Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
650 results · page 4 of 13
Feb 27, 2025The MongoDB Shell may be susceptible to control character injection where an attacker with control of the mongosh autocomplete feature, can use the autocompletiCVE-2025-1691 · Other software · MongoDB Inc · reported by cna@mongodb.comHigh 7.6
The MongoDB Shell may be susceptible to control character injection where an attacker with control of the mongosh autocomplete feature, can use the autocompletion feature to input and run obfuscated malicious text. This requires user interaction in the form of the user using ‘tab’ to autocomplete text that is a prefix of the attacker’s prepared autocompletion. This issue affects mongosh versions prior to 2.3.9. The vulnerability is exploitable only when mongosh is connected to a cluster that is partially or fully controlled by an attacker.
- Product
- mongosh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2025Autoship Cloud for WooCommerce Subscription Products: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26878 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in patternsinthecloud Autoship Cloud for WooCommerce Subscription Products autoship-cloud allows DOM-Based XSS.This issue affects Autoship Cloud for WooCommerce Subscription Products: from n/a through <= 2.8.0.1.
- Product
- Autoship Cloud for WooCommerce Subscription Products
- Affected
- up to 2.8.0.1
- What to do
- Affects up to 2.8.0.1. Update Autoship Cloud for WooCommerce Subscription Products to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 21, 2025Autoship Cloud for WooCommerce Subscription Products: Stored Cross-Site ScriptingCVE-2024-13461 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Autoship Cloud for WooCommerce Subscription Products plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'autoship-create-scheduled-order-action' shortcode in all versions up to, and including, 2.8.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Autoship Cloud for WooCommerce Subscription Products
- Affected
- up to 2.8.0
- What to do
- Affects up to 2.8.0. Update Autoship Cloud for WooCommerce Subscription Products to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 16, 2025Oshine Modules: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-44044 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brandexponents Oshine Modules oshine-modules allows Reflected XSS.This issue affects Oshine Modules: from n/a through < 3.3.8.
- Product
- Oshine Modules
- What to do
- Update Oshine Modules to the newest version.
Feb 11, 2025Photoshop Elements versions 2025.0 and earlier are affected by a Creation of Temporary File in Directory with Incorrect Permissions vulnerability that could resCVE-2025-21162 · Other software · Adobe · reported by AdobeMedium 5.5
Photoshop Elements versions 2025.0 and earlier are affected by a Creation of Temporary File in Directory with Incorrect Permissions vulnerability that could result in privilege escalation in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Photoshop Elements
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 31, 2025Oshine Modules: Server-Side Request Forgery (SSRF)CVE-2024-44055 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Server-Side Request Forgery (SSRF) vulnerability in brandexponents Oshine Modules oshine-modules.This issue affects Oshine Modules: from n/a through < 3.3.8.
- Product
- Oshine Modules
- What to do
- Update Oshine Modules to the newest version.
Jan 27, 2025Shipping for Nova Poshta: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-24612 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ihor Kit Shipping for Nova Poshta nova-poshta-ttn allows SQL Injection.This issue affects Shipping for Nova Poshta: from n/a through <= 1.19.6.
- Product
- Shipping for Nova Poshta
- Affected
- up to 1.19.6
- What to do
- Affects up to 1.19.6. Update Shipping for Nova Poshta to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025InnoShop V.0.3.8 and below is vulnerable to Cross Site Scripting (XSS) via SVG file upload.CVE-2024-57277 · Other software · reported by MITREMedium 5.7
InnoShop V.0.3.8 and below is vulnerable to Cross Site Scripting (XSS) via SVG file upload.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2025Photoshop Desktop versions 25.12, 26.1 and earlier are affected by an Uncontrolled Search Path Element vulnerability that could lead to arbitrary code executionCVE-2025-21127 · Other software · Adobe · reported by AdobeHigh 7.8
Photoshop Desktop versions 25.12, 26.1 and earlier are affected by an Uncontrolled Search Path Element vulnerability that could lead to arbitrary code execution. An attacker could manipulate the search path environment variable to point to a malicious library, resulting in the execution of arbitrary code when the application loads. Exploitation of this issue requires user interaction in that a victim must run the vulnerable application.
- Product
- Photoshop Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2025Photoshop Desktop versions 25.12, 26.1 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code eCVE-2025-21122 · Other software · Adobe · reported by AdobeHigh 7.8
Photoshop Desktop versions 25.12, 26.1 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Photoshop Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025Saoshyant Page Builder: Missing AuthorizationCVE-2025-22560 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in saoshyant1994 Saoshyant Page Builder saoshyant-page-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Saoshyant Page Builder: from n/a through <= 3.8.
- Product
- Saoshyant Page Builder
- Affected
- up to 3.8
- What to do
- Affects up to 3.8. Update Saoshyant Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Woo Ukrposhta: Reflected Cross-Site ScriptingCVE-2024-12049 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Woo Ukrposhta plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'order', 'post', and 'idd' parameters in all versions up to, and including, 1.17.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Woo Ukrposhta
- Affected
- up to 1.17.11
- What to do
- Affects up to 1.17.11. Update Woo Ukrposhta to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Jan 1, 2025Huang Yaoshi Pharmaceutical Management Software through 16.0 allows arbitrary file upload via a .asp filename in the fileName element of the UploadFile element CVE-2024-56829 · Other software · reported by MITRECritical 10
Huang Yaoshi Pharmaceutical Management Software through 16.0 allows arbitrary file upload via a .asp filename in the fileName element of the UploadFile element in a SOAP request to /XSDService.asmx.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2024Saoshyant Element: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51646 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in saoshyant1994 Saoshyant Element saoshyant-element allows Reflected XSS.This issue affects Saoshyant Element: from n/a through <= 1.2.
- Product
- Saoshyant Element
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Saoshyant Element to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 10, 2024Photoshop Desktop versions 26.0 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the cCVE-2024-52997 · Other software · Adobe · reported by AdobeHigh 7.8
Photoshop Desktop versions 26.0 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Photoshop Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 26, 2024Out-of-bounds read vulnerability exists in Sharp Corporation and Toshiba Tec Corporation multiple MFPs (multifunction printers), which may lead to a denial-of-sCVE-2024-36254 · Other software · Sharp Corporation · reported by vultures@jpcert.or.jpHigh 7.5
Out-of-bounds read vulnerability exists in Sharp Corporation and Toshiba Tec Corporation multiple MFPs (multifunction printers), which may lead to a denial-of-service (DoS) condition.
- Product
- Multiple MFPs (multifunction printers)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 26, 2024Cross-site scripting vulnerability exists in Sharp Corporation and Toshiba Tech Corporation multiple MFPs (multifunction printers).CVE-2024-36249 · Other software · Sharp Corporation · reported by vultures@jpcert.or.jpHigh 7.4
Cross-site scripting vulnerability exists in Sharp Corporation and Toshiba Tech Corporation multiple MFPs (multifunction printers). If this vulnerability is exploited, an arbitrary script may be executed on the administrative page of the affected MFPs. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].
- Product
- Multiple MFPs (multifunction printers)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2024Jigoshop – Store Exporter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50519 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Josh Kohlbach Jigoshop – Store Exporter jigoshop-exporter allows Reflected XSS.This issue affects Jigoshop – Store Exporter: from n/a through <= 1.5.8.
- Product
- Jigoshop – Store Exporter
- Affected
- up to 1.5.8
- What to do
- Affects up to 1.5.8. Update Jigoshop – Store Exporter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 12, 2024Photoshop Desktop versions 24.7.3, 25.11 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary codeCVE-2024-49514 · Other software · Adobe · reported by AdobeHigh 7.8
Photoshop Desktop versions 24.7.3, 25.11 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Photoshop Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2024Jigoshop – Store Toolkit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51712 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michael Visser Jigoshop – Store Toolkit jigoshop-store-toolkit allows Reflected XSS.This issue affects Jigoshop – Store Toolkit: from n/a through <= 1.4.0.
- Product
- Jigoshop – Store Toolkit
- Affected
- up to 1.4.0
- What to do
- Affects up to 1.4.0. Update Jigoshop – Store Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 25, 2024Sharp and Toshiba Tec MFPs improperly validate input data in URI data registration, resulting in a stored cross-site scripting vulnerability.CVE-2024-48870 · Other software · Toshiba Tec Corporation · reported by vultures@jpcert.or.jpMedium 6.2
Sharp and Toshiba Tec MFPs improperly validate input data in URI data registration, resulting in a stored cross-site scripting vulnerability. If crafted input is stored by an administrative user, malicious script may be executed on the web browsers of other victim users.
- Product
- e-STUDIO 908
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2024Sharp and Toshiba Tec MFPs improperly process query parameters in HTTP requests, resulting in a reflected cross-site scripting vulnerability.CVE-2024-47801 · Other software · Sharp Corporation · reported by vultures@jpcert.or.jpHigh 7.4
Sharp and Toshiba Tec MFPs improperly process query parameters in HTTP requests, resulting in a reflected cross-site scripting vulnerability. Accessing a crafted URL which points to an affected product may cause malicious script executed on the web browser.
- Product
- Sharp Digital Full-color MFPs and Monochrome MFPs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2024Sharp and Toshiba Tec MFPs improperly process query parameters in HTTP requests, which may allow contamination of unintended data to HTTP response headers.CVE-2024-47549 · Other software · Sharp Corporation · reported by vultures@jpcert.or.jpHigh 7.4
Sharp and Toshiba Tec MFPs improperly process query parameters in HTTP requests, which may allow contamination of unintended data to HTTP response headers. Accessing a crafted URL which points to an affected product may cause malicious script executed on the web browser.
- Product
- Sharp Digital Full-color MFPs and Monochrome MFPs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2024Sharp and Toshiba Tec MFPs improperly process HTTP authentication requests, resulting in an authentication bypass vulnerability.CVE-2024-47406 · Other software · Sharp Corporation · reported by vultures@jpcert.or.jpCritical 9.1
Sharp and Toshiba Tec MFPs improperly process HTTP authentication requests, resulting in an authentication bypass vulnerability.
- Product
- Sharp Digital Full-color MFPs and Monochrome MFPs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2024Sharp and Toshiba Tec MFPs provide configuration related APIs.CVE-2024-47005 · Other software · Sharp Corporation · reported by vultures@jpcert.or.jpHigh 8.1
Sharp and Toshiba Tec MFPs provide configuration related APIs. They are expected to be called by administrative users only, but insufficiently restricted. A non-administrative user may execute some configuration APIs.
- Product
- Sharp Digital Full-color MFPs and Monochrome MFPs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2024Sharp and Toshiba Tec MFPs improperly process URI data in HTTP PUT requests resulting in a path Traversal vulnerability.CVE-2024-45842 · Other software · Sharp Corporation · reported by vultures@jpcert.or.jpMedium 5.3
Sharp and Toshiba Tec MFPs improperly process URI data in HTTP PUT requests resulting in a path Traversal vulnerability. Unintended internal files may be retrieved when processing crafted HTTP requests.
- Product
- Sharp Digital Full-color MFPs and Monochrome MFPs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2024Sharp and Toshiba Tec MFPs provide the web page to download data, where query parameters in HTTP requests are improperly processed and resulting in an Out-of-boCVE-2024-45829 · Other software · Sharp Corporation · reported by vultures@jpcert.or.jpMedium 4.9
Sharp and Toshiba Tec MFPs provide the web page to download data, where query parameters in HTTP requests are improperly processed and resulting in an Out-of-bounds Read vulnerability. Crafted HTTP requests may cause affected products crashed.
- Product
- Sharp Digital Full-color MFPs and Monochrome MFPs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2024Sharp and Toshiba Tec MFPs improperly process HTTP request headers, resulting in an Out-of-bounds Read vulnerability.CVE-2024-43424 · Other software · Sharp Corporation · reported by vultures@jpcert.or.jpHigh 7.5
Sharp and Toshiba Tec MFPs improperly process HTTP request headers, resulting in an Out-of-bounds Read vulnerability. Crafted HTTP requests may cause affected products crashed.
- Product
- Sharp Digital Full-color MFPs and Monochrome MFPs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2024Sharp and Toshiba Tec MFPs contain multiple Out-of-bounds Read vulnerabilities, due to improper processing of keyword search input and improper processing of SOCVE-2024-42420 · Other software · Sharp Corporation · reported by vultures@jpcert.or.jpHigh 7.5
Sharp and Toshiba Tec MFPs contain multiple Out-of-bounds Read vulnerabilities, due to improper processing of keyword search input and improper processing of SOAP messages. Crafted HTTP requests may cause affected products crashed.
- Product
- Sharp Digital Full-color MFPs and Monochrome MFPs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 24, 2024Incorrect access control in Shenzhen Tuoshi Network Communications Co.,Ltd 5G CPE Router NR500-EA RG500UEAABxCOMSLICv3.2.2543.12.18 allows attackers to access tCVE-2024-48442 · Other software · tuoshi · reported by MITREMedium 6.5
Incorrect access control in Shenzhen Tuoshi Network Communications Co.,Ltd 5G CPE Router NR500-EA RG500UEAABxCOMSLICv3.2.2543.12.18 allows attackers to access the SSH protocol without authentication.
- Product
- 5g_cpe_router_nr500-ea_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 24, 2024Shenzhen Tuoshi Network Communications Co.,Ltd 5G CPE Router NR500-EA RG500UEAABxCOMSLICv3.2.2543.12.18 was discovered to contain a command injection vulnerabilCVE-2024-48440 · Other software · tuoshi · reported by MITREHigh 8.8
Shenzhen Tuoshi Network Communications Co.,Ltd 5G CPE Router NR500-EA RG500UEAABxCOMSLICv3.2.2543.12.18 was discovered to contain a command injection vulnerability via the component at_command.asp.
- Product
- 5g_cpe_router_nr500-ea_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2024Photoshop Desktop versions 24.7.4, 25.11 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the cCVE-2024-45109 · Other software · Adobe · reported by AdobeHigh 7.8
Photoshop Desktop versions 24.7.4, 25.11 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Photoshop Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2024Photoshop Desktop versions 24.7.4, 25.11 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the cCVE-2024-45108 · Other software · Adobe · reported by AdobeHigh 7.8
Photoshop Desktop versions 24.7.4, 25.11 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Photoshop Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2024Photoshop Desktop versions 24.7.4, 25.11 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the cCVE-2024-43760 · Other software · Adobe · reported by AdobeHigh 7.8
Photoshop Desktop versions 24.7.4, 25.11 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Photoshop Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2024Photoshop Desktop versions 24.7.4, 25.11 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution inCVE-2024-43756 · Other software · Adobe · reported by AdobeHigh 7.8
Photoshop Desktop versions 24.7.4, 25.11 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Photoshop Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2024Photoshop Desktop versions 24.7.3, 25.9.1 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the contexCVE-2024-34117 · Other software · Adobe · reported by AdobeHigh 7.8
Photoshop Desktop versions 24.7.3, 25.9.1 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Photoshop Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2024Prototype Pollution in alykoshin mini-deep-assign v0.0.8 allows an attacker to execute arbitrary code or cause a Denial of Service (DoS) and cause other impactsCVE-2024-38983 · Other software · alykoshin · reported by MITRECritical 9.8
Prototype Pollution in alykoshin mini-deep-assign v0.0.8 allows an attacker to execute arbitrary code or cause a Denial of Service (DoS) and cause other impacts via the _assign() method at (/lib/index.js:91)
- Product
- mini-deep-assign
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jul 29, 2024In the Linux kernel, the following vulnerability has been resolved: platform/x86: toshiba_acpi: Fix array out-of-bounds access In order to use toshiba_dmi_quiCVE-2024-41028 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.1
In the Linux kernel, the following vulnerability has been resolved: platform/x86: toshiba_acpi: Fix array out-of-bounds access In order to use toshiba_dmi_quirks[] together with the standard DMI matching functions, it must be terminated by a empty entry. Since this entry is missing, an array out-of-bounds access occurs every time the quirk list is processed. Fix this by adding the terminating empty entry.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jul 3, 2024When deploying Cloud Foundry together with the haproxy-boshrelease and using a non default configuration, it might be possible to craft HTTP requests that bypasCVE-2024-37082 · Other software · Cloud Foundry · reported by security@vmware.comCritical 9.1
When deploying Cloud Foundry together with the haproxy-boshrelease and using a non default configuration, it might be possible to craft HTTP requests that bypass mTLS authentication to Cloud Foundry applications. You are affected if you have route-services enabled in routing-release and have configured the haproxy-boshrelease property “ha_proxy.forwarded_client_cert” to “forward_only_if_route_service”.
- Product
- haproxy-boshrelease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcloudfoundry.orgcloudfoundry.org
Jun 19, 2024In the Linux kernel, the following vulnerability has been resolved: macintosh/via-macii: Fix "BUG: sleeping function called from invalid context" The via-maciCVE-2024-38607 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: macintosh/via-macii: Fix "BUG: sleeping function called from invalid context" The via-macii ADB driver calls request_irq() after disabling hard interrupts. But disabling interrupts isn't necessary here because the VIA shift register interrupt was masked during VIA1 initialization.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jun 17, 2024alexbinary object-deep-assign 1.0.11 is vulnerable to Prototype Pollution via the extend() method of Module.deepAssign (/src/index.js)CVE-2024-36582 · Other software · alykoshin · reported by MITRECritical 9.8
alexbinary object-deep-assign 1.0.11 is vulnerable to Prototype Pollution via the extend() method of Module.deepAssign (/src/index.js)
- Product
- mini-deep-assign
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jun 14, 2024Attackers can then execute malicious files by enabling certain services of the printer via the web configuration page and elevate its privileges to root.CVE-2024-3498 · Other software · Toshiba Tec Corporation · reported by ecc0f906-8666-484c-bcf8-c3b7520a72f0High 7.8
Attackers can then execute malicious files by enabling certain services of the printer via the web configuration page and elevate its privileges to root. As for the affected products/models/versions, see the reference URL.
- Product
- Toshiba Tec e-Studio multi-function peripheral (MFP)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2024Path traversal vulnerability in the web server of the Toshiba printer enables attacker to overwrite orginal files or add new ones to the printer.CVE-2024-3497 · Other software · Toshiba Tec Corporation · reported by ecc0f906-8666-484c-bcf8-c3b7520a72f0High 8.8
Path traversal vulnerability in the web server of the Toshiba printer enables attacker to overwrite orginal files or add new ones to the printer. As for the affected products/models/versions, see the reference URL.
- Product
- Toshiba Tec e-Studio multi-function peripheral (MFP)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2024Attackers can bypass the web login authentication process to gain access to the printer's system information and upload malicious drivers to the printer.CVE-2024-3496 · Other software · Toshiba Tec Corporation · reported by ecc0f906-8666-484c-bcf8-c3b7520a72f0High 8.8
Attackers can bypass the web login authentication process to gain access to the printer's system information and upload malicious drivers to the printer. As for the affected products/models/versions, see the reference URL.
- Product
- Toshiba Tec e-Studio multi-function peripheral (MFP)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2024An attacker with admin access can install rogue applications.CVE-2024-27180 · Other software · Toshiba Tec Corporation · reported by ecc0f906-8666-484c-bcf8-c3b7520a72f0Medium 6.7
An attacker with admin access can install rogue applications. As for the affected products/models/versions, see the reference URL.
- Product
- Toshiba Tec e-Studio multi-function peripheral (MFP)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2024Admin cookies are written in clear-text in logs.CVE-2024-27179 · Other software · Toshiba Tec Corporation · reported by ecc0f906-8666-484c-bcf8-c3b7520a72f0Medium 4.7
Admin cookies are written in clear-text in logs. An attacker can retrieve them and bypass the authentication mechanism. As for the affected products/models/versions, see the reference URL.
- Product
- Toshiba Tec e-Studio multi-function peripheral (MFP)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2024An attacker can get Remote Code Execution by overwriting files.CVE-2024-27178 · Other software · Toshiba Tec Corporation · reported by ecc0f906-8666-484c-bcf8-c3b7520a72f0High 7.2
An attacker can get Remote Code Execution by overwriting files. Overwriting files is enable by falsifying file name variable. This vulnerability can be executed in combination with other vulnerabilities and difficult to execute alone. So, the CVSS score for this vulnerability alone is lower than the score listed in the "Base Score" of this vulnerability. For detail on related other vulnerabilities, please ask to the below contact point. https://www.toshibatec.com/contacts/products/ As for the affected products/models/versions, see the reference URL.
- Product
- Toshiba Tec e-Studio multi-function peripheral (MFP)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2024An attacker can get Remote Code Execution by overwriting files.CVE-2024-27177 · Other software · Toshiba Tec Corporation · reported by ecc0f906-8666-484c-bcf8-c3b7520a72f0High 7.2
An attacker can get Remote Code Execution by overwriting files. Overwriting files is enable by falsifying package name variable. This vulnerability can be executed in combination with other vulnerabilities and difficult to execute alone. So, the CVSS score for this vulnerability alone is lower than the score listed in the "Base Score" of this vulnerability. For detail on related other vulnerabilities, please ask to the below contact point. https://www.toshibatec.com/contacts/products/ As for the affected products/models/versions, see the reference URL.
- Product
- Toshiba Tec e-Studio multi-function peripheral (MFP)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2024An attacker can get Remote Code Execution by overwriting files.CVE-2024-27176 · Other software · Toshiba Tec Corporation · reported by ecc0f906-8666-484c-bcf8-c3b7520a72f0High 7.2
An attacker can get Remote Code Execution by overwriting files. Overwriting files is enable by falsifying session ID variable. This vulnerability can be executed in combination with other vulnerabilities and difficult to execute alone. So, the CVSS score for this vulnerability alone is lower than the score listed in the "Base Score" of this vulnerability. For detail on related other vulnerabilities, please ask to the below contact point. https://www.toshibatec.com/contacts/products/ As for the affected products/models/versions, see the reference URL.
- Product
- Toshiba Tec e-Studio multi-function peripheral (MFP)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2024Remote Command program allows an attacker to read any file using a Local File Inclusion vulnerability.CVE-2024-27175 · Other software · Toshiba Tec Corporation · reported by ecc0f906-8666-484c-bcf8-c3b7520a72f0Medium 4.4
Remote Command program allows an attacker to read any file using a Local File Inclusion vulnerability. An attacker can read any file on the printer. As for the affected products/models/versions, see the reference URL.
- Product
- Toshiba Tec e-Studio multi-function peripheral (MFP)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.