Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
38,876 results · page 323 of 778
Jul 5, 202414Finger v1.1 was discovered to contain an arbitrary user deletion vulnerability via the component /api/admin/user?id.CVE-2024-37768 · Other software · B1ackc4t · reported by MITRECritical 9.1
14Finger v1.1 was discovered to contain an arbitrary user deletion vulnerability via the component /api/admin/user?id.
- Product
- 14finger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 5, 2024Volmarg Personal Management System 1.4.64 is vulnerable to SSRF (Server Side Request Forgery) via uploading a SVG file.CVE-2024-29319 · Other software · volmarg · reported by MITRECritical 9.8
Volmarg Personal Management System 1.4.64 is vulnerable to SSRF (Server Side Request Forgery) via uploading a SVG file. The server can make unintended HTTP and DNS requests to a server that the attacker controls.
- Product
- personal_management_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 5, 2024goanother Another Redis Desktop Manager =<1.6.1 is vulnerable to Cross Site Scripting (XSS) via src/components/Setting.vue.CVE-2024-23998 · Other software · goanother · reported by MITRECritical 9.6
goanother Another Redis Desktop Manager =<1.6.1 is vulnerable to Cross Site Scripting (XSS) via src/components/Setting.vue.
- Product
- another_redis_desktop_manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 5, 2024Lukas Bach yana =<1.0.16 is vulnerable to Cross Site Scripting (XSS) via src/electron-main.ts.CVE-2024-23997 · Other software · lukasbach · reported by MITRECritical 9.6
Lukas Bach yana =<1.0.16 is vulnerable to Cross Site Scripting (XSS) via src/electron-main.ts.
- Product
- yana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 5, 2024The CloudStack integration API service allows running its unauthenticated API server (usually on port 8096 when configured and enabled via integration.api.port CVE-2024-39864 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
The CloudStack integration API service allows running its unauthenticated API server (usually on port 8096 when configured and enabled via integration.api.port global setting) for internal portal integrations and for testing purposes. By default, the integration API service port is disabled and is considered disabled when integration.api.port is set to 0 or negative. Due to an improper initialisation logic, the integration API service would listen on a random port when its port value is set to 0 (default value). An attacker that can access the CloudStack management network could scan and find the randomised integration API service port and exploit it to perform unauthorised administrative actions and perform remote code execution on CloudStack managed hosts and result in complete compromise of the confidentiality, integrity, and availability of CloudStack managed infrastructure. Users are recommended to restrict the network access on the CloudStack management server hosts to only essential ports. Users are recommended to upgrade to version 4.18.2.1, 4.19.0.2 or later, which addresses this issue.
- Product
- Apache CloudStack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comcloudstack.apache.org
Jul 5, 2024An issue was discovered in SeaCMS <=12.9 which allows remote attackers to execute arbitrary code via admin_ping.php.CVE-2024-39028 · Other software · seacms · reported by MITRECritical 9.8
An issue was discovered in SeaCMS <=12.9 which allows remote attackers to execute arbitrary code via admin_ping.php.
- Product
- seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 5, 2024The CloudStack cluster service runs on unauthenticated port (default 9090) that can be misused to run arbitrary commands on targeted hypervisors and CloudStack CVE-2024-38346 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
The CloudStack cluster service runs on unauthenticated port (default 9090) that can be misused to run arbitrary commands on targeted hypervisors and CloudStack management server hosts. Some of these commands were found to have command injection vulnerabilities that can result in arbitrary code execution via agents on the hosts that may run as a privileged user. An attacker that can reach the cluster service on the unauthenticated port (default 9090), can exploit this to perform remote code execution on CloudStack managed hosts and result in complete compromise of the confidentiality, integrity, and availability of CloudStack managed infrastructure. Users are recommended to restrict the network access to the cluster service port (default 9090) on a CloudStack management server host to only its peer CloudStack management server hosts. Users are recommended to upgrade to version 4.18.2.1, 4.19.0.2 or later, which addresses this issue.
- Product
- Apache CloudStack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comcloudstack.apache.org
Jul 5, 2024Unauthorized file access in WEB Server in ABB ASPECT - Enterprise v3.08.01; NEXUS Series v3.08.01 ; MATRIX Series v3.08.01 allows Attacker to execute arbiCVE-2024-6298 · Other software · ABB · reported by cybersecurity@ch.abb.comCritical 9.4
Unauthorized file access in WEB Server in ABB ASPECT - Enterprise v3.08.01; NEXUS Series v3.08.01 ; MATRIX Series v3.08.01 allows Attacker to execute arbitrary code remotely
- Product
- ASPECT-Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsearch.abb.comsearch.abb.com
Jul 5, 2024Unauthorized file access in WEB Server in ABB ASPECT - Enterprise v3.08.01; NEXUS Series v3.08.01 ; MATRIX Series v3.08.01 allows Attacker to access filesCVE-2024-6209 · Other software · ABB · reported by cybersecurity@ch.abb.comCritical 9.4
Unauthorized file access in WEB Server in ABB ASPECT - Enterprise v3.08.01; NEXUS Series v3.08.01 ; MATRIX Series v3.08.01 allows Attacker to access files unauthorized
- Product
- ASPECT-Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsearch.abb.comsearch.abb.com
Jul 4, 2024rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users (if they have Upload perCVE-2024-39943 · Other software · rejetto · reported by MITRECritical 9.9
rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users (if they have Upload permissions). This occurs because a shell is used to execute df (i.e., with execSync instead of spawnSync in child_process in Node.js).
- Product
- http_file_server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 4, 2024Gogs through 0.13.0 allows argument injection during the previewing of changes.CVE-2024-39932 · Other software · gogs · reported by MITRECritical 9.9
Gogs through 0.13.0 allows argument injection during the previewing of changes.
- Product
- gogs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsonarsource.com
Jul 4, 2024Gogs through 0.13.0 allows deletion of internal files.CVE-2024-39931 · Other software · gogs · reported by MITRECritical 9.9
Gogs through 0.13.0 allows deletion of internal files.
- Product
- gogs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsonarsource.com
Jul 4, 2024The built-in SSH server of Gogs through 0.13.0 allows argument injection in internal/ssh/ssh.go, leading to remote code execution.CVE-2024-39930 · Other software · gogs · reported by MITRECritical 9.9
The built-in SSH server of Gogs through 0.13.0 allows argument injection in internal/ssh/ssh.go, leading to remote code execution. Authenticated attackers can exploit this by opening an SSH connection and sending a malicious --split-string env request if the built-in SSH server is activated. Windows installations are unaffected.
- Product
- gogs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsonarsource.com
Jul 4, 2024QR/demoapp/qr_image.php in Asial JpGraph Professional through 4.2.6-pro allows remote attackers to execute arbitrary code via a PHP payload in the data parameteCVE-2024-39165 · Other software · reported by MITRECritical 9.8
QR/demoapp/qr_image.php in Asial JpGraph Professional through 4.2.6-pro allows remote attackers to execute arbitrary code via a PHP payload in the data parameter in conjunction with a .php file name in the filename parameter. This occurs because an unnecessary QR/demoapp folder.is shipped with the product.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsynacktiv.comsynacktiv.com
Jul 3, 2024In ZNC before 1.9.1, remote code execution can occur in modtcl via a KICK.CVE-2024-39844 · Other software · znc · reported by MITRECritical 9.8
In ZNC before 1.9.1, remote code execution can occur in modtcl via a KICK.
- Product
- znc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Jul 3, 2024An authentication bypass in the SSH service of gost v2.11.5 allows attackers to intercept communications via setting the HostKeyCallback function to ssh.InsecurCVE-2024-39223 · Other software · ginuerzh · reported by MITRECritical 9.8
An authentication bypass in the SSH service of gost v2.11.5 allows attackers to intercept communications via setting the HostKeyCallback function to ssh.InsecureIgnoreHostKey
- Product
- gost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jul 3, 2024When deploying Cloud Foundry together with the haproxy-boshrelease and using a non default configuration, it might be possible to craft HTTP requests that bypasCVE-2024-37082 · Other software · Cloud Foundry · reported by security@vmware.comCritical 9.1
When deploying Cloud Foundry together with the haproxy-boshrelease and using a non default configuration, it might be possible to craft HTTP requests that bypass mTLS authentication to Cloud Foundry applications. You are affected if you have route-services enabled in routing-release and have configured the haproxy-boshrelease property “ha_proxy.forwarded_client_cert” to “forward_only_if_route_service”.
- Product
- haproxy-boshrelease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcloudfoundry.orgcloudfoundry.org
Jul 2, 2024mySCADA myPRO uses a hard-coded password which could allow an attacker to remotely execute code on the affected device.CVE-2024-4708 · Other software · mySCADA · reported by ics-cert@hq.dhs.govCritical 9.3
mySCADA myPRO uses a hard-coded password which could allow an attacker to remotely execute code on the affected device.
- Product
- myPRO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2024Command go env is documented as outputting a shell script containing the Go environment.CVE-2023-24531 · Other software · Go toolchain · reported by security@golang.orgCritical 9.8
Command go env is documented as outputting a shell script containing the Go environment. However, go env doesn't sanitize values, so executing its output as a shell script can cause various bad bahaviors, including executing arbitrary commands or inserting new environment variables. This issue is relatively minor because, in general, if an attacker can set arbitrary environment variables on a system, they have better attack vectors than making "go env" print them out.
- Product
- cmd/go
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2024GeoTools is an open source Java library that provides tools for geospatial data.CVE-2024-36404 · Other software · geotools · reported by GitHubCritical 9.8
GeoTools is an open source Java library that provides tools for geospatial data. Prior to versions 31.2, 30.4, and 29.6, Remote Code Execution (RCE) is possible if an application uses certain GeoTools functionality to evaluate XPath expressions supplied by user input. Versions 31.2, 30.4, and 29.6 contain a fix for this issue. As a workaround, GeoTools can operate with reduced functionality by removing the `gt-complex` jar from one's application. As an example of the impact, application schema `datastore` would not function without the ability to use XPath expressions to query complex content. Alternatively, one may utilize a drop-in replacement GeoTools jar from SourceForge for versions 31.1, 30.3, 30.2, 29.2, 28.2, 27.5, 27.4, 26.7, 26.4, 25.2, and 24.0. These jars are for download only and are not available from maven central, intended to quickly provide a fix to affected applications.
- Product
- geotools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2024Under certain circumstances the web interface will accept characters unrelated to the expected input.CVE-2024-32755 · Other software · Johnson Controls · reported by productsecurity@jci.comCritical 9.1
Under certain circumstances the web interface will accept characters unrelated to the expected input.
- Product
- American Dynamics Illustra Essentials Gen 4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcisa.govjohnsoncontrols.com
Jul 2, 2024A vulnerability allows attackers to download source code or an executable from a remote location and execute the code without sufficiently verifying the origin CVE-2023-41921 · Other software · Kiloview · reported by cert@ncsc.nlCritical 9.8
A vulnerability allows attackers to download source code or an executable from a remote location and execute the code without sufficiently verifying the origin and integrity of the code. This vulnerability can allow attackers to modify the firmware before uploading it to the system, thus achieving the modification of the target’s integrity to achieve an insecure state.
- Product
- P1/P2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.ncsc.nladvisories.ncsc.nl
Jul 2, 2024The vulnerability allows attackers access to the root account without having to authenticate.CVE-2023-41920 · Other software · Kiloview · reported by cert@ncsc.nlCritical 9.8
The vulnerability allows attackers access to the root account without having to authenticate. Specifically, if the device is configured with the IP address of 10.10.10.10, the root user is automatically logged in.
- Product
- P1/P2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.ncsc.nladvisories.ncsc.nl
Jul 2, 2024Hardcoded credentials are discovered within the application's source code, creating a potential security risk for unauthorized access.CVE-2023-41919 · Other software · Kiloview · reported by cert@ncsc.nlCritical 9.8
Hardcoded credentials are discovered within the application's source code, creating a potential security risk for unauthorized access.
- Product
- P1/P2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.ncsc.nladvisories.ncsc.nl
Jul 2, 2024A vulnerability allows unauthorized access to functionality inadequately constrained by ACLs.CVE-2023-41918 · Other software · Kiloview · reported by cert@ncsc.nlCritical 10
A vulnerability allows unauthorized access to functionality inadequately constrained by ACLs. Attackers may exploit this to unauthenticated execute commands potentially leading to unauthorized data manipulation, access to privileged functions, or even the execution of arbitrary code.
- Product
- P1/P2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.ncsc.nladvisories.ncsc.nl
Jul 2, 2024Inadequate input validation exposes the system to potential remote code execution (RCE) risks.CVE-2023-41917 · Other software · Kiloview · reported by cert@ncsc.nlCritical 10
Inadequate input validation exposes the system to potential remote code execution (RCE) risks. Attackers can exploit this vulnerability by appending shell commands to the Speed-Measurement feature, enabling unauthorized code execution.
- Product
- P1/P2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.ncsc.nladvisories.ncsc.nl
Jul 2, 2024Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce: Time-based SQL InjectionCVE-2024-6172 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the db parameter in all versions up to, and including, 5.7.25 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. CVE-2024-37252 appears to be a duplicate of this issue.
- Product
- Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce
- Affected
- up to 5.7.25
- What to do
- Affects up to 5.7.25. Update Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 1, 2024Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.CVE-2024-39309 · Other software · parse-community · reported by GitHubCritical 9.8
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. A vulnerability in versions prior to 6.5.7 and 7.1.0 allows SQL injection when Parse Server is configured to use the PostgreSQL database. The algorithm to detect SQL injection has been improved in versions 6.5.7 and 7.1.0. No known workarounds are available.
- Product
- parse-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2024MachForm up to version 21 is affected by an authenticated unrestricted file upload which leads to a remote code execution.CVE-2024-37762 · Other software · machform · reported by MITRECritical 9.9
MachForm up to version 21 is affected by an authenticated unrestricted file upload which leads to a remote code execution.
- Product
- machform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2024The N-central server is vulnerable to session rebinding of already authenticated users when using Entra SSO, which can lead to authentication bypass.CVE-2024-5322 · Other software · N-able · reported by a5532a13-c4dd-4202-bef1-e0b8f2f8d12bCritical 9.1
The N-central server is vulnerable to session rebinding of already authenticated users when using Entra SSO, which can lead to authentication bypass. This vulnerability is present in all Entra-supported deployments of N-central prior to 2024.3.
- Product
- N-central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.n-able.comme.n-able.com
Jul 1, 2024trunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager.CVE-2024-38368 · Other software · CocoaPods · reported by GitHubCritical 9.3
trunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager. A vulnerability affected older pods which migrated from the pre-2014 pull request workflow to trunk. If the pods had never been claimed then it was still possible to do so. It was also possible to have all owners removed from a pod, and that made the pod available for the same claiming system. This was patched server-side in commit 71be5440906b6bdfbc0bcc7f8a9fec33367ea0f4 in September 2023.
- Product
- CocoaPods
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.cocoapods.orgblog.cocoapods.org
Jul 1, 2024trunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager.CVE-2024-38366 · Other software · CocoaPods · reported by GitHubCritical 10
trunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager. The part of trunk which verifies whether a user has a real email address on signup used a rfc-822 library which executes a shell command to validate the email domain MX records validity. It works via an DNS MX. This lookup could be manipulated to also execute a command on the trunk server, effectively giving root access to the server and the infrastructure. This issue was patched server-side with commit 001cc3a430e75a16307f5fd6cdff1363ad2f40f3 in September 2023. This RCE triggered a full user-session reset, as an attacker could have used this method to write to any Podspec in trunk.
- Product
- CocoaPods
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.cocoapods.orgevasec.webflow.io
Jul 1, 2024The N-central server is vulnerable to an authentication bypass of the user interface.CVE-2024-28200 · Other software · N-able · reported by a5532a13-c4dd-4202-bef1-e0b8f2f8d12bCritical 9.1
The N-central server is vulnerable to an authentication bypass of the user interface. This vulnerability is present in all deployments of N-central prior to 2024.2. This vulnerability was discovered through internal N-central source code review and N-able has not observed any exploitation in the wild.
- Product
- N-central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.n-able.comme.n-able.com
Jul 1, 2024An issue in the component ControlCenter.sys/ControlCenter64.sys of ThundeRobot Control Center v2.0.0.10 allows attackers to access sensitive information, executCVE-2024-39251 · Other software · thunderobot · reported by MITRECritical 10
An issue in the component ControlCenter.sys/ControlCenter64.sys of ThundeRobot Control Center v2.0.0.10 allows attackers to access sensitive information, execute arbitrary code, or escalate privileges via sending crafted IOCTL requests.
- Product
- control_center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2024Gradio v4.36.1 was discovered to contain a code injection vulnerability via the component /gradio/component_meta.py.CVE-2024-39236 · Other software · gradio_project · reported by MITRECritical 9.8
Gradio v4.36.1 was discovered to contain a code injection vulnerability via the component /gradio/component_meta.py. This vulnerability is triggered via a crafted input. NOTE: the supplier disputes this because the report is about a user attacking himself.
- Product
- gradio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2024Fiber is an Express-inspired web framework written in Go A vulnerability present in versions prior to 2.52.5 is a session middleware issue in GoFiber versions 2CVE-2024-38513 · Other software · gofiber · reported by GitHubCritical 10
Fiber is an Express-inspired web framework written in Go A vulnerability present in versions prior to 2.52.5 is a session middleware issue in GoFiber versions 2 and above. This vulnerability allows users to supply their own session_id value, resulting in the creation of a session with that key. If a website relies on the mere presence of a session for security purposes, this can lead to significant security risks, including unauthorized access and session fixation attacks. All users utilizing GoFiber's session middleware in the affected versions are impacted. The issue has been addressed in version 2.52.5. Users are strongly encouraged to upgrade to version 2.52.5 or higher to mitigate this vulnerability. Users who are unable to upgrade immediately can apply the following workarounds to reduce the risk: Either implement additional validation to ensure session IDs are not supplied by the user and are securely generated by the server, or regularly rotate session IDs and enforce strict session expiration policies.
- Product
- fiber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2024Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are vulnerably to information disclosure, SSRF or local script execution via backend applicationsCVE-2024-38476 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are vulnerably to information disclosure, SSRF or local script execution via backend applications whose response headers are malicious or exploitable. Users are recommended to upgrade to version 2.4.60, which fixes this issue.
- Product
- Apache HTTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhttpd.apache.orgsecurity.netapp.com
Jul 1, 2024Apache HTTP Server Improper Escaping of Output VulnerabilityCVE-2024-38475 · Websites & servers · Apache · reported by security@apache.orgExploitedCritical 9.1
Apache HTTP Server contains an improper escaping of output vulnerability in mod_rewrite that allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure.
- Product
- HTTP Server
- On CISA’s list since
- May 1, 2025 (federal fix deadline May 22, 2025)
- What to do
- Attackers are using this now. Install Apache’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA cataloghttpd.apache.orgsecurity.netapp.com
Jul 1, 2024Substitution encoding issue in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows attacker to execute scripts in directories permitted by the configuraCVE-2024-38474 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Substitution encoding issue in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows attacker to execute scripts in directories permitted by the configuration but not directly reachable by any URL or source disclosure of scripts meant to only to be executed as CGI. Users are recommended to upgrade to version 2.4.60, which fixes this issue. Some RewriteRules that capture and substitute unsafely will now fail unless rewrite flag "UnsafeAllow3F" is specified.
- Product
- Apache HTTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhttpd.apache.orgsecurity.netapp.com
Jul 1, 2024OSGeo GeoServer GeoTools Eval Injection VulnerabilityCVE-2024-36401 · Other software · OSGeo · reported by GitHubExploitedCritical 9.8
OSGeo GeoServer GeoTools contains an improper neutralization of directives in dynamically evaluated code vulnerability due to unsafely evaluating property names as XPath expressions. This allows unauthenticated attackers to conduct remote code execution via specially crafted input.
- Product
- GeoServer
- On CISA’s list since
- Jul 15, 2024 (federal fix deadline Aug 5, 2024)
- What to do
- Attackers are using this now. Install OSGeo’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA cataloggithub.comgithub.com
Jul 1, 2024Incorrect Provision of Specified Functionality vulnerability in MESbook 20221021.03 version.CVE-2024-6425 · Other software · MESbook · reported by cve-coordination@incibe.esCritical 9.1
Incorrect Provision of Specified Functionality vulnerability in MESbook 20221021.03 version. An unauthenticated remote attacker can register user accounts without being authenticated from the route "/account/Register/" and in the parameters "UserName=<RANDOMUSER>&Password=<PASSWORD>&ConfirmPassword=<PASSWORD-REPEAT>".
- Product
- MESbook
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2024External server-side request vulnerability in MESbook 20221021.03 version, which could allow a remote, unauthenticated attacker to exploit the endpoint "/api/PrCVE-2024-6424 · Other software · MESbook · reported by cve-coordination@incibe.esCritical 9.3
External server-side request vulnerability in MESbook 20221021.03 version, which could allow a remote, unauthenticated attacker to exploit the endpoint "/api/Proxy/Post?userName=&password=&uri=<FILE|INTERNAL URL|IP/HOST" or "/api/Proxy/Get?userName=&password=&uri=<ARCHIVO|URL INTERNA|IP/HOST" to read the source code of web files, read internal files or access network resources.
- Product
- MESbook
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2024agreejs shared v0.0.1 was discovered to contain a prototype pollution via the function mergeInternalComponents.CVE-2024-39017 · Other software · agreejs_shared · reported by MITRECritical 9.8
agreejs shared v0.0.1 was discovered to contain a prototype pollution via the function mergeInternalComponents. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
- Product
- agreejs_shared
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jul 1, 2024cafebazaar hod v0.4.14 was discovered to contain a prototype pollution via the function request.CVE-2024-39015 · Other software · cafebazaar · reported by MITRECritical 9.8
cafebazaar hod v0.4.14 was discovered to contain a prototype pollution via the function request. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
- Product
- hod
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jul 1, 2024ahilfoley cahil/utils v2.3.2 was discovered to contain a prototype pollution via the function set.CVE-2024-39014 · Other software · cahilfoley · reported by MITRECritical 9.8
ahilfoley cahil/utils v2.3.2 was discovered to contain a prototype pollution via the function set. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
- Product
- utils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jul 1, 20242o3t-utility v0.1.2 was discovered to contain a prototype pollution via the function extend.CVE-2024-39013 · Other software · 2o3t · reported by MITRECritical 9.8
2o3t-utility v0.1.2 was discovered to contain a prototype pollution via the function extend. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
- Product
- 2o3t-utility
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jul 1, 2024robinweser fast-loops v1.1.3 was discovered to contain a prototype pollution via the function objectMergeDeep.CVE-2024-39008 · Other software · robinweser · reported by MITRECritical 10
robinweser fast-loops v1.1.3 was discovered to contain a prototype pollution via the function objectMergeDeep. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
- Product
- fast-loops
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jul 1, 2024jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function s.contexts._.configure.CVE-2024-38999 · Other software · jrburke · reported by MITRECritical 10
jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function s.contexts._.configure. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
- Product
- requirejs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jul 1, 2024ag-grid-community v31.3.2 and ag-grid-enterprise v31.3.2 were discovered to contain a prototype pollution via the _.mergeDeep function.CVE-2024-38996 · Other software · ag-grid · reported by MITRECritical 9.8
ag-grid-community v31.3.2 and ag-grid-enterprise v31.3.2 were discovered to contain a prototype pollution via the _.mergeDeep function. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
- Product
- ag-grid-enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jul 1, 2024rjrodger jsonic-next v2.12.1 was discovered to contain a prototype pollution via the function empty.CVE-2024-38993 · Other software · rjrodger · reported by MITRECritical 9.8
rjrodger jsonic-next v2.12.1 was discovered to contain a prototype pollution via the function empty. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
- Product
- jsonic-next
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.