Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,599 results · page 6 of 52
Dec 12, 2024Read/Write vulnerability in the image decoding module Impact: Successful exploitation of this vulnerability will affect availability.CVE-2024-54107 · Other software · Huawei · reported by psirt@huawei.comHigh 7.1
Read/Write vulnerability in the image decoding module Impact: Successful exploitation of this vulnerability will affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2024Null pointer dereference vulnerability in the image decoding module Impact: Successful exploitation of this vulnerability will affect availability.CVE-2024-54106 · Other software · Huawei · reported by psirt@huawei.comHigh 7.1
Null pointer dereference vulnerability in the image decoding module Impact: Successful exploitation of this vulnerability will affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2024Read/Write vulnerability in the image decoding module Impact: Successful exploitation of this vulnerability will affect availability.CVE-2024-54105 · Other software · Huawei · reported by psirt@huawei.comMedium 5.1
Read/Write vulnerability in the image decoding module Impact: Successful exploitation of this vulnerability will affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2024Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality.CVE-2024-54104 · Other software · Huawei · reported by psirt@huawei.comMedium 6.2
Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2024Vulnerability of improper access control in the album module Impact: Successful exploitation of this vulnerability may affect service confidentiality.CVE-2024-54103 · Other software · Huawei · reported by psirt@huawei.comMedium 6.1
Vulnerability of improper access control in the album module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2024Race condition vulnerability in the DDR module Impact: Successful exploitation of this vulnerability may affect service confidentiality.CVE-2024-54102 · Other software · Huawei · reported by psirt@huawei.comMedium 6.1
Race condition vulnerability in the DDR module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2024Denial of service (DoS) vulnerability in the installation module Impact: Successful exploitation of this vulnerability will affect availability.CVE-2024-54101 · Other software · Huawei · reported by psirt@huawei.comMedium 6.2
Denial of service (DoS) vulnerability in the installation module Impact: Successful exploitation of this vulnerability will affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2024Vulnerability of improper access control in the secure input module Impact: Successful exploitation of this vulnerability may cause features to perform abnormalCVE-2024-54100 · Other software · Huawei · reported by psirt@huawei.comMedium 6.2
Vulnerability of improper access control in the secure input module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2024File replacement vulnerability on some devices Impact: Successful exploitation of this vulnerability will affect integrity and confidentiality.CVE-2024-54099 · Other software · Huawei · reported by psirt@huawei.comMedium 6.7
File replacement vulnerability on some devices Impact: Successful exploitation of this vulnerability will affect integrity and confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2024Service logic error vulnerability in the system service module Impact: Successful exploitation of this vulnerability may affect service integrity.CVE-2024-54098 · Other software · Huawei · reported by psirt@huawei.comHigh 8.5
Service logic error vulnerability in the system service module Impact: Successful exploitation of this vulnerability may affect service integrity.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2024Security vulnerability in the HiView module Impact: Successful exploitation of this vulnerability may affect feature implementation and integrity.CVE-2024-54097 · Other software · Huawei · reported by psirt@huawei.comHigh 7.3
Security vulnerability in the HiView module Impact: Successful exploitation of this vulnerability may affect feature implementation and integrity.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2024Vulnerability of improper access control in the MTP module Impact: Successful exploitation of this vulnerability may affect integrity and accuracy.CVE-2024-54096 · Other software · Huawei · reported by psirt@huawei.comMedium 5.3
Vulnerability of improper access control in the MTP module Impact: Successful exploitation of this vulnerability may affect integrity and accuracy.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2024Motoko's incremental garbage collector is impacted by an uninitialized memory access bug, caused by incorrect use of write barriers in a few locations.CVE-2024-11991 · Other software · Internet Computer · reported by 6b35d637-e00f-4228-858c-b20ad6e1d07bMedium 5.6
Motoko's incremental garbage collector is impacted by an uninitialized memory access bug, caused by incorrect use of write barriers in a few locations. This vulnerability could potentially allow unauthorized read or write access to a Canister's memory. However, exploiting this bug requires the Canister to enable the incremental garbage collector or enhanced orthogonal persistence, which are non-default features in Motoko.
- Product
- Motoko
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 24, 2024The Imager package before 1.025 for Perl has a heap-based buffer overflow leading to denial of service, or possibly unspecified other impact, when the trim() meCVE-2024-53901 · Other software · Tonycoz · reported by MITREMedium 5.5
The Imager package before 1.025 for Perl has a heap-based buffer overflow leading to denial of service, or possibly unspecified other impact, when the trim() method is called on a crafted input image.
- Product
- Imager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2024Issue summary: Calling the OpenSSL API function SSL_free_buffers may cause memory to be accessed that was previously freed in some situations Impact summary: ACVE-2024-4741 · Websites & servers · OpenSSL · reported by openssl-security@openssl.orgHigh 7.5
Issue summary: Calling the OpenSSL API function SSL_free_buffers may cause memory to be accessed that was previously freed in some situations Impact summary: A use after free can have a range of potential consequences such as the corruption of valid data, crashes or execution of arbitrary code. However, only applications that directly call the SSL_free_buffers function are affected by this issue. Applications that do not call this function are not vulnerable. Our investigations indicate that this function is rarely used by applications. The SSL_free_buffers function is used to free the internal OpenSSL buffer used when processing an incoming record from the network. The call is only expected to succeed if the buffer is not currently in use. However, two scenarios have been identified where the buffer is freed even when still in use. The first scenario occurs where a record header has been received from the network and processed by OpenSSL, but the full record body has not yet arrived. In this case calling SSL_free_buffers will succeed even though a record has only been partially processed and the buffer is still in use. The second scenario occurs where a full record containing
- Product
- OpenSSL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2024CWE-862: Missing Authorization vulnerability exists that could cause unauthorized access when enabled on the network and potentially impacting connected devicesCVE-2024-10575 · Other software · Schneider Electric · reported by cybersecurity@se.comCritical 10
CWE-862: Missing Authorization vulnerability exists that could cause unauthorized access when enabled on the network and potentially impacting connected devices.
- Product
- EcoStruxure IT Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.com
Nov 11, 2024Cash Operations does not perform necessary authorization check for an authenticated user, resulting in escalation of privileges causing low impact to confidentiCVE-2024-47587 · Network & remote access · SAP_SE · reported by cna@sap.comLow 3.5
Cash Operations does not perform necessary authorization check for an authenticated user, resulting in escalation of privileges causing low impact to confidentiality to the application.
- Product
- SAP Cash Management (Cash Operations)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2024When using IPAuthenticationProvider in ZooKeeper Admin Server there is a possibility of Authentication Bypass by Spoofing -- this only impacts IP based authentiCVE-2024-51504 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.1
When using IPAuthenticationProvider in ZooKeeper Admin Server there is a possibility of Authentication Bypass by Spoofing -- this only impacts IP based authentication implemented in ZooKeeper Admin Server. Default configuration of client's IP address detection in IPAuthenticationProvider, which uses HTTP request headers, is weak and allows an attacker to bypass authentication via spoofing client's IP address in request headers. Default configuration honors X-Forwarded-For HTTP header to read client's IP address. X-Forwarded-For request header is mainly used by proxy servers to identify the client and can be easily spoofed by an attacker pretending that the request comes from a different IP address. Admin Server commands, such as snapshot and restore arbitrarily can be executed on successful exploitation which could potentially lead to information leakage or service availability issues. Users are recommended to upgrade to version 3.9.3, which fixes this issue.
- Product
- Apache ZooKeeper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Nov 5, 2024LaunchAnywhere vulnerability in the account module Impact: Successful exploitation of this vulnerability may affect service confidentiality.CVE-2024-51530 · Other software · Huawei · reported by psirt@huawei.comMedium 6.6
LaunchAnywhere vulnerability in the account module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2024Data verification vulnerability in the battery module Impact: Successful exploitation of this vulnerability may affect function stability.CVE-2024-51529 · Other software · Huawei · reported by psirt@huawei.comMedium 5.5
Data verification vulnerability in the battery module Impact: Successful exploitation of this vulnerability may affect function stability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2024Vulnerability of improper log printing in the Super Home Screen module Impact: Successful exploitation of this vulnerability may affect service confidentiality.CVE-2024-51528 · Other software · Huawei · reported by psirt@huawei.comMedium 4
Vulnerability of improper log printing in the Super Home Screen module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2024Permission control vulnerability in the Gallery app Impact: Successful exploitation of this vulnerability may affect service confidentiality.CVE-2024-51527 · Other software · Huawei · reported by psirt@huawei.comMedium 5.1
Permission control vulnerability in the Gallery app Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2024Permission control vulnerability in the hidebug module Impact: Successful exploitation of this vulnerability may affect service confidentiality.CVE-2024-51526 · Other software · Huawei · reported by psirt@huawei.comHigh 8.2
Permission control vulnerability in the hidebug module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2024Permission control vulnerability in the clipboard module Impact: Successful exploitation of this vulnerability may affect service confidentiality.CVE-2024-51525 · Other software · Huawei · reported by psirt@huawei.comMedium 6.2
Permission control vulnerability in the clipboard module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2024Permission control vulnerability in the Wi-Fi module Impact: Successful exploitation of this vulnerability may affect service confidentiality.CVE-2024-51524 · Other software · Huawei · reported by psirt@huawei.comMedium 4
Permission control vulnerability in the Wi-Fi module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2024Information management vulnerability in the Gallery module Impact: Successful exploitation of this vulnerability may affect service confidentiality.CVE-2024-51523 · Other software · Huawei · reported by psirt@huawei.comHigh 7.1
Information management vulnerability in the Gallery module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2024Vulnerability of improper device information processing in the device management module Impact: Successful exploitation of this vulnerability may affect availabCVE-2024-51522 · Other software · Huawei · reported by psirt@huawei.comMedium 6.2
Vulnerability of improper device information processing in the device management module Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2024Input parameter verification vulnerability in the background service module Impact: Successful exploitation of this vulnerability may affect availability.CVE-2024-51521 · Other software · Huawei · reported by psirt@huawei.comMedium 5.7
Input parameter verification vulnerability in the background service module Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2024Vulnerability of input parameters not being verified in the HDC module Impact: Successful exploitation of this vulnerability may affect availability.CVE-2024-51520 · Other software · Huawei · reported by psirt@huawei.comMedium 5.5
Vulnerability of input parameters not being verified in the HDC module Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2024Vulnerability of input parameters not being verified in the HDC module Impact: Successful exploitation of this vulnerability may affect availability.CVE-2024-51519 · Other software · Huawei · reported by psirt@huawei.comMedium 5
Vulnerability of input parameters not being verified in the HDC module Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2024Vulnerability of message types not being verified in the advanced messaging modul Impact: Successful exploitation of this vulnerability may affect availability.CVE-2024-51518 · Other software · Huawei · reported by psirt@huawei.comMedium 5.3
Vulnerability of message types not being verified in the advanced messaging modul Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2024Vulnerability of improper memory access in the phone service module Impact: Successful exploitation of this vulnerability may affect availability.CVE-2024-51517 · Other software · Huawei · reported by psirt@huawei.comMedium 5.1
Vulnerability of improper memory access in the phone service module Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2024Permission control vulnerability in the ability module Impact: Successful exploitation of this vulnerability may cause features to function abnormally.CVE-2024-51516 · Other software · Huawei · reported by psirt@huawei.comMedium 6.2
Permission control vulnerability in the ability module Impact: Successful exploitation of this vulnerability may cause features to function abnormally.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2024Race condition vulnerability in the kernel network module Impact:Successful exploitation of this vulnerability may affect availability.CVE-2024-51515 · Other software · Huawei · reported by psirt@huawei.comMedium 6.2
Race condition vulnerability in the kernel network module Impact:Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2024Vulnerability of pop-up windows belonging to no app in the VPN module Impact: Successful exploitation of this vulnerability may affect service confidentiality.CVE-2024-51514 · Other software · Huawei · reported by psirt@huawei.comMedium 5.3
Vulnerability of pop-up windows belonging to no app in the VPN module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2024Vulnerability of processes not being fully terminated in the VPN module Impact: Successful exploitation of this vulnerability will affect power consumption.CVE-2024-51513 · Other software · Huawei · reported by psirt@huawei.comMedium 5.5
Vulnerability of processes not being fully terminated in the VPN module Impact: Successful exploitation of this vulnerability will affect power consumption.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2024Vulnerability of parameter type not being verified in the WantAgent module Impact: Successful exploitation of this vulnerability may affect availability.CVE-2024-51512 · Other software · Huawei · reported by psirt@huawei.comMedium 6.2
Vulnerability of parameter type not being verified in the WantAgent module Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2024Vulnerability of parameter type not being verified in the WantAgent module Impact: Successful exploitation of this vulnerability may affect availability.CVE-2024-51511 · Other software · Huawei · reported by psirt@huawei.comMedium 6.2
Vulnerability of parameter type not being verified in the WantAgent module Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2024Out-of-bounds access vulnerability in the logo module Impact: Successful exploitation of this vulnerability may affect service confidentiality.CVE-2024-51510 · Other software · Huawei · reported by psirt@huawei.comHigh 7.6
Out-of-bounds access vulnerability in the logo module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2024An issue in the PepeGxng smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact via the mint functioCVE-2024-51427 · Other software · ethereum · reported by MITRECritical 9.8
An issue in the PepeGxng smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact via the mint function. NOTE: this is disputed by third parties because the impact is limited to function calls.
- Product
- ethereum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2024An issue in the PepeGxng smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact via the _transfer fuCVE-2024-51426 · Other software · ethereum · reported by MITREHigh 8.8
An issue in the PepeGxng smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact via the _transfer function. NOTE: this is disputed by third parties because the impact is limited to function calls.
- Product
- ethereum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2024An issue in the WaterToken smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact.CVE-2024-51425 · Other software · ethereum · reported by MITREHigh 8.8
An issue in the WaterToken smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact. NOTE: this is disputed by third parties because the impact is limited to function calls.
- Product
- ethereum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2024An issue in the PepeGxng smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact via the Owned.setOwnCVE-2024-51424 · Other software · ethereum · reported by MITRECritical 9.8
An issue in the PepeGxng smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact via the Owned.setOwner function. NOTE: this is disputed by third parties because the impact is limited to function calls.
- Product
- ethereum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2024CVE-2024-10387 IMPACT A Denial-of-Service vulnerability exists in the affected product.CVE-2024-10387 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comHigh 8.7
CVE-2024-10387 IMPACT A Denial-of-Service vulnerability exists in the affected product. The vulnerability could allow a threat actor with network access to send crafted messages to the device, potentially resulting in Denial-of-Service.
- Product
- FactoryTalk ThinManager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Oct 25, 2024CVE-2024-10386 IMPACT An authentication vulnerability exists in the affected product.CVE-2024-10386 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comCritical 9.3
CVE-2024-10386 IMPACT An authentication vulnerability exists in the affected product. The vulnerability could allow a threat actor with network access to send crafted messages to the device, potentially resulting in database manipulation.
- Product
- FactoryTalk ThinManager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Oct 23, 2024HCL Sametime is impacted by the error messages containing sensitive information.CVE-2023-50355 · Other software · HCL Software · reported by psirt@hcl.comLow 3.6
HCL Sametime is impacted by the error messages containing sensitive information. An attacker can use this information to launch another, more focused attack.
- Product
- Sametime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Oct 23, 2024HCL Sametime is impacted by insecure services in-use on the UIM client by default.CVE-2024-30124 · Other software · HCL Software · reported by psirt@hcl.comMedium 4
HCL Sametime is impacted by insecure services in-use on the UIM client by default. An unused legacy REST service was enabled by default using the HTTP protocol. An attacker could potentially use this service endpoint maliciously.
- Product
- Sametime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Oct 23, 2024HCL Sametime is impacted by misconfigured security related HTTP headers.CVE-2024-30122 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.8
HCL Sametime is impacted by misconfigured security related HTTP headers. It was identified that some HTTP headers were missing on web service responses. This will lead to less secure browser default treatment for the policies controlled by these headers.
- Product
- Sametime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Oct 17, 2024### Impact When this library is used to deserialize messagepack data from an untrusted source, there is a risk of a denial of service attack by an attacker thaCVE-2024-48924 · Other software · MessagePack-CSharp · reported by GitHubHigh 8.7
### Impact When this library is used to deserialize messagepack data from an untrusted source, there is a risk of a denial of service attack by an attacker that sends data contrived to produce hash collisions, leading to large CPU consumption disproportionate to the size of the data being deserialized. This is similar to [a prior advisory](https://github.com/MessagePack-CSharp/MessagePack-CSharp/security/advisories/GHSA-7q36-4xx7-xcxf), which provided an inadequate fix for the hash collision part of the vulnerability. ### Patches The following steps are required to mitigate this risk. 1. Upgrade to a version of the library where a fix is available. 1. Review the steps in [this previous advisory](https://github.com/MessagePack-CSharp/MessagePack-CSharp/security/advisories/GHSA-7q36-4xx7-xcxf) to ensure you have your application configured for untrusted data. ### Workarounds If upgrading MessagePack to a patched version is not an option for you, you may apply a manual workaround as follows: 1. Declare a class that derives from `MessagePackSecurity`. 2. Override the `GetHashCollisionResistantEqualityComparer<T>` method to provide a collision-resistant hash function of your own
- Product
- MessagePack-CSharp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2024The SAP HANA Node.js client package versions from 2.0.0 before 2.21.31 is impacted by Prototype Pollution vulnerability allowing an attacker to add arbitrary prCVE-2024-45277 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
The SAP HANA Node.js client package versions from 2.0.0 before 2.21.31 is impacted by Prototype Pollution vulnerability allowing an attacker to add arbitrary properties to global object prototypes. This is due to improper user input sanitation when using the nestTables feature causing low impact on the availability of the application. This has no impact on Confidentiality and Integrity.
- Product
- SAP HANA Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.