Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,355 results · page 13 of 28
Oct 11, 2022The d8s-utility package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-41386 · Other software · Democritus · reported by MITRECritical 9.8
The d8s-utility package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-urls package. The affected version is 0.1.0.
- Product
- D8s-utility
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2022The d8s-html package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-41385 · Other software · Democritus · reported by MITRECritical 9.8
The d8s-html package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-urls package. The affected version is 0.1.0.
- Product
- D8s-html
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2022The d8s-domains package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-41384 · Other software · Democritus · reported by MITRECritical 9.8
The d8s-domains package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-urls package. The affected version is 0.1.0.
- Product
- D8s-domains
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2022The d8s-archives package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-41383 · Other software · Democritus · reported by MITRECritical 9.8
The d8s-archives package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-file-system package. The affected version is 0.1.0.
- Product
- D8s-archives
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2022The d8s-json package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-41382 · Other software · Democritus · reported by MITRECritical 9.8
The d8s-json package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-file-system package. The affected version is 0.1.0.
- Product
- D8s-json
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2022The d8s-utility package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-41381 · Other software · Democritus · reported by MITRECritical 9.8
The d8s-utility package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-file-system package. The affected version is 0.1.0.
- Product
- D8s-utility
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2022The d8s-yaml package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-41380 · Other software · Democritus · reported by MITRECritical 9.8
The d8s-yaml package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-file-system package. The affected version is 0.1.0.
- Product
- D8s-yaml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2022Windows Distributed File System (DFS) Information Disclosure VulnerabilityCVE-2022-38025 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Windows Distributed File System (DFS) Information Disclosure Vulnerability
- Product
- Windows Server 2022
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Oct 7, 2022Exposure of sensitive information in AT_Distributor prior to SMR Oct-2022 Release 1 allows local attacker to access SerialNo via log.CVE-2022-39848 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4
Exposure of sensitive information in AT_Distributor prior to SMR Oct-2022 Release 1 allows local attacker to access SerialNo via log.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Sep 19, 2022The d8s-pdfs for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-40812 · Other software · Democritus Pdfs Project · reported by MITRECritical 9.8
The d8s-pdfs for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-file-system package. The affected version is 0.1.0.
- Product
- Democritus Pdfs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2022The d8s-ip-addresses for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-40810 · Other software · Democritus IP Addresses Project · reported by MITRECritical 9.8
The d8s-ip-addresses for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-hypothesis package. The affected version is 0.1.0
- Product
- Democritus IP Addresses
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2022The d8s-dicts for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-40809 · Other software · Democritus Dicts Project · reported by MITRECritical 9.8
The d8s-dicts for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-hypothesis package. The affected version is 0.1.0
- Product
- Democritus Dicts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2022The d8s-strings for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-40432 · Other software · D8s-strings Project · reported by MITRECritical 9.8
The d8s-strings for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-hypothesis package. The affected version is 0.1.0.
- Product
- D8s-strings
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2022The d8s-pdfs for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-40431 · Other software · D8s-pdfs Project · reported by MITRECritical 9.8
The d8s-pdfs for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-networking package. The affected version is 0.1.0.
- Product
- D8s-pdfs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2022The d8s-utility for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-40430 · Other software · D8s-utility Project · reported by MITRECritical 9.8
The d8s-utility for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-networking package. The affected version is 0.1.0.
- Product
- D8s-utility
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2022The d8s-ip-addresses for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-40429 · Other software · D8s-ip-addresses Project · reported by MITRECritical 9.8
The d8s-ip-addresses for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-networking package. The affected version is 0.1.0.
- Product
- D8s-ip-addresses
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2022The d8s-mpeg for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-40428 · Other software · D8s-mpeg Project · reported by MITRECritical 9.8
The d8s-mpeg for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-networking package. The affected version is 0.1.0.
- Product
- D8s Mpeg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2022The d8s-asns for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-40426 · Other software · D8s-asns Project · reported by MITRECritical 9.8
The d8s-asns for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-networking package. The affected version is 0.1.0.
- Product
- D8s-asns
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2022The d8s-html for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-40425 · Other software · D8s-html Project · reported by MITRECritical 9.8
The d8s-html for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-networking package. The affected version is 0.1.0.
- Product
- D8s-html
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2022The d8s-python for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-38887 · Other software · D8s-python Project · reported by MITRECritical 9.8
The d8s-python for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The democritus-strings package. The affected version is 0.1.0.
- Product
- D8s-python
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2022The d8s-xml for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-38886 · Other software · D8s-xml Project · reported by MITRECritical 9.8
The d8s-xml for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-strings package. The affected version is 0.1.0.
- Product
- D8s-xml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2022The d8s-netstrings for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-38885 · Other software · D8s-netstrings Project · reported by MITRECritical 9.8
The d8s-netstrings for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-strings package. The affected version is 0.1.0.
- Product
- D8s-netstrings
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2022The d8s-grammars for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-38884 · Other software · D8s-grammars Project · reported by MITRECritical 9.8
The d8s-grammars for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-strings package. The affected version is 0.1.0.
- Product
- D8s-grammars
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2022The d8s-math for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-38883 · Other software · D8s-math Project · reported by MITRECritical 9.8
The d8s-math for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-strings package. The affected version is 0.1.0.
- Product
- D8s-math
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2022The d8s-json for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-38882 · Other software · D8s-json Project · reported by MITRECritical 9.8
The d8s-json for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-strings package. The affected version is 0.1.0.
- Product
- D8s-json
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2022The d8s-archives for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-38881 · Other software · D8s-archives Project · reported by MITRECritical 9.8
The d8s-archives for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-strings package. The affected version is 0.1.0.
- Product
- D8s-archives
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2022The d8s-urls for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-40811 · Other software · Democritus Urls Project · reported by MITRECritical 9.8
The d8s-urls for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-file-system package. The affected version is 0.1.0.
- Product
- Democritus Urls
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2022The d8s-dates for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-40808 · Other software · Democritus Dates Project · reported by MITRECritical 9.8
The d8s-dates for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-hypothesis package. The affected version is 0.1.0
- Product
- Democritus Dates
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2022The d8s-domains for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-40807 · Other software · Democritus Domains Project · reported by MITRECritical 9.8
The d8s-domains for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-hypothesis package. The affected version is 0.1.0
- Product
- Democritus Domains
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2022The d8s-uuids for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-40806 · Other software · Democritus Uuids Project · reported by MITRECritical 9.8
The d8s-uuids for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-hypothesis package. The affected version is 0.1.0
- Product
- Democritus Uuids
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2022The d8s-urls for python 0.1.0, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-40805 · Other software · Democritus Urls Project · reported by MITRECritical 9.8
The d8s-urls for python 0.1.0, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor inserted by third parties is the democritus-hypothesis package.
- Product
- Democritus Urls
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2022The d8s-domains for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-40427 · Other software · Democritus Domains Project · reported by MITRECritical 9.8
The d8s-domains for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-networking package. The affected version is 0.1.0
- Product
- Democritus Domains
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2022The d8s-urls for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-40424 · Other software · Democritus Urls Project · reported by MITRECritical 9.8
The d8s-urls for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor inserted by third parties is the democritus-networking package. The affected version of d8s-urls is 0.1.0
- Product
- Democritus Urls
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2022The d8s-urls for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-38880 · Other software · Democritus Urls Project · reported by MITRECritical 9.8
The d8s-urls for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The affected version is 0.1.0.
- Product
- Democritus Urls
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2022Windows Distributed File System (DFS) Elevation of Privilege VulnerabilityCVE-2022-34719 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Windows Distributed File System (DFS) Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Sep 13, 2022Talos Linux is a Linux distribution built for Kubernetes deployments.CVE-2022-36103 · Other software · siderolabs · reported by GitHubHigh 7.2
Talos Linux is a Linux distribution built for Kubernetes deployments. Talos worker nodes use a join token to get accepted into the Talos cluster. Due to improper validation of the request while signing a worker node CSR (certificate signing request) Talos control plane node might issue Talos API certificate which allows full access to Talos API on a control plane node. Accessing Talos API with full level access on a control plane node might reveal sensitive information which allows full level access to the cluster (Kubernetes and Talos PKI, etc.). Talos API join token is stored in the machine configuration on the worker node. When configured correctly, Kubernetes workloads don't have access to the machine configuration, but due to a misconfiguration workload might access the machine configuration and reveal the join token. This problem has been fixed in Talos 1.2.2. Enabling the Pod Security Standards mitigates the vulnerability by denying hostPath mounts and host networking by default in the baseline policy. Clusters that don't run untrusted workloads are not affected. Clusters with correct Pod Security configurations which don't allow hostPath mounts, and secure access to cloud m
- Product
- talos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2022indy-node is the server portion of Hyperledger Indy, a distributed ledger purpose-built for decentralized identity.CVE-2022-31006 · Other software · hyperledger · reported by GitHubHigh 7.5
indy-node is the server portion of Hyperledger Indy, a distributed ledger purpose-built for decentralized identity. In vulnerable versions of indy-node, an attacker can max out the number of client connections allowed by the ledger, leaving the ledger unable to be used for its intended purpose. However, the ledger content will not be impacted and the ledger will resume functioning after the attack. This attack exploits the trade-off between resilience and availability. Any protection against abusive client connections will also prevent the network being accessed by certain legitimate users. As a result, validator nodes must tune their firewall rules to ensure the right trade-off for their network's expected users. The guidance to network operators for the use of firewall rules in the deployment of Indy networks has been modified to better protect against denial of service attacks by increasing the cost and complexity in mounting such attacks. The mitigation for this vulnerability is not in the Hyperledger Indy code per se, but rather in the individual deployments of Indy. The mitigations should be applied to all deployments of Indy, and are not related to a particular release.
- Product
- indy-node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2022Indy Node is the server portion of a distributed ledger purpose-built for decentralized identity.CVE-2022-31020 · Other software · hyperledger · reported by GitHubHigh 8.8
Indy Node is the server portion of a distributed ledger purpose-built for decentralized identity. In versions 1.12.4 and prior, the `pool-upgrade` request handler in Indy-Node allows an improperly authenticated attacker to remotely execute code on nodes within the network. The `pool-upgrade` request handler in Indy-Node 1.12.5 has been updated to properly authenticate pool-upgrade transactions before any processing is performed by the request handler. The transactions are further sanitized to prevent remote code execution. As a workaround, endorsers should not create DIDs for untrusted users. A vulnerable ledger should configure `auth_rules` to prevent new DIDs from being written to the ledger until the network can be upgraded.
- Product
- indy-node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2022NVIDIA’s distribution of the Data Plane Development Kit (MLNX_DPDK) contains a vulnerability in the network stack, where error recovery is not handled properly,CVE-2022-28199 · Other software · NVIDIA · reported by psirt@nvidia.comMedium 6.5
NVIDIA’s distribution of the Data Plane Development Kit (MLNX_DPDK) contains a vulnerability in the network stack, where error recovery is not handled properly, which can allow a remote attacker to cause denial of service and some impact to data integrity and confidentiality.
- Product
- NVIDIA FLARE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comnvidia.custhelp.com
Aug 18, 2022Uncontrolled search path in the Intel(R) Distribution for Python before version 2022.0.3 may allow an authenticated user to potentially enable escalation of priCVE-2022-28696 · Other software · Intel · reported by secure@intel.comHigh 7.8
Uncontrolled search path in the Intel(R) Distribution for Python before version 2022.0.3 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- Distribution For Python
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2022Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applications.CVE-2022-36023 · Other software · hyperledger · reported by GitHubHigh 7
Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applications. If a gateway client application sends a malformed request to a gateway peer it may crash the peer node. Version 2.4.6 checks for the malformed gateway request and returns an error to the gateway client. There are no known workarounds, users must upgrade to version 2.4.6.
- Product
- fabric
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 1, 2022An issue in the login and reset password functionality of Backdrop CMS v1.22.0 allows attackers to enumerate usernames via password reset requests and distinct CVE-2022-34530 · Other software · Backdropcms · reported by MITREMedium 5.3
An issue in the login and reset password functionality of Backdrop CMS v1.22.0 allows attackers to enumerate usernames via password reset requests and distinct responses returned based on usernames.
- Product
- Backdrop CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2022The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords.CVE-2022-29965 · Other software · Emerson · reported by MITREMedium 5.5
The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. Access to privileged operations on the maintenance port TELNET interface (23/TCP) on M-series and SIS (CSLS/LSNB/LSNG) nodes is controlled by means of utility passwords. These passwords are generated using a deterministic, insecure algorithm using a single seed value composed of a day/hour/minute timestamp with less than 16 bits of entropy. The seed value is fed through a lookup table and a series of permutation operations resulting in three different four-character passwords corresponding to different privilege levels. An attacker can easily reconstruct these passwords and thus gain access to privileged maintenance operations. NOTE: this is different from CVE-2014-2350.
- Product
- Deltav Distributed Control System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2022The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords.CVE-2022-29964 · Other software · Emerson · reported by MITREMedium 5.5
The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. WIOC SSH provides access to a shell as root, DeltaV, or backup via hardcoded credentials. NOTE: this is different from CVE-2014-2350.
- Product
- Deltav Distributed Control System SQ Controller Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2022The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords.CVE-2022-29963 · Other software · Emerson · reported by MITREMedium 5.5
The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. TELNET on port 18550 provides access to a root shell via hardcoded credentials. This affects S-series, P-series, and CIOC/EIOC nodes. NOTE: this is different from CVE-2014-2350.
- Product
- Deltav Distributed Control System SQ Controller Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2022The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords.CVE-2022-29962 · Other software · Emerson · reported by MITREMedium 5.5
The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. FTP has hardcoded credentials (but may often be disabled in production). This affects S-series, P-series, and CIOC/EIOC nodes. NOTE: this is different from CVE-2014-2350.
- Product
- Deltav Distributed Control System SQ Controller Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2022The Emerson DeltaV Distributed Control System (DCS) through 2022-04-29 mishandles authentication.CVE-2022-29957 · Other software · Emerson · reported by MITREHigh 7.8
The Emerson DeltaV Distributed Control System (DCS) through 2022-04-29 mishandles authentication. It utilizes several proprietary protocols for a wide variety of functionality. These protocols include Firmware upgrade (18508/TCP, 18518/TCP); Plug-and-Play (18510/UDP); Hawk services (18507/UDP); Management (18519/TCP); Cold restart (18512/UDP); SIS communications (12345/TCP); and Wireless Gateway Protocol (18515/UDP). None of these protocols have any authentication features, allowing any attacker capable of communicating with the ports in question to invoke (a subset of) desired functionality.
- Product
- Deltav Distributed Control System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2022Git is a distributed revision control system.CVE-2022-29187 · Other software · git · reported by GitHubHigh 7.8
Git is a distributed revision control system. Git prior to versions 2.37.1, 2.36.2, 2.35.4, 2.34.4, 2.33.4, 2.32.3, 2.31.4, and 2.30.5, is vulnerable to privilege escalation in all platforms. An unsuspecting user could still be affected by the issue reported in CVE-2022-24765, for example when navigating as root into a shared tmp directory that is owned by them, but where an attacker could create a git repository. Versions 2.37.1, 2.36.2, 2.35.4, 2.34.4, 2.33.4, 2.32.3, 2.31.4, and 2.30.5 contain a patch for this issue. The simplest way to avoid being affected by the exploit described in the example is to avoid running git as root (or an Administrator in Windows), and if needed to reduce its use to a minimum. While a generic workaround is not possible, a system could be hardened from the exploit described in the example by removing any such repository if it exists already and creating one as root to block any future attacks.
- Product
- git
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgopenwall.com
Jul 7, 2022Hyperledger Fabric is a permissioned distributed ledger framework.CVE-2022-31121 · Other software · hyperledger · reported by GitHubHigh 7.5
Hyperledger Fabric is a permissioned distributed ledger framework. In affected versions if a consensus client sends a malformed consensus request to an orderer it may crash the orderer node. A fix has been added in commit 0f1835949 which checks for missing consensus messages and returns an error to the consensus client should the message be missing. Users are advised to upgrade to versions 2.2.7 or v2.4.5. There are no known workarounds for this issue.
- Product
- fabric
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2022A user with administrative privileges in Distributed Data Systems WebHMI 4.1.1.7662 can store a script that could impact other logged in users.CVE-2022-2254 · Other software · Distributed Data Systems · reported by ics-cert@hq.dhs.govMedium 6.2
A user with administrative privileges in Distributed Data Systems WebHMI 4.1.1.7662 can store a script that could impact other logged in users.
- Product
- WebHMI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.