Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

545new WordPress flaws this week

391,964entries in the database

4,746 results · page 52 of 95

Jul 11, 2024An Exposure of Resource to Wrong Sphere vulnerability in the sampling service of Juniper Networks Junos OS Evolved allows an unauthenticated network-based attacCVE-2024-39553 · Network & remote access · Juniper Networks · reported by sirt@juniper.netMedium 6.9
An Exposure of Resource to Wrong Sphere vulnerability in the sampling service of Juniper Networks Junos OS Evolved allows an unauthenticated network-based attacker to send arbitrary data to the device, which leads msvcsd process to crash with limited availability impacting Denial of Service (DoS) and allows unauthorized network access to the device, potentially impacting system integrity. This issue only happens when inline jflow is configured. This does not impact any forwarding traffic. The impacted services MSVCS-DB app crashes momentarily and recovers by itself. This issue affects Juniper Networks Junos OS Evolved: * 21.4 versions earlier than 21.4R3-S7-EVO; * 22.2 versions earlier than 22.2R3-S3-EVO; * 22.3 versions earlier than 22.3R3-S2-EVO; * 22.4 versions earlier than 22.4R3-EVO; * 23.2 versions earlier than 23.2R1-S2-EVO, 23.2R2-EVO.
Product
Junos OS Evolved
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record supportportal.juniper.net supportportal.juniper.net
Jul 11, 2024CWE-200: Information Exposure vulnerability exists that could cause disclosure of credentials when a specially crafted message is sent to the device.CVE-2024-6407 · Other software · Schneider Electric · reported by cybersecurity@se.comCritical 9.8
CWE-200: Information Exposure vulnerability exists that could cause disclosure of credentials when a specially crafted message is sent to the device.
Product
Wiser Home Controller WHC-5918A
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record download.schneider-electric.com download.schneider-electric.com
Jul 10, 2024Duplicator: Information exposureCVE-2024-6210 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Duplicator plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 1.5.9. This makes it possible for unauthenticated attackers to obtain the full path to instances, which they may be able to use in combination with other vulnerabilities or to simplify reconnaissance work. On its own, this information is of very limited use.
Product
Duplicator
Affected
up to 1.5.9
What to do
Affects up to 1.5.9. Update Duplicator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 10, 2024FileBird Document Library: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-37504 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Ninja Team FileBird Document Library.This issue affects FileBird Document Library: from n/a through 2.0.6.
Product
FileBird Document Library
Affected
up to 2.0.6
What to do
Affects up to 2.0.6. Update FileBird Document Library to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 10, 2024Table & Contact Form 7 Database – Tablesome: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-37498 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Pauple Table & Contact Form 7 Database – Tablesome.This issue affects Table & Contact Form 7 Database – Tablesome: from n/a through 1.0.33.
Product
Table & Contact Form 7 Database – Tablesome
Affected
up to 1.0.33
What to do
Affects up to 1.0.33. Update Table & Contact Form 7 Database – Tablesome to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 10, 2024Newspack Blocks: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-37115 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Automattic Newspack Blocks.This issue affects Newspack Blocks: from n/a through 3.0.8.
Product
Newspack Blocks
Affected
up to 3.0.8
What to do
Affects up to 3.0.8. Update Newspack Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 10, 2024WishList Member X: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-37113 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Membership Software WishList Member X.This issue affects WishList Member X: from n/a before 3.26.7.
Product
WishList Member X
Fixed in
3.26.7
What to do
Update WishList Member X to 3.26.7 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 10, 2024WishList Member X: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-37110 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Membership Software WishList Member X.This issue affects WishList Member X: from n/a before 3.26.7.
Product
WishList Member X
Fixed in
3.26.7
What to do
Update WishList Member X to 3.26.7 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 9, 2024Exposure of Sensitive Information to an Unauthorized Actor in Samsung Galaxy SmartTag2 prior to 0.20.04 allows attackes to potentially identify the tag's locatiCVE-2024-32670 · Computers, phones & browsers · Samsung · reported by PSIRT@samsung.comHigh 7
Exposure of Sensitive Information to an Unauthorized Actor in Samsung Galaxy SmartTag2 prior to 0.20.04 allows attackes to potentially identify the tag's location by scanning the BLE adversting.
Product
Galaxy SmartTag2
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityreport.samsung.com securityreport.samsung.com
Jul 9, 2024OpenSearch Dashboards Reports allows ‘Report Owner’ export and share reports from OpenSearch Dashboards.CVE-2024-39900 · Other software · opensearch-project · reported by GitHubMedium 5.4
OpenSearch Dashboards Reports allows ‘Report Owner’ export and share reports from OpenSearch Dashboards. An issue in the OpenSearch reporting plugin allows unintended access to private tenant resources like notebooks. The system did not properly check if the user was the resource author when accessing resources in a private tenant, leading to potential data being revealed. The patches are included in OpenSearch 2.14.
Product
reporting
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 9, 2024In DevmemIntUnexportCtx of devicemem_server.c, there is a possible arbitrary code execution due to a race condition.CVE-2024-34725 · Computers, phones & browsers · Google · reported by security@android.comHigh 7
In DevmemIntUnexportCtx of devicemem_server.c, there is a possible arbitrary code execution due to a race condition. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com source.android.com
Jul 9, 2024Multiple Exposure of sensitive information to an unauthorized actor weaknesses [CWE-200] vulnerability in Fortinet FortiAIOps 2.0.0 may allow an authenticated, CVE-2024-27784 · Network & remote access · Fortinet · reported by psirt@fortinet.comHigh 8.8
Multiple Exposure of sensitive information to an unauthorized actor weaknesses [CWE-200] vulnerability in Fortinet FortiAIOps 2.0.0 may allow an authenticated, remote attacker to retrieve sensitive information from the API endpoint or log files.
Product
FortiAIOps
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fortiguard.fortinet.com fortiguard.fortinet.com
Jul 9, 2024Social Sharing Plugin – Kiwi: Information ExposureCVE-2024-3228 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Social Sharing Plugin – Kiwi plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.1.7 via the 'kiwi-nw-pinterest' class. This makes it possible for unauthenticated attackers to view limited content from password protected posts.
Product
Social Sharing Plugin – Kiwi
Affected
up to 2.1.7
What to do
Affects up to 2.1.7. Update Social Sharing Plugin – Kiwi to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 4, 2024Information exposure vulnerability in the MRW plugin, in its 5.4.3 version, affecting the "mrw_log" functionality.CVE-2024-6506 · Other software · MRW · reported by cve-coordination@incibe.esHigh 8.2
Information exposure vulnerability in the MRW plugin, in its 5.4.3 version, affecting the "mrw_log" functionality. This vulnerability could allow a remote attacker to obtain other customers' order information and access sensitive information such as name and phone number. This vulnerability also allows an attacker to create or overwrite shipping labels.
Product
MRW plugin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record incibe.es incibe.es
Jul 3, 2024Insecure Permissions vulnerability in Micro-Star International Co., Ltd MSI Center v.2.0.36.0 allows a local attacker to escalate privileges via the Export SystCVE-2024-37726 · Other software · micro_star_international_co · reported by MITREMedium 6.8
Insecure Permissions vulnerability in Micro-Star International Co., Ltd MSI Center v.2.0.36.0 allows a local attacker to escalate privileges via the Export System Info function in MSI.CentralServer.exe
Product
msi_center
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 3, 2024Information exposure vulnerability in MESbook 20221021.03 version, the exploitation of which could allow a local attacker, with user privileges, to access diffeCVE-2024-6426 · Other software · MESbook · reported by cve-coordination@incibe.esHigh 8.1
Information exposure vulnerability in MESbook 20221021.03 version, the exploitation of which could allow a local attacker, with user privileges, to access different resources by changing the API value of the application.
Product
MESbook
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record incibe.es incibe.es
Jul 2, 2024Improper verification of intent by broadcast receiver vulnerability in GalaxyStore prior to version 4.5.81.0 allows local attackers to launch unexported activitCVE-2024-34601 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5.9
Improper verification of intent by broadcast receiver vulnerability in GalaxyStore prior to version 4.5.81.0 allows local attackers to launch unexported activities of GalaxyStore.
Product
GalaxyStore
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com security.samsungmobile.com
Jul 2, 2024Exposure of sensitive information in proc file system prior to SMR Jul-2024 Release 1 allows local attackers to read kernel memory address.CVE-2024-34594 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5.5
Exposure of sensitive information in proc file system prior to SMR Jul-2024 Release 1 allows local attackers to read kernel memory address.
Product
Samsung Mobile Devices
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com security.samsungmobile.com
Jul 2, 2024Inadequate input validation exposes the system to potential remote code execution (RCE) risks.CVE-2023-41917 · Other software · Kiloview · reported by cert@ncsc.nlCritical 10
Inadequate input validation exposes the system to potential remote code execution (RCE) risks. Attackers can exploit this vulnerability by appending shell commands to the Speed-Measurement feature, enabling unauthorized code execution.
Product
P1/P2
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record advisories.ncsc.nl advisories.ncsc.nl
Jul 1, 2024In JetBrains TeamCity before 2024.03.3 application token could be exposed in EC2 Cloud Profile settingsCVE-2024-39879 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5
In JetBrains TeamCity before 2024.03.3 application token could be exposed in EC2 Cloud Profile settings
Product
TeamCity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jetbrains.com jetbrains.com
Jul 1, 2024In JetBrains TeamCity before 2024.03.3 private key could be exposed via testing GitHub App ConnectionCVE-2024-39878 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.1
In JetBrains TeamCity before 2024.03.3 private key could be exposed via testing GitHub App Connection
Product
TeamCity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jetbrains.com jetbrains.com
Jun 29, 2024Advanced File Manager: Sensitive Information ExposureCVE-2024-5598 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Advanced File Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.2.4 via the 'fma_local_file_system' function. This makes it possible for unauthenticated attackers to extract sensitive data including backups or other sensitive information if the files have been moved to the built-in Trash folder.
Product
Advanced File Manager
Affected
up to 5.2.4
What to do
Affects up to 5.2.4. Update Advanced File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 28, 2024Vanna v0.3.4 is vulnerable to SQL injection in its DuckDB integration exposed to its Flask Web APIs.CVE-2024-5827 · Other software · vanna-ai · reported by security@huntr.devCritical 9.8
Vanna v0.3.4 is vulnerable to SQL injection in its DuckDB integration exposed to its Flask Web APIs. Attackers can inject malicious SQL training data and generate corresponding queries to write arbitrary files on the victim's file system, such as backdoor.php with contents `<?php system($_GET[0]); ?>`. This can lead to command execution or the creation of backdoors.
Product
vanna-ai/vanna
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record huntr.com huntr.com
Jun 28, 2024IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.4 agent username and password error response discrepancy exposes product to brute force enumeration.CVE-2024-38322 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.4 agent username and password error response discrepancy exposes product to brute force enumeration. IBM X-Force ID: 294869.
Product
Storage Defender - Resiliency Service
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com
Jun 28, 2024SEO SIMPLE PACK: Information ExposureCVE-2024-2795 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The SEO SIMPLE PACK plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.2.1 via META description. This makes it possible for unauthenticated attackers to extract limited information about password protected posts.
Product
SEO SIMPLE PACK
Affected
up to 3.2.1
What to do
Affects up to 3.2.1. Update SEO SIMPLE PACK to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jun 27, 2024PTC Creo Elements/Direct License Server exposes a web interface which can be used by unauthenticated remote attackers to execute arbitrary OS commands on the seCVE-2024-6071 · Other software · PTC · reported by ics-cert@hq.dhs.govCritical 10
PTC Creo Elements/Direct License Server exposes a web interface which can be used by unauthenticated remote attackers to execute arbitrary OS commands on the server.
Product
Creo Elements/Direct License
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov ptc.com
Jun 27, 2024VMware Workspace One UEM update addresses an information exposure vulnerability.CVE-2024-22260 · Other software · vmware · reported by security@vmware.comMedium 6.8
VMware Workspace One UEM update addresses an information exposure vulnerability. A malicious actor with network access to the Workspace One UEM may be able to perform an attack resulting in an information exposure.
Product
workspace_one_uem
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record vmware.com vmware.com
Jun 26, 2024Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), CWE - 200 - Exposure of Sensitive Information to an Unauthorized Actor, CWCVE-2024-4228 · Other software · Magarsus Consultancy · reported by iletisim@usom.gov.trCritical 9.8
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), CWE - 200 - Exposure of Sensitive Information to an Unauthorized Actor, CWE - 522 - Insufficiently Protected Credentials vulnerability in Magarsus Consultancy SSO (Single Sign On) allows SQL Injection. This issue affects SSO (Single Sign On): from 1.0 before 1.1.
Product
SSO (Single Sign On)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record siberguvenlik.gov.tr usom.gov.tr
Jun 24, 2024An issue in Wavlink WN551K1 allows a remote attacker to obtain sensitive information via the ExportAllSettings.sh component.CVE-2024-38892 · Other software · wavlink · reported by MITREMedium 6.5
An issue in Wavlink WN551K1 allows a remote attacker to obtain sensitive information via the ExportAllSettings.sh component.
Product
wn551k1_firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 21, 2024Event Management Tickets Booking: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-5059 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in A WP Life Event Management Tickets Booking.This issue affects Event Management Tickets Booking: from n/a through 1.4.0.
Product
Event Management Tickets Booking
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update Event Management Tickets Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 21, 2024phpinfo() WP: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-35776 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Exeebit phpinfo() WP.This issue affects phpinfo() WP: from n/a through 5.0.
Product
phpinfo() WP
Affected
up to 5.0
What to do
Affects up to 5.0. Update phpinfo() WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024Export WP Page to Static HTML/CSS: Open RedirectCVE-2024-3597 · WordPress plugins & themes · reported by WordfenceHigh 7.1
The Export WP Page to Static HTML/CSS plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 2.2.2. This is due to insufficient validation on the redirect url supplied via the rc_exported_zip_file parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.
Product
Export WP Page to Static HTML/CSS
Affected
up to 2.2.2
What to do
Affects up to 2.2.2. Update Export WP Page to Static HTML/CSS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 19, 2024In the module "Bulk Export products to Google Merchant-Google Shopping" (bagoogleshopping) up to version 1.0.26 from Buy Addons for PrestaShop, a guest can perfCVE-2024-34993 · Other software · bamboosolutions · reported by MITREMedium 6.3
In the module "Bulk Export products to Google Merchant-Google Shopping" (bagoogleshopping) up to version 1.0.26 from Buy Addons for PrestaShop, a guest can perform SQL injection via`GenerateCategories::renderCategories().
Product
bulk_export
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 18, 2024Johan Fagerström, member of the AXIS OS Bug Bounty Program, has found that a O3C feature may expose sensitive traffic between the client (Axis device) and (O3C)CVE-2024-0066 · Other software · Axis Communications AB · reported by product-security@axis.comMedium 5.3
Johan Fagerström, member of the AXIS OS Bug Bounty Program, has found that a O3C feature may expose sensitive traffic between the client (Axis device) and (O3C) server. If O3C is not being used this flaw does not apply. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.
Product
AXIS OS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record axis.com axis.com
Jun 17, 2024A Prototype Pollution issue in flatten-json 1.0.1 allows an attacker to execute arbitrary code via module.exports.unflattenJSON (flatten-json/index.js:42)CVE-2024-36574 · Other software · amirziai · reported by MITREMedium 6.3
A Prototype Pollution issue in flatten-json 1.0.1 allows an attacker to execute arbitrary code via module.exports.unflattenJSON (flatten-json/index.js:42)
Product
flatten_json
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com gist.github.com
Jun 17, 2024Improper removal of sensitive information in data source export feature in Devolutions Remote Desktop Manager 2024.1.32.0 and earlier on Windows allows an attacCVE-2024-6055 · Other software · Devolutions · reported by security@devolutions.netMedium 4.7
Improper removal of sensitive information in data source export feature in Devolutions Remote Desktop Manager 2024.1.32.0 and earlier on Windows allows an attacker that obtains the exported settings to recover powershell credentials configured on the data source via stealing the configuration file.
Product
Remote Desktop Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record devolutions.net devolutions.net
Jun 16, 2024In SonarQube before 10.4 and 9.9.4 LTA, encrypted values generated using the Settings Encryption feature are potentially exposed in cleartext as part of the URLCVE-2024-38460 · Other software · Sonarsource · reported by MITREMedium 4.9
In SonarQube before 10.4 and 9.9.4 LTA, encrypted values generated using the Settings Encryption feature are potentially exposed in cleartext as part of the URL parameters in the logs (such as SonarQube Access Logs, Proxy Logs, etc).
Product
Sonarqube
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.sonarsource.com sonarsource.atlassian.net
Jun 13, 2024NVIDIA GPU software for Linux contains a vulnerability where it can expose sensitive information to an actor that is not explicitly authorized to have access toCVE-2024-0093 · Other software · nvidia · reported by psirt@nvidia.comMedium 6.5
NVIDIA GPU software for Linux contains a vulnerability where it can expose sensitive information to an actor that is not explicitly authorized to have access to that information. A successful exploit of this vulnerability might lead to information disclosure.
Product
vGPU software and Cloud Gaming
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nvidia.custhelp.com nvidia.custhelp.com
Jun 13, 2024Dell SCG, versions prior to 5.24.00.00, contain an Improper Access Control vulnerability in the SCG exposed for an internal update REST API (if enabled by AdminCVE-2024-28969 · Other software · Dell · reported by security_alert@emc.comMedium 4.3
Dell SCG, versions prior to 5.24.00.00, contain an Improper Access Control vulnerability in the SCG exposed for an internal update REST API (if enabled by Admin user from UI). A remote low privileged attacker could potentially exploit this vulnerability, leading to the execution of certain APIs applicable only for Admin Users on the application's backend database that could potentially allow an unauthorized user access to restricted resources.
Product
Secure Connect Gateway-Application
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record dell.com dell.com
Jun 13, 2024Dell SCG, versions prior to 5.24.00.00, contain an Improper Access Control vulnerability in the SCG exposed for internal email and collection settings REST APIsCVE-2024-28968 · Other software · Dell · reported by security_alert@emc.comMedium 5.4
Dell SCG, versions prior to 5.24.00.00, contain an Improper Access Control vulnerability in the SCG exposed for internal email and collection settings REST APIs (if enabled by Admin user from UI). A remote low privileged attacker could potentially exploit this vulnerability, leading to the execution of certain APIs applicable only for Admin Users on the application's backend database that could potentially allow an unauthorized user access to restricted resources and change of state.
Product
Secure Connect Gateway-Application
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record dell.com dell.com
Jun 13, 2024Dell SCG, versions prior to 5.24.00.00, contain an Improper Access Control vulnerability in the SCG exposed for an internal maintenance REST API (if enabled by CVE-2024-28967 · Other software · Dell · reported by security_alert@emc.comMedium 5.4
Dell SCG, versions prior to 5.24.00.00, contain an Improper Access Control vulnerability in the SCG exposed for an internal maintenance REST API (if enabled by Admin user from UI). A remote low privileged attacker could potentially exploit this vulnerability, leading to the execution of certain APIs applicable only for Admin Users on the application's backend database that could potentially allow an unauthorized user access to restricted resources and change of state.
Product
Secure Connect Gateway-Application
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record dell.com dell.com
Jun 13, 2024Dell SCG, versions prior to 5.24.00.00, contain an Improper Access Control vulnerability in the SCG exposed for an internal update REST API (if enabled by AdminCVE-2024-28966 · Other software · Dell · reported by security_alert@emc.comMedium 5.4
Dell SCG, versions prior to 5.24.00.00, contain an Improper Access Control vulnerability in the SCG exposed for an internal update REST API (if enabled by Admin user from UI). A remote low privileged attacker could potentially exploit this vulnerability, leading to the execution of certain APIs applicable only for Admin Users on the application's backend database that could potentially allow an unauthorized user access to restricted resources and change of state.
Product
Secure Connect Gateway-Application
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record dell.com dell.com
Jun 13, 2024Dell SCG, versions prior to 5.24.00.00, contain an Improper Access Control vulnerability in the SCG exposed for an internal enable REST API (if enabled by AdminCVE-2024-28965 · Other software · Dell · reported by security_alert@emc.comMedium 5.4
Dell SCG, versions prior to 5.24.00.00, contain an Improper Access Control vulnerability in the SCG exposed for an internal enable REST API (if enabled by Admin user from UI). A remote low privileged attacker could potentially exploit this vulnerability, leading to the execution of certain Internal APIs applicable only for Admin Users on the application's backend database that could potentially allow an unauthorized user access to restricted resources and change of state.
Product
Secure Connect Gateway-Application
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record dell.com dell.com
Jun 13, 2024Adobe Framemaker Publishing Server versions 2020.3, 2022.2 and earlier are affected by an Information Exposure vulnerability (CWE-200) that could lead to privilCVE-2024-30300 · Other software · Adobe · reported by AdobeCritical 9.8
Adobe Framemaker Publishing Server versions 2020.3, 2022.2 and earlier are affected by an Information Exposure vulnerability (CWE-200) that could lead to privilege escalation. An attacker could exploit this vulnerability to gain access to sensitive information which may include system or user privileges. Exploitation of this issue does not require user interaction.
Product
Adobe Framemaker Publishing Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record helpx.adobe.com helpx.adobe.com
Jun 13, 2024Easy WP SMTP by SendLayer – WordPress SMTP and Email Log: Information exposureCVE-2024-3073 · WordPress plugins & themes · reported by WordfenceLow 2.7
The Easy WP SMTP by SendLayer – WordPress SMTP and Email Log Plugin plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 2.3.0. This is due to plugin providing the SMTP password in the SMTP Password field when viewing the settings. This makes it possible for authenticated attackers, with administrative-level access and above, to view the SMTP password for the supplied server. Although this would not be useful for attackers in most cases, if an administrator account becomes compromised this could be useful information to an attacker in a limited environment.
Product
Easy WP SMTP by SendLayer – WordPress SMTP and Email Log
Affected
up to 2.3.0
What to do
Affects up to 2.3.0. Update Easy WP SMTP by SendLayer – WordPress SMTP and Email Log to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 12, 2024A problem with the Palo Alto Networks GlobalProtect app can result in exposure of encrypted user credentials, used for connecting to GlobalProtect, in applicatiCVE-2024-5908 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comMedium 5.5
A problem with the Palo Alto Networks GlobalProtect app can result in exposure of encrypted user credentials, used for connecting to GlobalProtect, in application logs. Normally, these application logs are only viewable by local users and are included when generating logs for troubleshooting purposes. This means that these encrypted credentials are exposed to recipients of the application logs.
Product
GlobalProtect App
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.paloaltonetworks.com security.paloaltonetworks.com
Jun 12, 2024CWE-532: Insertion of Sensitive Information into Log File vulnerability exists that could cause exposure of SNMP credentials when an attacker has access to the CVE-2024-5557 · Other software · Schneider Electric · reported by cybersecurity@se.comMedium 4.5
CWE-532: Insertion of Sensitive Information into Log File vulnerability exists that could cause exposure of SNMP credentials when an attacker has access to the controller logs.
Product
SpaceLogic AS-P
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record download.schneider-electric.com download.schneider-electric.com
Jun 12, 2024CWE-668: Exposure of the Resource Wrong Sphere vulnerability exists that exposes a SSH interface over the product network interface.CVE-2024-5313 · Other software · Schneider Electric · reported by cybersecurity@se.comMedium 6.5
CWE-668: Exposure of the Resource Wrong Sphere vulnerability exists that exposes a SSH interface over the product network interface. This does not allow to directly exploit the product or make any unintended operation as the SSH interface access is protected by an authentication mechanism. Impacts are limited to port scanning and fingerprinting activities as well as attempts to perform a potential denial of service attack on the exposed SSH interface.
Product
EVlink Home Smart
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record download.schneider-electric.com download.schneider-electric.com
Jun 11, 2024Import and export users and customers: Missing AuthorizationCVE-2024-34815 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Javier Carazo Import and export users and customers import-users-from-csv-with-meta.This issue affects Import and export users and customers: from n/a through <= 1.26.5.
Product
Import and export users and customers
Affected
up to 1.26.5
What to do
Affects up to 1.26.5. Update Import and export users and customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 11, 2024Aspose.Words Exporter: Missing AuthorizationCVE-2024-32146 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Aspose.Cloud Marketplace Aspose.Words Exporter.This issue affects Aspose.Words Exporter: from n/a through 6.3.1.
Product
Aspose.Words Exporter
Affected
up to 6.3.1
What to do
Affects up to 6.3.1. Update Aspose.Words Exporter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.