Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
19,438 results · page 81 of 389
Nov 21, 2024Formidable Forms: Does not sanitise and escape some of its settingsCVE-2024-9768 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Formidable Forms WordPress plugin before 6.14.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Formidable Forms
- Fixed in
- 6.14.1
- What to do
- Update Formidable Forms to 6.14.1 or newer.
Nov 21, 2024Ditty: Does not sanitise and escape some of its settingsCVE-2024-9600 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ditty WordPress plugin before 3.1.47 does not sanitise and escape some of its settings, which could allow high privilege users such as author to perform Stored Cross-Site Scripting attacks.
- Product
- Ditty
- Fixed in
- 3.1.47
- What to do
- Update Ditty to 3.1.47 or newer.
Nov 21, 2024Alphabetical List: Does not have CSRF check in placeCVE-2024-8157 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Alphabetical List WordPress plugin through 1.0.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Alphabetical List
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update Alphabetical List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 21, 2024CM Table Of Contents: Does not have CSRF checkCVE-2024-5029 · WordPress plugins & themes · reported by WPScanMedium 4.8
The CM Table Of Contents WordPress plugin before 1.2.4 does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
- Product
- CM Table Of Contents
- Fixed in
- 1.2.4
- What to do
- Update CM Table Of Contents to 1.2.4 or newer.
Nov 21, 2024Media File Rename, Find Unused File, Add Alt text, Caption, Desc For Image SEO: Does not sanitise uploaded SVG filesCVE-2024-10482 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Media File Rename, Find Unused File, Add Alt text, Caption, Desc For Image SEO WordPress plugin before 1.5.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.
- Product
- Media File Rename, Find Unused File, Add Alt text, Caption, Desc For Image SEO
- Fixed in
- 1.5.0
- What to do
- Update Media File Rename, Find Unused File, Add Alt text, Caption, Desc For Image SEO to 1.5.0 or newer.
Nov 18, 2024The DVC from TRCore has a Path Traversal vulnerability and does not restrict the types of uploaded files.CVE-2024-11315 · Other software · TRCore · reported by twcert@cert.org.twCritical 9.8
The DVC from TRCore has a Path Traversal vulnerability and does not restrict the types of uploaded files. This allows unauthenticated remote attackers to upload arbitrary files to any directory, leading to arbitrary code execution by uploading webshells.
- Product
- DVC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Nov 18, 2024The DVC from TRCore has a Path Traversal vulnerability and does not restrict the types of uploaded files.CVE-2024-11314 · Other software · TRCore · reported by twcert@cert.org.twCritical 9.8
The DVC from TRCore has a Path Traversal vulnerability and does not restrict the types of uploaded files. This allows unauthenticated remote attackers to upload arbitrary files to any directory, leading to arbitrary code execution by uploading webshells.
- Product
- DVC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Nov 18, 2024The DVC from TRCore has a Path Traversal vulnerability and does not restrict the types of uploaded files.CVE-2024-11313 · Other software · TRCore · reported by twcert@cert.org.twCritical 9.8
The DVC from TRCore has a Path Traversal vulnerability and does not restrict the types of uploaded files. This allows unauthenticated remote attackers to upload arbitrary files to any directory, leading to arbitrary code execution by uploading webshells.
- Product
- DVC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Nov 18, 2024The DVC from TRCore has a Path Traversal vulnerability and does not restrict the types of uploaded files.CVE-2024-11312 · Other software · TRCore · reported by twcert@cert.org.twCritical 9.8
The DVC from TRCore has a Path Traversal vulnerability and does not restrict the types of uploaded files. This allows unauthenticated remote attackers to upload arbitrary files to any directory, leading to arbitrary code execution by uploading webshells.
- Product
- DVC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Nov 18, 2024The DVC from TRCore has a Path Traversal vulnerability and does not restrict the types of uploaded files.CVE-2024-11311 · Other software · TRCore · reported by twcert@cert.org.twCritical 9.8
The DVC from TRCore has a Path Traversal vulnerability and does not restrict the types of uploaded files. This allows unauthenticated remote attackers to upload arbitrary files to any directory, leading to arbitrary code execution by uploading webshells.
- Product
- DVC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Nov 18, 2024CM Table Of Contents: Does not have CSRF check in placeCVE-2024-5030 · WordPress plugins & themes · reported by WPScanLow 3.8
The CM Table Of Contents WordPress plugin before 1.2.3 does not have CSRF check in place when resetting its settings, which could allow attackers to make a logged in admin perform such action via a CSRF attack
- Product
- CM Table Of Contents
- Fixed in
- 1.2.3
- What to do
- Update CM Table Of Contents to 1.2.3 or newer.
Nov 17, 2024A script injection vulnerability was found in the Debezium database connector, where it does not properly sanitize some parameters.CVE-2023-1419 · Other software · Red Hat · reported by Red HatMedium 5.9
A script injection vulnerability was found in the Debezium database connector, where it does not properly sanitize some parameters. This flaw allows an attacker to send a malicious request to inject a parameter that may allow the viewing of unauthorized data.
- Product
- Red Hat build of Debezium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Nov 15, 2024Jobs for: Does not sanitise and escape some of its Job settingsCVE-2024-10104 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Jobs for WordPress plugin before 2.7.8 does not sanitise and escape some of its Job settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks
- Product
- Jobs for
- Fixed in
- 2.7.8
- What to do
- Update Jobs for to 2.7.8 or newer.
Nov 14, 2024The ventilator does not perform proper file integrity checks when adopting firmware updates.CVE-2024-48974 · Other software · Baxter · reported by productsecurity@baxter.comCritical 9.3
The ventilator does not perform proper file integrity checks when adopting firmware updates. This makes it possible for an attacker to force unauthorized changes to the device's configuration settings and/or compromise device functionality by pushing a compromised/illegitimate firmware file. This could disrupt the function of the device and/or cause unauthorized information disclosure.
- Product
- Life2000 Ventilation System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2024Harbor fails to validate the user permissions when updating a robot account that belongs to a project that the authenticated user doesn’t have access to.CVE-2022-31667 · Computers, phones & browsers · Linuxfoundation · reported by security@vmware.comMedium 6.4
Harbor fails to validate the user permissions when updating a robot account that belongs to a project that the authenticated user doesn’t have access to. By sending a request that attempts to update a robot account, and specifying a robot account id and robot account name that belongs to a different project that the user doesn’t have access to, it was possible to revoke the robot account permissions.
- Product
- Harbor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2024Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit: Does not sanitize and escape the bwfan-track-id parameter before using it in a SQL statementCVE-2024-9186 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit WordPress plugin before 3.3.0 does not sanitize and escape the bwfan-track-id parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks
- Product
- Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit
- Fixed in
- 3.3.0
- What to do
- Update Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit to 3.3.0 or newer.
Nov 14, 2024Simple File List: Does not sanitise and escape a generated URL before outputting it back in an attributeCVE-2024-10146 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Simple File List WordPress plugin before 6.1.13 does not sanitise and escape a generated URL before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against admins.
- Product
- Simple File List
- Fixed in
- 6.1.13
- What to do
- Update Simple File List to 6.1.13 or newer.
Nov 13, 2024Jenkins OpenId Connect Authentication Plugin 4.418.vccc7061f5b_6d and earlier does not invalidate the previous session on login.CVE-2024-52553 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comHigh 8.8
Jenkins OpenId Connect Authentication Plugin 4.418.vccc7061f5b_6d and earlier does not invalidate the previous session on login.
- Product
- Jenkins OpenId Connect Authentication Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2024Jenkins Pipeline: Declarative Plugin 2.2214.vb_b_34b_2ea_9b_83 and earlier does not check whether the main (Jenkinsfile) script used to restart a build from a sCVE-2024-52551 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comHigh 8
Jenkins Pipeline: Declarative Plugin 2.2214.vb_b_34b_2ea_9b_83 and earlier does not check whether the main (Jenkinsfile) script used to restart a build from a specific stage is approved, allowing attackers with Item/Build permission to restart a previous build whose (Jenkinsfile) script is no longer approved.
- Product
- Jenkins Pipeline: Declarative Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2024Jenkins Pipeline: Groovy Plugin 3990.vd281dd77a_388 and earlier, except 3975.3977.v478dd9e956c3 does not check whether the main (Jenkinsfile) script for a rebuiCVE-2024-52550 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comHigh 8
Jenkins Pipeline: Groovy Plugin 3990.vd281dd77a_388 and earlier, except 3975.3977.v478dd9e956c3 does not check whether the main (Jenkinsfile) script for a rebuilt build is approved, allowing attackers with Item/Build permission to rebuild a previous build whose (Jenkinsfile) script is no longer approved.
- Product
- Jenkins Pipeline: Groovy Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2024Jenkins Script Security Plugin 1367.vdf2fc45f229c and earlier, except 1365.1367.va_3b_b_89f8a_95b_ and 1362.1364.v4cf2dc5d8776, does not perform a permission chCVE-2024-52549 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
Jenkins Script Security Plugin 1367.vdf2fc45f229c and earlier, except 1365.1367.va_3b_b_89f8a_95b_ and 1362.1364.v4cf2dc5d8776, does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of files on the controller file system.
- Product
- Jenkins Script Security Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2024The transport_message_handler function in SCP-Firmware release versions 2.11.0-2.15.0 does not properly handle errors, potentially allowing an Application ProceCVE-2024-9413 · Computers, phones & browsers · Arm · reported by arm-security@arm.comHigh 8
The transport_message_handler function in SCP-Firmware release versions 2.11.0-2.15.0 does not properly handle errors, potentially allowing an Application Processor (AP) to cause a buffer overflow in System Control Processor (SCP) firmware.
- Product
- SCP-Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024RSS Feed Widget: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-9836 · WordPress plugins & themes · reported by WPScanMedium 5.9
The RSS Feed Widget WordPress plugin before 3.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- RSS Feed Widget
- Fixed in
- 3.0.0
- What to do
- Update RSS Feed Widget to 3.0.0 or newer.
Nov 12, 2024RSS Feed Widget: Does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attributeCVE-2024-9835 · WordPress plugins & themes · reported by WPScanMedium 4.8
The RSS Feed Widget WordPress plugin before 3.0.1 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
- Product
- RSS Feed Widget
- Fixed in
- 3.0.1
- What to do
- Update RSS Feed Widget to 3.0.1 or newer.
Nov 11, 2024In mutt and neomutt, PGP encryption does not use the --hidden-recipient mode which may leak the Bcc email header field by inferring from the recipients info.CVE-2024-49395 · Other software · Red Hat · reported by Red HatMedium 5.3
In mutt and neomutt, PGP encryption does not use the --hidden-recipient mode which may leak the Bcc email header field by inferring from the recipients info.
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Nov 11, 2024Cash Operations does not perform necessary authorization check for an authenticated user, resulting in escalation of privileges causing low impact to confidentiCVE-2024-47587 · Network & remote access · SAP_SE · reported by cna@sap.comLow 3.5
Cash Operations does not perform necessary authorization check for an authenticated user, resulting in escalation of privileges causing low impact to confidentiality to the application.
- Product
- SAP Cash Management (Cash Operations)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2024Webopac from Grand Vice info does not properly validate uploaded file types, allowing unauthenticated remote attackers to upload and execute webshells, which coCVE-2024-11018 · Other software · Grand Vice info · reported by twcert@cert.org.twCritical 9.8
Webopac from Grand Vice info does not properly validate uploaded file types, allowing unauthenticated remote attackers to upload and execute webshells, which could lead to arbitrary code execution on the server.
- Product
- Webopac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Nov 11, 2024Webopac from Grand Vice info does not properly validate uploaded file types, allowing remote attackers with regular privileges to upload and execute webshells, CVE-2024-11017 · Other software · Grand Vice info · reported by twcert@cert.org.twHigh 8.8
Webopac from Grand Vice info does not properly validate uploaded file types, allowing remote attackers with regular privileges to upload and execute webshells, which could lead to arbitrary code execution on the server.
- Product
- Webopac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Nov 8, 2024hopetree izone lts c011b48 contains a server-side request forgery (SSRF) vulnerability in the active push function as \\apps\\tool\\apis\\bd_push.py does not seCVE-2024-50811 · Other software · tendcode · reported by MITRECritical 9.1
hopetree izone lts c011b48 contains a server-side request forgery (SSRF) vulnerability in the active push function as \\apps\\tool\\apis\\bd_push.py does not securely filter user input through push_urls() and get_urls().
- Product
- izone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 8, 2024Registrations for the Events Calendar: Does not sanitise and escape some parametersCVE-2024-7982 · WordPress plugins & themes · reported by WPScanCritical 9.6
The Registrations for the Events Calendar WordPress plugin before 2.12.4 does not sanitise and escape some parameters when accepting event registrations, which could allow unauthenticated users to perform Cross-Site Scripting attacks.
- Product
- Registrations for the Events Calendar
- Fixed in
- 2.12.4
- What to do
- Update Registrations for the Events Calendar to 2.12.4 or newer.
Nov 7, 2024The Jetpack WordPress plugin does not have proper authorisation in one of its REST endpoint, allowing any authenticated users, such as subscriber to read arbitrCVE-2024-9926 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Jetpack WordPress plugin does not have proper authorisation in one of its REST endpoint, allowing any authenticated users, such as subscriber to read arbitrary feedbacks data sent via the Jetpack Contact Form
- What to do
- Update the plugin to the newest version.
Nov 7, 2024WP Booking Calendar: Does not sanitise and escape some of its Widgets settingsCVE-2024-10027 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Booking Calendar WordPress plugin before 10.6.3 does not sanitise and escape some of its Widgets settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- WP Booking Calendar
- Fixed in
- 10.6.3
- What to do
- Update WP Booking Calendar to 10.6.3 or newer.
Nov 6, 2024Wp-ImageZoom: Does not sanitise and escape some parameters before outputting them back in a pageCVE-2024-9934 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Wp-ImageZoom WordPress plugin through 1.1.0 does not sanitise and escape some parameters before outputting them back in a page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Wp-ImageZoom
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Wp-ImageZoom to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2024WP ULike: Does not sanitise and escape some of its settingsCVE-2024-7879 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP ULike WordPress plugin before 4.7.5 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- WP ULike
- Fixed in
- 4.7.5
- What to do
- Update WP ULike to 4.7.5 or newer.
Nov 5, 2024Pods: Does not sanitise and escape some of its settingsCVE-2024-9883 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Pods WordPress plugin before 3.2.7.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Pods
- Fixed in
- 3.2.7.1
- What to do
- Update Pods to 3.2.7.1 or newer.
Nov 5, 2024Post From Frontend: Does not have CSRF checkCVE-2024-9689 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Post From Frontend WordPress plugin through 1.0.0 does not have CSRF check when deleting posts, which could allow attackers to make logged in admin perform such action via a CSRF attack
- Product
- Post From Frontend
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Post From Frontend to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 5, 2024Appointment Booking Calendar — Simply Schedule Appointments Booking: Does not sanitise and escape some of its Notification settingsCVE-2024-7877 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin WordPress plugin before 1.6.7.55 does not sanitise and escape some of its Notification settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Appointment Booking Calendar — Simply Schedule Appointments Booking
- Fixed in
- 1.6.7.55
- What to do
- Update Appointment Booking Calendar — Simply Schedule Appointments Booking to 1.6.7.55 or newer.
Nov 5, 2024Appointment Booking Calendar — Simply Schedule Appointments Booking: Does not sanitise and escape some of its Appointment Type settingsCVE-2024-7876 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin WordPress plugin before 1.6.7.55 does not sanitise and escape some of its Appointment Type settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Appointment Booking Calendar — Simply Schedule Appointments Booking
- Fixed in
- 1.6.7.55
- What to do
- Update Appointment Booking Calendar — Simply Schedule Appointments Booking to 1.6.7.55 or newer.
Nov 5, 2024Table of Contents Plus: Does not sanitise and escape some of its settingsCVE-2024-5578 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Table of Contents Plus WordPress plugin through 2408 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Table of Contents Plus
- Affected
- up to 2408
- What to do
- Affects up to 2408. Update Table of Contents Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 4, 2024cobalt is a media downloader that doesn't piss you off.CVE-2024-51498 · Other software · imputnet · reported by GitHubMedium 6
cobalt is a media downloader that doesn't piss you off. A malicious cobalt instance could serve links with the `javascript:` protocol, resulting in Cross-site Scripting (XSS) when the user tries to download an item from a picker. This issue has been present since commit `66bac03e`, was mitigated in commit `97977efa` (correctly configured web instances were no longer vulnerable) and fully fixed in commit `c4be1d3a` (included in release version 10.2.1). Users are advised to upgrade. Users unable to upgrade should enable a content-security-policy.
- Product
- cobalt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2024The install() function of ProviderInstaller.java in Magisk App before canary version 27007 does not verify the GMS app before loading it, which allows a local uCVE-2024-48336 · Other software · magisk · reported by MITREHigh 8.4
The install() function of ProviderInstaller.java in Magisk App before canary version 27007 does not verify the GMS app before loading it, which allows a local untrusted app with no additional privileges to silently execute arbitrary code in the Magisk app and escalate privileges to root via a crafted package, aka Bug #8279. User interaction is not needed for exploitation.
- Product
- magisk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2024IDExpert from CHANGING Information Technology does not properly validate a specific parameter in the administrator interface, allowing remote attackers with admCVE-2024-10653 · Other software · CHANGING Information Technology · reported by twcert@cert.org.twHigh 7.2
IDExpert from CHANGING Information Technology does not properly validate a specific parameter in the administrator interface, allowing remote attackers with administrative privileges to inject and execute OS commands on the server.
- Product
- IDExpert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Nov 1, 2024IDExpert from CHANGING Information Technology does not properly validate a parameter for a specific functionality, allowing unauthenticated remote attackers to CVE-2024-10652 · Other software · CHANGING Information Technology · reported by twcert@cert.org.twMedium 6.1
IDExpert from CHANGING Information Technology does not properly validate a parameter for a specific functionality, allowing unauthenticated remote attackers to inject JavsScript code and perform Reflected Cross-site scripting attacks.
- Product
- IDExpert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Nov 1, 2024IDExpert from CHANGING Information Technology does not properly validate a specific parameter in the administrator interface, allowing remote attackers with admCVE-2024-10651 · Other software · CHANGING Information Technology · reported by twcert@cert.org.twMedium 4.9
IDExpert from CHANGING Information Technology does not properly validate a specific parameter in the administrator interface, allowing remote attackers with administrator privileges to exploit this vulnerability to read arbitrary system files.
- Product
- IDExpert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Oct 31, 2024HCL AppScan Source <= 10.6.0 does not properly validate a TLS/SSL certificate for an executable.CVE-2024-30149 · Other software · HCL Software · reported by psirt@hcl.comMedium 4.8
HCL AppScan Source <= 10.6.0 does not properly validate a TLS/SSL certificate for an executable.
- Product
- AppScan Source
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Oct 30, 2024Download Manager: Doesn't sanitize some of it's shortcode parametersCVE-2024-8444 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Download Manager WordPress plugin before 3.3.00 doesn't sanitize some of it's shortcode parameters, leading to cross site scripting.
- Product
- Download Manager
- Fixed in
- 3.3.00
- What to do
- Update Download Manager to 3.3.00 or newer.
Oct 28, 2024In the Linux kernel, the following vulnerability has been resolved: btrfs: fix uninitialized pointer free in add_inode_ref() The add_inode_ref() function doesCVE-2024-50088 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix uninitialized pointer free in add_inode_ref() The add_inode_ref() function does not initialize the "name" struct when it is declared. If any of the following calls to "read_one_inode() returns NULL, dir = read_one_inode(root, parent_objectid); if (!dir) { ret = -ENOENT; goto out; } inode = read_one_inode(root, inode_objectid); if (!inode) { ret = -EIO; goto out; } then "name.name" would be freed on "out" before being initialized. out: ... kfree(name.name); This issue was reported by Coverity with CID 1526744.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Oct 21, 2024In the Linux kernel, the following vulnerability has been resolved: drm/shmem-helper: Remove errant put in error path drm_gem_shmem_mmap() doesn't own this reCVE-2022-48981 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: drm/shmem-helper: Remove errant put in error path drm_gem_shmem_mmap() doesn't own this reference, resulting in the GEM object getting prematurely freed leading to a later use-after-free.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Oct 21, 2024In the Linux kernel, the following vulnerability has been resolved: x86/sgx: Fix deadlock in SGX NUMA node search When the current node doesn't have an EPC seCVE-2024-49856 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: x86/sgx: Fix deadlock in SGX NUMA node search When the current node doesn't have an EPC section configured by firmware and all other EPC sections are used up, CPU can get stuck inside the while loop that looks for an available EPC page from remote nodes indefinitely, leading to a soft lockup. Note how nid_of_current will never be equal to nid in that while loop because nid_of_current is not set in sgx_numa_mask. Also worth mentioning is that it's perfectly fine for the firmware not to setup an EPC section on a node. While setting up an EPC section on each node can enhance performance, it is not a requirement for functionality. Rework the loop to start and end on *a* node that has SGX memory. This avoids the deadlock looking for the current SGX-lacking node to show up in the loop when it never will.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Oct 21, 2024TS Poll: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-8625 · WordPress plugins & themes · reported by WPScanHigh 7.2
The TS Poll WordPress plugin before 2.4.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
- Product
- TS Poll
- Fixed in
- 2.4.0
- What to do
- Update TS Poll to 2.4.0 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.