Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,269 results · page 12 of 26
Jun 9, 2023Fuel CMS v1.5.2 was discovered to contain a SQL injection vulnerability via the id parameter at /controllers/Blocks.php.CVE-2023-33557 · Other software · Thedaylightstudio · reported by MITREHigh 8.8
Fuel CMS v1.5.2 was discovered to contain a SQL injection vulnerability via the id parameter at /controllers/Blocks.php.
- Product
- Fuel CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 7, 2023 PTC Vuforia Studio does not require a token; this could allow an attacker with local access to perform a cross-site request forgery attack or a replay atCVE-2023-31200 · Other software · PTC · reported by ics-cert@hq.dhs.govMedium 5.7
PTC Vuforia Studio does not require a token; this could allow an attacker with local access to perform a cross-site request forgery attack or a replay attack.
- Product
- Vuforia Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 7, 2023 Before importing a project into Vuforia, a user could modify the “resourceDirectory” attribute in the appConfig.json file to be a different path.CVE-2023-29502 · Other software · PTC · reported by ics-cert@hq.dhs.govMedium 6.2
Before importing a project into Vuforia, a user could modify the “resourceDirectory” attribute in the appConfig.json file to be a different path.
- Product
- Vuforia Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 7, 2023The local Vuforia web application does not support HTTPS, and federated credentials are passed via basic authentication.CVE-2023-29168 · Other software · PTC · reported by ics-cert@hq.dhs.govLow 3.7
The local Vuforia web application does not support HTTPS, and federated credentials are passed via basic authentication.
- Product
- Vuforia Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 7, 2023 By changing the filename parameter in the request, an attacker could delete any file with the permissions of the Vuforia server account.CVE-2023-29152 · Other software · PTC · reported by ics-cert@hq.dhs.govMedium 6.2
By changing the filename parameter in the request, an attacker could delete any file with the permissions of the Vuforia server account.
- Product
- Vuforia Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 7, 2023 A user could use the “Upload Resource” functionality to upload files to any location on the disk.CVE-2023-27881 · Other software · PTC · reported by ics-cert@hq.dhs.govHigh 8
A user could use the “Upload Resource” functionality to upload files to any location on the disk.
- Product
- Vuforia Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 7, 2023 An attacker with local access to the machine could record the traffic, which could allow them to resend requests without the server authenticating that the uCVE-2023-24476 · Other software · PTC · reported by ics-cert@hq.dhs.govLow 1.8
An attacker with local access to the machine could record the traffic, which could allow them to resend requests without the server authenticating that the user or session are valid.
- Product
- Vuforia Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2023Keyboard Themes 1.275.1.164 for Android contains a dictionary traversal vulnerability that allows unauthorized apps to overwrite arbitrary files in its internalCVE-2023-29736 · Other software · Timmystudios · reported by MITRECritical 9.8
Keyboard Themes 1.275.1.164 for Android contains a dictionary traversal vulnerability that allows unauthorized apps to overwrite arbitrary files in its internal storage and achieve arbitrary code execution.
- Product
- Keyboard Themes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2023Shop Beat Solutions (Pty) LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Cross Site Request Forgery (CSRF).CVE-2022-36250 · Other software · Shop Beat · reported by support@shopbeat.co.zaHigh 8.8
Shop Beat Solutions (Pty) LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Cross Site Request Forgery (CSRF).
- Product
- studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordshopbeat.co.zashopbeat.co.za
May 30, 2023Shop Beat Solutions (Pty) LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Bypass 2FA via APIs.CVE-2022-36249 · Other software · Shop Beat · reported by support@shopbeat.co.zaMedium 5.4
Shop Beat Solutions (Pty) LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Bypass 2FA via APIs. For Controlpanel Lite. "After login we are directly able to use the bearer token or jsession ID to access the apis instead of entering the 2FA code. Thus, leading to bypass of 2FA on API level.
- Product
- studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordshopbeat.co.zashopbeat.co.za
May 30, 2023Shop Beat Solutions (Pty) LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to IDOR via controlpanel.shopbeat.co.za.CVE-2022-36247 · Other software · Shop Beat · reported by support@shopbeat.co.zaCritical 9.1
Shop Beat Solutions (Pty) LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to IDOR via controlpanel.shopbeat.co.za.
- Product
- studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordshopbeat.co.zashopbeat.co.za
May 30, 2023Shop Beat Solutions (Pty) LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Insecure Permissions.CVE-2022-36246 · Other software · Shop Beat · reported by support@shopbeat.co.zaCritical 9.8
Shop Beat Solutions (Pty) LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Insecure Permissions.
- Product
- studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordshopbeat.co.zashopbeat.co.za
May 30, 2023Shop Beat Solutions (Pty) LTD Shop Beat Media Player 2.5.95 up to 3.2.57 suffers from Multiple Stored Cross-Site Scripting (XSS) vulnerabilities via Shop Beat CCVE-2022-36244 · Other software · Shop Beat · reported by support@shopbeat.co.zaMedium 5.4
Shop Beat Solutions (Pty) LTD Shop Beat Media Player 2.5.95 up to 3.2.57 suffers from Multiple Stored Cross-Site Scripting (XSS) vulnerabilities via Shop Beat Control Panel found at www.shopbeat.co.za controlpanel.shopbeat.co.za.
- Product
- studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordshopbeat.co.zashopbeat.co.za
May 30, 2023Shop Beat Solutions (pty) LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Directory Traversal via server.shopbeat.co.za.CVE-2022-36243 · Other software · Shop Beat · reported by support@shopbeat.co.zaMedium 5.3
Shop Beat Solutions (pty) LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Directory Traversal via server.shopbeat.co.za. Information Exposure Through Directory Listing vulnerability in "studio" software of Shop Beat. This issue affects: Shop Beat studio studio versions prior to 3.2.57 on arm.
- Product
- studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordshopbeat.co.zashopbeat.co.za
May 22, 2023Beekeeper Studio versions prior to 3.9.9 allows a remote authenticated attacker to execute arbitrary JavaScript code with the privilege of the application on thCVE-2023-28394 · Other software · Beekeeper Studio, Inc. · reported by vultures@jpcert.or.jpHigh 8.8
Beekeeper Studio versions prior to 3.9.9 allows a remote authenticated attacker to execute arbitrary JavaScript code with the privilege of the application on the PC where the affected product is installed. As a result, an arbitrary OS command may be executed as well.
- Product
- Beekeeper Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2023 The affected products have a CSRF vulnerability that could allow an attacker to execute code and upload malicious files.CVE-2023-2505 · Other software · BirdDog · reported by ics-cert@hq.dhs.govHigh 7.7
The affected products have a CSRF vulnerability that could allow an attacker to execute code and upload malicious files.
- Product
- STUDIO R3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2023 Files present on firmware images could allow an attacker to gain unauthorized access as a root user using hard-coded credentials.CVE-2023-2504 · Other software · BirdDog · reported by ics-cert@hq.dhs.govHigh 8.4
Files present on firmware images could allow an attacker to gain unauthorized access as a root user using hard-coded credentials.
- Product
- STUDIO R3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 18, 2023Cross-Site Request Forgery (CSRF) vulnerability in Studio Wombat Shoppable Images plugin <= 1.2.3 versions.CVE-2023-25698 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Studio Wombat Shoppable Images plugin <= 1.2.3 versions.
- Fixed in
- 1.2.4
- What to do
- Update the plugin to 1.2.4 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 10, 2023Insecure inherited permissions in the Intel(R) NUC Software Studio Service installer before version 1.17.38.0 may allow an authenticated user to potentially enaCVE-2022-38103 · Other software · Intel · reported by secure@intel.comMedium 6.7
Insecure inherited permissions in the Intel(R) NUC Software Studio Service installer before version 1.17.38.0 may allow an authenticated user to potentially enable escalation of privilege via local access
- Product
- NUC Software Studio Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2023Visual Studio Code Spoofing VulnerabilityCVE-2023-29338 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.6
Visual Studio Code Spoofing Vulnerability
- Product
- Visual Studio Code
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 28, 2023In Talend Studio before 7.3.1-R2022-10 and 8.x before 8.0.1-R2022-09, microservices allow unauthenticated access to the Jolokia endpoint of the microservice.CVE-2023-31444 · Other software · Talend · reported by MITREHigh 7.5
In Talend Studio before 7.3.1-R2022-10 and 8.x before 8.0.1-R2022-09, microservices allow unauthenticated access to the Jolokia endpoint of the microservice. This allows for remote access to the JVM via the Jolokia JMX-HTTP bridge.
- Product
- Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2023An issue found in Ego Studio SuperClean v.1.1.9 and v.1.1.5 allows an attacker to gain privileges cause a denial of service via the update_info field of the _deCVE-2023-27652 · Other software · Egostudiogroup · reported by MITREMedium 5.5
An issue found in Ego Studio SuperClean v.1.1.9 and v.1.1.5 allows an attacker to gain privileges cause a denial of service via the update_info field of the _default_.xml file.
- Product
- Super Clean
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordegostudiogroup.comapkpure.com
Apr 14, 2023An issue found in Ego Studio SuperClean v.1.1.9 and v.1.1.5 allows an attacker to gain privileges via the update_info field of the _default_.xml file.CVE-2023-27651 · Other software · Egostudiogroup · reported by MITREHigh 7.8
An issue found in Ego Studio SuperClean v.1.1.9 and v.1.1.5 allows an attacker to gain privileges via the update_info field of the _default_.xml file.
- Product
- Super Clean
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordegostudiogroup.comapkpure.com
Apr 14, 2023Directory Traversal vulnerability found in T-ME Studios Change Color of Keypad v.1.275.1.277 allows a remote attacker to execute arbitrary code via the dex fileCVE-2023-27648 · Other software · Timmystudios · reported by MITRECritical 9.8
Directory Traversal vulnerability found in T-ME Studios Change Color of Keypad v.1.275.1.277 allows a remote attacker to execute arbitrary code via the dex file in the internal storage.
- Product
- Change Color Of Keypad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcorporate.timmystudios.comgithub.com
Apr 14, 2023Timmystudios Fast Typing Keyboard v1.275.1.162 allows unauthorized apps to overwrite arbitrary files in its internal storage via a dictionary traversal vulnerabCVE-2022-47027 · Other software · Timmystudios · reported by MITRECritical 9.8
Timmystudios Fast Typing Keyboard v1.275.1.162 allows unauthorized apps to overwrite arbitrary files in its internal storage via a dictionary traversal vulnerability and achieve arbitrary code execution.
- Product
- Fast Typing Keyboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcorporate.timmystudios.comgithub.com
Apr 11, 2023Visual Studio Spoofing VulnerabilityCVE-2023-28299 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Visual Studio Spoofing Vulnerability
- Product
- Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 11, 2023Visual Studio Remote Code Execution VulnerabilityCVE-2023-28296 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Visual Studio Remote Code Execution Vulnerability
- Product
- Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 11, 2023Visual Studio Information Disclosure VulnerabilityCVE-2023-28263 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Visual Studio Information Disclosure Vulnerability
- Product
- Microsoft Visual Studio 2022 version 17.2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 11, 2023Visual Studio Elevation of Privilege VulnerabilityCVE-2023-28262 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Visual Studio Elevation of Privilege Vulnerability
- Product
- Microsoft Visual Studio 2022 version 17.2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 11, 2023Visual Studio Code Remote Code Execution VulnerabilityCVE-2023-24893 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Visual Studio Code Remote Code Execution Vulnerability
- Product
- Visual Studio Code
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 2, 2023Jenkins Visual Studio Code Metrics Plugin 1.7 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.CVE-2023-28681 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comHigh 8.2
Jenkins Visual Studio Code Metrics Plugin 1.7 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
- Product
- Jenkins Visual Studio Code Metrics Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2023WP Film Studio: Does not have CSRF checkCVE-2023-0500 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP Film Studio WordPress plugin before 1.3.5 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
- Product
- WP Film Studio
- Fixed in
- 1.3.5
- What to do
- Update WP Film Studio to 1.3.5 or newer.
Feb 28, 2023In Dataiku DSS 11.2.1, an attacker can download other Dataiku files that were uploaded to the myfiles section by specifying the target username in a download reCVE-2023-24045 · Other software · Dataiku · reported by MITREMedium 6.5
In Dataiku DSS 11.2.1, an attacker can download other Dataiku files that were uploaded to the myfiles section by specifying the target username in a download request.
- Product
- Data Science Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddataiku.comgist.github.com
Feb 17, 2023Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crafter Studio on Linux, MacOS, Windows, x86, ARM, 64 bit CVE-2023-26020 · Other software · CrafterCMS · reported by security@craftersoftware.comMedium 5.7
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crafter Studio on Linux, MacOS, Windows, x86, ARM, 64 bit allows SQL Injection.This issue affects CrafterCMS v4.0 from 4.0.0 through 4.0.1, and v3.1 from 3.1.0 through 3.1.26.
- Product
- CrafterCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.craftercms.orgdocs.craftercms.org
Feb 14, 2023Visual Studio Remote Code Execution VulnerabilityCVE-2023-23381 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Visual Studio Remote Code Execution Vulnerability
- Product
- Microsoft Visual Studio 2013 Update 5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Feb 14, 2023Visual Studio Remote Code Execution VulnerabilityCVE-2023-21815 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Visual Studio Remote Code Execution Vulnerability
- Product
- Microsoft Visual Studio 2013 Update 5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Feb 14, 2023.NET and Visual Studio Remote Code Execution VulnerabilityCVE-2023-21808 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
.NET and Visual Studio Remote Code Execution Vulnerability
- Product
- .NET 6.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Feb 14, 2023Visual Studio Denial of Service VulnerabilityCVE-2023-21567 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.6
Visual Studio Denial of Service Vulnerability
- Product
- Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Feb 14, 2023Visual Studio Elevation of Privilege VulnerabilityCVE-2023-21566 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Visual Studio Elevation of Privilege Vulnerability
- Product
- Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Feb 14, 2023Microsoft SQL Server Integration Service (VS extension) Remote Code Execution VulnerabilityCVE-2023-21568 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.3
Microsoft SQL Server Integration Service (VS extension) Remote Code Execution Vulnerability
- Product
- SQL Server Integration Services for Visual Studio 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Feb 3, 2023Cross Site Request Forgery vulnerability in FUEL-CMS 1.4.13 allows remote attackers to run arbitrary code via post ID to /permissions/delete/2---.CVE-2021-36570 · Other software · Thedaylightstudio · reported by MITREHigh 8.8
Cross Site Request Forgery vulnerability in FUEL-CMS 1.4.13 allows remote attackers to run arbitrary code via post ID to /permissions/delete/2---.
- Product
- Fuel CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2023Cross Site Request Forgery vulnerability in FUEL-CMS 1.4.13 allows remote attackers to run arbitrary code via post ID to /users/delete/2.CVE-2021-36569 · Other software · Thedaylightstudio · reported by MITREHigh 8.8
Cross Site Request Forgery vulnerability in FUEL-CMS 1.4.13 allows remote attackers to run arbitrary code via post ID to /users/delete/2.
- Product
- Fuel CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2023ContentStudio: Authorization bypassCVE-2023-0558 · WordPress plugins & themes · reported by WordfenceHigh 8.2
The ContentStudio plugin for WordPress is vulnerable to authorization bypass due to an unsecure token check that is susceptible to type juggling in versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to execute functions intended for use by users with proper API keys.
- Product
- ContentStudio
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update ContentStudio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 27, 2023ContentStudio: Sensitive Information ExposureCVE-2023-0557 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The ContentStudio plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.2.5. This could allow unauthenticated attackers to obtain a nonce needed for the creation of posts.
- Product
- ContentStudio
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update ContentStudio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 27, 2023ContentStudio: Authorization bypassCVE-2023-0556 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The ContentStudio plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several functions in versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to obtain the blog metadata (via the function cstu_get_metadata) that includes the plugin's contentstudio_token. Knowing this token allows for other interactions with the plugin such as creating posts in versions prior to 1.2.5, which added other requirements to posting and updating.
- Product
- ContentStudio
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update ContentStudio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 17, 2023Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 is vulnerable to improper input validation of user input to seveCVE-2022-47917 · Other software · Sewio · reported by ics-cert@hq.dhs.govMedium 6.8
Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 is vulnerable to improper input validation of user input to several modules and services of the software. This could allow an attacker to delete arbitrary files and cause a denial-of-service condition.
- Product
- RTLS Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2023Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 does not properly validate the input module name to the backup sCVE-2022-47911 · Other software · Sewio · reported by ics-cert@hq.dhs.govCritical 9.1
Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 does not properly validate the input module name to the backup services of the software. This could allow a remote attacker to access sensitive functions of the application and execute arbitrary system commands.
- Product
- RTLS Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2023Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 is vulnerable to cross-site request forgery in its monitor serviCVE-2022-47395 · Other software · Sewio · reported by ics-cert@hq.dhs.govHigh 8.1
Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 is vulnerable to cross-site request forgery in its monitor services. An attacker could take advantage of this vulnerability to execute arbitrary maintenance operations and cause a denial-of-service condition.
- Product
- RTLS Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2023Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 is vulnerable to cross-site scripting in its backup services.CVE-2022-46733 · Other software · Sewio · reported by ics-cert@hq.dhs.govMedium 6.3
Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 is vulnerable to cross-site scripting in its backup services. An attacker could take advantage of this vulnerability to execute arbitrary commands.
- Product
- RTLS Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2023Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 contains hard-coded passwords for select users in the applicatioCVE-2022-45444 · Other software · Sewio · reported by ics-cert@hq.dhs.govCritical 10
Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 contains hard-coded passwords for select users in the application’s database. This could allow a remote attacker to login to the database with unrestricted access.
- Product
- RTLS Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.