Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,303 results · page 52 of 87
Feb 22, 2024A vulnerability classified as problematic was found in Limbas 5.2.14.CVE-2024-1784 · Other software · limbas · reported by VulDBLow 3.9
A vulnerability classified as problematic was found in Limbas 5.2.14. Affected by this vulnerability is an unknown functionality of the file main_admin.php. The manipulation of the argument tab_group leads to sql injection. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-254575. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- limbas
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 22, 2024A vulnerability classified as critical has been found in Totolink LR1200GB 9.1.0u.6619_B20230130/9.3.5u.6698_B20230810.CVE-2024-1783 · Other software · Totolink · reported by VulDBCritical 9.8
A vulnerability classified as critical has been found in Totolink LR1200GB 9.1.0u.6619_B20230130/9.3.5u.6698_B20230810. Affected is the function loginAuth of the file /cgi-bin/cstecgi.cgi of the component Web Interface. The manipulation of the argument http_host leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-254574 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- LR1200GB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Feb 22, 2024A vulnerability, which was classified as critical, was found in TemmokuMVC up to 2.3.CVE-2024-1750 · Other software · Temmokumvc · reported by VulDBMedium 5.6
A vulnerability, which was classified as critical, was found in TemmokuMVC up to 2.3. Affected is the function get_img_url/img_replace in the library lib/images_get_down.php of the component Image Download Handler. The manipulation leads to deserialization. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-254532. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Temmokumvc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Feb 22, 2024A vulnerability, which was classified as problematic, has been found in Bdtask Bhojon Best Restaurant Management Software 2.9.CVE-2024-1749 · Other software · Bdtask · reported by VulDBLow 2.4
A vulnerability, which was classified as problematic, has been found in Bdtask Bhojon Best Restaurant Management Software 2.9. This issue affects some unknown processing of the file /dashboard/message of the component Message Page. The manipulation of the argument Title leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-254531. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Bhojon Best Restaurant Management Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
Feb 22, 2024A vulnerability classified as critical was found in van_der_Schaar LAB AutoPrognosis 0.1.21.CVE-2024-1748 · Other software · van_der_Schaar LAB · reported by VulDBMedium 5
A vulnerability classified as critical was found in van_der_Schaar LAB AutoPrognosis 0.1.21. This vulnerability affects the function load_model_from_file of the component Release Note Handler. The manipulation leads to deserialization. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. VDB-254530 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AutoPrognosis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2024A vulnerability, which was classified as problematic, was found in GARO WALLBOX GLB+ T2EV7 0.5.CVE-2024-1707 · Other software · GARO · reported by VulDBMedium 4.3
A vulnerability, which was classified as problematic, was found in GARO WALLBOX GLB+ T2EV7 0.5. This affects an unknown part of the file /index.jsp#settings of the component Software Update Handler. The manipulation of the argument Reference leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-254397 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- WALLBOX GLB+ T2EV7
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Feb 21, 2024A vulnerability was found in keerti1924 PHP-MYSQL-User-Login-System 1.0 and classified as critical.CVE-2024-1702 · Other software · keerti1924 · reported by VulDBMedium 6.3
A vulnerability was found in keerti1924 PHP-MYSQL-User-Login-System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /edit.php. The manipulation leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-254390 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- PHP-MYSQL-User-Login-System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2024A vulnerability has been found in keerti1924 PHP-MYSQL-User-Login-System 1.0 and classified as critical.CVE-2024-1701 · Other software · keerti1924 · reported by VulDBMedium 5.3
A vulnerability has been found in keerti1924 PHP-MYSQL-User-Login-System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /edit.php. The manipulation leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-254389 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- PHP-MYSQL-User-Login-System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2024A vulnerability, which was classified as problematic, was found in keerti1924 PHP-MYSQL-User-Login-System 1.0.CVE-2024-1700 · Other software · keerti1924 · reported by VulDBMedium 4.3
A vulnerability, which was classified as problematic, was found in keerti1924 PHP-MYSQL-User-Login-System 1.0. Affected is an unknown function of the file /signup.php. The manipulation of the argument username with the input <script>alert("xss")</script> leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-254388. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- PHP-MYSQL-User-Login-System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2024A vulnerability classified as problematic was found in Totolink X6000R 9.4.0cu.852_B20230719.CVE-2024-1661 · Other software · Totolink · reported by VulDBLow 2.5
A vulnerability classified as problematic was found in Totolink X6000R 9.4.0cu.852_B20230719. Affected by this vulnerability is an unknown functionality of the file /etc/shadow. The manipulation leads to hard-coded credentials. It is possible to launch the attack on the local host. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-254179. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- X6000R
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2024A vulnerability, which was classified as critical, has been found in ECshop 4.1.8.CVE-2024-1530 · Other software · Shopex · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in ECshop 4.1.8. Affected by this issue is some unknown functionality of the file /admin/view_sendlist.php. The manipulation leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-250562 is the identifier assigned to this vulnerability.
- Product
- Ecshop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2024 When a BIG-IP PEM classification profile is configured on a UDP virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to teCVE-2024-23982 · Network & remote access · F5 · reported by f5sirt@f5.comHigh 7.5
When a BIG-IP PEM classification profile is configured on a UDP virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. This issue affects classification engines using signatures released between 09-08-2022 and 02-16-2023. See the table in the F5 Security Advisory for a complete list of affected classification signature files. NOTE: Software versions which have reached End of Technical Support (EoTS) are not evaluated
- Product
- BIG-IP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2024A vulnerability, which was classified as problematic, has been found in dbartholomae lambda-middleware frameguard up to 1.0.4.CVE-2021-4437 · Other software · dbartholomae · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in dbartholomae lambda-middleware frameguard up to 1.0.4. Affected by this issue is some unknown functionality of the file packages/json-deserializer/src/JsonDeserializer.ts of the component JSON Mime-Type Handler. The manipulation leads to inefficient regular expression complexity. Upgrading to version 1.1.0 is able to address this issue. The patch is identified as f689404d830cbc1edd6a1018d3334ff5f44dc6a6. It is recommended to upgrade the affected component. VDB-253406 is the identifier assigned to this vulnerability.
- Product
- lambda-middleware frameguard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2024A vulnerability, which was classified as problematic, was found in KDE Plasma Workspace up to 5.93.0.CVE-2024-1433 · Other software · KDE · reported by VulDBLow 3.1
A vulnerability, which was classified as problematic, was found in KDE Plasma Workspace up to 5.93.0. This affects the function EventPluginsManager::enabledPlugins of the file components/calendar/eventpluginsmanager.cpp of the component Theme File Handler. The manipulation of the argument pluginId leads to path traversal. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The patch is named 6cdf42916369ebf4ad5bd876c4dfa0170d7b2f01. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-253407. NOTE: This requires write access to user's home or the installation of third party global themes.
- Product
- Plasma Workspace
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2024** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in DeepFaceLab pretrained DF.wf.288res.384.92.72.22 and classified as problematic.CVE-2024-1432 · Other software · Iperov · reported by VulDBMedium 5
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in DeepFaceLab pretrained DF.wf.288res.384.92.72.22 and classified as problematic. This issue affects the function apply_xseg of the file main.py. The manipulation leads to deserialization. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-253391. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- Deepfacelab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2024A vulnerability was found in Netgear R7000 1.0.11.136_10.2.120 and classified as problematic.CVE-2024-1431 · Network & remote access · Netgear · reported by VulDBMedium 4.3
A vulnerability was found in Netgear R7000 1.0.11.136_10.2.120 and classified as problematic. Affected by this issue is some unknown functionality of the file /debuginfo.htm of the component Web Management Interface. The manipulation leads to information disclosure. The exploit has been disclosed to the public and may be used. VDB-253382 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- R7000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2024A vulnerability has been found in Netgear R7000 1.0.11.136_10.2.120 and classified as problematic.CVE-2024-1430 · Network & remote access · Netgear · reported by VulDBMedium 5.3
A vulnerability has been found in Netgear R7000 1.0.11.136_10.2.120 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /currentsetting.htm of the component Web Management Interface. The manipulation leads to information disclosure. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- R7000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2024A vulnerability was found in Linksys WRT54GL 4.30.18 and classified as problematic.CVE-2024-1404 · Network & remote access · Linksys · reported by VulDBMedium 4.3
A vulnerability was found in Linksys WRT54GL 4.30.18 and classified as problematic. Affected by this issue is some unknown functionality of the file /SysInfo.htm of the component Web Management Interface. The manipulation leads to information disclosure. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-253328. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- WRT54GL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2024A vulnerability, which was classified as critical, has been found in PHPEMS up to 1.0.CVE-2024-1353 · Websites & servers · Phpems · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in PHPEMS up to 1.0. Affected by this issue is the function index of the file app/weixin/controller/index.api.php. The manipulation of the argument picurl leads to deserialization. The exploit has been disclosed to the public and may be used. VDB-253226 is the identifier assigned to this vulnerability.
- Product
- Phpems
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Feb 6, 2024A vulnerability, which was classified as critical, was found in CodeAstro Restaurant POS System 1.0.CVE-2024-1268 · Other software · CodeAstro · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, was found in CodeAstro Restaurant POS System 1.0. This affects an unknown part of the file update_product.php. The manipulation leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-253011.
- Product
- Restaurant POS System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
Feb 6, 2024A vulnerability, which was classified as problematic, has been found in CodeAstro Restaurant POS System 1.0.CVE-2024-1267 · Other software · CodeAstro · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in CodeAstro Restaurant POS System 1.0. Affected by this issue is some unknown functionality of the file create_account.php. The manipulation of the argument Full Name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-253010 is the identifier assigned to this vulnerability.
- Product
- Restaurant POS System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
Feb 6, 2024A vulnerability classified as problematic was found in CodeAstro University Management System 1.0.CVE-2024-1266 · Other software · CodeAstro · reported by VulDBLow 2.4
A vulnerability classified as problematic was found in CodeAstro University Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /st_reg.php of the component Student Registration Form. The manipulation of the argument Address leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-253009 was assigned to this vulnerability.
- Product
- University Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
Feb 6, 2024A vulnerability classified as problematic has been found in CodeAstro University Management System 1.0.CVE-2024-1265 · Other software · CodeAstro · reported by VulDBLow 2.4
A vulnerability classified as problematic has been found in CodeAstro University Management System 1.0. Affected is an unknown function of the file /att_add.php of the component Attendance Management. The manipulation of the argument Student Name leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-253008.
- Product
- University Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
Feb 6, 2024A vulnerability has been found in Juanpao JPShop up to 1.5.02 and classified as critical.CVE-2024-1264 · Other software · Juanpao · reported by VulDBMedium 6.3
A vulnerability has been found in Juanpao JPShop up to 1.5.02 and classified as critical. Affected by this vulnerability is the function actionUpdate of the file /api/controllers/common/UploadsController.php. The manipulation of the argument imgage leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-253003.
- Product
- JPShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Feb 6, 2024A vulnerability, which was classified as critical, was found in Juanpao JPShop up to 1.5.02.CVE-2024-1263 · Other software · Juanpao · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, was found in Juanpao JPShop up to 1.5.02. Affected is the function actionUpdate of the file /api/controllers/merchant/shop/PosterController.php of the component API. The manipulation of the argument pic_url leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-253002 is the identifier assigned to this vulnerability.
- Product
- JPShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Feb 6, 2024A vulnerability, which was classified as critical, has been found in Juanpao JPShop up to 1.5.02.CVE-2024-1262 · Other software · Juanpao · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in Juanpao JPShop up to 1.5.02. This issue affects the function actionUpdate of the file /api/controllers/merchant/design/MaterialController.php of the component API. The manipulation of the argument pic_url leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-253001 was assigned to this vulnerability.
- Product
- JPShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Feb 6, 2024A vulnerability classified as critical was found in Juanpao JPShop up to 1.5.02.CVE-2024-1261 · Other software · Juanpao · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in Juanpao JPShop up to 1.5.02. This vulnerability affects the function actionIndex of the file /api/controllers/merchant/app/ComboController.php of the component API. The manipulation of the argument pic_url leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-253000.
- Product
- JPShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Feb 6, 2024A vulnerability classified as critical has been found in Juanpao JPShop up to 1.5.02.CVE-2024-1260 · Other software · Juanpao · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in Juanpao JPShop up to 1.5.02. This affects the function actionIndex of the file /api/controllers/admin/app/ComboController.php of the component API. The manipulation of the argument pic_url leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252999.
- Product
- JPShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Feb 6, 2024A vulnerability was found in Jspxcms 10.2.0 and classified as problematic.CVE-2024-1256 · Other software · Ujcms · reported by VulDBLow 3.5
A vulnerability was found in Jspxcms 10.2.0 and classified as problematic. This issue affects some unknown processing of the file /ext/collect/filter_text.do. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252995.
- Product
- Jspxcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2024A vulnerability has been found in sepidz SepidzDigitalMenu up to 7.1.0728.1 and classified as problematic.CVE-2024-1255 · Other software · sepidz · reported by VulDBMedium 5.3
A vulnerability has been found in sepidz SepidzDigitalMenu up to 7.1.0728.1 and classified as problematic. This vulnerability affects unknown code of the file /Waiters. The manipulation leads to information disclosure. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-252994 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- SepidzDigitalMenu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2024A vulnerability, which was classified as critical, was found in Byzoro Smart S20 Management Platform up to 20231120.CVE-2024-1254 · Other software · Byzoro · reported by VulDBMedium 4.7
A vulnerability, which was classified as critical, was found in Byzoro Smart S20 Management Platform up to 20231120. This affects an unknown part of the file /sysmanage/sysmanageajax.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-252993 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Smart S20 Management Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2024A vulnerability, which was classified as critical, has been found in Byzoro Smart S40 Management Platform up to 20240126.CVE-2024-1253 · Other software · Byzoro · reported by VulDBMedium 4.7
A vulnerability, which was classified as critical, has been found in Byzoro Smart S40 Management Platform up to 20240126. Affected by this issue is some unknown functionality of the file /useratte/web.php of the component Import Handler. The manipulation of the argument file_upload leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252992. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Smart S40 Management Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2024A vulnerability classified as critical was found in Tongda OA 2017 up to 11.9.CVE-2024-1252 · Other software · Tongda · reported by VulDBMedium 5.5
A vulnerability classified as critical was found in Tongda OA 2017 up to 11.9. Affected by this vulnerability is an unknown functionality of the file /general/attendance/manage/ask_duty/delete.php. The manipulation of the argument ASK_DUTY_ID leads to sql injection. The exploit has been disclosed to the public and may be used. Upgrading to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-252991.
- Product
- OA 2017
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2024A vulnerability classified as critical has been found in Tongda OA 2017 up to 11.10.CVE-2024-1251 · Other software · Tongda · reported by VulDBMedium 5.5
A vulnerability classified as critical has been found in Tongda OA 2017 up to 11.10. Affected is an unknown function of the file /general/email/outbox/delete.php. The manipulation of the argument DELETE_STR leads to sql injection. The exploit has been disclosed to the public and may be used. VDB-252990 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- OA 2017
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2024A vulnerability classified as critical was found in QiboSoft QiboCMS X1 up to 1.0.6.CVE-2024-1225 · Other software · QiboSoft · reported by VulDBHigh 7.3
A vulnerability classified as critical was found in QiboSoft QiboCMS X1 up to 1.0.6. Affected by this vulnerability is the function rmb_pay of the file /application/index/controller/Pay.php. The manipulation of the argument callback_class leads to deserialization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252847. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- QiboCMS X1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Feb 4, 2024A vulnerability was found in planet-freo up to 20150116 and classified as problematic.CVE-2015-10129 · Other software · samwilson · reported by VulDBLow 3.7
A vulnerability was found in planet-freo up to 20150116 and classified as problematic. Affected by this issue is some unknown functionality of the file admin/inc/auth.inc.php. The manipulation of the argument auth leads to incorrect comparison. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The name of the patch is 6ad38c58a45642eb8c7844e2f272ef199f59550d. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-252716.
- Product
- planet-freo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2024A vulnerability was found in Jspxcms 10.2.0 and classified as problematic.CVE-2024-1200 · Other software · jspxcms · reported by VulDBMedium 5.3
A vulnerability was found in Jspxcms 10.2.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /template/1/default/. The manipulation leads to information disclosure. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-252698 is the identifier assigned to this vulnerability.
- Product
- jspxcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2024A vulnerability has been found in CodeAstro Employee Task Management System 1.0 and classified as problematic.CVE-2024-1199 · Other software · CodeAstro · reported by VulDBMedium 5.4
A vulnerability has been found in CodeAstro Employee Task Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file \employee-tasks-php\attendance-info.php. The manipulation of the argument aten_id leads to denial of service. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-252697 was assigned to this vulnerability.
- Product
- Employee Task Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2024A vulnerability, which was classified as critical, was found in openBI up to 6.0.3.CVE-2024-1198 · Other software · Openbi · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, was found in openBI up to 6.0.3. Affected is the function addxinzhi of the file application/controllers/User.php of the component Phar Handler. The manipulation of the argument outimgurl leads to deserialization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252696.
- Product
- Openbi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Feb 2, 2024A vulnerability classified as critical was found in iTop VPN up to 4.0.0.1.CVE-2024-1195 · Other software · iTop · reported by VulDBMedium 5.5
A vulnerability classified as critical was found in iTop VPN up to 4.0.0.1. Affected by this vulnerability is an unknown functionality in the library ITopVpnCallbackProcess.sys of the component IOCTL Handler. The manipulation leads to denial of service. The attack needs to be approached locally. The identifier VDB-252685 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- VPN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2024A vulnerability classified as problematic has been found in Armcode AlienIP 2.41.CVE-2024-1194 · Computers, phones & browsers · Armcode · reported by VulDBLow 3.3
A vulnerability classified as problematic has been found in Armcode AlienIP 2.41. Affected is an unknown function of the component Locate Host Handler. The manipulation leads to denial of service. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252684. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AlienIP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2024A vulnerability was found in Global Scape CuteFTP 9.3.0.3 and classified as problematic.CVE-2024-1190 · Other software · Global Scape · reported by VulDBLow 3.3
A vulnerability was found in Global Scape CuteFTP 9.3.0.3 and classified as problematic. Affected by this issue is some unknown functionality. The manipulation of the argument Host/Username/Password leads to denial of service. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252680. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- CuteFTP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2024A vulnerability has been found in AMPPS 2.7 and classified as problematic.CVE-2024-1189 · Other software · Softaculous · reported by VulDBMedium 5.3
A vulnerability has been found in AMPPS 2.7 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Encryption Passphrase Handler. The manipulation leads to denial of service. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.0 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-252679. NOTE: The vendor explains that AMPPS 4.0 is a complete overhaul and the code was re-written.
- Product
- Ampps
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2024A vulnerability, which was classified as problematic, was found in Rizone Soft Notepad3 1.0.2.350.CVE-2024-1188 · Other software · Rizone Soft · reported by VulDBLow 3.3
A vulnerability, which was classified as problematic, was found in Rizone Soft Notepad3 1.0.2.350. Affected is an unknown function of the component Encryption Passphrase Handler. The manipulation leads to denial of service. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. VDB-252678 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Notepad3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2024A vulnerability, which was classified as problematic, has been found in Munsoft Easy Outlook Express Recovery 2.0.CVE-2024-1187 · Other software · Munsoft · reported by VulDBLow 3.3
A vulnerability, which was classified as problematic, has been found in Munsoft Easy Outlook Express Recovery 2.0. This issue affects some unknown processing of the component Registration Key Handler. The manipulation leads to denial of service. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The identifier VDB-252677 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Easy Outlook Express Recovery
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2024A vulnerability classified as problematic was found in Munsoft Easy Archive Recovery 2.0.CVE-2024-1186 · Other software · Munsoft · reported by VulDBLow 3.3
A vulnerability classified as problematic was found in Munsoft Easy Archive Recovery 2.0. This vulnerability affects unknown code of the component Registration Key Handler. The manipulation leads to denial of service. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252676. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Easy Archive Recovery
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2024A vulnerability classified as problematic has been found in Nsasoft NBMonitor Network Bandwidth Monitor 1.6.5.0.CVE-2024-1185 · Other software · Nsasoft · reported by VulDBLow 3.3
A vulnerability classified as problematic has been found in Nsasoft NBMonitor Network Bandwidth Monitor 1.6.5.0. This affects an unknown part of the component Registration Handler. The manipulation leads to denial of service. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252675. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- NBMonitor Network Bandwidth Monitor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 31, 2024SQL injection vulnerability in Enterprise Architect 16.0.1605 32-bit allows attackers to run arbitrary SQL commands via the Find parameter in the Select ClassifCVE-2022-47072 · Other software · Sparxsystems · reported by MITRECritical 9.8
SQL injection vulnerability in Enterprise Architect 16.0.1605 32-bit allows attackers to run arbitrary SQL commands via the Find parameter in the Select Classifier dialog box..
- Product
- Enterprise Architect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 31, 2024A vulnerability was found in openBI up to 1.0.8 and classified as critical.CVE-2024-1115 · Other software · Openbi · reported by VulDBHigh 7.3
A vulnerability was found in openBI up to 1.0.8 and classified as critical. This issue affects the function dlfile of the file /application/websocket/controller/Setting.php. The manipulation of the argument phpPath leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-252473 was assigned to this vulnerability.
- Product
- Openbi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Jan 31, 2024A vulnerability has been found in openBI up to 1.0.8 and classified as critical.CVE-2024-1114 · Other software · openbi · reported by VulDBMedium 6.5
A vulnerability has been found in openBI up to 1.0.8 and classified as critical. This vulnerability affects the function dlfile of the file /application/index/controller/Screen.php. The manipulation of the argument fileUrl leads to improper access controls. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252472.
- Product
- openbi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.