Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
6,232 results · page 33 of 125
Feb 11, 2025Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Incorrect Authorization vulnerability that could reCVE-2025-24421 · Websites & servers · Adobe · reported by AdobeMedium 4.3
Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A low-privileged attacker could exploit this vulnerability to read select data. Exploitation of this issue does not require user interaction
- Product
- Adobe Commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2025Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Incorrect Authorization vulnerability that could reCVE-2025-24420 · Websites & servers · Adobe · reported by AdobeMedium 4.3
Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A low-privileged attacker could exploit this vulnerability to modify select data. Exploitation of this issue does not require user interaction.
- Product
- Adobe Commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2025Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Incorrect Authorization vulnerability that could reCVE-2025-24419 · Websites & servers · Adobe · reported by AdobeMedium 4.3
Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A low-privileged attacker could exploit this vulnerability to modify select data. Exploitation of this issue does not require user interaction.
- Product
- Adobe Commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2025Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Authorization vulnerability that could resCVE-2025-24418 · Websites & servers · Adobe · reported by AdobeHigh 8.1
Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Authorization vulnerability that could result in Privilege escalation. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue does not require user interaction.
- Product
- Adobe Commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2025Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability thatCVE-2025-24417 · Websites & servers · Adobe · reported by AdobeHigh 8.7
Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as high.
- Product
- Adobe Commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2025Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability thatCVE-2025-24416 · Websites & servers · Adobe · reported by AdobeHigh 8.7
Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as high.
- Product
- Adobe Commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2025Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability thatCVE-2025-24415 · Websites & servers · Adobe · reported by AdobeHigh 8.7
Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as high.
- Product
- Adobe Commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2025Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability thatCVE-2025-24414 · Websites & servers · Adobe · reported by AdobeHigh 8.7
Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as high.
- Product
- Adobe Commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2025Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability thatCVE-2025-24413 · Websites & servers · Adobe · reported by AdobeHigh 8.7
Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as high.
- Product
- Adobe Commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2025Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability thatCVE-2025-24412 · Websites & servers · Adobe · reported by AdobeHigh 8.7
Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as high.
- Product
- Adobe Commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2025Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Access Control vulnerability that could reCVE-2025-24411 · Websites & servers · Adobe · reported by AdobeHigh 8.1
Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized access affecting Confidentiality and Integrity. Exploitation of this issue does not require user interaction.
- Product
- Adobe Commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2025Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability thatCVE-2025-24410 · Websites & servers · Adobe · reported by AdobeHigh 8.7
Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as high.
- Product
- Adobe Commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2025Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Incorrect Authorization vulnerability that could rCVE-2025-24409 · Websites & servers · Adobe · reported by AdobeHigh 8.2
Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access, leading to both a High impact to confidentiality and Low impact to integrity. Exploitation of this issue does not require user interaction.
- Product
- Adobe Commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2025Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Information Exposure vulnerability that could resulCVE-2025-24408 · Websites & servers · Adobe · reported by AdobeMedium 6.5
Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Information Exposure vulnerability that could result in privilege escalation. A low-privileged attacker could gain unauthorized access to sensitive information. Exploitation of this issue does not require user interaction.
- Product
- Adobe Commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2025Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Incorrect Authorization vulnerability that could reCVE-2025-24407 · Websites & servers · Adobe · reported by AdobeHigh 7.1
Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A low privileged attacker could exploit this vulnerability to perform actions with permissions that were not granted leading to both a High impact to confidentiality and Low impact to integrity. Exploitation of this issue does not require user interaction.
- Product
- Adobe Commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2025Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Limitation of a Pathname to a Restricted DCVE-2025-24406 · Websites & servers · Adobe · reported by AdobeHigh 7.5
Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to a security feature bypass. An unauthenticated attacker could exploit this vulnerability to modify files that are stored outside the restricted directory. Exploitation of this issue does not require user interaction.
- Product
- Adobe Commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2025Due to missing authorization check in an RFC enabled function module in transaction SDCCN, an authenticated attacker could generate technical meta-data.CVE-2025-23189 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
Due to missing authorization check in an RFC enabled function module in transaction SDCCN, an authenticated attacker could generate technical meta-data. This leads to a low impact on integrity. There is no impact on confidentiality or availability
- Product
- SAP NetWeaver and ABAP Platform (SDCCN)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2025Due to missing authorization check in an RFC enabled function module in transaction SDCCN, an unauthenticated attacker could generate technical meta-data.CVE-2025-23187 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.3
Due to missing authorization check in an RFC enabled function module in transaction SDCCN, an unauthenticated attacker could generate technical meta-data. This leads to a low impact on integrity. There is no impact on confidentiality or availability.
- Product
- SAP NetWeaver and ABAP Platform (SDCCN)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 7, 2025NEXTU FLETA AX1500 WIFI6 v1.0.3 was discovered to contain a buffer overflow at /boafrm/formIpQoS.CVE-2024-35106 · Other software · reported by MITREMedium 4.6
NEXTU FLETA AX1500 WIFI6 v1.0.3 was discovered to contain a buffer overflow at /boafrm/formIpQoS. This vulnerability allows attackers to cause a Denial of Service (DoS) or potentially arbitrary code execution via a crafted POST request.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordez-net.co.krez-net.co.kr
Feb 6, 2025IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned.CVE-2024-56467 · Other software · IBM · reported by psirt@us.ibm.comLow 3.3
IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned. This information could be used in further attacks against the system.
- Product
- EntireX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2025IBM ApplinX 11.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser.CVE-2024-49798 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM ApplinX 11.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.
- Product
- ApplinX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2025IBM Security Verify Access Appliance and Container 10.0.0 through 10.0.8 could allow a remote attacker to obtain sensitive information when a detailed technicalCVE-2024-45658 · Other software · IBM · reported by psirt@us.ibm.comLow 2.7
IBM Security Verify Access Appliance and Container 10.0.0 through 10.0.8 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned. This information could be used in further attacks against the system.
- Product
- Security Verify Access Appliance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2025IBM Security Verify Access Appliance and Container 10.0.0 through 10.0.8 could allow a remote attacker to obtain sensitive information when a detailed technicalCVE-2024-45659 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM Security Verify Access Appliance and Container 10.0.0 through 10.0.8 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned. This information could be used in further attacks against the system.
- Product
- Security Verify Access Appliance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2025Meta Tag Manager: Missing AuthorizationCVE-2025-22260 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Marcus (aka @msykes) Meta Tag Manager meta-tag-manager.This issue affects Meta Tag Manager: from n/a through <= 3.1.
- Product
- Meta Tag Manager
- Affected
- up to 3.1
- What to do
- Affects up to 3.1. Update Meta Tag Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 31, 2025In the Linux kernel, the following vulnerability has been resolved: zram: fix potential UAF of zram table If zram_meta_alloc failed early, it frees allocated CVE-2025-21671 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: zram: fix potential UAF of zram table If zram_meta_alloc failed early, it frees allocated zram->table without setting it NULL. Which will potentially cause zram_meta_free to access the table if user reset an failed and uninitialized device.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jan 31, 2025Post Meta: Cross-Site Request Forgery (CSRF)CVE-2025-24549 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Mahbubur Rahman Post Meta post-meta allows Reflected XSS.This issue affects Post Meta: from n/a through <= 1.0.9.
- Product
- Post Meta
- Affected
- up to 1.0.9
- What to do
- Affects up to 1.0.9. Update Post Meta to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 30, 2025Tracking Code Manager: Does not sanitise and escape some of its metabox settingsCVE-2024-10309 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Tracking Code Manager WordPress plugin before 2.4.0 does not sanitise and escape some of its metabox settings when outputing them in the page, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks.
- Product
- Tracking Code Manager
- Fixed in
- 2.4.0
- What to do
- Update Tracking Code Manager to 2.4.0 or newer.
Jan 29, 2025In axios before 1.7.8, lib/helpers/isURLSameOrigin.js does not use a URL object when determining an origin, and has a potentially unwanted setAttribute('href',hCVE-2024-57965 · Other software · axios · reported by MITRENone
In axios before 1.7.8, lib/helpers/isURLSameOrigin.js does not use a URL object when determining an origin, and has a potentially unwanted setAttribute('href',href) call. NOTE: some parties feel that the code change only addresses a warning message from a SAST tool and does not fix a vulnerability.
- Product
- axios
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2025The old versions of EXIF Viewer Classic contain a cross-site scripting vulnerability caused by improper handling of EXIF meta data.CVE-2025-23362 · Other software · Rodrigue · reported by vultures@jpcert.or.jpMedium 6.1
The old versions of EXIF Viewer Classic contain a cross-site scripting vulnerability caused by improper handling of EXIF meta data. When an image is rendered and crafted EXIF meta data is processed, an arbitrary script may be executed on the web browser. Versions 2.3.2 and 2.4.0 were reported as vulnerable. According to the vendor, the product has been refactored after those old versions and the version 3.0.1 is not vulnerable.
- Product
- EXIF Viewer Classic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromewebstore.google.comexifviewers.com
Jan 28, 2025In shouldSkipForInitialSUW of AdvancedPowerUsageDetail.java, there is a possible way to bypass factory reset protections due to a missing permission check.CVE-2024-40677 · Computers, phones & browsers · Google · reported by security@android.comHigh 8.4
In shouldSkipForInitialSUW of AdvancedPowerUsageDetail.java, there is a possible way to bypass factory reset protections due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comsource.android.com
Jan 27, 2025A cross-site scripting (XSS) vulnerability in the Product module of Dolibarr v21.0.0-beta allows attackers to execute arbitrary web scripts or HTMl via a crafteCVE-2024-55228 · Other software · Dolibarr · reported by MITRECritical 9
A cross-site scripting (XSS) vulnerability in the Product module of Dolibarr v21.0.0-beta allows attackers to execute arbitrary web scripts or HTMl via a crafted payload injected into the Title parameter.
- Product
- Dolibarr Erp/crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jan 27, 2025A cross-site scripting (XSS) vulnerability in the Events/Agenda module of Dolibarr v21.0.0-beta allows attackers to execute arbitrary web scripts or HTMl via a CVE-2024-55227 · Other software · Dolibarr · reported by MITRECritical 9
A cross-site scripting (XSS) vulnerability in the Events/Agenda module of Dolibarr v21.0.0-beta allows attackers to execute arbitrary web scripts or HTMl via a crafted payload injected into the Title parameter.
- Product
- Dolibarr Erp/crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jan 27, 2025Responsive Slider by MetaSlider: Cross-Site Request Forgery (CSRF)CVE-2025-24533 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in MetaSlider Responsive Slider by MetaSlider ml-slider allows Cross Site Request Forgery.This issue affects Responsive Slider by MetaSlider: from n/a through <= 3.92.0.
- Product
- Responsive Slider by MetaSlider
- Affected
- up to 3.92.0
- What to do
- Affects up to 3.92.0. Update Responsive Slider by MetaSlider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 25, 2025IBM Analytics Content Hub 2.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser.CVE-2024-35134 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM Analytics Content Hub 2.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.
- Product
- Analytics Content Hub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 25, 2025IBM Control Center 6.2.1 and 6.3.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the brCVE-2024-35112 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.4
IBM Control Center 6.2.1 and 6.3.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.
- Product
- Control Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 25, 2025IBM Control Center 6.2.1 and 6.3.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browCVE-2024-35111 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM Control Center 6.2.1 and 6.3.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.
- Product
- Control Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 24, 2025A vulnerability was found in Dcat-Admin 2.2.1-beta.CVE-2025-0709 · Other software · Dcatadmin · reported by VulDBMedium 5.1
A vulnerability was found in Dcat-Admin 2.2.1-beta. It has been rated as problematic. This issue affects some unknown processing of the file /admin/auth/roles of the component Roles Page. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Dcat Admin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 24, 2025JSM Show Post Metadata: Missing AuthorizationCVE-2025-24589 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in JS Morisset JSM Show Post Metadata jsm-show-post-meta allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JSM Show Post Metadata: from n/a through <= 4.6.0.
- Product
- JSM Show Post Metadata
- Affected
- up to 4.6.0
- What to do
- Affects up to 4.6.0. Update JSM Show Post Metadata to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Precious Metals Charts and Widgets for: Stored Cross-Site ScriptingCVE-2024-13572 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Precious Metals Charts and Widgets for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'nfusion-widget' shortcode in all versions up to, and including, 1.2.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Precious Metals Charts and Widgets for
- Affected
- up to 1.2.8
- What to do
- Affects up to 1.2.8. Update Precious Metals Charts and Widgets for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 23, 2025It has been found that the Beta10 software does not provide for proper authorisation control in multiple areas of the application.CVE-2025-0637 · Other software · Beta10 · reported by cve-coordination@incibe.esCritical 9.8
It has been found that the Beta10 software does not provide for proper authorisation control in multiple areas of the application. This deficiency could allow a malicious actor, without authentication, to access private areas and/or areas intended for other roles. The vulnerability has been identified at least in the file or path ‘/app/tools.html’.
- Product
- Beta10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2025MDTF – Meta Data and Taxonomies Filter: Stored Cross-Site ScriptingCVE-2024-13340 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mdf_results_by_ajax' shortcode in all versions up to, and including, 1.3.3.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- MDTF – Meta Data and Taxonomies Filter
- Affected
- up to 1.3.3.6
- What to do
- Affects up to 1.3.3.6. Update MDTF – Meta Data and Taxonomies Filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 21, 2025In setActualDefaultRingtoneUri of RingtoneManager.java, there is a possible way to bypass content providers read permissions due to a missing permission check.CVE-2023-40132 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In setActualDefaultRingtoneUri of RingtoneManager.java, there is a possible way to bypass content providers read permissions due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2025Metaphor Widgets: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23816 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in metaphorcreations Metaphor Widgets allows Stored XSS. This issue affects Metaphor Widgets: from n/a through 2.4.
- Product
- Metaphor Widgets
- Affected
- up to 2.4
- What to do
- Affects up to 2.4. Update Metaphor Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 14, 2025IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD web console could allow a local user to obtain sensitive information when a detailed technical error message is retuCVE-2024-52898 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.2
IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD web console could allow a local user to obtain sensitive information when a detailed technical error message is returned.
- Product
- MQ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2025In Apache Linkis <1.7.0, due to the lack of effective filtering of parameters, an attacker configuring malicious Mysql JDBC parameters in the DataSource ManagerCVE-2024-45627 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.9
In Apache Linkis <1.7.0, due to the lack of effective filtering of parameters, an attacker configuring malicious Mysql JDBC parameters in the DataSource Manager Module will allow the attacker to read arbitrary files from the Linkis server. Therefore, the parameters in the Mysql JDBC URL should be blacklisted. This attack requires the attacker to obtain an authorized account from Linkis before it can be carried out. Versions of Apache Linkis < 1.7.0 will be affected. We recommend users upgrade the version of Linkis to version 1.7.0.
- Product
- Apache Linkis Metadata Query Service JDBC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Jan 14, 2025An access control issue in the component /square/getAllSquare/circle of iceCMS v2.2.0 allows unauthenticated attackers to access sensitive information.CVE-2025-22983 · Other software · Thecosy · reported by MITREHigh 7.5
An access control issue in the component /square/getAllSquare/circle of iceCMS v2.2.0 allows unauthenticated attackers to access sensitive information.
- Product
- Icecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2025In the Linux kernel, the following vulnerability has been resolved: sched: fix warning in sched_setaffinity Commit 8f9ea86fdf99b added some logic to sched_setCVE-2024-41932 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: sched: fix warning in sched_setaffinity Commit 8f9ea86fdf99b added some logic to sched_setaffinity that included a WARN when a per-task affinity assignment races with a cpuset update. Specifically, we can have a race where a cpuset update results in the task affinity no longer being a subset of the cpuset. That's fine; we have a fallback to instead use the cpuset mask. However, we have a WARN set up that will trigger if the cpuset mask has no overlap at all with the requested task affinity. This shouldn't be a warning condition; its trivial to create this condition. Reproduced the warning by the following setup: - $PID inside a cpuset cgroup - another thread repeatedly switching the cpuset cpus from 1-2 to just 1 - another thread repeatedly setting the $PID affinity (via taskset) to 2
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jan 8, 2025MDTF – Meta Data and Taxonomies Filter: SQL InjectionCVE-2024-12030 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to SQL Injection via the 'key' attribute of the 'mdf_value' shortcode in all versions up to, and including, 1.3.3.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- MDTF – Meta Data and Taxonomies Filter
- Affected
- up to 1.3.3.5
- What to do
- Affects up to 1.3.3.5. Update MDTF – Meta Data and Taxonomies Filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 7, 2025IceWarp Server 10.2.1 is vulnerable to Cross Site Scripting (XSS) via the meta parameter.CVE-2024-55218 · Other software · Icewarp · reported by MITREMedium 6.1
IceWarp Server 10.2.1 is vulnerable to Cross Site Scripting (XSS) via the meta parameter.
- Product
- Icewarp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordresources.s4e.ioicewarp.com
Jan 7, 2025Metadata SEO: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22516 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hpinfosys Metadata SEO metadata-seo allows Stored XSS.This issue affects Metadata SEO: from n/a through <= 2.3.
- Product
- Metadata SEO
- Affected
- up to 2.3
- What to do
- Affects up to 2.3. Update Metadata SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.