Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
38,838 results · page 309 of 777
Sep 12, 2024CVE-2024-45824 IMPACT A remote code vulnerability exists in the affected products.CVE-2024-45824 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comCritical 9.2
CVE-2024-45824 IMPACT A remote code vulnerability exists in the affected products. The vulnerability occurs when chained with Path Traversal, Command Injection, and XSS Vulnerabilities and allows for full unauthenticated remote code execution. The link in the mitigations section below contains patches to fix this issue.
- Product
- FactoryTalk View Site Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Sep 12, 2024No-IP Dynamic Update Client (DUC) v3.x uses cleartext credentials that may occur on a command line or in a file.CVE-2024-40457 · Other software · no-ip · reported by MITRECritical 9.1
No-IP Dynamic Update Client (DUC) v3.x uses cleartext credentials that may occur on a command line or in a file. NOTE: the vendor's position is that cleartext in /etc/default/noip-duc is recommended and is the intentional behavior.
- Product
- duc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2024SolarWinds Access Rights Manager (ARM) was found to be susceptible to a remote code execution vulnerability.CVE-2024-28991 · Other software · SolarWinds · reported by psirt@solarwinds.comCritical 9
SolarWinds Access Rights Manager (ARM) was found to be susceptible to a remote code execution vulnerability. If exploited, this vulnerability would allow an authenticated user to abuse the service, resulting in remote code execution.
- Product
- Access Rights Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.solarwinds.comsolarwinds.com
Sep 12, 2024A cross-site scripting (XSS) vulnerability exists in all versions of the MindsDB platform, enabling the execution of a JavaScript payload whenever a user enumerCVE-2024-45856 · Other software · mindsdb · reported by 6f8de1f0-f67e-45a6-b68f-98777fdb759cCritical 9
A cross-site scripting (XSS) vulnerability exists in all versions of the MindsDB platform, enabling the execution of a JavaScript payload whenever a user enumerates an ML Engine, database, project, or dataset containing arbitrary JavaScript code within the web UI.
- Product
- mindsdb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2024LearnPress – WordPress LMS: SQL InjectionCVE-2024-8529 · WordPress plugins & themes · reported by WordfenceCritical 10
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to SQL Injection via the 'c_fields' parameter of the /wp-json/lp/v1/courses/archive-course REST API endpoint in all versions up to, and including, 4.2.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- LearnPress – WordPress LMS
- Affected
- up to 4.2.7
- What to do
- Affects up to 4.2.7. Update LearnPress – WordPress LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordabrahack.complugins.trac.wordpress.org
Sep 12, 2024LearnPress – WordPress LMS: SQL InjectionCVE-2024-8522 · WordPress plugins & themes · reported by WordfenceCritical 10
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to SQL Injection via the 'c_only_fields' parameter of the /wp-json/learnpress/v1/courses REST API endpoint in all versions up to, and including, 4.2.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- LearnPress – WordPress LMS
- Affected
- up to 4.2.7
- What to do
- Affects up to 4.2.7. Update LearnPress – WordPress LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordabrahack.complugins.trac.wordpress.org
Sep 11, 2024Deserialization of untrusted data in the agent portal of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to acCVE-2024-29847 · Network & remote access · Ivanti · reported by support@hackerone.comCritical 9.8
Deserialization of untrusted data in the agent portal of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to achieve remote code execution.
- Product
- EPM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2024evilnapsis Inventio Lite Versions v4 and before is vulnerable to SQL Injection via the "username" parameter in "/?action=processlogin."CVE-2024-44541 · Other software · evilnapsis · reported by MITRECritical 9.8
evilnapsis Inventio Lite Versions v4 and before is vulnerable to SQL Injection via the "username" parameter in "/?action=processlogin."
- Product
- inventio-lite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2024In the Linux kernel, the following vulnerability has been resolved: igb: cope with large MAX_SKB_FRAGS Sabrina reports that the igb driver does not cope well CVE-2024-45030 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Critical 9.8
In the Linux kernel, the following vulnerability has been resolved: igb: cope with large MAX_SKB_FRAGS Sabrina reports that the igb driver does not cope well with large MAX_SKB_FRAG values: setting MAX_SKB_FRAG to 45 causes payload corruption on TX. An easy reproducer is to run ssh to connect to the machine. With MAX_SKB_FRAGS=17 it works, with MAX_SKB_FRAGS=45 it fails. This has been reported originally in https://bugzilla.redhat.com/show_bug.cgi?id=2265320 The root cause of the issue is that the driver does not take into account properly the (possibly large) shared info size when selecting the ring layout, and will try to fit two packets inside the same 4K page even when the 1st fraglist will trump over the 2nd head. Address the issue by checking if 2K buffers are insufficient.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Sep 11, 2024In the Linux kernel, the following vulnerability has been resolved: nvme: move stopping keep-alive into nvme_uninit_ctrl() Commit 4733b65d82bd ("nvme: start kCVE-2024-45013 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Critical 9.8
In the Linux kernel, the following vulnerability has been resolved: nvme: move stopping keep-alive into nvme_uninit_ctrl() Commit 4733b65d82bd ("nvme: start keep-alive after admin queue setup") moves starting keep-alive from nvme_start_ctrl() into nvme_init_ctrl_finish(), but don't move stopping keep-alive into nvme_uninit_ctrl(), so keep-alive work can be started and keep pending after failing to start controller, finally use-after-free is triggered if nvme host driver is unloaded. This patch fixes kernel panic when running nvme/004 in case that connection failure is triggered, by moving stopping keep-alive into nvme_uninit_ctrl(). This way is reasonable because keep-alive is now started in nvme_init_ctrl_finish().
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Sep 11, 2024COMFAST CF-XR11 V2.7.2 has a command injection vulnerability in function sub_424CB4.CVE-2024-44466 · Other software · comfast · reported by MITRECritical 9.8
COMFAST CF-XR11 V2.7.2 has a command injection vulnerability in function sub_424CB4. Attackers can send POST request messages to /usr/bin/webmgnt and inject commands into parameter iface.
- Product
- cf-xr11_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2024A unauthenticated Remote Code Execution (RCE) vulnerability is found in the SO Planning online planning tool.CVE-2024-27115 · Other software · Simple Online Planning · reported by csirt@divd.nlCritical 10
A unauthenticated Remote Code Execution (RCE) vulnerability is found in the SO Planning online planning tool. With this vulnerability, an attacker can upload executable files that are moved to a publicly accessible folder before verifying any requirements. This leads to the possibility of execution of code on the underlying system when the file is triggered. The vulnerability has been remediated in version 1.52.02.
- Product
- SO Planning
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2024An unauthenticated Insecure Direct Object Reference (IDOR) to the database has been found in the SO Planning tool that occurs when the public view setting is enCVE-2024-27113 · Other software · Simple Online Planning · reported by csirt@divd.nlCritical 9.3
An unauthenticated Insecure Direct Object Reference (IDOR) to the database has been found in the SO Planning tool that occurs when the public view setting is enabled. An attacker could use this vulnerability to gain access to the underlying database by exporting it as a CSV file. The vulnerability has been remediated in version 1.52.02.
- Product
- SO Planning
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2024A unauthenticated SQL Injection has been found in the SO Planning tool that occurs when the public view setting is enabled.CVE-2024-27112 · Other software · Simple Online Planning · reported by csirt@divd.nlCritical 9.3
A unauthenticated SQL Injection has been found in the SO Planning tool that occurs when the public view setting is enabled. An attacker could use this vulnerability to gain access to the underlying database. The vulnerability has been remediated in version 1.52.02.
- Product
- SO Planning
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2024A vulnerability in significant-gravitas/autogpt version 0.5.1 allows an attacker to bypass the shell commands denylist settings.CVE-2024-6091 · Other software · significant-gravitas · reported by security@huntr.devCritical 9.8
A vulnerability in significant-gravitas/autogpt version 0.5.1 allows an attacker to bypass the shell commands denylist settings. The issue arises when the denylist is configured to block specific commands, such as 'whoami' and '/bin/whoami'. An attacker can circumvent this restriction by executing commands with a modified path, such as '/bin/./whoami', which is not recognized by the denylist.
- Product
- significant-gravitas/autogpt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2024This vulnerability exists in Reedos aiM-Star version 2.0.1 due to missing restrictions for excessive failed authentication attempts on its API based login.CVE-2024-45790 · Other software · Reedos Software Solutions · reported by vdisclose@cert-in.org.inCritical 9.3
This vulnerability exists in Reedos aiM-Star version 2.0.1 due to missing restrictions for excessive failed authentication attempts on its API based login. A remote attacker could exploit this vulnerability by conducting a brute force attack against legitimate user passwords, which could lead to gain unauthorized access and compromise other user accounts.
- Product
- Mutual Fund Distribution Product (aiM-Star)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2024Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Vidco Software VOC TESTER allows Path Traversal.CVE-2024-7609 · Other software · Vidco Software · reported by iletisim@usom.gov.trCritical 9.2
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Vidco Software VOC TESTER allows Path Traversal. This issue affects VOC TESTER: before 12.34.8.
- Product
- VOC TESTER
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Sep 11, 2024WooCommerce Photo Reviews Premium: Authentication bypassCVE-2024-8277 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WooCommerce Photo Reviews Premium plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.3.13.2. This is due to the plugin not properly validating what user transient is being used in the login() function and not properly verifying the user's identity. This makes it possible for unauthenticated attackers to log in as user that has dismissed an admin notice in the past 30 days, which is often an administrator. Alternatively, a user can log in as any user with any transient that has a valid user_id as the value, though it would be more difficult to exploit this successfully.
- Product
- WooCommerce Photo Reviews Premium
- Affected
- up to 1.3.13.2
- What to do
- Affects up to 1.3.13.2. Update WooCommerce Photo Reviews Premium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Sep 10, 2024An unauthenticated attacker can leverage a time-based SQL injection vulnerability in VICIdial to enumerate database records.CVE-2024-8503 · Other software · VICIdial · reported by bbf0bd87-ece2-41be-b873-96928ee8fab9Critical 9.8
An unauthenticated attacker can leverage a time-based SQL injection vulnerability in VICIdial to enumerate database records. By default, VICIdial stores plaintext credentials within the database.
- Product
- VICIdial
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkorelogic.comvicidial.org
Sep 10, 2024Renwoxing Enterprise Intelligent Management System before v3.0 was discovered to contain a SQL injection vulnerability via the parid parameter at /fx/baseinfo/SCVE-2024-43040 · Other software · renwoxing · reported by MITRECritical 9.1
Renwoxing Enterprise Intelligent Management System before v3.0 was discovered to contain a SQL injection vulnerability via the parid parameter at /fx/baseinfo/SearchInfo.
- Product
- intelligent_management_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024The Ruby SAML library is for implementing the client side of a SAML authorization.CVE-2024-45409 · Other software · SAML-Toolkits · reported by GitHubCritical 10
The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in <= 12.2 and 1.13.0 <= 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document (by the IdP) can thus forge a SAML Response/Assertion with arbitrary contents. This would allow the attacker to log in as arbitrary user within the vulnerable system. This vulnerability is fixed in 1.17.0 and 1.12.3.
- Product
- ruby-saml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024An issue in the component /jeecg-boot/jmreport/dict/list of JimuReport v1.7.8 allows attacker to escalate privileges via a crafted GET request.CVE-2024-44893 · Other software · jeecg · reported by MITRECritical 9.8
An issue in the component /jeecg-boot/jmreport/dict/list of JimuReport v1.7.8 allows attacker to escalate privileges via a crafted GET request.
- Product
- jimureport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024Microsoft is aware of a vulnerability in Servicing Stack that has rolled back the fixes for some vulnerabilities affecting Optional Components on Windows 10, veCVE-2024-43491 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.8
Microsoft is aware of a vulnerability in Servicing Stack that has rolled back the fixes for some vulnerabilities affecting Optional Components on Windows 10, version 1507 (initial version released July 2015). This means that an attacker could exploit these previously mitigated vulnerabilities on Windows 10, version 1507 (Windows 10 Enterprise 2015 LTSB and Windows 10 IoT Enterprise 2015 LTSB) systems that have installed the Windows security update released on March 12, 2024—KB5035858 (OS Build 10240.20526) or other updates released until August 2024. All later versions of Windows 10 are not impacted by this vulnerability. This servicing stack vulnerability is addressed by installing the September 2024 Servicing stack update (SSU KB5043936) AND the September 2024 Windows security update (KB5043083), in that order. Note: Windows 10, version 1507 reached the end of support (EOS) on May 9, 2017 for devices running the Pro, Home, Enterprise, Education, and Enterprise IoT editions. Only Windows 10 Enterprise 2015 LTSB and Windows 10 IoT Enterprise 2015 LTSB editions are still under support.
- Product
- Windows 10 Version 1507
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024Azure Stack Hub Elevation of Privilege VulnerabilityCVE-2024-38220 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9
Azure Stack Hub Elevation of Privilege Vulnerability
- Product
- Azure Stack Hub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024Nix is a package manager for Linux and other Unix systems.CVE-2024-45593 · Other software · NixOS · reported by GitHubCritical 9
Nix is a package manager for Linux and other Unix systems. A bug in Nix 2.24 prior to 2.24.6 allows a substituter or malicious user to craft a NAR that, when unpacked by Nix, causes Nix to write to arbitrary file system locations to which the Nix process has access. This will be with root permissions when using the Nix daemon. This issue is fixed in Nix 2.24.6.
- Product
- nix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024eladmin v2.7 and before is vulnerable to Server-Side Request Forgery (SSRF) which allows an attacker to execute arbitrary code via the DatabaseController.java cCVE-2024-44677 · Other software · eladmin · reported by MITRECritical 9.8
eladmin v2.7 and before is vulnerable to Server-Side Request Forgery (SSRF) which allows an attacker to execute arbitrary code via the DatabaseController.java component.
- Product
- eladmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024Loftware Spectrum through 4.6 has unprotected JMX Registry.CVE-2023-37234 · Other software · loftware · reported by MITRECritical 9.8
Loftware Spectrum through 4.6 has unprotected JMX Registry.
- Product
- spectrum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcode-white.comcode-white.com
Sep 10, 2024Command Injection vulnerability in goform/SetIPTVCfg interface of Tenda AC15 V15.03.05.20 allows remote attackers to run arbitrary commands via crafted POST reqCVE-2023-36103 · Network & remote access · tenda · reported by MITRECritical 9.8
Command Injection vulnerability in goform/SetIPTVCfg interface of Tenda AC15 V15.03.05.20 allows remote attackers to run arbitrary commands via crafted POST request.
- Product
- ac15_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024Loftware Spectrum before 4.6 HF14 uses a Hard-coded Password.CVE-2023-37231 · Other software · loftware · reported by MITRECritical 9.8
Loftware Spectrum before 4.6 HF14 uses a Hard-coded Password.
- Product
- spectrum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcode-white.comcode-white.com
Sep 10, 2024Loftware Spectrum before 4.6 HF13 Deserializes Untrusted Data.CVE-2023-37227 · Other software · loftware · reported by MITRECritical 9.8
Loftware Spectrum before 4.6 HF13 Deserializes Untrusted Data.
- Product
- spectrum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcode-white.comcode-white.com
Sep 10, 2024Loftware Spectrum before 4.6 HF14 has Missing Authentication for a Critical Function.CVE-2023-37226 · Other software · loftware · reported by MITRECritical 9.8
Loftware Spectrum before 4.6 HF14 has Missing Authentication for a Critical Function.
- Product
- spectrum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcode-white.comcode-white.com
Sep 10, 2024A vulnerability has been identified in Industrial Edge Management Pro (All versions < V1.9.5), Industrial Edge Management Virtual (All versions < V2.3.1-1).CVE-2024-45032 · Other software · Siemens · reported by productcert@siemens.comCritical 10
A vulnerability has been identified in Industrial Edge Management Pro (All versions < V1.9.5), Industrial Edge Management Virtual (All versions < V2.3.1-1). Affected components do not properly validate the device tokens. This could allow an unauthenticated remote attacker to impersonate other devices onboarded to the system.
- Product
- Industrial Edge Management Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.com
Sep 10, 2024A vulnerability has been identified in Automation License Manager V5 (All versions), Automation License Manager V6.0 (All versions < V6.0 SP12 Upd3), AutomationCVE-2024-44087 · Other software · Siemens · reported by productcert@siemens.comCritical 9.2
A vulnerability has been identified in Automation License Manager V5 (All versions), Automation License Manager V6.0 (All versions < V6.0 SP12 Upd3), Automation License Manager V6.2 (All versions < V6.2 Upd3). Affected applications do not properly validate certain fields in incoming network packets on port 4410/tcp. This could allow an unauthenticated remote attacker to cause an integer overflow and crash of the application. This denial of service condition could prevent legitimate users from using subsequent products that rely on the affected application for license verification.
- Product
- Automation License Manager V5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.com
Sep 10, 2024A vulnerability has been identified in SINUMERIK 828D V4 (All versions), SINUMERIK 828D V5 (All versions < V5.24), SINUMERIK 840D sl V4 (All versions), SINUMERICVE-2024-41171 · Other software · Siemens · reported by productcert@siemens.comCritical 9.3
A vulnerability has been identified in SINUMERIK 828D V4 (All versions), SINUMERIK 828D V5 (All versions < V5.24), SINUMERIK 840D sl V4 (All versions), SINUMERIK ONE (All versions < V6.24). Affected devices do not properly enforce access restrictions to scripts that are regularly executed by the system with elevated privileges. This could allow an authenticated local attacker to escalate their privileges in the underlying system.
- Product
- SINUMERIK 828D V4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.com
Sep 10, 2024A vulnerability has been identified in SIMATIC BATCH V9.1 (All versions), SIMATIC Information Server 2020 (All versions < V2020 SP2 Update 5), SIMATIC InformatiCVE-2024-35783 · Other software · Siemens · reported by productcert@siemens.comCritical 9.4
A vulnerability has been identified in SIMATIC BATCH V9.1 (All versions), SIMATIC Information Server 2020 (All versions < V2020 SP2 Update 5), SIMATIC Information Server 2022 (All versions < V2022 SP1 Update 2), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP2 UC06), SIMATIC Process Historian 2020 (All versions < V2020 SP2 Update 5), SIMATIC Process Historian 2022 (All versions < V2022 SP1 Update 2), SIMATIC WinCC Runtime Professional V18 (All versions < V18 Update 5), SIMATIC WinCC Runtime Professional V19 (All versions < V19 Update 3), SIMATIC WinCC V7.4 (All versions), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 18), SIMATIC WinCC V8.0 (All versions < V8.0 Update 5). The affected products run their DB server with elevated privileges which could allow an authenticated attacker to execute arbitrary OS commands with administrative privileges.
- Product
- SIMATIC BATCH V9.1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.com
Sep 10, 2024A vulnerability has been identified in Opcenter Quality (All versions < V2406), Opcenter RDnL (All versions < V2410), SIMATIC PCS neo V4.0 (All versions), SIMATCVE-2024-33698 · Other software · Siemens · reported by productcert@siemens.comCritical 9.3
A vulnerability has been identified in Opcenter Quality (All versions < V2406), Opcenter RDnL (All versions < V2410), SIMATIC PCS neo V4.0 (All versions), SIMATIC PCS neo V4.1 (All versions < V4.1 Update 2), SIMATIC PCS neo V5.0 (All versions < V5.0 Update 1), SINEC NMS (All versions), SINEMA Remote Connect Client (All versions < V3.2 SP3), Totally Integrated Automation Portal (TIA Portal) V16 (All versions), Totally Integrated Automation Portal (TIA Portal) V17 (All versions < V17 Update 8), Totally Integrated Automation Portal (TIA Portal) V18 (All versions < V18 Update 5), Totally Integrated Automation Portal (TIA Portal) V19 (All versions < V19 Update 3). Affected products contain a heap-based buffer overflow vulnerability in the integrated UMC component. This could allow an unauthenticated remote attacker to execute arbitrary code.
- Product
- Opcenter Quality
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.com
Sep 10, 2024An unauthenticated remote attacker can run malicious c# code included in curve files and execute commands in the users context.CVE-2024-6596 · Other software · Endress+Hauser · reported by info@cert.vde.comCritical 9.8
An unauthenticated remote attacker can run malicious c# code included in curve files and execute commands in the users context.
- Product
- Echo Curve Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2024**UNSUPPORTED WHEN ASSIGNED** A command injection vulnerability in the export-cgi program of Zyxel NAS326 firmware versions through V5.21(AAZF.18)C0 and NAS542 CVE-2024-6342 · Network & remote access · Zyxel · reported by security@zyxel.com.twCritical 9.8
**UNSUPPORTED WHEN ASSIGNED** A command injection vulnerability in the export-cgi program of Zyxel NAS326 firmware versions through V5.21(AAZF.18)C0 and NAS542 firmware versions through V5.21(ABAG.15)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted HTTP POST request.
- Product
- NAS326 firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2024D-Link DI-8300 v16.07.26A1 is vulnerable to command injection via the msp_info_htm function.CVE-2024-44411 · Network & remote access · d-link · reported by MITRECritical 9.8
D-Link DI-8300 v16.07.26A1 is vulnerable to command injection via the msp_info_htm function.
- Product
- di-8300
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2024D-Link DI-8300 v16.07.26A1 is vulnerable to command injection via the upgrade_filter_asp function.CVE-2024-44410 · Network & remote access · d-link · reported by MITRECritical 9.8
D-Link DI-8300 v16.07.26A1 is vulnerable to command injection via the upgrade_filter_asp function.
- Product
- di-8300
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2024In Connex health portal released before8/30/2024, SQL injection vulnerabilities were found that could have allowed an unauthenticated attacker to gain unauthoriCVE-2024-6795 · Other software · Baxter · reported by productsecurity@baxter.comCritical 10
In Connex health portal released before8/30/2024, SQL injection vulnerabilities were found that could have allowed an unauthenticated attacker to gain unauthorized access to Connex portal's database. An attacker could have submitted a crafted payload to Connex portal that could have resulted in modification and disclosure of database content and/or perform administrative operations including shutting down the database.
- Product
- Connex Health Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2024A deserialization vulnerability in Thinkphp v6.1.3 to v8.0.4 allows attackers to execute arbitrary code.CVE-2024-44902 · Other software · thinkphp · reported by MITRECritical 9.8
A deserialization vulnerability in Thinkphp v6.1.3 to v8.0.4 allows attackers to execute arbitrary code.
- Product
- thinkphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2024HPE has identified a denial of service vulnerability in HPE HP-UX System's Network File System (NFSv4) services.CVE-2024-42500 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.3
HPE has identified a denial of service vulnerability in HPE HP-UX System's Network File System (NFSv4) services.
- Product
- HPE HP-UX ONCplus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2024Qualitor up to 8.24 is vulnerable to Remote Code Execution (RCE) via Arbitrary File Upload in checkAcesso.php.CVE-2024-44849 · Other software · qualitor · reported by MITRECritical 9.8
Qualitor up to 8.24 is vulnerable to Remote Code Execution (RCE) via Arbitrary File Upload in checkAcesso.php.
- Product
- qalitor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.extencil.megithub.com
Sep 9, 2024SeaCMS v13.1 was discovered to a Server-Side Request Forgery (SSRF) via the url parameter at /admin_reslib.php.CVE-2024-44721 · Other software · seacms · reported by MITRECritical 9.8
SeaCMS v13.1 was discovered to a Server-Side Request Forgery (SSRF) via the url parameter at /admin_reslib.php.
- Product
- seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2024Joplin is a free, open source note taking and to-do application.CVE-2024-40643 · Other software · laurent22 · reported by GitHubCritical 9.6
Joplin is a free, open source note taking and to-do application. Joplin fails to take into account that "<" followed by a non letter character will not be considered html. As such it is possible to do an XSS by putting an "illegal" tag within a tag.
- Product
- joplin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2024A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload.CVE-2024-37288 · Other software · Elastic · reported by security@elastic.coCritical 9.9
A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. This issue only affects users that use Elastic Security’s built-in AI tools https://www.elastic.co/guide/en/security/current/ai-for-security.html and have configured an Amazon Bedrock connector https://www.elastic.co/guide/en/security/current/assistant-connect-to-bedrock.html .
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2024Orca HCM from LEARNING DIGITAL has an Missing Authentication vulnerability, allowing unauthenticated remote attacker to exploit this functionality to create an CVE-2024-8584 · Other software · LEARNING DIGITAL · reported by twcert@cert.org.twCritical 9.8
Orca HCM from LEARNING DIGITAL has an Missing Authentication vulnerability, allowing unauthenticated remote attacker to exploit this functionality to create an account with administrator privilege and subsequently use it to log in.
- Product
- Orca HCM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Sep 8, 2024A vulnerability classified as critical was found in TOTOLINK AC1200 T8 4.1.5cu.861_B20230220.CVE-2024-8580 · Other software · TOTOLINK · reported by VulDBCritical 9.2
A vulnerability classified as critical was found in TOTOLINK AC1200 T8 4.1.5cu.861_B20230220. This vulnerability affects unknown code of the file /etc/shadow.sample. The manipulation leads to use of hard-coded password. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AC1200 T8
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2024Opti Marketing: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2024-6928 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Opti Marketing WordPress plugin through 2.0.9 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
- Product
- Opti Marketing
- Affected
- up to 2.0.9
- What to do
- Affects up to 2.0.9. Update Opti Marketing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.