Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

472new WordPress flaws this week

390,714entries in the database

1,002 results · page 13 of 21

Dec 13, 2023Scrypted is a home video integration and automation platform.CVE-2023-47620 · Other software · koush · reported by GitHubMedium 6.1
Scrypted is a home video integration and automation platform. In versions 0.55.0 and prior, a reflected cross-site scripting vulnerability exists in the plugin-http.ts file via the `owner' and 'pkg` parameters. An attacker can run arbitrary JavaScript code.
Product
scrypted
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com securitylab.github.com
Dec 12, 2023 Hitachi Vantara Pentaho Data Integration & Analytics versions before 9.5.0.1 and 9.3.0.5, including 8.3.x does not restrict JNDI identifiers during the creatiCVE-2023-3517 · Other software · Hitachi Vantara · reported by security.vulnerabilities@hitachivantara.comHigh 8.5
Hitachi Vantara Pentaho Data Integration & Analytics versions before 9.5.0.1 and 9.3.0.5, including 8.3.x does not restrict JNDI identifiers during the creation of XActions, allowing control of system level data sources.
Product
Pentaho Data Integration & Analytics
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.pentaho.com support.pentaho.com
Dec 12, 2023SAS application is vulnerable to Reflected Cross-Site Scripting (XSS).CVE-2023-4932 · Other software · SAS Institute · reported by cvd@cert.plMedium 6.3
SAS application is vulnerable to Reflected Cross-Site Scripting (XSS). Improper input validation in the `_program` parameter of the the `/SASStoredProcess/do` endpoint allows arbitrary JavaScript to be executed when specially crafted URL is opened by an authenticated user. The attack is possible from a low-privileged user. Only versions 9.4_M7 and 9.4_M8 were tested and confirmed to be vulnerable, status of others is unknown. For above mentioned versions hot fixes were published.
Product
SAS Integration Technologies
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.pl cert.pl
Dec 11, 2023SAP BTP Security Services Integration Library ([Golang] github.com/sap/cloud-security-client-go) - versions < 0.17.0, allow under certain conditions an escalatiCVE-2023-50424 · Network & remote access · SAP_SE · reported by cna@sap.comCritical 9.1
SAP BTP Security Services Integration Library ([Golang] github.com/sap/cloud-security-client-go) - versions < 0.17.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application.
Product
github.com/sap/cloud-security-client-go
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blogs.sap.com github.com
Dec 11, 2023SAP BTP Security Services Integration Library ([Python] sap-xssec) - versions < 4.1.0, allow under certain conditions an escalation of privileges.CVE-2023-50423 · Network & remote access · SAP_SE · reported by cna@sap.comCritical 9.1
SAP BTP Security Services Integration Library ([Python] sap-xssec) - versions < 4.1.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application.
Product
sap-xssec
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blogs.sap.com github.com
Dec 11, 2023SAP BTP Security Services Integration Library ([Java] cloud-security-services-integration-library) - versions below 2.17.0 and versions from 3.0.0 to before 3.3CVE-2023-50422 · Network & remote access · SAP_SE · reported by cna@sap.comCritical 9.1
SAP BTP Security Services Integration Library ([Java] cloud-security-services-integration-library) - versions below 2.17.0 and versions from 3.0.0 to before 3.3.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application.
Product
cloud-security-services-integration-library
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blogs.sap.com github.com
Dec 11, 2023SAP BTP Security Services Integration Library ([Node.js] @sap/xssec - versions < 3.6.0, allow under certain conditions an escalation of privileges.CVE-2023-49583 · Network & remote access · SAP_SE · reported by cna@sap.comCritical 9.1
SAP BTP Security Services Integration Library ([Node.js] @sap/xssec - versions < 3.6.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application.
Product
@sap/xssec
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blogs.sap.com me.sap.com
Dec 11, 2023Improper Input Validation vulnerability in GStreamer integration of The Document Foundation LibreOffice allows an attacker to execute arbitrary GStreamer pluginCVE-2023-6185 · Other software · The Document Foundation · reported by security@documentfoundation.orgHigh 8.3
Improper Input Validation vulnerability in GStreamer integration of The Document Foundation LibreOffice allows an attacker to execute arbitrary GStreamer plugins. In affected versions the filename of the embedded video is not sufficiently escaped when passed to GStreamer enabling an attacker to run arbitrary gstreamer plugins depending on what plugins are installed on the target system.
Product
LibreOffice
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.debian.org lists.fedoraproject.org
Dec 7, 2023Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms: URL Redirection to Untrusted Site ('Open Redirect')CVE-2023-47779 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks. Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms.This issue affects Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms: from n/a through 1.1.4.
Product
Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 1, 2023Improper neutralization of input in Jira integration configuration in GitLab CE/EE, affecting all versions from 15.10 prior to 16.6.1, 16.5 prior to 16.5.3, andCVE-2023-6033 · Websites & servers · GitLab · reported by cve@gitlab.comHigh 8.7
Improper neutralization of input in Jira integration configuration in GitLab CE/EE, affecting all versions from 15.10 prior to 16.6.1, 16.5 prior to 16.5.3, and 16.4 prior to 16.4.3 allows attacker to execute javascript in victim's browser.
Product
GitLab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gitlab.com hackerone.com
Nov 14, 2023Microsoft Host Integration Server 2020 Remote Code Execution VulnerabilityCVE-2023-38151 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Microsoft Host Integration Server 2020 Remote Code Execution Vulnerability
Product
Host Integration Server 2020
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com msrc.microsoft.com
Nov 9, 2023application-collabora is an integration of Collabora Online in XWiki.CVE-2023-46743 · Other software · xwikisas · reported by GitHubHigh 7.3
application-collabora is an integration of Collabora Online in XWiki. As part of the application use cases, depending on the rights that a user has over a document, they should be able to open the office attachments files in view or edit mode. Currently, if a user opens an attachment file in edit mode in collabora, this right will be preserved for all future users, until the editing session is closes, even if some of them have only view right. Collabora server is the one issuing this request and it seems that the `userCanWrite` query parameter is cached, even if, for example, token is not. This issue has been patched in version 1.3.
Product
application-collabora
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 7, 2023The affected versions of MongoDB Atlas Kubernetes Operator may print sensitive information like GCP service account keys and API integration secrets while DEBUGCVE-2023-0436 · Other software · MongoDB Inc · reported by cna@mongodb.comMedium 4.5
The affected versions of MongoDB Atlas Kubernetes Operator may print sensitive information like GCP service account keys and API integration secrets while DEBUG mode logging is enabled. This issue affects MongoDB Atlas Kubernetes Operator versions: 1.5.0, 1.6.0, 1.6.1, 1.7.0. Please note that this is reported on an EOL version of the product, and users are advised to upgrade to the latest supported version. Required Configuration: DEBUG logging is not enabled by default, and must be configured by the end-user. To check the log-level of the Operator, review the flags passed in your deployment configuration (eg. https://github.com/mongodb/mongodb-atlas-kubernetes/blob/main/config/manager/manager.yaml#L27 https://github.com/mongodb/mongodb-atlas-kubernetes/blob/main/config/manager/manager.yaml#L27 )
Product
MongoDB Atlas Kubernetes Operator
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 1, 2023A vulnerability in the SSL/TLS certificate handling of Snort 3 Detection Engine integration with Cisco Firepower Threat Defense (FTD) Software could allow an unCVE-2023-20031 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4
A vulnerability in the SSL/TLS certificate handling of Snort 3 Detection Engine integration with Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the Snort 3 detection engine to restart. This vulnerability is due to a logic error that occurs when an SSL/TLS certificate that is under load is accessed when it is initiating an SSL connection. Under specific, time-based constraints, an attacker could exploit this vulnerability by sending a high rate of SSL/TLS connection requests to be inspected by the Snort 3 detection engine on an affected device. A successful exploit could allow the attacker to cause the Snort 3 detection engine to reload, resulting in either a bypass or a denial of service (DoS) condition, depending on device configuration. The Snort detection engine will restart automatically. No manual intervention is required.
Product
Cisco Firepower Threat Defense Software
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sec.cloudapps.cisco.com sec.cloudapps.cisco.com
Oct 25, 2023PingFederate using the PingOne MFA adapter allows a new MFA device to be paired without requiring second factor authentication from an existing registered devicCVE-2023-39231 · Other software · Ping Identity · reported by responsible-disclosure@pingidentity.comHigh 7.3
PingFederate using the PingOne MFA adapter allows a new MFA device to be paired without requiring second factor authentication from an existing registered device. A threat actor may be able to exploit this vulnerability to register their own MFA device if they have knowledge of a victim user's first factor credentials.
Product
PingOne MFA Integration Kit
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.pingidentity.com pingidentity.com
Oct 22, 2023iTerm2 before 3.4.20 allow (potentially remote) code execution because of mishandling of certain escape sequences related to tmux integration.CVE-2023-46300 · Other software · Iterm2 · reported by MITRECritical 9.8
iTerm2 before 3.4.20 allow (potentially remote) code execution because of mishandling of certain escape sequences related to tmux integration.
Product
Iterm2
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.solidsnail.com github.com
Oct 16, 2023Active Directory Integration / LDAP Integration: Stores sensitive LDAP logs in a buffer fileCVE-2023-5003 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Active Directory Integration / LDAP Integration WordPress plugin before 4.1.10 stores sensitive LDAP logs in a buffer file when an administrator wants to export said logs. Unfortunately, this log file is never removed, and remains accessible to any users knowing the URL to do so.
Product
Active Directory Integration / LDAP Integration
Fixed in
4.1.10
What to do
Update Active Directory Integration / LDAP Integration to 4.1.10 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 14, 2023IBM App Connect Enterprise 11.0.0.1 through 11.0.0.23, 12.0.1.0 through 12.0.10.0 and IBM Integration Bus 10.1 through 10.1.0.1 are vulnerable to a denial of seCVE-2023-45176 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.2
IBM App Connect Enterprise 11.0.0.1 through 11.0.0.23, 12.0.1.0 through 12.0.10.0 and IBM Integration Bus 10.1 through 10.1.0.1 are vulnerable to a denial of service for integration nodes on Windows. IBM X-Force ID: 247998.
Product
App Connect Enterprise
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com
Sep 28, 2023Font Awesome Integration: Stored Cross-Site ScriptingCVE-2023-5233 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Font Awesome Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'fawesome' shortcode in versions up to, and including, 5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Font Awesome Integration
Affected
up to 5.0
What to do
Affects up to 5.0. Update Font Awesome Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 27, 2023Active Directory Integration / LDAP Integration: LDAP PassbackCVE-2023-4506 · WordPress plugins & themes · reported by WordfenceLow 2.2
The Active Directory Integration / LDAP Integration plugin for WordPress is vulnerable to LDAP Passback in versions up to, and including, 4.1.10. This is due to insufficient validation when changing the LDAP server. This makes it possible for authenticated attackers, with administrative access and above, to change the LDAP server and retrieve the credentials for the original LDAP server.
Product
Active Directory Integration / LDAP Integration
Affected
up to 4.1.10
What to do
Affects up to 4.1.10. Update Active Directory Integration / LDAP Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record medium.com plugins.trac.wordpress.org
Sep 22, 2023WP-Matomo Integration (WP-Piwik): Stored Cross-Site ScriptingCVE-2023-4774 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP-Matomo Integration (WP-Piwik) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wp-piwik' shortcode in versions up to, and including, 1.0.28 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP-Matomo Integration (WP-Piwik)
Affected
up to 1.0.28
What to do
Affects up to 1.0.28. Update WP-Matomo Integration (WP-Piwik) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 6, 2023Jenkins Pipeline Maven Integration Plugin 1330.v18e473854496 and earlier does not properly mask (i.e., replace with asterisks) usernames of credentials specifieCVE-2023-41934 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 5.3
Jenkins Pipeline Maven Integration Plugin 1330.v18e473854496 and earlier does not properly mask (i.e., replace with asterisks) usernames of credentials specified in custom Maven settings in Pipeline build logs if "Treat username as secret" is checked.
Product
Jenkins Pipeline Maven Integration Plugin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com jenkins.io
Sep 5, 2023disintegration Imaging 1.6.2 allows attackers to cause a panic (because of an integer index out of range during a Grayscale call) via a crafted TIFF file to theCVE-2023-36308 · Other software · Disintegration · reported by MITREMedium 5.5
disintegration Imaging 1.6.2 allows attackers to cause a panic (because of an integer index out of range during a Grayscale call) via a crafted TIFF file to the scan function of scanner.go. NOTE: it is unclear whether there are common use cases in which this panic could have any security consequence
Product
Imaging
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 16, 2023 Dell Storage Integration Tools for VMware (DSITV) and Dell Storage vSphere Client Plugin (DSVCP) versions prior to 6.1.1 and Replay Manager for VMware (RMSV)CVE-2023-39250 · Other software · Dell · reported by security_alert@emc.comHigh 7.8
Dell Storage Integration Tools for VMware (DSITV) and Dell Storage vSphere Client Plugin (DSVCP) versions prior to 6.1.1 and Replay Manager for VMware (RMSV) versions prior to 3.1.2 contain an information disclosure vulnerability. A local low-privileged malicious user could potentially exploit this vulnerability to retrieve an encryption key that could aid in further attacks.
Product
Dell Storage Integration Tools for VMware (DSITV), Dell Storage vSphere Client Plugin (DSVCP), Replay Manager for VMware (RMSV)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record dell.com dell.com
Aug 7, 2023In SAP NetWeaver Process Integration - versions SAP_XIESR 7.50, SAP_XITOOL 7.50, SAP_XIAF 7.50, user-controlled inputs, if not sufficiently encoded, could resulCVE-2023-37488 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.1
In SAP NetWeaver Process Integration - versions SAP_XIESR 7.50, SAP_XITOOL 7.50, SAP_XIAF 7.50, user-controlled inputs, if not sufficiently encoded, could result in Cross-Site Scripting (XSS) attack. On successful exploitation the attacker can cause limited impact on confidentiality and integrity of the system.
Product
SAP NetWeaver Process Integration
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record me.sap.com sap.com
Aug 3, 2023 Due to insufficient file permissions, unprivileged users could gain access to unencrypted user credentials that are used in the integration interface towards 3CVE-2023-21408 · Other software · Axis Communications AB · reported by product-security@axis.comHigh 8.4
Due to insufficient file permissions, unprivileged users could gain access to unencrypted user credentials that are used in the integration interface towards 3rd party systems.
Product
AXIS License Plate Verifier
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record axis.com axis.com
Jul 30, 2023 IBM B2B Advanced Communications 1.0.0.0 and IBM Multi-Enterprise Integration Gateway 1.0.0.1 could allow a user to cause a denial of service due to the deseriaCVE-2023-24971 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.5
IBM B2B Advanced Communications 1.0.0.0 and IBM Multi-Enterprise Integration Gateway 1.0.0.1 could allow a user to cause a denial of service due to the deserializing of untrusted serialized Java objects. IBM X-Force ID: 246976.
Product
B2B Advanced Communications
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com
Jul 30, 2023IBM B2B Advanced Communications 1.0.0.0 and IBM Multi-Enterprise Integration Gateway 1.0.0.1 are vulnerable to cross-site scripting.CVE-2023-22595 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.4
IBM B2B Advanced Communications 1.0.0.0 and IBM Multi-Enterprise Integration Gateway 1.0.0.1 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 244076.
Product
B2B Advanced Communications
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ibm.com ibm.com
Jul 25, 2023In JetBrains TeamCity before 2023.05.2 reflected XSS via GitHub integration was possibleCVE-2023-39175 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.6
In JetBrains TeamCity before 2023.05.2 reflected XSS via GitHub integration was possible
Product
TeamCity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jetbrains.com jetbrains.com
Jul 25, 2023In JetBrains TeamCity before 2023.05.2 a ReDoS attack was possible via integration with issue trackersCVE-2023-39174 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.3
In JetBrains TeamCity before 2023.05.2 a ReDoS attack was possible via integration with issue trackers
Product
TeamCity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jetbrains.com jetbrains.com
Jul 12, 2023WooCommerce Etsy Integration: Cross-Site Request ForgeryCVE-2021-4409 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WooCommerce Etsy Integration plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.3.1. This is due to missing or incorrect nonce validation on the etcpf_delete_feed() function. This makes it possible for unauthenticated attackers to delete an export feed via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
WooCommerce Etsy Integration
Affected
up to 3.3.1
What to do
Affects up to 3.3.1. Update WooCommerce Etsy Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Jul 10, 2023The Runtime Workbench (RWB) of SAP NetWeaver Process Integration - version SAP_XITOOL 7.50, does not perform authentication checks for certain functionalities tCVE-2023-35873 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.5
The Runtime Workbench (RWB) of SAP NetWeaver Process Integration - version SAP_XITOOL 7.50, does not perform authentication checks for certain functionalities that require user identity. An unauthenticated user might access technical data about the product status and its configuration. The vulnerability does not allow access to sensitive information or administrative functionalities. On successful exploitation an attacker can cause limited impact on confidentiality and availability of the application.
Product
SAP NetWeaver Process Integration (Runtime Workbench)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record me.sap.com sap.com
Jul 10, 2023The Message Display Tool (MDT) of SAP NetWeaver Process Integration - version SAP_XIAF 7.50, does not perform authentication checks for certain functionalities CVE-2023-35872 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.5
The Message Display Tool (MDT) of SAP NetWeaver Process Integration - version SAP_XIAF 7.50, does not perform authentication checks for certain functionalities that require user identity. An unauthenticated user might access technical data about the product status and its configuration. The vulnerability does not allow access to sensitive information or administrative functionalities. On successful exploitation an attacker can cause limited impact on confidentiality and availability of the application.
Product
SAP NetWeaver Process Integration (Message Display Tool)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record me.sap.com sap.com
Jul 5, 2023icingaweb2-module-jira provides integration with Atlassian Jira.CVE-2023-30607 · Other software · Icinga · reported by GitHubMedium 5
icingaweb2-module-jira provides integration with Atlassian Jira. Starting in version 1.3.0 and prior to version 1.3.2, template and field configuration forms perform the deletion action before user input is validated, including the cross site request forgery token. This issue is fixed in version 1.3.2. There are no known workarounds.
Product
icingaweb2-module-jira
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 30, 2023Improper Information in Cybersecurity Guidebook in Bosch Building Integration System (BIS) 5.0 may lead to wrong configuration which allows local users to accesCVE-2023-29241 · Other software · Bosch · reported by psirt@bosch.comHigh 8.1
Improper Information in Cybersecurity Guidebook in Bosch Building Integration System (BIS) 5.0 may lead to wrong configuration which allows local users to access data via network
Product
BIS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record psirt.bosch.com psirt.bosch.com
Jun 29, 2023Active Directory Integration / LDAP Integration: LDAP InjectionCVE-2023-3447 · WordPress plugins & themes · reported by WordfenceHigh 7.6
The Active Directory Integration / LDAP Integration plugin for WordPress is vulnerable to LDAP Injection in versions up to, and including, 4.1.5. This is due to insufficient escaping on the supplied username value. This makes it possible for attackers, with an existing account on a vulnerable WordPress instance, to extract potentially sensitive information from the LDAP directory.
Product
Active Directory Integration / LDAP Integration
Affected
up to 4.1.5
What to do
Affects up to 4.1.5. Update Active Directory Integration / LDAP Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 19, 2023Integration for Contact Form 7 and Zoho CRM, Bigin: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-2527 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Integration for Contact Form 7 and Zoho CRM, Bigin WordPress plugin before 1.2.4 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
Product
Integration for Contact Form 7 and Zoho CRM, Bigin
Fixed in
1.2.4
What to do
Update Integration for Contact Form 7 and Zoho CRM, Bigin to 1.2.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 14, 2023Jenkins Sonargraph Integration Plugin 5.0.1 and earlier does not escape the file path and the project name for the Log file field form validation, resulting in CVE-2023-35145 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Sonargraph Integration Plugin 5.0.1 and earlier does not escape the file path and the project name for the Log file field form validation, resulting in a stored cross-site scripting vulnerability exploitable by attackers with Item/Configure permission.
Product
Jenkins Sonargraph Integration Plugin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com jenkins.io
Jun 9, 2023UmbracoIdentityExtensions is an Umbraco add-on package that enables easy extensibility points for ASP.Net Identity integration.CVE-2023-32312 · Other software · umbraco · reported by GitHubLow 3.7
UmbracoIdentityExtensions is an Umbraco add-on package that enables easy extensibility points for ASP.Net Identity integration. In affected versions client secrets are not required which may expose some endpoints to untrusted actors. Since Umbraco is not a single-page application, the implicit flow is not safe. For traditional MVC applications, it is recommended to use the authorization code flow, which requires the client to authenticate with the authorization server using a client secret. This flow provides better security, as it involves exchanging an authorization code for an access token and/or ID token, rather than directly returning tokens in the URL fragment. This issue has been patched in commit `e792429f9` and a release to Nuget is pending. Users are advised to upgrade when possible.
Product
UmbracoIdentityExtensions
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.umbraco.com github.com
Jun 9, 2023Active Directory Integration: Cross-Site Request Forgery leading to time-based SQL InjectionCVE-2023-2599 · WordPress plugins & themes · reported by WordfenceLow 3.1
The Active Directory Integration plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to time-based SQL Injection via the orderby and order parameters in versions up to, and including, 4.1.4 due to missing nonce verification on the get_users function and insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to cause resource exhaustion via a forged request granted they can trick an administrator into performing an action such as clicking on a link.
Product
Active Directory Integration
Affected
up to 4.1.4
What to do
Affects up to 4.1.4. Update Active Directory Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 9, 2023Active Directory Integration: Time-based SQL InjectionCVE-2023-2484 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Active Directory Integration plugin for WordPress is vulnerable to time-based SQL Injection via the orderby and order parameters in versions up to, and including, 4.1.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with administrator privileges to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Active Directory Integration
Affected
up to 4.1.4
What to do
Affects up to 4.1.4. Update Active Directory Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 28, 2023André Bräkling WP-Matomo Integration: Auth. (admin+) Stored Cross-Site Scripting (XSS)CVE-2023-33211 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in André Bräkling WP-Matomo Integration (WP-Piwik) plugin <= 1.0.27 versions.
Product
André Bräkling WP-Matomo Integration
Affected
up to 1.0.27
What to do
Affects up to 1.0.27. Update André Bräkling WP-Matomo Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 26, 2023Cross-Site Request Forgery (CSRF) vulnerability in CRM Perks Integration for Contact Form 7 and Zoho CRM, Bigin plugin <= 1.2.2 versions.CVE-2023-25976 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in CRM Perks Integration for Contact Form 7 and Zoho CRM, Bigin plugin <= 1.2.2 versions.
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 16, 2023Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.149 and earlier does not mask credentials displayed on the configuration form, increasing the potenCVE-2023-33000 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comHigh 7.5
Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.149 and earlier does not mask credentials displayed on the configuration form, increasing the potential for attackers to observe and capture them.
Product
Jenkins NS-ND Integration Performance Publisher Plugin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jenkins.io jenkins.io
May 15, 2023Active Directory Integration / LDAP Integration: Does not have proper authorization or nonce values for some POST requestsCVE-2023-0812 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Active Directory Integration / LDAP Integration WordPress plugin before 4.1.1 does not have proper authorization or nonce values for some POST requests, leading to unauthenticated data disclosure.
Product
Active Directory Integration / LDAP Integration
Fixed in
4.1.1
What to do
Update Active Directory Integration / LDAP Integration to 4.1.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 10, 2023Authentication bypass vulnerability in NEXT ENGINE Integration Plugin (for EC-CUBE 2.0 series) all versions allows a remote unauthenticated attacker to alter thCVE-2023-27919 · Other software · NE Inc. · reported by vultures@jpcert.or.jpMedium 5.3
Authentication bypass vulnerability in NEXT ENGINE Integration Plugin (for EC-CUBE 2.0 series) all versions allows a remote unauthenticated attacker to alter the information stored in the system.
Product
NEXT ENGINE Integration Plugin (for EC-CUBE 2.0 series)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp main.next-engine.com
Apr 28, 2023Concrete CMS (previously concrete5) versions 8.5.12 and below, and 9.0 through 9.1.3 is vulnerable to stored XSS on API Integrations via the name parameter.CVE-2023-28477 · Other software · Concretecms · reported by MITREMedium 5.5
Concrete CMS (previously concrete5) versions 8.5.12 and below, and 9.0 through 9.1.3 is vulnerable to stored XSS on API Integrations via the name parameter.
Product
Concrete CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record concretecms.com concretecms.org
Apr 26, 2023Baremetal Operator (BMO) is a bare metal host provisioning integration for Kubernetes.CVE-2023-30841 · Other software · metal3-io · reported by GitHubMedium 6
Baremetal Operator (BMO) is a bare metal host provisioning integration for Kubernetes. Prior to version 0.3.0, ironic and ironic-inspector deployed within Baremetal Operator using the included `deploy.sh` store their `.htpasswd` files as ConfigMaps instead of Secrets. This causes the plain-text username and hashed password to be readable by anyone having a cluster-wide read-access to the management cluster, or access to the management cluster's Etcd storage. This issue is patched in baremetal-operator PR#1241, and is included in BMO release 0.3.0 onwards. As a workaround, users may modify the kustomizations and redeploy the BMO, or recreate the required ConfigMaps as Secrets per instructions in baremetal-operator PR#1241.
Product
baremetal-operator
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 25, 2023PingID integration for Windows login prior to 2.9 does not handle duplicate usernames, which can lead to a username collision when two people with the same userCVE-2022-23721 · Other software · Ping Identity · reported by responsible-disclosure@pingidentity.comLow 3.8
PingID integration for Windows login prior to 2.9 does not handle duplicate usernames, which can lead to a username collision when two people with the same username are provisioned onto the same machine at different times.
Product
unspecified
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.pingidentity.com docs.pingidentity.com
Apr 24, 2023Authentication Bypass in Hub Business integration in Devolutions Workspace Desktop 2023.1.1.3 and earlier on Windows and macOS allows an attacker with access toCVE-2023-2257 · Other software · Devolutions · reported by security@devolutions.netHigh 7.8
Authentication Bypass in Hub Business integration in Devolutions Workspace Desktop 2023.1.1.3 and earlier on Windows and macOS allows an attacker with access to the user interface to unlock a Hub Business space without being prompted to enter the password via an unimplemented "Force Login" security feature. This vulnerability occurs only if "Force Login" feature is enabled on the Hub Business instance and that an attacker has access to a locked Workspace desktop application configured with a Hub Business space.
Product
Workspace Desktop
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record devolutions.net devolutions.net

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.