Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
7,406 results · page 49 of 149
Nov 22, 2024The Kubernetes kubelet component allows arbitrary command execution via specially crafted gitRepo volumes.This issue affects kubelet: through 1.28.11, from 1.29CVE-2024-10220 · Other software · Kubernetes · reported by jordan@liggitt.netHigh 8.1
The Kubernetes kubelet component allows arbitrary command execution via specially crafted gitRepo volumes.This issue affects kubelet: through 1.28.11, from 1.29.0 through 1.29.6, from 1.30.0 through 1.30.2.
- Product
- kubelet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgroups.google.com
Nov 22, 2024A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions.CVE-2024-50401 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twLow 2.1
A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to obtain secret data or modify memory. We have already fixed the vulnerability in the following versions: QTS 5.2.1.2930 build 20241025 and later QuTS hero h5.2.1.2929 build 20241025 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions.CVE-2024-50400 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twLow 2.1
A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to obtain secret data or modify memory. We have already fixed the vulnerability in the following versions: QTS 5.2.1.2930 build 20241025 and later QuTS hero h5.2.1.2929 build 20241025 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions.CVE-2024-50399 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twLow 2.1
A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to obtain secret data or modify memory. We have already fixed the vulnerability in the following versions: QTS 5.2.1.2930 build 20241025 and later QuTS hero h5.2.1.2929 build 20241025 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions.CVE-2024-50398 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twLow 2.1
A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to obtain secret data or modify memory. We have already fixed the vulnerability in the following versions: QTS 5.2.1.2930 build 20241025 and later QuTS hero h5.2.1.2929 build 20241025 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions.CVE-2024-50397 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 7.7
A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained user access to obtain secret data or modify memory. We have already fixed the vulnerability in the following versions: QTS 5.2.1.2930 build 20241025 and later QuTS hero h5.2.1.2929 build 20241025 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions.CVE-2024-50396 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 7.7
A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers to obtain secret data or modify memory. We have already fixed the vulnerability in the following versions: QTS 5.2.1.2930 build 20241025 and later QuTS hero h5.2.1.2929 build 20241025 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024An authorization bypass through user-controlled key vulnerability has been reported to affect Media Streaming add-on.CVE-2024-50395 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 6.9
An authorization bypass through user-controlled key vulnerability has been reported to affect Media Streaming add-on. If exploited, the vulnerability could allow local network attackers to gain privilege. We have already fixed the vulnerability in the following version: Media Streaming add-on 500.1.1.6 ( 2024/08/02 ) and later
- Product
- Media Streaming add-on
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024A link following vulnerability has been reported to affect QuLog Center.CVE-2024-48862 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 8.7
A link following vulnerability has been reported to affect QuLog Center. If exploited, the vulnerability could allow remote attackers to traverse the file system to unintended locations and read or overwrite the contents of unexpected files. We have already fixed the vulnerability in the following versions: QuLog Center 1.7.0.831 ( 2024/10/15 ) and later QuLog Center 1.8.0.888 ( 2024/10/15 ) and later
- Product
- QuLog Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024An OS command injection vulnerability has been reported to affect several product versions.CVE-2024-48861 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 7.3
An OS command injection vulnerability has been reported to affect several product versions. If exploited, the vulnerability could allow local network attackers to execute commands. We have already fixed the vulnerability in the following versions: QuRouter 2.4.4.106 and later
- Product
- QuRouter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024An OS command injection vulnerability has been reported to affect several product versions.CVE-2024-48860 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twCritical 9.5
An OS command injection vulnerability has been reported to affect several product versions. If exploited, the vulnerability could allow remote attackers to execute commands. We have already fixed the vulnerability in the following version: QuRouter 2.4.3.103 and later
- Product
- QuRouter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024An exposure of sensitive information vulnerability has been reported to affect QNAP AI Core.CVE-2024-38647 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 7.9
An exposure of sensitive information vulnerability has been reported to affect QNAP AI Core. If exploited, the vulnerability could allow remote attackers to compromise the security of the system. We have already fixed the vulnerability in the following version: QNAP AI Core 3.4.1 and later
- Product
- QNAP AI Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3.CVE-2024-38646 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 8.4
An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow local authenticated attackers who have gained administrator access to read or modify the resource. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.7 and later
- Product
- Notes Station 3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024A server-side request forgery (SSRF) vulnerability has been reported to affect Notes Station 3.CVE-2024-38645 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twCritical 9.4
A server-side request forgery (SSRF) vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote authenticated attackers to read application data. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.7 and later
- Product
- Notes Station 3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024An OS command injection vulnerability has been reported to affect Notes Station 3.CVE-2024-38644 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 8.7
An OS command injection vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote authenticated attackers to execute commands. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.7 and later
- Product
- Notes Station 3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024A missing authentication for critical function vulnerability has been reported to affect Notes Station 3.CVE-2024-38643 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twCritical 9.3
A missing authentication for critical function vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote attackers to gain access to and execute certain functions. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.7 and later
- Product
- Notes Station 3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions.CVE-2024-37050 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 5.1
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to execute code. We have already fixed the vulnerability in the following versions: QTS 5.2.1.2930 build 20241025 and later QuTS hero h5.2.1.2929 build 20241025 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions.CVE-2024-37049 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 5.1
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to execute code. We have already fixed the vulnerability in the following versions: QTS 5.2.1.2930 build 20241025 and later QuTS hero h5.2.1.2929 build 20241025 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions.CVE-2024-37048 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 5.1
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QTS 5.2.1.2930 build 20241025 and later QuTS hero h5.2.1.2929 build 20241025 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions.CVE-2024-37047 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 5.1
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to execute code. We have already fixed the vulnerability in the following versions: QTS 5.2.1.2930 build 20241025 and later QuTS hero h5.2.1.2929 build 20241025 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024A path traversal vulnerability has been reported to affect several QNAP operating system versions.CVE-2024-37046 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twLow 2.1
A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to read the contents of unexpected files and expose sensitive data. We have already fixed the vulnerability in the following versions: QTS 5.2.1.2930 build 20241025 and later QuTS hero h5.2.1.2929 build 20241025 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions.CVE-2024-37045 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 5.1
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QTS 5.2.1.2930 build 20241025 and later QuTS hero h5.2.1.2929 build 20241025 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions.CVE-2024-37044 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 5.1
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to execute code. We have already fixed the vulnerability in the following versions: QTS 5.2.1.2930 build 20241025 and later QuTS hero h5.2.1.2929 build 20241025 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024A path traversal vulnerability has been reported to affect several QNAP operating system versions.CVE-2024-37043 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 5.1
A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to read the contents of unexpected files and expose sensitive data. We have already fixed the vulnerability in the following versions: QTS 5.2.1.2930 build 20241025 and later QuTS hero h5.2.1.2929 build 20241025 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions.CVE-2024-37042 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 5.1
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QTS 5.2.1.2930 build 20241025 and later QuTS hero h5.2.1.2929 build 20241025 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions.CVE-2024-37041 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 5.1
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to execute code. We have already fixed the vulnerability in the following versions: QTS 5.2.1.2930 build 20241025 and later QuTS hero h5.2.1.2929 build 20241025 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024A cross-site scripting (XSS) vulnerability has been reported to affect Photo Station.CVE-2024-32770 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 6.3
A cross-site scripting (XSS) vulnerability has been reported to affect Photo Station. If exploited, the vulnerability could allow remote attackers who have gained user access to inject malicious code. We have already fixed the vulnerability in the following version: Photo Station 6.4.3 ( 2024/07/12 ) and later
- Product
- Photo Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024A cross-site scripting (XSS) vulnerability has been reported to affect Photo Station.CVE-2024-32769 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 6.3
A cross-site scripting (XSS) vulnerability has been reported to affect Photo Station. If exploited, the vulnerability could allow remote attackers who have gained user access to inject malicious code. We have already fixed the vulnerability in the following version: Photo Station 6.4.3 ( 2024/07/12 ) and later
- Product
- Photo Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024A cross-site scripting (XSS) vulnerability has been reported to affect Photo Station.CVE-2024-32768 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 6.3
A cross-site scripting (XSS) vulnerability has been reported to affect Photo Station. If exploited, the vulnerability could allow remote attackers who have gained user access to inject malicious code. We have already fixed the vulnerability in the following version: Photo Station 6.4.3 ( 2024/07/12 ) and later
- Product
- Photo Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024A cross-site scripting (XSS) vulnerability has been reported to affect Photo Station.CVE-2024-32767 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 6.3
A cross-site scripting (XSS) vulnerability has been reported to affect Photo Station. If exploited, the vulnerability could allow remote attackers who have gained user access to inject malicious code. We have already fixed the vulnerability in the following version: Photo Station 6.4.3 ( 2024/07/12 ) and later
- Product
- Photo Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2024In bta_hd_set_report_act of bta_hd_act.cc, there is a possible out-of-bounds read due to an integer overflow.CVE-2018-9481 · Computers, phones & browsers · Google · reported by security@android.comMedium 6.5
In bta_hd_set_report_act of bta_hd_act.cc, there is a possible out-of-bounds read due to an integer overflow. This could lead to remote information disclosure in the Bluetooth service with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2024In bta_hd_get_report_act of bta_hd_act.cc, there is a possible out-of-bounds read due to improper input validation.CVE-2018-9480 · Computers, phones & browsers · Google · reported by security@android.comMedium 6.5
In bta_hd_get_report_act of bta_hd_act.cc, there is a possible out-of-bounds read due to improper input validation. This could lead to remote information disclosure in the Bluetooth service with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 18, 2024In the Linux kernel, the following vulnerability has been resolved: security/keys: fix slab-out-of-bounds in key_task_permission KASAN reports an out of boundCVE-2024-50301 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: security/keys: fix slab-out-of-bounds in key_task_permission KASAN reports an out of bounds read: BUG: KASAN: slab-out-of-bounds in __kuid_val include/linux/uidgid.h:36 BUG: KASAN: slab-out-of-bounds in uid_eq include/linux/uidgid.h:63 [inline] BUG: KASAN: slab-out-of-bounds in key_task_permission+0x394/0x410 security/keys/permission.c:54 Read of size 4 at addr ffff88813c3ab618 by task stress-ng/4362 CPU: 2 PID: 4362 Comm: stress-ng Not tainted 5.10.0-14930-gafbffd6c3ede #15 Call Trace: __dump_stack lib/dump_stack.c:82 [inline] dump_stack+0x107/0x167 lib/dump_stack.c:123 print_address_description.constprop.0+0x19/0x170 mm/kasan/report.c:400 __kasan_report.cold+0x6c/0x84 mm/kasan/report.c:560 kasan_report+0x3a/0x50 mm/kasan/report.c:585 __kuid_val include/linux/uidgid.h:36 [inline] uid_eq include/linux/uidgid.h:63 [inline] key_task_permission+0x394/0x410 security/keys/permission.c:54 search_nested_keyrings+0x90e/0xe90 security/keys/keyring.c:793 This issue was also reported by syzbot. It can be reproduced by following these steps(more details [1]): 1. Obtain more than 32 inputs that have similar hashes
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Nov 18, 2024In the Linux kernel, the following vulnerability has been resolved: media: cx24116: prevent overflows on SNR calculus as reported by Coverity, if reading SNR CVE-2024-50290 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: media: cx24116: prevent overflows on SNR calculus as reported by Coverity, if reading SNR registers fail, a negative number will be returned, causing an underflow when reading SNR registers. Prevent that.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Nov 18, 2024In the Linux kernel, the following vulnerability has been resolved: media: v4l2-tpg: prevent the risk of a division by zero As reported by Coverity, the logicCVE-2024-50287 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: media: v4l2-tpg: prevent the risk of a division by zero As reported by Coverity, the logic at tpg_precalculate_line() blindly rescales the buffer even when scaled_witdh is equal to zero. If this ever happens, this will cause a division by zero. Instead, add a WARN_ON_ONCE() to trigger such cases and return without doing any precalculation.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Nov 18, 2024The WesHacks GitHub repository provides the official Hackathon competition website source code for the Muweilah Wesgreen Hackathon.CVE-2024-52583 · Other software · DefinetlyNotAI · reported by GitHubHigh 8.2
The WesHacks GitHub repository provides the official Hackathon competition website source code for the Muweilah Wesgreen Hackathon. The page `schedule.html` before 17 November 2024 or commit 93dfb83 contains links to `Leostop`, a site that hosts a malicious injected JavaScript file that occurs when bootstrap is run as well as jquery. `Leostop` may be a tracking malware and creates 2 JavaScript files, but little else is known about it. The WesHacks website remove all references to `Leostop` as of 17 November 2024.
- Product
- WesHacks
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 18, 2024A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software coCVE-2021-1444 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.1
A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input by the web services interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive, browser-based information.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.This advisory is part of the October 2021 release of the Cisco ASA, FTD, and FMC Security Advisory Bundled publication. For a complete list of the advisories and links to them, see .
- Product
- Cisco Adaptive Security Appliance (ASA) Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Nov 18, 2024Zohocorp ManageEngine ADAudit Plus versions below 8123 are vulnerable to SQL Injection in the reports module.CVE-2024-49574 · Other software · ManageEngine · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 8.3
Zohocorp ManageEngine ADAudit Plus versions below 8123 are vulnerable to SQL Injection in the reports module.
- Product
- ADAudit Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2024The web interface in RSA NetWitness 11.7.2.0 allows Cross-Site Scripting (XSS) via the Where textbox on the Reports screen during new rule creation.CVE-2024-23169 · Other software · reported by MITREMedium 4.6
The web interface in RSA NetWitness 11.7.2.0 allows Cross-Site Scripting (XSS) via the Where textbox on the Reports screen during new rule creation.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.netwitness.comcommunity.netwitness.com
Nov 15, 2024Gogs <=0.13.0 is vulnerable to Directory Traversal via the editFilePost function of internal/route/repo/editor.go.CVE-2024-44625 · Other software · gogs · reported by MITREHigh 8.8
Gogs <=0.13.0 is vulnerable to Directory Traversal via the editFilePost function of internal/route/repo/editor.go.
- Product
- gogs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfysac.github.iogogs.io
Nov 15, 2024A vulnerability in the payload inspection for Ethernet Industrial Protocol (ENIP) traffic for Cisco Firepower Threat Defense (FTD) Software could allow an unautCVE-2021-34753 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.8
A vulnerability in the payload inspection for Ethernet Industrial Protocol (ENIP) traffic for Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass configured rules for ENIP traffic. This vulnerability is due to incomplete processing during deep packet inspection for ENIP packets. An attacker could exploit this vulnerability by sending a crafted ENIP packet to the targeted interface. A successful exploit could allow the attacker to bypass configured access control and intrusion policies that should trigger and drop for the ENIP packet.
- Product
- Cisco Firepower Threat Defense Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Nov 15, 2024A vulnerability in the CLI of Cisco FTD Software could allow an authenticated, local attacker with administrative privileges to execute arbitrary commands CVE-2021-34752 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.7
A vulnerability in the CLI of Cisco FTD Software could allow an authenticated, local attacker with administrative privileges to execute arbitrary commands with root privileges on the underlying operating system of an affected device. This vulnerability is due to insufficient validation of user-supplied command arguments. An attacker could exploit this vulnerability by submitting crafted input to the affected commands. A successful exploit could allow the attacker to execute commands with root privileges on the underlying operating system. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
- Product
- Cisco Firepower Threat Defense Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Nov 15, 2024A vulnerability in the administrative web-based GUI configuration manager of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remoCVE-2021-34751 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4.3
A vulnerability in the administrative web-based GUI configuration manager of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to access sensitive configuration information. The attacker would require low privilege credentials on an affected device. This vulnerability exists because of improper encryption of sensitive information stored within the GUI configuration manager. An attacker could exploit this vulnerability by logging into the GUI of Cisco FMC Software and navigating to certain sensitive configurations. A successful exploit could allow the attacker to view sensitive configuration parameters in clear text.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.[[Publication_URL{Layout()}]]This advisory is part of the October 2021 release of the Cisco ASA, FTD, and FMC Security Advisory Bundled publication. For a complete list of the advisories and links to them, see .
- Product
- Cisco Firepower Management Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Nov 15, 2024A vulnerability in the administrative web-based GUI configuration manager of Cisco Firepower Management Center Software could allow an authenticated, remote attCVE-2021-34750 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4.3
A vulnerability in the administrative web-based GUI configuration manager of Cisco Firepower Management Center Software could allow an authenticated, remote attacker to access sensitive configuration information. The attacker would require low privilege credentials on an affected device. This vulnerability is due to lack of proper encryption of sensitive information stored within the GUI configuration manager. An attacker could exploit this vulnerability by logging into the FMC GUI and navigating to certain sensitive configurations. A successful exploit could allow the attacker to view sensitive configuration parameters in clear text.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.[[Publication_URL{Layout()}]]This advisory is part of the October 2021 release of the Cisco ASA, FTD, and FMC Security Advisory Bundled publication. For a complete list of the advisories and links to them, see .
- Product
- Cisco Firepower Management Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Nov 15, 2024Multiple Cisco products are affected by a vulnerability in the Snort detection engine that could allow an unauthenticated, remote attacker to bypass a configureCVE-2021-1494 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.8
Multiple Cisco products are affected by a vulnerability in the Snort detection engine that could allow an unauthenticated, remote attacker to bypass a configured file policy for HTTP. The vulnerability is due to incorrect handling of specific HTTP header parameters. An attacker could exploit this vulnerability by sending crafted HTTP packets through an affected device. A successful exploit could allow the attacker to bypass a configured file policy for HTTP packets and deliver a malicious payload.
- Product
- Cisco Firepower Threat Defense Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Nov 13, 2024A Remote Code Execution vulnerability has been discovered in Sonatype Nexus Repository 2.CVE-2024-5082 · Other software · Sonatype · reported by 103e4ec9-0a87-450b-af77-479448ddef11High 7.1
A Remote Code Execution vulnerability has been discovered in Sonatype Nexus Repository 2. This issue affects Nexus Repository 2 OSS/Pro versions up to and including 2.15.1.
- Product
- Nexus Repository
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2024A stored Cross-site Scripting vulnerability has been discovered in Sonatype Nexus Repository 2 This issue affects Nexus Repository 2 OSS/Pro versions up to andCVE-2024-5083 · Other software · Sonatype · reported by 103e4ec9-0a87-450b-af77-479448ddef11Medium 5.1
A stored Cross-site Scripting vulnerability has been discovered in Sonatype Nexus Repository 2 This issue affects Nexus Repository 2 OSS/Pro versions up to and including 2.15.1.
- Product
- Nexus Repository
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2024In Progress® Telerik® Report Server versions prior to 2024 Q4 (10.3.24.1112), the encryption of local asset data used an older algorithm which may allow a sophiCVE-2024-7295 · Other software · Progress Software Corporation · reported by security@progress.comHigh 7.1
In Progress® Telerik® Report Server versions prior to 2024 Q4 (10.3.24.1112), the encryption of local asset data used an older algorithm which may allow a sophisticated actor to decrypt this information.
- Product
- Telerik Report Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting.CVE-2024-49369 · Other software · Icinga · reported by GitHubCritical 9.8
Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. The TLS certificate validation in all Icinga 2 versions starting from 2.4.0 was flawed, allowing an attacker to impersonate both trusted cluster nodes as well as any API users that use TLS client certificates for authentication (ApiUser objects with the client_cn attribute set). This vulnerability has been fixed in v2.14.3, v2.13.10, v2.12.11, and v2.11.12.
- Product
- icinga2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2024In the Linux kernel, the following vulnerability has been resolved: macsec: Fix use-after-free while sending the offloading packet KASAN reports the followingCVE-2024-50261 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: macsec: Fix use-after-free while sending the offloading packet KASAN reports the following UAF. The metadata_dst, which is used to store the SCI value for macsec offload, is already freed by metadata_dst_free() in macsec_free_netdev(), while driver still use it for sending the packet. To fix this issue, dst_release() is used instead to release metadata_dst. So it is not freed instantly in macsec_free_netdev() if still referenced by skb. BUG: KASAN: slab-use-after-free in mlx5e_xmit+0x1e8f/0x4190 [mlx5_core] Read of size 2 at addr ffff88813e42e038 by task kworker/7:2/714 [...] Workqueue: mld mld_ifc_work Call Trace: <TASK> dump_stack_lvl+0x51/0x60 print_report+0xc1/0x600 kasan_report+0xab/0xe0 mlx5e_xmit+0x1e8f/0x4190 [mlx5_core] dev_hard_start_xmit+0x120/0x530 sch_direct_xmit+0x149/0x11e0 __qdisc_run+0x3ad/0x1730 __dev_queue_xmit+0x1196/0x2ed0 vlan_dev_hard_start_xmit+0x32e/0x510 [8021q] dev_hard_start_xmit+0x120/0x530 __dev_queue_xmit+0x14a7/0x2ed0 macsec_start_xmit+0x13e9/0x2340 dev_hard_start_xmit+0x120/0x530 __dev_queue_xmit+0x14a7/0x2ed0 ip6_finish_output2+0x923/0x1a70
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.