel.com
Jan 18, 2024A stack based buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft when parsing the wTTitleLen field of a DPS file.CVE-2023-43823 · Other software · Delta Electronics · reported by disclosures@exodusintel.comHigh 8.8
A stack based buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft when parsing the wTTitleLen field of a DPS file. A remote, unauthenticated attacker can exploit this vulnerability by enticing a user to open a specially crafted DPS file to achieve remote code execution.
- Product
- DOPSoft
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.exodusintel.comblog.exodusintel.com
Jan 18, 2024A stack based buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft when parsing the wLogTitlesTimeLen field of a DPS file.CVE-2023-43822 · Other software · Delta Electronics · reported by disclosures@exodusintel.comHigh 8.8
A stack based buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft when parsing the wLogTitlesTimeLen field of a DPS file. A remote, unauthenticated attacker can exploit this vulnerability by enticing a user to open a specially crafted DPS file to achieve remote code execution.
- Product
- DOPSoft
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.exodusintel.comblog.exodusintel.com
Jan 18, 2024A stack based buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft when parsing the wLogTitlesActionLen field of a DPS file.CVE-2023-43821 · Other software · Delta Electronics · reported by disclosures@exodusintel.comHigh 8.8
A stack based buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft when parsing the wLogTitlesActionLen field of a DPS file. A remote, unauthenticated attacker can exploit this vulnerability by enticing a user to open a specially crafted DPS file to achieve remote code execution.
- Product
- DOPSoft
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.exodusintel.comblog.exodusintel.com
Jan 18, 2024A stack based buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft when parsing the wLogTitlesPrevValueLen field of a DPS file.CVE-2023-43820 · Other software · Delta Electronics · reported by disclosures@exodusintel.comHigh 8.8
A stack based buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft when parsing the wLogTitlesPrevValueLen field of a DPS file. A remote, unauthenticated attacker can exploit this vulnerability by enticing a user to open a specially crafted DPS file to achieve remote code execution.
- Product
- DOPSoft
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.exodusintel.comblog.exodusintel.com
Jan 18, 2024A stack based buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft when parsing the InitialMacroLen field of a DPS file.CVE-2023-43819 · Other software · Delta Electronics · reported by disclosures@exodusintel.comHigh 8.8
A stack based buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft when parsing the InitialMacroLen field of a DPS file. A remote, unauthenticated attacker can exploit this vulnerability by enticing a user to open a specially crafted DPS file to achieve remote code execution.
- Product
- DOPSoft
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.exodusintel.comblog.exodusintel.com
Jan 18, 2024A buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft.CVE-2023-43818 · Other software · Delta Electronics · reported by disclosures@exodusintel.comHigh 8.8
A buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft. A remote, unauthenticated attacker can exploit this vulnerability by enticing a user to open a specially crafted DPS file to achieve remote code execution.
- Product
- DOPSoft
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.exodusintel.comblog.exodusintel.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.