Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
15,261 results · page 114 of 306
Aug 7, 2023PrestaShop is an open source e-commerce web application.CVE-2023-39529 · Websites & servers · PrestaShop · reported by GitHubMedium 6.7
PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, it is possible to delete a file from the server by using the Attachments controller and the Attachments API. Version 8.1.1 contains a patch for this issue. There are no known workarounds.
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2023PrestaShop is an open source e-commerce web application.CVE-2023-39528 · Websites & servers · PrestaShop · reported by GitHubMedium 6.8
PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, the `displayAjaxEmailHTML` method can be used to read any file on the server, potentially even outside of the project if the server is not correctly configured. Version 8.1.1 contains a patch for this issue. There are no known workarounds.
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2023PrestaShop is an open source e-commerce web application.CVE-2023-39527 · Websites & servers · PrestaShop · reported by GitHubHigh 8.3
PrestaShop is an open source e-commerce web application. Versions prior to 1.7.8.10, 8.0.5, and 8.1.1 are vulnerable to cross-site scripting through the `isCleanHTML` method. Versions 1.7.8.10, 8.0.5, and 8.1.1 contain a patch. There are no known workarounds.
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2023PrestaShop is an open source e-commerce web application.CVE-2023-39526 · Websites & servers · PrestaShop · reported by GitHubCritical 9.1
PrestaShop is an open source e-commerce web application. Versions prior to 1.7.8.10, 8.0.5, and 8.1.1 are vulnerable to remote code execution through SQL injection and arbitrary file write in the back office. Versions 1.7.8.10, 8.0.5, and 8.1.1 contain a patch. There are no known workarounds.
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2023PrestaShop is an open source e-commerce web application.CVE-2023-39525 · Websites & servers · PrestaShop · reported by GitHubMedium 6.5
PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, in the back office, files can be compromised using path traversal by replaying the import file deletion query with a specified file path that uses the traversal path. Version 8.1.1 contains a patch for this issue. There are no known workarounds.
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2023PrestaShop is an open source e-commerce web application.CVE-2023-39524 · Websites & servers · PrestaShop · reported by GitHubMedium 6.7
PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, SQL injection possible in the product search field, in BO's product page. Version 8.1.1 contains a patch for this issue. There are no known workarounds.
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2023The Aerospike Java client is a Java application that implements a network protocol to communicate with an Aerospike server.CVE-2023-36480 · Other software · aerospike · reported by GitHubCritical 9.8
The Aerospike Java client is a Java application that implements a network protocol to communicate with an Aerospike server. Prior to versions 7.0.0, 6.2.0, 5.2.0, and 4.5.0 some of the messages received from the server contain Java objects that the client deserializes when it encounters them without further validation. Attackers that manage to trick clients into communicating with a malicious server can include especially crafted objects in its responses that, once deserialized by the client, force it to execute arbitrary code. This can be abused to take control of the machine the client is running on. Versions 7.0.0, 6.2.0, 5.2.0, and 4.5.0 contain a patch for this issue.
- Product
- aerospike-client-java
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2023The Unica application exposes an API which accepts arbitrary XML input.CVE-2023-37497 · Other software · HCL Software · reported by psirt@hcl.comHigh 8.1
The Unica application exposes an API which accepts arbitrary XML input. By manipulating the given XML, an authenticated attacker with certain rights can successfully perform XML External Entity attacks (XXE) against the backend service.
- Product
- HCL Unica Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Aug 3, 2023A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot Application Software could allow an authenticated, remote attacker to conducCVE-2023-20204 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.4
A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot Application Software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
- Product
- Cisco BroadWorks
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.comsec.cloudapps.cisco.com
Aug 2, 2023A XSS vulnerability exists in the Xiaomi cloud service Application product.CVE-2023-26316 · Other software · MI · reported by security@xiaomi.comMedium 6.1
A XSS vulnerability exists in the Xiaomi cloud service Application product. The vulnerability is caused by Webview's whitelist checking function allowing javascript protocol to be loaded and can be exploited by attackers to steal Xiaomi cloud service account's cookies.
- Product
- Xiaomi Cloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtrust.mi.comtrust.mi.com
Aug 2, 2023The users clientID at "application passwords" was not sanitized or escaped before being added to DOM.CVE-2023-26446 · Other software · OX Software GmbH · reported by security@open-xchange.comMedium 5.4
The users clientID at "application passwords" was not sanitized or escaped before being added to DOM. Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the web interface and API. To exploit this an attacker would require temporary access to the users account or lure a user to a compromised account. We now sanitize the user-controllable clientID parameter. No publicly available exploits are known.
- Product
- OX App Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jul 31, 2023Cross Site Request Forgery (CSRF) vulnerability in admin.php in DuxCMS 2.1 allows remote attackers to modtify application data via article/admin/content/add.CVE-2020-21881 · Other software · Duxcms Project · reported by MITREMedium 6.5
Cross Site Request Forgery (CSRF) vulnerability in admin.php in DuxCMS 2.1 allows remote attackers to modtify application data via article/admin/content/add.
- Product
- Duxcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2023IBM TRIRIGA 3.0, 4.0, and 4.4 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser.CVE-2020-4868 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM TRIRIGA 3.0, 4.0, and 4.4 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 190744.
- Product
- TRIRIGA Application Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jul 26, 2023The VMware Tanzu Application Service for VMs and Isolation Segment contain an information disclosure vulnerability due to the logging of credentials in hex encoCVE-2023-20891 · Other software · VMware · reported by security@vmware.comMedium 6.5
The VMware Tanzu Application Service for VMs and Isolation Segment contain an information disclosure vulnerability due to the logging of credentials in hex encoding in platform system audit logs. A malicious non-admin user who has access to the platform system audit logs can access hex encoded CF API admin credentials and can push new malicious versions of an application. In a default deployment non-admin users do not have access to the platform system audit logs.
- Product
- VMware Tanzu Application Service for VMs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 25, 2023Envoy is an open source edge and service proxy designed for cloud-native applications.CVE-2023-35944 · Other software · envoyproxy · reported by GitHubHigh 8.2
Envoy is an open source edge and service proxy designed for cloud-native applications. Envoy allows mixed-case schemes in HTTP/2, however, some internal scheme checks are case-sensitive. Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, this can lead to the rejection of requests with mixed-case schemes such as `htTp` or `htTps`, or the bypassing of some requests such as `https` in unencrypted connections. With a fix in versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, Envoy will now lowercase scheme values by default, and change the internal scheme checks that were case-sensitive to be case-insensitive. There are no known workarounds for this issue.
- Product
- envoy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 25, 2023Envoy is an open source edge and service proxy designed for cloud-native applications.CVE-2023-35943 · Other software · envoyproxy · reported by GitHubMedium 6.3
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, the CORS filter will segfault and crash Envoy when the `origin` header is removed and deleted between `decodeHeaders`and `encodeHeaders`. Versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12 have a fix for this issue. As a workaround, do not remove the `origin` header in the Envoy configuration.
- Product
- envoy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 25, 2023Envoy is an open source edge and service proxy designed for cloud-native applications.CVE-2023-35942 · Other software · envoyproxy · reported by GitHubMedium 6.5
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, gRPC access loggers using listener's global scope can cause a `use-after-free` crash when the listener is drained. Versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12 have a fix for this issue. As a workaround, disable gRPC access log or stop listener update.
- Product
- envoy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 25, 2023Envoy is an open source edge and service proxy designed for cloud-native applications.CVE-2023-35941 · Other software · envoyproxy · reported by GitHubHigh 8.6
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, a malicious client is able to construct credentials with permanent validity in some specific scenarios. This is caused by the some rare scenarios in which HMAC payload can be always valid in OAuth2 filter's check. Versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12 have a fix for this issue. As a workaround, avoid wildcards/prefix domain wildcards in the host's domain configuration.
- Product
- envoy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2023Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge.CVE-2023-37918 · Other software · dapr · reported by GitHubMedium 6.8
Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. A vulnerability has been found in Dapr that allows bypassing API token authentication, which is used by the Dapr sidecar to authenticate calls coming from the application, with a well-crafted HTTP request. Users who leverage API token authentication are encouraged to upgrade Dapr to 1.10.9 or to 1.11.2. This vulnerability impacts Dapr users who have configured API token authentication. An attacker could craft a request that is always allowed by the Dapr sidecar over HTTP, even if the `dapr-api-token` in the request is invalid or missing. The issue has been fixed in Dapr 1.10.9 or to 1.11.2. There are no known workarounds for this vulnerability.
- Product
- dapr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.dapr.iogithub.com
Jul 20, 2023Attackers can exploit an open API listener on SteelSeries GG 36.0.0 to create a sub-application that will be executed automatically from a controlled location, CVE-2023-31461 · Other software · Steelseries · reported by MITREHigh 7.5
Attackers can exploit an open API listener on SteelSeries GG 36.0.0 to create a sub-application that will be executed automatically from a controlled location, because of a path traversal vulnerability.
- Product
- GG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsteelseries.comakamai.com
Jul 19, 2023An OS command injection vulnerability was found in the Avaya Aura Device Services Web application which could allow remote code execution as the Web server userCVE-2023-3722 · Other software · Avaya · reported by securityalerts@avaya.comHigh 8.6
An OS command injection vulnerability was found in the Avaya Aura Device Services Web application which could allow remote code execution as the Web server user via a malicious uploaded file. This issue affects Avaya Aura Device Services version 8.1.4.0 and earlier.
- Product
- Aura Device Services
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.avaya.comdownload.avaya.com
Jul 19, 2023Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript.CVE-2023-37899 · Other software · feathersjs · reported by GitHubHigh 7.5
Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. Feathers socket handler did not catch invalid string conversion errors like `const message = ${{ toString: '' }}` which would cause the NodeJS process to crash when sending an unexpected Socket.io message like `socket.emit('find', { toString: '' })`. A fix has been released in versions 5.0.8 and 4.5.18. Users are advised to upgrade. There is no known workaround for this vulnerability.
- Product
- feathers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 19, 2023In GeoVision GV-ADR2701 cameras, an attacker could edit the login response to access the web application.CVE-2023-3638 · Other software · GeoVision · reported by ics-cert@hq.dhs.govCritical 9.8
In GeoVision GV-ADR2701 cameras, an attacker could edit the login response to access the web application.
- Product
- GV-ADR2701
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 19, 2023XBRL data create application version 7.0 and earlier improperly restricts XML external entity references (XXE).CVE-2023-32635 · Other software · Financial Services Agency · reported by vultures@jpcert.or.jpMedium 5.5
XBRL data create application version 7.0 and earlier improperly restricts XML external entity references (XXE). By processing a specially crafted XBRL file, arbitrary files on the system may be read by an attacker.
- Product
- XBRL data create application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpsubmit2.edinet-fsa.go.jp
Jul 18, 2023A CSV injection vulnerability was found in the Avaya Call Management System (CMS) Supervisor web application which allows a user with administrative privileges CVE-2023-3527 · Other software · Avaya · reported by securityalerts@avaya.comMedium 6.8
A CSV injection vulnerability was found in the Avaya Call Management System (CMS) Supervisor web application which allows a user with administrative privileges to input crafted data which, when exported to a CSV file, may attempt arbitrary command execution on the system used to open the file by a spreadsheet software such as Microsoft Excel.
- Product
- Avaya Call Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.avaya.comdownload.avaya.com
Jul 18, 2023Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Diagnostics).CVE-2023-22042 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.1
Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Diagnostics). Supported versions that are affected are 12.2.3-12.3.12. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Applications Framework. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Applications Framework, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Applications Framework accessible data as well as unauthorized read access to a subset of Oracle Applications Framework accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
- Product
- Applications Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2023Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: MS Excel Specific).CVE-2023-22037 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.5
Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: MS Excel Specific). Supported versions that are affected are 12.2.3-12.2.12. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Web Applications Desktop Integrator, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Web Applications Desktop Integrator accessible data as well as unauthorized read access to a subset of Oracle Web Applications Desktop Integrator accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Web Applications Desktop Integrator. CVSS 3.1 Base Score 6.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L).
- Product
- Web Applications Desktop Integrator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2023Vulnerability in the Oracle Health Sciences Sciences Data Management Workbench product of Oracle Health Sciences Applications (component: Blinding FunctionalityCVE-2023-22022 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.5
Vulnerability in the Oracle Health Sciences Sciences Data Management Workbench product of Oracle Health Sciences Applications (component: Blinding Functionality). Supported versions that are affected are 3.1.0.2, 3.1.1.3 and 3.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Health Sciences Sciences Data Management Workbench. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Health Sciences Sciences Data Management Workbench accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
- Product
- Life Sciences Data Management Workbench
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2023Vulnerability in the Oracle Applications Technology product of Oracle E-Business Suite (component: Reports Configuration).CVE-2023-22004 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 4.3
Vulnerability in the Oracle Applications Technology product of Oracle E-Business Suite (component: Reports Configuration). Supported versions that are affected are 12.2.3-12.2.12. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Applications Technology. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Applications Technology accessible data. CVSS 3.1 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N).
- Product
- E-Business Suite Technology Stack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2023Vulnerability in the Application Express Administration product of Oracle Application Express (component: None).CVE-2023-21983 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 5.6
Vulnerability in the Application Express Administration product of Oracle Application Express (component: None). Supported versions that are affected are Application Express Administration: 18.2-22.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Application Express Administration. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Application Express Administration accessible data as well as unauthorized read access to a subset of Application Express Administration accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Application Express Administration. CVSS 3.1 Base Score 5.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L).
- Product
- Application Express (APEX)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2023Vulnerability in the Application Express Customers Plugin product of Oracle Application Express (component: User Account).CVE-2023-21975 · Other software · Oracle Corporation · reported by secalert_us@oracle.comCritical 9
Vulnerability in the Application Express Customers Plugin product of Oracle Application Express (component: User Account). Supported versions that are affected are Application Express Customers Plugin: 18.2-22.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Application Express Customers Plugin. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Application Express Customers Plugin, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Application Express Customers Plugin. CVSS 3.1 Base Score 9.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H).
- Product
- Application Express (APEX)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2023Vulnerability in the Application Express Team Calendar Plugin product of Oracle Application Express (component: User Account).CVE-2023-21974 · Other software · Oracle Corporation · reported by secalert_us@oracle.comCritical 9
Vulnerability in the Application Express Team Calendar Plugin product of Oracle Application Express (component: User Account). Supported versions that are affected are Application Express Team Calendar Plugin: 18.2-22.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Application Express Team Calendar Plugin. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Application Express Team Calendar Plugin, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Application Express Team Calendar Plugin. CVSS 3.1 Base Score 9.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H).
- Product
- Application Express (APEX)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2023Open Enclave is a hardware-agnostic open source library for developing applications that utilize Hardware-based Trusted Execution Environments, also known as EnCVE-2023-37479 · Other software · openenclave · reported by GitHubMedium 5.3
Open Enclave is a hardware-agnostic open source library for developing applications that utilize Hardware-based Trusted Execution Environments, also known as Enclaves. There are two issues that are mitigated in version 0.19.3. First, Open Enclave SDK does not properly sanitize the `MXCSR` register on enclave entry. This makes applications vulnerable to MXCSR Configuration Dependent Timing (MCDT) attacks, where incorrect `MXCSR` values can impact instruction retirement by at most one cycle, depending on the (secret) data operand value. Please find more details in the guidance from Intel in the references. Second, Open Enclave SDK does not sanitize x86's alignment check flag `RFLAGS.AC` on enclave entry. This opens up the possibility for a side-channel attacker to be notified for every unaligned memory access performed by the enclave. The issue has been addressed in version 0.19.3 and the current master branch. Users will need to recompile their applications against the patched libraries to be protected from this vulnerability. There are no known workarounds for this vulnerability.
- Product
- openenclave
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2023The XPRTLD web application in Veritas InfoScale Operations Manager (VIOM) before 8.0.0.410 allows an authenticated attacker to upload all types of files to the CVE-2023-38404 · Other software · Veritas · reported by MITREHigh 7.2
The XPRTLD web application in Veritas InfoScale Operations Manager (VIOM) before 8.0.0.410 allows an authenticated attacker to upload all types of files to the server. An authenticated attacker can then execute the malicious file to perform command execution on the remote server.
- Product
- Infoscale Operations Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordveritas.comveritas.com
Jul 17, 2023 Reactive web applications that use Spring HATEOAS to produce hypermedia-based responses might be exposed to malicious forwarded headers if they are not behind CVE-2023-34036 · Other software · Spring · reported by security@vmware.comMedium 5.3
Reactive web applications that use Spring HATEOAS to produce hypermedia-based responses might be exposed to malicious forwarded headers if they are not behind a trusted proxy that ensures correctness of such headers, or if they don't have anything else in place to handle (and possibly discard) forwarded headers either in WebFlux or at the level of the underlying HTTP server. For the application to be affected, it needs to satisfy the following requirements: * It needs to use the reactive web stack (Spring WebFlux) and Spring HATEOAS to create links in hypermedia-based responses. * The application infrastructure does not guard against clients submitting (X-)Forwarded… headers.
- Product
- Spring HATEOAS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2023CleverTap Cordova Plugin version 2.6.2 allows a remote attacker to execute JavaScript code in any application that is opened via a specially constructed deeplinCVE-2023-2507 · Other software · CleverTap · reported by help@fluidattacks.comCritical 9.3
CleverTap Cordova Plugin version 2.6.2 allows a remote attacker to execute JavaScript code in any application that is opened via a specially constructed deeplink by an attacker. This is possible because the plugin does not correctly validate the data coming from the deeplinks before using them.
- Product
- Cordova Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comgithub.com
Jul 14, 2023XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it.CVE-2023-37462 · Other software · xwiki · reported by GitHubCritical 9.9
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Improper escaping in the document `SkinsCode.XWikiSkinsSheet` leads to an injection vector from view right on that document to programming rights, or in other words, it is possible to execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. The attack works by opening a non-existing page with a name crafted to contain a dangerous payload. It is possible to check if an existing installation is vulnerable. See the linked GHSA for instructions on testing an installation. This issue has been patched in XWiki 14.4.8, 14.10.4 and 15.0-rc-1. Users are advised to upgrade. The fix commit `d9c88ddc` can also be applied manually to the impacted document `SkinsCode.XWikiSkinsSheet` and users unable to upgrade are advised to manually patch their installations.
- Product
- xwiki-platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2023The "nickname" field within Savoir-faire Linux's Jami application is susceptible to a failed state when a user inserts special characters into the field.CVE-2023-3433 · Other software · Savoir-faire Linux · reported by cves@blacklanternsecurity.comMedium 5.5
The "nickname" field within Savoir-faire Linux's Jami application is susceptible to a failed state when a user inserts special characters into the field. When present, these special characters, make it so the application cannot create the signature for the user and results in a local denial of service to the application.
- Product
- Jami
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.blacklanternsecurity.comgit.jami.net
Jul 13, 2023Auto-GPT is an experimental open-source application showcasing the capabilities of the GPT-4 language model.CVE-2023-37275 · Other software · Significant-Gravitas · reported by GitHubLow 3.1
Auto-GPT is an experimental open-source application showcasing the capabilities of the GPT-4 language model. The Auto-GPT command line UI makes heavy use of color-coded print statements to signify different types of system messages to the user, including messages that are crucial for the user to review and control which commands should be executed. Before v0.4.3, it was possible for a malicious external resource (such as a website browsed by Auto-GPT) to cause misleading messages to be printed to the console by getting the LLM to regurgitate JSON encoded ANSI escape sequences (`\u001b[`). These escape sequences were JSON decoded and printed to the console as part of the model's "thinking process". The issue has been patched in release version 0.4.3.
- Product
- Auto-GPT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2023Auto-GPT is an experimental open-source application showcasing the capabilities of the GPT-4 language model.CVE-2023-37274 · Other software · Significant-Gravitas · reported by GitHubHigh 7.5
Auto-GPT is an experimental open-source application showcasing the capabilities of the GPT-4 language model. When Auto-GPT is executed directly on the host system via the provided run.sh or run.bat files, custom Python code execution is sandboxed using a temporary dedicated docker container which should not have access to any files outside of the Auto-GPT workspace directory. Before v0.4.3, the `execute_python_code` command (introduced in v0.4.1) does not sanitize the `basename` arg before writing LLM-supplied code to a file with an LLM-supplied name. This allows for a path traversal attack that can overwrite any .py file outside the workspace directory by specifying a `basename` such as `../../../main.py`. This can further be abused to achieve arbitrary code execution on the host running Auto-GPT by e.g. overwriting autogpt/main.py which will be executed outside of the docker environment meant to sandbox custom python code execution the next time Auto-GPT is started. The issue has been patched in version 0.4.3. As a workaround, the risk introduced by this vulnerability can be remediated by running Auto-GPT in a virtual machine, or another environment in which damage to files or co
- Product
- Auto-GPT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2023Auto-GPT is an experimental open-source application showcasing the capabilities of the GPT-4 language model.CVE-2023-37273 · Other software · Significant-Gravitas · reported by GitHubHigh 8.1
Auto-GPT is an experimental open-source application showcasing the capabilities of the GPT-4 language model. Running Auto-GPT version prior to 0.4.3 by cloning the git repo and executing `docker compose run auto-gpt` in the repo root uses a different docker-compose.yml file from the one suggested in the official docker set up instructions. The docker-compose.yml file located in the repo root mounts itself into the docker container without write protection. This means that if malicious custom python code is executed via the `execute_python_file` and `execute_python_code` commands, it can overwrite the docker-compose.yml file and abuse it to gain control of the host system the next time Auto-GPT is started. The issue has been patched in version 0.4.3.
- Product
- Auto-GPT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2023An insecure connection between Systems Manager and CQI Reporter application could expose infusion data to an attacker.CVE-2023-30565 · Other software · Becton Dickinson & Co · reported by cybersecurity@bd.comLow 3.5
An insecure connection between Systems Manager and CQI Reporter application could expose infusion data to an attacker.
- Product
- CQI Reporter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2023Reflected XSS attacks, occur when a malicious script is reflected off a web application to the victim's browser.CVE-2023-29457 · Other software · Zabbix · reported by security@zabbix.comMedium 6.3
Reflected XSS attacks, occur when a malicious script is reflected off a web application to the victim's browser. The script can be activated through Action form fields, which can be sent as request to a website with a vulnerability that enables execution of malicious scripts.
- Product
- Zabbix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orgsupport.zabbix.com
Jul 13, 2023Reflected XSS attacks, also known as non-persistent attacks, occur when a malicious script is reflected off a web application to the victim's browser.CVE-2023-29455 · Other software · Zabbix · reported by security@zabbix.comMedium 5.4
Reflected XSS attacks, also known as non-persistent attacks, occur when a malicious script is reflected off a web application to the victim's browser. The script is activated through a link, which sends a request to a website with a vulnerability that enables execution of malicious scripts.
- Product
- Zabbix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orgsupport.zabbix.com
Jul 13, 2023Stored or persistent cross-site scripting (XSS) is a type of XSS where the attacker first sends the payload to the web application, then the application saves tCVE-2023-29454 · Other software · Zabbix · reported by security@zabbix.comMedium 5.4
Stored or persistent cross-site scripting (XSS) is a type of XSS where the attacker first sends the payload to the web application, then the application saves the payload (e.g., in a database or server-side text files), and finally, the application unintentionally executes the payload for every victim visiting its web pages.
- Product
- Zabbix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orgsupport.zabbix.com
Jul 12, 2023SonicWall GMS and Analytics CAS Web Services application use static values for authentication without proper checks leading to authentication bypass vulnerabiliCVE-2023-34137 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comCritical 9.8
SonicWall GMS and Analytics CAS Web Services application use static values for authentication without proper checks leading to authentication bypass vulnerability. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.
- Product
- GMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.global.sonicwall.comsonicwall.com
Jul 12, 2023Tomcat application credentials are hardcoded in SonicWall GMS and Analytics configuration file.CVE-2023-34128 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comCritical 9.8
Tomcat application credentials are hardcoded in SonicWall GMS and Analytics configuration file. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.
- Product
- GMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.global.sonicwall.comsonicwall.com
Jul 12, 2023In notification access permission dialog box, malicious application can embedded a very long service label that overflow the original user prompt and possibly cCVE-2023-21260 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In notification access permission dialog box, malicious application can embedded a very long service label that overflow the original user prompt and possibly contains mis-leading information to be appeared as a system message for user confirmation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Jul 11, 2023Orchid is a Laravel package that allows application development of back-office applications, admin/user panels, and dashboards.CVE-2023-36825 · Other software · orchidsoftware · reported by GitHubCritical 9.6
Orchid is a Laravel package that allows application development of back-office applications, admin/user panels, and dashboards. A vulnerability present starting in version 14.0.0-alpha4 and prior to version 14.5.0 is related to the deserialization of untrusted data from the `_state` query parameter, which can result in remote code execution. The issue has been addressed in version 14.5.0. Users are advised to upgrade their software to this version or any subsequent versions that include the patch. There are no known workarounds.
- Product
- platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 11, 2023The Rockwell Automation Enhanced HIM software contains an API that the application uses that is not protected sufficiently and uses incorrect Cross-Origin ResCVE-2023-2746 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comCritical 9.6
The Rockwell Automation Enhanced HIM software contains an API that the application uses that is not protected sufficiently and uses incorrect Cross-Origin Resource Sharing (CORS) settings and, as a result, is vulnerable to a Cross Site Request Forgery (CSRF) attack. To exploit this vulnerability, a malicious user would have to convince a user to click on an untrusted link through a social engineering attack or successfully perform a Cross Site Scripting Attack (XSS). Exploitation of a CSRF could potentially lead to sensitive information disclosure and full remote access to the affected products.
- Product
- Enhanced HIM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.custhelp.comrockwellautomation.custhelp.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.