Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
38,876 results · page 318 of 778
Aug 2, 2024An issue in Horizon Business Services Inc.CVE-2024-38886 · Other software · horizoncloud · reported by MITRECritical 9.8
An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a remote attacker to perform a Traffic Injection attack due to improper verification of the source of a communication channel.
- Product
- caterease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comvuldb.com
Aug 2, 2024An issue in Horizon Business Services Inc.CVE-2024-38883 · Other software · horizoncloud · reported by MITRECritical 9.1
An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a remote attacker to perform a Drop Encryption Level attack due to the selection of a less-secure algorithm during negotiation.
- Product
- caterease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comvuldb.com
Aug 2, 2024An issue in Horizon Business Services Inc.CVE-2024-38882 · Other software · horizoncloud · reported by MITRECritical 9.8
An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a remote attacker to perform command line execution through SQL Injection due to improper neutralization of special elements used in an OS command.
- Product
- caterease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comvuldb.com
Aug 2, 2024anji-plus AJ-Report is affected by an authentication bypass vulnerability.CVE-2024-7314 · Other software · anji-plus · reported by VulnCheckCritical 9.8
anji-plus AJ-Report is affected by an authentication bypass vulnerability. A remote and unauthenticated attacker can append ";swagger-ui" to HTTP requests to bypass authentication and execute arbitrary Java on the victim server. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-05 UTC.
- Product
- AJ-Report
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2024Improper Control of Generation of Code ('Code Injection') vulnerability in Apache InLong.CVE-2024-36268 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache InLong. This issue affects Apache InLong: from 1.10.0 through 1.12.0, which could lead to Remote Code Execution. Users are advised to upgrade to Apache InLong's 1.13.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/10251
- Product
- Apache InLong TubeMQ Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Aug 2, 2024In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because BER-encoded signatures are allowed.CVE-2024-42461 · Other software · elliptic_project · reported by MITRECritical 9.1
In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because BER-encoded signatures are allowed.
- Product
- elliptic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecurity.netapp.com
Aug 2, 2024server.c in Neat VNC (aka neatvnc) before 0.8.1 does not properly validate the security type, a related issue to CVE-2006-2369.CVE-2024-42458 · Other software · any1 · reported by MITRECritical 9.8
server.c in Neat VNC (aka neatvnc) before 0.8.1 does not properly validate the security type, a related issue to CVE-2006-2369.
- Product
- neatvnc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 1, 2024Under certain circumstances the communication between exacqVision Client and exacqVision Server will use insufficient key length and exchangeCVE-2024-32758 · Other software · Johnson Controls · reported by productsecurity@jci.comCritical 9
Under certain circumstances the communication between exacqVision Client and exacqVision Server will use insufficient key length and exchange
- Product
- exacqVision
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcisa.govjohnsoncontrols.com
Aug 1, 2024Dispatch's notification service uses Jinja templates to generate messages to users.CVE-2024-7093 · Other software · Netflix · reported by security-report@netflix.comCritical 9.4
Dispatch's notification service uses Jinja templates to generate messages to users. Jinja permits code execution within blocks, which were neither properly sanitized nor sandboxed. This vulnerability enables users to construct command line scripts in their custom message templates, which are then executed whenever these notifications are rendered and sent out.
- Product
- Dispatch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 1, 2024Use of insecure hashing algorithm in the Gravatar's service in Navidrome v0.52.3 allows attackers to manipulate a user's account information.CVE-2024-41259 · Other software · navidrome · reported by MITRECritical 9.1
Use of insecure hashing algorithm in the Gravatar's service in Navidrome v0.52.3 allows attackers to manipulate a user's account information.
- Product
- navidrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 1, 2024ListingPro: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-39619 · WordPress plugins & themes · reported by PatchstackCritical 9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in CridioStudio ListingPro listingpro-plugin allows PHP Local File Inclusion.This issue affects ListingPro: from n/a through <= 2.9.4.
- Product
- ListingPro
- Affected
- up to 2.9.4
- What to do
- Affects up to 2.9.4. Update ListingPro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 1, 2024Backup and Staging by WP Time Capsule: Improper Privilege ManagementCVE-2024-38770 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Improper Privilege Management vulnerability in Revmakx Backup and Staging by WP Time Capsule allows Privilege Escalation, Authentication Bypass.This issue affects Backup and Staging by WP Time Capsule: from n/a through 1.22.20.
- Product
- Backup and Staging by WP Time Capsule
- Affected
- up to 1.22.20
- What to do
- Affects up to 1.22.20. Update Backup and Staging by WP Time Capsule to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 1, 2024Elektra is an opinionated Openstack Dashboard for Operators and Consumers of Openstack Services.CVE-2024-41961 · Network & remote access · sapcc · reported by GitHubCritical 9.6
Elektra is an opinionated Openstack Dashboard for Operators and Consumers of Openstack Services. A code injection vulnerability was found in the live search functionality of the Ruby on Rails based Elektra web application. An authenticated user can craft a search term containing Ruby code, which later flows into an `eval` sink which executes the code. Fixed in commit 8bce00be93b95a6512ff68fe86bf9554e486bc02.
- Product
- elektra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2024A vulnerability was found in TOTOLINK CP450 4.1.0cu.747_B20191224.CVE-2024-7332 · Other software · TOTOLINK · reported by VulDBCritical 9.3
A vulnerability was found in TOTOLINK CP450 4.1.0cu.747_B20191224. It has been classified as critical. This affects an unknown part of the file /web_cste/cgi-bin/product.ini of the component Telnet Service. The manipulation leads to use of hard-coded password. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-273255. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- CP450
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2024Weak authentication in Microsoft Dynamics 365 allows an unauthenticated attacker to elevate privileges over a network.CVE-2024-38182 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9
Weak authentication in Microsoft Dynamics 365 allows an unauthenticated attacker to elevate privileges over a network.
- Product
- Dynamics 365 Field Service (on-premises) v7 series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2024slpd-lite is a unicast SLP UDP server.CVE-2024-41660 · Other software · openbmc · reported by GitHubCritical 9.8
slpd-lite is a unicast SLP UDP server. Any OpenBMC system that includes the slpd-lite package is impacted. Installing this package is the default when building OpenBMC. Nefarious users can send slp packets to the BMC using UDP port 427 to cause memory overflow issues within the slpd-lite daemon on the BMC. Patches will be available in the latest openbmc/slpd-lite repository.
- Product
- slpd-lite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2024XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it.CVE-2024-41947 · Other software · xwiki · reported by GitHubCritical 9
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. By creating a conflict when another user with more rights is currently editing a page, it is possible to execute JavaScript snippets on the side of the other user, which compromises the confidentiality, integrity and availability of the whole XWiki installation. This has been patched in XWiki 15.10.8 and 16.3.0RC1.
- Product
- xwiki-platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2024XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it.CVE-2024-37901 · Other software · xwiki · reported by GitHubCritical 9.9
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with edit right on any page can perform arbitrary remote code execution by adding instances of `XWiki.SearchSuggestConfig` and `XWiki.SearchSuggestSourceClass` to their user profile or any other page. This compromises the confidentiality, integrity and availability of the whole XWiki installation. This vulnerability has been patched in XWiki 14.10.21, 15.5.5 and 15.10.2.
- Product
- xwiki-platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2024A verbose error handling issue in the proxy service implemented in the GravityZone Update Server allows an attacker to cause a server-side request forgery.CVE-2024-6980 · Other software · Bitdefender · reported by cve-requests@bitdefender.comCritical 9.2
A verbose error handling issue in the proxy service implemented in the GravityZone Update Server allows an attacker to cause a server-side request forgery. This issue only affects GravityZone Console versions before 6.38.1-5 running only on premise.
- Product
- GravityZone Update Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2024When the device is shared, the homepage module are before 2.19.0 in eWeLink Cloud Service allows Secondary user to take over devices as primary user via sharinCVE-2024-7205 · Other software · CoolKit · reported by 68870bb1-d075-4169-957d-e580b18692b9Critical 9.4
When the device is shared, the homepage module are before 2.19.0 in eWeLink Cloud Service allows Secondary user to take over devices as primary user via sharing unnecessary device-sensitive information.
- Product
- eWeLink Cloud Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2024it's possible for an attacker to gain administrative access without having any kind of account on the targeted site and perform unauthorized actions.CVE-2024-6695 · WordPress plugins & themes · reported by WPScanCritical 9.8
it's possible for an attacker to gain administrative access without having any kind of account on the targeted site and perform unauthorized actions. This is due to improper logic flow on the user registration process.
- Fixed in
- 3.11.9
- What to do
- Update the plugin to 3.11.9 or newer.
Jul 30, 2024Prototype Pollution in alykoshin mini-deep-assign v0.0.8 allows an attacker to execute arbitrary code or cause a Denial of Service (DoS) and cause other impactsCVE-2024-38983 · Other software · alykoshin · reported by MITRECritical 9.8
Prototype Pollution in alykoshin mini-deep-assign v0.0.8 allows an attacker to execute arbitrary code or cause a Denial of Service (DoS) and cause other impacts via the _assign() method at (/lib/index.js:91)
- Product
- mini-deep-assign
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jul 30, 2024In D-Link DIR-860L REVA FIRMWARE PATCH 1.10..B04, the Telnet service contains hardcoded credentials, enabling attackers to log in remotely to the Telnet serviceCVE-2024-41611 · Other software · dlink · reported by MITRECritical 9.8
In D-Link DIR-860L REVA FIRMWARE PATCH 1.10..B04, the Telnet service contains hardcoded credentials, enabling attackers to log in remotely to the Telnet service and perform arbitrary commands.
- Product
- dir-860l_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2024D-Link DIR-820LW REVB FIRMWARE PATCH 2.03.B01_TC contains hardcoded credentials in the Telnet service, enabling attackers to log in remotely to the Telnet serviCVE-2024-41610 · Other software · dlink · reported by MITRECritical 9.8
D-Link DIR-820LW REVB FIRMWARE PATCH 2.03.B01_TC contains hardcoded credentials in the Telnet service, enabling attackers to log in remotely to the Telnet service and perform arbitrary commands.
- Product
- dir-820lw_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2024ais-ltd strategyen v0.4.0 was discovered to contain a prototype pollution via the function mergeObjects.CVE-2024-39012 · Other software · aisltd · reported by MITRECritical 9.8
ais-ltd strategyen v0.4.0 was discovered to contain a prototype pollution via the function mergeObjects. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
- Product
- strategyen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jul 30, 2024Prototype Pollution in chargeover redoc v2.0.9-rc.69 allows attackers to execute arbitrary code or cause a Denial of Service (DoS) and cause other impacts via tCVE-2024-39011 · Other software · redocly · reported by MITRECritical 9.8
Prototype Pollution in chargeover redoc v2.0.9-rc.69 allows attackers to execute arbitrary code or cause a Denial of Service (DoS) and cause other impacts via the function mergeObjects.
- Product
- redoc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jul 30, 2024chase-moskal snapstate v0.0.9 was discovered to contain a prototype pollution via the function attemptNestedProperty.CVE-2024-39010 · Other software · chasemoskal · reported by MITRECritical 9.8
chase-moskal snapstate v0.0.9 was discovered to contain a prototype pollution via the function attemptNestedProperty. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
- Product
- snapstate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jul 30, 2024Prototype Pollution in 75lb deep-merge 1.1.1 allows attackers to execute arbitrary code or cause a Denial of Service (DoS) and cause other impacts via merge metCVE-2024-38986 · Other software · 75lb · reported by MITRECritical 9.8
Prototype Pollution in 75lb deep-merge 1.1.1 allows attackers to execute arbitrary code or cause a Denial of Service (DoS) and cause other impacts via merge methods of lodash to merge objects.
- Product
- deep-merge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jul 30, 2024Prototype Pollution in lukebond json-override 0.2.0 allows attackers to to execute arbitrary code or cause a Denial of Service (DoS) via the __proto__ property.CVE-2024-38984 · Other software · lukebond · reported by MITRECritical 9.8
Prototype Pollution in lukebond json-override 0.2.0 allows attackers to to execute arbitrary code or cause a Denial of Service (DoS) via the __proto__ property.
- Product
- json-override
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jul 30, 2024Prototype pollution in allpro form-manager 0.7.4 allows attackers to run arbitrary code and cause other impacts via the functions setDefaults, mergeBranch, and CVE-2024-36572 · Other software · allpro · reported by MITRECritical 9.8
Prototype pollution in allpro form-manager 0.7.4 allows attackers to run arbitrary code and cause other impacts via the functions setDefaults, mergeBranch, and Object.setObjectValue.
- Product
- form-manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jul 30, 2024Studio 42 elFinder 2.1.64 is vulnerable to Incorrect Access Control.CVE-2024-38909 · Other software · studio42 · reported by MITRECritical 9.8
Studio 42 elFinder 2.1.64 is vulnerable to Incorrect Access Control. Copying files with an unauthorized extension between server directories allows an arbitrary attacker to expose secrets, perform RCE, etc.
- Product
- elfinder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2024Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mikafon Electronic Inc.CVE-2024-6699 · Other software · Mikafon Electronic Inc. · reported by iletisim@usom.gov.trCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mikafon Electronic Inc. Mikafon MA7 allows SQL Injection. This issue affects Mikafon MA7: from v3.0 before v3.1.
- Product
- Mikafon MA7
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Jul 30, 2024SiberianCMS - CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-41702 · Other software · SiberianCMS · reported by cna@cyber.gov.ilCritical 9.8
SiberianCMS - CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
- Product
- SiberianCMS v5.0.8
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2024Web Authentication vulnerability in Apache SeaTunnel.CVE-2023-48396 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.1
Web Authentication vulnerability in Apache SeaTunnel. Since the jwt key is hardcoded in the application, an attacker can forge any token to log in any user. Attacker can get secret key in /seatunnel-server/seatunnel-app/src/main/resources/application.yml and then create a token. This issue affects Apache SeaTunnel: 1.0.0. Users are recommended to upgrade to version 1.0.1, which fixes the issue.
- Product
- Apache SeaTunnel Web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comlists.apache.org
Jul 30, 2024In the Linux kernel, the following vulnerability has been resolved: net: rswitch: Avoid use-after-free in rswitch_poll() The use-after-free is actually in rswCVE-2024-42108 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Critical 9.8
In the Linux kernel, the following vulnerability has been resolved: net: rswitch: Avoid use-after-free in rswitch_poll() The use-after-free is actually in rswitch_tx_free(), which is inlined in rswitch_poll(). Since `skb` and `gq->skbs[gq->dirty]` are in fact the same pointer, the skb is first freed using dev_kfree_skb_any(), then the value in skb->len is used to update the interface statistics. Let's move around the instructions to use skb->len before the skb is freed. This bug is trivial to reproduce using KFENCE. It will trigger a splat every few packets. A simple ARP request or ICMP echo request is enough.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jul 30, 2024CZ Loan Management: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2024-5975 · WordPress plugins & themes · reported by WPScanCritical 9.1
The CZ Loan Management WordPress plugin through 1.1 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
- Product
- CZ Loan Management
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update CZ Loan Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 30, 2024WpStickyBar: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2024-5765 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WpStickyBar WordPress plugin through 2.1.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
- Product
- WpStickyBar
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update WpStickyBar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 29, 2024SQL Injection vulnerability in Lost and Found Information System 1.0 allows a remote attacker to escalate privileges via the id parameter to php-lfis/admin/cateCVE-2024-37858 · Other software · lost_and_found_information_system_project · reported by MITRECritical 9.8
SQL Injection vulnerability in Lost and Found Information System 1.0 allows a remote attacker to escalate privileges via the id parameter to php-lfis/admin/categories/manage_category.php.
- Product
- lost_and_found_information_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comsourcecodester.com
Jul 29, 2024An issue was discovered in Italtel i-MCS NFV 12.1.0-20211215.CVE-2024-28805 · Other software · italtel · reported by MITRECritical 9.1
An issue was discovered in Italtel i-MCS NFV 12.1.0-20211215. There is Incorrect Access Control.
- Product
- i-mcs_nfv
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgruppotim.itgruppotim.it
Jul 29, 2024In the Linux kernel, the following vulnerability has been resolved: ila: block BH in ila_output() As explained in commit 1378817486d6 ("tipc: block BH before CVE-2024-41081 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Critical 9.8
In the Linux kernel, the following vulnerability has been resolved: ila: block BH in ila_output() As explained in commit 1378817486d6 ("tipc: block BH before using dst_cache"), net/core/dst_cache.c helpers need to be called with BH disabled. ila_output() is called from lwtunnel_output() possibly from process context, and under rcu_read_lock(). We might be interrupted by a softirq, re-enter ila_output() and corrupt dst_cache data structures. Fix the race by using local_bh_disable().
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jul 29, 2024In the Linux kernel, the following vulnerability has been resolved: nvme: avoid double free special payload If a discard request needs to be retried, and thatCVE-2024-41073 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Critical 9.8
In the Linux kernel, the following vulnerability has been resolved: nvme: avoid double free special payload If a discard request needs to be retried, and that retry may fail before a new special payload is added, a double free will result. Clear the RQF_SPECIAL_LOAD when the request is cleaned.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jul 29, 2024In the Linux kernel, the following vulnerability has been resolved: net/sched: Fix UAF when resolving a clash KASAN reports the following UAF: BUG: KASAN: sCVE-2024-41040 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Critical 9.8
In the Linux kernel, the following vulnerability has been resolved: net/sched: Fix UAF when resolving a clash KASAN reports the following UAF: BUG: KASAN: slab-use-after-free in tcf_ct_flow_table_process_conn+0x12b/0x380 [act_ct] Read of size 1 at addr ffff888c07603600 by task handler130/6469 Call Trace: <IRQ> dump_stack_lvl+0x48/0x70 print_address_description.constprop.0+0x33/0x3d0 print_report+0xc0/0x2b0 kasan_report+0xd0/0x120 __asan_load1+0x6c/0x80 tcf_ct_flow_table_process_conn+0x12b/0x380 [act_ct] tcf_ct_act+0x886/0x1350 [act_ct] tcf_action_exec+0xf8/0x1f0 fl_classify+0x355/0x360 [cls_flower] __tcf_classify+0x1fd/0x330 tcf_classify+0x21c/0x3c0 sch_handle_ingress.constprop.0+0x2c5/0x500 __netif_receive_skb_core.constprop.0+0xb25/0x1510 __netif_receive_skb_list_core+0x220/0x4c0 netif_receive_skb_list_internal+0x446/0x620 napi_complete_done+0x157/0x3d0 gro_cell_poll+0xcf/0x100 __napi_poll+0x65/0x310 net_rx_action+0x30c/0x5c0 __do_softirq+0x14f/0x491 __irq_exit_rcu+0x82/0xc0 irq_exit_rcu+0xe/0x20 common_interrupt+0xa1/0xb0 </IRQ> <TASK> asm_common_interrupt+0x27/0x40 Allocated by task 6469: kasan_save_stack+0x38/0x7
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jul 29, 2024Admidio is a free, open source user management system for websites of organizations and groups.CVE-2024-38529 · Other software · Admidio · reported by GitHubCritical 9
Admidio is a free, open source user management system for websites of organizations and groups. In Admidio before version 4.3.10, there is a Remote Code Execution Vulnerability in the Message module of the Admidio Application, where it is possible to upload a PHP file in the attachment. The uploaded file can be accessed publicly through the URL `{admidio_base_url}/adm_my_files/messages_attachments/{file_name}`. The vulnerability is caused due to the lack of file extension verification, allowing malicious files to be uploaded to the server and public availability of the uploaded file. This vulnerability is fixed in 4.3.10.
- Product
- admidio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2024Admidio is a free, open source user management system for websites of organizations and groups.CVE-2024-37906 · Other software · Admidio · reported by GitHubCritical 9.9
Admidio is a free, open source user management system for websites of organizations and groups. In Admidio before version 4.3.9, there is an SQL Injection in the `/adm_program/modules/ecards/ecard_send.php` source file of the Admidio Application. The SQL Injection results in a compromise of the application's database. The value of `ecard_recipients `POST parameter is being directly concatenated with the SQL query in the source code causing the SQL Injection. The SQL Injection can be exploited by a member user, using blind condition-based, time-based, and Out of band interaction SQL Injection payloads. This vulnerability is fixed in 4.3.9.
- Product
- admidio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2024User Profile Builder: Does not have proper authorisationCVE-2024-6366 · WordPress plugins & themes · reported by WPScanCritical 9.1
The User Profile Builder WordPress plugin before 3.11.8 does not have proper authorisation, allowing unauthenticated users to upload media files via the async upload functionality of WP.
- Product
- User Profile Builder
- Fixed in
- 3.11.8
- What to do
- Update User Profile Builder to 3.11.8 or newer.
Jul 29, 2024The query functionality of WinMatrix3 Web package from Simopro Technology lacks proper validation of user input, allowing unauthenticated remote attackers to inCVE-2024-7202 · Other software · Simopro Technology · reported by twcert@cert.org.twCritical 9.8
The query functionality of WinMatrix3 Web package from Simopro Technology lacks proper validation of user input, allowing unauthenticated remote attackers to inject SQL commands to read, modify, and delete database contents.
- Product
- WinMatrix3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Jul 28, 2024The login functionality of WinMatrix3 Web package from Simopro Technology lacks proper validation of user input, allowing unauthenticated remote attackers to inCVE-2024-7201 · Other software · Simopro Technology · reported by twcert@cert.org.twCritical 9.8
The login functionality of WinMatrix3 Web package from Simopro Technology lacks proper validation of user input, allowing unauthenticated remote attackers to inject SQL commands to read, modify, and delete database contents.
- Product
- WinMatrix3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Jul 28, 2024The web services of Softnext's products, Mail SQR Expert and Mail Archiving Expert do not properly validate user input, allowing unauthenticated remote attackerCVE-2024-5670 · Other software · Softnext · reported by twcert@cert.org.twCritical 9.8
The web services of Softnext's products, Mail SQR Expert and Mail Archiving Expert do not properly validate user input, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the remote server.
- Product
- SN OS 12.1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Jul 27, 2024TightVNC (Server for Windows) before 2.8.84 allows attackers to connect to the control pipe via a network connection.CVE-2024-42049 · Other software · tightvnc · reported by MITRECritical 9.1
TightVNC (Server for Windows) before 2.8.84 allows attackers to connect to the control pipe via a network connection.
- Product
- tightvnc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsourceforge.nettightvnc.com
Jul 26, 2024streamlit-geospatial is a streamlit multipage app for geospatial applications.CVE-2024-41120 · Other software · opengeos · reported by GitHubCritical 9.8
streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the `url` variable on line 63 of `pages/9_🔲_Vector_Data_Visualization.py` takes user input, which is later passed to the `gpd.read_file` method. `gpd.read_file` method creates a request to arbitrary destinations, leading to blind server-side request forgery. Commit c4f81d9616d40c60584e36abb15300853a66e489 fixes this issue.
- Product
- streamlit-geospatial
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.