Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,303 results · page 48 of 87
Apr 14, 2024** DISPUTED ** A vulnerability classified as problematic has been found in Tuya SDK up to 5.0.x.CVE-2024-3764 · Other software · Tuya · reported by VulDBLow 2.7
** DISPUTED ** A vulnerability classified as problematic has been found in Tuya SDK up to 5.0.x. Affected is an unknown function of the component MQTT Packet Handler. The manipulation leads to denial of service. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. Upgrading to version 5.1.0 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-260604. NOTE: The vendor explains that a malicious actor would have to crack TLS first or use a legitimate login to initiate the attack.
- Product
- SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2024A vulnerability, which was classified as critical, has been found in cym1102 nginxWebUI up to 3.9.9.CVE-2024-3740 · Other software · cym1102 · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in cym1102 nginxWebUI up to 3.9.9. This issue affects the function exec of the file /adminPage/conf/reload. The manipulation of the argument nginxExe leads to deserialization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-260579.
- Product
- nginxWebUI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2024A vulnerability classified as critical was found in cym1102 nginxWebUI up to 3.9.9.CVE-2024-3739 · Other software · cym1102 · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in cym1102 nginxWebUI up to 3.9.9. This vulnerability affects unknown code of the file /adminPage/main/upload. The manipulation of the argument file leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-260578 is the identifier assigned to this vulnerability.
- Product
- nginxWebUI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2024A vulnerability classified as critical has been found in cym1102 nginxWebUI up to 3.9.9.CVE-2024-3738 · Other software · cym1102 · reported by VulDBHigh 7.3
A vulnerability classified as critical has been found in cym1102 nginxWebUI up to 3.9.9. This affects the function handlePath of the file /adminPage/conf/saveCmd. The manipulation of the argument nginxPath leads to improper certificate validation. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-260577 was assigned to this vulnerability.
- Product
- nginxWebUI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2024A vulnerability was found in TBK DVR-4104 and DVR-4216 up to 20240412 and classified as critical.CVE-2024-3721 · Other software · TBK · reported by VulDBMedium 6.3
A vulnerability was found in TBK DVR-4104 and DVR-4216 up to 20240412 and classified as critical. This issue affects some unknown processing of the file /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___. The manipulation of the argument mdb/mdc leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-260573 was assigned to this vulnerability.
- Product
- DVR-4104
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2024A vulnerability has been found in Tianwell Fire Intelligent Command Platform 1.1.1.1 and classified as critical.CVE-2024-3720 · Other software · Tianwell · reported by VulDBMedium 6.3
A vulnerability has been found in Tianwell Fire Intelligent Command Platform 1.1.1.1 and classified as critical. This vulnerability affects unknown code of the file /mfsNotice/page of the component API Interface. The manipulation of the argument gsdwid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-260572.
- Product
- Fire Intelligent Command Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 12, 2024A vulnerability classified as problematic has been found in Zhejiang Land Zongheng Network Technology O2OA up to 20240403.CVE-2024-3689 · Other software · Zhejiang Land Zongheng Network Technology · reported by VulDBLow 3.7
A vulnerability classified as problematic has been found in Zhejiang Land Zongheng Network Technology O2OA up to 20240403. Affected is an unknown function of the file /x_portal_assemble_surface/jaxrs/portal/list?v=8.2.3-4-43f4fe3. The manipulation leads to information disclosure. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. VDB-260478 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- O2OA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 12, 2024A vulnerability was found in bihell Dice 3.1.0 and classified as problematic.CVE-2024-3687 · Other software · bihell · reported by VulDBLow 3.5
A vulnerability was found in bihell Dice 3.1.0 and classified as problematic. Affected by this issue is some unknown functionality of the component Comment Handler. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-260474 is the identifier assigned to this vulnerability.
- Product
- Dice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 12, 2024A vulnerability has been found in DedeCMS 5.7.112-UTF8 and classified as problematic.CVE-2024-3686 · Other software · dedecms · reported by VulDBMedium 4.3
A vulnerability has been found in DedeCMS 5.7.112-UTF8 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file update_guide.php. The manipulation of the argument files leads to path traversal: '../filedir'. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-260473 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 12, 2024A vulnerability, which was classified as critical, was found in DedeCMS 5.7.112-UTF8.CVE-2024-3685 · Other software · dedecms · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, was found in DedeCMS 5.7.112-UTF8. Affected is an unknown function of the file stepselect_main.php. The manipulation of the argument ids leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-260472. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2024Advanced Classifieds & Directory Pro: Unauthorized loss of dataCVE-2024-2222 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Advanced Classifieds & Directory Pro plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the ajax_callback_delete_attachment function in all versions up to, and including, 3.0.0. This makes it possible for authenticated attackers, with subscriber access or higher, to delete arbitrary media uploads.
- Product
- Advanced Classifieds & Directory Pro
- Affected
- up to 3.0.0
- What to do
- Affects up to 3.0.0. Update Advanced Classifieds & Directory Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 9, 2024Classified Listing – Classified ads & Business Directory: Unauthorized access & modification of dataCVE-2024-1352 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized access & modification of data due to a missing capability check on the rtcl_import_location() rtcl_import_category() functions in all versions up to, and including, 3.0.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to create terms.
- Product
- Classified Listing – Classified ads & Business Directory
- Affected
- up to 3.0.4
- What to do
- Affects up to 3.0.4. Update Classified Listing – Classified ads & Business Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 9, 2024Classified Listing – Classified ads & Business Directory: Cross-Site Request ForgeryCVE-2024-1315 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.4. This is due to missing or incorrect nonce validation on the 'rtcl_update_user_account' function. This makes it possible for unauthenticated attackers to change the administrator user's password and email address via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This locks the administrator out of the site and prevents them from resetting their password, while granting the attacker access to their account.
- Product
- Classified Listing – Classified ads & Business Directory
- Affected
- up to 3.0.4
- What to do
- Affects up to 3.0.4. Update Classified Listing – Classified ads & Business Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 8, 2024A vulnerability classified as critical was found in Netentsec NS-ASG Application Security Gateway 6.3.CVE-2024-3458 · Other software · Netentsec · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in Netentsec NS-ASG Application Security Gateway 6.3. This vulnerability affects unknown code of the file /admin/add_ikev2.php. The manipulation of the argument TunnelId leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-259714 is the identifier assigned to this vulnerability.
- Product
- NS-ASG Application Security Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2024A vulnerability classified as critical has been found in Netentsec NS-ASG Application Security Gateway 6.3.CVE-2024-3457 · Other software · Netentsec · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in Netentsec NS-ASG Application Security Gateway 6.3. This affects an unknown part of the file /admin/config_ISCGroupNoCache.php. The manipulation of the argument GroupId leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-259713 was assigned to this vulnerability.
- Product
- NS-ASG Application Security Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2024A vulnerability was found in namithjawahar Wp-Insert up to 2.0.8 and classified as problematic.CVE-2014-125111 · Other software · namithjawahar · reported by VulDBLow 3.5
A vulnerability was found in namithjawahar Wp-Insert up to 2.0.8 and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 2.0.9 is able to address this issue. The name of the patch is a07b7b08084b9b85859f3968ce7fde0fd1fcbba3. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-259628.
- Product
- Wp-Insert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2024A vulnerability classified as critical was found in CP Plus Wi-Fi Camera up to 20240401.CVE-2024-3434 · Other software · CP Plus · reported by VulDBMedium 5.4
A vulnerability classified as critical was found in CP Plus Wi-Fi Camera up to 20240401. Affected by this vulnerability is an unknown functionality of the component User Management. The manipulation leads to improper authorization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259615. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Wi-Fi Camera
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
Apr 7, 2024A vulnerability classified as problematic has been found in PuneethReddyHC Event Management 1.0.CVE-2024-3433 · Other software · PuneethReddyHC · reported by VulDBLow 3.5
A vulnerability classified as problematic has been found in PuneethReddyHC Event Management 1.0. Affected is an unknown function of the file /backend/register.php. The manipulation of the argument event_id/full_name/email/mobile/college/branch leads to cross site scripting. It is possible to launch the attack remotely. VDB-259614 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Event Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comvuldb.com
Apr 7, 2024A vulnerability, which was classified as critical, has been found in kyivstarteam react-native-sms-user-consent up to 1.1.4 on Android.CVE-2021-4438 · Other software · kyivstarteam · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, has been found in kyivstarteam react-native-sms-user-consent up to 1.1.4 on Android. Affected by this issue is the function registerReceiver of the file android/src/main/java/ua/kyivstar/reactnativesmsuserconsent/SmsUserConsentModule.kt. The manipulation leads to improper export of android application components. Attacking locally is a requirement. Upgrading to version 1.1.5 is able to address this issue. The name of the patch is 5423dcb0cd3e4d573b5520a71fa08aa279e4c3c7. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-259508.
- Product
- react-native-sms-user-consent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2024A vulnerability has been found in iboss Secure Web Gateway up to 10.1 and classified as problematic.CVE-2024-3378 · Other software · iboss · reported by VulDBMedium 4.3
A vulnerability has been found in iboss Secure Web Gateway up to 10.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /login of the component Login Portal. The manipulation of the argument redirectUrl leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 10.2.0.160 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-259501 was assigned to this vulnerability.
- Product
- Secure Web Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2024A vulnerability classified as problematic was found in Xuxueli xxl-job up to 2.4.1.CVE-2024-3366 · Other software · Xuxueli · reported by VulDBLow 3.5
A vulnerability classified as problematic was found in Xuxueli xxl-job up to 2.4.1. This vulnerability affects the function deserialize of the file com/xxl/job/core/util/JdkSerializeTool.java of the component Template Handler. The manipulation leads to injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259480.
- Product
- xxl-job
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2024** UNSUPPORTED WHEN ASSIGNED ** A vulnerability has been found in D-Link DNS-320L, DNS-320LW and DNS-327L up to 20240403 and classified as problematic.CVE-2024-3274 · Network & remote access · D-Link · reported by VulDBMedium 5.3
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability has been found in D-Link DNS-320L, DNS-320LW and DNS-327L up to 20240403 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/info.cgi of the component HTTP GET Request Handler. The manipulation leads to information disclosure. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-259285 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.
- Product
- DNS-320L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsupportannouncement.us.dlink.com
Apr 3, 2024A vulnerability classified as problematic was found in ThingsBoard up to 3.6.2.CVE-2024-3270 · Other software · thingsboard · reported by VulDBLow 3.8
A vulnerability classified as problematic was found in ThingsBoard up to 3.6.2. This vulnerability affects unknown code of the component AdvancedFeature. The manipulation leads to improper access controls. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-259282 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure and replied to be planning to fix this issue in version 3.7.
- Product
- thingsboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
Apr 2, 2024A vulnerability classified as critical has been found in Shibang Communications IP Network Intercom Broadcasting System 1.0.CVE-2024-3218 · Other software · Shibang Communications · reported by VulDBMedium 5.4
A vulnerability classified as critical has been found in Shibang Communications IP Network Intercom Broadcasting System 1.0. This affects an unknown part of the file /php/busyscreenshotpush.php. The manipulation of the argument jsondata[callee]/jsondata[imagename] leads to path traversal: '../filedir'. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-259065 was assigned to this vulnerability.
- Product
- IP Network Intercom Broadcasting System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2024A vulnerability has been found in c-blosc2 up to 2.13.2 and classified as critical.CVE-2024-3204 · Other software · c-blosc2_project · reported by VulDBHigh 7.3
A vulnerability has been found in c-blosc2 up to 2.13.2 and classified as critical. Affected by this vulnerability is the function ndlz4_decompress of the file /src/c-blosc2/plugins/codecs/ndlz/ndlz4x4.c. The manipulation leads to heap-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.14.3 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-259051.
- Product
- c-blosc2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Apr 2, 2024A vulnerability, which was classified as critical, was found in c-blosc2 up to 2.13.2.CVE-2024-3203 · Other software · Blosc · reported by VulDBHigh 7.3
A vulnerability, which was classified as critical, was found in c-blosc2 up to 2.13.2. Affected is the function ndlz8_decompress of the file /src/c-blosc2/plugins/codecs/ndlz/ndlz8x8.c. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.14.3 is able to address this issue. It is recommended to upgrade the affected component. VDB-259050 is the identifier assigned to this vulnerability.
- Product
- C-blosc2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Apr 2, 2024A vulnerability, which was classified as problematic, has been found in codelyfe Stupid Simple CMS 1.2.4.CVE-2024-3202 · Other software · codelyfe · reported by VulDBLow 3.7
A vulnerability, which was classified as problematic, has been found in codelyfe Stupid Simple CMS 1.2.4. This issue affects some unknown processing of the component Login Page. The manipulation leads to improper restriction of excessive authentication attempts. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The identifier VDB-259049 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Stupid Simple CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2024A vulnerability, which was classified as problematic, was found in Bdtask Multi-Store Inventory Management System up to 20240325.CVE-2024-3151 · Other software · Bdtask · reported by VulDBMedium 4.3
A vulnerability, which was classified as problematic, was found in Bdtask Multi-Store Inventory Management System up to 20240325. Affected is an unknown function of the file /stockmovment/stockmovment/delete/ of the component Stock Movement Page. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-258924. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Multi-Store Inventory Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
Apr 1, 2024** DISPUTED ** A vulnerability, which was classified as problematic, was found in Intelbras MHDX 1004, MHDX 1008, MHDX 1016, MHDX 5016, HDCVI 1008 and HDCVI 101CVE-2024-3160 · Other software · Intelbras · reported by VulDBMedium 5.3
** DISPUTED ** A vulnerability, which was classified as problematic, was found in Intelbras MHDX 1004, MHDX 1008, MHDX 1016, MHDX 5016, HDCVI 1008 and HDCVI 1016 up to 20240401. This affects an unknown part of the file /cap.js of the component HTTP GET Request Handler. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The identifier VDB-258933 was assigned to this vulnerability. NOTE: The vendor explains that they do not classify the information shown as sensitive and therefore there is no vulnerability which is about to harm the user.
- Product
- MHDX 1004
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2024A vulnerability, which was classified as critical, has been found in DedeCMS 5.7.112.CVE-2024-3148 · Other software · Dedecms · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in DedeCMS 5.7.112. This issue affects some unknown processing of the file dede/makehtml_archives_action.php. The manipulation leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-258923. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2024A vulnerability classified as problematic was found in DedeCMS 5.7.CVE-2024-3147 · Other software · dedecms · reported by VulDBMedium 4.3
A vulnerability classified as problematic was found in DedeCMS 5.7. This vulnerability affects unknown code of the file /src/dede/makehtml_map.php. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-258922 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2024A vulnerability classified as problematic has been found in DedeCMS 5.7.CVE-2024-3146 · Other software · dedecms · reported by VulDBMedium 4.3
A vulnerability classified as problematic has been found in DedeCMS 5.7. This affects an unknown part of the file /src/dede/makehtml_rss_action.php. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-258921 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2024A vulnerability was found in Clavister E10 and E80 up to 14.00.10 and classified as problematic.CVE-2024-3142 · Other software · Clavister · reported by VulDBMedium 4.3
A vulnerability was found in Clavister E10 and E80 up to 14.00.10 and classified as problematic. This issue affects some unknown processing of the component Setting Handler. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 14.00.11 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-258917 was assigned to this vulnerability.
- Product
- E10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.clavister.comgithub.com
Apr 1, 2024A vulnerability has been found in Clavister E10 and E80 up to 14.00.10 and classified as problematic.CVE-2024-3141 · Other software · Clavister · reported by VulDBLow 2.4
A vulnerability has been found in Clavister E10 and E80 up to 14.00.10 and classified as problematic. This vulnerability affects unknown code of the file /?Page=Node&OBJ=/System/AdvancedSettings/DeviceSettings/MiscSettings of the component Misc Settings Page. The manipulation of the argument WatchdogTimerTime/BufFloodRebootTime/MaxPipeUsers/AVCache Lifetime/HTTPipeliningMaxReq/Reassembly MaxConnections/Reassembly MaxProcessingMem/ScrSaveTime leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 14.00.11 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-258916.
- Product
- E10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.clavister.comgithub.com
Apr 1, 2024** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as problematic, has been found in Replify-Messenger 1.0 on Android.CVE-2024-3128 · Other software · reported by VulDBLow 2.4
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as problematic, has been found in Replify-Messenger 1.0 on Android. This issue affects some unknown processing of the file androidmanifest.xml of the component Backup File Handler. The manipulation leads to exposure of backup file to an unauthorized control sphere. It is possible to launch the attack on the physical device. The exploit has been disclosed to the public and may be used. The identifier VDB-258869 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: The vendor was contacted early and responded very quickly. He does not intend to maintain the app anymore and will revoke the availability in the Google Play Store.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2024A vulnerability classified as problematic was found in Zebra ZTC GK420d 1.0.CVE-2024-3125 · Other software · Zebra · reported by VulDBLow 2.4
A vulnerability classified as problematic was found in Zebra ZTC GK420d 1.0. This vulnerability affects unknown code of the file /settings of the component Alert Setup Page. The manipulation of the argument Address leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-258868. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- ZTC GK420d
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2024A vulnerability classified as problematic has been found in fridgecow smartalarm 1.8.1 on Android.CVE-2024-3124 · Other software · fridgecow · reported by VulDBLow 2.4
A vulnerability classified as problematic has been found in fridgecow smartalarm 1.8.1 on Android. This affects an unknown part of the file androidmanifest.xml of the component Backup File Handler. The manipulation leads to exposure of backup file to an unauthorized control sphere. It is possible to launch the attack on the physical device. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-258867.
- Product
- smartalarm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2024A vulnerability was found in sequentech admin-console up to 6.1.7 and classified as problematic.CVE-2022-4966 · Other software · sequentech · reported by VulDBLow 3.5
A vulnerability was found in sequentech admin-console up to 6.1.7 and classified as problematic. Affected by this issue is some unknown functionality of the component Election Description Handler. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 7.0.0-beta.1 is able to address this issue. The patch is identified as 0043a6b1e6e0f5abc9557e73f9ffc524fc5d609d. It is recommended to upgrade the affected component. VDB-258782 is the identifier assigned to this vulnerability.
- Product
- admin-console
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2024A vulnerability, which was classified as critical, was found in NUUO NVRmini 2 up to 3.0.8.CVE-2016-15038 · Other software · NUUO · reported by VulDBMedium 6.5
A vulnerability, which was classified as critical, was found in NUUO NVRmini 2 up to 3.0.8. Affected is an unknown function of the file /deletefile.php. The manipulation of the argument filename leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-258780.
- Product
- NVRmini 2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2024A vulnerability has been found in wp-file-upload Plugin up to 2.4.3 on WordPress and classified as problematic.CVE-2014-125110 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability has been found in wp-file-upload Plugin up to 2.4.3 on WordPress and classified as problematic. Affected by this vulnerability is the function wfu_ajax_action_callback of the file lib/wfu_ajaxactions.php. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 2.4.4 is able to address this issue. The identifier of the patch is c846327df030a0a97da036a2f07c769ab9284ddb. It is recommended to upgrade the affected component. The identifier VDB-258781 was assigned to this vulnerability.
- Product
- wp-file-upload
- Affected
- up to 2.4.3
- What to do
- Affects up to 2.4.3. Update wp-file-upload to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2024A vulnerability was found in chrisy TFO Graphviz Plugin up to 1.9 on WordPress and classified as problematic.CVE-2015-10131 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability was found in chrisy TFO Graphviz Plugin up to 1.9 on WordPress and classified as problematic. Affected by this issue is the function admin_page_load/admin_page of the file tfo-graphviz-admin.php. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 1.10 is able to address this issue. The name of the patch is 594c953a345f79e26003772093b0caafc14b92c2. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-258620.
- Product
- chrisy TFO Graphviz
- Affected
- up to 1.9
- What to do
- Affects up to 1.9. Update chrisy TFO Graphviz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2024A vulnerability, which was classified as critical, has been found in Dreamer CMS up to 4.1.3.CVE-2024-3118 · Other software · Dreamer · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in Dreamer CMS up to 4.1.3. This issue affects some unknown processing of the component Attachment Handler. The manipulation leads to permission issues. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-258779. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2024A vulnerability classified as critical was found in YouDianCMS up to 9.5.12.CVE-2024-3117 · Other software · Youdiancms · reported by VulDBMedium 4.7
A vulnerability classified as critical was found in YouDianCMS up to 9.5.12. This vulnerability affects unknown code of the file App\Lib\Action\Admin\ChannelAction.class.php. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-258778 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Youdiancms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 29, 2024A vulnerability was found in Qdrant up to 1.6.1/1.7.4/1.8.2 and classified as critical.CVE-2024-3078 · Other software · Qdrant · reported by VulDBMedium 5.5
A vulnerability was found in Qdrant up to 1.6.1/1.7.4/1.8.2 and classified as critical. This issue affects some unknown processing of the file lib/collection/src/collection/snapshots.rs of the component Full Snapshot REST API. The manipulation leads to path traversal. Upgrading to version 1.8.3 is able to address this issue. The patch is named 3ab5172e9c8f14fa1f7b24e7147eac74e2412b62. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-258611.
- Product
- Qdrant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2024A vulnerability has been found in Netentsec NS-ASG Application Security Gateway 6.3 and classified as critical.CVE-2024-3041 · Other software · Netentsec · reported by VulDBMedium 6.3
A vulnerability has been found in Netentsec NS-ASG Application Security Gateway 6.3 and classified as critical. This vulnerability affects unknown code of the file /protocol/log/listloginfo.php. The manipulation leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-258430 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- NS-ASG Application Security Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2024A vulnerability, which was classified as critical, was found in Netentsec NS-ASG Application Security Gateway 6.3.CVE-2024-3040 · Other software · Netentsec · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, was found in Netentsec NS-ASG Application Security Gateway 6.3. This affects an unknown part of the file /admin/list_crl_conf. The manipulation of the argument CRLId leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-258429 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- NS-ASG Application Security Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2024A vulnerability classified as critical has been found in Shanghai Brad Technology BladeX 3.4.0.CVE-2024-3039 · Other software · Shanghai Brad Technology · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in Shanghai Brad Technology BladeX 3.4.0. Affected is an unknown function of the file /api/blade-user/export-user of the component API. The manipulation with the input updatexml(1,concat(0x3f,md5(123456),0x3f),1)=1 leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-258426 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- BladeX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2024A vulnerability was found in Tenda FH1205 2.0.0.7(775) and classified as critical.CVE-2024-3010 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability was found in Tenda FH1205 2.0.0.7(775) and classified as critical. Affected by this issue is the function formSetCfm of the file /goform/setcfm. The manipulation of the argument funcpara1 leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-258296. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- FH1205
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2024A vulnerability has been found in Tenda FH1205 2.0.0.7(775) and classified as critical.CVE-2024-3009 · Network & remote access · Tenda · reported by VulDBMedium 6.3
A vulnerability has been found in Tenda FH1205 2.0.0.7(775) and classified as critical. Affected by this vulnerability is the function formWriteFacMac of the file /goform/WriteFacMac. The manipulation of the argument mac leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-258295. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- FH1205
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2024A vulnerability, which was classified as critical, was found in Tenda FH1205 2.0.0.7(775).CVE-2024-3008 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability, which was classified as critical, was found in Tenda FH1205 2.0.0.7(775). Affected is the function formexeCommand of the file /goform/execCommand. The manipulation of the argument cmdinput leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-258294 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- FH1205
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.