Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
5,661 results · page 42 of 114
Jan 30, 2025A specific authentication strategy allows to learn ids of PAM users associated with certain authentication types.CVE-2025-24506 · Other software · Broadcom · reported by secure@symantec.comMedium 5.3
A specific authentication strategy allows to learn ids of PAM users associated with certain authentication types.
- Product
- Symantec Privileged Access Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2025This vulnerability allows a high-privileged authenticated PAM user to achieve remote command execution on the affected PAM system by uploading a specially craftCVE-2025-24505 · Other software · Broadcom · reported by secure@symantec.comHigh 8.8
This vulnerability allows a high-privileged authenticated PAM user to achieve remote command execution on the affected PAM system by uploading a specially crafted upgrade file.
- Product
- Symantec Privileged Access Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2025An improper input validation the CSRF filter results in unsanitized user input written to the application logs.CVE-2025-24504 · Other software · Broadcom · reported by secure@symantec.comMedium 5.3
An improper input validation the CSRF filter results in unsanitized user input written to the application logs.
- Product
- Symantec Privileged Access Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2025A malicious actor can fix the session of a PAM user by tricking the user to click on a specially crafted link to the PAM server.CVE-2025-24503 · Other software · Broadcom · reported by secure@symantec.comCritical 9.3
A malicious actor can fix the session of a PAM user by tricking the user to click on a specially crafted link to the PAM server.
- Product
- Symantec Privileged Access Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2025An improper session validation allows an unauthenticated attacker to cause certain request notifications to be executed in the context of an incorrect user by sCVE-2025-24502 · Other software · Broadcom · reported by secure@symantec.comMedium 5.3
An improper session validation allows an unauthenticated attacker to cause certain request notifications to be executed in the context of an incorrect user by spoofing the client IP address.
- Product
- Symantec Privileged Access Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2025An improper input validation allows an unauthenticated attacker to alter PAM logs by sending a specially crafted HTTP request.CVE-2025-24501 · Other software · Broadcom · reported by secure@symantec.comMedium 5.3
An improper input validation allows an unauthenticated attacker to alter PAM logs by sending a specially crafted HTTP request.
- Product
- Symantec Privileged Access Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2025The vulnerability allows an unauthenticated attacker to access information in PAM database.CVE-2025-24500 · Other software · Broadcom · reported by secure@symantec.comHigh 8.7
The vulnerability allows an unauthenticated attacker to access information in PAM database.
- Product
- Symantec Privileged Access Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2025A reflected cross-site scripting (XSS) vulnerability in Audemium ERP <=0.9.0 allows remote attackers to execute an arbitrary JavaScript payload in the web browsCVE-2025-22917 · Other software · reported by MITREMedium 5.4
A reflected cross-site scripting (XSS) vulnerability in Audemium ERP <=0.9.0 allows remote attackers to execute an arbitrary JavaScript payload in the web browser of a user by including a malicious payload into the 'type' parameter of list.php.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2025IBM Common Licensing 9.0 could allow an authenticated user to modify a configuration file that they should not have access to due to a broken authorization mecCVE-2023-50946 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM Common Licensing 9.0 could allow an authenticated user to modify a configuration file that they should not have access to due to a broken authorization mechanism.
- Product
- Common Licensing
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 25, 2025IBM Analytics Content Hub 2.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser.CVE-2024-35134 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM Analytics Content Hub 2.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.
- Product
- Analytics Content Hub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 25, 2025IBM Control Center 6.2.1 and 6.3.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browCVE-2024-35111 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM Control Center 6.2.1 and 6.3.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.
- Product
- Control Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 25, 2025brodos.net Onlineshop: Stored Cross-Site ScriptingCVE-2024-12529 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The brodos.net Onlineshop Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'BrodosCategory' shortcode in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- brodos.net Onlineshop
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update brodos.net Onlineshop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 25, 2025Broadstreet: Stored Cross-Site ScriptingCVE-2024-11825 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Broadstreet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘zone’ parameter in all versions up to, and including, 1.51.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Broadstreet
- Affected
- up to 1.51.0
- What to do
- Affects up to 1.51.0. Update Broadstreet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 23, 2025WP Social Broadcast: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23545 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Navnish Bhardwaj WP Social Broadcast wp-social-broadcast allows Reflected XSS.This issue affects WP Social Broadcast: from n/a through <= 1.0.0.
- Product
- WP Social Broadcast
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update WP Social Broadcast to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2025Broadcast Live Video – Live Streaming : HTML5, WebRTC, HLS, RTSP, RTMP: Stored Cross-Site ScriptingCVE-2024-12504 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Broadcast Live Video – Live Streaming : HTML5, WebRTC, HLS, RTSP, RTMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'videowhisper_hls' shortcode in all versions up to, and including, 6.1.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Broadcast Live Video – Live Streaming : HTML5, WebRTC, HLS, RTSP, RTMP
- Affected
- up to 6.1.9
- What to do
- Affects up to 6.1.9. Update Broadcast Live Video – Live Streaming : HTML5, WebRTC, HLS, RTSP, RTMP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 22, 2025Jenkins Eiffel Broadcaster Plugin 2.8.0 through 2.10.2 (both inclusive) uses the credential ID as the cache key during signing operations, allowing attackers abCVE-2025-24400 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
Jenkins Eiffel Broadcaster Plugin 2.8.0 through 2.10.2 (both inclusive) uses the credential ID as the cache key during signing operations, allowing attackers able to create a credential with the same ID as a legitimate one in a different credentials store to sign an event published to RabbitMQ with the legitimate credentials.
- Product
- Jenkins Eiffel Broadcaster Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2025A vulnerability in the SIP processing subsystem of Cisco BroadWorks could allow an unauthenticated, remote attacker to halt the processing of incoming SIP requeCVE-2025-20165 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.5
A vulnerability in the SIP processing subsystem of Cisco BroadWorks could allow an unauthenticated, remote attacker to halt the processing of incoming SIP requests, resulting in a denial of service (DoS) condition. This vulnerability is due to improper memory handling for certain SIP requests. An attacker could exploit this vulnerability by sending a high number of SIP requests to an affected system. A successful exploit could allow the attacker to exhaust the memory that was allocated to the Cisco BroadWorks Network Servers that handle SIP traffic. If no memory is available, the Network Servers can no longer process incoming requests, resulting in a DoS condition that requires manual intervention to recover.
- Product
- Cisco BroadWorks
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.clamav.netsec.cloudapps.cisco.com
Jan 22, 2025Smallerik File Browser: Unrestricted Upload of File with Dangerous TypeCVE-2025-23918 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in Enrico Sandoli Smallerik File Browser smallerik-file-browser allows Upload a Web Shell to a Web Server.This issue affects Smallerik File Browser: from n/a through <= 1.1.
- Product
- Smallerik File Browser
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Smallerik File Browser to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 21, 2025The mqlink.elf is service component in Ruijie RG-EW300N with firmware ReyeeOS 1.300.1422 is vulnerable to Remote Code Execution via a modified MQTT broker messaCVE-2024-42936 · Other software · Ruijie · reported by MITRECritical 9.8
The mqlink.elf is service component in Ruijie RG-EW300N with firmware ReyeeOS 1.300.1422 is vulnerable to Remote Code Execution via a modified MQTT broker message.
- Product
- Reyee OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2025On most desktop platforms, Brave Browser versions 1.70.x-1.73.x included a feature to show a site's origin on the OS-provided file selector dialog when a site pCVE-2025-23086 · Other software · Brave · reported by support@hackerone.comMedium 6.1
On most desktop platforms, Brave Browser versions 1.70.x-1.73.x included a feature to show a site's origin on the OS-provided file selector dialog when a site prompts the user to upload or download a file. However the origin was not correctly inferred in some cases. When combined with an open redirector vulnerability on a trusted site, this could allow a malicious site to initiate a download whose origin in the file select dialog appears as the trusted site which initiated the redirect.
- Product
- Desktop Browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2025A Broken Object Level Authorization (BOLA) vulnerability in Indico through 3.3.5 allows attackers to read information by sending a crafted POST request to the cCVE-2024-50633 · Other software · CERN · reported by MITRENone
A Broken Object Level Authorization (BOLA) vulnerability in Indico through 3.3.5 allows attackers to read information by sending a crafted POST request to the component /api/principals. NOTE: this is disputed by the Supplier because the product intentionally lets all users retrieve certain information about other user accounts (this functionality is, in the current design, not restricted to any privileged roles such as event organizer).
- Product
- Indico
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2025A “Use of a Broken or Risky Cryptographic Algorithm” vulnerability in the SSL/TLS component used in B&R Automation Runtime versions before 6.1 and B&R mapp ViewCVE-2024-8603 · Other software · B&R Industrial Automation · reported by cybersecurity@ch.abb.comHigh 8.2
A “Use of a Broken or Risky Cryptographic Algorithm” vulnerability in the SSL/TLS component used in B&R Automation Runtime versions before 6.1 and B&R mapp View versions before 6.1 may be abused by unauthenticated network-based attackers to masquerade as services on impacted devices.
- Product
- Automation Runtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2025A potential buffer overflow vulnerability was reported in PC Manager, Lenovo Browser, and Lenovo App Store that could allow a local attacker to cause a system cCVE-2024-10254 · Other software · Lenovo · reported by psirt@lenovo.comMedium 4.7
A potential buffer overflow vulnerability was reported in PC Manager, Lenovo Browser, and Lenovo App Store that could allow a local attacker to cause a system crash.
- Product
- PC Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2025A potential TOCTOU vulnerability was reported in PC Manager, Lenovo Browser, and Lenovo App Store that could allow a local attacker to cause a system crash.CVE-2024-10253 · Other software · Lenovo · reported by psirt@lenovo.comMedium 4.7
A potential TOCTOU vulnerability was reported in PC Manager, Lenovo Browser, and Lenovo App Store that could allow a local attacker to cause a system crash.
- Product
- PC Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2025Microsoft Brokering File System Elevation of Privilege VulnerabilityCVE-2025-21372 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Brokering File System Elevation of Privilege Vulnerability
- Product
- Windows 11 Version 24H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2025Microsoft Brokering File System Elevation of Privilege VulnerabilityCVE-2025-21315 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Brokering File System Elevation of Privilege Vulnerability
- Product
- Windows 11 Version 24H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2025Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP store user input in the local browser storage to improve usability.CVE-2025-0059 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6
Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP store user input in the local browser storage to improve usability. An attacker with administrative privileges or access to the victim�s user directory on the Operating System level would be able to read this data. Depending on the user input provided in transactions, the disclosed data could range from non-critical data to highly sensitive data, causing high impact on confidentiality of the application.
- Product
- SAP NetWeaver Application Server ABAP (applications based on SAP GUI for HTML)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2025HCL MyXalytics is affected by broken authentication.CVE-2024-42172 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.3
HCL MyXalytics is affected by broken authentication. It allows attackers to compromise keys, passwords, and session tokens, potentially leading to identity theft and system control. This vulnerability arises from poor configuration, logic errors, or software bugs and can affect any application with access control, including databases, network infrastructure, and web applications.
- Product
- DRYiCE MyXalytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Jan 10, 2025Atheos is a self-hosted browser-based cloud IDE.CVE-2025-22152 · Other software · Atheos · reported by GitHubCritical 9.4
Atheos is a self-hosted browser-based cloud IDE. Prior to v600, the $path and $target parameters are not properly validated across multiple components, allowing an attacker to read, modify, or execute arbitrary files on the server. These vulnerabilities can be exploited through various attack vectors present in multiple PHP files. This vulnerability is fixed in v600.
- Product
- Atheos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2025Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 11.8.0 before 12.3.10, from 12.4.0 beforCVE-2024-13312 · Websites & servers · Drupal · reported by mlhess@drupal.orgMedium 5.3
Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 11.8.0 before 12.3.10, from 12.4.0 before 12.4.9.
- Product
- Open Social
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2025Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Browser Back Button allows Cross-Site Scripting (XSCVE-2024-13308 · Websites & servers · Drupal · reported by mlhess@drupal.orgLow 3.8
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Browser Back Button allows Cross-Site Scripting (XSS).This issue affects Browser Back Button: from 1.0.0 before 2.0.2.
- Product
- Browser Back Button
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2025Missing Authorization vulnerability in Drupal Download All Files allows Forceful Browsing.This issue affects Download All Files: from 0.0.0 before 2.0.2.CVE-2024-13303 · Websites & servers · Drupal · reported by mlhess@drupal.orgMedium 5.3
Missing Authorization vulnerability in Drupal Download All Files allows Forceful Browsing.This issue affects Download All Files: from 0.0.0 before 2.0.2.
- Product
- Download All Files
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2025Incorrect Authorization vulnerability in Drupal Pages Restriction Access allows Forceful Browsing.This issue affects Pages Restriction Access: from 2.0.0 beforeCVE-2024-13302 · Websites & servers · Drupal · reported by mlhess@drupal.orgMedium 5.3
Incorrect Authorization vulnerability in Drupal Pages Restriction Access allows Forceful Browsing.This issue affects Pages Restriction Access: from 2.0.0 before 2.0.3.
- Product
- Pages Restriction Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2025Incorrect Authorization vulnerability in Drupal Basic HTTP Authentication allows Forceful Browsing.This issue affects Basic HTTP Authentication: from 7.X-1.0 beCVE-2024-13291 · Websites & servers · Drupal · reported by mlhess@drupal.orgHigh 7.3
Incorrect Authorization vulnerability in Drupal Basic HTTP Authentication allows Forceful Browsing.This issue affects Basic HTTP Authentication: from 7.X-1.0 before 7.X-1.4.
- Product
- Basic HTTP Authentication
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2025Incorrect Authorization vulnerability in Drupal OhDear Integration allows Forceful Browsing.This issue affects OhDear Integration: from 0.0.0 before 2.0.4.CVE-2024-13290 · Websites & servers · Drupal · reported by mlhess@drupal.orgMedium 5.3
Incorrect Authorization vulnerability in Drupal OhDear Integration allows Forceful Browsing.This issue affects OhDear Integration: from 0.0.0 before 2.0.4.
- Product
- OhDear Integration
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2025Canlineapp Online 1.1 is vulnerable to Broken Access Control and allows users with the Auditor role to create an audit template as a result of improper authorizCVE-2024-56114 · Other software · Henkel · reported by MITREMedium 6.5
Canlineapp Online 1.1 is vulnerable to Broken Access Control and allows users with the Auditor role to create an audit template as a result of improper authorization checks. This feature is designated for supervisor role, but auditors have been able to successfully create audit templates from their account.
- Product
- Canlineapp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.come-connectsolutions.com
Jan 9, 2025Incorrect Authorization vulnerability in Drupal Block permissions allows Forceful Browsing.This issue affects Block permissions: from 1.0.0 before 1.2.0.CVE-2024-13282 · Websites & servers · Drupal · reported by mlhess@drupal.orgHigh 8.8
Incorrect Authorization vulnerability in Drupal Block permissions allows Forceful Browsing.This issue affects Block permissions: from 1.0.0 before 1.2.0.
- Product
- Block permissions
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2025Incorrect Authorization vulnerability in Drupal Monster Menus allows Forceful Browsing.This issue affects Monster Menus: from 0.0.0 before 9.3.2.CVE-2024-13281 · Websites & servers · Drupal · reported by mlhess@drupal.orgCritical 9.1
Incorrect Authorization vulnerability in Drupal Monster Menus allows Forceful Browsing.This issue affects Monster Menus: from 0.0.0 before 9.3.2.
- Product
- Monster Menus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2025Insufficient Session Expiration vulnerability in Drupal Persistent Login allows Forceful Browsing.This issue affects Persistent Login: from 0.0.0 before 1.8.0, CVE-2024-13280 · Websites & servers · Drupal · reported by mlhess@drupal.orgCritical 9.8
Insufficient Session Expiration vulnerability in Drupal Persistent Login allows Forceful Browsing.This issue affects Persistent Login: from 0.0.0 before 1.8.0, from 2.0.* before 2.2.2.
- Product
- Persistent Login
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2025Incorrect Authorization vulnerability in Drupal Smart IP Ban allows Forceful Browsing.This issue affects Smart IP Ban: from 7.X-1.0 before 7.X-1.1.CVE-2024-13277 · Websites & servers · Drupal · reported by mlhess@drupal.orgCritical 9.1
Incorrect Authorization vulnerability in Drupal Smart IP Ban allows Forceful Browsing.This issue affects Smart IP Ban: from 7.X-1.0 before 7.X-1.1.
- Product
- Smart IP Ban
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2025Insertion of Sensitive Information Into Sent Data vulnerability in Drupal File Entity (fieldable files) allows Forceful Browsing.This issue affects File Entity CVE-2024-13276 · Websites & servers · Drupal · reported by mlhess@drupal.orgHigh 7.5
Insertion of Sensitive Information Into Sent Data vulnerability in Drupal File Entity (fieldable files) allows Forceful Browsing.This issue affects File Entity (fieldable files): from 7.X-* before 7.X-2.39.
- Product
- File Entity (fieldable files)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2025Incorrect Authorization vulnerability in Drupal Content Entity Clone allows Forceful Browsing.This issue affects Content Entity Clone: from 0.0.0 before 1.0.4.CVE-2024-13271 · Websites & servers · Drupal · reported by mlhess@drupal.orgMedium 4.3
Incorrect Authorization vulnerability in Drupal Content Entity Clone allows Forceful Browsing.This issue affects Content Entity Clone: from 0.0.0 before 1.0.4.
- Product
- Content Entity Clone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2025Incorrect Authorization vulnerability in Drupal Freelinking allows Forceful Browsing.This issue affects Freelinking: from 0.0.0 before 4.0.1.CVE-2024-13270 · Websites & servers · Drupal · reported by mlhess@drupal.orgMedium 4.3
Incorrect Authorization vulnerability in Drupal Freelinking allows Forceful Browsing.This issue affects Freelinking: from 0.0.0 before 4.0.1.
- Product
- Freelinking
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2025Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Advanced Varnish allows Forceful Browsing.This issue affects Advanced Varnish: from 0.CVE-2024-13269 · Websites & servers · Drupal · reported by mlhess@drupal.orgMedium 5.3
Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Advanced Varnish allows Forceful Browsing.This issue affects Advanced Varnish: from 0.0.0 before 4.0.11.
- Product
- Advanced Varnish
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2025Incorrect Authorization vulnerability in Drupal Responsive and off-canvas menu allows Forceful Browsing.This issue affects Responsive and off-canvas menu: from CVE-2024-13266 · Websites & servers · Drupal · reported by mlhess@drupal.orgMedium 5.3
Incorrect Authorization vulnerability in Drupal Responsive and off-canvas menu allows Forceful Browsing.This issue affects Responsive and off-canvas menu: from 0.0.0 before 4.4.4.
- Product
- Responsive and off-canvas menu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2025Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Image Sizes allows Forceful Browsing.This issue affects Image Sizes: from 0.0.0 beforeCVE-2024-13259 · Websites & servers · Drupal · reported by mlhess@drupal.orgHigh 7.5
Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Image Sizes allows Forceful Browsing.This issue affects Image Sizes: from 0.0.0 before 3.0.2.
- Product
- Image Sizes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2025Incorrect Authorization vulnerability in Drupal Drupal REST & JSON API Authentication allows Forceful Browsing.This issue affects Drupal REST & JSON API AuthentCVE-2024-13258 · Websites & servers · Drupal · reported by mlhess@drupal.orgCritical 9.8
Incorrect Authorization vulnerability in Drupal Drupal REST & JSON API Authentication allows Forceful Browsing.This issue affects Drupal REST & JSON API Authentication: from 0.0.0 before 2.0.13.
- Product
- Drupal REST & JSON API Authentication
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2025Incorrect Authorization vulnerability in Drupal Commerce View Receipt allows Forceful Browsing.This issue affects Commerce View Receipt: from 0.0.0 before 1.0.3CVE-2024-13257 · Websites & servers · Drupal · reported by mlhess@drupal.orgMedium 5.3
Incorrect Authorization vulnerability in Drupal Commerce View Receipt allows Forceful Browsing.This issue affects Commerce View Receipt: from 0.0.0 before 1.0.3.
- Product
- Commerce View Receipt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2025Insufficient Granularity of Access Control vulnerability in Drupal Email Contact allows Forceful Browsing.This issue affects Email Contact: from 0.0.0 before 2.CVE-2024-13256 · Websites & servers · Drupal · reported by mlhess@drupal.orgHigh 7.5
Insufficient Granularity of Access Control vulnerability in Drupal Email Contact allows Forceful Browsing.This issue affects Email Contact: from 0.0.0 before 2.0.4.
- Product
- Email Contact
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2025Exposure of Sensitive Information Through Data Queries vulnerability in Drupal RESTful Web Services allows Forceful Browsing.This issue affects RESTful Web ServCVE-2024-13255 · Websites & servers · Drupal · reported by mlhess@drupal.orgHigh 7.5
Exposure of Sensitive Information Through Data Queries vulnerability in Drupal RESTful Web Services allows Forceful Browsing.This issue affects RESTful Web Services: from 7.X-2.0 before 7.X-2.10.
- Product
- RESTful Web Services
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.