Category: alerts

Today, CISA released a Resource Guide for Cybersecurity Clinics to outline ways CISA can partner with and support cybersecurity clinics and their clients.

University cybersecurity clinics train students from diverse backgrounds and academic expertise to strengthen the digital defenses of non-profits, hospitals, municipalities, small businesses, and other under-resourced organizations. They can help address the national cyber workforce gap by developing a talent pipeline for cyber civil defense and helping students see themselves in a cybersecurity career.

CISA encourages clinics to engage with CISA and leverage the CISA resources outlined in the guide. CISA also encourages more universities to consider starting their own cybersecurity clinics as they play an important role in strengthening the cybersecurity posture of small organizations at the local level.

High Vulnerabilities

 

 

CISA, in partnership with UK National Cyber Security Centre (NCSC) and other U.S. and international partners released the joint advisory, SVR Cyber Actors Adapt Tactics for Initial Cloud Access. This advisory provides recent tactics, techniques, and procedures (TTPs) used by Russian Foreign Intelligence Service (SVR) cyber actors—also known as APT29, the Dukes, CozyBear, and NOBELIUM/Midnight Blizzard—to gain initial access into a cloud environment.

The authoring agencies encourage network defenders and organizations review the joint advisory for recommended mitigations. For more information on APT29, see joint CSA Russian Foreign Intelligence Service (SVR) Exploiting JetBrains TeamCity CVE Globally or visit CISA’s Russia Cyber Threat Overview and Advisories page. For more guidance on cloud security best practices, see CISA’s Secure Cloud Business Applications (SCuBA) Project.

How SVR-Attributed Actors are Adapting to the Move of Government and Corporations to Cloud Infrastructure

OVERVIEW

This advisory details recent tactics, techniques, and procedures (TTPs) of the group commonly known as APT29, also known as Midnight Blizzard, the Dukes, or Cozy Bear.

The UK National Cyber Security Centre (NCSC) and international partners assess that APT29 is a cyber espionage group, almost certainly part of the SVR, an element of the Russian intelligence services. The US National Security Agency (NSA), the US Cybersecurity and Infrastructure Security Agency (CISA), the US Cyber National Mission Force (CNMF), the Federal Bureau of Investigation (FBI), Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC), the Canadian Centre for Cyber Security (CCCS), and New Zealand Government Communications Security Bureau (GCSB) agree with this attribution and the details provided in this advisory.

This advisory provides an overview of TTPs deployed by the actor to gain initial access into the cloud environment and includes advice to detect and mitigate this activity.

To download the PDF version of this report, click here.

PREVIOUS ACTOR ACTIVITY

The NCSC has previously detailed how Russian Foreign Intelligence Service (SVR) cyber actors have targeted governmental, think tank, healthcare, and energy targets for intelligence gain. It has now observed SVR actors expanding their targeting to include aviation, education, law enforcement, local and state councils, government financial departments, and military organizations.

SVR actors are also known for:

• The supply chain compromise of SolarWinds software.
• Activity that targeted organizations developing the COVID-19 vaccine.

EVOLVING TTPs

As organizations continue to modernize their systems and move to cloud-based infrastructure, the SVR has adapted to these changes in the operating environment.

They have to move beyond their traditional means of initial access, such as exploiting software vulnerabilities in an on-premises network, and instead target the cloud services themselves.

To access the majority of the victims’ cloud hosted network, actors must first successfully authenticate to the cloud provider. Denying initial access to the cloud environment can prohibit SVR from successfully compromising their target. In contrast, in an on-premises system, more of the network is typically exposed to threat actors.

Below describes in more detail how SVR actors are adapting to continue their cyber operations for intelligence gain. These TTPs have been observed in the last 12 months.

ACCESS VIA SERVICE AND DORMANT ACCOUNTS

Previous SVR campaigns reveal the actors have successfully used brute forcing [T1110] and password spraying to access service accounts. This type of account is typically used to run and manage applications and services. There is no human user behind them so they cannot be easily protected with multi-factor authentication (MFA), making these accounts more susceptible to a successful compromise. Service accounts are often also highly privileged depending on which applications and services they’re responsible for managing. Gaining access to these accounts provides threat actors with privileged initial access to a network, to launch further operations.

SVR campaigns have also targeted dormant accounts belonging to users who no longer work at a victim organization but whose accounts remain on the system [T1078.004].

Following an enforced password reset for all users during an incident, SVR actors have also been observed logging into inactive accounts and following instructions to reset the password. This has allowed the actor to regain access following incident response eviction activities.

CLOUD-BASED TOKEN AUTHENTICATION

Account access is typically authenticated by either username and password credentials or system-issued access tokens. The NCSC and partners have observed SVR actors using tokens to access their victims’ accounts, without needing a password [T1528].

The default validity time of system-issued tokens varies dependent on the system; however, cloud platforms should allow administrators to adjust the validity time as appropriate for their users. More information can be found on this in the mitigations section of this advisory.

ENROLLING NEW DEVICES TO THE CLOUD

On multiple occasions, the SVR have successfully bypassed password authentication on personal accounts using password spraying and credential reuse. SVR actors have also then bypassed MFA through a technique known as “MFA bombing” or “MFA fatigue,” in which the actors repeatedly push MFA requests to a victim’s device until the victim accepts the notification [T1621].

Once an actor has bypassed these systems to gain access to the cloud environment, SVR actors have been observed registering their own device as a new device on the cloud tenant [T1098.005]. If device validation rules are not set up, SVR actors can successfully register their own device and gain access to the network.

By configuring the network with device enrollment policies, there have been instances where these measures have defended against SVR actors and denied them access to the cloud tenant.

RESIDENTIAL PROXIES

As network-level defenses improve detection of suspicious activity, SVR actors have looked at other ways to stay covert on the internet. A TTP associated with this actor is the use of residential proxies [T1090.002]. Residential proxies typically make traffic appear to originate from IP addresses within internet service provider (ISP) ranges used for residential broadband customers and hide the true source. This can make it harder to distinguish malicious connections from typical users. This reduces the effectiveness of network defenses that use IP addresses as indicators of compromise, and so it is important to consider a variety of information sources such as application and host-based logging for detecting suspicious activity.

CONCLUSION

The SVR is a sophisticated actor capable of carrying out a global supply chain compromise such as the 2020 SolarWinds, however the guidance in this advisory shows that a strong baseline of cyber security fundamentals can help defend from such actors.

For organizations that have moved to cloud infrastructure, a first line of defense against an actor such as SVR should be to protect against SVR’s TTPs for initial access. By following the mitigations outlined in this advisory, organizations will be in a stronger position to defend against this threat.

Once the SVR gain initial access, the actor is capable of deploying highly sophisticated post compromise capabilities such as MagicWeb, as reported in 2022. Therefore, mitigating against the SVR’s initial access vectors is particularly important for network defenders.

CISA have also produced guidance through their Secure Cloud Business Applications (SCuBA) Project which is designed to protect assets stored in cloud environments.

Some of the TTPs listed in this report, such as residential proxies and exploitation of system accounts, are similar to those reported as recently as January 2024 by Microsoft.

MITRE ATT&CK®

This report has been compiled with respect to the MITRE ATT&CK® framework, a globally accessible knowledge base of adversary tactics and techniques based on real-world observations.

Tactic	ID	Technique	Procedure
Credential Access	T1110	Brute Force	The SVR use password spraying and brute forcing as an initial infection vector.
Initial Access	T1078.004	Valid Accounts: Cloud Accounts	The SVR use compromised credentials to gain access to accounts for cloud services, including system and dormant accounts.
Credential Access	T1528	Steal Application Access Token	The SVR use stolen access tokens to login to accounts without the need for passwords.
Credential Access	T1621	Multi-Factor Authentication Request Generation	The SVR repeatedly push MFA requests to a victim’s device until the victim accepts the notification, providing SVR access to the account.
Command and Control	T1090.002	Proxy: External Proxy	The SVR use open proxies in residential IP ranges to blend in with expected IP address pools in access logs.
Persistence	T1098.005	Account Manipulation: Device Registration	The SVR attempt to register their own device on the cloud tenant after acquiring access to accounts.

MITIGATION AND DETECTION

A number of mitigations will be useful in defending against the activity described in this advisory: 

• Use multi-factor authentication (/2-factor authentication/two-step verification) to reduce the impact of password compromises. See NCSC guidance: Multifactor Authentication for Online Services and Setting up 2-Step Verification (2SV).
• Accounts that cannot use 2SV should have strong, unique passwords. User and system accounts should be disabled when no longer required with a “joiners, movers, and leavers” process in place and regular reviews to identify and disable inactive/dormant accounts. See NCSC guidance: 10 Steps to Cyber Security.
• System and service accounts should implement the principle of least privilege, providing tightly scoped access to resources required for the service to function.
• Canary service accounts should be created which appear to be valid service accounts but are never used by legitimate services. Monitoring and alerting on the use of these account provides a high confidence signal that they are being used illegitimately and should be investigated urgently.
• Session lifetimes should be kept as short as practical to reduce the window of opportunity for an adversary to use stolen session tokens. This should be paired with a suitable authentication method that strikes a balance between regular user authentication and user experience.
• Ensure device enrollment policies are configured to only permit authorized devices to enroll. Use zero-touch enrollment where possible, or if self-enrollment is required then use a strong form of 2SV that is resistant to phishing and prompt bombing. Old devices should be prevented from (re)enrolling when no longer required. See NCSC guidance: Device Security Guidance.
• Consider a variety of information sources such as application events and host-based logs to help prevent, detect and investigate potential malicious behavior. Focus on the information sources and indicators of compromise that have a better rate of false positives. For example, looking for changes to user agent strings that could indicate session hijacking may be more effective than trying to identify connections from suspicious IP addresses. See NCSC guidance: Introduction to Logging for Security Purposes.

DISCLAIMER

This report draws on information derived from NCSC and industry sources. Any NCSC findings and recommendations made have not been provided with the intention of avoiding all risks and following the recommendations will not remove all such risk. Ownership of information risks remains with the relevant system owner at all times.

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information legislation.

Refer any FOIA queries to ncscinfoleg@ncsc.gov.uk.

All material is UK Crown Copyright.

Today, CISA, the Environmental Protection Agency (EPA), and the Federal Bureau of Investigation (FBI) updated the joint fact sheet Top Cyber Actions for Securing Water Systems. This update includes additional resources—from American Water Works Association, the WaterISAC, and MS-ISAC—to support water systems in defending against from malicious cyber activity. 

The fact sheet outlines the following practical actions Water and Wastewater Systems (WWS) Sector entities can take to better protect water systems from malicious cyber activity and provides actionable guidance to implement concurrently:

• Reduce Exposure to the Public-Facing Internet
• Conduct Regular Cybersecurity Assessments
• Change Default Passwords Immediately
• Conduct an Inventory of Operational Technology/Information Technology Assets
• Develop and Exercise Cybersecurity Incident Response and Recovery Plans
• Backup OT/IT Systems
• Reduce Exposure to Vulnerabilities
• Conduct Cybersecurity Awareness Training

CISA, EPA, and FBI urge all WWS Sector and critical infrastructure organizations to review the fact sheet and implement the actions to improve resilience to cyber threat activity. Organizations can visit cisa.gov/water for additional sector tools, information, and resources.

 

 

 

 

Primary Vendor — Product	Description	Published	CVSS Score	Source & Patch Info
4ipnet — eap-767	4ipnet EAP-767 v3.42.00 is vulnerable to Incorrect Access Control. The device uses the same set of credentials, regardless of how many times a user logs in, the content of the cookie remains unchanged.	2024-02-14	not yet calculated	CVE-2024-24300 cve@mitre.org
4ipnet — eap-767	Command Injection vulnerability discovered in 4ipnet EAP-767 device v3.42.00 within the web interface of the device allows attackers with valid credentials to inject arbitrary shell commands to be executed by the device with root privileges.	2024-02-14	not yet calculated	CVE-2024-24301 cve@mitre.org
adv_radius — adv_radius	SQL injection vulnerability in adv radius v.2.2.5 allows a local attacker to execute arbitrary code via a crafted script.	2024-02-13	not yet calculated	CVE-2024-22923 cve@mitre.org cve@mitre.org
alanclarke — urlite	An issue in alanclarke URLite v.3.1.0 allows an attacker to cause a denial of service (DoS) via a crafted payload to the parsing function.	2024-02-16	not yet calculated	CVE-2023-51931 cve@mitre.org cve@mitre.org
amd — 3rd_gen_amd	Improper Access Control in System Management Mode (SMM) may allow an attacker access to the SPI flash potentially leading to arbitrary code execution.	2024-02-13	not yet calculated	CVE-2023-20587 psirt@amd.com
amd — 3rd_gen_amd	Failure to initialize memory in SEV Firmware may allow a privileged attacker to access stale data from other guests.	2024-02-13	not yet calculated	CVE-2023-31346 psirt@amd.com
amd — 3rd_gen_amd	Due to a code bug in Secure_TSC, SEV firmware may allow an attacker with high privileges to cause a guest to observe an incorrect TSC when Secure TSC is enabled potentially resulting in a loss of guest integrity.	2024-02-13	not yet calculated	CVE-2023-31347 psirt@amd.com
amd — alveo_card	Insufficient verification of data authenticity in the configuration state machine may allow a local attacker to potentially load arbitrary bitstreams.	2024-02-13	not yet calculated	CVE-2023-20570 psirt@amd.com
amd — amd_ryzen	Insufficient checking of memory buffer in ASP Secure OS may allow an attacker with a malicious TA to read/write to the ASP Secure OS kernel virtual address space potentially leading to privilege escalation.	2024-02-13	not yet calculated	CVE-2021-46757 psirt@amd.com
amd — amd_ryzen	Improper Access Control in the AMD SPI protection feature may allow a user with Ring0 (kernel mode) privileged access to bypass protections potentially resulting in loss of integrity and availability.	2024-02-13	not yet calculated	CVE-2023-20579 psirt@amd.com
appleple_inc. — a-blog_cms	URL spoofing vulnerability exists in a-blog cms Ver.3.1.0 to Ver.3.1.8. If an attacker sends a specially crafted request, the administrator of the product may be forced to access an arbitrary website when clicking a link in the audit log.	2024-02-15	not yet calculated	CVE-2024-25559 vultures@jpcert.or.jp vultures@jpcert.or.jp
bludit — bludit_cms	Cross Site Scripting (XSS) vulnerability in Bludit CMS version 3.15, allows remote attackers to execute arbitrary code and obtain sensitive information via edit-content.php.	2024-02-17	not yet calculated	CVE-2024-25297 cve@mitre.org
caddy — caddy	The caddy-security plugin 1.1.20 for Caddy allows reflected XSS via a GET request to a URL that contains an XSS payload and begins with either a /admin or /settings/mfa/delete/ substring.	2024-02-12	not yet calculated	CVE-2023-52430 cve@mitre.org cve@mitre.org
ce-phoenixcart — phoenixcart	A remote code execution (RCE) vulnerability in /admin/define_language.php of CE Phoenix v1.0.8.20 allows attackers to execute arbitrary PHP code via injecting a crafted payload into the file english.php.	2024-02-16	not yet calculated	CVE-2024-25415 cve@mitre.org cve@mitre.org cve@mitre.org
codeprojects — simple_admin_panel_app	Simple Admin Panel App v1.0 was discovered to contain a SQL injection vulnerability via the orderID parameter at /adminView/viewEachOrder.php.	2024-02-14	not yet calculated	CVE-2024-25223 cve@mitre.org
codeprojects — simple_admin_panel_app	A cross-site scripting (XSS) vulnerability in Simple Admin Panel App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Size Number parameter under the Add Size function.	2024-02-14	not yet calculated	CVE-2024-25224 cve@mitre.org
codeprojects — simple_admin_panel_app	A cross-site scripting (XSS) vulnerability in Simple Admin Panel App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Category Name parameter under the Add Category function.	2024-02-14	not yet calculated	CVE-2024-25225 cve@mitre.org
codeprojects — simple_admin_panel_app	A cross-site scripting (XSS) vulnerability in Simple Admin Panel App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Category Name parameter under the Add Category function.	2024-02-14	not yet calculated	CVE-2024-25226 cve@mitre.org
connect2id — nimbus_jose+jwt	In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header value (aka iteration count) for the PasswordBasedDecrypter (PBKDF2) component.	2024-02-11	not yet calculated	CVE-2023-52428 cve@mitre.org cve@mitre.org cve@mitre.org
cskaza — csz_cms	An arbitrary file upload vulnerability in /admin/upgrade of CSZ CMS v1.3.0 allows attackers to execute arbitrary code via uploading a crafted Zip file.	2024-02-16	not yet calculated	CVE-2024-25414 cve@mitre.org cve@mitre.org
cu_solutions_group — cusg_solutions_content_management_solution	Cross Site Scripting (XSS) vulnerability in CU Solutions Group (CUSG) Content Management System (CMS) before v.7.75 allows a remote attacker to execute arbitrary code, escalate privileges, and obtain sensitive information via a crafted script to the login.php component.	2024-02-14	not yet calculated	CVE-2023-48985 cve@mitre.org
cu_solutions_group — cusg_solutions_content_management_solution	Cross Site Scripting (XSS) vulnerability in CU Solutions Group (CUSG) Content Management System (CMS) before v.7.75 allows a remote attacker to execute arbitrary code, escalate privileges, and obtain sensitive information via a crafted script to the users.php component.	2024-02-14	not yet calculated	CVE-2023-48986 cve@mitre.org
cu_solutions_group — cusg_solutions_content_management_solution	Blind SQL Injection vulnerability in CU Solutions Group (CUSG) Content Management System (CMS) before v.7.75 allows a remote attacker to execute arbitrary code, escalate privileges, and obtain sensitive information via a crafted script to the pages.php component.	2024-02-14	not yet calculated	CVE-2023-48987 cve@mitre.org
dakkar — plack::middleware::xsrfblock_perl_package	The Plack::Middleware::XSRFBlock package before 0.0.19 for Perl allows attackers to bypass a CSRF protection mechanism via an empty form value and an empty cookie (if signed cookies are disabled).	2024-02-13	not yet calculated	CVE-2023-52431 cve@mitre.org cve@mitre.org
darktrace — threat_visualizer	DOM-based HTML injection vulnerability in the main page of Darktrace Threat Visualizer version 6.1.27 (bundle version 61050) and before has been identified. A URL, crafted by a remote attacker and visited by an authenticated user, allows open redirect and potential credential stealing using an injected HTML form.	2024-02-16	not yet calculated	CVE-2024-22854 cve@mitre.org
digital-peak.com — dp_calendar_for_joomla	XSS vulnerability in DP Calendar component for Joomla.	2024-02-15	not yet calculated	CVE-2024-21727 security@joomla.org
dnssec — dnssec	The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the “NSEC3” issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations.	2024-02-14	not yet calculated	CVE-2023-50868 cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org
ellucian — banner	Ellucian Banner 9.17 allows Insecure Direct Object Reference (IDOR) via a modified bannerId to the /StudentSelfService/ssb/studentCard/retrieveData endpoint.	2024-02-13	not yet calculated	CVE-2023-49339 cve@mitre.org cve@mitre.org
expressvpn — expressvpn	ExpressVPN before 12.73.0 on Windows, when split tunneling is used, sends DNS requests according to the Windows configuration (e.g., sends them to DNS servers operated by the user’s ISP instead of to the ExpressVPN DNS servers), which may allow remote attackers to obtain sensitive information about websites visited by VPN users.	2024-02-11	not yet calculated	CVE-2024-25728 cve@mitre.org cve@mitre.org
firebear_studio — improved_import_&_export	A XSLT Server Side injection vulnerability in the Import Jobs function of FireBear Improved Import And Export v3.8.6 allows attackers to execute arbitrary commands via a crafted XSLT file.	2024-02-16	not yet calculated	CVE-2024-25413 cve@mitre.org cve@mitre.org
flusity — flusity_cms	Directory Traversal vulnerability in flusity CMS v.2.4 allows a remote attacker to execute arbitrary code and obtain sensitive information via the download_backup.php component.	2024-02-15	not yet calculated	CVE-2024-25502 cve@mitre.org
freebsd — freebsd	The total size of the user-provided nmreq to nmreq_copyin() was first computed and then trusted during the copyin. This time-of-check to time-of-use bug could lead to kernel memory corruption. On systems configured to include netmap in their devfs_ruleset, a privileged process running in a jail can affect the host environment.	2024-02-15	not yet calculated	CVE-2022-23084 secteam@freebsd.org
freebsd — freebsd	A user-provided integer option was passed to nmreq_copyin() without checking if it would overflow. This insufficient bounds checking could lead to kernel memory corruption. On systems configured to include netmap in their devfs_ruleset, a privileged process running in a jail can affect the host environment.	2024-02-15	not yet calculated	CVE-2022-23085 secteam@freebsd.org
freebsd — freebsd	Handlers for *_CFG_PAGE read / write ioctls in the mpr, mps, and mpt drivers allocated a buffer of a caller-specified size but copied to it a fixed size header. Other heap content would be overwritten if the specified size was too small. Users with access to the mpr, mps or mpt device node may overwrite heap data, potentially resulting in privilege escalation. Note that the device node is only accessible to root and members of the operator group.	2024-02-15	not yet calculated	CVE-2022-23086 secteam@freebsd.org
freebsd — freebsd	The e1000 network adapters permit a variety of modifications to an Ethernet packet when it is being transmitted. These include the insertion of IP and TCP checksums, insertion of an Ethernet VLAN header, and TCP segmentation offload (“TSO”). The e1000 device model uses an on-stack buffer to generate the modified packet header when simulating these modifications on transmitted packets. When checksum offload is requested for a transmitted packet, the e1000 device model used a guest-provided value to specify the checksum offset in the on-stack buffer. The offset was not validated for certain packet types. A misbehaving bhyve guest could overwrite memory in the bhyve process on the host, possibly leading to code execution in the host context. The bhyve process runs in a Capsicum sandbox, which (depending on the FreeBSD version and bhyve configuration) limits the impact of exploiting this issue.	2024-02-15	not yet calculated	CVE-2022-23087 secteam@freebsd.org
freebsd — freebsd	The 802.11 beacon handling routine failed to validate the length of an IEEE 802.11s Mesh ID before copying it to a heap-allocated buffer. While a FreeBSD Wi-Fi client is in scanning mode (i.e., not associated with a SSID) a malicious beacon frame may overwrite kernel memory, leading to remote code execution.	2024-02-15	not yet calculated	CVE-2022-23088 secteam@freebsd.org
freebsd — freebsd	When dumping core and saving process information, proc_getargv() might return a sbuf which have a sbuf_len() of 0 or -1, which is not properly handled. An out-of-bound read can happen when user constructs a specially crafted ps_string, which in turn can cause the kernel to crash.	2024-02-15	not yet calculated	CVE-2022-23089 secteam@freebsd.org
freebsd — freebsd	The aio_aqueue function, used by the lio_listio system call, fails to release a reference to a credential in an error case. An attacker may cause the reference count to overflow, leading to a use after free (UAF).	2024-02-15	not yet calculated	CVE-2022-23090 secteam@freebsd.org
freebsd — freebsd	A particular case of memory sharing is mishandled in the virtual memory system. This is very similar to SA-21:08.vm, but with a different root cause. An unprivileged local user process can maintain a mapping of a page after it is freed, allowing that process to read private data belonging to other processes or the kernel.	2024-02-15	not yet calculated	CVE-2022-23091 secteam@freebsd.org
freebsd — freebsd	The implementation of lib9p’s handling of RWALK messages was missing a bounds check needed when unpacking the message contents. The missing check means that the receipt of a specially crafted message will cause lib9p to overwrite unrelated memory. The bug can be triggered by a malicious bhyve guest kernel to overwrite memory in the bhyve(8) process. This could potentially lead to user-mode code execution on the host, subject to bhyve’s Capsicum sandbox.	2024-02-15	not yet calculated	CVE-2022-23092 secteam@freebsd.org
freebsd — freebsd	ping reads raw IP packets from the network to process responses in the pr_pack() function. As part of processing a response ping has to reconstruct the IP header, the ICMP header and if present a “quoted packet,” which represents the packet that generated an ICMP error. The quoted packet again has an IP header and an ICMP header. The pr_pack() copies received IP and ICMP headers into stack buffers for further processing. In so doing, it fails to take into account the possible presence of IP option headers following the IP header in either the response or the quoted packet. When IP options are present, pr_pack() overflows the destination buffer by up to 40 bytes. The memory safety bugs described above can be triggered by a remote host, causing the ping program to crash. The ping process runs in a capability mode sandbox on all affected versions of FreeBSD and is thus very constrained in how it can interact with the rest of the system at the point where the bug can occur.	2024-02-15	not yet calculated	CVE-2022-23093 secteam@freebsd.org
freebsd — freebsd	`bhyveload -h ` may be used to grant loader access to the directory tree on the host. Affected versions of bhyveload(8) do not make any attempt to restrict loader’s access to , allowing the loader to read any file the host user has access to. In the bhyveload(8) model, the host supplies a userboot.so to boot with, but the loader scripts generally come from the guest image. A maliciously crafted script could be used to exfiltrate sensitive data from the host accessible to the user running bhyhveload(8), which is often the system root.	2024-02-15	not yet calculated	CVE-2024-25940 secteam@freebsd.org
freebsd — freebsd	The jail(2) system call has not limited a visiblity of allocated TTYs (the kern.ttys sysctl). This gives rise to an information leak about processes outside the current jail. Attacker can get information about TTYs allocated on the host or in other jails. Effectively, the information printed by “pstat -t” may be leaked.	2024-02-15	not yet calculated	CVE-2024-25941 secteam@freebsd.org
german_national_identity_card — online-ausweis-funktion_eid_scheme	The Online-Ausweis-Funktion eID scheme in the German National Identity card through 2024-02-15 allows authentication bypass by spoofing. A man-in-the-middle attacker can assume a victim’s identify for access to government, medical, and financial resources, and can also extract personal data from the card, aka the “sPACE (Spoofing Password Authenticated Connection Establishment)” issue. This occurs because of a combination of factors, such as insecure PIN entry (for basic readers) and eid:// deeplinking. The victim must be using a modified eID kernel, which may occur if the victim is tricked into installing a fake version of an official app. NOTE: the BSI position is “ensuring a secure operational environment at the client side is an obligation of the ID card owner.”	2024-02-15	not yet calculated	CVE-2024-23674 cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org
gestsup — gestsup	A cross-site scripting (XSS) vulnerability in Gestsup v3.2.46 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Description text field.	2024-02-13	not yet calculated	CVE-2023-52059 cve@mitre.org cve@mitre.org
gestsup — gestsup	A Cross-Site Request Forgery (CSRF) in Gestsup v3.2.46 allows attackers to arbitrarily edit user profile information via a crafted request.	2024-02-13	not yet calculated	CVE-2023-52060 cve@mitre.org cve@mitre.org
ghost — ghost	Ghost through 5.76.0 allows stored XSS, and resultant privilege escalation in which a contributor can take over any account, via an SVG profile picture that contains JavaScript code to interact with the API on localhost TCP port 3001. NOTE: The discoverer reports that “The vendor does not view this as a valid vector.”	2024-02-11	not yet calculated	CVE-2024-23724 cve@mitre.org cve@mitre.org cve@mitre.org
google — android	In applyCustomDescription of SaveUi.java, there is a possible way to view other user’s images due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.	2024-02-16	not yet calculated	CVE-2023-40122 security@android.com security@android.com
google — android	In DevmemIntUnmapPMR of devicemem_server.c, there is a possible arbitrary code execution due to a use after free. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.	2024-02-16	not yet calculated	CVE-2023-21165 security@android.com
google — android	In convertSubgraphFromHAL of ShimConverter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.	2024-02-16	not yet calculated	CVE-2023-40085 security@android.com security@android.com
google — android	In multiple files, there is a possible way that trimmed content could be included in PDF output due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.	2024-02-16	not yet calculated	CVE-2023-40093 security@android.com security@android.com security@android.com
google — android	In discovery_thread of Dns64Configuration.cpp, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.	2024-02-15	not yet calculated	CVE-2023-40100 security@android.com security@android.com
google — android	In ca-certificates, there is a possible way to read encrypted TLS data due to untrusted cryptographic certificates. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.	2024-02-15	not yet calculated	CVE-2023-40104 security@android.com security@android.com
google — android	In backupAgentCreated of ActivityManagerService.java, there is a possible way to leak sensitive data due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.	2024-02-15	not yet calculated	CVE-2023-40105 security@android.com security@android.com
google — android	In sanitizeSbn of NotificationManagerService.java, there is a possible way to launch an activity from the background due to BAL Bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.	2024-02-15	not yet calculated	CVE-2023-40106 security@android.com security@android.com
google — android	In ARTPWriter of ARTPWriter.cpp, there is a possible use after free due to uninitialized data. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.	2024-02-15	not yet calculated	CVE-2023-40107 security@android.com security@android.com
google — android	In createFromParcel of UsbConfiguration.java, there is a possible background activity launch (BAL) due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.	2024-02-15	not yet calculated	CVE-2023-40109 security@android.com security@android.com
google — android	In multiple functions of MtpPacket.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.	2024-02-15	not yet calculated	CVE-2023-40110 security@android.com security@android.com
google — android	In setMediaButtonReceiver of MediaSessionRecord.java, there is a possible way to send a pending intent on behalf of system_server due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.	2024-02-15	not yet calculated	CVE-2023-40111 security@android.com security@android.com
google — android	In ippSetValueTag of ipp.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure of past print jobs or other print-related information, with no additional execution privileges needed. User interaction is not needed for exploitation.	2024-02-15	not yet calculated	CVE-2023-40112 security@android.com security@android.com
google — android	In multiple locations, there is a possible way for apps to access cross-user message data due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.	2024-02-15	not yet calculated	CVE-2023-40113 security@android.com security@android.com
google — android	In multiple functions of MtpFfsHandle.cpp, there is a possible out of bounds write due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.	2024-02-15	not yet calculated	CVE-2023-40114 security@android.com security@android.com
google — android	In readLogs of StatsService.cpp, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.	2024-02-15	not yet calculated	CVE-2023-40115 security@android.com security@android.com
google — android	In multiple locations, there is a possible cross-user read due to a confused deputy. This could lead to local information disclosure of photos or other images with no additional execution privileges needed. User interaction is not needed for exploitation.	2024-02-15	not yet calculated	CVE-2023-40124 security@android.com security@android.com
google — android	In startInstall of UpdateFetcher.java, there is a possible way to trigger a malicious config update due to a logic error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.	2024-02-16	not yet calculated	CVE-2024-0014 security@android.com
google — android	In convertToComponentName of DreamService.java, there is a possible way to launch arbitrary protected activities due to intent redirection. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.	2024-02-16	not yet calculated	CVE-2024-0015 security@android.com security@android.com
google — android	In multiple locations, there is a possible out of bounds read due to a missing bounds check. This could lead to paired device information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.	2024-02-16	not yet calculated	CVE-2024-0016 security@android.com security@android.com
google — android	In shouldUseNoOpLocation of CameraActivity.java, there is a possible confused deputy due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.	2024-02-16	not yet calculated	CVE-2024-0017 security@android.com security@android.com
google — android	In convertYUV420Planar16ToY410 of ColorConverter.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.	2024-02-16	not yet calculated	CVE-2024-0018 security@android.com security@android.com
google — android	In setListening of AppOpsControllerImpl.java, there is a possible way to hide the microphone privacy indicator when restarting systemUI due to a missing check for active recordings. This could lead to local denial of service with no additional execution privileges needed. User interaction is needed for exploitation.	2024-02-16	not yet calculated	CVE-2024-0019 security@android.com security@android.com
google — android	In onActivityResult of NotificationSoundPreference.java, there is a possible way to hear audio files belonging to a different user due to a confused deputy. This could lead to local information disclosure across users of a device with no additional execution privileges needed. User interaction is not needed for exploitation.	2024-02-16	not yet calculated	CVE-2024-0020 security@android.com security@android.com
google — android	In onCreate of NotificationAccessConfirmationActivity.java, there is a possible way for an app in the work profile to enable notification listener services due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.	2024-02-16	not yet calculated	CVE-2024-0021 security@android.com security@android.com
google — android	In ConvertRGBToPlanarYUV of Codec2BufferUtils.cpp, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.	2024-02-16	not yet calculated	CVE-2024-0023 security@android.com security@android.com
google — android	In multiple files, there is a possible way to capture the device screen when disallowed by device policy due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.	2024-02-16	not yet calculated	CVE-2024-0029 security@android.com security@android.com
google — android	In btif_to_bta_response of btif_gatt_util.cc, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.	2024-02-16	not yet calculated	CVE-2024-0030 security@android.com security@android.com
google — android	In attp_build_read_by_type_value_cmd of att_protocol.cc, there is a possible out of bounds write due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.	2024-02-16	not yet calculated	CVE-2024-0031 security@android.com security@android.com
google — android	In queryChildDocuments of FileSystemProvider.java, there is a possible way to request access to directories that should be hidden due to improper input validation. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.	2024-02-16	not yet calculated	CVE-2024-0032 security@android.com security@android.com security@android.com
google — android	In multiple functions of ashmem-dev.cpp, there is a possible missing seal due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.	2024-02-16	not yet calculated	CVE-2024-0033 security@android.com security@android.com security@android.com
google — android	In BackgroundLaunchProcessController, there is a possible way to launch arbitrary activity from the background due to BAL Bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.	2024-02-16	not yet calculated	CVE-2024-0034 security@android.com security@android.com
google — android	In onNullBinding of TileLifecycleManager.java, there is a possible way to launch an activity from the background due to a missing null check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.	2024-02-16	not yet calculated	CVE-2024-0035 security@android.com security@android.com
google — android	In startNextMatchingActivity of ActivityTaskManagerService.java, there is a possible way to bypass the restrictions on starting activities from the background due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.	2024-02-16	not yet calculated	CVE-2024-0036 security@android.com security@android.com
google — android	In applyCustomDescription of SaveUi.java, there is a possible way to view images belonging to a different user due to a missing permission check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.	2024-02-16	not yet calculated	CVE-2024-0037 security@android.com security@android.com
google — android	In injectInputEventToInputFilter of AccessibilityManagerService.java, there is a possible arbitrary input event injection due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.	2024-02-16	not yet calculated	CVE-2024-0038 security@android.com security@android.com
google — android	In setParameter of MtpPacket.cpp, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.	2024-02-16	not yet calculated	CVE-2024-0040 security@android.com security@android.com
google — android	In removePersistentDot of SystemStatusAnimationSchedulerImpl.kt, there is a possible race condition due to a logic error in the code. This could lead to local escalation of privilege that fails to remove the persistent dot with no additional execution privileges needed. User interaction is not needed for exploitation.	2024-02-16	not yet calculated	CVE-2024-0041 security@android.com security@android.com
hazelcast — hazelcast_platform	In Hazelcast Platform through 5.3.4, a security issue exists within the SQL mapping for the CSV File Source connector. This issue arises from inadequate permission checking, which could enable unauthorized clients to access data from files stored on a member’s filesystem.	2024-02-16	not yet calculated	CVE-2023-45860 cve@mitre.org cve@mitre.org
honeywell — niagara_framework	Uncontrolled Resource Consumption vulnerability in Honeywell Niagara Framework on Windows, Linux, QNX allows Content Spoofing. This issue affects Niagara Framework: before Niagara AX 3.8.1, before Niagara 4.1.	2024-02-13	not yet calculated	CVE-2024-1309 psirt@honeywell.com psirt@honeywell.com
hp_inc — certain_hp_desktop_pc_products	Potential vulnerabilities have been identified in certain HP Desktop PC products using the HP TamperLock feature, which might allow intrusion detection bypass via a physical attack. HP is releasing firmware and guidance to mitigate these potential vulnerabilities.	2024-02-14	not yet calculated	CVE-2022-48219 hp-security-alert@hp.com
hp_inc — certain_hp_desktop_pc_products	Potential vulnerabilities have been identified in certain HP Desktop PC products using the HP TamperLock feature, which might allow intrusion detection bypass via a physical attack. HP is releasing firmware and guidance to mitigate these potential vulnerabilities.	2024-02-14	not yet calculated	CVE-2022-48220 hp-security-alert@hp.com
hp_inc. — certain_hp_workstation_pcs	A potential security vulnerability has been identified in the system BIOS for certain HP Workstation PCs, which might allow escalation of privilege, arbitrary code execution, or denial of service. HP is releasing mitigation for the potential vulnerability.	2024-02-14	not yet calculated	CVE-2023-6138 hp-security-alert@hp.com
idocview — idocv	An issue in idocv v.14.1.3_20231228 allows a remote attacker to execute arbitrary code and obtain sensitive information via a crafted script.	2024-02-16	not yet calculated	CVE-2024-24377 cve@mitre.org
inprax — izzi_connect	INPRAX “iZZi connect” application on Android contains hard-coded MQTT queue credentials. The same MQTT queue is used by corresponding physical recuperation devices. Exploiting this vulnerability could potentially allow unauthorized access to manage and read parameters of the recuperation unit “reQnet iZZi”.This issue affects “iZZi connect” application versions before 2024010401.	2024-02-15	not yet calculated	CVE-2024-0390 cvd@cert.pl cvd@cert.pl
koha — koha	CSV Injection vulnerability in ‘/members/moremember.pl’ and ‘/admin/aqbudgets.pl’ endpoints in Koha Library Management System version 23.05.05 and earlier allows attackers to to inject DDE commands into csv exports via the ‘Budget’ and ‘Patrons Member’ components.	2024-02-12	not yet calculated	CVE-2024-24337 cve@mitre.org
linux — kernel	dm_table_create in drivers/md/dm-table.c in the Linux kernel through 6.7.4 can attempt to (in alloc_targets) allocate more than INT_MAX bytes, and crash, because of a missing check for struct dm_ioctl.target_count.	2024-02-12	not yet calculated	CVE-2023-52429 cve@mitre.org cve@mitre.org
linux — kernel	printer_write in drivers/usb/gadget/function/f_printer.c in the Linux kernel through 6.7.4 does not properly call usb_ep_queue, which might allow attackers to cause a denial of service or have unspecified other impact.	2024-02-12	not yet calculated	CVE-2024-25741 cve@mitre.org
linux — kernel	In the Linux kernel before 6.6.7, an untrusted VMM can trigger int80 syscall handling at any given point. This is related to arch/x86/coco/tdx/tdx.c and arch/x86/mm/mem_encrypt_amd.c.	2024-02-12	not yet calculated	CVE-2024-25744 cve@mitre.org cve@mitre.org
linux — ubi	create_empty_lvol in drivers/mtd/ubi/vtbl.c in the Linux kernel through 6.7.4 can attempt to allocate zero bytes, and crash, because of a missing check for ubi->leb_size.	2024-02-12	not yet calculated	CVE-2024-25739 cve@mitre.org cve@mitre.org
linux — ubi	A memory leak flaw was found in the UBI driver in drivers/mtd/ubi/attach.c in the Linux kernel through 6.7.4 for UBI_IOCATT, because kobj->name is not released.	2024-02-12	not yet calculated	CVE-2024-25740 cve@mitre.org
mbloch — mbloch/mapshaper	Path Traversal in GitHub repository mbloch/mapshaper prior to 0.6.44.	2024-02-13	not yet calculated	CVE-2024-1163 security@huntr.dev security@huntr.dev
motorola — cx2l	A hidden interface in Motorola CX2L Router firmware v1.0.1 leaks information regarding the SystemWizardStatus component via sending a crafted request to device_web_ip.	2024-02-12	not yet calculated	CVE-2024-25360 cve@mitre.org
mysten_labs — sui blockchain	An issue in mystenlabs Sui Blockchain before v.1.6.3 allow a remote attacker to execute arbitrary code and cause a denial of service via a crafted compressed script to the Sui node component.	2024-02-13	not yet calculated	CVE-2023-42374 cve@mitre.org cve@mitre.org cve@mitre.org
ncurses — ncurses	ncurses 6.4-20230610 has a NULL pointer dereference in tgetstr in tinfo/lib_termcap.c.	2024-02-16	not yet calculated	CVE-2023-45918 cve@mitre.org
qanything — kernel	qanything_kernel/connector/database/mysql/mysql_client.py in qanything.ai QAnything before 1.2.0 allows SQL Injection.	2024-02-11	not yet calculated	CVE-2024-25722 cve@mitre.org cve@mitre.org
raidenmaild — raidenmaild	Insecure Permissions issue in Raiden Professional Server RaidenFTPD v.2.4 build 4005 allows a local attacker to gain privileges and execute arbitrary code via crafted executable running from the installation directory.	2024-02-13	not yet calculated	CVE-2023-38960 cve@mitre.org
react_ative — document_picker	Directory Traversal vulnerability in React Native Document Picker before v.9.1.1 and fixed in v.9.1.1 allows a local attacker to execute arbitrary code via a crafted script to the Android library component.	2024-02-16	not yet calculated	CVE-2024-25466 cve@mitre.org cve@mitre.org
redaxo — redaxo_cms	An issue was discovered in REDAXO version 5.15.1, allows attackers to execute arbitrary code and obtain sensitive information via modules.modules.php.	2024-02-17	not yet calculated	CVE-2024-25298 cve@mitre.org
redaxo — redaxo_cms	A cross-site scripting (XSS) vulnerability in Redaxo v5.15.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter in the Template section.	2024-02-14	not yet calculated	CVE-2024-25300 cve@mitre.org
redaxo — redaxo_cms	Redaxo v5.15.1 was discovered to contain a remote code execution (RCE) vulnerability via the component /pages/templates.php.	2024-02-14	not yet calculated	CVE-2024-25301 cve@mitre.org cve@mitre.org
rhonabwy — rhonabwy	In Rhonabwy through 1.1.13, HMAC signature verification uses a strcmp function that is vulnerable to side-channel attacks, because it stops the comparison when the first difference is spotted in the two signatures. (The fix uses gnutls_memcmp, which has constant-time execution.)	2024-02-11	not yet calculated	CVE-2024-25714 cve@mitre.org
rurban — cpanel::json::xs_perl_package	The Cpanel::JSON::XS package before 4.33 for Perl performs out-of-bounds accesses in a way that allows attackers to obtain sensitive information or cause a denial of service.	2024-02-13	not yet calculated	CVE-2022-48623 cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org
samly — samly	In the Samly package before 1.4.0 for Elixir, Samly.State.Store.get_assertion/3 can return an expired session, which interferes with access control because Samly.AuthHandler uses a cached session and does not replace it, even after expiry.	2024-02-11	not yet calculated	CVE-2024-25718 cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org
sharp_corporation — energy_management_controller_with_cloud_services	Improper authentication vulnerability in Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier allows a network-adjacent unauthenticated attacker to access the affected product without authentication.	2024-02-14	not yet calculated	CVE-2024-23783 vultures@jpcert.or.jp vultures@jpcert.or.jp vultures@jpcert.or.jp
sharp_corporation — energy_management_controller_with_cloud_services	Improper access control vulnerability exists in Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier, which may allow a network-adjacent unauthenticated attacker to obtain a username and its hashed password displayed on the management page of the affected product.	2024-02-14	not yet calculated	CVE-2024-23784 vultures@jpcert.or.jp vultures@jpcert.or.jp vultures@jpcert.or.jp
sharp_corporation — energy_management_controller_with_cloud_services	Cross-site request forgery vulnerability in Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier allows a remote unauthenticated attacker to change the product settings.	2024-02-14	not yet calculated	CVE-2024-23785 vultures@jpcert.or.jp vultures@jpcert.or.jp vultures@jpcert.or.jp
sharp_corporation — energy_management_controller_with_cloud_services	Cross-site scripting vulnerability in Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier allows a network-adjacent unauthenticated attacker to execute an arbitrary script on the web browser of the user who is accessing the management page of the affected product.	2024-02-14	not yet calculated	CVE-2024-23786 vultures@jpcert.or.jp vultures@jpcert.or.jp vultures@jpcert.or.jp
sharp_corporation — energy_management_controller_with_cloud_services	Path traversal vulnerability in Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier allows a network-adjacent unauthenticated attacker to obtain an arbitrary file in the affected product.	2024-02-14	not yet calculated	CVE-2024-23787 vultures@jpcert.or.jp vultures@jpcert.or.jp vultures@jpcert.or.jp
sharp_corporation — energy_management_controller_with_cloud_services	Server-side request forgery vulnerability in Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier allows a network-adjacent unauthenticated attacker to send an arbitrary HTTP request (GET) from the affected product.	2024-02-14	not yet calculated	CVE-2024-23788 vultures@jpcert.or.jp vultures@jpcert.or.jp vultures@jpcert.or.jp
sharp_corporation — energy_management_controller_with_cloud_services	Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier allows a network-adjacent unauthenticated attacker to execute an arbitrary OS command on the affected product.	2024-02-14	not yet calculated	CVE-2024-23789 vultures@jpcert.or.jp vultures@jpcert.or.jp vultures@jpcert.or.jp
smartcalc.es — osticky_component_for_joomla	An Open Redirect vulnerability was found in osTicky2 below 2.2.8. osTicky (osTicket Bridge) by SmartCalc is a Joomla 3.x extension that provides Joomla fronted integration with osTicket, a popular Support ticket system. The Open Redirect vulnerability allows attackers to control the return parameter in the URL to a base64 malicious URL.	2024-02-15	not yet calculated	CVE-2024-21728 security@joomla.org
sourcecodester — barangay_population_monitoring_system	Barangay Population Monitoring System 1.0 was discovered to contain a SQL injection vulnerability via the resident parameter at /endpoint/delete-resident.php.	2024-02-14	not yet calculated	CVE-2024-25209 cve@mitre.org
sourcecodester — online_medicine_ordering_system	Online Medicine Ordering System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /omos/?p=products/view_product.	2024-02-14	not yet calculated	CVE-2024-25217 cve@mitre.org
sourcecodester — school_task_manager	Sourcecodester School Task Manager 1.0 allows SQL Injection via the ‘subject’ parameter.	2024-02-13	not yet calculated	CVE-2024-24142 cve@mitre.org
sourcecodester — simple_expense_tracker	Simple Expense Tracker v1.0 was discovered to contain a SQL injection vulnerability via the expense parameter at /endpoint/delete_expense.php.	2024-02-14	not yet calculated	CVE-2024-25210 cve@mitre.org
sourcecodester — simple_expense_tracker	Simple Expense Tracker v1.0 was discovered to contain a SQL injection vulnerability via the category parameter at /endpoint/delete_category.php.	2024-02-14	not yet calculated	CVE-2024-25211 cve@mitre.org
steve-community — steve	SteVe v3.6.0 was discovered to use predictable transaction ID’s when receiving a StartTransaction request. This vulnerability can allow attackers to cause a Denial of Service (DoS) by using the predicted transaction ID’s to terminate other transactions.	2024-02-13	not yet calculated	CVE-2024-25407 cve@mitre.org
swftools — swftools	A global-buffer-overflow vulnerability was found in SWFTools v0.9.2, in the function LineText at lib/swf5compiler.flex.	2024-02-14	not yet calculated	CVE-2024-25165 cve@mitre.org
teltonika – rut240	Teltonika RUT240 devices with firmware before 07.04.2, when bridge mode is used, sometimes make SSH and HTTP services available on the IPv6 WAN interface even though the UI shows that they are only available on the LAN interface.	2024-02-17	not yet calculated	CVE-2023-31728 cve@mitre.org cve@mitre.org
teltonika — trb1	Teltonika TRB1-series devices with firmware before TRB1_R_00.07.05.2 allow attackers to exploit a firmware vulnerability via Ethernet LAN or USB.	2024-02-17	not yet calculated	CVE-2024-22727 cve@mitre.org
tenda — ac10	Tenda AC10V4.0 V16.03.10.20 was discovered to contain a stack overflow via the page parameter in the sub_49B384 function.	2024-02-15	not yet calculated	CVE-2024-25373 cve@mitre.org
tongda — office_anywhere	Tongda OA v2017 and up to v11.9 was discovered to contain a SQL injection vulnerability via the $AFF_ID parameter at /affair/delete.php.	2024-02-16	not yet calculated	CVE-2024-25320 cve@mitre.org
totoline — x5000r	An issue in TOTOLINK X5000R V.9.1.0u.6369_B20230113 allows a remote attacker to cause a denial of service via the host_time parameter of the NTPSyncWithHost component.	2024-02-17	not yet calculated	CVE-2024-25468 cve@mitre.org
vitalpbx — vitalpbx	An issue in VitalPBX v.3.2.4-5 allows an attacker to execute arbitrary code via a crafted payload to the /var/lib/vitalpbx/scripts folder.	2024-02-15	not yet calculated	CVE-2024-24386 cve@mitre.org cve@mitre.org
wind_river — vxworks	An issue was discovered in Wind River VxWorks 7 22.09 and 23.03. If a VxWorks task or POSIX thread that uses OpenSSL exits, limited per-task memory is not freed, resulting in a memory leak.	2024-02-15	not yet calculated	CVE-2023-51787 cve@mitre.org
wordpress — analytics_insights_for_google_analytics_4_(aiwp)	The Analytics Insights for Google Analytics 4 (AIWP) WordPress plugin before 6.3 is vulnerable to Open Redirect due to insufficient validation on the redirect oauth2callback.php file. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.	2024-02-12	not yet calculated	CVE-2024-0250 contact@wpscan.com
wordpress — mappress_maps_for_wordpress	The MapPress Maps for WordPress plugin before 2.88.15 does not sanitize and escape the map title when outputting it back in the admin dashboard, allowing Contributors and above roles to perform Stored Cross-Site Scripting attacks	2024-02-12	not yet calculated	CVE-2024-0420 contact@wpscan.com
wordpress — mappress_maps_for_wordpress	The MapPress Maps for WordPress plugin before 2.88.16 does not ensure that posts to be retrieve via an AJAX action is a public map, allowing unauthenticated users to read arbitrary private and draft posts.	2024-02-12	not yet calculated	CVE-2024-0421 contact@wpscan.com
wordpress — smart_manager	The Smart Manager WordPress plugin before 8.28.0 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.	2024-02-12	not yet calculated	CVE-2024-0566 contact@wpscan.com
wordpress — wordpress	The Web3 WordPress plugin before 3.0.0 is vulnerable to an authentication bypass due to incorrect authentication checking in the login flow in functions ‘handle_auth_request’ and ‘handle_login_request’. This makes it possible for non-authenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username.	2024-02-12	not yet calculated	CVE-2023-6036 contact@wpscan.com
wordpress — wordpress	The chartjs WordPress plugin through 2023.2 does not sanitize and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).	2024-02-12	not yet calculated	CVE-2023-6081 contact@wpscan.com contact@wpscan.com
wordpress — wordpress	The chartjs WordPress plugin through 2023.2 does not sanitize and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).	2024-02-12	not yet calculated	CVE-2023-6082 contact@wpscan.com contact@wpscan.com
wordpress — wordpress	The Popup Builder WordPress plugin before 4.2.6 does not validate a parameter before making a request to it, which could allow users with the administrator role to perform SSRF attack in Multisite WordPress configurations.	2024-02-12	not yet calculated	CVE-2023-6294 contact@wpscan.com
wordpress — wordpress	The lasTunes WordPress plugin through 3.6.1 does not have CSRF check in some places, and is missing sanitization as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack	2024-02-12	not yet calculated	CVE-2023-6499 contact@wpscan.com
wordpress — wordpress	The Splashscreen WordPress plugin through 0.20 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack	2024-02-12	not yet calculated	CVE-2023-6501 contact@wpscan.com contact@wpscan.com
wordpress — wordpress	The Popup Box WordPress plugin before 20.9.0 does not sanitize and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed	2024-02-12	not yet calculated	CVE-2023-6591 contact@wpscan.com
wordpress — wordpress	The GigPress WordPress plugin through 2.3.29 does not sanitize and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)	2024-02-12	not yet calculated	CVE-2023-7233 contact@wpscan.com
wordpress — wordpress	The EazyDocs WordPress plugin before 2.4.0 re-introduced CVE-2023-6029 (https://wpscan.com/vulnerability/7a0aaf85-8130-4fd7-8f09-f8edc929597e/) in 2.3.8, allowing any authenticated users, such as subscriber to delete arbitrary posts, as well as add and delete documents/sections. The issue was partially fixed in 2.3.9.	2024-02-12	not yet calculated	CVE-2024-0248 contact@wpscan.com
yetiforcecompany — yetiforcecrm	Directory Traversal vulnerability in YetiForceCompany YetiForceCRM versions 6.4.0 and before allows a remote authenticated attacker to obtain sensitive information via the license parameter in the LibraryLicense.php component.	2024-02-16	not yet calculated	CVE-2023-49508 cve@mitre.org cve@mitre.org cve@mitre.org
yonyou — space-time_enterprise_information_integration_platform	SQL Injection vulnerability in Yonyou space-time enterprise information integration platform v.9.0 and before allows an attacker to obtain sensitive information via the gwbhAIM parameter in the saveMove.jsp in the hr_position directory.	2024-02-15	not yet calculated	CVE-2024-24256 cve@mitre.org
zimbra — zimbra_collaboration	In Zimbra Collaboration (ZCS) 8.8.15 and 9.0, a closed account (with 2FA and generated passwords) can send e-mail messages when configured for Imap/smtp.	2024-02-13	not yet calculated	CVE-2023-26562 cve@mitre.org cve@mitre.org cve@mitre.org
zimbra — zimbra_collaboration	An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15, 9.0, and 10.0. Through the help document endpoint in webmail, an attacker can inject JavaScript or HTML code that leads to cross-site scripting (XSS). (Adding an adequate message to avoid malicious code will mitigate this issue.)	2024-02-13	not yet calculated	CVE-2023-45206 cve@mitre.org cve@mitre.org cve@mitre.org
zimbra — zimbra_collaboration	An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15, 9.0, and 10.0. An attacker can send a PDF document through mail that contains malicious JavaScript. While previewing this file in webmail in the Chrome browser, the stored XSS payload is executed. (This has been mitigated by sanitizing the JavaScript code present in a PDF document.)	2024-02-13	not yet calculated	CVE-2023-45207 cve@mitre.org cve@mitre.org cve@mitre.org
zimbra — zimbra_collaboration	An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15, 9.0, and 10.0. XSS, with resultant session stealing, can occur via JavaScript code in a link (for a webmail redirection endpoint) within en email message, e.g., if a victim clicks on that link within Zimbra webmail.	2024-02-13	not yet calculated	CVE-2023-48432 cve@mitre.org cve@mitre.org cve@mitre.org
zimbra — zimbra_collaboration	Zimbra Collaboration before Kepler 9.0.0 Patch 38 GA allows DOM-based JavaScript injection in the Modern UI.	2024-02-13	not yet calculated	CVE-2023-50808 cve@mitre.org cve@mitre.org cve@mitre.org