Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,303 results · page 51 of 87
Mar 15, 2024A vulnerability was found in Tenda AC18 15.03.05.05 and classified as critical.CVE-2024-2485 · Network & remote access · Tenda · reported by VulDBHigh 8.8
A vulnerability was found in Tenda AC18 15.03.05.05 and classified as critical. Affected by this issue is the function formSetSpeedWan of the file /goform/SetSpeedWan. The manipulation of the argument speed_dir leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-256892. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AC18
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2024A vulnerability, which was classified as problematic, has been found in Surya2Developer Hostel Management Service 1.0.CVE-2024-2483 · Other software · Surya2Developer · reported by VulDBMedium 4.3
A vulnerability, which was classified as problematic, has been found in Surya2Developer Hostel Management Service 1.0. This issue affects some unknown processing of the file /change-password.php of the component Password Change Handler. The manipulation of the argument oldpassword leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-256889 was assigned to this vulnerability.
- Product
- Hostel Management Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2024A vulnerability has been found in Surya2Developer Hostel Management Service 1.0 and classified as problematic.CVE-2024-2482 · Other software · Surya2Developer · reported by VulDBLow 3.7
A vulnerability has been found in Surya2Developer Hostel Management Service 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /check_availability.php of the component HTTP POST Request Handler. The manipulation of the argument oldpassword leads to observable response discrepancy. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-256891.
- Product
- Hostel Management Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2024A vulnerability, which was classified as critical, was found in Surya2Developer Hostel Management System 1.0.CVE-2024-2481 · Other software · Surya2Developer · reported by VulDBMedium 6.5
A vulnerability, which was classified as critical, was found in Surya2Developer Hostel Management System 1.0. Affected is an unknown function of the file /admin/manage-students.php. The manipulation of the argument del leads to improper access controls. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-256890 is the identifier assigned to this vulnerability.
- Product
- Hostel Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2024A vulnerability classified as critical was found in MHA Sistemas arMHAzena 9.6.0.0.CVE-2024-2480 · Other software · MHA Sistemas · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in MHA Sistemas arMHAzena 9.6.0.0. This vulnerability affects unknown code of the component Executa Page. The manipulation of the argument Companhia/Planta/Agente de/Agente até leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-256888. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- arMHAzena
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjohnermac.github.iovuldb.com
Mar 15, 2024A vulnerability classified as problematic has been found in MHA Sistemas arMHAzena 9.6.0.0.CVE-2024-2479 · Other software · MHA Sistemas · reported by VulDBLow 3.5
A vulnerability classified as problematic has been found in MHA Sistemas arMHAzena 9.6.0.0. This affects an unknown part of the component Cadastro Page. The manipulation of the argument Query leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-256887. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- arMHAzena
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjohnermac.github.iovuldb.com
Mar 12, 2024A vulnerability, which was classified as critical, was found in Gacjie Server up to 1.0.CVE-2024-2406 · Other software · Gacjie · reported by VulDBMedium 5.4
A vulnerability, which was classified as critical, was found in Gacjie Server up to 1.0. This affects the function index of the file /app/admin/controller/Upload.php. The manipulation of the argument file leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-256503.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Mar 12, 2024A vulnerability was found in EVE-NG 5.0.1-13 and classified as problematic.CVE-2024-2391 · Other software · Eve-ng · reported by VulDBLow 2.4
A vulnerability was found in EVE-NG 5.0.1-13 and classified as problematic. Affected by this issue is some unknown functionality of the component Lab Handler. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-256442 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Eve-ng
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2024A vulnerability classified as problematic was found in Musicshelf 1.0/1.1 on Android.CVE-2024-2365 · Other software · musicshelf · reported by VulDBLow 1.6
A vulnerability classified as problematic was found in Musicshelf 1.0/1.1 on Android. Affected by this vulnerability is an unknown functionality of the file io\fabric\sdk\android\services\network\PinningTrustManager.java of the component SHA-1 Handler. The manipulation leads to password hash with insufficient computational effort. It is possible to launch the attack on the physical device. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier VDB-256321 was assigned to this vulnerability.
- Product
- musicshelf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2024A vulnerability classified as problematic has been found in Musicshelf 1.0/1.1 on Android.CVE-2024-2364 · Other software · musicshelf · reported by VulDBLow 1.8
A vulnerability classified as problematic has been found in Musicshelf 1.0/1.1 on Android. Affected is an unknown function of the file androidmanifest.xml of the component Backup Handler. The manipulation leads to exposure of backup file to an unauthorized control sphere. It is possible to launch the attack on the physical device. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-256320.
- Product
- musicshelf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2024A vulnerability has been found in keerti1924 Secret-Coder-PHP-Project 1.0 and classified as problematic.CVE-2024-2355 · Other software · keerti1924 · reported by VulDBLow 3.7
A vulnerability has been found in keerti1924 Secret-Coder-PHP-Project 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /secret_coder.sql. The manipulation leads to inclusion of sensitive information in source code. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-256315. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Secret-Coder-PHP-Project
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2024A vulnerability, which was classified as problematic, was found in Dreamer CMS 4.1.3.CVE-2024-2354 · Other software · Dreamer · reported by VulDBMedium 4.3
A vulnerability, which was classified as problematic, was found in Dreamer CMS 4.1.3. Affected is an unknown function of the file /admin/menu/toEdit. The manipulation of the argument id leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-256314 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2024A vulnerability, which was classified as critical, has been found in Totolink X6000R 9.4.0cu.852_20230719.CVE-2024-2353 · Other software · Totolink · reported by VulDBHigh 8.8
A vulnerability, which was classified as critical, has been found in Totolink X6000R 9.4.0cu.852_20230719. This issue affects the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi of the component shttpd. The manipulation of the argument ip leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-256313 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- X6000R
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2024A vulnerability, which was classified as critical, has been found in 1Panel up to 1.10.1-lts.CVE-2024-2352 · Other software · fit2cloud · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in 1Panel up to 1.10.1-lts. Affected by this issue is the function baseApi.UpdateDeviceSwap of the file /api/v1/toolbox/device/update/swap. The manipulation of the argument Path with the input 123123123\nopen -a Calculator leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-256304.
- Product
- 1panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2024A vulnerability classified as critical was found in CodeAstro Ecommerce Site 1.0.CVE-2024-2351 · Websites & servers · CodeAstro · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in CodeAstro Ecommerce Site 1.0. Affected by this vulnerability is an unknown functionality of the file action.php of the component Search. The manipulation of the argument cat_id/brand_id/keyword leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-256303.
- Product
- Ecommerce Site
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2024A vulnerability classified as critical has been found in CodeAstro Membership Management System 1.0.CVE-2024-2333 · Other software · CodeAstro · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in CodeAstro Membership Management System 1.0. Affected is an unknown function of the file /add_members.php. The manipulation of the argument fullname leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-256284.
- Product
- Membership Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2024A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3 and classified as critical.CVE-2024-2329 · Other software · Netentsec · reported by VulDBMedium 6.3
A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/list_resource_icon.php?action=delete. The manipulation of the argument IconId leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-256280. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- NS-ASG Application Security Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 8, 2024A vulnerability was found in Bdtask Hospital AutoManager up to 20240227 and classified as problematic.CVE-2024-2317 · Other software · Bdtask · reported by VulDBLow 3.8
A vulnerability was found in Bdtask Hospital AutoManager up to 20240227 and classified as problematic. This issue affects some unknown processing of the file /prescription/prescription/delete/ of the component Prescription Page. The manipulation leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-256271. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Hospital AutoManager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
Mar 8, 2024A vulnerability has been found in Bdtask Hospital AutoManager up to 20240227 and classified as problematic.CVE-2024-2316 · Other software · Bdtask · reported by VulDBMedium 4.3
A vulnerability has been found in Bdtask Hospital AutoManager up to 20240227 and classified as problematic. This vulnerability affects unknown code of the file /billing/bill/edit/ of the component Update Bill Page. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-256270 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Hospital AutoManager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
Mar 7, 2024A vulnerability, which was classified as problematic, has been found in boyiddha Automated-Mess-Management-System 1.0.CVE-2024-2285 · Other software · boyiddha · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in boyiddha Automated-Mess-Management-System 1.0. Affected by this issue is some unknown functionality of the file /member/member_edit.php. The manipulation of the argument name leads to cross site scripting. The attack may be launched remotely. The identifier of this vulnerability is VDB-256052. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Automated-Mess-Management-System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2024A vulnerability classified as problematic was found in boyiddha Automated-Mess-Management-System 1.0.CVE-2024-2284 · Other software · boyiddha · reported by VulDBLow 3.5
A vulnerability classified as problematic was found in boyiddha Automated-Mess-Management-System 1.0. Affected by this vulnerability is an unknown functionality of the file /member/chat.php of the component Chat Book. The manipulation of the argument msg leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-256051. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Automated-Mess-Management-System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2024A vulnerability classified as critical has been found in boyiddha Automated-Mess-Management-System 1.0.CVE-2024-2283 · Other software · boyiddha · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in boyiddha Automated-Mess-Management-System 1.0. Affected is an unknown function of the file /member/view.php. The manipulation of the argument date leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-256050 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Automated-Mess-Management-System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2024A vulnerability was found in Bdtask G-Prescription Gynaecology & OBS Consultation Software 1.0 and classified as problematic.CVE-2024-2277 · Other software · Bdtask · reported by VulDBMedium 4.3
A vulnerability was found in Bdtask G-Prescription Gynaecology & OBS Consultation Software 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /Setting/change_password_save of the component Password Reset Handler. The manipulation leads to cross-site request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-256046 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- G-Prescription Gynaecology & OBS Consultation Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
Mar 7, 2024A vulnerability has been found in Bdtask G-Prescription Gynaecology & OBS Consultation Software 1.0 and classified as problematic.CVE-2024-2276 · Other software · Bdtask · reported by VulDBLow 2.4
A vulnerability has been found in Bdtask G-Prescription Gynaecology & OBS Consultation Software 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /Venue_controller/edit_venue/ of the component Edit Venue Page. The manipulation of the argument Venue map leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-256045 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- G-Prescription Gynaecology & OBS Consultation Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
Mar 7, 2024A vulnerability, which was classified as problematic, was found in Bdtask G-Prescription Gynaecology & OBS Consultation Software 1.0.CVE-2024-2275 · Other software · Bdtask · reported by VulDBLow 2.4
A vulnerability, which was classified as problematic, was found in Bdtask G-Prescription Gynaecology & OBS Consultation Software 1.0. Affected is an unknown function of the component OBS Patient/Gynee Prescription. The manipulation of the argument Patient Title/Full Name/Address/Cheif Complain/LMP/Menstrual Edd/OBS P/OBS Alc/Medicine Name/Medicine Type/Ml/Dose/Days/Comments/Template Name leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-256044. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- G-Prescription Gynaecology & OBS Consultation Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
Mar 7, 2024A vulnerability, which was classified as problematic, has been found in Bdtask G-Prescription Gynaecology & OBS Consultation Software 1.0.CVE-2024-2274 · Other software · Bdtask · reported by VulDBLow 2.4
A vulnerability, which was classified as problematic, has been found in Bdtask G-Prescription Gynaecology & OBS Consultation Software 1.0. This issue affects some unknown processing of the file /Home/Index of the component Prescription Dashboard. The manipulation of the argument Title leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-256043. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- G-Prescription Gynaecology & OBS Consultation Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
Mar 7, 2024A vulnerability classified as critical was found in keerti1924 Online-Book-Store-Website 1.0.CVE-2024-2272 · Other software · keerti1924 · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in keerti1924 Online-Book-Store-Website 1.0. This vulnerability affects unknown code of the file /home.php of the component HTTP POST Request Handler. The manipulation of the argument product_name leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-256042 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Online-Book-Store-Website
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2024A vulnerability classified as critical has been found in keerti1924 Online-Book-Store-Website 1.0.CVE-2024-2271 · Other software · keerti1924 · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in keerti1924 Online-Book-Store-Website 1.0. This affects an unknown part of the file /shop.php of the component HTTP POST Request Handler. The manipulation of the argument product_name leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-256041 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Online-Book-Store-Website
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2024A vulnerability was found in keerti1924 Online-Book-Store-Website 1.0 and classified as problematic.CVE-2024-2267 · Other software · keerti1924 · reported by VulDBMedium 4.3
A vulnerability was found in keerti1924 Online-Book-Store-Website 1.0 and classified as problematic. This issue affects some unknown processing of the file /shop.php. The manipulation of the argument product_price leads to business logic errors. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-256037 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Online-Book-Store-Website
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2024A vulnerability has been found in keerti1924 Secret-Coder-PHP-Project 1.0 and classified as problematic.CVE-2024-2266 · Other software · keerti1924 · reported by VulDBLow 3.5
A vulnerability has been found in keerti1924 Secret-Coder-PHP-Project 1.0 and classified as problematic. This vulnerability affects unknown code of the file /login.php of the component Login Page. The manipulation of the argument emailcookie/passwordcookie leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-256036. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Secret-Coder-PHP-Project
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2024A vulnerability, which was classified as problematic, was found in keerti1924 PHP-MYSQL-User-Login-System 1.0.CVE-2024-2265 · Other software · keerti1924 · reported by VulDBMedium 5.3
A vulnerability, which was classified as problematic, was found in keerti1924 PHP-MYSQL-User-Login-System 1.0. This affects an unknown part of the file login.sql. The manipulation leads to inclusion of sensitive information in source code. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-256035. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- PHP-MYSQL-User-Login-System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2024A vulnerability, which was classified as critical, has been found in keerti1924 PHP-MYSQL-User-Login-System 1.0.CVE-2024-2264 · Other software · keerti1924 · reported by VulDBHigh 7.3
A vulnerability, which was classified as critical, has been found in keerti1924 PHP-MYSQL-User-Login-System 1.0. Affected by this issue is some unknown functionality of the file /login.php. The manipulation of the argument email leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-256034 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- PHP-MYSQL-User-Login-System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2024In the Linux kernel, the following vulnerability has been resolved: ipmi: ssif: initialize ssif_info->client early During probe ssif_info->client is dereferenCVE-2021-47095 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: ipmi: ssif: initialize ssif_info->client early During probe ssif_info->client is dereferenced in error path. However, it is set when some of the error checking has already been done. This causes following kernel crash if an error path is taken: [ 30.645593][ T674] ipmi_ssif 0-000e: ipmi_ssif: Not probing, Interface already present [ 30.657616][ T674] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000088 ... [ 30.657723][ T674] pc : __dev_printk+0x28/0xa0 [ 30.657732][ T674] lr : _dev_err+0x7c/0xa0 ... [ 30.657772][ T674] Call trace: [ 30.657775][ T674] __dev_printk+0x28/0xa0 [ 30.657778][ T674] _dev_err+0x7c/0xa0 [ 30.657781][ T674] ssif_probe+0x548/0x900 [ipmi_ssif 62ce4b08badc1458fd896206d9ef69a3c31f3d3e] [ 30.657791][ T674] i2c_device_probe+0x37c/0x3c0 ... Initialize ssif_info->client before any error path can be taken. Clear i2c_client data in the error path to prevent the dangling pointer from leaking.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Mar 3, 2024A vulnerability classified as critical was found in CodeAstro Membership Management System 1.0.CVE-2024-2149 · Other software · CodeAstro · reported by VulDBMedium 4.7
A vulnerability classified as critical was found in CodeAstro Membership Management System 1.0. This vulnerability affects unknown code of the file settings.php. The manipulation of the argument currency leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-255502 is the identifier assigned to this vulnerability.
- Product
- Membership Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2024A vulnerability was found in Bdtask Hospita AutoManager up to 20240223 and classified as problematic.CVE-2024-2135 · Other software · Bdtask · reported by VulDBLow 2.4
A vulnerability was found in Bdtask Hospita AutoManager up to 20240223 and classified as problematic. This issue affects some unknown processing of the file /hospital_activities/birth/form of the component Hospital Activities Page. The manipulation of the argument Description with the input <img src=a onerror=alert(1)> leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-255497 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Hospita AutoManager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
Mar 2, 2024A vulnerability has been found in Bdtask Hospita AutoManager up to 20240223 and classified as problematic.CVE-2024-2134 · Other software · Bdtask · reported by VulDBMedium 4.3
A vulnerability has been found in Bdtask Hospita AutoManager up to 20240223 and classified as problematic. This vulnerability affects unknown code of the file /investigation/delete/ of the component Investigation Report Handler. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-255496. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Hospita AutoManager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
Mar 2, 2024A vulnerability, which was classified as problematic, was found in Bdtask Isshue Multi Store eCommerce Shopping Cart Solution 4.0.CVE-2024-2133 · Websites & servers · Bdtask · reported by VulDBLow 2.4
A vulnerability, which was classified as problematic, was found in Bdtask Isshue Multi Store eCommerce Shopping Cart Solution 4.0. This affects an unknown part of the file /dashboard/Cinvoice/manage_invoice of the component Manage Sale Page. The manipulation of the argument Title leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-255495.
- Product
- Isshue Multi Store eCommerce Shopping Cart Solution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
Mar 1, 2024A vulnerability was found in Mini-Tmall up to 20231017 and classified as critical.CVE-2024-2074 · Other software · mini · reported by VulDBMedium 6.3
A vulnerability was found in Mini-Tmall up to 20231017 and classified as critical. This issue affects some unknown processing of the file ?r=tmall/admin/user/1/1. The manipulation of the argument orderBy leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-255389 was assigned to this vulnerability.
- Product
- mini-tmall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2024A vulnerability has been found in rahman SelectCours 1.0 and classified as problematic.CVE-2024-2064 · Other software · rahman · reported by VulDBMedium 4.3
A vulnerability has been found in rahman SelectCours 1.0 and classified as problematic. Affected by this vulnerability is the function getCacheNames of the file CacheController.java of the component Template Handler. The manipulation of the argument fragment leads to injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-255379.
- Product
- SelectCours
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2024A vulnerability has been found in Surya2Developer Online Shopping System 1.0 and classified as critical.CVE-2024-1971 · Other software · Surya2Developer · reported by VulDBHigh 7.3
A vulnerability has been found in Surya2Developer Online Shopping System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file login.php of the component POST Parameter Handler. The manipulation of the argument password with the input nochizplz'+or+1%3d1+limit+1%23 leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-255127.
- Product
- Online Shopping System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2024Directorist – WordPress Business Directory Plugin with Classified Ads Listings: Unauthorized modification of dataCVE-2024-1322 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Directorist – WordPress Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'setup_wizard' function in all versions up to, and including, 7.8.4. This makes it possible for unauthenticated attackers to recreate default pages and enable or disable monetization and change map provider.
- Product
- Directorist – WordPress Business Directory Plugin with Classified Ads Listings
- Affected
- up to 7.8.4
- What to do
- Affects up to 7.8.4. Update Directorist – WordPress Business Directory Plugin with Classified Ads Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 27, 2024A vulnerability, which was classified as critical, was found in osuuu LightPicture up to 1.2.2.CVE-2024-1921 · Other software · osuuu · reported by VulDBMedium 4.7
A vulnerability, which was classified as critical, was found in osuuu LightPicture up to 1.2.2. Affected is an unknown function of the file /app/controller/Setup.php. The manipulation leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-254856.
- Product
- LightPicture
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Feb 27, 2024A vulnerability, which was classified as critical, has been found in osuuu LightPicture up to 1.2.2.CVE-2024-1920 · Other software · osuuu · reported by VulDBMedium 5.6
A vulnerability, which was classified as critical, has been found in osuuu LightPicture up to 1.2.2. This issue affects the function handle of the file /app/middleware/TokenVerify.php. The manipulation leads to use of hard-coded cryptographic key . The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-254855.
- Product
- LightPicture
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Feb 27, 2024A vulnerability has been found in Byzoro Smart S42 Management Platform up to 20240219 and classified as critical.CVE-2024-1918 · Other software · Byzoro · reported by VulDBMedium 4.7
A vulnerability has been found in Byzoro Smart S42 Management Platform up to 20240219 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /useratte/userattestation.php. The manipulation of the argument hidwel leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-254839. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Smart S42 Management Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2024A vulnerability, which was classified as problematic, was found in CodeAstro House Rental Management System 1.0.CVE-2024-1825 · Other software · CodeAstro · reported by VulDBMedium 4.3
A vulnerability, which was classified as problematic, was found in CodeAstro House Rental Management System 1.0. This affects an unknown part of the component User Registration Page. The manipulation of the argument address with the input <img src="1" onerror="console.log(1)"> leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-254613 was assigned to this vulnerability.
- Product
- House Rental Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2024A vulnerability, which was classified as critical, has been found in CodeAstro House Rental Management System 1.0.CVE-2024-1824 · Other software · CodeAstro · reported by VulDBHigh 7.3
A vulnerability, which was classified as critical, has been found in CodeAstro House Rental Management System 1.0. Affected by this issue is some unknown functionality of the file signing.php. The manipulation of the argument uname/password leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-254612.
- Product
- House Rental Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2024A vulnerability classified as critical was found in CodeAstro Simple Voting System 1.0.CVE-2024-1823 · Other software · CodeAstro · reported by VulDBMedium 5.3
A vulnerability classified as critical was found in CodeAstro Simple Voting System 1.0. Affected by this vulnerability is an unknown functionality of the file users.php of the component Backend. The manipulation leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-254611.
- Product
- Simple Voting System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2024A vulnerability was found in CodeAstro Membership Management System 1.0 and classified as critical.CVE-2024-1818 · Other software · CodeAstro · reported by VulDBMedium 4.7
A vulnerability was found in CodeAstro Membership Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /uploads/ of the component Logo Handler. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-254606 is the identifier assigned to this vulnerability.
- Product
- Membership Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
Feb 23, 2024A vulnerability has been found in Demososo DM Enterprise Website Building System up to 2022.8 and classified as critical.CVE-2024-1817 · Other software · Demososo · reported by VulDBHigh 7.3
A vulnerability has been found in Demososo DM Enterprise Website Building System up to 2022.8 and classified as critical. Affected by this vulnerability is the function dmlogin of the file indexDM_load.php of the component Cookie Handler. The manipulation of the argument is_admin with the input y leads to improper authentication. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-254605 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- DM Enterprise Website Building System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Feb 22, 2024** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, has been found in D-Link DIR-600M C1 3.08.CVE-2024-1786 · Network & remote access · D-Link · reported by VulDBHigh 7.5
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, has been found in D-Link DIR-600M C1 3.08. Affected by this issue is some unknown functionality of the component Telnet Service. The manipulation of the argument username leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-254576. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.
- Product
- DIR-600M C1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.