Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
764 results · page 7 of 16
Feb 19, 2025OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar.CVE-2025-25196 · Other software · openfga · reported by GitHubMedium 5.8
OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA < v1.8.4 (Helm chart < openfga-0.2.22, docker < v.1.8.4) are vulnerable to authorization bypass when certain Check and ListObject calls are executed. Users on OpenFGA v1.8.4 or previous, specifically under the following conditions are affected by this authorization bypass vulnerability: 1. Calling Check API or ListObjects with a model that has a relation directly assignable to both public access AND userset with the same type. 2. A type bound public access tuple is assigned to an object. 3. userset tuple is not assigned to the same object. and 4. Check request's user field is a userset that has the same type as the type bound public access tuple's user type. Users are advised to upgrade to v1.8.5 which is backwards compatible. There are no known workarounds for this vulnerability.
- Product
- openfga
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2025Generation of weak initialization vector in an Intel(R) IPP Cryptography software library before version 2021.5 may allow an unauthenticated user to potentiallyCVE-2022-26083 · Other software · Intel · reported by secure@intel.comHigh 7.5
Generation of weak initialization vector in an Intel(R) IPP Cryptography software library before version 2021.5 may allow an unauthenticated user to potentially enable information disclosure via local access.
- Product
- Integrated Performance Primitives Cryptography
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2025Microsoft High Performance Compute (HPC) Pack Remote Code Execution VulnerabilityCVE-2025-21198 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9
Microsoft High Performance Compute (HPC) Pack Remote Code Execution Vulnerability
- Product
- Microsoft HPC Pack 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2025Cacti is an open source performance and fault management framework.CVE-2025-24368 · Other software · Cacti · reported by GitHubMedium 6.9
Cacti is an open source performance and fault management framework. Some of the data stored in automation_tree_rules.php is not thoroughly checked and is used to concatenate the SQL statement in build_rule_item_filter() function from lib/api_automation.php, resulting in SQL injection. This vulnerability is fixed in 1.2.29.
- Product
- cacti
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2025Cacti is an open source performance and fault management framework.CVE-2025-24367 · Other software · Cacti · reported by GitHubHigh 8.7
Cacti is an open source performance and fault management framework. An authenticated Cacti user can abuse graph creation and graph template functionality to create arbitrary PHP scripts in the web root of the application, leading to remote code execution on the server. This vulnerability is fixed in 1.2.29.
- Product
- cacti
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2025Cacti is an open source performance and fault management framework.CVE-2025-22604 · Other software · Cacti · reported by GitHubCritical 9.1
Cacti is an open source performance and fault management framework. Due to a flaw in multi-line SNMP result parser, authenticated users can inject malformed OIDs in the response. When processed by ss_net_snmp_disk_io() or ss_net_snmp_disk_bytes(), a part of each OID will be used as a key in an array that is used as part of a system command, causing a command execution vulnerability. This vulnerability is fixed in 1.2.29.
- Product
- cacti
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2025Cacti is an open source performance and fault management framework.CVE-2024-54146 · Other software · Cacti · reported by GitHubHigh 7.6
Cacti is an open source performance and fault management framework. Cacti has a SQL injection vulnerability in the template function of host_templates.php using the graph_template parameter. This vulnerability is fixed in 1.2.29.
- Product
- cacti
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2025Cacti is an open source performance and fault management framework.CVE-2024-54145 · Other software · Cacti · reported by GitHubMedium 6.3
Cacti is an open source performance and fault management framework. Cacti has a SQL injection vulnerability in the get_discovery_results function of automation_devices.php using the network parameter. This vulnerability is fixed in 1.2.29.
- Product
- cacti
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2025Cacti is an open source performance and fault management framework.CVE-2024-45598 · Other software · Cacti · reported by GitHubMedium 6
Cacti is an open source performance and fault management framework. Prior to 1.2.29, an administrator can change the `Poller Standard Error Log Path` parameter in either Installation Step 5 or in Configuration->Settings->Paths tab to a local file inside the server. Then simply going to Logs tab and selecting the name of the local file will show its content on the web UI. This vulnerability is fixed in 1.2.29.
- Product
- cacti
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2025Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Performance Schema).CVE-2025-21534 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 4.9
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Performance Schema). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and 9.0.1 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
- Product
- MySQL Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordoracle.comsecurity.netapp.com
Jan 15, 2025Sentry is a developer-first error tracking and performance monitoring tool.CVE-2025-22146 · Other software · getsentry · reported by GitHubCritical 9.1
Sentry is a developer-first error tracking and performance monitoring tool. A critical vulnerability was discovered in the SAML SSO implementation of Sentry. It was reported to us via our private bug bounty program. The vulnerability allows an attacker to take over any user account by using a malicious SAML Identity Provider and another organization on the same Sentry instance. The victim email address must be known in order to exploit this vulnerability. The Sentry SaaS fix was deployed on Jan 14, 2025. For self hosted users; if only a single organization is allowed `(SENTRY_SINGLE_ORGANIZATION = True)`, then no action is needed. Otherwise, users should upgrade to version 25.1.0 or higher. There are no known workarounds for this vulnerability.
- Product
- sentry
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2025wp Hosting Performance Check: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22521 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Scott Farrell wp Hosting Performance Check wp-hosting-performance-check allows Reflected XSS.This issue affects wp Hosting Performance Check: from n/a through <= 2.18.8.
- Product
- wp Hosting Performance Check
- Affected
- up to 2.18.8
- What to do
- Affects up to 2.18.8. Update wp Hosting Performance Check to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 4, 2025WP Compress – Instant Performance & Speed Optimization: Reflected Cross-Site ScriptingCVE-2024-12047 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘custom_server’ parameter in all versions up to, and including, 6.30.03 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- WP Compress – Instant Performance & Speed Optimization
- Affected
- up to 6.30.03
- What to do
- Affects up to 6.30.03. Update WP Compress – Instant Performance & Speed Optimization to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 2, 2025Swift Performance Lite: Cross-Site Request Forgery (CSRF)CVE-2024-37511 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in swte Swift Performance Lite swift-performance-lite allows Cross Site Request Forgery.This issue affects Swift Performance Lite: from n/a through <= 2.3.6.20.
- Product
- Swift Performance Lite
- Affected
- up to 2.3.6.20
- What to do
- Affects up to 2.3.6.20. Update Swift Performance Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2024An issue exists in SoftIron HyperCloud where authenticated, but non-admin users can create data pools, which could potentially impact the performance and availCVE-2024-13058 · Other software · SoftIron · reported by 0a72a055-908d-47f5-a16a-1f09049c16c6Medium 4.8
An issue exists in SoftIron HyperCloud where authenticated, but non-admin users can create data pools, which could potentially impact the performance and availability of the backend software-defined storage subsystem. This issue only impacts SoftIron HyperCloud and related software products (such as VM Squared) software versions 2.3.0 to before 2.5.0.
- Product
- HyperCloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.softiron.cloud
Dec 18, 2024Envoy is a cloud-native high-performance edge/middle/service proxy.CVE-2024-53271 · Other software · envoyproxy · reported by GitHubHigh 7.1
Envoy is a cloud-native high-performance edge/middle/service proxy. In affected versions envoy does not properly handle http 1.1 non-101 1xx responses. This can lead to downstream failures in networked devices. This issue has been addressed in versions 1.31.5 and 1.32.3. Users are advised to upgrade. There are no known workarounds for this issue.
- Product
- envoy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2024Envoy is a cloud-native high-performance edge/middle/service proxy.CVE-2024-53270 · Other software · envoyproxy · reported by GitHubHigh 7.5
Envoy is a cloud-native high-performance edge/middle/service proxy. In affected versions `sendOverloadError` is going to assume the active request exists when `envoy.load_shed_points.http1_server_abort_dispatch` is configured. If `active_request` is nullptr, only onMessageBeginImpl() is called. However, the `onMessageBeginImpl` will directly return ok status if the stream is already reset leading to the nullptr reference. The downstream reset can actually happen during the H/2 upstream reset. As a result envoy may crash. This issue has been addressed in releases 1.32.3, 1.31.5, 1.30.9, and 1.29.12. Users are advised to upgrade. Users unable to upgrade may disable `http1_server_abort_dispatch` load shed point and/or use a high threshold.
- Product
- envoy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2024Envoy is a cloud-native high-performance edge/middle/service proxy.CVE-2024-53269 · Other software · envoyproxy · reported by GitHubMedium 4.5
Envoy is a cloud-native high-performance edge/middle/service proxy. When additional address are not ip addresses, then the Happy Eyeballs sorting algorithm will crash in data plane. This issue has been addressed in releases 1.32.2, 1.31.4, and 1.30.8. Users are advised to upgrade. Users unable to upgrade may disable Happy Eyeballs and/or change the IP configuration.
- Product
- envoy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2024MinIO is a high-performance, S3 compatible object store, open sourced under GNU AGPLv3 license.CVE-2024-55949 · Other software · minio · reported by GitHubCritical 9.3
MinIO is a high-performance, S3 compatible object store, open sourced under GNU AGPLv3 license. Minio is subject to a privilege escalation in IAM import API, all users are impacted since MinIO commit `580d9db85e04f1b63cc2909af50f0ed08afa965f`. This issue has been addressed in commit `f246c9053f9603e610d98439799bdd2a6b293427` which is included in RELEASE.2024-12-13T22-19-12Z. There are no workarounds possible, all users are advised to upgrade immediately.
- Product
- minio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2024Playloom Engine is an open-source, high-performance game development engine.CVE-2024-55946 · Other software · Quetrobits · reported by GitHubHigh 8.7
Playloom Engine is an open-source, high-performance game development engine. Engine Beta v0.0.1 has a security vulnerability related to data storage, specifically when using the collaboration features. When collaborating with another user, they may have access to personal information you have entered into the software. This poses a risk to user privacy. The maintainers of Playloom Engine have temporarily disabled the collaboration feature until a fix can be implemented. When Engine Beta v0.0.2 is released, it is expected to contain a patch addressing this issue. Users should refrain from using the collaboration feature in the meantime.
- Product
- Playloom-Engine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2024Laravel Pulse is a real-time application performance monitoring tool and dashboard for Laravel applications.CVE-2024-55661 · Other software · laravel · reported by GitHubHigh 8.7
Laravel Pulse is a real-time application performance monitoring tool and dashboard for Laravel applications. A vulnerability has been discovered in Laravel Pulse prior to version 1.3.1 that could allow remote code execution through the public `remember()` method in the `Laravel\Pulse\Livewire\Concerns\RemembersQueries` trait. This method is accessible via Livewire components and can be exploited to call arbitrary callables within the application. An authenticated user with access to Laravel Pulse dashboard can execute arbitrary code by calling any function or static method in which the callable is a function or static method and the callable has no parameters or no strict parameter types. The vulnerable to component is `remember(callable $query, string $key = '')` method in `Laravel\Pulse\Livewire\Concerns\RemembersQueries`, and the vulnerability affects all Pulse card components that use this trait. Version 1.3.1 contains a patch.
- Product
- pulse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2024Under specific circumstances, insecure permissions in Ivanti Performance Manager before version 2024.3 HF1, 2024.1 HF1, or 2023.3 HF1 allows a local authenticatCVE-2024-11597 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75High 7.8
Under specific circumstances, insecure permissions in Ivanti Performance Manager before version 2024.3 HF1, 2024.1 HF1, or 2023.3 HF1 allows a local authenticated attacker to achieve local privilege escalation.
- Product
- Performance Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 6, 2024Swift Performance Lite: Local PHP File InclusionCVE-2024-10516 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Swift Performance Lite plugin for WordPress is vulnerable to Local PHP File Inclusion in all versions up to, and including, 2.3.7.1 via the 'ajaxify' function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
- Product
- Swift Performance Lite
- Affected
- up to 2.3.7.1
- What to do
- Affects up to 2.3.7.1. Update Swift Performance Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 3, 2024An issue in InfoDom Performa 365 v4.0.1 allows authenticated attackers to elevate their privileges to Administrator via a crafted payload sent to /api/users.CVE-2024-46624 · Other software · infodom · reported by MITREHigh 8.8
An issue in InfoDom Performa 365 v4.0.1 allows authenticated attackers to elevate their privileges to Administrator via a crafted payload sent to /api/users.
- Product
- performa_365
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2024An authenticated arbitrary file upload vulnerability in the /documentCache/upload endpoint of InfoDom Performa 365 v4.0.1 allows attackers to execute arbitrary CVE-2024-46625 · Other software · reported by MITREHigh 8.8
An authenticated arbitrary file upload vulnerability in the /documentCache/upload endpoint of InfoDom Performa 365 v4.0.1 allows attackers to execute arbitrary code via uploading a crafted SVG file.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 25, 2024SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte.CVE-2024-53262 · Other software · sveltejs · reported by GitHubLow 2
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. The static error.html template for errors contains placeholders that are replaced without escaping the content first. error.html is the page that is rendered when everything else fails. It can contain the following placeholders: %sveltekit.status% — the HTTP status, and %sveltekit.error.message% — the error message. This leads to possible injection if an app explicitly creates an error with a message that contains user controlled content. Only applications where user provided input is used in the `Error` message will be vulnerable, so the vast majority of applications will not be vulnerable This issue has been addressed in version 2.8.3 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- kit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 25, 2024SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte.CVE-2024-53261 · Other software · sveltejs · reported by GitHubLow 2
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. "Unsanitized input from *the request URL* flows into `end`, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS)." The files `packages/kit/src/exports/vite/dev/index.js` and `packages/kit/src/exports/vite/utils.js` both contain user controllable data which under specific conditions may flow to dev mode pages. There is little to no expected impact. The Vite development is not exposed to the network by default and even if someone were able to trick a developer into executing an XSS against themselves, a development database should not have any sensitive data. None the less this issue has been addressed in version 2.8.3 and all users are advised to upgrade.
- Product
- kit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024Sentry is an error tracking and performance monitoring platform.CVE-2024-53253 · Other software · getsentry · reported by GitHubMedium 5.3
Sentry is an error tracking and performance monitoring platform. Version 24.11.0, and only version 24.11.0, is vulnerable to a scenario where a specific error message generated by the Sentry platform could include a plaintext Client ID and Client Secret for an application integration. The Client ID and Client Secret would not be displayed in the UI, but would be returned in the underlying HTTP response to the end user. This could occur under the following conditions: An app installation made use of a Search UI component with the `async` flag set to true (default: true); auser types types into the Search Component which creates a request to the third-party for search or query results; and that third-party response may then fail validation and Sentry would return the `select-requester.invalid-response` error code along with a serialized version of a Sentry application containing the integration Client Secret. Should this error be found, it's reasonable to assume the potential exposure of an integration Client Secret. However, an ID and Secret pair alone does not provide direct access to any data. For that secret to be abused an attacker would also need to obtain a valid API token for
- Product
- sentry
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting.CVE-2024-49369 · Other software · Icinga · reported by GitHubCritical 9.8
Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. The TLS certificate validation in all Icinga 2 versions starting from 2.4.0 was flawed, allowing an attacker to impersonate both trusted cluster nodes as well as any API users that use TLS client certificates for authentication (ApiUser objects with the client_cn attribute set). This vulnerability has been fixed in v2.14.3, v2.13.10, v2.12.11, and v2.11.12.
- Product
- icinga2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients.CVE-2024-47535 · Other software · netty · reported by GitHubMedium 5.5
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. An unsafe reading of environment file could potentially cause a denial of service in Netty. When loaded on an Windows application, Netty attempts to load a file that does not exist. If an attacker creates such a large file, the Netty application crashes. This vulnerability is fixed in 4.1.115.
- Product
- netty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2024In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Prevent out of bounds access in performance query extensions Check that the numbeCVE-2024-49984 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Prevent out of bounds access in performance query extensions Check that the number of perfmons userspace is passing in the copy and reset extensions is not greater than the internal kernel storage where the ids will be copied into.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Oct 7, 2024Cacti is an open source performance and fault management framework.CVE-2024-43365 · Other software · Cacti · reported by GitHubMedium 5.7
Cacti is an open source performance and fault management framework. The`consolenewsection` parameter is not properly sanitized when saving external links in links.php . Morever, the said consolenewsection parameter is stored in the database and reflected back to user in `index.php`, finally leading to stored XSS. Users with the privilege to create external links can manipulate the “consolenewsection” parameter in the http post request while creating external links to perform stored XSS attacks. The vulnerability known as XSS (Cross-Site Scripting) occurs when an application allows untrusted user input to be displayed on a web page without proper validation or escaping. This issue has been addressed in release version 1.2.28. All users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- cacti
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Oct 7, 2024Cacti is an open source performance and fault management framework.CVE-2024-43364 · Other software · Cacti · reported by GitHubMedium 5.7
Cacti is an open source performance and fault management framework. The `title` parameter is not properly sanitized when saving external links in links.php . Morever, the said title parameter is stored in the database and reflected back to user in index.php, finally leading to stored XSS. Users with the privilege to create external links can manipulate the `title` parameter in the http post request while creating external links to perform stored XSS attacks. The vulnerability known as XSS (Cross-Site Scripting) occurs when an application allows untrusted user input to be displayed on a web page without proper validation or escaping. This issue has been addressed in release version 1.2.28. All users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- cacti
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Oct 7, 2024Cacti is an open source performance and fault management framework.CVE-2024-43363 · Other software · Cacti · reported by GitHubHigh 7.2
Cacti is an open source performance and fault management framework. An admin user can create a device with a malicious hostname containing php code and repeat the installation process (completing only step 5 of the installation process is enough, no need to complete the steps before or after it) to use a php file as the cacti log file. After having the malicious hostname end up in the logs (log poisoning), one can simply go to the log file url to execute commands to achieve RCE. This issue has been addressed in version 1.2.28 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- cacti
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Oct 7, 2024Cacti is an open source performance and fault management framework.CVE-2024-43362 · Other software · Cacti · reported by GitHubHigh 7.3
Cacti is an open source performance and fault management framework. The `fileurl` parameter is not properly sanitized when saving external links in `links.php` . Morever, the said fileurl is placed in some html code which is passed to the `print` function in `link.php` and `index.php`, finally leading to stored XSS. Users with the privilege to create external links can manipulate the `fileurl` parameter in the http post request while creating external links to perform stored XSS attacks. The vulnerability known as XSS (Cross-Site Scripting) occurs when an application allows untrusted user input to be displayed on a web page without proper validation or escaping. This issue has been addressed in release version 1.2.28. All users are advised to upgrade. There are no known workarounds for this issue.
- Product
- cacti
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Oct 7, 2024Improper resource management in firmware of some Solidigm DC Products may allow an attacker to potentially control the performance of the resource.CVE-2024-47972 · Other software · Solidigm · reported by f946a70c-00eb-42ce-8e9b-634d1f7b5a6fMedium 4
Improper resource management in firmware of some Solidigm DC Products may allow an attacker to potentially control the performance of the resource.
- Product
- D7-P5510
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2024Cross-site scripting vulnerability exists in MF Teacher Performance Management System version 6.CVE-2024-41930 · Other software · Media Fusion Co.,Ltd. · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability exists in MF Teacher Performance Management System version 6. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the website using the product.
- Product
- MF Teacher Performance Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2024Envoy is a cloud-native high-performance edge/middle/service proxy.CVE-2024-45810 · Other software · envoyproxy · reported by GitHubMedium 6.5
Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy will crash when the http async client is handling `sendLocalReply` under some circumstance, e.g., websocket upgrade, and requests mirroring. The http async client will crash during the `sendLocalReply()` in http async client, one reason is http async client is duplicating the status code, another one is the destroy of router is called at the destructor of the async stream, while the stream is deferred deleted at first. There will be problems that the stream decoder is destroyed but its reference is called in `router.onDestroy()`, causing segment fault. This will impact ext_authz if the `upgrade` and `connection` header are allowed, and request mirrorring. This issue has been addressed in versions 1.31.2, 1.30.6, 1.29.9, and 1.28.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- envoy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2024Envoy is a cloud-native high-performance edge/middle/service proxy.CVE-2024-45809 · Other software · envoyproxy · reported by GitHubMedium 5.3
Envoy is a cloud-native high-performance edge/middle/service proxy. Jwt filter will lead to an Envoy crash when clear route cache with remote JWKs. In the following case: 1. remote JWKs are used, which requires async header processing; 2. clear_route_cache is enabled on the provider; 3. header operations are enabled in JWT filter, e.g. header to claims feature; 4. the routing table is configured in a way that the JWT header operations modify requests to not match any route. When these conditions are met, a crash is triggered in the upstream code due to nullptr reference conversion from route(). The root cause is the ordering of continueDecoding and clearRouteCache. This issue has been addressed in versions 1.31.2, 1.30.6, and 1.29.9. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- envoy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2024Envoy is a cloud-native high-performance edge/middle/service proxy.CVE-2024-45808 · Other software · envoyproxy · reported by GitHubMedium 6.5
Envoy is a cloud-native high-performance edge/middle/service proxy. A vulnerability has been identified in Envoy that allows malicious attackers to inject unexpected content into access logs. This is achieved by exploiting the lack of validation for the `REQUESTED_SERVER_NAME` field for access loggers. This issue has been addressed in versions 1.31.2, 1.30.6, 1.29.9, and 1.28.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- envoy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2024Envoy is a cloud-native high-performance edge/middle/service proxy.CVE-2024-45807 · Other software · envoyproxy · reported by GitHubHigh 7.5
Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy's 1.31 is using `oghttp` as the default HTTP/2 codec, and there are potential bugs around stream management in the codec. To resolve this Envoy will switch off the `oghttp2` by default. The impact of this issue is that envoy will crash. This issue has been addressed in release version 1.31.2. All users are advised to upgrade. There are no known workarounds for this issue.
- Product
- envoy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2024Envoy is a cloud-native high-performance edge/middle/service proxy.CVE-2024-45806 · Other software · envoyproxy · reported by GitHubMedium 6.5
Envoy is a cloud-native high-performance edge/middle/service proxy. A security vulnerability in Envoy allows external clients to manipulate Envoy headers, potentially leading to unauthorized access or other malicious actions within the mesh. This issue arises due to Envoy's default configuration of internal trust boundaries, which considers all RFC1918 private address ranges as internal. The default behavior for handling internal addresses in Envoy has been changed. Previously, RFC1918 IP addresses were automatically considered internal, even if the internal_address_config was empty. The default configuration of Envoy will continue to trust internal addresses while in this release and it will not trust them by default in next release. If you have tooling such as probes on your private network which need to be treated as trusted (e.g. changing arbitrary x-envoy headers) please explicitly include those addresses or CIDR ranges into `internal_address_config`. Successful exploitation could allow attackers to bypass security controls, access sensitive data, or disrupt services within the mesh, like Istio. This issue has been addressed in versions 1.31.2, 1.30.6, 1.29.9, and 1.28.7. Use
- Product
- envoy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2024A vulnerability was found in Performance Co-Pilot (PCP).CVE-2024-45770 · Other software · Red Hat · reported by Red HatMedium 4.4
A vulnerability was found in Performance Co-Pilot (PCP). This flaw can only be exploited if an attacker has access to a compromised PCP system account. The issue is related to the pmpost tool, which is used to log messages in the system. Under certain conditions, it runs with high-level privileges.
- Product
- Red Hat Enterprise Linux 8
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Sep 19, 2024A vulnerability was found in Performance Co-Pilot (PCP).CVE-2024-45769 · Other software · Red Hat · reported by Red HatMedium 5.5
A vulnerability was found in Performance Co-Pilot (PCP). This flaw allows an attacker to send specially crafted data to the system, which could cause the program to misbehave or crash.
- Product
- Red Hat Enterprise Linux 8
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Sep 17, 2024Sentry is a developer-first error tracking and performance monitoring platform.CVE-2024-45606 · Other software · getsentry · reported by GitHubHigh 7.1
Sentry is a developer-first error tracking and performance monitoring platform. An authenticated user can mute alert rules from arbitrary organizations and projects with a know rule ID. The user does not need to be a member of the organization or have permissions on the project. In our review, we have identified no instances where alerts have been muted by unauthorized parties. A patch was issued to ensure authorization checks are properly scoped on requests to mute alert rules. Authenticated users who do not have the necessary permissions are no longer able to mute alerts. Sentry SaaS users do not need to take any action. Self-Hosted Sentry users should upgrade to version **24.9.0** or higher. The rule mute feature was generally available as of 23.6.0 but users with early access may have had the feature as of 23.4.0. Affected users are advised to upgrade to version 24.9.0. There are no known workarounds for this vulnerability.
- Product
- sentry
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2024Sentry is a developer-first error tracking and performance monitoring platform.CVE-2024-45605 · Other software · getsentry · reported by GitHubMedium 6.5
Sentry is a developer-first error tracking and performance monitoring platform. An authenticated user delete the user issue alert notifications for arbitrary users given a know alert ID. A patch was issued to ensure authorization checks are properly scoped on requests to delete user alert notifications. Sentry SaaS users do not need to take any action. Self-Hosted Sentry users should upgrade to version 24.9.0 or higher. There are no known workarounds for this vulnerability.
- Product
- sentry
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2024Incorrect authorization in kperfmon prior to SMR Sep-2024 Release 1 allows local attackers to access information related to performance including app usage.CVE-2024-34652 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4
Incorrect authorization in kperfmon prior to SMR Sep-2024 Release 1 allows local attackers to access information related to performance including app usage.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.com
Aug 30, 2024svelte performance oriented web framework.CVE-2024-45047 · Other software · sveltejs · reported by GitHubMedium 5.4
svelte performance oriented web framework. A potential mXSS vulnerability exists in Svelte for versions up to but not including 4.2.19. Svelte improperly escapes HTML on server-side rendering. The assumption is that attributes will always stay as such, but in some situation the final DOM tree rendered on browsers is different from what Svelte expects on server-side rendering. This may be leveraged to perform XSS attacks, and a type of the XSS is known as mXSS (mutation XSS). More specifically, this can occur when injecting malicious content into an attribute within a `noscript` tag. This issue has been addressed in release version 4.2.19. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- svelte
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2024The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2.CVE-2024-43783 · Other software · apollographql · reported by GitHubHigh 7.5
The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. Instances of the Apollo Router running versions >=1.21.0 and < 1.52.1 are impacted by a denial of service vulnerability if _all_ of the following are true: 1. The Apollo Router has been configured to support [External Coprocessing](https://www.apollographql.com/docs/router/customizations/coprocessor). 2. The Apollo Router has been configured to send request bodies to coprocessors. This is a non-default configuration and must be configured intentionally by administrators. Instances of the Apollo Router running versions >=1.7.0 and <1.52.1 are impacted by a denial-of-service vulnerability if all of the following are true: 1. Router has been configured to use a custom-developed Native Rust Plugin. 2. The plugin accesses Request.router_request in the RouterService layer. 3. You are accumulating the body from Request.router_request into memory. If using an impacted configuration, the Router will load entire HTTP request bodies into memory without respect to other HTTP request size-limiting configurations like limits.http_max_request_bytes.
- Product
- router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2024Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in OpenText Performance Center on Windows allows CrossCVE-2022-26328 · Other software · OpenText · reported by security@opentext.comLow 2
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in OpenText Performance Center on Windows allows Cross-Site Scripting (XSS).This issue affects Performance Center: 12.63.
- Product
- Performance Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.