Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
908 results · page 10 of 19
Oct 30, 2023An issue in the component SuperUserSetuserModuleFrontController:init() of idnovate superuser before v2.4.2 allows attackers to bypass authentication via a craftCVE-2023-45899 · Other software · Idnovate · reported by MITREHigh 7.5
An issue in the component SuperUserSetuserModuleFrontController:init() of idnovate superuser before v2.4.2 allows attackers to bypass authentication via a crafted HTTP call.
- Product
- Superuser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.friendsofpresta.orgsecurity.friendsofpresta.org
Oct 29, 2023/api/v1/company/upload-logo in CompanyController.php in crater through 6.0.6 allows a superadmin to execute arbitrary PHP code by placing this code into an imagCVE-2023-46865 · Other software · Craterapp · reported by MITREHigh 7.2
/api/v1/company/upload-logo in CompanyController.php in crater through 6.0.6 allows a superadmin to execute arbitrary PHP code by placing this code into an image/png IDAT chunk of a Company Logo image.
- Product
- Crater
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2023An issue was discovered in SuperWebMailer 9.00.0.01710.CVE-2023-38194 · Other software · Superwebmailer · reported by MITREMedium 6.1
An issue was discovered in SuperWebMailer 9.00.0.01710. It allows keepalive.php XSS via a GET parameter.
- Product
- Superwebmailer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordherolab.usd.deherolab.usd.de
Oct 20, 2023An issue was discovered in SuperWebMailer 9.00.0.01710.CVE-2023-38193 · Other software · Superwebmailer · reported by MITREHigh 8.8
An issue was discovered in SuperWebMailer 9.00.0.01710. It allows Remote Code Execution via a crafted sendmail command line.
- Product
- Superwebmailer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordherolab.usd.deherolab.usd.de
Oct 20, 2023An issue was discovered in SuperWebMailer 9.00.0.01710.CVE-2023-38192 · Other software · Superwebmailer · reported by MITREMedium 6.1
An issue was discovered in SuperWebMailer 9.00.0.01710. It allows superadmincreate.php XSS via crafted incorrect passwords.
- Product
- Superwebmailer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordherolab.usd.deherolab.usd.de
Oct 20, 2023An issue was discovered in SuperWebMailer 9.00.0.01710.CVE-2023-38190 · Other software · Superwebmailer · reported by MITREHigh 8.8
An issue was discovered in SuperWebMailer 9.00.0.01710. It allows Export SQL Injection via the size parameter.
- Product
- Superwebmailer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordherolab.usd.deherolab.usd.de
Oct 20, 2023An issue was discovered in SuperWebMailer 9.00.0.01710.CVE-2023-38191 · Other software · Superwebmailer · reported by MITREMedium 6.1
An issue was discovered in SuperWebMailer 9.00.0.01710. It allows spamtest_external.php XSS via a crafted filename.
- Product
- Superwebmailer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordherolab.usd.deherolab.usd.de
Oct 20, 2023Super Testimonials: Stored Cross-Site ScriptingCVE-2023-5613 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Super Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tpsscode' shortcode in all versions up to, and including, 2.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Super Testimonials
- Affected
- up to 2.9
- What to do
- Affects up to 2.9. Update Super Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 19, 2023KnowBand supercheckout > 5.0.7 and < 6.0.7 is vulnerable to Unrestricted Upload of File with Dangerous Type.CVE-2023-45384 · Other software · knownband · reported by MITRECritical 9.8
KnowBand supercheckout > 5.0.7 and < 6.0.7 is vulnerable to Unrestricted Upload of File with Dangerous Type. In the module "Module One Page Checkout, Social Login & Mailchimp" (supercheckout), a guest can upload files with extensions .php
- Product
- supercheckout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaddons.prestashop.comsecurity.friendsofpresta.org
Oct 18, 2023The Apollo Router is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation.CVE-2023-45812 · Other software · apollographql · reported by GitHubHigh 7.5
The Apollo Router is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation. Affected versions are subject to a Denial-of-Service (DoS) type vulnerability which causes the Router to panic and terminate when a multi-part response is sent. When users send queries to the router that uses the `@defer` or Subscriptions, the Router will panic. To be vulnerable, users of Router must have a coprocessor with `coprocessor.supergraph.response` configured in their `router.yaml` and also to support either `@defer` or Subscriptions. Apollo Router version 1.33.0 has a fix for this vulnerability which was introduced in PR #4014. Users are advised to upgrade. Users unable to upgrade should avoid using the coprocessor supergraph response or disable defer and subscriptions support and continue to use the coprocessor supergraph response.
- Product
- router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2023SQL injection vulnerability in KnowBand Module One Page Checkout, Social Login & Mailchimp (supercheckout) v.8.0.3 and before allows a remote attacker to executCVE-2023-44024 · Other software · Knowband · reported by MITRECritical 9.8
SQL injection vulnerability in KnowBand Module One Page Checkout, Social Login & Mailchimp (supercheckout) v.8.0.3 and before allows a remote attacker to execute arbitrary code via a crafted request to the updateCheckoutBehaviour function in the supercheckout.php component.
- Product
- ONE Page Checkout, Social Login & Mailchimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.friendsofpresta.orgsecurity.friendsofpresta.org
Oct 2, 2023Super Store Finder 3.7 and below is vulnerable to authenticated Arbitrary PHP Code Injection that could lead to Remote Code Execution when settings overwrite coCVE-2023-43835 · Other software · Superstorefinder · reported by MITREHigh 8.8
Super Store Finder 3.7 and below is vulnerable to authenticated Arbitrary PHP Code Injection that could lead to Remote Code Execution when settings overwrite config.inc.php content.
- Product
- Super Store Finder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Sep 27, 2023Super Store Finder v3.6 and below was discovered to contain a SQL injection vulnerability via the Search parameter at /admin/stores.php.CVE-2023-44044 · Other software · Superstorefinder · reported by MITREHigh 7.2
Super Store Finder v3.6 and below was discovered to contain a SQL injection vulnerability via the Search parameter at /admin/stores.php.
- Product
- Super Store Finder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2023The DP module has a service hijacking vulnerability.Successful exploitation of this vulnerability may affect some Super Device services.CVE-2023-41294 · Other software · Huawei · reported by psirt@huawei.comCritical 9.8
The DP module has a service hijacking vulnerability.Successful exploitation of this vulnerability may affect some Super Device services.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevice.harmonyos.comdevice.harmonyos.com
Sep 19, 2023A Allocation of Resources Without Limits or Throttling vulnerability in SUSE RKE2 allows attackers with access to K3s servers apiserver/supervisor port (TCP 64CVE-2023-32186 · Other software · SUSE · reported by meissner@suse.deHigh 7.5
A Allocation of Resources Without Limits or Throttling vulnerability in SUSE RKE2 allows attackers with access to K3s servers apiserver/supervisor port (TCP 6443) cause denial of service. This issue affects RKE2: from 1.24.0 before 1.24.17+rke2r1, from v1.25.0 before v1.25.13+rke2r1, from v1.26.0 before v1.26.8+rke2r1, from v1.27.0 before v1.27.5+rke2r1, from v1.28.0 before v1.28.1+rke2r1.
- Product
- RKE2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.suse.comgithub.com
Sep 19, 2023Super Store Finder: Unauthenticated arbitrary email creation and relayCVE-2023-5054 · WordPress plugins & themes · reported by WordfenceMedium 5.8
The Super Store Finder plugin for WordPress is vulnerable to unauthenticated arbitrary email creation and relay in versions up to, and including, 6.9.3. This is due to insufficient restrictions on the sendMail.php file that allows direct access. This makes it possible for unauthenticated attackers to send emails utilizing the vulnerable site's server, with arbitrary content. Please note that this vulnerability has already been publicly disclosed with an exploit which is why we are publishing the details without a patch available, we are attempting to initiate contact with the developer.
- Product
- Super Store Finder
- Affected
- up to 6.9.3
- What to do
- Affects up to 6.9.3. Update Super Store Finder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordsuperstorefinder.netsuperstorefinder.net
Sep 18, 2023An Allocation of Resources Without Limits or Throttling vulnerability in SUSE k3s allows attackers with access to K3s servers' apiserver/supervisor port (TCP 64CVE-2023-32187 · Other software · SUSE · reported by meissner@suse.deHigh 7.5
An Allocation of Resources Without Limits or Throttling vulnerability in SUSE k3s allows attackers with access to K3s servers' apiserver/supervisor port (TCP 6443) cause denial of service. This issue affects k3s: from v1.24.0 before v1.24.17+k3s1, from v1.25.0 before v1.25.13+k3s1, from v1.26.0 before v1.26.8+k3s1, from sev1.27.0 before v1.27.5+k3s1, from v1.28.0 before v1.28.1+k3s1.
- Product
- k3s
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.suse.comgithub.com
Sep 14, 2023SQL injection vulnerability in Super Store Finder PHP Script v.3.6 allows a remote attacker to execute arbitrary code via a crafted payload to the username paraCVE-2023-38912 · Other software · Superstorefinder · reported by MITRECritical 9.8
SQL injection vulnerability in Super Store Finder PHP Script v.3.6 allows a remote attacker to execute arbitrary code via a crafted payload to the username parameter.
- Product
- PHP Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodecanyon.netpacketstormsecurity.com
Sep 6, 2023SearchBlox before Version 9.1 is vulnerable to business logic bypass where the user is able to create multiple super admin users in the system.CVE-2020-10130 · Other software · SearchBlox · reported by cret@cert.orgHigh 8.8
SearchBlox before Version 9.1 is vulnerable to business logic bypass where the user is able to create multiple super admin users in the system.
- Product
- SearchBlox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.searchblox.comdeveloper.searchblox.com
Sep 6, 2023Apache Superset would allow for SQLite database connections to be incorrectly registered when an attacker uses alternative driver names like sqlite+pysqlite or CVE-2023-39265 · Websites & servers · Apache Software Foundation · reported by security@apache.orgLow 3.8
Apache Superset would allow for SQLite database connections to be incorrectly registered when an attacker uses alternative driver names like sqlite+pysqlite or by using database imports. This could allow for unexpected file creation on Superset webservers. Additionally, if Apache Superset is using a SQLite database for its metadata (not advised for production use) it could result in more severe vulnerabilities related to confidentiality and integrity. This vulnerability exists in Apache Superset versions up to and including 2.1.0.
- Product
- Apache Superset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comlists.apache.org
Sep 6, 2023If an attacker gains write access to the Apache Superset metadata database, they could persist a specifically crafted Python object that may lead to remote codeCVE-2023-37941 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.6
If an attacker gains write access to the Apache Superset metadata database, they could persist a specifically crafted Python object that may lead to remote code execution on Superset's web backend. The Superset metadata db is an 'internal' component that is typically only accessible directly by the system administrator and the superset process itself. Gaining access to that database should be difficult and require significant privileges. This vulnerability impacts Apache Superset versions 1.5.0 up to and including 2.1.0. Users are recommended to upgrade to version 2.1.1 or later.
- Product
- Apache Superset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comlists.apache.org
Sep 6, 2023An Incorrect authorisation check in SQLLab in Apache Superset versions up to and including 2.1.0.CVE-2023-32672 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 4.3
An Incorrect authorisation check in SQLLab in Apache Superset versions up to and including 2.1.0. This vulnerability allows an authenticated user to query tables that they do not have proper access to within Superset. The vulnerability can be exploited by leveraging a SQL parsing vulnerability.
- Product
- Apache Superset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
Sep 6, 2023By default, stack traces for errors were enabled, which resulted in the exposure of internal traces on REST API endpoints to users.CVE-2023-39264 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 4.3
By default, stack traces for errors were enabled, which resulted in the exposure of internal traces on REST API endpoints to users. This vulnerability exists in Apache Superset versions up to and including 2.1.0.
- Product
- Apache Superset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
Sep 6, 2023Improper REST API permission in Apache Superset up to and including 2.1.0 allows for an authenticated Gamma users to test network connections, possible SSRF.CVE-2023-36388 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 4.3
Improper REST API permission in Apache Superset up to and including 2.1.0 allows for an authenticated Gamma users to test network connections, possible SSRF.
- Product
- Apache Superset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
Sep 6, 2023An improper default REST API permission for Gamma users in Apache Superset up to and including 2.1.0 allows for an authenticated Gamma user to test database conCVE-2023-36387 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.4
An improper default REST API permission for Gamma users in Apache Superset up to and including 2.1.0 allows for an authenticated Gamma user to test database connections.
- Product
- Apache Superset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.apache.org
Sep 6, 2023A non Admin authenticated user could incorrectly create resources using the import charts feature, on Apache Superset up to and including 2.1.0.CVE-2023-27526 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 4.3
A non Admin authenticated user could incorrectly create resources using the import charts feature, on Apache Superset up to and including 2.1.0.
- Product
- Apache Superset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
Sep 6, 2023Improper data authorization check on Jinja templated queries in Apache Superset up to and including 2.1.0 allows for an authenticated user to issue queries on dCVE-2023-27523 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5
Improper data authorization check on Jinja templated queries in Apache Superset up to and including 2.1.0 allows for an authenticated user to issue queries on database tables they may not have access to.
- Product
- Apache Superset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
Sep 5, 2023Super Store Finder v3.6 was discovered to contain multiple SQL injection vulnerabilities in the store locator component via the products, distance, lat, and lngCVE-2023-41507 · Other software · Superstorefinder · reported by MITRECritical 9.8
Super Store Finder v3.6 was discovered to contain multiple SQL injection vulnerabilities in the store locator component via the products, distance, lat, and lng parameters.
- Product
- Super Store Finder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsuperstorefinder.net
Sep 5, 2023A hard coded password in Super Store Finder v3.6 allows attackers to access the administration panel.CVE-2023-41508 · Other software · Superstorefinder · reported by MITRECritical 9.8
A hard coded password in Super Store Finder v3.6 allows attackers to access the administration panel.
- Product
- Super Store Finder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsuperstorefinder.net
Sep 5, 2023The Apollo Router is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2.CVE-2023-41317 · Other software · apollographql · reported by GitHubHigh 7.5
The Apollo Router is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. Affected versions are subject to a Denial-of-Service (DoS) type vulnerability which causes the Router to panic and terminate when GraphQL Subscriptions are enabled. It can be triggered when **all of the following conditions are met**: 1. Running Apollo Router v1.28.0, v1.28.1 or v1.29.0 ("impacted versions"); **and** 2. The Supergraph schema provided to the Router (either via Apollo Uplink or explicitly via other configuration) **has a `subscription` type** with root-fields defined; **and** 3. The YAML configuration provided to the Router **has subscriptions enabled** (they are _disabled_ by default), either by setting `enabled: true` _or_ by setting a valid `mode` within the `subscriptions` object (as seen in [subscriptions' documentation](https://www.apollographql.com/docs/router/executing-operations/subscription-support/#router-setup)); **and** 4. An [anonymous](https://spec.graphql.org/draft/#sec-Anonymous-Operation-Definitions) (i.e., un-named) `subscription` operation (e.g., `subscription { ... }`) is received by the Router If **all
- Product
- router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2023Buffer Overflow vulnerability in Supermicro motherboard X12DPG-QR 1.4b allows local attackers to hijack control flow via manipulation of SmcSecurityEraseSetupVaCVE-2023-34853 · Other software · supermicro · reported by MITREHigh 7.8
Buffer Overflow vulnerability in Supermicro motherboard X12DPG-QR 1.4b allows local attackers to hijack control flow via manipulation of SmcSecurityEraseSetupVar variable.
- Product
- x12dpg-qr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupermicro.comsupermicro.com
Aug 11, 2023An issue was discovered in pcmt superMicro-CMS version 3.11, allows authenticated attackers to execute arbitrary code via the font_type parameter to setup.php.CVE-2021-25857 · Other software · Supermicro-cms Project · reported by MITREHigh 7.2
An issue was discovered in pcmt superMicro-CMS version 3.11, allows authenticated attackers to execute arbitrary code via the font_type parameter to setup.php.
- Product
- Supermicro-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2023An issue was discovered in pcmt superMicro-CMS version 3.11, allows attackers to delete files via crafted image file in images.php.CVE-2021-25856 · Other software · Supermicro-cms Project · reported by MITREMedium 4.9
An issue was discovered in pcmt superMicro-CMS version 3.11, allows attackers to delete files via crafted image file in images.php.
- Product
- Supermicro-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2023A shell-injection vulnerability in email notifications on Supermicro motherboards (such as H12DST-B before 03.10.35) allows remote attackers to inject execute aCVE-2023-35861 · Other software · supermicro · reported by MITRECritical 9.8
A shell-injection vulnerability in email notifications on Supermicro motherboards (such as H12DST-B before 03.10.35) allows remote attackers to inject execute arbitrary commands as root on the BMC.
- Product
- h12dst-b
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.freax13.desupermicro.com
Jul 20, 2023A vulnerability, which was classified as problematic, has been found in ActiveITzone Active Super Shop CMS 2.5.CVE-2023-3788 · Other software · ActiveITzone · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in ActiveITzone Active Super Shop CMS 2.5. This issue affects some unknown processing of the component Manage Details Page. The manipulation of the argument name/phone/address leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-235055.
- Product
- Active Super Shop CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2023A vulnerability was found in Super Store Finder 3.6.CVE-2023-3751 · Other software · Superstorefinder · reported by VulDBMedium 6.3
A vulnerability was found in Super Store Finder 3.6. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /index.php of the component POST Parameter Handler. The manipulation of the argument products leads to sql injection. The attack can be launched remotely. The identifier VDB-234421 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Super Store Finder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2023A CSV injection vulnerability was found in the Avaya Call Management System (CMS) Supervisor web application which allows a user with administrative privileges CVE-2023-3527 · Other software · Avaya · reported by securityalerts@avaya.comMedium 6.8
A CSV injection vulnerability was found in the Avaya Call Management System (CMS) Supervisor web application which allows a user with administrative privileges to input crafted data which, when exported to a CSV file, may attempt arbitrary command execution on the system used to open the file by a spreadsheet software such as Microsoft Excel.
- Product
- Avaya Call Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.avaya.comdownload.avaya.com
May 31, 2023A use after free flaw was found in hfsplus_put_super in fs/hfsplus/super.c in the Linux Kernel.CVE-2023-2985 · Computers, phones & browsers · Linux · reported by Red HatMedium 5.5
A use after free flaw was found in hfsplus_put_super in fs/hfsplus/super.c in the Linux Kernel. This flaw could allow a local user to cause a denial of service problem.
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
May 22, 2023 In Snap One OvrC Pro versions prior to 7.2, when logged into the superuser account, a new functionality appears that could alloCVE-2023-25183 · Other software · Snap One · reported by ics-cert@hq.dhs.govHigh 8.3
In Snap One OvrC Pro versions prior to 7.2, when logged into the superuser account, a new functionality appears that could allow users to execute arbitrary commands on the hub device.
- Product
- OvrC Cloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2023An authenticated user with specific data permissions could access database connections stored passwords by requesting a specific REST API.CVE-2023-30776 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 4.9
An authenticated user with specific data permissions could access database connections stored passwords by requesting a specific REST API. This issue affects Apache Superset version 1.3.0 up to 2.0.1.
- Product
- Apache Superset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comlists.apache.org
Apr 24, 2023Apache Superset Insecure Default Initialization of Resource VulnerabilityCVE-2023-27524 · Websites & servers · Apache · reported by security@apache.orgExploitedHigh 8.9
Apache Superset contains an insecure default initialization of a resource vulnerability that allows an attacker to authenticate and access unauthorized resources on installations that have not altered the default configured SECRET_KEY according to installation instructions.
- Product
- Superset
- On CISA’s list since
- Jan 8, 2024 (federal fix deadline Jan 29, 2024)
- What to do
- Attackers are using this now. Install Apache’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA cataloglists.apache.orgpacketstormsecurity.com
Apr 20, 2023An issue found in Ego Studio SuperClean v.1.1.9 and v.1.1.5 allows an attacker to gain privileges cause a denial of service via the update_info field of the _deCVE-2023-27652 · Other software · Egostudiogroup · reported by MITREMedium 5.5
An issue found in Ego Studio SuperClean v.1.1.9 and v.1.1.5 allows an attacker to gain privileges cause a denial of service via the update_info field of the _default_.xml file.
- Product
- Super Clean
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordegostudiogroup.comapkpure.com
Apr 17, 2023An authenticated user with Gamma role authorization could have access to metadata information using non trivial methods in Apache Superset up to and including 2CVE-2023-27525 · Websites & servers · Apache Software Foundation · reported by security@apache.orgLow 3.1
An authenticated user with Gamma role authorization could have access to metadata information using non trivial methods in Apache Superset up to and including 2.0.1
- Product
- Apache Superset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
Apr 17, 2023A malicious actor who has been authenticated and granted specific permissions in Apache Superset may use the import dataset feature in order to conduct Server-SCVE-2023-25504 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 4.9
A malicious actor who has been authenticated and granted specific permissions in Apache Superset may use the import dataset feature in order to conduct Server-Side Request Forgery attacks and query internal resources on behalf of the server where Superset is deployed. This vulnerability exists in Apache Superset versions up to and including 2.0.1.
- Product
- Apache Superset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comlists.apache.org
Apr 14, 2023An issue found in DUALSPACE Lock Master v.2.2.4 allows a local attacker to cause a denial of service or gain sensitive information via the com.ludashi.superlockCVE-2023-27647 · Other software · Dualspace · reported by MITREHigh 7.1
An issue found in DUALSPACE Lock Master v.2.2.4 allows a local attacker to cause a denial of service or gain sensitive information via the com.ludashi.superlock.util.pref.SharedPrefProviderEntryMethod: insert of the android.net.Uri.insert method.
- Product
- Lock Master
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddualspace.comapp-lock-master.en.uptodown.com
Apr 14, 2023An issue found in Ego Studio SuperClean v.1.1.9 and v.1.1.5 allows an attacker to gain privileges via the update_info field of the _default_.xml file.CVE-2023-27651 · Other software · Egostudiogroup · reported by MITREHigh 7.8
An issue found in Ego Studio SuperClean v.1.1.9 and v.1.1.5 allows an attacker to gain privileges via the update_info field of the _default_.xml file.
- Product
- Super Clean
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordegostudiogroup.comapkpure.com
Apr 14, 2023An issue found in DUALSPACE v.1.1.3 allows a local attacker to gain privileges via the key_ad_new_user_avoid_time field.CVE-2023-27193 · Other software · Dualspace · reported by MITREHigh 7.8
An issue found in DUALSPACE v.1.1.3 allows a local attacker to gain privileges via the key_ad_new_user_avoid_time field.
- Product
- Space Clean & Super Cleaner
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddualspace.comapkpure.com
Apr 13, 2023On affected modular platforms running Arista EOS equipped with both redundant supervisor modules and having the redundancy protocol configured with RPR or SSO, CVE-2023-24509 · Other software · Arista Networks · reported by psirt@arista.comCritical 9.3
On affected modular platforms running Arista EOS equipped with both redundant supervisor modules and having the redundancy protocol configured with RPR or SSO, an existing unprivileged user can login to the standby supervisor as a root user, leading to a privilege escalation. Valid user credentials are required in order to exploit this vulnerability.
- Product
- Arista EOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 11, 2023An issue found in DUALSPACE Super Secuirty v.2.3.7 allows an attacker to cause a denial of service via the key_wifi_safe_net_check_url, KEY_Cirus_scan_whitelistCVE-2023-27192 · Other software · Dualspace · reported by MITRECritical 9.8
An issue found in DUALSPACE Super Secuirty v.2.3.7 allows an attacker to cause a denial of service via the key_wifi_safe_net_check_url, KEY_Cirus_scan_whitelist and KEY_AD_NEW_USER_AVOID_TIME parameters.
- Product
- Super Security
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddualspace.comapkpure.com
Apr 10, 2023An issue found in DUALSPACE Super Secuirty v.2.3.7 allows an attacker to cause a denial of service via the SharedPreference files.CVE-2023-27191 · Other software · Dualspace · reported by MITREHigh 7.5
An issue found in DUALSPACE Super Secuirty v.2.3.7 allows an attacker to cause a denial of service via the SharedPreference files.
- Product
- Super Security
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddualspace.comapkpure.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.