Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
900 results · page 11 of 18
Nov 28, 2022Insecure permissions in Chocolatey Ruby package v3.1.2.1 and below grants all users in the Authenticated Users group write privileges for the path C:\tools\rubyCVE-2022-45301 · Other software · Chocolatey · reported by MITREMedium 4.3
Insecure permissions in Chocolatey Ruby package v3.1.2.1 and below grants all users in the Authenticated Users group write privileges for the path C:\tools\ruby31 and all files located in that folder.
- Product
- Chocolatey Ruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2022A CWE-191: Integer Underflow (Wrap or Wraparound) vulnerability exists that could cause a denial of service of the controller due to memory access violations whCVE-2022-37301 · Other software · Schneider Electric · reported by cybersecurity@se.comHigh 7.5
A CWE-191: Integer Underflow (Wrap or Wraparound) vulnerability exists that could cause a denial of service of the controller due to memory access violations when using the Modbus TCP protocol. Affected products: Modicon M340 CPU (part numbers BMXP34*)(V3.40 and prior), Modicon M580 CPU (part numbers BMEP* and BMEH*)(V3.22 and prior), Legacy Modicon Quantum/Premium(All Versions), Modicon Momentum MDI (171CBU*)(All Versions), Modicon MC80 (BMKC80)(V1.7 and prior)
- Product
- Modicon M340 CPU (part numbers BMXP34*)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2022Jenkins Violations Plugin 0.7.11 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.CVE-2022-45386 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.5
Jenkins Violations Plugin 0.7.11 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
- Product
- Jenkins Violations Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Nov 15, 2022Jenkins Pipeline Utility Steps Plugin 2.13.1 and earlier does not restrict the set of enabled prefix interpolators and bundles versions of Apache Commons ConfigCVE-2022-45381 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comHigh 8.1
Jenkins Pipeline Utility Steps Plugin 2.13.1 and earlier does not restrict the set of enabled prefix interpolators and bundles versions of Apache Commons Configuration library that enable the 'file:' prefix interpolator by default, allowing attackers able to configure Pipelines to read arbitrary files from the Jenkins controller file system.
- Product
- Jenkins Pipeline Utility Steps Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Nov 9, 2022Microsoft Windows CNG Key Isolation Service Privilege Escalation VulnerabilityCVE-2022-41125 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Cryptographic Next Generation (CNG) Key Isolation Service contains an unspecified vulnerability that allows an attacker to gain SYSTEM-level privileges.
- Product
- Windows
- On CISA’s list since
- Nov 8, 2022 (federal fix deadline Dec 9, 2022)
- What to do
- Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogmsrc.microsoft.commsrc.microsoft.com
Nov 2, 2022Libde265 v1.0.8 was discovered to contain a segmentation violation via apply_sao_internal<unsigned short> in sao.cc.CVE-2022-43245 · Other software · Struktur · reported by MITREMedium 6.5
Libde265 v1.0.8 was discovered to contain a segmentation violation via apply_sao_internal<unsigned short> in sao.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video file.
- Product
- Libde265
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Oct 28, 2022Nginx NJS v0.7.4 was discovered to contain a segmentation violation in njs_promise_reaction_job.CVE-2022-43285 · Network & remote access · F5 · reported by MITREHigh 7.5
Nginx NJS v0.7.4 was discovered to contain a segmentation violation in njs_promise_reaction_job. NOTE: the vendor disputes the significance of this report because NJS does not operate on untrusted input.
- Product
- NJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2022Nginx NJS v0.7.2 to v0.7.4 was discovered to contain a segmentation violation via njs_scope_valid_value at njs_scope.h.CVE-2022-43284 · Network & remote access · F5 · reported by MITREHigh 7.5
Nginx NJS v0.7.2 to v0.7.4 was discovered to contain a segmentation violation via njs_scope_valid_value at njs_scope.h. NOTE: the vendor disputes the significance of this report because NJS does not operate on untrusted input.
- Product
- NJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2022A malicious crafted dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by read access violation.CVE-2022-42944 · Other software · Autodesk · reported by psirt@autodesk.comHigh 7.8
A malicious crafted dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by read access violation. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
- Product
- Autocad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordautodesk.comautodesk.com
Oct 21, 2022A malicious crafted dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by read access violation.CVE-2022-42943 · Other software · Autodesk · reported by psirt@autodesk.comHigh 7.8
A malicious crafted dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by read access violation. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
- Product
- Autocad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordautodesk.comautodesk.com
Oct 21, 2022A malicious crafted dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by read access violation.CVE-2022-42942 · Other software · Autodesk · reported by psirt@autodesk.comHigh 7.8
A malicious crafted dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by read access violation. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
- Product
- Autocad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordautodesk.comautodesk.com
Oct 21, 2022A malicious crafted dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by read access violation.CVE-2022-42941 · Other software · Autodesk · reported by psirt@autodesk.comHigh 7.8
A malicious crafted dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by read access violation. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
- Product
- Autocad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordautodesk.comautodesk.com
Oct 21, 2022A malicious crafted .dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by write access violationCVE-2022-42937 · Other software · Autodesk · reported by psirt@autodesk.comHigh 7.8
A malicious crafted .dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by write access violation. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
- Product
- Autocad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordautodesk.comautodesk.com
Oct 21, 2022A malicious crafted .dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by write access violationCVE-2022-42936 · Other software · Autodesk · reported by psirt@autodesk.comHigh 7.8
A malicious crafted .dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by write access violation. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
- Product
- Autocad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordautodesk.comautodesk.com
Oct 21, 2022A malicious crafted .dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by write access violationCVE-2022-42935 · Other software · Autodesk · reported by psirt@autodesk.comHigh 7.8
A malicious crafted .dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by write access violation. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
- Product
- Autocad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordautodesk.comautodesk.com
Oct 21, 2022A malicious crafted .dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by write access violationCVE-2022-42934 · Other software · Autodesk · reported by psirt@autodesk.comHigh 7.8
A malicious crafted .dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by write access violation. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
- Product
- Autocad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordautodesk.comautodesk.com
Oct 21, 2022A malicious crafted .dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by write access violationCVE-2022-42933 · Other software · Autodesk · reported by psirt@autodesk.comHigh 7.8
A malicious crafted .dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by write access violation. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
- Product
- Autocad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordautodesk.comautodesk.com
Oct 21, 2022A malicious crafted .dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by write access violationCVE-2022-41310 · Other software · Autodesk · reported by psirt@autodesk.comHigh 7.8
A malicious crafted .dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by write access violation. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
- Product
- Autocad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordautodesk.comautodesk.com
Oct 21, 2022A malicious crafted .dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by write access violationCVE-2022-41309 · Other software · Autodesk · reported by psirt@autodesk.comHigh 7.8
A malicious crafted .dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by write access violation. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
- Product
- Autocad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordautodesk.comautodesk.com
Oct 19, 2022GPAC 2.1-DEV-rev368-gfd054169b-master was discovered to contain a segmentation violation via the function gf_dump_vrml_sffield at /scene_manager/scene_dump.c.CVE-2022-43045 · Other software · Gpac · reported by MITREMedium 5.5
GPAC 2.1-DEV-rev368-gfd054169b-master was discovered to contain a segmentation violation via the function gf_dump_vrml_sffield at /scene_manager/scene_dump.c.
- Product
- Gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2022GPAC 2.1-DEV-rev368-gfd054169b-master was discovered to contain a segmentation violation via the function gf_isom_get_meta_item_info at /isomedia/meta.c.CVE-2022-43044 · Other software · Gpac · reported by MITREMedium 5.5
GPAC 2.1-DEV-rev368-gfd054169b-master was discovered to contain a segmentation violation via the function gf_isom_get_meta_item_info at /isomedia/meta.c.
- Product
- Gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2022GPAC 2.1-DEV-rev368-gfd054169b-master was discovered to contain a segmentation violation via the function BD_CheckSFTimeOffset at /bifs/field_decode.c.CVE-2022-43043 · Other software · Gpac · reported by MITREMedium 5.5
GPAC 2.1-DEV-rev368-gfd054169b-master was discovered to contain a segmentation violation via the function BD_CheckSFTimeOffset at /bifs/field_decode.c.
- Product
- Gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2022GPAC 2.1-DEV-rev368-gfd054169b-master was discovered to contain a segmentation violation via the function gf_isom_meta_restore_items_ref at /isomedia/meta.c.CVE-2022-43039 · Other software · Gpac · reported by MITREMedium 5.5
GPAC 2.1-DEV-rev368-gfd054169b-master was discovered to contain a segmentation violation via the function gf_isom_meta_restore_items_ref at /isomedia/meta.c.
- Product
- Gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2022A maliciously crafted PKT file when consumed through SubassemblyComposer.exe application could lead to memory corruption vulnerability by read access violation.CVE-2022-41308 · Other software · Autodesk · reported by psirt@autodesk.comHigh 7.8
A maliciously crafted PKT file when consumed through SubassemblyComposer.exe application could lead to memory corruption vulnerability by read access violation. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
- Product
- Subassembly Composer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordautodesk.comautodesk.com
Oct 14, 2022A maliciously crafted PKT file when consumed through SubassemblyComposer.exe application could lead to memory corruption vulnerability by read access violation.CVE-2022-41307 · Other software · Autodesk · reported by psirt@autodesk.comHigh 7.8
A maliciously crafted PKT file when consumed through SubassemblyComposer.exe application could lead to memory corruption vulnerability by read access violation. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
- Product
- Subassembly Composer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordautodesk.comautodesk.com
Oct 14, 2022A maliciously crafted PCT file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by write access violation.CVE-2022-41306 · Other software · Autodesk · reported by psirt@autodesk.comHigh 7.8
A maliciously crafted PCT file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by write access violation. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
- Product
- Design Review
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordautodesk.comautodesk.com
Oct 14, 2022A maliciously crafted PKT file when consumed through SubassemblyComposer.exe application could lead to memory corruption vulnerability by write access violationCVE-2022-41305 · Other software · Autodesk · reported by psirt@autodesk.comHigh 7.8
A maliciously crafted PKT file when consumed through SubassemblyComposer.exe application could lead to memory corruption vulnerability by write access violation. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
- Product
- Subassembly Composer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordautodesk.comautodesk.com
Oct 14, 2022A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the url variabCVE-2022-37603 · Other software · Webpack.js · reported by MITREHigh 7.5
A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the url variable in interpolateName.js.
- Product
- Loader-utils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2022Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded.CVE-2022-42889 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.text.lookup.StringLookup that performs the interpolation. Starting with version 1.5 and continuing through 1.9, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - "script" - execute expressions using the JVM script execution engine (javax.script) - "dns" - resolve dns records - "url" - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons Text 1.10.0, which disables the problematic interpolators by default.
- Product
- Apache Commons Text
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Oct 11, 2022A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the resourcePaCVE-2022-37599 · Other software · Webpack.js · reported by MITREHigh 7.5
A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the resourcePath variable in interpolateName.js.
- Product
- Loader-utils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2022A maliciously crafted PKT file when consumed through SubassemblyComposer.exe application could lead to memory corruption vulnerability by read access violation.CVE-2022-41301 · Other software · Autodesk · reported by psirt@autodesk.comHigh 7.8
A maliciously crafted PKT file when consumed through SubassemblyComposer.exe application could lead to memory corruption vulnerability by read access violation. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
- Product
- Subassembly Composer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordautodesk.comautodesk.com
Oct 3, 2022A maliciously crafted PCT or DWF file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by read access violation.CVE-2022-33890 · Other software · Autodesk · reported by psirt@autodesk.comHigh 7.8
A maliciously crafted PCT or DWF file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by read access violation. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
- Product
- Autocad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordautodesk.comautodesk.com
Oct 3, 2022A malicious crafted Dwg2Spd file when processed through Autodesk DWG application could lead to memory corruption vulnerability by write access violation.CVE-2022-33888 · Other software · Autodesk · reported by psirt@autodesk.comHigh 7.8
A malicious crafted Dwg2Spd file when processed through Autodesk DWG application could lead to memory corruption vulnerability by write access violation. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
- Product
- Autocad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordautodesk.comautodesk.com
Oct 3, 2022Bento4 v1.6.0-639 was discovered to contain a segmentation violation via the AP4_Processor::ProcessFragments function in mp4decrypt.CVE-2022-41425 · Other software · Axiosys · reported by MITREMedium 6.5
Bento4 v1.6.0-639 was discovered to contain a segmentation violation via the AP4_Processor::ProcessFragments function in mp4decrypt.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2022Bento4 v1.6.0-639 was discovered to contain a segmentation violation in the mp4fragment component.CVE-2022-41423 · Other software · Axiosys · reported by MITREMedium 6.5
Bento4 v1.6.0-639 was discovered to contain a segmentation violation in the mp4fragment component.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2022isolated-vm is a library for nodejs which gives the user access to v8's Isolate interface.CVE-2022-39266 · Other software · laverdet · reported by GitHubCritical 9.6
isolated-vm is a library for nodejs which gives the user access to v8's Isolate interface. In versions 4.3.6 and prior, if the untrusted v8 cached data is passed to the API through CachedDataOptions, attackers can bypass the sandbox and run arbitrary code in the nodejs process. Version 4.3.7 changes the documentation to warn users that they should not accept `cachedData` payloads from a user.
- Product
- isolated-vm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 26, 2022Inappropriate implementation in Site Isolation in Google Chrome prior to 105.0.5195.52 allowed a remote attacker who had compromised the renderer process to bypCVE-2022-3044 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 6.5
Inappropriate implementation in Site Isolation in Google Chrome prior to 105.0.5195.52 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page.
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comcrbug.com
Sep 23, 2022SWFTools commit 772e55a2 was discovered to contain a segmentation violation via FoFiTrueType::writeTTF at /xpdf/FoFiTrueType.cc.CVE-2022-35097 · Other software · Swftools · reported by MITREMedium 5.5
SWFTools commit 772e55a2 was discovered to contain a segmentation violation via FoFiTrueType::writeTTF at /xpdf/FoFiTrueType.cc.
- Product
- Swftools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2022SWFTools commit 772e55a2 was discovered to contain a segmentation violation via InfoOutputDev::type3D1 at /pdf/InfoOutputDev.cc.CVE-2022-35095 · Other software · Swftools · reported by MITREMedium 5.5
SWFTools commit 772e55a2 was discovered to contain a segmentation violation via InfoOutputDev::type3D1 at /pdf/InfoOutputDev.cc.
- Product
- Swftools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2022SWFTools commit 772e55a2 was discovered to contain a segmentation violation via convert_gfxline at /gfxpoly/convert.c.CVE-2022-35092 · Other software · Swftools · reported by MITREMedium 5.5
SWFTools commit 772e55a2 was discovered to contain a segmentation violation via convert_gfxline at /gfxpoly/convert.c.
- Product
- Swftools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2022HashiCorp Consul 1.8.1 up to 1.11.8, 1.12.4, and 1.13.1 do not properly validate the node or segment names prior to interpolation and usage in JWT claim assertiCVE-2021-41803 · Other software · Hashicorp · reported by MITREHigh 7.1
HashiCorp Consul 1.8.1 up to 1.11.8, 1.12.4, and 1.13.1 do not properly validate the node or segment names prior to interpolation and usage in JWT claim assertions with the auto config RPC. Fixed in 1.11.9, 1.12.5, and 1.13.2."
- Product
- Consul
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.hashicorp.comlists.fedoraproject.org
Sep 22, 2022OTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x6b6a8f.CVE-2022-35032 · Other software · Otfcc Project · reported by MITREMedium 6.5
OTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x6b6a8f.
- Product
- Otfcc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Sep 22, 2022OTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x703969.CVE-2022-35031 · Other software · Otfcc Project · reported by MITREMedium 6.5
OTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x703969.
- Product
- Otfcc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Sep 22, 2022OTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x4fe954.CVE-2022-35030 · Other software · Otfcc Project · reported by MITREMedium 6.5
OTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x4fe954.
- Product
- Otfcc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Sep 22, 2022OTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x6babea.CVE-2022-35029 · Other software · Otfcc Project · reported by MITREMedium 6.5
OTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x6babea.
- Product
- Otfcc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Sep 22, 2022OTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x4fbbb6.CVE-2022-35028 · Other software · Otfcc Project · reported by MITREMedium 6.5
OTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x4fbbb6.
- Product
- Otfcc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Sep 22, 2022OTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x4fe9a7.CVE-2022-35027 · Other software · Otfcc Project · reported by MITREMedium 6.5
OTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x4fe9a7.
- Product
- Otfcc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Sep 22, 2022OTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x4fbc0b.CVE-2022-35026 · Other software · Otfcc Project · reported by MITREMedium 6.5
OTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x4fbc0b.
- Product
- Otfcc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Sep 22, 2022OTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x5266a8.CVE-2022-35025 · Other software · Otfcc Project · reported by MITREMedium 6.5
OTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x5266a8.
- Product
- Otfcc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Sep 22, 2022OTFCC commit 617837b was discovered to contain a segmentation violation via /multiarch/memmove-vec-unaligned-erms.S.CVE-2022-35024 · Other software · Otfcc Project · reported by MITREMedium 6.5
OTFCC commit 617837b was discovered to contain a segmentation violation via /multiarch/memmove-vec-unaligned-erms.S.
- Product
- Otfcc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.