Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
38,838 results · page 306 of 777
Oct 1, 2024Echo RSS Feed Post Generator: Privilege escalationCVE-2024-9265 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Echo RSS Feed Post Generator plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 5.4.6. This is due to the plugin not properly restricting the roles that can set during registration through the echo_check_post_header_sent() function. This makes it possible for unauthenticated attackers to register as an administrator.
- Product
- Echo RSS Feed Post Generator
- Affected
- up to 5.4.6
- What to do
- Affects up to 5.4.6. Update Echo RSS Feed Post Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Oct 1, 2024Wechat Social login: Arbitrary file uploadsCVE-2024-9108 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Wechat Social login plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'convert_remoteimage_to_local' function in versions up to, and including, 1.3.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- Wechat Social login
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update Wechat Social login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 1, 2024Wechat Social login: Authentication bypassCVE-2024-9106 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Wechat Social login plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.3.0. This is due to insufficient verification on the user being supplied during the social login. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the user id. This is only exploitable if the app secret is not set, so it has a default empty value.
- Product
- Wechat Social login
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update Wechat Social login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 30, 2024An issue was discovered in Atos Eviden iCare 2.7.1 through 2.7.11.CVE-2024-42017 · Other software · reported by MITRECritical 10
An issue was discovered in Atos Eviden iCare 2.7.1 through 2.7.11. The application exposes a web interface locally. In the worst-case scenario, if the application is remotely accessible, it allows an attacker to execute arbitrary commands with system privilege on the endpoint hosting the application, without any authentication.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordeviden.comsupport.bull.com
Sep 30, 2024Certain switch models from PLANET Technology lack proper access control in firmware upload and download functionality, allowing unauthenticated remote attackersCVE-2024-8456 · Other software · PLANET Technology · reported by twcert@cert.org.twCritical 9.8
Certain switch models from PLANET Technology lack proper access control in firmware upload and download functionality, allowing unauthenticated remote attackers to download and upload firmware and system configurations, ultimately gaining full control of the devices.
- Product
- GS-4210-24PL4C hardware 2.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Sep 27, 2024GiveWP – Donation Plugin and Fundraising Platform: PHP Object InjectionCVE-2024-8353 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.16.1 via deserialization of untrusted input via several parameters like 'give_title' and 'card_address'. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to delete arbitrary files and achieve remote code execution. This is essentially the same vulnerability as CVE-2024-5932, however, it was discovered the the presence of stripslashes_deep on user_info allows the is_serialized check to be bypassed. This issue was mostly patched in 3.16.1, but further hardening was added in 3.16.2.
- Product
- GiveWP – Donation Plugin and Fundraising Platform
- Affected
- up to 3.16.1
- What to do
- Affects up to 3.16.1. Update GiveWP – Donation Plugin and Fundraising Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 27, 2024A Command injection vulnerability in requestLetsEncryptSsl in NginxProxyManager 2.11.3 allows an attacker to RCE via Add Let's Encrypt Certificate.CVE-2024-46256 · Websites & servers · nginxproxymanager · reported by MITRECritical 9.8
A Command injection vulnerability in requestLetsEncryptSsl in NginxProxyManager 2.11.3 allows an attacker to RCE via Add Let's Encrypt Certificate.
- Product
- nginx_proxy_manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2024Alisonic Sibylla devices are vulnerable to SQL injection attacks, which could allow complete access to the database.CVE-2024-8630 · Other software · Alisonic · reported by ics-cert@hq.dhs.govCritical 9.3
Alisonic Sibylla devices are vulnerable to SQL injection attacks, which could allow complete access to the database.
- Product
- Sibylla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2024OPW Fuel Management Systems SiteSentinel could allow an attacker to bypass authentication to the server and obtain full admin privileges.CVE-2024-8310 · Other software · OPW Fuel Managements Systems · reported by ics-cert@hq.dhs.govCritical 9.8
OPW Fuel Management Systems SiteSentinel could allow an attacker to bypass authentication to the server and obtain full admin privileges.
- Product
- SiteSentinel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2024OMNTEC Proteus Tank Monitoring OEL8000III Series could allow an attacker to perform administrative actions without proper authentication.CVE-2024-6981 · Other software · OMNTEC · reported by ics-cert@hq.dhs.govCritical 9.3
OMNTEC Proteus Tank Monitoring OEL8000III Series could allow an attacker to perform administrative actions without proper authentication.
- Product
- Proteus Tank Monitoring
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2024A Stored Cross-Site Scripting (XSS) vulnerability in Webkul Krayin CRM 1.3.0 allows remote attackers to inject arbitrary JavaScript code by submitting a malicioCVE-2024-46367 · Other software · webkul · reported by MITRECritical 9.6
A Stored Cross-Site Scripting (XSS) vulnerability in Webkul Krayin CRM 1.3.0 allows remote attackers to inject arbitrary JavaScript code by submitting a malicious payload within the username field. This can lead to privilege escalation when the payload is executed, granting the attacker elevated permissions within the CRM system.
- Product
- krayin_crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2024Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Western Digital My Cloud ddns-start on Linux allows Overflow Buffers.ThCVE-2024-22170 · Network & remote access · Western Digital · reported by psirt@wdc.comCritical 9.2
Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Western Digital My Cloud ddns-start on Linux allows Overflow Buffers.This issue affects My Cloud: before 5.29.102.
- Product
- My Cloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2024authentik is an open-source identity provider.CVE-2024-47070 · Other software · goauthentik · reported by GitHubCritical 9
authentik is an open-source identity provider. A vulnerability that exists in versions prior to 2024.8.3 and 2024.6.5 allows bypassing password login by adding X-Forwarded-For header with an unparsable IP address, e.g. `a`. This results in a possibility of logging into any account with a known login or email address. The vulnerability requires the authentik instance to trust X-Forwarded-For header provided by the attacker, thus it is not reproducible from external hosts on a properly configured environment. The issue occurs due to the password stage having a policy bound to it, which skips the password stage if the Identification stage is setup to also contain a password stage. Due to the invalid X-Forwarded-For header, which does not get validated to be an IP Address early enough, the exception happens later and the policy fails. The default blueprint doesn't correctly set `failure_result` to `True` on the policy binding meaning that due to this exception the policy returns false and the password stage is skipped. Versions 2024.8.3 and 2024.6.5 fix this issue.
- Product
- authentik
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2024Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RSM Design Website Template allows SQL Injection.CVE-2024-3373 · Other software · RSM Design · reported by iletisim@usom.gov.trCritical 9.2
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RSM Design Website Template allows SQL Injection. This issue affects Website Template: before 1.2.
- Product
- Website Template
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Sep 27, 2024In the Linux kernel, the following vulnerability has been resolved: fou: fix initialization of grc The grc must be initialize first.CVE-2024-46865 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Critical 9.8
In the Linux kernel, the following vulnerability has been resolved: fou: fix initialization of grc The grc must be initialize first. There can be a condition where if fou is NULL, goto out will be executed and grc would be used uninitialized.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Sep 27, 2024Cleartext Storage of Sensitive Information in a Cookie vulnerability in Oceanic Software ValeApp allows Protocol Manipulation, : JSON Hijacking (aka JavaScript CVE-2024-8644 · Other software · Oceanic Software · reported by iletisim@usom.gov.trCritical 9.3
Cleartext Storage of Sensitive Information in a Cookie vulnerability in Oceanic Software ValeApp allows Protocol Manipulation, : JSON Hijacking (aka JavaScript Hijacking). This issue affects ValeApp: before v2.0.0.
- Product
- ValeApp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Sep 27, 2024Session Fixation vulnerability in Oceanic Software ValeApp allows Brute Force, Session Hijacking.CVE-2024-8643 · Other software · Oceanic Software · reported by iletisim@usom.gov.trCritical 9.3
Session Fixation vulnerability in Oceanic Software ValeApp allows Brute Force, Session Hijacking. This issue affects ValeApp: before v2.0.0.
- Product
- ValeApp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Sep 26, 2024Tenda G3 Router firmware v15.03.05.05 was discovered to contain a remote code execution (RCE) vulnerability via the usbPartitionName parameter in the formSetUSBCVE-2024-46628 · Network & remote access · tenda · reported by MITRECritical 9.8
Tenda G3 Router firmware v15.03.05.05 was discovered to contain a remote code execution (RCE) vulnerability via the usbPartitionName parameter in the formSetUSBPartitionUmount function.
- Product
- g3_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 26, 2024The device enables an unauthorized attacker to execute system commands with elevated privileges.CVE-2024-9166 · Other software · Atelmo · reported by ics-cert@hq.dhs.govCritical 9.3
The device enables an unauthorized attacker to execute system commands with elevated privileges. This exploit is facilitated through the use of the 'getcommand' query within the application, allowing the attacker to gain root access.
- Product
- Atemio AM 520 HD Full HD Satellite Receiver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 26, 2024Incorrect access control in BECN DATAGERRY v2.2 allows attackers to execute arbitrary commands via crafted web requests.CVE-2024-46627 · Other software · becn · reported by MITRECritical 9.1
Incorrect access control in BECN DATAGERRY v2.2 allows attackers to execute arbitrary commands via crafted web requests.
- Product
- datagerry
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 26, 2024NVIDIA Container Toolkit 1.16.1 or earlier contains a Time-of-check Time-of-Use (TOCTOU) vulnerability when used with default configuration where a specificallyCVE-2024-0132 · Other software · NVIDIA · reported by psirt@nvidia.comCritical 9
NVIDIA Container Toolkit 1.16.1 or earlier contains a Time-of-check Time-of-Use (TOCTOU) vulnerability when used with default configuration where a specifically crafted container image may gain access to the host file system. This does not impact use cases where CDI is used. A successful exploit of this vulnerability may lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.
- Product
- Container Toolkit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 26, 2024Jupiter X Core: Arbitrary file uploadsCVE-2024-7772 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Jupiter X Core plugin for WordPress is vulnerable to arbitrary file uploads due to a mishandled file type validation in the 'validate' function in all versions up to, and including, 4.6.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- Jupiter X Core
- Affected
- up to 4.6.5
- What to do
- Affects up to 4.6.5. Update Jupiter X Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 25, 2024Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Talent Software BAP Automation allows Stored XSS.CVE-2024-4657 · Other software · Talent Software · reported by iletisim@usom.gov.trCritical 9.3
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Talent Software BAP Automation allows Stored XSS. This issue affects BAP Automation: before 30840.
- Product
- BAP Automation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Sep 25, 2024Incorrect Authorization vulnerability in WatchGuard Authentication Gateway (aka Single Sign-On Agent) on Windows allows an attacker with network access to execuCVE-2024-6593 · Network & remote access · WatchGuard · reported by 5d1c2695-1a31-4499-88ae-e847036fd7e3Critical 9.3
Incorrect Authorization vulnerability in WatchGuard Authentication Gateway (aka Single Sign-On Agent) on Windows allows an attacker with network access to execute restricted management commands. An attacker that has already gained network access could exploit this vulnerability to retrieve authenticated usernames and group memberships from the Single Sign-On Agent or tamper with the agent configuration. This vulnerability cannot be used by an attacker to gain access to user credentials.
- Product
- SSO Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.watchguard.comredteam-pentesting.de
Sep 25, 2024An incorrect authorization vulnerability in the protocol communication between the WatchGuard Authentication Gateway (aka Single Sign-On Agent) on Windows and tCVE-2024-6592 · Network & remote access · WatchGuard · reported by 5d1c2695-1a31-4499-88ae-e847036fd7e3Critical 9.3
An incorrect authorization vulnerability in the protocol communication between the WatchGuard Authentication Gateway (aka Single Sign-On Agent) on Windows and the WatchGuard Single Sign-On Client on Windows and MacOS allows an attacker with network access to forge communications to affected components. In the event an attacker has already gained network access, they could exploit this vulnerability to retrieve authenticated usernames and group memberships from the Single Sign-On Agent or send arbitrary account and group information to the Single Sign-On Agent for their host. This vulnerability cannot be used by an attacker to gain access to user credentials.
- Product
- SSO Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.watchguard.comredteam-pentesting.de
Sep 25, 2024The Events Calendar: SQL InjectionCVE-2024-8275 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The The Events Calendar plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'tribe_has_next_event' function in all versions up to, and including, 6.6.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Only sites that have manually added tribe_has_next_event() will be vulnerable to this SQL injection.
- Product
- The Events Calendar
- Affected
- up to 6.6.4
- What to do
- Affects up to 6.6.4. Update The Events Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recorddocs.theeventscalendar.complugins.trac.wordpress.org
Sep 25, 2024Prisna GWT – Google Website Translator: PHP Object InjectionCVE-2024-8514 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The Prisna GWT – Google Website Translator plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.11 via deserialization of untrusted input from the 'prisna_import' parameter. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
- Product
- Prisna GWT – Google Website Translator
- Affected
- up to 1.4.11
- What to do
- Affects up to 1.4.11. Update Prisna GWT – Google Website Translator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 25, 2024WordPress Simple HTML Sitemap: SQL InjectionCVE-2024-7385 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The WordPress Simple HTML Sitemap plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 3.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- WordPress Simple HTML Sitemap
- Affected
- up to 3.1
- What to do
- Affects up to 3.1. Update WordPress Simple HTML Sitemap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 24, 2024Daily Prayer Time: SQL InjectionCVE-2024-8621 · WordPress plugins & themes · reported by WordfenceCritical 9.9
The Daily Prayer Time plugin for WordPress is vulnerable to SQL Injection via the 'max_word' attribute of the 'quran_verse' shortcode in all versions up to, and including, 2024.08.26 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Daily Prayer Time
- Affected
- up to 2024.08.26
- What to do
- Affects up to 2024.08.26. Update Daily Prayer Time to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 24, 2024REST API TO MiniProgram: Privilege escalationCVE-2024-8485 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The REST API TO MiniProgram plugin for WordPress is vulnerable to privilege escalation via account takeovr in all versions up to, and including, 4.7.1 via the updateUserInfo() due to missing validation on the 'openid' user controlled key that determines what user will be updated. This makes it possible for unauthenticated attackers to update arbitrary user's accounts, including their email to a @weixin.com email, which can the be leveraged to reset the password of the user's account, including administrators.
- Product
- REST API TO MiniProgram
- Affected
- up to 4.7.1
- What to do
- Affects up to 4.7.1. Update REST API TO MiniProgram to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 24, 2024Flowise < 2.1.1 suffers from a Stored Cross-Site vulnerability due to a lack of input sanitization in Flowise Chat Embed < 2.0.0.CVE-2024-9148 · Other software · FlowiseAI · reported by vulnreport@tenable.comCritical 9.6
Flowise < 2.1.1 suffers from a Stored Cross-Site vulnerability due to a lack of input sanitization in Flowise Chat Embed < 2.0.0.
- Product
- FlowiseChatEmbed
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2024External Control of File Name or Path, : Incorrect Permission Assignment for Critical Resource vulnerability in Olgu Computer Systems e-Belediye allows ManipulaCVE-2024-9142 · Other software · Olgu Computer Systems · reported by iletisim@usom.gov.trCritical 9.4
External Control of File Name or Path, : Incorrect Permission Assignment for Critical Resource vulnerability in Olgu Computer Systems e-Belediye allows Manipulating Web Input to File System Calls. This issue affects e-Belediye: before 2.0.642.
- Product
- e-Belediye
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Sep 24, 2024Vulnerability in the Scriptcase application version 9.4.019, which involves the arbitrary upload of a file via /scriptcase/devel/lib/third/jquery_plugin/jQuery-CVE-2024-8940 · Other software · Scriptcase · reported by cve-coordination@incibe.esCritical 10
Vulnerability in the Scriptcase application version 9.4.019, which involves the arbitrary upload of a file via /scriptcase/devel/lib/third/jquery_plugin/jQuery-File-Upload/server/php/ via a POST request. An attacker could upload malicious files to the server due to the application not properly verifying user input.
- Product
- Scriptcase
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2024The password recovery mechanism for the forgotten password in Riello Netman 204 allows an attacker to reset the admin password and take over control of the deviCVE-2024-8878 · Other software · Riello · reported by office@cyberdanube.comCritical 10
The password recovery mechanism for the forgotten password in Riello Netman 204 allows an attacker to reset the admin password and take over control of the device.This issue affects Netman 204: through 4.05.
- Product
- Netman 204
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcyberdanube.comseclists.org
Sep 24, 2024WP Easy Gallery – WordPress Gallery: SQL InjectionCVE-2024-8436 · WordPress plugins & themes · reported by WordfenceCritical 9.9
The WP Easy Gallery – WordPress Gallery Plugin plugin for WordPress is vulnerable to SQL Injection via the 'edit_imageId' and 'edit_imageDelete' parameters in all versions up to, and including, 4.8.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- WP Easy Gallery – WordPress Gallery
- Affected
- up to 4.8.5
- What to do
- Affects up to 4.8.5. Update WP Easy Gallery – WordPress Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 24, 2024Mellium mellium.im/xmpp 0.0.1 through 0.21.4 allows response spoofing if the implementation uses predictable IDs because the stanza type is not checked.CVE-2024-46957 · Other software · mellium · reported by MITRECritical 9.8
Mellium mellium.im/xmpp 0.0.1 through 0.21.4 allows response spoofing if the implementation uses predictable IDs because the stanza type is not checked. This is fixed in 0.22.0.
- Product
- xmpp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodeberg.orgmellium.im
Sep 24, 2024IceCMS v3.4.7 and before was discovered to contain a hardcoded JWT key, allowing an attacker to forge JWT authentication information.CVE-2024-46612 · Other software · icecms_project · reported by MITRECritical 9.8
IceCMS v3.4.7 and before was discovered to contain a hardcoded JWT key, allowing an attacker to forge JWT authentication information.
- Product
- icecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2024A specially crafted POST request to the ProGauge MAGLINK LX CONSOLE IP sub-menu can allow a remote attacker to inject arbitrary commands.CVE-2024-45066 · Other software · Dover Fueling Solutions (DFS) · reported by ics-cert@hq.dhs.govCritical 10
A specially crafted POST request to the ProGauge MAGLINK LX CONSOLE IP sub-menu can allow a remote attacker to inject arbitrary commands.
- Product
- ProGauge MAGLINK LX CONSOLE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2024A specially crafted POST request to the ProGauge MAGLINK LX CONSOLE UTILITY sub-menu can allow a remote attacker to inject arbitrary commands.CVE-2024-43693 · Other software · Dover Fueling Solutions (DFS) · reported by ics-cert@hq.dhs.govCritical 10
A specially crafted POST request to the ProGauge MAGLINK LX CONSOLE UTILITY sub-menu can allow a remote attacker to inject arbitrary commands.
- Product
- ProGauge MAGLINK LX CONSOLE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2024An attacker can directly request the ProGauge MAGLINK LX CONSOLE resource sub page with full privileges by requesting the URL directly.CVE-2024-43692 · Other software · Dover Fueling Solutions (DFS) · reported by ics-cert@hq.dhs.govCritical 9.3
An attacker can directly request the ProGauge MAGLINK LX CONSOLE resource sub page with full privileges by requesting the URL directly.
- Product
- ProGauge MAGLINK LX CONSOLE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2024The web application for ProGauge MAGLINK LX4 CONSOLE contains an administrative-level user account with a password that cannot be changed.CVE-2024-43423 · Other software · Dover Fueling Solutions (DFS) · reported by ics-cert@hq.dhs.govCritical 9.3
The web application for ProGauge MAGLINK LX4 CONSOLE contains an administrative-level user account with a password that cannot be changed.
- Product
- ProGauge MAGLINK LX CONSOLE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2024Command injection vulnerabilities in the underlying CLI service could lead to unauthenticated remote code execution by sending specially crafted packets destineCVE-2024-42507 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.8
Command injection vulnerabilities in the underlying CLI service could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities results in the ability to execute arbitrary code as a privileged user on the underlying operating system.
- Product
- Aruba OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2024Command injection vulnerabilities in the underlying CLI service could lead to unauthenticated remote code execution by sending specially crafted packets destineCVE-2024-42506 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.8
Command injection vulnerabilities in the underlying CLI service could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities results in the ability to execute arbitrary code as a privileged user on the underlying operating system.
- Product
- Aruba OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2024Command injection vulnerabilities in the underlying CLI service could lead to unauthenticated remote code execution by sending specially crafted packets destineCVE-2024-42505 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.8
Command injection vulnerabilities in the underlying CLI service could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities results in the ability to execute arbitrary code as a privileged user on the underlying operating system.
- Product
- Aruba OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2024An issue discovered in CS-Cart MultiVendor 4.16.1 allows attackers to alter arbitrary user account profiles via crafted post request.CVE-2023-26689 · Other software · cs-cart · reported by MITRECritical 9.8
An issue discovered in CS-Cart MultiVendor 4.16.1 allows attackers to alter arbitrary user account profiles via crafted post request.
- Product
- cs-cart_multivendor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2024File Upload vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to run arbitrary code via the image upload feature when customizing a shop.CVE-2023-26686 · Other software · cs-cart · reported by MITRECritical 9.8
File Upload vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to run arbitrary code via the image upload feature when customizing a shop.
- Product
- cs-cart_multivendor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2024Donation Forms by Charitable – Donations Plugin & Fundraising Platform for: Privilege escalationCVE-2024-8791 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Donation Forms by Charitable – Donations Plugin & Fundraising Platform for WordPress plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.8.1.14. This is due to the plugin not properly verifying a user's identity when the ID parameter is supplied through the update_core_user() function. This makes it possible for unauthenticated attackers to update the email address and password of arbitrary user accounts, including administrators, which can then be used to log in to those user accounts.
- Product
- Donation Forms by Charitable – Donations Plugin & Fundraising Platform for
- Affected
- up to 1.8.1.14
- What to do
- Affects up to 1.8.1.14. Update Donation Forms by Charitable – Donations Plugin & Fundraising Platform for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 23, 2024WooEvents - Calendar and Event Booking: Arbitrary file overwriteCVE-2024-8671 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The WooEvents - Calendar and Event Booking plugin for WordPress is vulnerable to arbitrary file overwrite due to insufficient file path validation in the inc/barcode.php file in all versions up to, and including, 4.1.2. This makes it possible for unauthenticated attackers to overwrite arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
- Product
- WooEvents - Calendar and Event Booking
- Affected
- up to 4.1.2
- What to do
- Affects up to 4.1.2. Update WooEvents - Calendar and Event Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Sep 23, 2024MDTF – Meta Data and Taxonomies Filter: SQL InjectionCVE-2024-8624 · WordPress plugins & themes · reported by WordfenceCritical 9.9
The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to SQL Injection via the 'meta_key' attribute of the 'mdf_select_title' shortcode in all versions up to, and including, 1.3.3.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- MDTF – Meta Data and Taxonomies Filter
- Affected
- up to 1.3.3.3
- What to do
- Affects up to 1.3.3.3. Update MDTF – Meta Data and Taxonomies Filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 23, 2024Inappropriate implementation in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML CVE-2024-7024 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comCritical 9.6
Inappropriate implementation in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.