Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
941 results · page 7 of 19
Mar 14, 2025The GLPI Inventory Plugin handles various types of tasks for GLPI agents for the GLPI asset and IT management software package.CVE-2025-26626 · Other software · glpi-project · reported by GitHubMedium 6.5
The GLPI Inventory Plugin handles various types of tasks for GLPI agents for the GLPI asset and IT management software package. Versions prior to 1.5.0 are vulnerable to reflective cross-site scripting, which may lead to executing javascript code. Version 1.5.0 fixes the issue.
- Product
- glpi-inventory-plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 12, 2025Bitdefender Box, versions 1.3.11.490 through 1.3.11.505, uses the insecure HTTP protocol to download assets over the Internet to update and restart daemons and CVE-2024-13872 · Other software · Bitdefender · reported by cve-requests@bitdefender.comCritical 9.4
Bitdefender Box, versions 1.3.11.490 through 1.3.11.505, uses the insecure HTTP protocol to download assets over the Internet to update and restart daemons and detection rules on the devices. Updates can be remotely triggered through the /set_temp_token API method. Then, an unauthenticated and network-adjacent attacker can use man-in-the-middle (MITM) techniques to return malicious responses. Restarted daemons that use malicious assets can then be exploited for remote code execution on the device.
- Product
- BOX v1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2025A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3.CVE-2025-2152 · Other software · Open Asset Import Library · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3. This issue affects the function Assimp::BaseImporter::ConvertToUTF8 of the file BaseImporter.cpp of the component File Handler. The manipulation leads to heap-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2025A vulnerability classified as critical was found in Open Asset Import Library Assimp 5.4.3.CVE-2025-2151 · Other software · Open Asset Import Library · reported by VulDBMedium 5.3
A vulnerability classified as critical was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function Assimp::GetNextLine in the library ParsingUtils.h of the component File Handler. The manipulation leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2025A vulnerability, which was classified as critical, has been found in Hunan Zhonghe Baiyi Information Technology Baiyiyun Asset Management and Operations System CVE-2025-1797 · Other software · Hunan Zhonghe Baiyi Information Technology · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, has been found in Hunan Zhonghe Baiyi Information Technology Baiyiyun Asset Management and Operations System up to 20250217. Affected by this issue is some unknown functionality of the file /wuser/anyUserBoundHouse.php. The manipulation of the argument huid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Baiyiyun Asset Management and Operations System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2025This advisory addresses a file placement vulnerability that could allow assets to be uploaded to unintended directories on the server.CVE-2022-25773 · Other software · Mautic · reported by security@mautic.orgMedium 4.3
This advisory addresses a file placement vulnerability that could allow assets to be uploaded to unintended directories on the server. * Improper Limitation of a Pathname to a Restricted Directory: A vulnerability exists in the asset upload functionality that allows users to upload files to directories outside of the intended temporary directory.
- Product
- mautic/core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2025GLPI is a free asset and IT management software package.CVE-2025-25192 · Other software · glpi-project · reported by GitHubMedium 6.5
GLPI is a free asset and IT management software package. Prior to version 10.0.18, a low privileged user can enable debug mode and access sensitive information. Version 10.0.18 contains a patch. As a workaround, one may delete the `install/update.php` file.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2025GLPI is a free asset and IT management software package.CVE-2025-23046 · Other software · glpi-project · reported by GitHubMedium 6.3
GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.18, if a "Mail servers" authentication provider is configured to use an Oauth connection provided by the OauthIMAP plugin, anyone can connect to GLPI using a user name on which an Oauth authorization has already been established. Version 10.0.18 contains a patch. As a workaround, one may disable any "Mail servers" authentication provider configured to use an Oauth connection provided by the OauthIMAP plugin.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2025GLPI is a free asset and IT management software package.CVE-2025-23024 · Other software · glpi-project · reported by GitHubMedium 6.9
GLPI is a free asset and IT management software package. Starting in version 0.72 and prior to version 10.0.18, an anonymous user can disable all the active plugins. Version 10.0.18 contains a patch. As a workaround, one may delete the `install/update.php` file.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2025GLPI is a free asset and IT management software package.CVE-2025-21627 · Other software · glpi-project · reported by GitHubMedium 6.5
GLPI is a free asset and IT management software package. In versions prior to 10.0.18, a malicious link can be crafted to perform a reflected XSS attack on the search page. If the anonymous ticket creation is enabled, this attack can be performed by an unauthenticated user. Version 10.0.18 contains a fix for the issue.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2025GLPI is a free asset and IT management software package.CVE-2025-21626 · Other software · glpi-project · reported by GitHubMedium 5.8
GLPI is a free asset and IT management software package. Starting in version 0.71 and prior to version 10.0.18, an anonymous user can fetch sensitive information from the `status.php` endpoint. Version 10.0.18 contains a fix for the issue. Some workarounds are available. One may delete the `status.php` file, restrict its access, or remove any sensitive values from the `name` field of the active LDAP directories, mail servers authentication providers and mail receivers.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2025A vulnerability was found in Baiyi Cloud Asset Management System 8.142.100.161.CVE-2025-1535 · Other software · Baiyi · reported by VulDBMedium 6.9
A vulnerability was found in Baiyi Cloud Asset Management System 8.142.100.161. It has been classified as critical. This affects an unknown part of the file /wuser/admin.ticket.close.php. The manipulation of the argument ticket_id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Cloud Asset Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2025A memory leak has been identified in the parseSWF_IMPORTASSETS2 function in util/parser.c of libming v0.4.8, which allows attackers to cause a denial of serviceCVE-2025-26307 · Other software · Libming · reported by MITREMedium 6.5
A memory leak has been identified in the parseSWF_IMPORTASSETS2 function in util/parser.c of libming v0.4.8, which allows attackers to cause a denial of service via a crafted SWF file.
- Product
- Libming
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2025A memory leak has been identified in the parseSWF_EXPORTASSETS function in util/parser.c of libming v0.4.8.CVE-2025-26304 · Other software · Libming · reported by MITREHigh 8.2
A memory leak has been identified in the parseSWF_EXPORTASSETS function in util/parser.c of libming v0.4.8.
- Product
- Libming
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2025PHPJabbers Shared Asset Booking System v1.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) in the "title, name" parameters.CVE-2023-51325 · Websites & servers · Phpjabbers · reported by MITREMedium 5.4
PHPJabbers Shared Asset Booking System v1.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) in the "title, name" parameters.
- Product
- Shared Asset Booking System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstorm.newsphpjabbers.com
Feb 20, 2025PHPJabbers Shared Asset Booking System v1.0 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code.CVE-2023-51324 · Websites & servers · Phpjabbers · reported by MITREMedium 6.5
PHPJabbers Shared Asset Booking System v1.0 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code. The vulnerability exists due to insufficient input validation on Languages section Labels any parameters field in System Options that is used to construct CSV file.
- Product
- Shared Asset Booking System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstorm.newsphpjabbers.com
Feb 20, 2025A lack of rate limiting in the 'Forgot Password' feature of PHPJabbers Shared Asset Booking System v1.0 allows attackers to send an excessive amount of email foCVE-2023-51323 · Websites & servers · Phpjabbers · reported by MITREMedium 6.5
A lack of rate limiting in the 'Forgot Password' feature of PHPJabbers Shared Asset Booking System v1.0 allows attackers to send an excessive amount of email for a legitimate user, leading to a possible Denial of Service (DoS) via a large amount of generated e-mail messages.
- Product
- Shared Asset Booking System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstorm.newsphpjabbers.com
Feb 19, 2025The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a sysCVE-2024-6696 · Other software · Hitachi Vantara · reported by security.vulnerabilities@hitachivantara.comMedium 4.9
The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets. (CWE-1220) Hitachi Vantara Pentaho Business Analytics Server versions before 10.2.0.0 and 9.3.0.9, including 8.3.x, do not correctly perform an authorization check in the user console trash content An attacker exploits a weakness in the configuration of access controls and is able to bypass the intended protection that these measures guard against and thereby obtain unauthorized access to the system or network.
- Product
- Pentaho Data Integration & Analytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2025A vulnerability, which was classified as critical, has been found in Baiyi Cloud Asset Management System up to 20250204.CVE-2025-1464 · Other software · Baiyi · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, has been found in Baiyi Cloud Asset Management System up to 20250204. This issue affects some unknown processing of the file /wuser/admin.house.collect.php. The manipulation of the argument project_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Cloud Asset Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2025A data exposure vulnerability exists in all versions prior to V15.00.001 of Rockwell Automation FactoryTalk® AssetCentre.CVE-2025-0498 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comHigh 7
A data exposure vulnerability exists in all versions prior to V15.00.001 of Rockwell Automation FactoryTalk® AssetCentre. The vulnerability exists due to insecure storage of FactoryTalk® Security user tokens, which could allow a threat actor to steal a token and, impersonate another user.
- Product
- FactoryTalk® AssetCentre
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Jan 30, 2025A data exposure vulnerability exists in all versions prior to V15.00.001 of Rockwell Automation FactoryTalk® AssetCentre.CVE-2025-0497 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comHigh 7.3
A data exposure vulnerability exists in all versions prior to V15.00.001 of Rockwell Automation FactoryTalk® AssetCentre. The vulnerability exists due to storing credentials in the configuration file of EventLogAttachmentExtractor, ArchiveExtractor, LogCleanUp, or ArchiveLogCleanUp packages.
- Product
- FactoryTalk® AssetCentre
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Jan 30, 2025An encryption vulnerability exists in all versions prior to V15.00.001 of Rockwell Automation FactoryTalk® AssetCentre.CVE-2025-0477 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comCritical 9.3
An encryption vulnerability exists in all versions prior to V15.00.001 of Rockwell Automation FactoryTalk® AssetCentre. The vulnerability exists due to a weak encryption methodology and could allow a threat actor to extract passwords belonging to other users of the application.
- Product
- FactoryTalk® AssetCentre
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Jan 24, 2025IBM Maximo Asset Management 7.6.1.3 MXAPIASSET API is vulnerable to unrestricted file upload which allows authenticated low privileged user to upload restrictedCVE-2024-45077 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM Maximo Asset Management 7.6.1.3 MXAPIASSET API is vulnerable to unrestricted file upload which allows authenticated low privileged user to upload restricted file types with a simple method of adding a dot to the end of the file name if Maximo is installed on Windows operating system.
- Product
- Maximo Asset Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2025IBM Maximo MXAPIASSET API 7.6.1.3 could allow a remote attacker to traverse directories on the system.CVE-2024-45652 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM Maximo MXAPIASSET API 7.6.1.3 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.
- Product
- Maximo Asset Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2025MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Tokens Wallet: Stored Cross-Site ScriptingCVE-2024-13391 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Tokens Wallet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'videowhisper_content_upload_guest' shortcode in all versions up to, and including, 2.9.29 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Tokens Wallet
- Affected
- up to 2.9.29
- What to do
- Affects up to 2.9.29. Update MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Tokens Wallet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 14, 2025silverstripe-asset-admin is a silverstripe assets gallery for asset management.CVE-2024-47605 · Other software · silverstripe · reported by GitHubMedium 5.4
silverstripe-asset-admin is a silverstripe assets gallery for asset management. When using the "insert media" functionality, the linked oEmbed JSON includes an HTML attribute which will replace the embed shortcode. The HTML is not sanitized before replacing the shortcode, allowing a script payload to be executed on both the CMS and the front-end of the website. This issue has been addressed in silverstripe/framework version 5.3.8 and users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- silverstripe-asset-admin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2024GLPI is a free asset and IT management software package.CVE-2024-50339 · Other software · glpi-project · reported by GitHubCritical 9.3
GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.17, an unauthenticated user can retrieve all the sessions IDs and use them to steal any valid session. Version 10.0.17 contains a patch for this issue.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2024GLPI is a free asset and IT management software package.CVE-2024-48912 · Other software · glpi-project · reported by GitHubHigh 7.2
GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.17, an authenticated user can use an application endpoint to delete any user account. Version 10.0.17 contains a patch for this issue.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2024GLPI is a free asset and IT management software package.CVE-2024-47761 · Other software · glpi-project · reported by GitHubHigh 7.5
GLPI is a free asset and IT management software package. Starting in version 0.80 and prior to version 10.0.17, an administrator with access to the sent notifications contents can take control of an account with higher privileges. Version 10.0.17 contains a patch for this issue.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2024GLPI is a free asset and IT management software package.CVE-2024-47760 · Other software · glpi-project · reported by GitHubHigh 7.5
GLPI is a free asset and IT management software package. Starting in version 9.1.0 and prior to version 10.0.17, a technician with an access to the API can take control of an account with higher privileges. Version 10.0.17 contains a patch for this issue.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2024GLPI is a free asset and IT management software package.CVE-2024-47758 · Other software · glpi-project · reported by GitHubHigh 7.6
GLPI is a free asset and IT management software package. Starting in version 9.3.0 and prior to version 10.0.17, an authenticated user can use the API to take control of any user that have the same or a lower level of privileges. Version 10.0.17 contains a patch for this issue.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2024Insufficient permissions in the TeamViewer Patch & Asset Management component prior to version 24.12 on Windows allows a local authenticated user to delete arbiCVE-2024-12363 · Other software · TeamViewer · reported by psirt@teamviewer.comHigh 7.1
Insufficient permissions in the TeamViewer Patch & Asset Management component prior to version 24.12 on Windows allows a local authenticated user to delete arbitrary files. TeamViewer Patch & Asset Management is part of TeamViewer Remote Management.
- Product
- Patch & Asset Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 30, 2024Asset CleanUp: Page Speed Booster: Server-Side Request Forgery (SSRF)CVE-2024-53738 · WordPress plugins & themes · reported by PatchstackMedium 4.4
Server-Side Request Forgery (SSRF) vulnerability in Gabe Livan Asset CleanUp: Page Speed Booster wp-asset-clean-up allows Server Side Request Forgery.This issue affects Asset CleanUp: Page Speed Booster: from n/a through <= 1.3.9.8.
- Product
- Asset CleanUp: Page Speed Booster
- Affected
- up to 1.3.9.8
- What to do
- Affects up to 1.3.9.8. Update Asset CleanUp: Page Speed Booster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 29, 2024A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the id parameter at /getAssetContent.CVE-2024-53505 · Other software · siyuan · reported by MITRECritical 9.8
A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the id parameter at /getAssetContent.
- Product
- siyuan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 18, 2024GLPI is a free asset and IT management software package.CVE-2024-43416 · Other software · glpi-project · reported by GitHubHigh 7.5
GLPI is a free asset and IT management software package. Starting in version 0.80 and prior to version 10.0.17, an unauthenticated user can use an application endpoint to check if an email address corresponds to a valid GLPI user. Version 10.0.17 fixes the issue.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2024GLPI is a free asset and IT management software package.CVE-2024-38370 · Other software · glpi-project · reported by GitHubMedium 5.3
GLPI is a free asset and IT management software package. Starting in 9.2.0 and prior to 11.0.0, it is possible to download a document from the API without appropriate rights. Upgrade to 10.0.16.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2024GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing.CVE-2024-45611 · Other software · glpi-project · reported by GitHubMedium 5.7
GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authenticated user can bypass the access control policy to create a private RSS feed attached to another user account and use a malicious payload to triggger a stored XSS. Upgrade to 10.0.17.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2024GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing.CVE-2024-45610 · Other software · glpi-project · reported by GitHubMedium 6.5
GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An unauthenticated user can provide a malicious link to a GLPI technician in order to exploit a reflected XSS vulnerability located in the Cable form. Upgrade to 10.0.17.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2024GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing.CVE-2024-45609 · Other software · glpi-project · reported by GitHubMedium 6.5
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An unauthenticated user can provide a malicious link to a GLPI technician in order to exploit a reflected XSS vulnerability located in the reports pages. Upgrade to 10.0.17.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2024GLPI is a free asset and IT management software package.CVE-2024-45608 · Other software · glpi-project · reported by GitHubMedium 6.5
GLPI is a free asset and IT management software package. An authenticated user can perfom a SQL injection by changing its preferences. Upgrade to 10.0.17.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2024GLPI is a free asset and IT management software package.CVE-2024-43418 · Other software · glpi-project · reported by GitHubMedium 6.5
GLPI is a free asset and IT management software package. An unauthenticated user can provide a malicious link to a GLPI technician in order to exploit a reflected XSS vulnerability. Upgrade to 10.0.17.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2024GLPI is a free asset and IT management software package.CVE-2024-43417 · Other software · glpi-project · reported by GitHubMedium 6.5
GLPI is a free asset and IT management software package. An unauthenticated user can provide a malicious link to a GLPI technician in order to exploit a reflected XSS vulnerability located in the Software form. Upgrade to 10.0.17.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2024GLPI is a free asset and IT management software package.CVE-2024-41679 · Other software · glpi-project · reported by GitHubMedium 6.5
GLPI is a free asset and IT management software package. An authenticated user can exploit a SQL injection vulnerability from the ticket form. Upgrade to 10.0.17.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2024GLPI is a free Asset and IT management software package.CVE-2024-47759 · Other software · glpi-project · reported by GitHubMedium 6.7
GLPI is a free Asset and IT management software package. An technician can upload a SVG containing a malicious script. The script will then be executed when any user will try to see the document contents. Upgrade to 10.0.17.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2024GLPI is a free asset and IT management software package.CVE-2024-41678 · Other software · glpi-project · reported by GitHubMedium 6.5
GLPI is a free asset and IT management software package. An unauthenticated user can provide a malicious link to a GLPI technician in order to exploit a reflected XSS vulnerability. Upgrade to 10.0.17.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2024GLPI is a free asset and IT management software package.CVE-2024-40638 · Other software · glpi-project · reported by GitHubHigh 8.1
GLPI is a free asset and IT management software package. An authenticated user can exploit multiple SQL injection vulnerabilities. One of them can be used to alter another user account data and take control of it. Upgrade to 10.0.17.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2024In Progress® Telerik® Report Server versions prior to 2024 Q4 (10.3.24.1112), the encryption of local asset data used an older algorithm which may allow a sophiCVE-2024-7295 · Other software · Progress Software Corporation · reported by security@progress.comHigh 7.1
In Progress® Telerik® Report Server versions prior to 2024 Q4 (10.3.24.1112), the encryption of local asset data used an older algorithm which may allow a sophisticated actor to decrypt this information.
- Product
- Telerik Report Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2024IBM Maximo Asset Management 7.6.1.3 is vulnerable to stored cross-site scripting.CVE-2024-45088 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.4
IBM Maximo Asset Management 7.6.1.3 is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
- Product
- Maximo Asset Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2024Asset CleanUp: Page Speed Booster: Missing AuthorizationCVE-2024-43314 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Gabe Livan Asset CleanUp: Page Speed Booster allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Asset CleanUp: Page Speed Booster: from n/a through 1.3.9.3.
- Product
- Asset CleanUp: Page Speed Booster
- Affected
- up to 1.3.9.3
- What to do
- Affects up to 1.3.9.3. Update Asset CleanUp: Page Speed Booster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2024An information disclosure vulnerability was identified in GitHub Enterprise Server via attacker uploaded asset URL allowing the attacker to retrieve metadata inCVE-2024-9539 · Other software · GitHub · reported by product-cna@github.comMedium 5.7
An information disclosure vulnerability was identified in GitHub Enterprise Server via attacker uploaded asset URL allowing the attacker to retrieve metadata information of a user who clicks on the URL and further exploit it to create a convincing phishing page. This required the attacker to upload malicious SVG files and phish a victim user to click on that uploaded asset URL. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.14 and was fixed in versions 3.14.2, 3.13.5, 3.12.10, 3.11.16. This vulnerability was reported via the GitHub Bug Bounty program.
- Product
- GitHub Enterprise Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.github.comdocs.github.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.