Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

542new WordPress flaws this week

391,528entries in the database

3,841 results · page 36 of 77

Mar 11, 2024A malicious DNS response can trigger a number of OOB reads, writes, and other memory issuesCVE-2024-27227 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comCritical 9.8
A malicious DNS response can trigger a number of OOB reads, writes, and other memory issues
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com source.android.com
Mar 11, 2024In Session of AccountManagerService.java, there is a possible method to retain foreground service privileges due to incorrect handling of null responses.CVE-2024-0048 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In Session of AccountManagerService.java, there is a possible method to retain foreground service privileges due to incorrect handling of null responses. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record android.googlesource.com source.android.com
Mar 6, 2024ESPHome is a system to control your ESP8266/ESP32 for Home Automation systems.CVE-2024-27287 · Other software · esphome · reported by GitHubMedium 6.5
ESPHome is a system to control your ESP8266/ESP32 for Home Automation systems. Starting in version 2023.12.9 and prior to version 2024.2.2, editing the configuration file API in dashboard component of ESPHome version 2023.12.9 (command line installation and Home Assistant add-on) serves unsanitized data with `Content-Type: text/html; charset=UTF-8`, allowing a remote authenticated user to inject arbitrary web script and exfiltrate session cookies via Cross-Site scripting. It is possible for a malicious authenticated user to inject arbitrary Javascript in configuration files using a POST request to the /edit endpoint, the configuration parameter allows to specify the file to write. To trigger the XSS vulnerability, the victim must visit the page` /edit?configuration=[xss file]`. Abusing this vulnerability a malicious actor could perform operations on the dashboard on the behalf of a logged user, access sensitive information, create, edit and delete configuration files and flash firmware on managed boards. In addition to this, cookies are not correctly secured, allowing the exfiltration of session cookie values. Version 2024.2.2 contains a patch for this issue.
Product
esphome
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 4, 2024IBM CICS TX Advanced 10.1 could disclose sensitive information to a remote attacker due to observable discrepancy in HTTP responses.CVE-2023-38362 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM CICS TX Advanced 10.1 could disclose sensitive information to a remote attacker due to observable discrepancy in HTTP responses. IBM X-Force ID: 260814.
Product
CICS TX Advanced
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com https
Mar 4, 2024Memory corruption while parsing beacon/probe response frame when AP sends more supported links in MLIE.CVE-2023-43553 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comCritical 9.8
Memory corruption while parsing beacon/probe response frame when AP sends more supported links in MLIE.
Product
Snapdragon
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record qualcomm.com qualcomm.com
Mar 2, 2024Master Slider – Responsive Touch Slider: Stored Cross-Site ScriptingCVE-2024-1449 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ms_slide shortcode in all versions up to, and including, 3.9.10 due to insufficient input sanitization and output escaping on the 'src' user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Master Slider – Responsive Touch Slider
Affected
up to 3.9.10
What to do
Affects up to 3.9.10. Update Master Slider – Responsive Touch Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Mar 2, 2024Master Slider – Responsive Touch Slider: Stored Cross-Site ScriptingCVE-2024-0611 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the slides callback functionality in all versions up to, and including, 3.9.9. This makes it possible for authenticated attackers, with editor-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Master Slider – Responsive Touch Slider
Affected
up to 3.9.9
What to do
Affects up to 3.9.9. Update Master Slider – Responsive Touch Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record advisory.abay.sh plugins.trac.wordpress.org
Mar 2, 2024Master Slider – Responsive Touch Slider: Cross-Site Request ForgeryCVE-2023-6326 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.9.10. This is due to missing or incorrect nonce validation on the 'process_bulk_action' function. This makes it possible for unauthenticated attackers to duplicate or delete arbitrary sliders via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. CVE-2023-50900 and CVE-2024-6490 may be a duplicate of this issue.
Product
Master Slider – Responsive Touch Slider
Affected
up to 3.9.10
What to do
Affects up to 3.9.10. Update Master Slider – Responsive Touch Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 1, 2024Slider Responsive Slideshow – Image slider, Gallery slideshow: PHP Object InjectionCVE-2024-1859 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Slider Responsive Slideshow – Image slider, Gallery slideshow plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3.8 via deserialization of untrusted input to the awl_slider_responsive_shortcode function. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Product
Slider Responsive Slideshow – Image slider, Gallery slideshow
Affected
up to 1.3.8
What to do
Affects up to 1.3.8. Update Slider Responsive Slideshow – Image slider, Gallery slideshow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 29, 2024IBM Cognos Command Center 10.2.4.1 and 10.2.5 exposes details the X-AspNet-Version Response Header that could allow an attacker to obtain information of the appCVE-2023-50324 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM Cognos Command Center 10.2.4.1 and 10.2.5 exposes details the X-AspNet-Version Response Header that could allow an attacker to obtain information of the application environment to conduct further attacks. IBM X-Force ID: 275038.
Product
Cognos Command Center
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com
Feb 26, 2024ESPHome is a system to control your ESP8266/ESP32.CVE-2024-27081 · Other software · esphome · reported by GitHubHigh 7.2
ESPHome is a system to control your ESP8266/ESP32. A security misconfiguration in the edit configuration file API in the dashboard component of ESPHome version 2023.12.9 (command line installation) allows authenticated remote attackers to read and write arbitrary files under the configuration directory rendering remote code execution possible. This vulnerability is patched in 2024.2.1.
Product
esphome
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 21, 2024An issue exists in all supported versions of IdentityIQ Lifecycle Manager that can result if an entitlement with a value containing leading or trailing whitespaCVE-2024-1714 · Other software · SailPoint · reported by psirt@sailpoint.comHigh 7.1
An issue exists in all supported versions of IdentityIQ Lifecycle Manager that can result if an entitlement with a value containing leading or trailing whitespace is requested by an authenticated user in an access request.
Product
IdentityIQ
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sailpoint.com sailpoint.com
Feb 21, 2024JTRT Responsive Tables: Cross-Site Request Forgery (CSRF)CVE-2024-24802 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in John Tendik JTRT Responsive Tables.This issue affects JTRT Responsive Tables: from n/a through 4.1.9.
Product
JTRT Responsive Tables
Affected
up to 4.1.9
What to do
Affects up to 4.1.9. Update JTRT Responsive Tables to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 20, 2024When opening a website using the `firefox://` protocol handler, SameSite cookies were not properly respected.CVE-2024-1555 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.3
When opening a website using the `firefox://` protocol handler, SameSite cookies were not properly respected. This vulnerability affects Firefox < 123.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Feb 20, 2024Set-Cookie response headers were being incorrectly honored in multipart HTTP responses.CVE-2024-1551 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.1
Set-Cookie response headers were being incorrectly honored in multipart HTTP responses. If an attacker could control the Content-Type response header, as well as control part of the response body, they could inject Set-Cookie response headers that would have been honored by the browser. This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org lists.debian.org
Feb 20, 2024IBM Common Licensing 9.0 could allow a local user to enumerate usernames due to an observable response discrepancy.CVE-2023-50306 · Other software · IBM · reported by psirt@us.ibm.comMedium 4
IBM Common Licensing 9.0 could allow a local user to enumerate usernames due to an observable response discrepancy. IBM X-Force ID: 273337.
Product
Common Licensing
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com
Feb 19, 2024Iris is a web collaborative platform that helps incident responders share technical details during investigations.CVE-2024-25640 · Other software · dfir-iris · reported by GitHubMedium 4.6
Iris is a web collaborative platform that helps incident responders share technical details during investigations. A stored Cross-Site Scripting (XSS) vulnerability has been identified in iris-web, affecting multiple locations in versions prior to v2.4.0. The vulnerability may allow an attacker to inject malicious scripts into the application, which could then be executed when a user visits the affected locations. This could lead to unauthorized access, data theft, or other related malicious activities. An attacker need to be authenticated on the application to exploit this vulnerability. The issue is fixed in version v2.4.0 of iris-web. No workarounds are available.
Product
iris-web
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 18, 2024Signed to unsigned conversion esp32_ipm_sendCVE-2023-6249 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgHigh 8
Signed to unsigned conversion esp32_ipm_send
Product
Zephyr
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 15, 2024In btif_to_bta_response of btif_gatt_util.cc, there is a possible out of bounds read due to an incorrect bounds check.CVE-2024-0030 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In btif_to_bta_response of btif_gatt_util.cc, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record android.googlesource.com source.android.com
Feb 15, 2024ping reads raw IP packets from the network to process responses in the pr_pack() function.CVE-2022-23093 · Other software · FreeBSD · reported by secteam@freebsd.orgMedium 6.5
ping reads raw IP packets from the network to process responses in the pr_pack() function. As part of processing a response ping has to reconstruct the IP header, the ICMP header and if present a "quoted packet," which represents the packet that generated an ICMP error. The quoted packet again has an IP header and an ICMP header. The pr_pack() copies received IP and ICMP headers into stack buffers for further processing. In so doing, it fails to take into account the possible presence of IP option headers following the IP header in either the response or the quoted packet. When IP options are present, pr_pack() overflows the destination buffer by up to 40 bytes. The memory safety bugs described above can be triggered by a remote host, causing the ping program to crash. The ping process runs in a capability mode sandbox on all affected versions of FreeBSD and is thus very constrained in how it can interact with the rest of the system at the point where the bug can occur.
Product
FreeBSD
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.freebsd.org security.freebsd.org
Feb 14, 2024When HTTP/2 is configured on BIG-IP or BIG-IP Next SPK systems, undisclosed responses can cause the Traffic Management Microkernel (TMM) to terminate.CVE-2024-23314 · Network & remote access · F5 · reported by f5sirt@f5.comHigh 7.5
When HTTP/2 is configured on BIG-IP or BIG-IP Next SPK systems, undisclosed responses can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
Product
BIG-IP
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record my.f5.com my.f5.com
Feb 12, 2024Brooklyn | Creative Multi-Purpose Responsive: Deserialization of Untrusted DataCVE-2024-24926 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Deserialization of Untrusted Data vulnerability in UnitedThemes Brooklyn | Creative Multi-Purpose Responsive WordPress Theme.This issue affects Brooklyn | Creative Multi-Purpose Responsive WordPress Theme: from n/a through 4.9.7.6.
Product
Brooklyn | Creative Multi-Purpose Responsive
Affected
up to 4.9.7.6
What to do
Affects up to 4.9.7.6. Update Brooklyn | Creative Multi-Purpose Responsive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 12, 2024Brooklyn | Creative Multi-Purpose Responsive: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-24927 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UnitedThemes Brooklyn | Creative Multi-Purpose Responsive WordPress Theme allows Reflected XSS.This issue affects Brooklyn | Creative Multi-Purpose Responsive WordPress Theme: from n/a through 4.9.7.6.
Product
Brooklyn | Creative Multi-Purpose Responsive
Affected
up to 4.9.7.6
What to do
Affects up to 4.9.7.6. Update Brooklyn | Creative Multi-Purpose Responsive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 9, 2024In LiteSpeed QUIC (LSQUIC) Library before 4.0.4, DCID validation is mishandled.CVE-2024-25678 · Other software · Litespeedtech · reported by MITRECritical 9.8
In LiteSpeed QUIC (LSQUIC) Library before 4.0.4, DCID validation is mishandled.
Product
Lsquic
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 9, 2024SQL injection vulnerability in Presta Monster "Multi Accessories Pro" (hsmultiaccessoriespro) module for PrestaShop versions 5.1.1 and before, allows remote attCVE-2023-50026 · Other software · Prestamonster · reported by MITRECritical 9.8
SQL injection vulnerability in Presta Monster "Multi Accessories Pro" (hsmultiaccessoriespro) module for PrestaShop versions 5.1.1 and before, allows remote attackers to escalate privileges and obtain sensitive information via the method HsAccessoriesGroupProductAbstract::getAccessoriesByIdProducts().
Product
Multi Accessories Pro
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.friendsofpresta.org security.friendsofpresta.org
Feb 7, 2024An issue was discovered whereby APM Server could log at ERROR level, a response from Elasticsearch indicating that indexing the document failed and that responsCVE-2024-23448 · Other software · Elastic · reported by security@elastic.coMedium 5.7
An issue was discovered whereby APM Server could log at ERROR level, a response from Elasticsearch indicating that indexing the document failed and that response would contain parts of the original document. Depending on the nature of the document that the APM Server attempted to ingest, this could lead to the insertion of sensitive or private information in the APM Server logs.
Product
APM Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record discuss.elastic.co elastic.co
Feb 7, 2024Espruino 2v20 (commit fcc9ba4) was discovered to contain an Out-of-bounds Read via jsvStringIteratorPrintfCallback at src/jsvar.c.CVE-2024-25201 · Other software · Espruino · reported by MITREHigh 7.5
Espruino 2v20 (commit fcc9ba4) was discovered to contain an Out-of-bounds Read via jsvStringIteratorPrintfCallback at src/jsvar.c.
Product
Espruino
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 7, 2024Espruino 2v20 (commit fcc9ba4) was discovered to contain a Stack Overflow via the jspeFactorFunctionCall at src/jsparse.c.CVE-2024-25200 · Other software · Espruino · reported by MITREHigh 7.5
Espruino 2v20 (commit fcc9ba4) was discovered to contain a Stack Overflow via the jspeFactorFunctionCall at src/jsparse.c.
Product
Espruino
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 6, 2024An issue was discovered by Elastic, whereby the Detection Engine Search API does not respect Document-level security (DLS) or Field-level security (FLS) when quCVE-2024-23446 · Other software · Elastic · reported by security@elastic.coMedium 6.5
An issue was discovered by Elastic, whereby the Detection Engine Search API does not respect Document-level security (DLS) or Field-level security (FLS) when querying the .alerts-security.alerts-{space_id} indices. Users who are authorized to call this API may obtain unauthorized access to documents if their roles are configured with DLS or FLS against the aforementioned index.
Product
Kibana
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record discuss.elastic.co elastic.co
Feb 6, 2024An information disclosure flaw was found in ansible-core due to a failure to respect the ANSIBLE_NO_LOG configuration in some scenarios.CVE-2024-0690 · Other software · Red Hat · reported by Red HatMedium 5
An information disclosure flaw was found in ansible-core due to a failure to respect the ANSIBLE_NO_LOG configuration in some scenarios. Information is still included in the output in certain tasks, such as loop items. Depending on the task, this issue may include sensitive information, such as decrypted secret values.
Product
Red Hat Ansible Automation Platform 2.4 for RHEL 8
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com access.redhat.com
Feb 5, 2024Lotos WebServer v0.1.1 was discovered to contain a Use-After-Free (UAF) vulnerability via the response_append_status_line function at /lotos/src/response.c.CVE-2024-24263 · Other software · Chendotjs · reported by MITREHigh 7.5
Lotos WebServer v0.1.1 was discovered to contain a Use-After-Free (UAF) vulnerability via the response_append_status_line function at /lotos/src/response.c.
Product
Lotos Webserver
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 2, 2024open-irs is an issue response robot that reponds to issues in the installed repository.CVE-2024-24757 · Other software · Degamisu · reported by GitHubHigh 7.6
open-irs is an issue response robot that reponds to issues in the installed repository. The `.env` file was accidentally uploaded when working with git actions. This problem is fixed in 1.0.1. Discontinuing all sensitive keys and turning into secrets.
Product
open-irs
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 1, 2024In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, the affected product responds back with an error message containing sensitive data if it reCVE-2024-21866 · Other software · Rapid Software LLC · reported by ics-cert@hq.dhs.govMedium 5.3
In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, the affected product responds back with an error message containing sensitive data if it receives a specific malformed request.
Product
Rapid SCADA
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rapidscada.org cisa.gov
Jan 26, 2024An issue in kosei entertainment esportsstudioLegends mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channeCVE-2023-48132 · Other software · Linecorp · reported by MITREMedium 5.4
An issue in kosei entertainment esportsstudioLegends mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.
Product
Line
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 22, 2024In Splunk Enterprise versions below 9.0.8, the Splunk RapidDiag utility discloses server responses from external applications in a log file.CVE-2024-23677 · Other software · Splunk · reported by prodsec@splunk.comMedium 4.3
In Splunk Enterprise versions below 9.0.8, the Splunk RapidDiag utility discloses server responses from external applications in a log file.
Product
Splunk Enterprise
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record advisory.splunk.com advisory.splunk.com
Jan 18, 2024A stack based buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft when parsing the wLogTitlesPrevValueLen field of a DPS file.CVE-2023-43820 · Other software · Delta Electronics · reported by disclosures@exodusintel.comHigh 8.8
A stack based buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft when parsing the wLogTitlesPrevValueLen field of a DPS file. A remote, unauthenticated attacker can exploit this vulnerability by enticing a user to open a specially crafted DPS file to achieve remote code execution.
Product
DOPSoft
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.exodusintel.com blog.exodusintel.com
Jan 17, 2024IBM QRadar SIEM 7.5 could disclose sensitive email information in responses from offense rules.CVE-2023-50950 · Other software · IBM · reported by psirt@us.ibm.comLow 3.7
IBM QRadar SIEM 7.5 could disclose sensitive email information in responses from offense rules. IBM X-Force ID: 275709.
Product
QRadar SIEM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com
Jan 12, 2024Wazuh is a free and open source platform used for threat prevention, detection, and response.CVE-2023-42463 · Other software · wazuh · reported by GitHubHigh 7.4
Wazuh is a free and open source platform used for threat prevention, detection, and response. This bug introduced a stack overflow hazard that could allow a local privilege escalation. This vulnerability was patched in version 4.5.3.
Product
wazuh
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 12, 2024The authentication mechanism can be bypassed by overflowing the value of the Cookie "authentication" field, provided there is an active user session.CVE-2023-49262 · Other software · Hongdian · reported by cvd@cert.plCritical 9.8
The authentication mechanism can be bypassed by overflowing the value of the Cookie "authentication" field, provided there is an active user session.
Product
H8951-4G-ESP
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.pl cert.pl
Jan 12, 2024The "tokenKey" value used in user authorization is visible in the HTML source of the login page.CVE-2023-49261 · Other software · Hongdian · reported by cvd@cert.plHigh 7.5
The "tokenKey" value used in user authorization is visible in the HTML source of the login page.
Product
H8951-4G-ESP
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.pl cert.pl
Jan 12, 2024An XSS attack can be performed by changing the MOTD banner and pointing the victim to the "terminal_tool.cgi" path.CVE-2023-49260 · Other software · Hongdian · reported by cvd@cert.plMedium 6.1
An XSS attack can be performed by changing the MOTD banner and pointing the victim to the "terminal_tool.cgi" path. It can be used together with the vulnerability CVE-2023-49255.
Product
H8951-4G-ESP
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.pl cert.pl
Jan 12, 2024The authentication cookies are generated using an algorithm based on the username, hardcoded secret and the up-time, and can be guessed in a reasonable time.CVE-2023-49259 · Other software · Hongdian · reported by cvd@cert.plHigh 7.5
The authentication cookies are generated using an algorithm based on the username, hardcoded secret and the up-time, and can be guessed in a reasonable time.
Product
H8951-4G-ESP
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.pl cert.pl
Jan 12, 2024User browser may be forced to execute JavaScript and pass the authentication cookie to the attacker leveraging the XSS vulnerability located at "/gui/terminal_tCVE-2023-49258 · Other software · Hongdian · reported by cvd@cert.plMedium 6.1
User browser may be forced to execute JavaScript and pass the authentication cookie to the attacker leveraging the XSS vulnerability located at "/gui/terminal_tool.cgi" in the "data" parameter.
Product
H8951-4G-ESP
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.pl cert.pl
Jan 12, 2024An authenticated user is able to upload an arbitrary CGI-compatible file using the certificate upload utility and execute it with the root user privileges.CVE-2023-49257 · Other software · Hongdian · reported by cvd@cert.plHigh 8.8
An authenticated user is able to upload an arbitrary CGI-compatible file using the certificate upload utility and execute it with the root user privileges.
Product
H8951-4G-ESP
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.pl cert.pl
Jan 12, 2024It is possible to download the configuration backup without authorization and decrypt included passwords using hardcoded static key.CVE-2023-49256 · Other software · Hongdian · reported by cvd@cert.plHigh 7.5
It is possible to download the configuration backup without authorization and decrypt included passwords using hardcoded static key.
Product
H8951-4G-ESP
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.pl cert.pl
Jan 12, 2024The router console is accessible without authentication at "data" field, and while a user needs to be logged in in order to modify the configuration, the sessioCVE-2023-49255 · Other software · Hongdian · reported by cvd@cert.plCritical 9.8
The router console is accessible without authentication at "data" field, and while a user needs to be logged in in order to modify the configuration, the session state is shared. If any other user is currently logged in, the anonymous user can execute commands in the context of the authenticated one. If the logged in user has administrative privileges, it is possible to use webadmin service configuration commands to create a new admin user with a chosen password.
Product
H8951-4G-ESP
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.pl cert.pl
Jan 12, 2024Authenticated user can execute arbitrary commands in the context of the root user by providing payload in the "destination" field of the network test tools.CVE-2023-49254 · Other software · Hongdian · reported by cvd@cert.plHigh 8.8
Authenticated user can execute arbitrary commands in the context of the root user by providing payload in the "destination" field of the network test tools. This is similar to the vulnerability CVE-2021-28151 mitigated on the user interface level by blacklisting characters with JavaScript, however, it can still be exploited by sending POST requests directly.
Product
H8951-4G-ESP
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.pl cert.pl
Jan 12, 2024Root user password is hardcoded into the device and cannot be changed in the user interface.CVE-2023-49253 · Other software · Hongdian · reported by cvd@cert.plCritical 9.8
Root user password is hardcoded into the device and cannot be changed in the user interface.
Product
H8951-4G-ESP
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.pl cert.pl
Jan 11, 2024LiteSpeed Cache: Stored Cross-Site ScriptingCVE-2023-4372 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'esi' shortcode in versions up to, and including, 5.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
LiteSpeed Cache
Affected
up to 5.6
What to do
Affects up to 5.6. Update LiteSpeed Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Jan 10, 2024The vulnerability allows a remote attacker to inject arbitrary HTTP response headers or manipulate HTTP response bodies inside a victim’s session via a crafted CVE-2023-48256 · Other software · Rexroth · reported by psirt@bosch.comMedium 5.3
The vulnerability allows a remote attacker to inject arbitrary HTTP response headers or manipulate HTTP response bodies inside a victim’s session via a crafted URL or HTTP request.
Product
Nexo cordless nutrunner NXA015S-36V (0608842001)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record psirt.bosch.com psirt.bosch.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.