Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,568 results · page 8 of 32
Nov 5, 2024In the Linux kernel, the following vulnerability has been resolved: net: netconsole: fix wrong warning A warning is triggered when there is insufficient spaceCVE-2024-50092 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Low 3.3
In the Linux kernel, the following vulnerability has been resolved: net: netconsole: fix wrong warning A warning is triggered when there is insufficient space in the buffer for userdata. However, this is not an issue since userdata will be sent in the next iteration. Current warning message: ------------[ cut here ]------------ WARNING: CPU: 13 PID: 3013042 at drivers/net/netconsole.c:1122 write_ext_msg+0x3b6/0x3d0 ? write_ext_msg+0x3b6/0x3d0 console_flush_all+0x1e9/0x330 The code incorrectly issues a warning when this_chunk is zero, which is a valid scenario. The warning should only be triggered when this_chunk is negative.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Oct 28, 2024WP Query Console: Improper Control of Generation of Code ('Code Injection')CVE-2024-50498 · WordPress plugins & themes · reported by PatchstackCritical 10
Improper Control of Generation of Code ('Code Injection') vulnerability in Ajit Bohra WP Query Console wp-query-console allows Code Injection.This issue affects WP Query Console: from n/a through <= 1.0.
- Product
- WP Query Console
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update WP Query Console to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comgithub.com
Oct 24, 2024When editing objects in the Syncope Console, incomplete HTML tags could be used to bypass HTML sanitization.CVE-2024-45031 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.1
When editing objects in the Syncope Console, incomplete HTML tags could be used to bypass HTML sanitization. This made it possible to inject stored XSS payloads which would trigger for other users during ordinary usage of the application. XSS payloads could also be injected in Syncope Enduser when editing “Personal Information” or “User Requests”: such payloads would trigger for administrators in Syncope Console, thus enabling session hijacking. Users are recommended to upgrade to version 3.0.9, which fixes this issue.
- Product
- Apache Syncope
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Oct 22, 2024The Script Console in Liferay Portal 7.0.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, 7CVE-2024-8980 · Other software · Liferay · reported by security@liferay.comCritical 9.6
The Script Console in Liferay Portal 7.0.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, 7.2 GA through fix pack 20, 7.1 GA through fix pack 28, 7.0 GA through fix pack 102 and 6.2 GA through fix pack 173 does not sufficiently protect against Cross-Site Request Forgery (CSRF) attacks, which allows remote attackers to execute arbitrary Groovy script via a crafted URL or a XSS vulnerability.
- Product
- Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2024Nokia SR OS routers allow read-write access to the entire file system via SFTP or SCP for users configured with "access console." Consequently, a low privilege CVE-2023-6729 · Other software · Nokia · reported by b48c3b8f-639e-4c16-8725-497bc411dad0High 7.3
Nokia SR OS routers allow read-write access to the entire file system via SFTP or SCP for users configured with "access console." Consequently, a low privilege authenticated user with "access console" can read or replace the router configuration file as well as other files stored in the Compact Flash or SD card without using CLI commands. This type of attack can lead to a compromise or denial of service of the router after the system is rebooted.
- Product
- SR OS (7250 IXR, 7450 ESS, 7750 SR, 7950 IXR, VSR), 7705 SAR OS, 7210 SAS OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2024Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console).CVE-2024-21274 · Websites & servers · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.5
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle WebLogic Server. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
- Product
- Oracle WebLogic Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2024Microsoft Windows Management Console Remote Code Execution VulnerabilityCVE-2024-43572 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Management Console contains unspecified vulnerability that allows for remote code execution.
- Product
- Windows
- On CISA’s list since
- Oct 8, 2024 (federal fix deadline Oct 29, 2024)
- What to do
- Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogmsrc.microsoft.comcisa.gov
Oct 8, 2024Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Payara Platform Payara Server (Admin Console moduleCVE-2024-8215 · Other software · Payara Platform · reported by 769c9ae7-73c3-4e47-ae19-903170fc3eb8High 8.7
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Payara Platform Payara Server (Admin Console modules) allows Remote Code Inclusion.This issue affects Payara Server: from 5.20.0 before 5.68.0, from 6.0.0 before 6.19.0, from 6.2022.1 before 6.2024.10, from 4.1.2.191.1 before 4.1.2.191.51.
- Product
- Payara Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.payara.fishdocs.payara.fish
Oct 7, 2024Teedy 1.11 is vulnerable to Cross Site Scripting (XSS) via the management console.CVE-2024-46278 · Other software · sismics · reported by MITREHigh 8.4
Teedy 1.11 is vulnerable to Cross Site Scripting (XSS) via the management console.
- Product
- teedy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2024Memory corruption is possible when an attempt is made from userspace or console to write some haptics effects pattern to the haptics debugfs file.CVE-2024-23374 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 6.7
Memory corruption is possible when an attempt is made from userspace or console to write some haptics effects pattern to the haptics debugfs file.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2024Once logged in to ProGauge MAGLINK LX4 CONSOLE, a valid user can change their privileges to administrator.CVE-2024-45373 · Other software · Dover Fueling Solutions (DFS) · reported by ics-cert@hq.dhs.govHigh 8.7
Once logged in to ProGauge MAGLINK LX4 CONSOLE, a valid user can change their privileges to administrator.
- Product
- ProGauge MAGLINK LX CONSOLE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2024A specially crafted POST request to the ProGauge MAGLINK LX CONSOLE IP sub-menu can allow a remote attacker to inject arbitrary commands.CVE-2024-45066 · Other software · Dover Fueling Solutions (DFS) · reported by ics-cert@hq.dhs.govCritical 10
A specially crafted POST request to the ProGauge MAGLINK LX CONSOLE IP sub-menu can allow a remote attacker to inject arbitrary commands.
- Product
- ProGauge MAGLINK LX CONSOLE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2024A specially crafted POST request to the ProGauge MAGLINK LX CONSOLE UTILITY sub-menu can allow a remote attacker to inject arbitrary commands.CVE-2024-43693 · Other software · Dover Fueling Solutions (DFS) · reported by ics-cert@hq.dhs.govCritical 10
A specially crafted POST request to the ProGauge MAGLINK LX CONSOLE UTILITY sub-menu can allow a remote attacker to inject arbitrary commands.
- Product
- ProGauge MAGLINK LX CONSOLE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2024An attacker can directly request the ProGauge MAGLINK LX CONSOLE resource sub page with full privileges by requesting the URL directly.CVE-2024-43692 · Other software · Dover Fueling Solutions (DFS) · reported by ics-cert@hq.dhs.govCritical 9.3
An attacker can directly request the ProGauge MAGLINK LX CONSOLE resource sub page with full privileges by requesting the URL directly.
- Product
- ProGauge MAGLINK LX CONSOLE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2024The web application for ProGauge MAGLINK LX4 CONSOLE contains an administrative-level user account with a password that cannot be changed.CVE-2024-43423 · Other software · Dover Fueling Solutions (DFS) · reported by ics-cert@hq.dhs.govCritical 9.3
The web application for ProGauge MAGLINK LX4 CONSOLE contains an administrative-level user account with a password that cannot be changed.
- Product
- ProGauge MAGLINK LX CONSOLE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2024ProGauge MAGLINK LX CONSOLE does not have sufficient filtering on input fields that are used to render pages which may allow cross site scripting.CVE-2024-41725 · Other software · Dover Fueling Solutions (DFS) · reported by ics-cert@hq.dhs.govHigh 8.7
ProGauge MAGLINK LX CONSOLE does not have sufficient filtering on input fields that are used to render pages which may allow cross site scripting.
- Product
- ProGauge MAGLINK LX CONSOLE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2024IBM Aspera Console 3.4.0 through 3.4.4 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag.CVE-2022-43845 · Other software · IBM · reported by psirt@us.ibm.comLow 3.7
IBM Aspera Console 3.4.0 through 3.4.4 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this vulnerability to obtain sensitive information from the cookie.
- Product
- Aspera Console
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2024IBM Aspera Console 3.4.0 through 3.4.4 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by a CSV injection vulnerabilCVE-2021-38963 · Other software · IBM · reported by psirt@us.ibm.comHigh 8
IBM Aspera Console 3.4.0 through 3.4.4 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by a CSV injection vulnerability. By persuading a victim to open a specially crafted file, an attacker could exploit this vulnerability to execute arbitrary code on the system.
- Product
- Aspera Console
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2024Improper access control in Intel(R) RAID Web Console software all versions may allow an authenticated user to potentially enable denial of service via adjacent CVE-2024-36261 · Other software · Intel · reported by secure@intel.comLow 3.5
Improper access control in Intel(R) RAID Web Console software all versions may allow an authenticated user to potentially enable denial of service via adjacent access.
- Product
- Raid Web Console
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2024Improper access control in Intel(R) RAID Web Console all versions may allow an authenticated user to potentially enable denial of service via adjacent access.CVE-2024-36247 · Other software · Intel · reported by secure@intel.comMedium 4.6
Improper access control in Intel(R) RAID Web Console all versions may allow an authenticated user to potentially enable denial of service via adjacent access.
- Product
- Raid Web Console
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2024Improper input validation in some Intel(R) RAID Web Console software all versions may allow an authenticated user to potentially enable information disclosure vCVE-2024-34545 · Other software · Intel · reported by secure@intel.comMedium 5.2
Improper input validation in some Intel(R) RAID Web Console software all versions may allow an authenticated user to potentially enable information disclosure via adjacent access.
- Product
- Raid Web Console
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2024Improper access control in Intel(R) RAID Web Console software for all versions may allow an authenticated user to potentially enable escalation of privilege viaCVE-2024-34543 · Other software · intel · reported by secure@intel.comMedium 6.7
Improper access control in Intel(R) RAID Web Console software for all versions may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- raid_web_console
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2024Uncontrolled search path element in Intel(R) RAID Web Console software for all versions may allow an authenticated user to potentially enable escalation of privCVE-2024-34153 · Other software · intel · reported by secure@intel.comMedium 6.7
Uncontrolled search path element in Intel(R) RAID Web Console software for all versions may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- raid_web_console
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2024Uncaught exception in Intel(R) RAID Web Console software all versions may allow an authenticated user to potentially enable denial of service via local access.CVE-2024-33848 · Other software · Intel · reported by secure@intel.comMedium 6.5
Uncaught exception in Intel(R) RAID Web Console software all versions may allow an authenticated user to potentially enable denial of service via local access.
- Product
- Raid Web Console
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2024Improper access control in Intel(R) RAID Web Console software for all versions may allow an authenticated user to potentially enable denial of service via adjacCVE-2024-32940 · Other software · Intel · reported by secure@intel.comMedium 6.5
Improper access control in Intel(R) RAID Web Console software for all versions may allow an authenticated user to potentially enable denial of service via adjacent access.
- Product
- Raid Web Console
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2024NULL pointer dereference in Intel(R) RAID Web Console software for all versions may allow an authenticated user to potentially enable denial of service via locaCVE-2024-32666 · Other software · Intel · reported by secure@intel.comMedium 4.7
NULL pointer dereference in Intel(R) RAID Web Console software for all versions may allow an authenticated user to potentially enable denial of service via local access.
- Product
- Raid Web Console
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2024Improper access control in Intel(R) RAID Web Console all versions may allow an authenticated user to potentially enable information disclosure via local access.CVE-2024-28170 · Other software · Intel · reported by secure@intel.comLow 3.3
Improper access control in Intel(R) RAID Web Console all versions may allow an authenticated user to potentially enable information disclosure via local access.
- Product
- Raid Web Console
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2024In the Linux kernel, the following vulnerability has been resolved: Revert "serial: 8250_omap: Set the console genpd always on if no console suspend" This revCVE-2024-46703 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: Revert "serial: 8250_omap: Set the console genpd always on if no console suspend" This reverts commit 68e6939ea9ec3d6579eadeab16060339cdeaf940. Kevin reported that this causes a crash during suspend on platforms that dont use PM domains.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Sep 10, 2024SQL injection in the management console of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to achieve remote cCVE-2024-8191 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75High 7.8
SQL injection in the management console of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to achieve remote code execution.
- Product
- Endpoint Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024DLL hijacking in the management console of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local authenticated attacker to escalate their prCVE-2024-44107 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75High 8.8
DLL hijacking in the management console of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local authenticated attacker to escalate their privileges and achieve arbitrary code execution.
- Product
- Workspace Control
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024Insufficient server-side controls in the management console of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local authenticated attacker CVE-2024-44106 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75High 8.8
Insufficient server-side controls in the management console of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local authenticated attacker to escalate their privileges.
- Product
- Workspace Control
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024Cleartext transmission of sensitive information in the management console of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local authentiCVE-2024-44105 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75High 8.2
Cleartext transmission of sensitive information in the management console of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local authenticated attacker to obtain OS credentials.
- Product
- Workspace Control
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024An incorrectly implemented authentication scheme that is subjected to a spoofing attack in the management console of Ivanti Workspace Control before version 202CVE-2024-44104 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75High 8.8
An incorrectly implemented authentication scheme that is subjected to a spoofing attack in the management console of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local authenticated attacker to escalate their privileges.
- Product
- Workspace Control
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024DLL hijacking in the management console of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local authenticated attacker to escalate their prCVE-2024-44103 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75High 8.8
DLL hijacking in the management console of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local authenticated attacker to escalate their privileges.
- Product
- Workspace Control
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024Microsoft Management Console Remote Code Execution VulnerabilityCVE-2024-38259 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Microsoft Management Console Remote Code Execution Vulnerability
- Product
- Windows 11 version 21H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2024A code injection vulnerability that allows a low-privileged user with REST API access granted to remotely upload arbitrary files to the VSPC server using REST ACVE-2024-39715 · Other software · Veeam · reported by support@hackerone.comHigh 8.5
A code injection vulnerability that allows a low-privileged user with REST API access granted to remotely upload arbitrary files to the VSPC server using REST API, leading to remote code execution on VSPC server.
- Product
- Veeam Service Provider Console
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2024A code injection vulnerability that permits a low-privileged user to upload arbitrary files to the server, leading to remote code execution on VSPC server.CVE-2024-39714 · Other software · Veeam · reported by support@hackerone.comCritical 9.9
A code injection vulnerability that permits a low-privileged user to upload arbitrary files to the server, leading to remote code execution on VSPC server.
- Product
- Veeam Service Provider Console
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2024A code injection vulnerability can allow a low-privileged user to overwrite files on that VSPC server, which can lead to remote code execution on VSPC server.CVE-2024-38651 · Other software · Veeam · reported by support@hackerone.comHigh 8.5
A code injection vulnerability can allow a low-privileged user to overwrite files on that VSPC server, which can lead to remote code execution on VSPC server.
- Product
- Veeam Service Provider Console
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2024An authentication bypass vulnerability can allow a low privileged attacker to access the NTLM hash of service account on the VSPC server.CVE-2024-38650 · Other software · Veeam · reported by support@hackerone.comCritical 9.9
An authentication bypass vulnerability can allow a low privileged attacker to access the NTLM hash of service account on the VSPC server.
- Product
- Veeam Service Provider Console
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2024An insufficient entropy vulnerability was found in the Openshift Console.CVE-2024-6508 · Other software · Red Hat · reported by Red HatHigh 8
An insufficient entropy vulnerability was found in the Openshift Console. In the authorization code type and implicit grant type, the OAuth2 protocol is vulnerable to a Cross-Site Request Forgery (CSRF) attack if the state parameter is used inefficiently. This flaw allows logging into the victim’s current application account using a third-party account without any restrictions.
- Product
- Red Hat OpenShift Container Platform 4.12
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Aug 20, 2024eScan Management Console 14.0.1400.2281 is vulnerable to Incorrect Access Control via acteScanAVReport.CVE-2024-42919 · Other software · escanav · reported by MITRECritical 9.8
eScan Management Console 14.0.1400.2281 is vulnerable to Incorrect Access Control via acteScanAVReport.
- Product
- escan_management_console
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2024An authentication bypass vulnerability in GoAnywhere MFT prior to 7.6.0 allows Admin Users with access to the Agent Console to circumvent some permission checksCVE-2024-25157 · Other software · Fortra · reported by df4dee71-de3a-4139-9588-11b62fe6c0ffMedium 6.5
An authentication bypass vulnerability in GoAnywhere MFT prior to 7.6.0 allows Admin Users with access to the Agent Console to circumvent some permission checks when attempting to visit other pages. This could lead to unauthorized information disclosure or modification.
- Product
- GoAnywhere MFT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2024A flaw was found in the OpenShift console.CVE-2024-7128 · Other software · Red Hat · reported by Red HatMedium 5.3
A flaw was found in the OpenShift console. Several endpoints in the application use the authHandler() and authHandlerWithUser() middleware functions. When the default authentication provider ("openShiftAuth") is set, these functions do not perform any authentication checks, relying instead on the targeted service to handle authentication and authorization. This issue leads to various degrees of data exposure due to a lack of proper credential verification.
- Product
- Red Hat OpenShift Container Platform 4.16
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Jul 25, 2024There is a cross-site scripting vulnerability in the Secure Access administrative console of Absolute Secure Access prior to version 13.07.CVE-2024-40873 · Other software · Absolute Security · reported by SecurityResponse@netmotionsoftware.comMedium 4.5
There is a cross-site scripting vulnerability in the Secure Access administrative console of Absolute Secure Access prior to version 13.07. Attackers with system administrator permissions can interfere with another system administrator’s use of the publishing UI when the administrators are editing the same management object. The scope is unchanged, there is no loss of confidentiality. Impact to system availability is none, impact to system integrity is high.
- Product
- Secure Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabsolute.comabsolute.com
Jul 24, 2024A flaw was found in the Openshift console.CVE-2024-7079 · Other software · Red Hat · reported by Red HatMedium 6.5
A flaw was found in the Openshift console. The /API/helm/verify endpoint is tasked to fetch and verify the installation of a Helm chart from a URI that is remote HTTP/HTTPS or local. Access to this endpoint is gated by the authHandlerWithUser() middleware function. Contrary to its name, this middleware function does not verify the validity of the user's credentials. As a result, unauthenticated users can access this endpoint.
- Product
- Red Hat OpenShift Container Platform 3.11
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Jul 22, 2024When editing a user, group or any object in the Syncope Console, HTML tags could be added to any text field and could lead to potential exploits.CVE-2024-38503 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.4
When editing a user, group or any object in the Syncope Console, HTML tags could be added to any text field and could lead to potential exploits. The same vulnerability was found in the Syncope Enduser, when editing “Personal Information” or “User Requests”. Users are recommended to upgrade to version 3.0.8, which fixes this issue.
- Product
- Apache Syncope
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsyncope.apache.orgopenwall.com
Jul 18, 2024Improper Restriction of XML External Entity Reference vulnerability in PruvaSoft Informatics Apinizer Management Console allows Data Serialization External EntiCVE-2024-5625 · Other software · PruvaSoft Informatics · reported by iletisim@usom.gov.trMedium 6.5
Improper Restriction of XML External Entity Reference vulnerability in PruvaSoft Informatics Apinizer Management Console allows Data Serialization External Entities Blowup. This issue affects Apinizer Management Console: before 2024.05.1.
- Product
- Apinizer Management Console
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Jul 18, 2024Authentication Bypass Using an Alternate Path or Channel vulnerability in PruvaSoft Informatics Apinizer Management Console allows Authentication Bypass.CVE-2024-5620 · Other software · PruvaSoft Informatics · reported by iletisim@usom.gov.trMedium 6.5
Authentication Bypass Using an Alternate Path or Channel vulnerability in PruvaSoft Informatics Apinizer Management Console allows Authentication Bypass. This issue affects Apinizer Management Console: before 2024.05.1.
- Product
- Apinizer Management Console
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Jul 18, 2024Authorization Bypass Through User-Controlled Key vulnerability in PruvaSoft Informatics Apinizer Management Console allows Exploiting Incorrectly Configured AccCVE-2024-5619 · Other software · PruvaSoft Informatics · reported by iletisim@usom.gov.trCritical 9.6
Authorization Bypass Through User-Controlled Key vulnerability in PruvaSoft Informatics Apinizer Management Console allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Apinizer Management Console: before 2024.05.1.
- Product
- Apinizer Management Console
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Jul 18, 2024Incorrect Permission Assignment for Critical Resource vulnerability in PruvaSoft Informatics Apinizer Management Console allows Accessing Functionality Not PropCVE-2024-5618 · Other software · PruvaSoft Informatics · reported by iletisim@usom.gov.trCritical 9.9
Incorrect Permission Assignment for Critical Resource vulnerability in PruvaSoft Informatics Apinizer Management Console allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Apinizer Management Console: before 2024.05.1.
- Product
- Apinizer Management Console
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.