Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
878 results · page 13 of 18
Jan 24, 2023A malicious / defective bluetooth controller can cause buffer overreads in the most functions that process HCI command responses.CVE-2023-0396 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgMedium 6.8
A malicious / defective bluetooth controller can cause buffer overreads in the most functions that process HCI command responses.
- Product
- zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2023The Sinilink XY-WFT1 WiFi Remote Thermostat, running firmware 1.3.6, allows an attacker to bypass the intended requirement to communicate using MQTT.CVE-2022-43704 · Other software · Sinilink · reported by MITREMedium 5.9
The Sinilink XY-WFT1 WiFi Remote Thermostat, running firmware 1.3.6, allows an attacker to bypass the intended requirement to communicate using MQTT. It is possible to replay Sinilink aka SINILINK521 protocol (udp/1024) commands interfacing directly with the target device. This, in turn, allows for an attack to control the onboard relay without requiring authentication via the mobile application. This might result in an unacceptable temperature within the target device's physical environment.
- Product
- Xy-wft1 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtrustwave.comtrustwave.com
Dec 16, 2022In sdpu_find_most_specific_service_uuid of sdp_utils.cc, there is a possible way to crash Bluetooth due to a missing null check.CVE-2022-20521 · Computers, phones & browsers · Google · reported by security@android.comMedium 5
In sdpu_find_most_specific_service_uuid of sdp_utils.cc, there is a possible way to crash Bluetooth due to a missing null check. This could lead to local denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-227203684
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Nov 23, 2022A denial-of-service vulnerability in the Mattermost allows an authenticated user to crash the server via multiple requests to one of the API endpoints which couCVE-2022-4045 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comLow 3.1
A denial-of-service vulnerability in the Mattermost allows an authenticated user to crash the server via multiple requests to one of the API endpoints which could fetch a large amount of data.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Nov 23, 2022A denial-of-service vulnerability in Mattermost allows an authenticated user to crash the server via multiple large autoresponder messages.CVE-2022-4044 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 4.3
A denial-of-service vulnerability in Mattermost allows an authenticated user to crash the server via multiple large autoresponder messages.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.commattermost.com
Nov 23, 2022A denial-of-service vulnerability in the Mattermost Playbooks plugin allows an authenticated user to crash the server via multiple large requests to one of the CVE-2022-4019 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 4.3
A denial-of-service vulnerability in the Mattermost Playbooks plugin allows an authenticated user to crash the server via multiple large requests to one of the Playbooks API endpoints.
- Product
- Playbooks Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.commattermost.com
Sep 23, 2022Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded while drafting a post, which allows autheCVE-2022-3257 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comLow 3.1
Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded while drafting a post, which allows authenticated users to cause resource exhaustion while processing the file, resulting in server-side Denial of Service.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.commattermost.com
Sep 9, 2022Mattermost version 7.0.x and earlier fails to sufficiently limit the in-memory sizes of concurrently uploaded JPEG images, which allows authenticated users to cCVE-2022-3147 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comLow 3.1
Mattermost version 7.0.x and earlier fails to sufficiently limit the in-memory sizes of concurrently uploaded JPEG images, which allows authenticated users to cause resource exhaustion on specific system configurations, resulting in server-side Denial of Service.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.commattermost.com
Sep 7, 2022JOSE is "JSON Web Almost Everything" - JWA, JWS, JWE, JWT, JWK, JWKS with no dependencies using runtime's native crypto in Node.js, Browser, Cloudflare Workers,CVE-2022-36083 · Other software · panva · reported by GitHubMedium 5.3
JOSE is "JSON Web Almost Everything" - JWA, JWS, JWE, JWT, JWK, JWKS with no dependencies using runtime's native crypto in Node.js, Browser, Cloudflare Workers, Electron, and Deno. The PBKDF2-based JWE key management algorithms expect a JOSE Header Parameter named `p2c` PBES2 Count, which determines how many PBKDF2 iterations must be executed in order to derive a CEK wrapping key. The purpose of this parameter is to intentionally slow down the key derivation function in order to make password brute-force and dictionary attacks more expensive. This makes the PBES2 algorithms unsuitable for situations where the JWE is coming from an untrusted source: an adversary can intentionally pick an extremely high PBES2 Count value, that will initiate a CPU-bound computation that may take an unreasonable amount of time to finish. Under certain conditions, it is possible to have the user's environment consume unreasonable amount of CPU time. The impact is limited only to users utilizing the JWE decryption APIs with symmetric secrets to decrypt JWEs from untrusted parties who do not limit the accepted JWE Key Management Algorithms (`alg` Header Parameter) using the `keyManagementAlgorithms` (or `
- Product
- jose
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2022The Guest account feature in Mattermost version 6.7.0 and earlier fails to properly restrict the permissions, which allows a guest user to fetch a list of all pCVE-2022-2408 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 4.3
The Guest account feature in Mattermost version 6.7.0 and earlier fails to properly restrict the permissions, which allows a guest user to fetch a list of all public channels in the team, in spite of not being part of those channels.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jul 14, 2022The legacy Slack import feature in Mattermost version 6.7.0 and earlier fails to properly limit the sizes of imported files, which allows an authenticated attacCVE-2022-2406 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 4.3
The legacy Slack import feature in Mattermost version 6.7.0 and earlier fails to properly limit the sizes of imported files, which allows an authenticated attacker to crash the server by importing large files via the Slack import REST API.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jul 14, 2022Unrestricted information disclosure of all users in Mattermost version 6.7.0 and earlier allows team members to access some sensitive information by directly acCVE-2022-2401 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 6.5
Unrestricted information disclosure of all users in Mattermost version 6.7.0 and earlier allows team members to access some sensitive information by directly accessing the APIs.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jul 12, 2022Incorrect default configuration for trusted IP header in Mattermost version 6.7.0 and earlier allows attacker to bypass some of the rate limitations in place orCVE-2022-2366 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 5.6
Incorrect default configuration for trusted IP header in Mattermost version 6.7.0 and earlier allows attacker to bypass some of the rate limitations in place or use manipulated IPs for audit logging via manipulating the request headers.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jul 10, 2022In Joomla component 'Joomlatools - DOCman 3.5.13 (and likely most versions below)' are affected to an reflected Cross-Site Scripting (XSS) in an image upload fuCVE-2022-27910 · Websites & servers · Joomlatools · reported by security@joomla.orgMedium 6.1
In Joomla component 'Joomlatools - DOCman 3.5.13 (and likely most versions below)' are affected to an reflected Cross-Site Scripting (XSS) in an image upload function
- Product
- DOCman
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjoomlatools.comjoomlatools.com
Jun 2, 2022Uncontrolled resource consumption in Mattermost version 6.6.0 and earlier allows an authenticated attacker to crash the server via a crafted SVG attachment on aCVE-2022-1982 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 4.3
Uncontrolled resource consumption in Mattermost version 6.6.0 and earlier allows an authenticated attacker to crash the server via a crafted SVG attachment on a post.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
May 3, 2022Mattermost Playbooks plugin 1.25 and earlier fails to properly restrict user-level permissions, which allows playbook members to escalate their membership priviCVE-2022-1548 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comLow 3.7
Mattermost Playbooks plugin 1.25 and earlier fails to properly restrict user-level permissions, which allows playbook members to escalate their membership privileges and perform actions restricted to playbook admins.
- Product
- Mattermost Playbooks
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Apr 19, 2022Mattermost 6.4.x and earlier fails to properly invalidate pending email invitations when the action is performed from the system console, which allows accidentaCVE-2022-1385 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comLow 3.7
Mattermost 6.4.x and earlier fails to properly invalidate pending email invitations when the action is performed from the system console, which allows accidentally invited users to join the workspace and access information from the public teams and channels.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.commattermost.com
Apr 19, 2022Mattermost version 6.4.x and earlier fails to properly check the plugin version when a plugin is installed from the Marketplace, which allows an authenticated aCVE-2022-1384 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 4.7
Mattermost version 6.4.x and earlier fails to properly check the plugin version when a plugin is installed from the Marketplace, which allows an authenticated and an authorized user to install and exploit an old plugin version from the Marketplace which might have known vulnerabilities.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Apr 13, 2022The image proxy component in Mattermost version 6.4.1 and earlier allocates memory for multiple copies of a proxied image, which allows an authenticated attackeCVE-2022-1337 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 4.3
The image proxy component in Mattermost version 6.4.1 and earlier allocates memory for multiple copies of a proxied image, which allows an authenticated attacker to crash the server via links to very large image files.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Apr 13, 2022Mattermost Playbooks plugin v1.24.0 and earlier fails to properly check the limit on the number of webhooks, which allows authenticated and authorized users to CVE-2022-1333 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comLow 3.5
Mattermost Playbooks plugin v1.24.0 and earlier fails to properly check the limit on the number of webhooks, which allows authenticated and authorized users to create a specifically drafted Playbook which could trigger a large amount of webhook requests leading to Denial of Service.
- Product
- Mattermost Playbooks
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Apr 13, 2022One of the API in Mattermost version 6.4.1 and earlier fails to properly protect the permissions, which allows the authenticated members with restricted custom CVE-2022-1332 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 4.3
One of the API in Mattermost version 6.4.1 and earlier fails to properly protect the permissions, which allows the authenticated members with restricted custom admin role to bypass the restrictions and view the server logs and server config.json file contents.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Mar 18, 2022One of the API in Mattermost version 6.3.0 and earlier fails to properly protect the permissions, which allows the system administrators to combine the two distCVE-2022-1003 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comLow 3.3
One of the API in Mattermost version 6.3.0 and earlier fails to properly protect the permissions, which allows the system administrators to combine the two distinct privileges/capabilities in a way that allows them to override certain restricted configurations like EnableUploads.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Mar 18, 2022Mattermost 6.3.0 and earlier fails to properly sanitize the HTML content in the email invitation sent to guest users, which allows registered users with specialCVE-2022-1002 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comLow 2
Mattermost 6.3.0 and earlier fails to properly sanitize the HTML content in the email invitation sent to guest users, which allows registered users with special permissions to invite guest users to inject unescaped HTML content in the email invitations.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.commattermost.com
Mar 10, 2022A stack overflow bug in the document extractor in Mattermost Server in versions up to and including 6.3.2 allows an attacker to crash the server via submitting CVE-2022-0904 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 4.3
A stack overflow bug in the document extractor in Mattermost Server in versions up to and including 6.3.2 allows an attacker to crash the server via submitting a maliciously crafted Apple Pages document.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Mar 10, 2022A call stack overflow bug in the SAML login feature in Mattermost server in versions up to and including 6.3.2 allows an attacker to crash the server via submitCVE-2022-0903 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 5.3
A call stack overflow bug in the SAML login feature in Mattermost server in versions up to and including 6.3.2 allows an attacker to crash the server via submitting a maliciously crafted POST body.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Feb 28, 2022Maps Plugin using Google Maps for: Does not have CSRF checks in most of its AJAX actionsCVE-2021-25081 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Maps Plugin using Google Maps for WordPress plugin before 1.8.4 does not have CSRF checks in most of its AJAX actions, which could allow attackers to make logged in admins delete arbitrary posts and update the plugin's settings via a CSRF attack
- Product
- Maps Plugin using Google Maps for
- Fixed in
- 1.8.4
- What to do
- Update Maps Plugin using Google Maps for to 1.8.4 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 28, 2022Maps Plugin using Google Maps for: Does not have proper authorisation and CSRF in most of its AJAX actionsCVE-2021-25011 · WordPress plugins & themes · reported by WPScanMedium 5.7
The Maps Plugin using Google Maps for WordPress plugin before 1.8.1 does not have proper authorisation and CSRF in most of its AJAX actions, which could allow any authenticated users, such as subscriber to delete arbitrary posts and update the plugin's settings.
- Product
- Maps Plugin using Google Maps for
- Fixed in
- 1.8.1
- What to do
- Update Maps Plugin using Google Maps for to 1.8.1 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 21, 2022Mattermost 6.3.0 and earlier fails to protect email addresses of the creator of the team via one of the APIs, which allows authenticated team members to access CVE-2022-0708 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 4.3
Mattermost 6.3.0 and earlier fails to protect email addresses of the creator of the team via one of the APIs, which allows authenticated team members to access this information resulting in sensitive & private information disclosure.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Feb 4, 2022In OpenZeppelin <=v4.4.0, initializer functions that are invoked separate from contract creation (the most prominent example being minimal proxies) may be reentCVE-2021-46320 · Other software · Openzeppelin · reported by MITREHigh 7.5
In OpenZeppelin <=v4.4.0, initializer functions that are invoked separate from contract creation (the most prominent example being minimal proxies) may be reentered if they make an untrusted non-view external call. Once an initializer has finished running it can never be re-executed. However, an exception put in place to support multiple inheritance made reentrancy possible, breaking the expectation that there is a single execution.
- Product
- Openzeppelin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2022Mattermost Boards plugin v0.10.0 and earlier fails to protect email addresses of all users via one of the Boards APIs, which allows authenticated and unauthorizCVE-2021-37867 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 4.3
Mattermost Boards plugin v0.10.0 and earlier fails to protect email addresses of all users via one of the Boards APIs, which allows authenticated and unauthorized users to access this information resulting in sensitive & private information disclosure.
- Product
- Mattermost Boards
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jan 18, 2022Mattermost Boards plugin v0.10.0 and earlier fails to invalidate a session on the server-side when a user logged out of Boards, which allows an attacker to reusCVE-2021-37866 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 4.7
Mattermost Boards plugin v0.10.0 and earlier fails to invalidate a session on the server-side when a user logged out of Boards, which allows an attacker to reuse old session token for authorization.
- Product
- Mattermost Boards
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.comwhitesourcesoftware.com
Jan 18, 2022Mattermost 6.2 and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded while drafting a post, which allows authenticated uCVE-2021-37865 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 4.3
Mattermost 6.2 and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded while drafting a post, which allows authenticated users to cause resource exhaustion while processing the file, resulting in server-side Denial of Service.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.commattermost.com
Jan 18, 2022Mattermost 6.1 and earlier fails to sufficiently validate permissions while viewing archived channels, which allows authenticated users to view contents of archCVE-2021-37864 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comLow 2.6
Mattermost 6.1 and earlier fails to sufficiently validate permissions while viewing archived channels, which allows authenticated users to view contents of archived channels even when this is denied by system administrators by directly accessing the APIs.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jan 12, 2022Jenkins Active Directory Plugin 2.25 and earlier does not encrypt the transmission of data between the Jenkins controller and Active Directory servers in most cCVE-2022-23105 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 6.5
Jenkins Active Directory Plugin 2.25 and earlier does not encrypt the transmission of data between the Jenkins controller and Active Directory servers in most configurations.
- Product
- Jenkins Active Directory Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Dec 17, 2021Mattermost 6.0 and earlier fails to sufficiently validate parameters during post creation, which allows authenticated attackers to cause a client-side crash of CVE-2021-37863 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comLow 3.5
Mattermost 6.0 and earlier fails to sufficiently validate parameters during post creation, which allows authenticated attackers to cause a client-side crash of the web application via a maliciously crafted post.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.commattermost.com
Dec 17, 2021Mattermost 6.0 and earlier fails to sufficiently validate the email address during registration, which allows attackers to trick users into signing up using attCVE-2021-37862 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comLow 3.7
Mattermost 6.0 and earlier fails to sufficiently validate the email address during registration, which allows attackers to trick users into signing up using attacker-controlled email addresses via crafted invitation token.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.commattermost.com
Dec 9, 2021Mattermost 6.0.2 and earlier fails to sufficiently sanitize user's password in audit logs when user creation fails.CVE-2021-37861 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 5.8
Mattermost 6.0.2 and earlier fails to sufficiently sanitize user's password in audit logs when user creation fails.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Sep 22, 2021Mattermost 5.38 and earlier fails to sufficiently sanitize clipboard contents, which allows a user-assisted attacker to inject arbitrary web script in product dCVE-2021-37860 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comLow 3.7
Mattermost 5.38 and earlier fails to sufficiently sanitize clipboard contents, which allows a user-assisted attacker to inject arbitrary web script in product deployments that explicitly disable the default CSP.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Sep 20, 2021Apprise is an open source library which allows you to send a notification to almost all of the most popular notification services available.CVE-2021-39229 · Other software · caronc · reported by GitHubHigh 7.5
Apprise is an open source library which allows you to send a notification to almost all of the most popular notification services available. In affected versions users who use Apprise granting them access to the IFTTT plugin (which just comes out of the box) are subject to a denial of service attack on an inefficient regular expression. The vulnerable regular expression is [here](https://github.com/caronc/apprise/blob/0007eade20934ddef0aba38b8f1aad980cfff253/apprise/plugins/NotifyIFTTT.py#L356-L359). The problem has been patched in release version 0.9.5.1. Users who are unable to upgrade are advised to remove `apprise/plugins/NotifyIFTTT.py` to eliminate the service.
- Product
- apprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2021Fixed a bypass for a reflected cross-site scripting vulnerability affecting OAuth-enabled instances of Mattermost.CVE-2021-37859 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comHigh 7.1
Fixed a bypass for a reflected cross-site scripting vulnerability affecting OAuth-enabled instances of Mattermost.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jul 12, 2021WP Reset – Most Advanced WordPress Reset Tool: Did not sanitise or escape its extra_data parameterCVE-2021-24424 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Reset – Most Advanced WordPress Reset Tool WordPress plugin before 1.90 did not sanitise or escape its extra_data parameter when creating a snapshot via the admin dashboard, leading to an authenticated Stored Cross-Site Scripting issue
- Product
- WP Reset – Most Advanced WordPress Reset Tool
- Fixed in
- 1.90
- What to do
- Update WP Reset – Most Advanced WordPress Reset Tool to 1.90 or newer.
Oct 16, 2020In Bender COMTRAXX, user authorization is validated for most, but not all, routes in the system.CVE-2019-19885 · Other software · Bender · reported by MITRECritical 9.1
In Bender COMTRAXX, user authorization is validated for most, but not all, routes in the system. A user with knowledge about the routes can read and write configuration data without prior authorization. This affects COM465IP, COM465DP, COM465ID, CP700, CP907, and CP915 devices before 4.2.0.
- Product
- Com465ip Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcert.vde.com
Jun 26, 2020An issue was discovered in Mattermost Mobile Apps before 1.31.2 on iOS.CVE-2020-13891 · Other software · Mattermost · reported by MITREHigh 7.5
An issue was discovered in Mattermost Mobile Apps before 1.31.2 on iOS. Unintended third-party servers could sometimes obtain authorization tokens, aka MMSA-2020-0022.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 3.6.0 and 3.5.2.CVE-2017-18921 · Other software · Mattermost · reported by MITREMedium 6.1
An issue was discovered in Mattermost Server before 3.6.0 and 3.5.2. XSS can occur via a link on an error page.
- Product
- Mattermost Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 3.6.2.CVE-2017-18920 · Other software · Mattermost · reported by MITRECritical 9.8
An issue was discovered in Mattermost Server before 3.6.2. The WebSocket feature does not follow the Same Origin Policy.
- Product
- Mattermost Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 3.7.0 and 3.6.3.CVE-2017-18919 · Other software · Mattermost · reported by MITREMedium 5.3
An issue was discovered in Mattermost Server before 3.7.0 and 3.6.3. Attackers can use the API for unauthenticated team creation.
- Product
- Mattermost Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 3.7.3 and 3.6.5.CVE-2017-18918 · Other software · Mattermost · reported by MITREMedium 4.9
An issue was discovered in Mattermost Server before 3.7.3 and 3.6.5. A System Administrator can place a SAML certificate at an arbitrary pathname.
- Product
- Mattermost Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7.CVE-2017-18917 · Other software · Mattermost · reported by MITREHigh 7.5
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. Weak hashing was used for e-mail invitations, OAuth, and e-mail verification tokens.
- Product
- Mattermost Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7.CVE-2017-18916 · Other software · Mattermost · reported by MITREMedium 5.3
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. API endpoint access control does not honor an integration permission restriction.
- Product
- Mattermost Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7.CVE-2017-18915 · Other software · Mattermost · reported by MITRECritical 9.8
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. After a restart of a server, an attacker might suddenly gain API Endpoint access.
- Product
- Mattermost Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.