Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,779exploited flaws on CISA’s list

40added in the last 30 days

583new WordPress flaws this week

397,870entries in the database

38,876 results · page 317 of 778

Aug 7, 2024An insufficient authorization vulnerability in web component of EPMM prior to 12.1.0.1 allows an unauthorized attacker within the network to execute arbitrary cCVE-2024-36130 · Network & remote access · Ivanti · reported by support@hackerone.comCritical 9.8
An insufficient authorization vulnerability in web component of EPMM prior to 12.1.0.1 allows an unauthorized attacker within the network to execute arbitrary commands on the underlying operating system of the appliance.
Product
EPMM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forums.ivanti.com
Aug 6, 2024An issue discovered in the RunHTTPServer function in Gorush v1.18.4 allows attackers to intercept and manipulate data due to use of deprecated TLS version.CVE-2024-41270 · Computers, phones & browsers · appleboy · reported by MITRECritical 9.1
An issue discovered in the RunHTTPServer function in Gorush v1.18.4 allows attackers to intercept and manipulate data due to use of deprecated TLS version.
Product
gorush
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com
Aug 6, 2024There is a vulnerability in the AP Certificate Management Service which could allow a threat actor to execute an unauthenticated RCE attack.CVE-2024-42395 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.8
There is a vulnerability in the AP Certificate Management Service which could allow a threat actor to execute an unauthenticated RCE attack. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise.
Product
HPE Aruba Networking InstantOS and Aruba Access Points running ArubaOS 10
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hpe.com
Aug 6, 2024There are vulnerabilities in the Soft AP Daemon Service which could allow a threat actor to execute an unauthenticated RCE attack.CVE-2024-42394 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.8
There are vulnerabilities in the Soft AP Daemon Service which could allow a threat actor to execute an unauthenticated RCE attack. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise.
Product
HPE Aruba Networking InstantOS and Aruba Access Points running ArubaOS 10
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hpe.com
Aug 6, 2024There are vulnerabilities in the Soft AP Daemon Service which could allow a threat actor to execute an unauthenticated RCE attack.CVE-2024-42393 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.8
There are vulnerabilities in the Soft AP Daemon Service which could allow a threat actor to execute an unauthenticated RCE attack. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise.
Product
Hpe Aruba Networking InstantOS and Aruba Access Points running ArubaOS 10
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hpe.com
Aug 6, 2024Cross Site Scripting vulnerability in Koha ILS 23.05 and before allows a remote attacker to execute arbitrary code via the additonal-contents.pl component.CVE-2024-28740 · Other software · koha · reported by MITRECritical 9.6
Cross Site Scripting vulnerability in Koha ILS 23.05 and before allows a remote attacker to execute arbitrary code via the additonal-contents.pl component.
Product
koha
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record febin0x4e4a.wordpress.com febin0x4e4a.wordpress.com
Aug 6, 2024GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750CVE-2024-39227 · Other software · gl-inet · reported by MITRECritical 9.8
GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain insecure permissions in the endpoint /cgi-bin/glc. This vulnerability allows unauthenticated attackers to execute arbitrary code or possibly a directory traversal via crafted JSON data.
Product
gl-mt2500
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Aug 6, 2024D-Link DIR-300 REVA FIRMWARE v1.06B05_WW contains hardcoded credentials in the Telnet service.CVE-2024-41616 · Other software · dlink · reported by MITRECritical 9.8
D-Link DIR-300 REVA FIRMWARE v1.06B05_WW contains hardcoded credentials in the Telnet service.
Product
dir-300_firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 6, 2024GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750CVE-2024-39228 · Other software · gl-inet · reported by MITRECritical 9.8
GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain a shell injection vulnerability via the interface check_ovpn_client_config and check_config.
Product
x750_firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Aug 6, 2024GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750CVE-2024-39226 · Other software · Gl-inet · reported by MITRECritical 9.8
GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain a vulnerability can be exploited to manipulate routers by passing malicious shell commands through the s2s API.
Product
Mt6000 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Aug 6, 2024GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750CVE-2024-39225 · Other software · gl-inet · reported by MITRECritical 9.8
GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain a remote code execution (RCE) vulnerability.
Product
mt6000_firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Aug 6, 2024A compromised HMS Networks Cosy+ device could be used to request a Certificate Signing Request from Talk2m for another device, resulting in an availability issuCVE-2024-33897 · Other software · hms-networks · reported by MITRECritical 9.1
A compromised HMS Networks Cosy+ device could be used to request a Certificate Signing Request from Talk2m for another device, resulting in an availability issue. The issue was patched on the Talk2m production server on April 18, 2024.
Product
ewon_cosy_firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.syss.com hmsnetworks.blob.core.windows.net
Aug 6, 2024PrivX before 34.0 allows data exfiltration and denial of service via the REST API.CVE-2024-30170 · Other software · privx · reported by MITRECritical 9.1
PrivX before 34.0 allows data exfiltration and denial of service via the REST API. This is fixed in minor versions 33.1, 32.3, 31.3, and later, and in major version 34.0 and later,
Product
privx
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record info.ssh.com privx.docs.ssh.com
Aug 6, 2024Insufficient checks when processing graphics shared memory could have led to memory corruption.CVE-2024-7519 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.6
Insufficient checks when processing graphics shared memory could have led to memory corruption. This could be leveraged by an attacker to perform a sandbox escape. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, Thunderbird < 128.1, and Thunderbird < 115.14.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Aug 6, 2024SQL injection vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0.CVE-2024-33974 · Other software · Janobe · reported by cve-coordination@incibe.esCritical 9.8
SQL injection vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in it through the following 'Users in '/report/printlogs.php' parameter.
Product
School Attendance Monitoring System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record incibe.es
Aug 6, 2024SQL injection vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0.CVE-2024-33973 · Other software · Janobe · reported by cve-coordination@incibe.esCritical 9.8
SQL injection vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in it through the following 'Attendance' and 'YearLevel' in '/report/attendance_print.php' parameter.
Product
School Attendance Monitoring System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record incibe.es
Aug 6, 2024SQL injection vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0.CVE-2024-33972 · Other software · Janobe · reported by cve-coordination@incibe.esCritical 9.8
SQL injection vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in it through the following 'events' in '/report/event_print.php' parameter.
Product
School Attendance Monitoring System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record incibe.es
Aug 6, 2024SQL injection vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0.CVE-2024-33971 · Other software · Janobe · reported by cve-coordination@incibe.esCritical 9.8
SQL injection vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in it through the following 'username' in '/login.php' parameter.
Product
School Attendance Monitoring System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record incibe.es
Aug 6, 2024SQL injection vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0.CVE-2024-33970 · Other software · Janobe · reported by cve-coordination@incibe.esCritical 9.8
SQL injection vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in it through the following 'studid' in '/candidate/controller.php' parameter.
Product
School Attendance Monitoring System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record incibe.es
Aug 6, 2024SQL injection vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0.CVE-2024-33969 · Other software · Janobe · reported by cve-coordination@incibe.esCritical 9.8
SQL injection vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in it through the following 'id' in '/AttendanceMonitoring/department/index.php' parameter.
Product
School Attendance Monitoring System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record incibe.es
Aug 6, 2024SQL injection vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0.CVE-2024-33968 · Other software · Janobe · reported by cve-coordination@incibe.esCritical 9.8
SQL injection vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in it through the following 'Attendance' and 'YearLevel' in '/AttendanceMonitoring/report/index.php' parameter.
Product
School Attendance Monitoring System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record incibe.es
Aug 6, 2024SQL injection vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0.CVE-2024-33967 · Other software · Janobe · reported by cve-coordination@incibe.esCritical 9.8
SQL injection vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in it through the following 'view' in 'Attendance' and 'YearLevel' in '/AttendanceMonitoring/report/attendance_print.php' parameter.
Product
School Attendance Monitoring System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record incibe.es
Aug 6, 2024SQL injection vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0.CVE-2024-33966 · Other software · Janobe · reported by cve-coordination@incibe.esCritical 9.8
SQL injection vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in it through the following 'xtsearch' in '/admin/mod_reports/index.php' parameter.
Product
Janobe PayPal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record incibe.es
Aug 6, 2024SQL injection vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0.CVE-2024-33965 · Other software · Janobe · reported by cve-coordination@incibe.esCritical 9.8
SQL injection vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in it through the following 'view' in '/tubigangarden/admin/mod_accomodation/index.php' parameter.
Product
Janobe PayPal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record incibe.es
Aug 6, 2024SQL injection vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0.CVE-2024-33964 · Other software · Janobe · reported by cve-coordination@incibe.esCritical 9.8
SQL injection vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in it through the following 'id' in '/admin/mod_users/index.php' parameter.
Product
Janobe PayPal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record incibe.es
Aug 6, 2024SQL injection vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0.CVE-2024-33963 · Other software · Janobe · reported by cve-coordination@incibe.esCritical 9.8
SQL injection vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in it through the following 'id' in '/admin/mod_room/index.php' parameter.
Product
Janobe PayPal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record incibe.es
Aug 6, 2024SQL injection vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0.CVE-2024-33962 · Other software · Janobe · reported by cve-coordination@incibe.esCritical 9.8
SQL injection vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in it through the following 'code' in '/admin/mod_reservation/index.php' parameter.
Product
Janobe PayPal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record incibe.es
Aug 6, 2024SQL injection vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0.CVE-2024-33961 · Other software · Janobe · reported by cve-coordination@incibe.esCritical 9.8
SQL injection vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in it through the following 'code' in '/admin/mod_reservation/controller.php' parameter.
Product
Janobe PayPal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record incibe.es
Aug 6, 2024SQL injection vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0.CVE-2024-33960 · Other software · Janobe · reported by cve-coordination@incibe.esCritical 9.8
SQL injection vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in it through the following 'end' in '/admin/mod_reports/printreport.php' parameter.
Product
Janobe PayPal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record incibe.es
Aug 6, 2024SQL injection vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0.CVE-2024-33959 · Other software · Janobe · reported by cve-coordination@incibe.esCritical 9.8
SQL injection vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in it through the following 'categ' in '/admin/mod_reports/printreport.php' parameter.
Product
Janobe PayPal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record incibe.es
Aug 6, 2024SQL injection vulnerability in E-Negosyo System affecting version 1.0.CVE-2024-33958 · Other software · Janobe · reported by cve-coordination@incibe.esCritical 9.8
SQL injection vulnerability in E-Negosyo System affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in 'phonenumber' in '/passwordrecover.php' parameter.
Product
E-Negosyo System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record incibe.es
Aug 6, 2024SQL injection vulnerability in E-Negosyo System affecting version 1.0.CVE-2024-33957 · Other software · Janobe · reported by cve-coordination@incibe.esCritical 9.8
SQL injection vulnerability in E-Negosyo System affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in 'id' in '/admin/orders/controller.php' parameter
Product
E-Negosyo System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record incibe.es
Aug 6, 2024HaloITSM versions up to 2.146.1 are affected by a SAML XML Signature Wrapping (XSW) vulnerability.CVE-2024-6202 · Other software · Halo Service Solutions · reported by vulnerability@ncsc.chCritical 9.8
HaloITSM versions up to 2.146.1 are affected by a SAML XML Signature Wrapping (XSW) vulnerability. When having a SAML integration configured, anonymous actors could impersonate arbitrary HaloITSM users by just knowing their email address. HaloITSM versions past 2.146.1 (and patches starting from 2.143.61 ) fix the mentioned vulnerability.
Product
HaloITSM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record haloitsm.com
Aug 6, 2024Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea Gitea Open Source Git Server allows Stored XSCVE-2024-6886 · Other software · Gitea · reported by 88ee5874-cf24-4952-aea0-31affedb7ff2Critical 10
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea Gitea Open Source Git Server allows Stored XSS.This issue affects Gitea Open Source Git Server: 1.22.0.
Product
Gitea Open Source Git Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.gitea.com github.com
Aug 6, 2024Improper access control in Calibre 6.9.0 ~ 7.14.0 allow unauthenticated attackers to achieve remote code execution.CVE-2024-6782 · Other software · Calibre · reported by info@starlabs.sgCritical 9.8
Improper access control in Calibre 6.9.0 ~ 7.14.0 allow unauthenticated attackers to achieve remote code execution.
Product
Calibre
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com starlabs.sg
Aug 5, 2024JFrog Artifactory versions below 7.90.6, 7.84.20, 7.77.14, 7.71.23, 7.68.22, 7.63.22, 7.59.23, 7.55.18 are vulnerable to Improper Input Validation that could poCVE-2024-6915 · Other software · JFrog · reported by reefs@jfrog.comCritical 9.3
JFrog Artifactory versions below 7.90.6, 7.84.20, 7.77.14, 7.71.23, 7.68.22, 7.63.22, 7.59.23, 7.55.18 are vulnerable to Improper Input Validation that could potentially lead to cache poisoning.
Product
Artifactory
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jfrog.com
Aug 5, 2024RoundCube Webmail Cross-Site Scripting VulnerabilityCVE-2024-42009 · Websites & servers · Roundcube · reported by MITREExploitedCritical 9.3
RoundCube Webmail contains a cross-site scripting vulnerability. This vulnerability could allow a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.
Product
Webmail
On CISA’s list since
Jun 9, 2025 (federal fix deadline Jun 30, 2025)
What to do
Attackers are using this now. Install Roundcube’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
Aug 5, 2024A Cross-Site Scripting vulnerability in rcmail_action_mail_get->run() in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and sCVE-2024-42008 · Websites & servers · Roundcube · reported by MITRECritical 9.3
A Cross-Site Scripting vulnerability in rcmail_action_mail_get->run() in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a malicious e-mail attachment served with a dangerous Content-Type header.
Product
Webmail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 5, 2024SQL Injection vulnerability in PuneethReddyHC Online Shopping sysstem advanced v.1.0 allows an attacker to execute arbitrary code via the register.phpCVE-2024-40498 · Other software · puneethreddyhc · reported by MITRECritical 9.8
SQL Injection vulnerability in PuneethReddyHC Online Shopping sysstem advanced v.1.0 allows an attacker to execute arbitrary code via the register.php
Product
online_shopping_system_advanced
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Aug 5, 2024Improper filering of special characters result in a command ('command injection') vulnerability in Korenix JetPort 5601v3.This issue affects JetPort 5601v3: thrCVE-2024-7397 · Other software · Korenix · reported by office@cyberdanube.comCritical 9.3
Improper filering of special characters result in a command ('command injection') vulnerability in Korenix JetPort 5601v3.This issue affects JetPort 5601v3: through 1.2.
Product
JetPort 5601v3
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cyberdanube.com seclists.org
Aug 5, 2024An authentication bypass vulnerability in Korenix JetPort 5601v3 allows an attacker to access functionality on the device without specifying a password.This issCVE-2024-7395 · Other software · Korenix · reported by office@cyberdanube.comCritical 9.3
An authentication bypass vulnerability in Korenix JetPort 5601v3 allows an attacker to access functionality on the device without specifying a password.This issue affects JetPort 5601v3: through 1.2.
Product
JetPort 5601v3
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cyberdanube.com seclists.org
Aug 5, 2024Apache OFBiz Incorrect Authorization VulnerabilityCVE-2024-38856 · Websites & servers · Apache · reported by security@apache.orgExploitedCritical 9.8
Apache OFBiz contains an incorrect authorization vulnerability that could allow remote code execution via a Groovy payload in the context of the OFBiz user process by an unauthenticated attacker.
Product
OFBiz
On CISA’s list since
Aug 27, 2024 (federal fix deadline Sep 17, 2024)
What to do
Attackers are using this now. Install Apache’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog issues.apache.org lists.apache.org
Aug 5, 2024Insufficient Session Expiration vulnerability in Apache Airflow Providers FAB.CVE-2024-42447 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Insufficient Session Expiration vulnerability in Apache Airflow Providers FAB. This issue affects Apache Airflow Providers FAB: 1.2.1 (when used with Apache Airflow 2.9.3) and FAB 1.2.0 for all Airflow versions. The FAB provider prevented the user from logging out. * FAB provider 1.2.1 only affected Airflow 2.9.3 (earlier and later versions of Airflow are not affected) * FAB provider 1.2.0 affected all versions of Airflow. Users who run Apache Airflow 2.9.3 are recommended to upgrade to Apache Airflow Providers FAB version 1.2.2 which fixes the issue. Users who run Any Apache Airflow version and have FAB provider 1.2.0 are recommended to upgrade to Apache Airflow Providers FAB version 1.2.2 which fixes the issue. Also upgrading Apache Airflow to latest version available is recommended. Note: Early version of Airflow reference container images of Airflow 2.9.3 and constraint files contained FAB provider 1.2.1 version, but this is fixed in updated versions of the images. Users are advised to pull the latest Airflow images or reinstall FAB provider according to the current constraints.
Product
Apache Airflow Providers FAB
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com lists.apache.org
Aug 5, 2024A Plaintext Storage of a Password vulnerability in ebooknote function in Hamastar MeetingHub Paperless Meetings 2021 allows remote attackers to obtain the otherCVE-2024-6118 · Other software · Hamastar Technology · reported by ART@zuso.aiCritical 9.3
A Plaintext Storage of a Password vulnerability in ebooknote function in Hamastar MeetingHub Paperless Meetings 2021 allows remote attackers to obtain the other users’ credentials and gain access to the product via an XML file.
Product
MeetingHub Paperless Meetings
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zuso.ai
Aug 5, 2024A Unrestricted upload of file with dangerous type vulnerability in meeting management function in Hamastar MeetingHub Paperless Meetings 2021 allows remote authCVE-2024-6117 · Other software · Hamastar Technology · reported by ART@zuso.aiCritical 9.3
A Unrestricted upload of file with dangerous type vulnerability in meeting management function in Hamastar MeetingHub Paperless Meetings 2021 allows remote authenticated users to perform arbitrary system commands via a crafted ASP file.
Product
MeetingHub Paperless Meetings
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zuso.ai
Aug 5, 2024Multiple Pimax products accept WebSocket connections from unintended endpoints.CVE-2024-41889 · Other software · Pimax · reported by vultures@jpcert.or.jpCritical 9.8
Multiple Pimax products accept WebSocket connections from unintended endpoints. If this vulnerability is exploited, arbitrary code may be executed by a remote unauthenticated attacker.
Product
Pimax Play
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com jvn.jp
Aug 3, 2024YayExtra – WooCommerce Extra Product Options: Arbitrary file uploadsCVE-2024-7257 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The YayExtra – WooCommerce Extra Product Options plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the handle_upload_file function in all versions up to, and including, 1.3.7. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
YayExtra – WooCommerce Extra Product Options
Affected
up to 1.3.7
What to do
Affects up to 1.3.7. Update YayExtra – WooCommerce Extra Product Options to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 2, 2024An issue in Horizon Business Services Inc.CVE-2024-38887 · Other software · horizoncloud · reported by MITRECritical 9.8
An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a remote attacker to expand control over the operating system from the database due to the execution of commands with unnecessary privileges.
Product
caterease
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com vuldb.com
Aug 2, 2024FOG is a cloning/imaging/rescue suite/inventory management system.CVE-2024-42348 · Other software · FOGProject · reported by GitHubCritical 9.3
FOG is a cloning/imaging/rescue suite/inventory management system. FOG Server 1.5.10.41.2 can leak AD username and password when registering a computer. This vulnerability is fixed in 1.5.10.41.3 and 1.6.0-beta.1395.
Product
fogproject
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Aug 2, 2024An issue in Horizon Business Services Inc.CVE-2024-38889 · Other software · horizoncloud · reported by MITRECritical 9.8
An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a remote attacker to perform SQL Injection due to improper neutralization of special elements used in an SQL command.
Product
caterease
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com vuldb.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.