Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,303 results · page 53 of 87
Jan 31, 2024A vulnerability, which was classified as critical, was found in openBI up to 1.0.8.CVE-2024-1113 · Other software · Openbi · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, was found in openBI up to 1.0.8. This affects the function uploadUnity of the file /application/index/controller/Unity.php. The manipulation of the argument file leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252471.
- Product
- Openbi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Jan 31, 2024A vulnerability was found in Rebuild up to 3.5.5 and classified as problematic.CVE-2024-1098 · Other software · Ruifang-tech · reported by VulDBMedium 4.3
A vulnerability was found in Rebuild up to 3.5.5 and classified as problematic. This issue affects the function QiniuCloud.getStorageFile of the file /filex/proxy-download. The manipulation of the argument url leads to information disclosure. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252455.
- Product
- Rebuild
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 31, 2024A vulnerability, which was classified as critical, has been found in Wanhu ezOFFICE 11.1.0.CVE-2024-1012 · Other software · Wanhu · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in Wanhu ezOFFICE 11.1.0. This issue affects some unknown processing of the file defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp. The manipulation of the argument recordId leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-252281 was assigned to this vulnerability.
- Product
- ezOFFICE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2024A vulnerability was found in openBI up to 1.0.8 and classified as critical.CVE-2024-1036 · Other software · Openbi · reported by VulDBHigh 7.3
A vulnerability was found in openBI up to 1.0.8 and classified as critical. This issue affects the function uploadIcon of the file /application/index/controller/Screen.php of the component Icon Handler. The manipulation leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252311.
- Product
- Openbi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Jan 30, 2024A vulnerability has been found in openBI up to 1.0.8 and classified as critical.CVE-2024-1035 · Other software · openbi · reported by VulDBHigh 7.3
A vulnerability has been found in openBI up to 1.0.8 and classified as critical. This vulnerability affects the function uploadIcon of the file /application/index/controller/Icon.php. The manipulation of the argument image leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-252310 is the identifier assigned to this vulnerability.
- Product
- openbi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Jan 30, 2024A vulnerability, which was classified as critical, was found in openBI up to 1.0.8.CVE-2024-1034 · Other software · Openbi Project · reported by VulDBHigh 7.3
A vulnerability, which was classified as critical, was found in openBI up to 1.0.8. This affects the function uploadFile of the file /application/index/controller/File.php. The manipulation leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-252309 was assigned to this vulnerability.
- Product
- Openbi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Jan 30, 2024A vulnerability, which was classified as problematic, has been found in openBI up to 1.0.8.CVE-2024-1033 · Other software · Openbi Project · reported by VulDBMedium 4.3
A vulnerability, which was classified as problematic, has been found in openBI up to 1.0.8. Affected by this issue is the function agent of the file /application/index/controller/Datament.php. The manipulation of the argument api leads to information disclosure. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252308.
- Product
- Openbi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Jan 30, 2024A vulnerability classified as critical was found in openBI up to 1.0.8.CVE-2024-1032 · Other software · Openbi Project · reported by VulDBHigh 7.3
A vulnerability classified as critical was found in openBI up to 1.0.8. Affected by this vulnerability is the function testConnection of the file /application/index/controller/Databasesource.php of the component Test Connection Handler. The manipulation leads to deserialization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252307.
- Product
- Openbi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Jan 30, 2024A vulnerability was found in Cogites eReserv 7.7.58 and classified as problematic.CVE-2024-1029 · Other software · Cogites · reported by VulDBLow 3.5
A vulnerability was found in Cogites eReserv 7.7.58 and classified as problematic. Affected by this issue is some unknown functionality of the file /front/admin/tenancyDetail.php. The manipulation of the argument Nom with the input Dreux"><script>alert('XSS')</script> leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-252302 is the identifier assigned to this vulnerability.
- Product
- eReserv
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2024A vulnerability was found in Cogites eReserv 7.7.58 and classified as problematic.CVE-2024-1026 · Other software · Cogites · reported by VulDBLow 3.5
A vulnerability was found in Cogites eReserv 7.7.58 and classified as problematic. This issue affects some unknown processing of the file front/admin/config.php. The manipulation of the argument id with the input %22%3E%3Cscript%3Ealert(%27XSS%27)%3C/script%3E leads to cross site scripting. The attack may be initiated remotely. The identifier VDB-252293 was assigned to this vulnerability.
- Product
- eReserv
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2024A vulnerability, which was classified as problematic, was found in CodeAstro Simple Student Result Management System 5.6.CVE-2024-1022 · Other software · CodeAstro · reported by VulDBLow 2.4
A vulnerability, which was classified as problematic, was found in CodeAstro Simple Student Result Management System 5.6. This affects an unknown part of the file /add_classes.php of the component Add Class Page. The manipulation of the argument Class Name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252291.
- Product
- Simple Student Result Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
Jan 29, 2024A vulnerability, which was classified as critical, has been found in Rebuild up to 3.5.5.CVE-2024-1021 · Other software · Ruifang-tech · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in Rebuild up to 3.5.5. Affected by this issue is the function readRawText of the component HTTP Request Handler. The manipulation of the argument url leads to server-side request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-252290 is the identifier assigned to this vulnerability.
- Product
- Rebuild
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2024A vulnerability classified as problematic was found in Rebuild up to 3.5.5.CVE-2024-1020 · Other software · ruifang-tech · reported by VulDBLow 3.5
A vulnerability classified as problematic was found in Rebuild up to 3.5.5. Affected by this vulnerability is the function getStorageFile of the file /filex/proxy-download. The manipulation of the argument url leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-252289 was assigned to this vulnerability.
- Product
- rebuild
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2024A vulnerability classified as problematic has been found in PbootCMS 3.2.5-20230421.CVE-2024-1018 · Other software · Pbootcms · reported by VulDBLow 2.4
A vulnerability classified as problematic has been found in PbootCMS 3.2.5-20230421. Affected is an unknown function of the file /admin.php?p=/Area/index#tab=t2. The manipulation of the argument name leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252288.
- Product
- Pbootcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2024A vulnerability was found in Shanxi Diankeyun Technology NODERP up to 6.0.2 and classified as critical.CVE-2024-1006 · Other software · Shanxi Diankeyun Technology · reported by VulDBHigh 7.3
A vulnerability was found in Shanxi Diankeyun Technology NODERP up to 6.0.2 and classified as critical. This issue affects some unknown processing of the file application/index/common.php of the component Cookie Handler. The manipulation of the argument Nod_User_Id/Nod_User_Token leads to improper authentication. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252275. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- NODERP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Jan 29, 2024A vulnerability has been found in Shanxi Diankeyun Technology NODERP up to 6.0.2 and classified as critical.CVE-2024-1005 · Other software · Shanxi Diankeyun Technology · reported by VulDBMedium 5.3
A vulnerability has been found in Shanxi Diankeyun Technology NODERP up to 6.0.2 and classified as critical. This vulnerability affects unknown code of the file /runtime/log. The manipulation leads to files or directories accessible. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-252274 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- NODERP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Jan 29, 2024A vulnerability, which was classified as critical, was found in Totolink N200RE 9.3.5u.6139_B20201216.CVE-2024-1004 · Other software · Totolink · reported by VulDBHigh 7.2
A vulnerability, which was classified as critical, was found in Totolink N200RE 9.3.5u.6139_B20201216. This affects the function loginAuth of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument http_host leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-252273 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- N200RE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjylsec.notion.sitevuldb.com
Jan 29, 2024A vulnerability, which was classified as critical, has been found in Totolink N200RE 9.3.5u.6139_B20201216.CVE-2024-1003 · Other software · Totolink · reported by VulDBHigh 7.2
A vulnerability, which was classified as critical, has been found in Totolink N200RE 9.3.5u.6139_B20201216. Affected by this issue is the function setLanguageCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument lang leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252272. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- N200RE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjylsec.notion.sitevuldb.com
Jan 29, 2024A vulnerability classified as critical was found in Totolink N200RE 9.3.5u.6139_B20201216.CVE-2024-1002 · Other software · Totolink · reported by VulDBHigh 7.2
A vulnerability classified as critical was found in Totolink N200RE 9.3.5u.6139_B20201216. Affected by this vulnerability is the function setIpPortFilterRules of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ePort leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252271. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- N200RE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjylsec.notion.sitevuldb.com
Jan 29, 2024A vulnerability classified as critical has been found in Totolink N200RE 9.3.5u.6139_B20201216.CVE-2024-1001 · Other software · Totolink · reported by VulDBHigh 7.2
A vulnerability classified as critical has been found in Totolink N200RE 9.3.5u.6139_B20201216. Affected is the function main of the file /cgi-bin/cstecgi.cgi. The manipulation leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-252270 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- N200RE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjylsec.notion.sitevuldb.com
Jan 29, 2024A vulnerability was found in Totolink N200RE 9.3.5u.6139_B20201216 and classified as critical.CVE-2024-0997 · Other software · Totolink · reported by VulDBHigh 7.2
A vulnerability was found in Totolink N200RE 9.3.5u.6139_B20201216 and classified as critical. Affected by this issue is the function setOpModeCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument pppoeUser leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-252266 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- N200RE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjylsec.notion.sitevuldb.com
Jan 28, 2024A vulnerability classified as critical has been found in Tenda i9 1.0.0.9(4122).CVE-2024-0996 · Network & remote access · Tenda · reported by VulDBHigh 7.2
A vulnerability classified as critical has been found in Tenda i9 1.0.0.9(4122). This affects the function formSetCfm of the file /goform/setcfm of the component httpd. The manipulation of the argument funcpara1 leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-252261 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- i9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjylsec.notion.sitevuldb.com
Jan 28, 2024A vulnerability was found in Tenda i6 1.0.0.9(3857) and classified as critical.CVE-2024-0992 · Network & remote access · Tenda · reported by VulDBHigh 7.2
A vulnerability was found in Tenda i6 1.0.0.9(3857) and classified as critical. This issue affects the function formwrlSSIDset of the file /goform/wifiSSIDset of the component httpd. The manipulation of the argument index leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-252257 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- i6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjylsec.notion.sitevuldb.com
Jan 28, 2024A vulnerability has been found in Tenda i6 1.0.0.9(3857) and classified as critical.CVE-2024-0991 · Network & remote access · Tenda · reported by VulDBHigh 7.2
A vulnerability has been found in Tenda i6 1.0.0.9(3857) and classified as critical. This vulnerability affects the function formSetCfm of the file /goform/setcfm of the component httpd. The manipulation of the argument funcpara1 leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252256. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- i6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjylsec.notion.sitevuldb.com
Jan 28, 2024A vulnerability, which was classified as critical, was found in Tenda i6 1.0.0.9(3857).CVE-2024-0990 · Network & remote access · Tenda · reported by VulDBHigh 7.2
A vulnerability, which was classified as critical, was found in Tenda i6 1.0.0.9(3857). This affects the function formSetAutoPing of the file /goform/setAutoPing of the component httpd. The manipulation of the argument ping1 leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252255. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- i6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjylsec.notion.sitevuldb.com
Jan 28, 2024A vulnerability, which was classified as problematic, has been found in Sichuan Yougou Technology KuERP up to 1.0.4.CVE-2024-0989 · Other software · Sichuan Yougou Technology · reported by VulDBMedium 5.4
A vulnerability, which was classified as problematic, has been found in Sichuan Yougou Technology KuERP up to 1.0.4. Affected by this issue is the function del_sn_db of the file /application/index/controller/Service.php. The manipulation of the argument file leads to path traversal: '../filedir'. The exploit has been disclosed to the public and may be used. VDB-252254 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- KuERP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Jan 28, 2024A vulnerability classified as critical was found in Sichuan Yougou Technology KuERP up to 1.0.4.CVE-2024-0988 · Other software · Sichuan Yougou Technology · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in Sichuan Yougou Technology KuERP up to 1.0.4. Affected by this vulnerability is the function checklogin of the file /application/index/common.php. The manipulation of the argument App_User_id/App_user_Token leads to improper authentication. The exploit has been disclosed to the public and may be used. The identifier VDB-252253 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- KuERP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Jan 28, 2024A vulnerability classified as critical has been found in Sichuan Yougou Technology KuERP up to 1.0.4.CVE-2024-0987 · Other software · Sichuan Yougou Technology · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in Sichuan Yougou Technology KuERP up to 1.0.4. Affected is an unknown function of the file /runtime/log. The manipulation leads to improper output neutralization for logs. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252252. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- KuERP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Jan 27, 2024A vulnerability was found in CodeAstro Stock Management System 1.0 and classified as problematic.CVE-2024-0958 · Other software · CodeAstro · reported by VulDBLow 3.5
A vulnerability was found in CodeAstro Stock Management System 1.0 and classified as problematic. This issue affects some unknown processing of the file /index.php of the component Add Category Handler. The manipulation of the argument Category Name/Category Description leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252203.
- Product
- Stock Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
Jan 26, 2024** DISPUTED ** A vulnerability, which was classified as problematic, has been found in NetBox up to 3.7.0.CVE-2024-0948 · Other software · netbox · reported by VulDBLow 2.4
** DISPUTED ** A vulnerability, which was classified as problematic, has been found in NetBox up to 3.7.0. This issue affects some unknown processing of the file /core/config-revisions of the component Home Page Configuration. The manipulation with the input <<h1 onload=alert(1)>>test</h1> leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The associated identifier of this vulnerability is VDB-252191. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- netbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
Jan 26, 2024A vulnerability classified as critical was found in 60IndexPage up to 1.8.5.CVE-2024-0946 · Other software · 60indexpage Project · reported by VulDBHigh 7.3
A vulnerability classified as critical was found in 60IndexPage up to 1.8.5. This vulnerability affects unknown code of the file /apply/index.php of the component Parameter Handler. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-252190 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- 60indexpage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Jan 26, 2024A vulnerability classified as critical has been found in 60IndexPage up to 1.8.5.CVE-2024-0945 · Other software · 60indexpage Project · reported by VulDBHigh 7.3
A vulnerability classified as critical has been found in 60IndexPage up to 1.8.5. This affects an unknown part of the file /include/file.php of the component Parameter Handler. The manipulation of the argument url leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-252189 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- 60indexpage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Jan 26, 2024A vulnerability was found in Novel-Plus 4.3.0-RC1 and classified as critical.CVE-2024-0941 · Other software · Xxyopen · reported by VulDBMedium 5.5
A vulnerability was found in Novel-Plus 4.3.0-RC1 and classified as critical. This issue affects some unknown processing of the file /novel/bookComment/list. The manipulation of the argument sort leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier VDB-252185 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Novel-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2024A vulnerability has been found in Byzoro Smart S210 Management Platform up to 20240117 and classified as critical.CVE-2024-0939 · Other software · Byzoro · reported by VulDBMedium 6.3
A vulnerability has been found in Byzoro Smart S210 Management Platform up to 20240117 and classified as critical. This vulnerability affects unknown code of the file /Tool/uploadfile.php. The manipulation of the argument file_upload leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252184. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Smart S210 Management Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2024A vulnerability, which was classified as critical, was found in Tongda OA 2017 up to 11.9.CVE-2024-0938 · Other software · Tongda · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, was found in Tongda OA 2017 up to 11.9. This affects an unknown part of the file /general/email/inbox/delete_webmail.php. The manipulation of the argument WEBBODY_ID_STR leads to sql injection. The exploit has been disclosed to the public and may be used. Upgrading to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-252183. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- OA 2017
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2024A vulnerability, which was classified as critical, has been found in van_der_Schaar LAB synthcity 0.2.9.CVE-2024-0937 · Other software · van_der_Schaar LAB · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in van_der_Schaar LAB synthcity 0.2.9. Affected by this issue is the function load_from_file of the component PKL File Handler. The manipulation leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-252182 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early and confirmed immediately the existence of the issue. A patch is planned to be released in February 2024.
- Product
- synthcity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2024A vulnerability classified as critical was found in van_der_Schaar LAB TemporAI 0.0.3.CVE-2024-0936 · Other software · van_der_Schaar LAB · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in van_der_Schaar LAB TemporAI 0.0.3. Affected by this vulnerability is the function load_from_file of the component PKL File Handler. The manipulation leads to deserialization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-252181 was assigned to this vulnerability. NOTE: The vendor was contacted early and confirmed immediately the existence of the issue. A patch is planned to be released in February 2024.
- Product
- TemporAI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2024A vulnerability was found in Niushop B2B2C V5 and classified as critical.CVE-2024-0933 · Other software · Niushop · reported by VulDBMedium 6.3
A vulnerability was found in Niushop B2B2C V5 and classified as critical. Affected by this issue is some unknown functionality of the file \app\model\Upload.php. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252140. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- B2B2C
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2024A vulnerability, which was classified as critical, has been found in Tenda AC10U 15.03.06.49_multi_TDE01.CVE-2024-0932 · Network & remote access · Tenda · reported by VulDBMedium 4.7
A vulnerability, which was classified as critical, has been found in Tenda AC10U 15.03.06.49_multi_TDE01. This issue affects the function setSmartPowerManagement. The manipulation of the argument time leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-252137 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AC10U
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2024A vulnerability classified as critical was found in Tenda AC10U 15.03.06.49_multi_TDE01.CVE-2024-0931 · Network & remote access · Tenda · reported by VulDBMedium 4.7
A vulnerability classified as critical was found in Tenda AC10U 15.03.06.49_multi_TDE01. This vulnerability affects the function saveParentControlInfo. The manipulation of the argument deviceId/time/urls leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252136. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AC10U
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2024A vulnerability classified as critical has been found in Tenda AC10U 15.03.06.49_multi_TDE01.CVE-2024-0930 · Network & remote access · Tenda · reported by VulDBMedium 4.7
A vulnerability classified as critical has been found in Tenda AC10U 15.03.06.49_multi_TDE01. This affects the function fromSetWirelessRepeat. The manipulation of the argument wpapsk_crypto leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252135. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AC10U
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2024A vulnerability was found in Tenda AC10U 15.03.06.49_multi_TDE01 and classified as critical.CVE-2024-0926 · Network & remote access · Tenda · reported by VulDBMedium 4.7
A vulnerability was found in Tenda AC10U 15.03.06.49_multi_TDE01 and classified as critical. This issue affects the function formWifiWpsOOB. The manipulation of the argument index leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252131. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AC10U
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2024A vulnerability has been found in Tenda AC10U 15.03.06.49_multi_TDE01 and classified as critical.CVE-2024-0925 · Network & remote access · Tenda · reported by VulDBMedium 4.7
A vulnerability has been found in Tenda AC10U 15.03.06.49_multi_TDE01 and classified as critical. This vulnerability affects the function formSetVirtualSer. The manipulation of the argument list leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-252130 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AC10U
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2024A vulnerability, which was classified as critical, was found in Tenda AC10U 15.03.06.49_multi_TDE01.CVE-2024-0924 · Network & remote access · Tenda · reported by VulDBMedium 4.7
A vulnerability, which was classified as critical, was found in Tenda AC10U 15.03.06.49_multi_TDE01. This affects the function formSetPPTPServer. The manipulation of the argument startIp leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-252129 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AC10U
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2024A vulnerability, which was classified as critical, has been found in Tenda AC10U 15.03.06.49_multi_TDE01.CVE-2024-0923 · Network & remote access · Tenda · reported by VulDBMedium 4.7
A vulnerability, which was classified as critical, has been found in Tenda AC10U 15.03.06.49_multi_TDE01. Affected by this issue is the function formSetDeviceName. The manipulation of the argument devName leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252128. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AC10U
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2024A vulnerability classified as critical was found in Tenda AC10U 15.03.06.49_multi_TDE01.CVE-2024-0922 · Network & remote access · Tenda · reported by VulDBMedium 4.7
A vulnerability classified as critical was found in Tenda AC10U 15.03.06.49_multi_TDE01. Affected by this vulnerability is the function formQuickIndex. The manipulation of the argument PPPOEPassword leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252127. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AC10U
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2024A vulnerability has been found in D-Link DIR-816 A2 1.10CNB04 and classified as critical.CVE-2024-0921 · Network & remote access · D-Link · reported by VulDBMedium 4.7
A vulnerability has been found in D-Link DIR-816 A2 1.10CNB04 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /goform/setDeviceSettings of the component Web Interface. The manipulation of the argument statuscheckpppoeuser leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252139.
- Product
- DIR-816 A2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2024A vulnerability was found in TRENDnet TEW-800MB 1.0.1.0 and classified as critical.CVE-2024-0918 · Other software · TRENDnet · reported by VulDBHigh 7.2
A vulnerability was found in TRENDnet TEW-800MB 1.0.1.0 and classified as critical. Affected by this issue is some unknown functionality of the component POST Request Handler. The manipulation of the argument DeviceURL leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-252122 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- TEW-800MB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 25, 2024A vulnerability was found in Kmint21 Golden FTP Server 2.02b and classified as problematic.CVE-2024-0889 · Other software · Kmint21 · reported by VulDBMedium 5.3
A vulnerability was found in Kmint21 Golden FTP Server 2.02b and classified as problematic. This issue affects some unknown processing of the component PASV Command Handler. The manipulation leads to denial of service. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-252041 was assigned to this vulnerability.
- Product
- Golden FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comvuldb.com
Jan 25, 2024A vulnerability, which was classified as problematic, was found in BORGChat 1.0.0 Build 438.CVE-2024-0888 · Other software · 10n · reported by VulDBMedium 5.3
A vulnerability, which was classified as problematic, was found in BORGChat 1.0.0 Build 438. This affects an unknown part of the component Service Port 7551. The manipulation leads to denial of service. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252039.
- Product
- borgchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.