Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
38,924 results · page 347 of 779
Mar 20, 2024Create by Mediavine: SQL InjectionCVE-2024-1711 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Create by Mediavine plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 1.9.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Create by Mediavine
- Affected
- up to 1.9.4
- What to do
- Affects up to 1.9.4. Update Create by Mediavine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Mar 20, 2024An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before.CVE-2024-22081 · Other software · elspec · reported by MITRECritical 9.8
An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. Unauthenticated memory corruption can occur in the HTTP header parsing mechanism.
- Product
- g5_digital_fault_recorder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordelspec-ltd.comelspec-ltd.com
Mar 20, 2024An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before.CVE-2024-22080 · Other software · elspec · reported by MITRECritical 9.8
An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. Unauthenticated memory corruption can occur during XML body parsing.
- Product
- g5_digital_fault_recorder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordelspec-ltd.comelspec-ltd.com
Mar 19, 2024SQL injection vulnerability in KnowBand spinwheel v.3.0.3 and before allows a remote attacker to gain escalated privileges and obtain sensitive information via CVE-2024-28389 · Other software · knowband · reported by MITRECritical 9.8
SQL injection vulnerability in KnowBand spinwheel v.3.0.3 and before allows a remote attacker to gain escalated privileges and obtain sensitive information via the SpinWheelFrameSpinWheelModuleFrontController::sendEmail() method.
- Product
- spinwheel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.friendsofpresta.orgsecurity.friendsofpresta.org
Mar 19, 2024SQL Injection vulnerability in Employee Management System v1.0 allows attackers to run arbitrary SQL commands via the admin_id parameter in update-admin.php.CVE-2024-28595 · Other software · employee_management_system_project · reported by MITRECritical 9.8
SQL Injection vulnerability in Employee Management System v1.0 allows attackers to run arbitrary SQL commands via the admin_id parameter in update-admin.php.
- Product
- employee_management_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2024An issue in Advanced Plugins reportsstatistics v1.3.20 and before allows a remote attacker to execute arbitrary code via the Sales Reports, Statistics, Custom FCVE-2024-28394 · Other software · advancedplugins · reported by MITRECritical 9.8
An issue in Advanced Plugins reportsstatistics v1.3.20 and before allows a remote attacker to execute arbitrary code via the Sales Reports, Statistics, Custom Fields & Export module.
- Product
- reportsstatistics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaddons.prestashop.comsecurity.friendsofpresta.org
Mar 19, 2024Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.CVE-2024-29027 · Other software · parse-community · reported by GitHubCritical 9
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 6.5.5 and 7.0.0-alpha.29, calling an invalid Parse Server Cloud Function name or Cloud Job name crashes the server and may allow for code injection, internal store manipulation or remote code execution. The patch in versions 6.5.5 and 7.0.0-alpha.29 added string sanitation for Cloud Function name and Cloud Job name. As a workaround, sanitize the Cloud Function name and Cloud Job name before it reaches Parse Server.
- Product
- parse-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2024Open Source Medicine Ordering System v1.0 was discovered to contain a SQL injection vulnerability via the date parameter at /admin/reports/index.php.CVE-2024-28303 · Other software · sourcecodester · reported by MITRECritical 9.8
Open Source Medicine Ordering System v1.0 was discovered to contain a SQL injection vulnerability via the date parameter at /admin/reports/index.php.
- Product
- open_source_medicine_ordering_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2024Tourfic: Unrestricted Upload of File with Dangerous TypeCVE-2024-29135 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in Themefic Tourfic tourfic.This issue affects Tourfic: from n/a through <= 2.11.15.
- Product
- Tourfic
- Affected
- up to 2.11.15
- What to do
- Affects up to 2.11.15. Update Tourfic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 19, 2024 An Unrestricted Upload of File vulnerability has been found on Cegid Meta4 HR, that allows an attacker to upload malicios files to the server via '/config/espaCVE-2024-2636 · Other software · Cegid · reported by cve-coordination@incibe.esCritical 9
An Unrestricted Upload of File vulnerability has been found on Cegid Meta4 HR, that allows an attacker to upload malicios files to the server via '/config/espanol/update_password.jsp' file. Modifying the 'M4_NEW_PASSWORD' parameter, an attacker could store a malicious JSP file inside the file directory, to be executed the the file is loaded in the application.
- Product
- Meta4 HR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2024Memory safety bugs present in Firefox 123.CVE-2024-2615 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.8
Memory safety bugs present in Firefox 123. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 124.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Mar 18, 2024An issue was discovered in OpenClinic GA 5.247.01.CVE-2023-40276 · Other software · openclinic_ga_project · reported by MITRECritical 9.1
An issue was discovered in OpenClinic GA 5.247.01. An Unauthenticated File Download vulnerability has been discovered in pharmacy/exportFile.jsp.
- Product
- openclinic_ga
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsourceforge.net
Mar 18, 2024An issue was discovered in OpenClinic GA 5.247.01.CVE-2023-40275 · Other software · openclinic_ga_project · reported by MITRECritical 9.1
An issue was discovered in OpenClinic GA 5.247.01. It allows retrieval of patient lists via queries such as findFirstname= to _common/search/searchByAjax/patientslistShow.jsp.
- Product
- openclinic_ga
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsourceforge.net
Mar 18, 2024RaspberryMatic is an open-source operating system for HomeMatic internet-of-things devices.CVE-2024-24578 · Other software · jens-maus · reported by GitHubCritical 10
RaspberryMatic is an open-source operating system for HomeMatic internet-of-things devices. RaspberryMatic / OCCU prior to version 3.75.6.20240316 contains a unauthenticated remote code execution (RCE) vulnerability, caused by multiple issues within the Java based `HMIPServer.jar` component. RaspberryMatric includes a Java based `HMIPServer`, that can be accessed through URLs starting with `/pages/jpages`. The `FirmwareController` class does however not perform any session id checks, thus this feature can be accessed without a valid session. Due to this issue, attackers can gain remote code execution as root user, allowing a full system compromise. Version 3.75.6.20240316 contains a patch.
- Product
- RaspberryMatic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2024Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.CVE-2024-21652 · Other software · argoproj · reported by GitHubCritical 9.8
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.8.13, 2.9.9, and 2.10.4, an attacker can exploit a chain of vulnerabilities, including a Denial of Service (DoS) flaw and in-memory data storage weakness, to effectively bypass the application's brute force login protection. This is a critical security vulnerability that allows attackers to bypass the brute force login protection mechanism. Not only can they crash the service affecting all users, but they can also make unlimited login attempts, increasing the risk of account compromise. Versions 2.8.13, 2.9.9, and 2.10.4 contain a patch for this issue.
- Product
- argo-cd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2024 CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could cause account takeover and unauthorized access to the systemCVE-2024-2051 · Other software · Schneider Electric · reported by cybersecurity@se.comCritical 9.8
CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could cause account takeover and unauthorized access to the system when an attacker conducts brute-force attacks against the login form.
- Product
- Easergy T200 (Modbus) Models: T200I, T200E, T200P, T200S, T200H
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.comdownload.schneider-electric.com
Mar 18, 2024File upload restriction evasion vulnerability in AMSS++ version 4.31.CVE-2024-2599 · Other software · Amssplus · reported by cve-coordination@incibe.esCritical 9.9
File upload restriction evasion vulnerability in AMSS++ version 4.31. This vulnerability could allow an authenticated user to potentially obtain RCE through webshell, compromising the entire infrastructure.
- Product
- AMSS++
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2024Tenda AC18 V15.03.05.05 has a stack overflow vulnerability in the page parameter of fromNatStaticSetting function.CVE-2024-28537 · Network & remote access · tenda · reported by MITRECritical 9.8
Tenda AC18 V15.03.05.05 has a stack overflow vulnerability in the page parameter of fromNatStaticSetting function.
- Product
- ac18_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2024 Unitronics Unistream Unilogic – Versions prior to 1.35.227 - CWE-22: 'Path Traversal' may allow RCE CVE-2024-27768 · Other software · Unitronics · reported by cna@cyber.gov.ilCritical 9.8
Unitronics Unistream Unilogic – Versions prior to 1.35.227 - CWE-22: 'Path Traversal' may allow RCE
- Product
- Unistream Unilogic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2024 CWE-287: Improper Authentication may allow Authentication Bypass CVE-2024-27767 · Other software · Unitronics · reported by cna@cyber.gov.ilCritical 10
CWE-287: Improper Authentication may allow Authentication Bypass
- Product
- Unistream Unilogic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2024FitNesse all releases allows a remote authenticated attacker to execute arbitrary OS commands.CVE-2024-28125 · Other software · unclebob · reported by vultures@jpcert.or.jpCritical 9.8
FitNesse all releases allows a remote authenticated attacker to execute arbitrary OS commands. Note: A contributor of FitNesse has claimed that this is not a vulnerability but a product specification and this is currently under further investigation.
- Product
- FitNesse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfitnesse.orggithub.com
Mar 18, 2024Rocket.Chat.Audit through 5ad78e8 depends on filecachetools, which does not exist in PyPI.CVE-2024-29151 · Other software · rocket_chat · reported by MITRECritical 9.1
Rocket.Chat.Audit through 5ad78e8 depends on filecachetools, which does not exist in PyPI.
- Product
- audit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2024The Kossy module before 0.60 for Perl allows JSON hijacking because of X-Requested-With mishandling.CVE-2021-47157 · Other software · kossy · reported by MITRECritical 9.8
The Kossy module before 0.60 for Perl allows JSON hijacking because of X-Requested-With mishandling.
- Product
- kossy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commetacpan.org
Mar 18, 2024The Net::IPV4Addr module 0.10 for Perl does not properly consider extraneous zero characters in an IP address string, which (in some situations) allows attackerCVE-2021-47155 · Other software · perl · reported by MITRECritical 9.1
The Net::IPV4Addr module 0.10 for Perl does not properly consider extraneous zero characters in an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses.
- Product
- perl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.urth.orgmetacpan.org
Mar 18, 2024In the CryptX module before 0.062 for Perl, gcm_decrypt_verify() and chacha20poly1305_decrypt_verify() do not verify the tag.CVE-2018-25099 · Other software · dcit · reported by MITRECritical 9.8
In the CryptX module before 0.062 for Perl, gcm_decrypt_verify() and chacha20poly1305_decrypt_verify() do not verify the tag.
- Product
- perl-cryptx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2024Siklu TG Terragraph devices before approximately 2.1.1 have a hardcoded root password that has been revealed via a brute force attack on an MD5 hash.CVE-2022-47036 · Other software · siklu · reported by MITRECritical 9.8
Siklu TG Terragraph devices before approximately 2.1.1 have a hardcoded root password that has been revealed via a brute force attack on an MD5 hash. It can be used for "debug login" by an admin. NOTE: the vulnerability is not fixed by the 2.1.1 firmware; instead, it is fixed in newer hardware, which would typically be used with firmware 2.1.1 or later.
- Product
- tg_terragraph
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsemaja2.netsemaja2.net
Mar 17, 2024Pie Register: Unrestricted Upload of File with Dangerous TypeCVE-2024-27957 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in Pie Register.This issue affects Pie Register: from n/a through 3.8.3.1.
- Product
- Pie Register
- Affected
- up to 3.8.3.1
- What to do
- Affects up to 3.8.3.1. Update Pie Register to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 16, 2024Buffer Overflow vulnerability in TOTOLink X5000R V9.1.0u.6118-B20201102 and A7000R V9.1.0u.6115-B20201022, allow remote attackers to execute arbitrary code and CVE-2024-28639 · Other software · totolink · reported by MITRECritical 9.8
Buffer Overflow vulnerability in TOTOLink X5000R V9.1.0u.6118-B20201102 and A7000R V9.1.0u.6115-B20201022, allow remote attackers to execute arbitrary code and cause a denial of service (DoS) via the IP field.
- Product
- x5000r_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2024OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team coCVE-2024-28255 · Other software · open-metadata · reported by GitHubCritical 9.8
OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. The `JwtFilter` handles the API authentication by requiring and verifying JWT tokens. When a new request comes in, the request's path is checked against this list. When the request's path contains any of the excluded endpoints the filter returns without validating the JWT. Unfortunately, an attacker may use Path Parameters to make any path contain any arbitrary strings. For example, a request to `GET /api/v1;v1%2fusers%2flogin/events/subscriptions/validation/condition/111` will match the excluded endpoint condition and therefore will be processed with no JWT validation allowing an attacker to bypass the authentication mechanism and reach any arbitrary endpoint, including the ones listed above that lead to arbitrary SpEL expression injection. This bypass will not work when the endpoint uses the `SecurityContext.getUserPrincipal()` since it will return `null` and will throw an NPE. This issue may lead to authentication bypass and has been addressed in version 1.2.4. Users are advised to upgrade. There are no known
- Product
- OpenMetadata
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2024OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team coCVE-2024-28253 · Other software · open-metadata · reported by GitHubCritical 9.4
OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. `CompiledRule::validateExpression` is also called from `PolicyRepository.prepare`. `prepare()` is called from `EntityRepository.prepareInternal()` which, in turn, gets called from `EntityResource.createOrUpdate()`. Note that even though there is an authorization check (`authorizer.authorize()`), it gets called after `prepareInternal()` gets called and therefore after the SpEL expression has been evaluated. In order to reach this method, an attacker can send a PUT request to `/api/v1/policies` which gets handled by `PolicyResource.createOrUpdate()`. This vulnerability was discovered with the help of CodeQL's Expression language injection (Spring) query and is also tracked as `GHSL-2023-252`. This issue may lead to Remote Code Execution and has been addressed in version 1.3.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- OpenMetadata
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodeql.github.comgithub.com
Mar 15, 2024Sciener locks' firmware update mechanism do not authenticate or validate firmware updates if passed to the lock through the Bluetooth Low Energy service.CVE-2023-7017 · Other software · Sciener · reported by cret@cert.orgCritical 9.8
Sciener locks' firmware update mechanism do not authenticate or validate firmware updates if passed to the lock through the Bluetooth Low Energy service. A challenge request can be sent to the lock with a command to prepare for an update, rather than an unlock request, allowing an attacker to compromise the device.
- Product
- Kontrol Lux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordalephsecurity.comalephsecurity.com
Mar 15, 2024The unlockKey character in a lock using Sciener firmware can be brute forced through repeated challenge requests, compromising the locks integrity.CVE-2023-7006 · Other software · Sciener · reported by cret@cert.orgCritical 9.1
The unlockKey character in a lock using Sciener firmware can be brute forced through repeated challenge requests, compromising the locks integrity.
- Product
- Kontrol Lux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordalephsecurity.comalephsecurity.com
Mar 15, 2024A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3 and 3.5.8 allows an attacker to perform SSRF style attacks on webCVE-2024-28752 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.3
A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3 and 3.5.8 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type. Users of other data bindings (including the default databinding) are not impacted.
- Product
- Apache CXF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comcxf.apache.org
Mar 15, 2024There is a command injection vulnerability in the TRENDnet TEW-827DRU router with firmware version 2.10B01.CVE-2024-28354 · Other software · trendnet · reported by MITRECritical 10
There is a command injection vulnerability in the TRENDnet TEW-827DRU router with firmware version 2.10B01. An attacker can inject commands into the post request parameters usapps.@smb[%d].username in the apply.cgi interface, thereby gaining root shell privileges.
- Product
- tew-827dru_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwarp-desk-89d.notion.sitewarp-desk-89d.notion.site
Mar 15, 2024SQL Injection vulnerability in ABO.CMS version 5.8, allows remote attackers to execute arbitrary code, cause a denial of service (DoS), escalate privileges, andCVE-2024-25227 · Other software · abocms · reported by MITRECritical 9.8
SQL Injection vulnerability in ABO.CMS version 5.8, allows remote attackers to execute arbitrary code, cause a denial of service (DoS), escalate privileges, and obtain sensitive information via the tb_login parameter in admin login page.
- Product
- abo.cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordthetrueartist.wixsite.comthetrueartist.wixsite.com
Mar 14, 2024Integer Overflow or Wraparound vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series and MELSEC-L Series CPU modules allows a remote unauthenticated CVE-2024-1917 · Other software · Mitsubishi Electric Corporation · reported by Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jpCritical 9.8
Integer Overflow or Wraparound vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series and MELSEC-L Series CPU modules allows a remote unauthenticated attacker to execute malicious code on a target product by sending a specially crafted packet.
- Product
- MELSEC-Q Series Q03UDECPU
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 14, 2024Integer Overflow or Wraparound vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series and MELSEC-L Series CPU modules allows a remote unauthenticated CVE-2024-1916 · Other software · Mitsubishi Electric Corporation · reported by Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jpCritical 9.8
Integer Overflow or Wraparound vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series and MELSEC-L Series CPU modules allows a remote unauthenticated attacker to execute malicious code on a target product by sending a specially crafted packet.
- Product
- MELSEC-Q Series Q03UDECPU
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 14, 2024Incorrect Pointer Scaling vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series and MELSEC-L Series CPU modules allows a remote unauthenticated attacCVE-2024-1915 · Other software · Mitsubishi Electric Corporation · reported by Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jpCritical 9.8
Incorrect Pointer Scaling vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series and MELSEC-L Series CPU modules allows a remote unauthenticated attacker to execute malicious code on a target product by sending a specially crafted packet.
- Product
- MELSEC-Q Series Q03UDECPU
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 14, 2024Integer Overflow or Wraparound vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series and MELSEC-L Series CPU modules allows a remote unauthenticated CVE-2024-0803 · Other software · Mitsubishi Electric Corporation · reported by Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jpCritical 9.8
Integer Overflow or Wraparound vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series and MELSEC-L Series CPU modules allows a remote unauthenticated attacker to execute malicious code on a target product by sending a specially crafted packet.
- Product
- MELSEC-Q Series Q03UDECPU
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 14, 2024Incorrect Pointer Scaling vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series and MELSEC-L Series CPU modules allows a remote unauthenticated attacCVE-2024-0802 · Other software · Mitsubishi Electric Corporation · reported by Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jpCritical 9.8
Incorrect Pointer Scaling vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series and MELSEC-L Series CPU modules allows a remote unauthenticated attacker to read arbitrary information from a target product or execute malicious code on a target product by sending a specially crafted packet.
- Product
- MELSEC-Q Series Q03UDECPU
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 14, 2024Unrestricted File Upload vulnerability in Greek Universities Network Open eClass v.3.15 and earlier allows attackers to run arbitrary code via upload of craftedCVE-2024-26503 · Other software · gunet · reported by MITRECritical 9.1
Unrestricted File Upload vulnerability in Greek Universities Network Open eClass v.3.15 and earlier allows attackers to run arbitrary code via upload of crafted file to certbadge.php endpoint.
- Product
- open_eclass_platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordless-secure.comless-secure.com
Mar 14, 2024There is a PHP file inclusion vulnerability in the template configuration of eyoucms v1.6.4, allowing attackers to execute code or system commands through a carCVE-2023-42286 · Other software · eyoucms · reported by MITRECritical 9.8
There is a PHP file inclusion vulnerability in the template configuration of eyoucms v1.6.4, allowing attackers to execute code or system commands through a carefully crafted malicious payload.
- Product
- eyoucms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 14, 2024Airflow-Diagrams v2.1.0 was discovered to contain an arbitrary file upload vulnerability in the unsafe_load function at cli.py.CVE-2024-28423 · Other software · airflow-diagrams_project · reported by MITRECritical 9.8
Airflow-Diagrams v2.1.0 was discovered to contain an arbitrary file upload vulnerability in the unsafe_load function at cli.py. This vulnerability allows attackers to execute arbitrary code via uploading a crafted YML file.
- Product
- airflow-diagrams
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 14, 2024In TP-Link Omada er605 1.0.1 through (v2.6) 2.2.3, a cloud-brd binary is susceptible to an integer overflow that leads to a heap-based buffer overflow.CVE-2024-25139 · Network & remote access · tp-link · reported by MITRECritical 10
In TP-Link Omada er605 1.0.1 through (v2.6) 2.2.3, a cloud-brd binary is susceptible to an integer overflow that leads to a heap-based buffer overflow. After heap shaping, an attacker can achieve code execution in the context of the cloud-brd binary that runs at the root level. This is fixed in ER605(UN)_v2_2.2.4 Build 020240119.
- Product
- omada_er605
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 14, 2024Tenda AX12 v1.0 v22.03.01.16 was discovered to contain a stack overflow via the ssid parameter in the sub_431CF0 function.CVE-2024-28383 · Network & remote access · tenda · reported by MITRECritical 9.8
Tenda AX12 v1.0 v22.03.01.16 was discovered to contain a stack overflow via the ssid parameter in the sub_431CF0 function.
- Product
- ax12_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 14, 2024SQL injection vulnerability in FME Modules quickproducttable module for PrestaShop v.1.2.1 and before, allows a remote attacker to escalate privileges and obtaiCVE-2024-28391 · Other software · fme_modules · reported by MITRECritical 9.8
SQL injection vulnerability in FME Modules quickproducttable module for PrestaShop v.1.2.1 and before, allows a remote attacker to escalate privileges and obtain information via the readCsv(), displayAjaxProductChangeAttr, displayAjaxProductAddToCart, getSearchProducts, and displayAjaxProductSku methods.
- Product
- quickproducttable_module_for_pestashop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.friendsofpresta.orgsecurity.friendsofpresta.org
Mar 14, 2024An issue in Advanced Plugins ultimateimagetool module for PrestaShop before v.2.2.01, allows a remote attacker to escalate privileges and obtain sensitive inforCVE-2024-28390 · Other software · advancedplugins · reported by MITRECritical 9.8
An issue in Advanced Plugins ultimateimagetool module for PrestaShop before v.2.2.01, allows a remote attacker to escalate privileges and obtain sensitive information via Improper Access Control.
- Product
- ultimateimagetool
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.friendsofpresta.orgsecurity.friendsofpresta.org
Mar 13, 2024SQL injection vulnerability in SunnyToo stproductcomments module for PrestaShop v.1.0.5 and before, allows a remote attacker to escalate privileges and obtain sCVE-2024-28388 · Other software · sunnytoo · reported by MITRECritical 9.8
SQL injection vulnerability in SunnyToo stproductcomments module for PrestaShop v.1.0.5 and before, allows a remote attacker to escalate privileges and obtain sensitive information via the StProductCommentClass::getListcomments method.
- Product
- stproductcomments
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.friendsofpresta.orgsecurity.friendsofpresta.org
Mar 13, 2024Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.CVE-2024-28175 · Other software · argoproj · reported by GitHubCritical 9
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Due to the improper URL protocols filtering of links specified in the `link.argocd.argoproj.io` annotations in the application summary component, an attacker can achieve cross-site scripting with elevated permissions. All unpatched versions of Argo CD starting with v1.0.0 are vulnerable to a cross-site scripting (XSS) bug allowing a malicious user to inject a javascript: link in the UI. When clicked by a victim user, the script will execute with the victim's permissions (up to and including admin). This vulnerability allows an attacker to perform arbitrary actions on behalf of the victim via the API, such as creating, modifying, and deleting Kubernetes resources. A patch for this vulnerability has been released in Argo CD versions v2.10.3 v2.9.8, and v2.8.12. There are no completely-safe workarounds besides upgrading. The safest alternative, if upgrading is not possible, would be to create a Kubernetes admission controller to reject any resources with an annotation starting with link.argocd.argoproj.io or reject the resource if the value use an improper URL protocol. This validation will need to be applied in
- Product
- argo-cd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2024Wings is the server control plane for Pterodactyl Panel.CVE-2024-27102 · Other software · pterodactyl · reported by GitHubCritical 9.9
Wings is the server control plane for Pterodactyl Panel. This vulnerability impacts anyone running the affected versions of Wings. The vulnerability can potentially be used to access files and directories on the host system. The full scope of impact is exactly unknown, but reading files outside of a server's base directory (sandbox root) is possible. In order to use this exploit, an attacker must have an existing "server" allocated and controlled by Wings. Details on the exploitation of this vulnerability are embargoed until March 27th, 2024 at 18:00 UTC. In order to mitigate this vulnerability, a full rewrite of the entire server filesystem was necessary. Because of this, the size of the patch is massive, however effort was made to reduce the amount of breaking changes. Users are advised to update to version 1.11.9. There are no known workarounds for this vulnerability.
- Product
- wings
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.