Updated 11 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

449new WordPress flaws this week

390,525entries in the database

1,478 results · page 12 of 30

Mar 15, 2024Discourse is an open source platform for community discussion.CVE-2024-24827 · Other software · discourse · reported by GitHubMedium 5.3
Discourse is an open source platform for community discussion. Without a rate limit on the POST /uploads endpoint, it makes it easier for an attacker to carry out a DoS attack on the server since creating an upload can be a resource intensive process. Do note that the impact varies from site to site as various site settings like `max_image_size_kb`, `max_attachment_size_kb` and `max_image_megapixels` will determine the amount of resources used when creating an upload. The issue is patched in the latest stable, beta and tests-passed version of Discourse. Users are advised to upgrade. Users unable to upgrade should reduce `max_image_size_kb`, `max_attachment_size_kb` and `max_image_megapixels` as smaller uploads require less resources to process. Alternatively, `client_max_body_size` can be reduced in Nginx to prevent large uploads from reaching the server.
Product
discourse
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 15, 2024Discourse is an open source platform for community discussion.CVE-2024-24748 · Other software · discourse · reported by GitHubMedium 5.3
Discourse is an open source platform for community discussion. In affected versions an attacker can learn that a secret subcategory exists under a public category which has no public subcategories. The issue is patched in the latest stable, beta and tests-passed version of Discourse. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Product
discourse
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 1, 2024parse-server is a Parse Server for Node.js / Express.CVE-2024-27298 · Other software · parse-community · reported by GitHubCritical 10
parse-server is a Parse Server for Node.js / Express. This vulnerability allows SQL injection when Parse Server is configured to use the PostgreSQL database. The vulnerability has been fixed in 6.5.0 and 7.0.0-alpha.20.
Product
parse-server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 1, 2024A vulnerability was found in LangChain langchain_community 0.0.26.CVE-2024-2057 · Other software · LangChain · reported by VulDBMedium 6.3
A vulnerability was found in LangChain langchain_community 0.0.26. It has been classified as critical. Affected is the function load_local in the library libs/community/langchain_community/retrievers/tfidf.py of the component TFIDFRetriever. The manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.0.27 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-255372.
Product
langchain_community
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 27, 2024In the module "Import/Update Bulk Product from any Csv/Excel File Pro" (ba_importer) up to version 1.1.28 from Buy Addons for PrestaShop, a guest can perform SQCVE-2024-25843 · Other software · communitydeveloper · reported by MITRECritical 9.8
In the module "Import/Update Bulk Product from any Csv/Excel File Pro" (ba_importer) up to version 1.1.28 from Buy Addons for PrestaShop, a guest can perform SQL injection in affected versions.
Product
import\/update_bulk_product_from_any_csv\/excel_file_pro
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record addons.prestashop.com security.friendsofpresta.org
Feb 12, 2024SteVe v3.6.0 was discovered to use predictable transaction ID's when receiving a StartTransaction request.CVE-2024-25407 · Other software · Steve-community · reported by MITREHigh 7.5
SteVe v3.6.0 was discovered to use predictable transaction ID's when receiving a StartTransaction request. This vulnerability can allow attackers to cause a Denial of Service (DoS) by using the predicted transaction ID's to terminate other transactions.
Product
Steve
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 12, 2024CSV Injection vulnerability in '/members/moremember.pl' and '/admin/aqbudgets.pl' endpoints in Koha Library Management System version 23.05.05 and earlier allowCVE-2024-24337 · Other software · koha-community · reported by MITREHigh 8
CSV Injection vulnerability in '/members/moremember.pl' and '/admin/aqbudgets.pl' endpoints in Koha Library Management System version 23.05.05 and earlier allows attackers to to inject DDE commands into csv exports via the 'Budget' and 'Patrons Member' components.
Product
koha_library_software
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nitipoom-jar.github.io nitipoom-jaroonchaipipat.github.io
Feb 8, 2024An arbitrary file upload vulnerability in /upgrade/control.php of ZenTao Community Edition v18.10, ZenTao Biz v8.10, and ZenTao Max v4.10 allows attackers to exCVE-2024-24202 · Other software · easycorp · reported by MITRECritical 9.8
An arbitrary file upload vulnerability in /upgrade/control.php of ZenTao Community Edition v18.10, ZenTao Biz v8.10, and ZenTao Max v4.10 allows attackers to execute arbitrary code via uploading a crafted .txt file.
Product
zentao_max
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record clammy-blizzard-8ef.notion.site clammy-blizzard-8ef.notion.site
Jan 31, 2024Community by PeepSo – Social Network, Membership, Registration, User Profiles: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-22158 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PeepSo Community by PeepSo – Social Network, Membership, Registration, User Profiles allows Stored XSS.This issue affects Community by PeepSo – Social Network, Membership, Registration, User Profiles: from n/a before 6.3.1.0.
Product
Community by PeepSo – Social Network, Membership, Registration, User Profiles
Fixed in
6.3.1.0
What to do
Update Community by PeepSo – Social Network, Membership, Registration, User Profiles to 6.3.1.0 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 16, 2024A Cross Site Scripting (XSS) vulnerability in evewa3ajax.php in GRUEN eVEWA3 Community 31 through 53 allows attackers to obtain escalated privileges via a craftCVE-2023-25295 · Other software · Gruen · reported by MITREMedium 6.1
A Cross Site Scripting (XSS) vulnerability in evewa3ajax.php in GRUEN eVEWA3 Community 31 through 53 allows attackers to obtain escalated privileges via a crafted request to the login panel.
Product
Evewa3
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.munz4u.de blog.munz4u.de
Jan 16, 2024Community by PeepSo: Does not sanitise and escape various parameters and generated URLs before outputting them back attributesCVE-2024-0187 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Community by PeepSo WordPress plugin before 6.3.1.2 does not sanitise and escape various parameters and generated URLs before outputting them back attributes, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Community by PeepSo
Fixed in
6.3.1.2
What to do
Update Community by PeepSo to 6.3.1.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2024Community by PeepSo: Does not have CSRF checkCVE-2023-7125 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Community by PeepSo WordPress plugin before 6.3.1.2 does not have CSRF check when creating a user post (visible on their wall in their profile page), which could allow attackers to make logged in users perform such action via a CSRF attack
Product
Community by PeepSo
Fixed in
6.3.1.2
What to do
Update Community by PeepSo to 6.3.1.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 12, 2024Discourse is a platform for community discussion.CVE-2024-21655 · Other software · discourse · reported by GitHubMedium 4.3
Discourse is a platform for community discussion. For fields that are client editable, limits on sizes are not imposed. This allows a malicious actor to cause a Discourse instance to use excessive disk space and also often excessive bandwidth. The issue is patched 3.1.4 and 3.2.0.beta4.
Product
discourse
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 12, 2024Rubygems.org is the Ruby community's gem hosting service.CVE-2024-21654 · Other software · rubygems · reported by GitHubMedium 4.8
Rubygems.org is the Ruby community's gem hosting service. Rubygems.org users with MFA enabled would normally be protected from account takeover in the case of email account takeover. However, a workaround on the forgotten password form allows an attacker to bypass the MFA requirement and takeover the account. This vulnerability has been patched in commit 0b3272a.
Product
rubygems.org
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 12, 2024Discourse is a platform for community discussion.CVE-2023-49099 · Other software · discourse · reported by GitHubLow 3.1
Discourse is a platform for community discussion. Under very specific circumstances, secure upload URLs associated with posts can be accessed by guest users even when login is required. This vulnerability has been patched in 3.2.0.beta4 and 3.1.4.
Product
discourse
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 12, 2024Discourse is a platform for community discussion.CVE-2023-48297 · Other software · discourse · reported by GitHubHigh 8.6
Discourse is a platform for community discussion. The message serializer uses the full list of expanded chat mentions (@all and @here) which can lead to a very long array of users. This issue was patched in versions 3.1.4 and beta 3.2.0.beta5.
Product
discourse
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 12, 2024GitLab Community and Enterprise Editions Improper Access Control VulnerabilityCVE-2023-7028 · Websites & servers · GitLab · reported by cve@gitlab.comExploitedCritical 10
GitLab Community and Enterprise Editions contain an improper access control vulnerability. This allows an attacker to trigger password reset emails to be sent to an unverified email address to ultimately facilitate an account takeover.
Product
GitLab CE/EE
On CISA’s list since
May 1, 2024 (federal fix deadline May 22, 2024)
What to do
Attackers are using this now. Install GitLab’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog gitlab.com hackerone.com
Jan 3, 2024An issue was discovered in O-RAN Software Community ric-plt-e2mgr in the G-Release environment, allows remote attackers to cause a denial of service (DoS) via aCVE-2023-42358 · Other software · O-ran-sc · reported by MITREHigh 7.7
An issue was discovered in O-RAN Software Community ric-plt-e2mgr in the G-Release environment, allows remote attackers to cause a denial of service (DoS) via a crafted request to the E2Manager API component.
Product
Ric-plt-e2mgr
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jira.o-ran-sc.org jira.o-ran-sc.org
Dec 26, 2023SteVe Community ocpp-jaxb before 0.0.8 generates invalid timestamps such as ones with month 00 in certain situations (such as when an application receives a StaCVE-2023-52096 · Other software · Steve-community · reported by MITREHigh 7.5
SteVe Community ocpp-jaxb before 0.0.8 generates invalid timestamps such as ones with month 00 in certain situations (such as when an application receives a StartTransaction Open Charge Point Protocol message with a timestamp parameter of 1000000). This may lead to a SQL exception in applications, and may undermine the integrity of transaction records.
Product
Ocpp-jaxb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 21, 2023Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for: Authorization Bypass Through User-Controlled KeyCVE-2023-47191 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Authorization Bypass Through User-Controlled Key vulnerability in KaineLabs Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress.This issue affects Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress: from n/a through 1.2.2.
Product
Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 11, 2023An issue was discovered in Hyland Alfresco Community Edition through 7.2.0.CVE-2023-49964 · Other software · Hyland · reported by MITREHigh 8.8
An issue was discovered in Hyland Alfresco Community Edition through 7.2.0. By inserting malicious content in the folder.get.html.ftl file, an attacker may perform SSTI (Server-Side Template Injection) attacks, which can leverage FreeMarker exposed objects to bypass restrictions and achieve RCE (Remote Code Execution). NOTE: this issue exists because of an incomplete fix for CVE-2020-12873.
Product
Alfresco Content Services
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com alfresco.com
Nov 30, 2023Community by PeepSo – Social Network, Membership, Registration, User Profiles: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-48746 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PeepSo Community by PeepSo – Social Network, Membership, Registration, User Profiles allows Reflected XSS.This issue affects Community by PeepSo – Social Network, Membership, Registration, User Profiles: from n/a through 6.2.6.0.
Product
Community by PeepSo – Social Network, Membership, Registration, User Profiles
Affected
up to 6.2.6.0
What to do
Affects up to 6.2.6.0. Update Community by PeepSo – Social Network, Membership, Registration, User Profiles to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023Community by PeepSo – Social Network, Membership, Registration, User Profiles: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-47850 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PeepSo Community by PeepSo – Social Network, Membership, Registration, User Profiles allows Stored XSS.This issue affects Community by PeepSo – Social Network, Membership, Registration, User Profiles: from n/a through 6.2.2.0.
Product
Community by PeepSo – Social Network, Membership, Registration, User Profiles
Affected
up to 6.2.2.0
What to do
Affects up to 6.2.2.0. Update Community by PeepSo – Social Network, Membership, Registration, User Profiles to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 28, 2023Cross Site Scripting (XSS) in Search filters in Prestashop Amazzing filter version up to version 3.2.5, allows remote attackers to inject arbitrary JavaScript cCVE-2023-48042 · Other software · Communitydeveloper · reported by MITREMedium 6.1
Cross Site Scripting (XSS) in Search filters in Prestashop Amazzing filter version up to version 3.2.5, allows remote attackers to inject arbitrary JavaScript code.
Product
Amazzing Filter
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record addons.prestashop.com medium.com
Nov 22, 2023Cross-Site Request Forgery (CSRF) vulnerability in PeepSo Download Community by PeepSo plugin <= 6.1.6.0 versions.CVE-2023-39925 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in PeepSo Download Community by PeepSo plugin <= 6.1.6.0 versions.
Fixed in
6.2.0.0
What to do
Update the plugin to 6.2.0.0 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 20, 2023OpenSIS Classic Community Edition version 9.0 lacks cross-site request forgery (CSRF) protection throughout the whole app.CVE-2023-38885 · Other software · Os4ed · reported by MITREHigh 8.8
OpenSIS Classic Community Edition version 9.0 lacks cross-site request forgery (CSRF) protection throughout the whole app. This may allow an attacker to trick an authenticated user into performing any kind of state changing request.
Product
Opensis
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 20, 2023An Insecure Direct Object Reference (IDOR) vulnerability in the Community Edition version 9.0 of openSIS Classic allows an unauthenticated remote attacker to acCVE-2023-38884 · Other software · Os4ed · reported by MITREHigh 7.5
An Insecure Direct Object Reference (IDOR) vulnerability in the Community Edition version 9.0 of openSIS Classic allows an unauthenticated remote attacker to access any student's files by visiting '/assets/studentfiles/<studentId>-<filename>'
Product
Opensis
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 20, 2023A reflected cross-site scripting (XSS) vulnerability in the Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to execute arbitrarCVE-2023-38883 · Other software · Os4ed · reported by MITREMedium 6.1
A reflected cross-site scripting (XSS) vulnerability in the Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the 'ajax' parameter in 'ParentLookup.php'.
Product
Opensis
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 20, 2023A reflected cross-site scripting (XSS) vulnerability in the Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to execute arbitrarCVE-2023-38882 · Other software · Os4ed · reported by MITREMedium 6.1
A reflected cross-site scripting (XSS) vulnerability in the Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the 'include' parameter in 'ForExport.php'
Product
Opensis
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 20, 2023A reflected cross-site scripting (XSS) vulnerability in the Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to execute arbitrarCVE-2023-38881 · Other software · Os4ed · reported by MITREMedium 6.1
A reflected cross-site scripting (XSS) vulnerability in the Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into any of the 'calendar_id', 'school_date', 'month' or 'year' parameters in 'CalendarModal.php'.
Product
Opensis
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 20, 2023The Community Edition version 9.0 of OS4ED's openSIS Classic has a broken access control vulnerability in the database backup functionality.CVE-2023-38880 · Other software · Os4ed · reported by MITRECritical 9.8
The Community Edition version 9.0 of OS4ED's openSIS Classic has a broken access control vulnerability in the database backup functionality. Whenever an admin generates a database backup, the backup is stored in the web root while the file name has a format of "opensisBackup<date>.sql" (e.g. "opensisBackup07-20-2023.sql"), i.e. can easily be guessed. This file can be accessed by any unauthenticated actor and contains a dump of the whole database including password hashes.
Product
Opensis
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 20, 2023The Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to read arbitrary files via a directory traversal vulnerability in the 'filCVE-2023-38879 · Other software · Os4ed · reported by MITREHigh 7.5
The Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to read arbitrary files via a directory traversal vulnerability in the 'filename' parameter of 'DownloadWindow.php'.
Product
Opensis
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 20, 2023The Strapi Protected Populate Plugin protects `get` endpoints from revealing too much information.CVE-2023-48218 · Other software · strapi-community · reported by GitHubMedium 5.3
The Strapi Protected Populate Plugin protects `get` endpoints from revealing too much information. Prior to version 1.3.4, users were able to bypass the field level security. Users who tried to populate something that they didn't have access to could populate those fields anyway. This issue has been patched in version 1.3.4. There are no known workarounds.
Product
strapi-plugin-protected-populate
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 10, 2023Use after free in OpenVPN version 2.6.0 to 2.6.6 may lead to undefined behavoir, leaking memory buffers or remote execution when sending network buffers to a reCVE-2023-46850 · Other software · OpenVPN · reported by security@openvpn.netCritical 9.8
Use after free in OpenVPN version 2.6.0 to 2.6.6 may lead to undefined behavoir, leaking memory buffers or remote execution when sending network buffers to a remote peer.
Product
OpenVPN 2 (Community)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.openvpn.net openvpn.net
Nov 10, 2023Using the --fragment option in certain configuration setups OpenVPN version 2.6.0 to 2.6.6 allows an attacker to trigger a divide by zero behaviour which could CVE-2023-46849 · Other software · OpenVPN · reported by security@openvpn.netHigh 7.5
Using the --fragment option in certain configuration setups OpenVPN version 2.6.0 to 2.6.6 allows an attacker to trigger a divide by zero behaviour which could cause an application crash, leading to a denial of service.
Product
OpenVPN 2 (Community)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.openvpn.net lists.fedoraproject.org
Nov 10, 2023Discourse is an open source platform for community discussion.CVE-2023-47121 · Other software · discourse · reported by GitHubLow 3.4
Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches, the embedding feature is susceptible to server side request forgery. The issue is patched in version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches. As a workaround, disable the Embedding feature.
Product
discourse
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 10, 2023Discourse is an open source platform for community discussion.CVE-2023-47120 · Other software · discourse · reported by GitHubHigh 7.5
Discourse is an open source platform for community discussion. In versions 3.1.0 through 3.1.2 of the `stable` branch and versions 3.1.0,beta6 through 3.2.0.beta2 of the `beta` and `tests-passed` branches, Redis memory can be depleted by crafting a site with an abnormally long favicon URL and drafting multiple posts which Onebox it. The issue is patched in version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches. There are no known workarounds.
Product
discourse
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 10, 2023Discourse is an open source platform for community discussion.CVE-2023-47119 · Other software · discourse · reported by GitHubMedium 5.3
Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches, some links can inject arbitrary HTML tags when rendered through our Onebox engine. The issue is patched in version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches. There are no known workarounds.
Product
discourse
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 10, 2023Discourse is an open source platform for community discussion.CVE-2023-46130 · Other software · discourse · reported by GitHubMedium 4.3
Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches, some theme components allow users to add svgs with unlimited `height` attributes, and this can affect the availability of subsequent replies in a topic. Most Discourse instances are unaffected, only instances with the svgbob or the mermaid theme component are within scope. The issue is patched in version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches. As a workaround, disable or remove the relevant theme components.
Product
discourse
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 10, 2023Discourse is an open source platform for community discussion.CVE-2023-45816 · Other software · discourse · reported by GitHubLow 3.3
Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches, there is an edge case where a bookmark reminder is sent and an unread notification is generated, but the underlying bookmarkable (e.g. post, topic, chat message) security has changed, making it so the user can no longer access the underlying resource. As of version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches, bookmark reminders are now no longer sent if the user does not have access to the underlying bookmarkable, and also the unread bookmark notifications are always filtered by access. There are no known workarounds.
Product
discourse
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 10, 2023Discourse is an open source platform for community discussion.CVE-2023-45806 · Other software · discourse · reported by GitHubMedium 4.3
Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches, if a user has been quoted and uses a `|` in their full name, they might be able to trigger a bug that generates a lot of duplicate content in all the posts they've been quoted by updating their full name again. Version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches contain a patch for this issue. No known workaround exists, although one can stop the "bleeding" by ensuring users only use alphanumeric characters in their full name field.
Product
discourse
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 9, 2023Cross-Site Request Forgery (CSRF) vulnerability in PeepSo Community by PeepSo – Social Network, Membership, Registration, User Profiles plugin <= 6.0.9.0 versioCVE-2023-32092 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in PeepSo Community by PeepSo – Social Network, Membership, Registration, User Profiles plugin <= 6.0.9.0 versions.
Fixed in
6.1.0.0
What to do
Update the plugin to 6.1.0.0 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 25, 2023Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.CVE-2023-46119 · Other software · parse-community · reported by GitHubHigh 7.5
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Parse Server crashes when uploading a file without extension. This vulnerability has been patched in versions 5.5.6 and 6.3.1.
Product
parse-server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 23, 2023A stored cross-site scripting (XSS) vulnerability in UVDesk Community Skeleton v1.1.1 allows attackers to execute arbitrary web scripts or HTML via a crafted paCVE-2023-37636 · Other software · Webkul · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in UVDesk Community Skeleton v1.1.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Message field when creating a ticket.
Product
Uvdesk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record esecforte.com esecforte.com
Oct 23, 2023UVDesk Community Skeleton v1.1.1 allows unauthenticated attackers to perform brute force attacks on the login page to gain access to the application.CVE-2023-37635 · Other software · Uvdesk · reported by MITRECritical 9.8
UVDesk Community Skeleton v1.1.1 allows unauthenticated attackers to perform brute force attacks on the login page to gain access to the application.
Product
Community-skeleton
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record esecforte.com esecforte.com
Oct 16, 2023OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana following the license change in early 2021.CVE-2023-45807 · Other software · opensearch-project · reported by GitHubMedium 5.4
OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana following the license change in early 2021. There is an issue with the implementation of tenant permissions in OpenSearch Dashboards where authenticated users with read-only access to a tenant can perform create, edit and delete operations on index metadata of dashboards and visualizations in that tenant, potentially rendering them unavailable. This issue does not affect index data, only metadata. Dashboards correctly enforces read-only permissions when indexing and updating documents. This issue does not provide additional read access to data users don’t already have. This issue can be mitigated by disabling the tenants functionality for the cluster. Versions 1.3.14 and 2.11.0 contain a fix for this issue.
Product
security
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 16, 2023Discourse is an open source platform for community discussion.CVE-2023-45131 · Other software · discourse · reported by GitHubHigh 7.5
Discourse is an open source platform for community discussion. New chat messages can be read by making an unauthenticated POST request to MessageBus. This issue is patched in the 3.1.1 stable and 3.2.0.beta2 versions of Discourse. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Product
discourse
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 16, 2023Discourse is an open source platform for community discussion.CVE-2023-44391 · Other software · discourse · reported by GitHubMedium 5.3
Discourse is an open source platform for community discussion. User summaries are accessible for anonymous users even when `hide_user_profiles_from_public` is enabled. This problem has been patched in the 3.1.1 stable and 3.2.0.beta2 version of Discourse. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Product
discourse
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 16, 2023Discourse is an open source platform for community discussion.CVE-2023-44388 · Other software · discourse · reported by GitHubHigh 7.5
Discourse is an open source platform for community discussion. A malicious request can cause production log files to quickly fill up and thus result in the server running out of disk space. This problem has been patched in the 3.1.1 stable and 3.2.0.beta2 versions of Discourse. It is possible to temporarily work around this problem by reducing the `client_max_body_size nginx directive`. `client_max_body_size` will limit the size of uploads that can be uploaded directly to the server.
Product
discourse
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nginx.org github.com
Oct 16, 2023Discourse is an open source platform for community discussion.CVE-2023-43814 · Other software · discourse · reported by GitHubLow 3.7
Discourse is an open source platform for community discussion. Attackers with details specific to a poll in a topic can use the `/polls/grouped_poll_results` endpoint to view the content of options in the poll and the number of votes for groups of poll participants. This impacts private polls where the results were intended to only be viewable by authorized users. This issue is patched in the 3.1.1 stable and 3.2.0.beta2 versions of Discourse. There is no workaround for this issue apart from upgrading to the fixed version.
Product
discourse
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.