Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
19,451 results · page 95 of 390
Apr 15, 2024NPS computy: Does not have CSRF checks in some placesCVE-2024-1755 · WordPress plugins & themes · reported by WPScanHigh 8.8
The NPS computy WordPress plugin through 2.7.5 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
- Product
- NPS computy
- Affected
- up to 2.7.5
- What to do
- Affects up to 2.7.5. Update NPS computy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 15, 2024NPS computy: Does not sanitise and escape some of its settingsCVE-2024-1754 · WordPress plugins & themes · reported by WPScanMedium 4.7
The NPS computy WordPress plugin through 2.7.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- NPS computy
- Affected
- up to 2.7.5
- What to do
- Affects up to 2.7.5. Update NPS computy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 15, 2024Testimonial Slider: Does not sanitise and escape some of its settingsCVE-2024-1746 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Testimonial Slider WordPress plugin before 2.3.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Testimonial Slider
- Fixed in
- 2.3.8
- What to do
- Update Testimonial Slider to 2.3.8 or newer.
Apr 15, 2024Carousel Slider: Does not sanitise and escape some of its settingsCVE-2024-1712 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Carousel Slider WordPress plugin before 2.2.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Carousel Slider
- Fixed in
- 2.2.7
- What to do
- Update Carousel Slider to 2.2.7 or newer.
Apr 15, 2024Top Bar: Does not sanitise and escape some of its settingsCVE-2024-1660 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Top Bar WordPress plugin before 3.0.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Top Bar
- Fixed in
- 3.0.5
- What to do
- Update Top Bar to 3.0.5 or newer.
Apr 15, 2024WooCommerce: Does not prevent users with at least the contributor role from leaking products they shouldn't have access toCVE-2024-1310 · WordPress plugins & themes · reported by WPScanMedium 4.9
The WooCommerce WordPress plugin before 8.6 does not prevent users with at least the contributor role from leaking products they shouldn't have access to. (e.g. private, draft and trashed products)
- Product
- WooCommerce
- Fixed in
- 8.6
- What to do
- Update WooCommerce to 8.6 or newer.
Apr 15, 2024Smart Forms: Does not have proper authorization in some actionsCVE-2024-1307 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Smart Forms WordPress plugin before 2.6.94 does not have proper authorization in some actions, which could allow users with a role as low as a subscriber to call them and perform unauthorized actions
- Product
- Smart Forms
- Fixed in
- 2.6.94
- What to do
- Update Smart Forms to 2.6.94 or newer.
Apr 15, 2024Smart Forms: Does not have CSRF checks in some placesCVE-2024-1306 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Smart Forms WordPress plugin before 2.6.94 does not have CSRF checks in some places, which could allow attackers to make logged-in users perform unwanted actions via CSRF attacks, such as editing entries, and we consider it a medium risk.
- Product
- Smart Forms
- Fixed in
- 2.6.94
- What to do
- Update Smart Forms to 2.6.94 or newer.
Apr 15, 2024Meta Box: Does not prevent users with at least the contributor role from access arbitrary custom fields assigned to other user's postsCVE-2024-1204 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Meta Box WordPress plugin before 5.9.4 does not prevent users with at least the contributor role from access arbitrary custom fields assigned to other user's posts.
- Product
- Meta Box
- Fixed in
- 5.9.4
- What to do
- Update Meta Box to 5.9.4 or newer.
Apr 15, 2024Fancy Product Designer: Does not sanitise and escape some of its settingsCVE-2024-0902 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Fancy Product Designer WordPress plugin before 6.1.81 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Fancy Product Designer
- Fixed in
- 6.1.81
- What to do
- Update Fancy Product Designer to 6.1.81 or newer.
Apr 15, 2024WooCommerce Customers Manager: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2024-0399 · WordPress plugins & themes · reported by WPScanHigh 8.1
The WooCommerce Customers Manager WordPress plugin before 29.7 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to an SQL injection exploitable by Subscriber+ role.
- Product
- WooCommerce Customers Manager
- Fixed in
- 29.7
- What to do
- Update WooCommerce Customers Manager to 29.7 or newer.
Apr 15, 2024Everest Backup: Does not properly validate backup files to be uploadedCVE-2023-7201 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Everest Backup WordPress plugin before 2.2.5 does not properly validate backup files to be uploaded, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup)
- Product
- Everest Backup
- Fixed in
- 2.2.5
- What to do
- Update Everest Backup to 2.2.5 or newer.
Apr 15, 2024WP User Profile Avatar: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-6067 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP User Profile Avatar WordPress plugin through 1.0.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- WP User Profile Avatar
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update WP User Profile Avatar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 15, 2024The file upload functionality of Ai3 QbiBot does not properly restrict types of uploaded files, allowing remote attackers with administrator privilege to uploadCVE-2024-3778 · Other software · Ai3 · reported by twcert@cert.org.twHigh 7.2
The file upload functionality of Ai3 QbiBot does not properly restrict types of uploaded files, allowing remote attackers with administrator privilege to upload files with dangerous type containing malicious code.
- Product
- QbiBot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Apr 15, 2024aEnrich Technology a+HRD's functionality for downloading files using youtube-dl.exe does not properly restrict user input.CVE-2024-3775 · Other software · aEnrich Technology · reported by twcert@cert.org.twMedium 5.3
aEnrich Technology a+HRD's functionality for downloading files using youtube-dl.exe does not properly restrict user input. This allows attackers to pass arbitrary arguments to youtube-dl.exe, leading to the download of partial unauthorized files.
- Product
- a+HRD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Apr 14, 2024The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below does not proper sanitize user input, allowing for an unauthenticated attacker CVE-2024-29838 · Other software · CS Technologies Australia · reported by 430a6cef-dc26-47e3-9fa8-52fb7f19644eHigh 7.5
The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below does not proper sanitize user input, allowing for an unauthenticated attacker to crash the controller software
- Product
- Evolution Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddirectcyber.com.audirectcyber.com.au
Apr 13, 2024WP Shortcodes Plugin — Shortcodes Ultimate: Does not properly escape some of its shortcodes attributes before they are echoed back to usersCVE-2024-2583 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 7.0.5 does not properly escape some of its shortcodes attributes before they are echoed back to users, making it possible for users with the contributor role to conduct Stored XSS attacks.
- Product
- WP Shortcodes Plugin — Shortcodes Ultimate
- Fixed in
- 7.0.5
- What to do
- Update WP Shortcodes Plugin — Shortcodes Ultimate to 7.0.5 or newer.
Apr 12, 2024IBM UrbanCode Deploy (UCD) 7.0 through 7.0.5.20, 7.1 through 7.1.2.16, 7.2 through 7.2.3.9, 7.3 through 7.3.2.4 and IBM DevOps Deploy 8.0 through 8.0.0.1 does CVE-2024-22358 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.3
IBM UrbanCode Deploy (UCD) 7.0 through 7.0.5.20, 7.1 through 7.1.2.16, 7.2 through 7.2.3.9, 7.3 through 7.3.2.4 and IBM DevOps Deploy 8.0 through 8.0.0.1 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 280896.
- Product
- UrbanCode Deploy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Apr 11, 2024Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel: Does not have proper authorizationCVE-2024-0881 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel WordPress plugin before 2.2.76 does not have proper authorization, resulting in password protected posts to be displayed in the result of some unauthenticated AJAX actions, allowing unauthenticated users to read such posts
- Product
- Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel
- Fixed in
- 2.2.76
- What to do
- Update Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel to 2.2.76 or newer.
Apr 10, 2024In the Linux kernel, the following vulnerability has been resolved: perf bpf: Avoid memory leak from perf_env__insert_btf() perf_env__insert_btf() doesn't insCVE-2021-47190 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: perf bpf: Avoid memory leak from perf_env__insert_btf() perf_env__insert_btf() doesn't insert if a duplicate BTF id is encountered and this causes a memory leak. Modify the function to return a success/error value and then free the memory if insertion didn't happen. v2. Adds a return -1 when the insertion error occurs in perf_env__fetch_btf. This doesn't affect anything as the result is never checked.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Apr 10, 2024Ultimate Video Player For WordPress: Does not have proper capability checkCVE-2024-2428 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Ultimate Video Player For WordPress WordPress plugin before 2.2.3 does not have proper capability check when updating its settings via a REST route, allowing Contributor and above users to update them. Furthermore, due to the lack of escaping in one of the settings, this also allows them to perform Stored XSS attacks
- Product
- Ultimate Video Player For WordPress
- Fixed in
- 2.2.3
- What to do
- Update Ultimate Video Player For WordPress to 2.2.3 or newer.
Apr 10, 2024WordPress Ping Optimizer: Does not have CSRF checks in some placesCVE-2023-6385 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WordPress Ping Optimizer WordPress plugin through 2.35.1.3.0 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks such as clearing logs.
- Product
- WordPress Ping Optimizer
- Affected
- up to 2.35.1.3.0
- What to do
- Affects up to 2.35.1.3.0. Update WordPress Ping Optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 9, 2024Responsive Gallery Grid: Does not sanitise and escape some of its settingsCVE-2024-1664 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Responsive Gallery Grid WordPress plugin before 2.3.11 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Responsive Gallery Grid
- Fixed in
- 2.3.11
- What to do
- Update Responsive Gallery Grid to 2.3.11 or newer.
Apr 8, 2024Cash Management in SAP S/4 HANA does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.CVE-2024-30217 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
Cash Management in SAP S/4 HANA does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. By exploiting this vulnerability, an attacker can approve or reject a bank account application affecting the integrity of the application. Confidentiality and Availability are not impacted.
- Product
- SAP S/4 HANA (Cash Management)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordme.sap.comsupport.sap.com
Apr 8, 2024Cash Management in SAP S/4 HANA does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.CVE-2024-30216 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
Cash Management in SAP S/4 HANA does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. By exploiting this vulnerability, attacker can add notes in the review request with 'completed' status affecting the integrity of the application. Confidentiality and Availability are not impacted.
- Product
- SAP S/4 HANA (Cash Management)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordme.sap.comsupport.sap.com
Apr 8, 2024SAP Group Reporting Data Collection does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.CVE-2024-28167 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.5
SAP Group Reporting Data Collection does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. On successful exploitation, specific data can be changed via the Enter Package Data app although the user does not have sufficient authorization causing high impact on Integrity of the appliction.
- Product
- SAP Group Reporting Data Collection (Enter Package Data)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordme.sap.comsupport.sap.com
Apr 8, 2024Self-Registration and Modify your own profile in User Admin Application of NetWeaver AS Java does not enforce proper security requirements for the content of thCVE-2024-27899 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 8.8
Self-Registration and Modify your own profile in User Admin Application of NetWeaver AS Java does not enforce proper security requirements for the content of the newly defined security answer. This can be leveraged by an attacker to cause profound impact on confidentiality and low impact on both integrity and availability.
- Product
- SAP NetWeaver AS Java User Management Engine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordme.sap.comsupport.sap.com
Apr 8, 2024BackWPup: Does not prevent Directory Listing in its temporary backup folderCVE-2023-7164 · WordPress plugins & themes · reported by WPScanHigh 7.5
The BackWPup WordPress plugin before 4.0.4 does not prevent Directory Listing in its temporary backup folder, allowing unauthenticated attackers to download backups of a site's database.
- Product
- BackWPup
- Fixed in
- 4.0.4
- What to do
- Update BackWPup to 4.0.4 or newer.
Apr 8, 2024TOTOLINK EX200 V4.0.3c.7646_B20201211 does not contain an authentication mechanism by default.CVE-2024-31813 · Other software · totolink · reported by MITREHigh 8.4
TOTOLINK EX200 V4.0.3c.7646_B20201211 does not contain an authentication mechanism by default.
- Product
- ex200_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2024WPB Show Core: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-1958 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WPB Show Core WordPress plugin before 2.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin or unauthenticated users
- Product
- WPB Show Core
- Fixed in
- 2.7
- What to do
- Update WPB Show Core to 2.7 or newer.
Apr 8, 2024wpb-show-core: Does not sanitise and escape the parameters before outputting it back in the response of an unauthenticated requestCVE-2024-1956 · WordPress plugins & themes · reported by WPScanMedium 6.1
The wpb-show-core WordPress plugin before 2.7 does not sanitise and escape the parameters before outputting it back in the response of an unauthenticated request, leading to a Reflected Cross-Site Scripting
- Product
- wpb-show-core
- Fixed in
- 2.7
- What to do
- Update wpb-show-core to 2.7 or newer.
Apr 8, 2024Font Farsi: Does not sanitise and escape some of its settingsCVE-2024-1752 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Font Farsi WordPress plugin through 1.6.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Font Farsi
- Affected
- up to 1.6.6
- What to do
- Affects up to 1.6.6. Update Font Farsi to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2024SendPress Newsletters: Does not sanitise and escape some of its settingsCVE-2024-1589 · WordPress plugins & themes · reported by WPScanMedium 6.1
The SendPress Newsletters WordPress plugin through 1.23.11.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- SendPress Newsletters
- Affected
- up to 1.23.11.6
- What to do
- Affects up to 1.23.11.6. Update SendPress Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2024SendPress Newsletters: Does not sanitise and escape some of its settingsCVE-2024-1588 · WordPress plugins & themes · reported by WPScanMedium 6.8
The SendPress Newsletters WordPress plugin through 1.23.11.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- SendPress Newsletters
- Affected
- up to 1.23.11.6
- What to do
- Affects up to 1.23.11.6. Update SendPress Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2024WPB Show Core: Does not sanitise and escape some parameters before outputting them back in the pageCVE-2024-1292 · WordPress plugins & themes · reported by WPScanMedium 4.7
The WPB Show Core WordPress plugin before 2.7 does not sanitise and escape some parameters before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- WPB Show Core
- Fixed in
- 2.7
- What to do
- Update WPB Show Core to 2.7 or newer.
Apr 6, 2024Inline Related Posts: Does not sanitise and escape some of its settingsCVE-2024-2444 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Inline Related Posts WordPress plugin before 3.5.0 does not sanitise and escape some of its settings, which could allow high privilege users such as Admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Inline Related Posts
- Fixed in
- 3.5.0
- What to do
- Update Inline Related Posts to 3.5.0 or newer.
Apr 5, 2024GRUB2 does not call the module fini functions on exit, leading to Debian/Ubuntu's peimage GRUB2 module leaving UEFI system table hooks after exit.CVE-2024-2312 · Other software · Debian · reported by security@ubuntu.comMedium 6.7
GRUB2 does not call the module fini functions on exit, leading to Debian/Ubuntu's peimage GRUB2 module leaving UEFI system table hooks after exit. This lead to a use-after-free condition, and could possibly lead to secure boot bypass.
- Product
- Debian based GNU GRUB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.launchpad.netcve.mitre.org
Apr 5, 2024Gutenberg Blocks by Kadence Blocks: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2024-2509 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Gutenberg Blocks by Kadence Blocks WordPress plugin before 3.2.26 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Gutenberg Blocks by Kadence Blocks
- Fixed in
- 3.2.26
- What to do
- Update Gutenberg Blocks by Kadence Blocks to 3.2.26 or newer.
Full record and what to do →NVD recordresearch.cleantalk.orgwpscan.com
Apr 4, 2024Brocade Web Interface in Brocade Fabric OS v9.x and before v9.2.0 does not properly represent the portName to the user if the portName contains reserved charCVE-2023-5973 · Other software · Brocade · reported by sirt@brocade.comMedium 4.3
Brocade Web Interface in Brocade Fabric OS v9.x and before v9.2.0 does not properly represent the portName to the user if the portName contains reserved characters. This could allow an authenticated user to alter the UI of the Brocade Switch and change ports display.
- Product
- Fabric OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.comsupport.broadcom.com
Apr 4, 2024Vite (French word for "quick", pronounced /vit/, like "veet") is a frontend build tooling to improve the frontend development experience.`server.fs.deny` does nCVE-2024-31207 · Other software · vitejs · reported by GitHubMedium 5.9
Vite (French word for "quick", pronounced /vit/, like "veet") is a frontend build tooling to improve the frontend development experience.`server.fs.deny` does not deny requests for patterns with directories. This vulnerability has been patched in version(s) 5.2.6, 5.1.7, 5.0.13, 4.5.3, 3.2.10 and 2.9.18.
- Product
- vite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2024In the Linux kernel, the following vulnerability has been resolved: tls: fix use-after-free on failed backlog decryption When the decrypt request goes to the CVE-2024-26800 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Critical 9.8
In the Linux kernel, the following vulnerability has been resolved: tls: fix use-after-free on failed backlog decryption When the decrypt request goes to the backlog and crypto_aead_decrypt returns -EBUSY, tls_do_decryption will wait until all async decryptions have completed. If one of them fails, tls_do_decryption will return -EBADMSG and tls_decrypt_sg jumps to the error path, releasing all the pages. But the pages have been passed to the async callback, and have already been released by tls_decrypt_done. The only true async case is when crypto_aead_decrypt returns -EINPROGRESS. With -EBUSY, we already waited so we can tell tls_sw_recvmsg that the data is available for immediate copy, but we need to notify tls_decrypt_sg (via the new ->async_done flag) that the memory has already been released.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Apr 3, 2024In the Linux kernel, the following vulnerability has been resolved: cxl/pci: Fix disabling memory if DVSEC CXL Range does not match a CFMWS window The Linux CCVE-2024-26761 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: cxl/pci: Fix disabling memory if DVSEC CXL Range does not match a CFMWS window The Linux CXL subsystem is built on the assumption that HPA == SPA. That is, the host physical address (HPA) the HDM decoder registers are programmed with are system physical addresses (SPA). During HDM decoder setup, the DVSEC CXL range registers (cxl-3.1, 8.1.3.8) are checked if the memory is enabled and the CXL range is in a HPA window that is described in a CFMWS structure of the CXL host bridge (cxl-3.1, 9.18.1.3). Now, if the HPA is not an SPA, the CXL range does not match a CFMWS window and the CXL memory range will be disabled then. The HDM decoder stops working which causes system memory being disabled and further a system hang during HDM decoder initialization, typically when a CXL enabled kernel boots. Prevent a system hang and do not disable the HDM decoder if the decoder's CXL range is not found in a CFMWS window. Note the change only fixes a hardware hang, but does not implement HPA/SPA translation. Support for this can be added in a follow on patch series.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Apr 3, 2024In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries/iommu: DLPAR add doesn't completely initialize pci_controller When a PCI dCVE-2024-26738 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries/iommu: DLPAR add doesn't completely initialize pci_controller When a PCI device is dynamically added, the kernel oopses with a NULL pointer dereference: BUG: Kernel NULL pointer dereference on read at 0x00000030 Faulting instruction address: 0xc0000000006bbe5c Oops: Kernel access of bad area, sig: 11 [#1] LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA pSeries Modules linked in: rpadlpar_io rpaphp rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace fscache netfs xsk_diag bonding nft_compat nf_tables nfnetlink rfkill binfmt_misc dm_multipath rpcrdma sunrpc rdma_ucm ib_srpt ib_isert iscsi_target_mod target_core_mod ib_umad ib_iser libiscsi scsi_transport_iscsi ib_ipoib rdma_cm iw_cm ib_cm mlx5_ib ib_uverbs ib_core pseries_rng drm drm_panel_orientation_quirks xfs libcrc32c mlx5_core mlxfw sd_mod t10_pi sg tls ibmvscsi ibmveth scsi_transport_srp vmx_crypto pseries_wdt psample dm_mirror dm_region_hash dm_log dm_mod fuse CPU: 17 PID: 2685 Comm: drmgr Not tainted 6.7.0-203405+ #66 Hardware name: IBM,9080-HEX POWER10 (raw) 0x800200 0xf000006 of:IBM,FW1060.00 (NH1060_008) hv:phyp
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Apr 3, 2024In the Linux kernel, the following vulnerability has been resolved: iio: adc: ad4130: zero-initialize clock init data The clk_init_data struct does not have aCVE-2024-26711 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: iio: adc: ad4130: zero-initialize clock init data The clk_init_data struct does not have all its members initialized, causing issues when trying to expose the internal clock on the CLK pin. Fix this by zero-initializing the clk_init_data struct.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Apr 3, 2024WooCommerce Cart Abandonment Recovery: Does not have CSRF check in its bulk actionsCVE-2024-2322 · WordPress plugins & themes · reported by WPScanMedium 6.8
The WooCommerce Cart Abandonment Recovery WordPress plugin before 1.2.27 does not have CSRF check in its bulk actions, which could allow attackers to make logged in admins delete arbitrary email templates as well as delete and unsubscribe users from abandoned orders via CSRF attacks.
- Product
- WooCommerce Cart Abandonment Recovery
- Fixed in
- 1.2.27
- What to do
- Update WooCommerce Cart Abandonment Recovery to 1.2.27 or newer.
Apr 2, 2024My Calendar: Does not sanitise and escape some parametersCVE-2024-1274 · WordPress plugins & themes · reported by WPScanMedium 5.4
The My Calendar WordPress plugin before 3.4.24 does not sanitise and escape some parameters, which could allow users with a role as low as Subscriber to perform Cross-Site Scripting attacks (depending on the permissions set by the admin)
- Product
- My Calendar
- Fixed in
- 3.4.24
- What to do
- Update My Calendar to 3.4.24 or newer.
Apr 2, 2024Page Builder Gutenberg Blocks: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2024-2369 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Page Builder Gutenberg Blocks WordPress plugin before 3.1.7 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Page Builder Gutenberg Blocks
- Fixed in
- 3.1.7
- What to do
- Update Page Builder Gutenberg Blocks to 3.1.7 or newer.
Apr 1, 2024Themify WordPress plugin before 1.4.4 does not sanitise and escape some of its Filters settings, which could allow high privilege users such as admin to perforCVE-2024-2278 · WordPress plugins & themes · reported by WPScanMedium 6.1
Themify WordPress plugin before 1.4.4 does not sanitise and escape some of its Filters settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Fixed in
- 1.4.4
- What to do
- Update the plugin to 1.4.4 or newer.
Apr 1, 2024Themify WordPress plugin before 1.4.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site ScriptiCVE-2024-2263 · WordPress plugins & themes · reported by WPScanMedium 4.8
Themify WordPress plugin before 1.4.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Fixed in
- 1.4.4
- What to do
- Update the plugin to 1.4.4 or newer.
Apr 1, 2024Themify WordPress plugin before 1.4.4 does not have CSRF check in its bulk action, which could allow attackers to make logged in users delete arbitrary filtersCVE-2024-2262 · WordPress plugins & themes · reported by WPScanMedium 4.7
Themify WordPress plugin before 1.4.4 does not have CSRF check in its bulk action, which could allow attackers to make logged in users delete arbitrary filters via CSRF attack, granted they know the related filter slugs
- Fixed in
- 1.4.4
- What to do
- Update the plugin to 1.4.4 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.