Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
546 results · page 6 of 11
Feb 21, 2025Totolink X5000R V9.1.0u.6369_B20230113 is vulnerable to command injection via the apcli_wps_gen_pincode function in mtkwifi.lua.CVE-2025-25605 · Other software · Totolink · reported by MITREMedium 6.5
Totolink X5000R V9.1.0u.6369_B20230113 is vulnerable to command injection via the apcli_wps_gen_pincode function in mtkwifi.lua.
- Product
- X5000r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2025Totolink X5000R V9.1.0u.6369_B20230113 is vulnerable to command injection via the vif_disable function in mtkwifi.lua.CVE-2025-25604 · Other software · Totolink · reported by MITREMedium 6.5
Totolink X5000R V9.1.0u.6369_B20230113 is vulnerable to command injection via the vif_disable function in mtkwifi.lua.
- Product
- X5000r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged)CVE-2025-26378 · Other software · Q-Free · reported by prodsec@nozominetworks.comHigh 8.8
A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged) attacker to reset passwords, including the ones of administrator accounts, via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged)CVE-2025-26377 · Other software · Q-Free · reported by prodsec@nozominetworks.comHigh 8.1
A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged) attacker to remove users via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged)CVE-2025-26376 · Other software · Q-Free · reported by prodsec@nozominetworks.comMedium 6.5
A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged) attacker to modify user data via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged)CVE-2025-26375 · Other software · Q-Free · reported by prodsec@nozominetworks.comHigh 8.8
A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged) attacker to create users with arbitrary privileges via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua (users endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticatedCVE-2025-26374 · Other software · Q-Free · reported by prodsec@nozominetworks.comMedium 6.5
A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua (users endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged) attacker to enumerate users via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua (user endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated CVE-2025-26373 · Other software · Q-Free · reported by prodsec@nozominetworks.comMedium 6.5
A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua (user endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged) attacker to enumerate users via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-priviCVE-2025-26372 · Other software · Q-Free · reported by prodsec@nozominetworks.comHigh 7.1
A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged) attacker to remove users from groups via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-priviCVE-2025-26371 · Other software · Q-Free · reported by prodsec@nozominetworks.comHigh 8.8
A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged) attacker to add users to groups via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-priviCVE-2025-26370 · Other software · Q-Free · reported by prodsec@nozominetworks.comHigh 7.1
A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged) attacker to remove privileges from user groups via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-priviCVE-2025-26369 · Other software · Q-Free · reported by prodsec@nozominetworks.comHigh 8.8
A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged) attacker to add privileges to user groups via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-priviCVE-2025-26368 · Other software · Q-Free · reported by prodsec@nozominetworks.comHigh 8.1
A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged) attacker to remove user groups via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-priviCVE-2025-26367 · Other software · Q-Free · reported by prodsec@nozominetworks.comMedium 4.3
A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged) attacker to create arbitrary user groups via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unautheCVE-2025-26366 · Other software · Q-Free · reported by prodsec@nozominetworks.comHigh 7.5
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to disable front panel authentication via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unautheCVE-2025-26365 · Other software · Q-Free · reported by prodsec@nozominetworks.comHigh 7.5
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to enable front panel authentication via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unautheCVE-2025-26364 · Other software · Q-Free · reported by prodsec@nozominetworks.comHigh 7.5
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to disable an authentication profile server via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unautheCVE-2025-26363 · Other software · Q-Free · reported by prodsec@nozominetworks.comHigh 7.5
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to enable an authentication profile server via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unautheCVE-2025-26362 · Other software · Q-Free · reported by prodsec@nozominetworks.comHigh 7.5
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to set an arbitrary authentication profile server via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unautheCVE-2025-26361 · Other software · Q-Free · reported by prodsec@nozominetworks.comCritical 9.1
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to factory reset the device via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-306 "Missing Authentication for Critical Function" in maxprofile/persistance/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an uCVE-2025-26360 · Other software · Q-Free · reported by prodsec@nozominetworks.comMedium 5.3
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/persistance/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to delete dashboards via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-306 "Missing Authentication for Critical Function" in maxprofile/accounts/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauCVE-2025-26359 · Other software · Q-Free · reported by prodsec@nozominetworks.comCritical 9.8
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/accounts/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to reset user PINs via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-35 "Path Traversal" in maxtime/api/database/database.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker toCVE-2025-26357 · Other software · Q-Free · reported by prodsec@nozominetworks.comMedium 4.9
A CWE-35 "Path Traversal" in maxtime/api/database/database.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to read sensitive files via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-35 "Path Traversal" in maxtime/api/database/database.lua (setActive endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticatCVE-2025-26356 · Other software · Q-Free · reported by prodsec@nozominetworks.comHigh 7.2
A CWE-35 "Path Traversal" in maxtime/api/database/database.lua (setActive endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to overwrite sensitive files via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-35 "Path Traversal" in maxtime/api/database/database.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker toCVE-2025-26355 · Other software · Q-Free · reported by prodsec@nozominetworks.comMedium 6.5
A CWE-35 "Path Traversal" in maxtime/api/database/database.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to delete sensitive files via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-35 "Path Traversal" in maxtime/api/database/database.lua (copy endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated reCVE-2025-26354 · Other software · Q-Free · reported by prodsec@nozominetworks.comHigh 7.2
A CWE-35 "Path Traversal" in maxtime/api/database/database.lua (copy endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to overwrite sensitive files via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-35 "Path Traversal" in maxtime/api/sql/sql.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to read sensCVE-2025-26353 · Other software · Q-Free · reported by prodsec@nozominetworks.comMedium 4.9
A CWE-35 "Path Traversal" in maxtime/api/sql/sql.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to read sensitive files via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-89 "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" in maxprofile/menu/model.lua (editUserMenu endpoint) in Q-Free MCVE-2025-26348 · Other software · Q-Free · reported by prodsec@nozominetworks.comMedium 5.5
A CWE-89 "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" in maxprofile/menu/model.lua (editUserMenu endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to execute arbitrary SQL commands via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-306 "Missing Authentication for Critical Function" in maxprofile/menu/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenCVE-2025-26347 · Other software · Q-Free · reported by prodsec@nozominetworks.comCritical 9.8
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/menu/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to edit user permissions via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-89 "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" in maxprofile/menu/model.lua (editUserGroupMenu endpoint) in Q-FCVE-2025-26346 · Other software · Q-Free · reported by prodsec@nozominetworks.comMedium 5.5
A CWE-89 "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" in maxprofile/menu/model.lua (editUserGroupMenu endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to execute arbitrary SQL commands via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-306 "Missing Authentication for Critical Function" in maxprofile/menu/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenCVE-2025-26345 · Other software · Q-Free · reported by prodsec@nozominetworks.comCritical 9.8
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/menu/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to edit user group permissions via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-306 "Missing Authentication for Critical Function" in maxprofile/guest-mode/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unCVE-2025-26344 · Other software · Q-Free · reported by prodsec@nozominetworks.comCritical 9.8
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/guest-mode/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to enable passwordless guest mode via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-306 "Missing Authentication for Critical Function" in maxprofile/accounts/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauCVE-2025-26342 · Other software · Q-Free · reported by prodsec@nozominetworks.comCritical 9.8
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/accounts/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to create arbitrary users, including administrators, via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-306 "Missing Authentication for Critical Function" in maxprofile/accounts/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauCVE-2025-26341 · Other software · Q-Free · reported by prodsec@nozominetworks.comCritical 9.8
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/accounts/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to reset arbitrary user passwords via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-306 "Missing Authentication for Critical Function" in maxtime/handleRoute.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticCVE-2025-26339 · Other software · Q-Free · reported by prodsec@nozominetworks.comCritical 9.8
A CWE-306 "Missing Authentication for Critical Function" in maxtime/handleRoute.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to affect the device confidentiality, integrity, or availability in multiple unspecified ways via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 24, 2025ASTEVAL is an evaluator of Python expressions and statements.CVE-2025-24359 · Other software · lmfit · reported by GitHubHigh 8.4
ASTEVAL is an evaluator of Python expressions and statements. Prior to version 1.0.6, if an attacker can control the input to the `asteval` library, they can bypass asteval's restrictions and execute arbitrary Python code in the context of the application using the library. The vulnerability is rooted in how `asteval` performs handling of `FormattedValue` AST nodes. In particular, the `on_formattedvalue` value uses the dangerous format method of the str class. The code allows an attacker to manipulate the value of the string used in the dangerous call `fmt.format(__fstring__=val)`. This vulnerability can be exploited to access protected attributes by intentionally triggering an `AttributeError` exception. The attacker can then catch the exception and use its `obj` attribute to gain arbitrary access to sensitive or protected object properties. Version 1.0.6 fixes this issue.
- Product
- asteval
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2025In the Linux kernel, the following vulnerability has been resolved: selinux: ignore unknown extended permissions When evaluating extended permissions, ignore CVE-2024-57931 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: selinux: ignore unknown extended permissions When evaluating extended permissions, ignore unknown permissions instead of calling BUG(). This commit ensures that future permissions can be added without interfering with older kernels.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Dec 19, 2024ACE vulnerability in JaninoEventEvaluator by QOS.CH logback-core upto including version 0.1 to 1.3.14 and 1.4.0 to 1.5.12 in Java applications allows CVE-2024-12798 · Other software · QOS.CH Sarl · reported by vulnerability@ncsc.chMedium 5.9
ACE vulnerability in JaninoEventEvaluator by QOS.CH logback-core upto including version 0.1 to 1.3.14 and 1.4.0 to 1.5.12 in Java applications allows attacker to execute arbitrary code by compromising an existing logback configuration file or by injecting an environment variable before program execution. Malicious logback configuration files can allow the attacker to execute arbitrary code using the JaninoEventEvaluator extension. A successful attack requires the user to have write access to a configuration file. Alternatively, the attacker could inject a malicious environment variable pointing to a malicious configuration file. In both cases, the attack requires existing privilege.
- Product
- Logback-core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlogback.qos.chlogback.qos.ch
Dec 6, 2024Lua apps can be deployed, removed, started, reloaded or stopped without authorization via AppManager.CVE-2024-10776 · Other software · SICK AG · reported by psirt@sick.deHigh 8.2
Lua apps can be deployed, removed, started, reloaded or stopped without authorization via AppManager. This allows an attacker to remove legitimate apps creating a DoS attack, read and write files or load apps that use all features of the product available to a customer.
- Product
- SICK InspectorP61x
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2024Improper access control vulnerability in M-Files Aino in versions before 24.10 allowed an authenticated user to access object information via incorrect evaluatiCVE-2024-11176 · Other software · M-Files Corporation · reported by security@m-files.comMedium 5.3
Improper access control vulnerability in M-Files Aino in versions before 24.10 allowed an authenticated user to access object information via incorrect evaluation of effective permissions.
- Product
- M-Files Aino
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordempower.m-files.comproduct.m-files.com
Nov 19, 2024In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: prevent NULL pointer dereference if ATIF is not supported acpi_evaluate_objectCVE-2024-53060 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: prevent NULL pointer dereference if ATIF is not supported acpi_evaluate_object() may return AE_NOT_FOUND (failure), which would result in dereferencing buffer.pointer (obj) while being NULL. Although this case may be unrealistic for the current code, it is still better to protect against possible bugs. Bail out also when status is AE_NOT_FOUND. This fixes 1 FORWARD_NULL issue reported by Coverity Report: CID 1600951: Null pointer dereferences (FORWARD_NULL) (cherry picked from commit 91c9e221fe2553edf2db71627d8453f083de87a1)
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Nov 14, 2024Giskard is an evaluation and testing framework for AI systems.CVE-2024-52524 · Other software · Giskard-AI · reported by GitHubMedium 6.9
Giskard is an evaluation and testing framework for AI systems. A Remote Code Execution (ReDoS) vulnerability was discovered in Giskard component by the GitHub Security Lab team. When processing datasets with specific text patterns with Giskard detectors, this vulnerability could trigger exponential regex evaluation times, potentially leading to denial of service. Giskard versions prior to 2.15.5 are affected.
- Product
- giskard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2024Jenkins Authorize Project Plugin 1.7.2 and earlier evaluates a string containing the job name with JavaScript on the Authorization view, resulting in a stored cCVE-2024-52552 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comHigh 8
Jenkins Authorize Project Plugin 1.7.2 and earlier evaluates a string containing the job name with JavaScript on the Authorization view, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- Product
- Jenkins Authorize Project Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2024A vulnerability, which was classified as problematic, has been found in Sanluan PublicCMS 5.202406.d.CVE-2024-11070 · Other software · Sanluan · reported by VulDBMedium 5.3
A vulnerability, which was classified as problematic, has been found in Sanluan PublicCMS 5.202406.d. This issue affects some unknown processing of the file /admin/cmsTagType/save of the component Tag Type Handler. The manipulation of the argument name leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- PublicCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2024An IDOR vulnerability exists in the 'Evaluations' function of the 'umgws datasets' section in lunary-ai/lunary versions 1.3.2.CVE-2024-7473 · Other software · lunary-ai · reported by security@huntr.devMedium 6.5
An IDOR vulnerability exists in the 'Evaluations' function of the 'umgws datasets' section in lunary-ai/lunary versions 1.3.2. This vulnerability allows an authenticated user to update other users' prompts by manipulating the 'id' parameter in the request. The issue is fixed in version 1.4.3.
- Product
- lunary-ai/lunary
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2024The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input.CVE-2024-9264 · Other software · Grafana · reported by security@grafana.comCritical 9.4
The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack. The `duckdb` binary must be present in Grafana's $PATH for this attack to function; by default, this binary is not installed in Grafana distributions.
- Product
- Grafana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgrafana.comsecurity.netapp.com
Oct 9, 2024In Progress Telerik Reporting versions prior to 2024 Q3 (18.2.24.924), a code execution attack is possible using object injection via insecure expression evaluaCVE-2024-8048 · Other software · Progress Software · reported by security@progress.comHigh 7.8
In Progress Telerik Reporting versions prior to 2024 Q3 (18.2.24.924), a code execution attack is possible using object injection via insecure expression evaluation.
- Product
- Telerik Reporting
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.telerik.comsecurity.netapp.com
Sep 10, 2024Pluto is a superset of Lua 5.4 with a focus on general-purpose programming.CVE-2024-45597 · Other software · PlutoLang · reported by GitHubMedium 5.3
Pluto is a superset of Lua 5.4 with a focus on general-purpose programming. Scripts passing user-controlled values to http.request header values are affected. An attacker could use this to send arbitrary requests, potentially leveraging authentication tokens provided in the same headers table.
- Product
- Pluto
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2024ClickHouse v24.3.3.102 was discovered to contain a buffer overflow via the component DB::evaluateConstantExpressionImpl.CVE-2024-41436 · Other software · clickhouse · reported by MITREHigh 7.5
ClickHouse v24.3.3.102 was discovered to contain a buffer overflow via the component DB::evaluateConstantExpressionImpl.
- Product
- clickhouse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Aug 16, 2024CraftOS-PC 2 is a rewrite of the desktop port of CraftOS from the popular Minecraft mod ComputerCraft using C++ and a modified version of PUC Lua, as well as SDCVE-2024-43395 · Other software · MCJack123 · reported by GitHubHigh 8.2
CraftOS-PC 2 is a rewrite of the desktop port of CraftOS from the popular Minecraft mod ComputerCraft using C++ and a modified version of PUC Lua, as well as SDL for drawing. Prior to version 2.8.3, users of CraftOS-PC 2 on Windows can escape the computer folder and access files anywhere without permission or notice by obfuscating `..`s to bypass the internal check preventing parent directory traversal. Version 2.8.3 contains a patch for this issue.
- Product
- craftos2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.