Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
38,964 results · page 361 of 780
Jan 10, 2024Tenda AX1803 v1.0.0.1 contains a stack overflow via the adv.iptv.stballvlans parameter in the function getIptvInfo.CVE-2023-51968 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda AX1803 v1.0.0.1 contains a stack overflow via the adv.iptv.stballvlans parameter in the function getIptvInfo.
- Product
- Ax1803 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgrove-laser-8ad.notion.sitegrove-laser-8ad.notion.site
Jan 10, 2024Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.stb.port parameter in the function getIptvInfo.CVE-2023-51967 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.stb.port parameter in the function getIptvInfo.
- Product
- Ax1803 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgrove-laser-8ad.notion.sitegrove-laser-8ad.notion.site
Jan 10, 2024Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.stb.mode parameter in the function setIptvInfo.CVE-2023-51962 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.stb.mode parameter in the function setIptvInfo.
- Product
- Ax1803 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgrove-laser-8ad.notion.sitegrove-laser-8ad.notion.site
Jan 10, 2024An insufficient entropy vulnerability exists in the salt generation functionality of WWBN AVideo dev master commit 15fed957fb.CVE-2023-49599 · Other software · WWBN · reported by talos-cna@cisco.comCritical 9.8
An insufficient entropy vulnerability exists in the salt generation functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted series of HTTP requests can lead to privilege escalation. An attacker can gather system information via HTTP requests and brute force the salt offline, leading to forging a legitimate password recovery code for the admin user.
- Product
- AVideo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Jan 10, 2024A cross-site scripting (xss) vulnerability exists in the functiongetOpenGraph videoName functionality of WWBN AVideo 11.6 and dev master commit 3c6bb3ff.CVE-2023-48728 · Other software · WWBN · reported by talos-cna@cisco.comCritical 9.6
A cross-site scripting (xss) vulnerability exists in the functiongetOpenGraph videoName functionality of WWBN AVideo 11.6 and dev master commit 3c6bb3ff. A specially crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get a user to visit a webpage to trigger this vulnerability.
- Product
- AVideo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Jan 10, 2024A local file inclusion vulnerability exists in the getLanguageFromBrowser functionality of WWBN AVideo dev master commit 15fed957fb.CVE-2023-47862 · Other software · WWBN · reported by talos-cna@cisco.comCritical 9.8
A local file inclusion vulnerability exists in the getLanguageFromBrowser functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can send a series of HTTP requests to trigger this vulnerability.
- Product
- AVideo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Jan 10, 2024A cross-site scripting (xss) vulnerability exists in the channelBody.php user name functionality of WWBN AVideo 11.6 and dev master commit 15fed957fb.CVE-2023-47861 · Other software · WWBN · reported by talos-cna@cisco.comCritical 9
A cross-site scripting (xss) vulnerability exists in the channelBody.php user name functionality of WWBN AVideo 11.6 and dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get a user to visit a webpage to trigger this vulnerability.
- Product
- AVideo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Jan 10, 2024Tenda AX1803 v1.0.0.1 contains a stack overflow via the adv.iptv.stbpvid parameter in the function setIptvInfo.CVE-2023-51965 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda AX1803 v1.0.0.1 contains a stack overflow via the adv.iptv.stbpvid parameter in the function setIptvInfo.
- Product
- Ax1803 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgrove-laser-8ad.notion.sitegrove-laser-8ad.notion.site
Jan 10, 2024Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.stb.port parameter in the function setIptvInfo.CVE-2023-51964 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.stb.port parameter in the function setIptvInfo.
- Product
- Ax1803 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgrove-laser-8ad.notion.sitegrove-laser-8ad.notion.site
Jan 10, 2024Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.city.vlan parameter in the function setIptvInfo.CVE-2023-51963 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.city.vlan parameter in the function setIptvInfo.
- Product
- Ax1803 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgrove-laser-8ad.notion.sitegrove-laser-8ad.notion.site
Jan 10, 2024Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.city.vlan parameter in the function formGetIptv.CVE-2023-51960 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.city.vlan parameter in the function formGetIptv.
- Product
- Ax1803 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgrove-laser-8ad.notion.sitegrove-laser-8ad.notion.site
Jan 10, 2024Tenda AX1803 v1.0.0.1 contains a stack overflow via the adv.iptv.stbpvid parameter in the function formGetIptv.CVE-2023-51959 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda AX1803 v1.0.0.1 contains a stack overflow via the adv.iptv.stbpvid parameter in the function formGetIptv.
- Product
- Ax1803 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgrove-laser-8ad.notion.sitegrove-laser-8ad.notion.site
Jan 10, 2024Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.stb.port parameter in the function formGetIptv.CVE-2023-51958 · Network & remote access · tenda · reported by MITRECritical 9.8
Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.stb.port parameter in the function formGetIptv.
- Product
- ax1803_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgrove-laser-8ad.notion.sitegrove-laser-8ad.notion.site
Jan 10, 2024Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.stb.mode parameter in the function formGetIptv.CVE-2023-51957 · Network & remote access · tenda · reported by MITRECritical 9.8
Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.stb.mode parameter in the function formGetIptv.
- Product
- ax1803_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgrove-laser-8ad.notion.sitegrove-laser-8ad.notion.site
Jan 10, 2024Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.city.vlan parameter in the function formSetIptvCVE-2023-51956 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.city.vlan parameter in the function formSetIptv
- Product
- Ax1803 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgrove-laser-8ad.notion.sitegrove-laser-8ad.notion.site
Jan 10, 2024Tenda AX1803 v1.0.0.1 contains a stack overflow via the adv.iptv.stballvlans parameter in the function formSetIptv.CVE-2023-51955 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda AX1803 v1.0.0.1 contains a stack overflow via the adv.iptv.stballvlans parameter in the function formSetIptv.
- Product
- Ax1803 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgrove-laser-8ad.notion.sitegrove-laser-8ad.notion.site
Jan 10, 2024Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.stb.port parameter in the function formSetIptv.CVE-2023-51954 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.stb.port parameter in the function formSetIptv.
- Product
- Ax1803 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgrove-laser-8ad.notion.sitegrove-laser-8ad.notion.site
Jan 10, 2024Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.stb.mode parameter in the function formSetIptv.CVE-2023-51953 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.stb.mode parameter in the function formSetIptv.
- Product
- Ax1803 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgrove-laser-8ad.notion.sitegrove-laser-8ad.notion.site
Jan 10, 2024Tenda AX1803 v1.0.0.1 contains a stack overflow via the adv.iptv.stbpvid parameter in the function formSetIptv.CVE-2023-51952 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda AX1803 v1.0.0.1 contains a stack overflow via the adv.iptv.stbpvid parameter in the function formSetIptv.
- Product
- Ax1803 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgrove-laser-8ad.notion.sitegrove-laser-8ad.notion.site
Jan 10, 2024Tenda AX1803 v1.0.0.1 contains a stack overflow via the adv.iptv.stballvlans parameter in the function setIptvInfo.CVE-2023-51966 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda AX1803 v1.0.0.1 contains a stack overflow via the adv.iptv.stballvlans parameter in the function setIptvInfo.
- Product
- Ax1803 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgrove-laser-8ad.notion.sitegrove-laser-8ad.notion.site
Jan 10, 2024Tenda AX1803 v1.0.0.1 contains a stack overflow via the adv.iptv.stballvlans parameter in the function formGetIptv.CVE-2023-51961 · Network & remote access · tenda · reported by MITRECritical 9.8
Tenda AX1803 v1.0.0.1 contains a stack overflow via the adv.iptv.stballvlans parameter in the function formGetIptv.
- Product
- ax1803_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgrove-laser-8ad.notion.sitegrove-laser-8ad.notion.site
Jan 10, 2024Tenda AX1803 v1.0.0.1 was discovered to contain a command injection vulnerability via the function fromAdvSetLanIp.CVE-2023-51972 · Network & remote access · tenda · reported by MITRECritical 9.8
Tenda AX1803 v1.0.0.1 was discovered to contain a command injection vulnerability via the function fromAdvSetLanIp.
- Product
- ax1803_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgrove-laser-8ad.notion.sitegrove-laser-8ad.notion.site
Jan 10, 2024Tenda AX1803 v1.0.0.1 contains a stack overflow via the adv.iptv.stbpvid parameter in the function getIptvInfo.CVE-2023-51971 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda AX1803 v1.0.0.1 contains a stack overflow via the adv.iptv.stbpvid parameter in the function getIptvInfo.
- Product
- Ax1803 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgrove-laser-8ad.notion.sitegrove-laser-8ad.notion.site
Jan 10, 2024A JQuery Unrestricted Arbitrary File Upload vulnerability was discovered in Hospital Management System V4.0 which allows an unauthenticated attacker to upload aCVE-2020-26629 · Websites & servers · Phpgurukul · reported by MITRECritical 9.8
A JQuery Unrestricted Arbitrary File Upload vulnerability was discovered in Hospital Management System V4.0 which allows an unauthenticated attacker to upload any file to the server.
- Product
- Hospital Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Jan 10, 2024Totolink N200RE_V5 V9.3.5u.6255_B20211224 is vulnerable to Incorrect Access Control.CVE-2022-46025 · Other software · totolink · reported by MITRECritical 9.1
Totolink N200RE_V5 V9.3.5u.6255_B20211224 is vulnerable to Incorrect Access Control. The device allows remote attackers to obtain Wi-Fi system information, such as Wi-Fi SSID and Wi-Fi password, without logging into the management page.
- Product
- n200re_v5_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpastebin.compastebin.com
Jan 9, 2024In Cassia Gateway firmware XC1000_2.1.1.2303082218 and XC2000_2.1.1.2303090947, the queueUrl parameter in /bypass/config is not sanitized.CVE-2023-31446 · Other software · Cassianetworks · reported by MITRECritical 9.8
In Cassia Gateway firmware XC1000_2.1.1.2303082218 and XC2000_2.1.1.2303090947, the queueUrl parameter in /bypass/config is not sanitized. This leads to injecting Bash code and executing it with root privileges on device startup.
- Product
- Xc1000 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.kscsc.onlinegithub.com
Jan 9, 2024 AMI’s SPx contains a vulnerability in the BMC where an Attacker may cause a stack-based buffer overflow via an adjacent network.CVE-2023-3043 · Other software · AMI · reported by biossecurity@ami.comCritical 9.6
AMI’s SPx contains a vulnerability in the BMC where an Attacker may cause a stack-based buffer overflow via an adjacent network. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.
- Product
- MegaRAC_SPx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record9443417.fs1.hubspotusercontent-na1.net9443417.fs1.hubspotusercontent-na1.net
Jan 9, 2024AMI’s SPx contains a vulnerability in the BMC where an Attacker may cause a stack-based buffer overflow via an adjacent network.CVE-2023-37293 · Other software · AMI · reported by biossecurity@ami.comCritical 9.6
AMI’s SPx contains a vulnerability in the BMC where an Attacker may cause a stack-based buffer overflow via an adjacent network. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.
- Product
- MegaRAC_SPx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record9443417.fs1.hubspotusercontent-na1.net9443417.fs1.hubspotusercontent-na1.net
Jan 9, 2024NET, .NET Framework, and Visual Studio Security Feature Bypass VulnerabilityCVE-2024-0057 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.1
NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability
- Product
- .NET 8.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jan 9, 2024A vulnerability was found in Totolink T6 4.1.9cu.5241_B20210923.CVE-2023-7221 · Other software · Totolink · reported by VulDBCritical 9.8
A vulnerability was found in Totolink T6 4.1.9cu.5241_B20210923. It has been classified as critical. This affects the function main of the file /cgi-bin/cstecgi.cgi?action=login of the component HTTP POST Request Handler. The manipulation of the argument v41 leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249855. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- T6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2024An Improper Verification of Cryptographic Signature vulnerability in the update process of Korenix JetNet Series allows replacing the whole operating system incCVE-2023-5347 · Other software · Korenix · reported by office@cyberdanube.comCritical 9.8
An Improper Verification of Cryptographic Signature vulnerability in the update process of Korenix JetNet Series allows replacing the whole operating system including Trusted Executables. This issue affects JetNet devices older than firmware version 2024/01.
- Product
- JetNet Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jan 9, 2024A vulnerability has been identified in SIMATIC IPC1047E (All versions with maxView Storage Manager < V4.14.00.26068 on Windows), SIMATIC IPC647E (All versions wCVE-2023-51438 · Other software · Siemens · reported by productcert@siemens.comCritical 10
A vulnerability has been identified in SIMATIC IPC1047E (All versions with maxView Storage Manager < V4.14.00.26068 on Windows), SIMATIC IPC647E (All versions with maxView Storage Manager < V4.14.00.26068 on Windows), SIMATIC IPC847E (All versions with maxView Storage Manager < V4.14.00.26068 on Windows). In default installations of maxView Storage Manager where Redfish® server is configured for remote system management, a vulnerability has been identified that can provide unauthorized access.
- Product
- SIMATIC IPC1047E
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comcert-portal.siemens.com
Jan 9, 2024A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.7).CVE-2023-49621 · Other software · Siemens · reported by productcert@siemens.comCritical 9.8
A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.7). The "intermediate installation" system state of the affected application uses default credential with admin privileges. An attacker could use the credentials to gain complete control of the affected device.
- Product
- SIMATIC CN 4100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comcert-portal.siemens.com
Jan 9, 2024Tenda A18 v15.13.07.09 was discovered to contain a stack overflow via the devName parameter in the formSetDeviceName function.CVE-2023-50585 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda A18 v15.13.07.09 was discovered to contain a stack overflow via the devName parameter in the formSetDeviceName function.
- Product
- A18 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2024An issue was discovered on TRENDnet TV-IP1314PI 5.5.3 200714 devices.CVE-2023-49237 · Other software · Trendnet · reported by MITRECritical 9.8
An issue was discovered on TRENDnet TV-IP1314PI 5.5.3 200714 devices. Command injection can occur because the system function is used by davinci to unpack language packs without strict filtering of URL strings.
- Product
- Tv-ip1314pi Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Jan 9, 2024A stack-based buffer overflow was discovered on TRENDnet TV-IP1314PI 5.5.3 200714 devices, leading to arbitrary command execution.CVE-2023-49236 · Other software · Trendnet · reported by MITRECritical 9.8
A stack-based buffer overflow was discovered on TRENDnet TV-IP1314PI 5.5.3 200714 devices, leading to arbitrary command execution. This occurs because of lack of length validation during an sscanf of a user-entered scale field in the RTSP playback function of davinci.
- Product
- Tv-ip1314pi Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Jan 9, 2024An issue was discovered in libremote_dbg.so on TRENDnet TV-IP1314PI 5.5.3 200714 devices.CVE-2023-49235 · Other software · Trendnet · reported by MITRECritical 9.8
An issue was discovered in libremote_dbg.so on TRENDnet TV-IP1314PI 5.5.3 200714 devices. Filtering of debug information is mishandled during use of popen. Consequently, an attacker can bypass validation and execute a shell command.
- Product
- Tv-ip1314pi Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Jan 9, 2024A vulnerability was found in Totolink NR1800X 9.1.0u.6279_B20210910 and classified as critical.CVE-2023-7220 · Other software · Totolink · reported by VulDBCritical 9.8
A vulnerability was found in Totolink NR1800X 9.1.0u.6279_B20210910 and classified as critical. Affected by this issue is the function loginAuth of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument password leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-249854 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- NR1800X
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2024Dataiku DSS before 11.4.5 and 12.4.1 has Incorrect Access Control that could lead to a full authentication bypass.CVE-2023-51717 · Other software · Dataiku · reported by MITRECritical 9.8
Dataiku DSS before 11.4.5 and 12.4.1 has Incorrect Access Control that could lead to a full authentication bypass.
- Product
- Data Science Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddataiku.comdoc.dataiku.com
Jan 8, 2024In Gradle Enterprise before 2023.1, a remote attacker may be able to gain access to a new installation (in certain installation scenarios) because of a non-uniqCVE-2023-49238 · Other software · Gradle · reported by MITRECritical 9.8
In Gradle Enterprise before 2023.1, a remote attacker may be able to gain access to a new installation (in certain installation scenarios) because of a non-unique initial system user password. Although this password must be changed upon the first login, it is possible that an attacker logs in before the legitimate administrator logs in.
- Product
- Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.gradle.comsecurity.gradle.com
Jan 8, 2024An issue found in NetScout nGeniusOne v.6.3.4 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafted file.CVE-2023-26999 · Other software · Netscout · reported by MITRECritical 9.8
An issue found in NetScout nGeniusOne v.6.3.4 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafted file.
- Product
- Ngeniusone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpiotrryciak.compiotrryciak.com
Jan 8, 2024Azure uAMQP is a general purpose C library for AMQP 1.0.CVE-2024-21646 · Other software · Azure · reported by GitHubCritical 9.8
Azure uAMQP is a general purpose C library for AMQP 1.0. The UAMQP library is used by several clients to implement AMQP protocol communication. When clients using this library receive a crafted binary type data, an integer overflow or wraparound or memory safety issue can occur and may cause remote code execution. This vulnerability has been patched in release 2024-01-01.
- Product
- azure-uamqp-c
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2024An issue in Evernote Evernote for MacOS v.10.68.2 allows a remote attacker to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments componeCVE-2023-50643 · Other software · Evernote · reported by MITRECritical 9.8
An issue in Evernote Evernote for MacOS v.10.68.2 allows a remote attacker to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments components.
- Product
- Evernote
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comelectronjs.org
Jan 8, 2024Discord-Recon is a Discord bot created to automate bug bounty recon, automated scans and information gathering via a discord server.CVE-2024-21663 · Other software · DEMON1A · reported by GitHubCritical 9.9
Discord-Recon is a Discord bot created to automate bug bounty recon, automated scans and information gathering via a discord server. Discord-Recon is vulnerable to remote code execution. An attacker is able to execute shell commands in the server without having an admin role. This vulnerability has been fixed in version 0.0.8.
- Product
- Discord-Recon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2024HTML5 MP3 Player with Folder Feedburner Playlist Free: Deserialization of Untrusted DataCVE-2023-52202 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Deserialization of Untrusted Data vulnerability in SVNLabs Softwares HTML5 MP3 Player with Folder Feedburner Playlist Free.This issue affects HTML5 MP3 Player with Folder Feedburner Playlist Free: from n/a through 2.8.0.
- Product
- HTML5 MP3 Player with Folder Feedburner Playlist Free
- Affected
- up to 2.8.0
- What to do
- Affects up to 2.8.0. Update HTML5 MP3 Player with Folder Feedburner Playlist Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 8, 2024HTML5 SoundCloud Player with Playlist Free: Deserialization of Untrusted DataCVE-2023-52205 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Deserialization of Untrusted Data vulnerability in SVNLabs Softwares HTML5 SoundCloud Player with Playlist Free.This issue affects HTML5 SoundCloud Player with Playlist Free: from n/a through 2.8.0.
- Product
- HTML5 SoundCloud Player with Playlist Free
- Affected
- up to 2.8.0
- What to do
- Affects up to 2.8.0. Update HTML5 SoundCloud Player with Playlist Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 8, 2024Cross-Site Request Forgery (CSRF), Deserialization of Untrusted Data vulnerability in Repute Infosystems ARMember – Membership Plugin, Content Restriction, MembCVE-2023-52200 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Cross-Site Request Forgery (CSRF), Deserialization of Untrusted Data vulnerability in Repute Infosystems ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup.This issue affects ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup: n/a.
- Affected
- up to 4.0.22
- What to do
- Affects up to 4.0.22. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 8, 2024Stud.IP 5.x through 5.3.3 allows XSS with resultant upload of executable files, because upload_action and edit_action in Admin_SmileysController do not check thCVE-2023-50982 · Other software · Studip · reported by MITRECritical 9
Stud.IP 5.x through 5.3.3 allows XSS with resultant upload of executable files, because upload_action and edit_action in Admin_SmileysController do not check the file extension. This leads to remote code execution with the privileges of the www-data user. The fixed versions are 5.3.4, 5.2.6, 5.1.7, and 5.0.9.
- Product
- Stud.ip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.studip.derehmeinfosec.de
Jan 8, 2024HTML5 MP3 Player with Playlist Free: Deserialization of Untrusted DataCVE-2023-52207 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Deserialization of Untrusted Data vulnerability in SVNLabs Softwares HTML5 MP3 Player with Playlist Free.This issue affects HTML5 MP3 Player with Playlist Free: from n/a through 3.0.0.
- Product
- HTML5 MP3 Player with Playlist Free
- Affected
- up to 3.0.0
- What to do
- Affects up to 3.0.0. Update HTML5 MP3 Player with Playlist Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 8, 2024Duplicator: Does not properly escape valuesCVE-2018-25095 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Duplicator WordPress plugin before 1.3.0 does not properly escape values when its installer script replaces values in WordPress configuration files. If this installer script is left on the site after use, it could be use to run arbitrary code on the server.
- Product
- Duplicator
- Fixed in
- 1.3.0
- What to do
- Update Duplicator to 1.3.0 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.