Critical security advisoryCriticalFlagged by our vulnerability database: PHP2Shell is on CISA’s exploited list. Most WordPress hosting runs PHP. See if your site is affectedFlagged by our vulnerability database: PHP2Shell is being exploited. DetailsExploited: PHP2Shell. Check your site
HuttenlocherTechnologies
843-331-6339
Start a project →
Updated 8 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list
35added in the last 30 days
456new WordPress flaws this week
390,714entries in the database

2,347 results · page 13 of 47

  • Feb 16, 2024Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges).CVE-2024-20964 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 5.3

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H).

    Product
    MySQL Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.comsecurity.netapp.com

  • Feb 16, 2024Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).CVE-2024-20962 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.5

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

    Product
    MySQL Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.comsecurity.netapp.com

  • Feb 16, 2024Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: RAPID).CVE-2024-20960 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.5

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: RAPID). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

    Product
    MySQL Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.comsecurity.netapp.com

  • Feb 11, 2024qanything_kernel/connector/database/mysql/mysql_client.py in qanything.ai QAnything before 1.2.0 allows SQL Injection.CVE-2024-25722 · Other software · Qanything · reported by MITRECritical 9.8

    qanything_kernel/connector/database/mysql/mysql_client.py in qanything.ai QAnything before 1.2.0 allows SQL Injection.

    Product
    Qanything
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordgithub.comgithub.com

  • Feb 5, 2024phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases.CVE-2024-24574 · Other software · thorsten · reported by GitHubMedium 6.5

    phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Unsafe echo of filename in phpMyFAQ\phpmyfaq\admin\attachments.php leads to allowed execution of JavaScript code in client side (XSS). This vulnerability has been patched in version 3.2.5.

    Product
    phpMyFAQ
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordgithub.comgithub.com

  • Feb 5, 2024phpMyFAQ is an Open Source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases.CVE-2024-22208 · Other software · thorsten · reported by GitHubMedium 6.5

    phpMyFAQ is an Open Source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. The 'sharing FAQ' functionality allows any unauthenticated actor to misuse the phpMyFAQ application to send arbitrary emails to a large range of targets. The phpMyFAQ application has a functionality where anyone can share a FAQ item to others. The front-end of this functionality allows any phpMyFAQ articles to be shared with 5 email addresses. Any unauthenticated actor can perform this action. There is a CAPTCHA in place, however the amount of people you email with a single request is not limited to 5 by the backend. An attacker can thus solve a single CAPTCHA and send thousands of emails at once. An attacker can utilize the target application's email server to send phishing messages. This can get the server on a blacklist, causing all emails to end up in spam. It can also lead to reputation damages. This issue has been patched in version 3.2.5.

    Product
    phpMyFAQ
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordgithub.comgithub.com

  • Feb 5, 2024phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases.CVE-2024-22202 · Other software · thorsten · reported by GitHubMedium 5.7

    phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. phpMyFAQ's user removal page allows an attacker to spoof another user's detail, and in turn make a compelling phishing case for removing another user's account. The front-end of this page doesn't allow changing the form details, an attacker can utilize a proxy to intercept this request and submit other data. Upon submitting this form, an email is sent to the administrator informing them that this user wants to delete their account. An administrator has no way of telling the difference between the actual user wishing to delete their account or the attacker issuing this for an account they do not control. This issue has been patched in version 3.2.5.

    Product
    phpMyFAQ
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordgithub.comgithub.com

  • Feb 1, 2024Vinchin Backup & Recovery v7.2 was discovered to use default MYSQL credentials.CVE-2024-22901 · Other software · Vinchin · reported by MITRECritical 9.8

    Vinchin Backup & Recovery v7.2 was discovered to use default MYSQL credentials.

    Product
    Vinchin Backup And Recovery
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordblog.leakix.netseclists.org

  • Feb 1, 2024A stored cross-site scripting (XSS) vulnerability in Travel Journal Using PHP and MySQL with Source Code v1.0 allows attackers to execute arbitrary web scripts CVE-2024-24945 · Other software · Remyandrade · reported by MITREMedium 6.1

    A stored cross-site scripting (XSS) vulnerability in Travel Journal Using PHP and MySQL with Source Code v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Share Your Moments parameter at /travel-journal/write-journal.php.

    Product
    Travel Journal Using PHP And Mysql With Source Code
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordgithub.comportswigger.net

  • Feb 1, 2024A stored cross-site scripting (XSS) vulnerability in Travel Journal Using PHP and MySQL with Source Code v1.0 allows attackers to execute arbitrary web scripts CVE-2024-24041 · Other software · Remyandrade · reported by MITREMedium 6.1

    A stored cross-site scripting (XSS) vulnerability in Travel Journal Using PHP and MySQL with Source Code v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the location parameter at /travel-journal/write-journal.php.

    Product
    Travel Journal Using PHP And Mysql With Source Code
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordgithub.comportswigger.net

  • Jan 25, 2024 Networker 19.9 and all prior versions contains a Plain-text Password stored in temporary config file during backup duration in NMDA MySQL Database backups.CVE-2024-22432 · Other software · Dell · reported by security_alert@emc.comHigh 7.8

    Networker 19.9 and all prior versions contains a Plain-text Password stored in temporary config file during backup duration in NMDA MySQL Database backups. User has low privilege access to Networker Client system could potentially exploit this vulnerability, leading to the disclosure of configured MySQL Database user credentials. The attacker may be able to use the exposed credentials to access the vulnerable application Database with privileges of the compromised account.

    Product
    NetWorker Module for Databases and Applications - Oracle
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recorddell.comdell.com

  • Jan 16, 2024Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: UDF).CVE-2024-20985 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.5

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: UDF). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

    Product
    MySQL Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordsecurity.netapp.comoracle.com

  • Jan 16, 2024Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML).CVE-2024-20983 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 4.9

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.34 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    Product
    MySQL Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordsecurity.netapp.comoracle.com

  • Jan 16, 2024Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL).CVE-2024-20981 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 4.9

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    Product
    MySQL Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordsecurity.netapp.comoracle.com

  • Jan 16, 2024Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).CVE-2024-20977 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.5

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

    Product
    MySQL Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordsecurity.netapp.comoracle.com

  • Jan 16, 2024Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).CVE-2024-20975 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.5

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.2.0 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

    Product
    MySQL Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordsecurity.netapp.comoracle.com

  • Jan 16, 2024Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).CVE-2024-20973 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.5

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

    Product
    MySQL Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordsecurity.netapp.comoracle.com

  • Jan 16, 2024Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).CVE-2024-20971 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 4.9

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    Product
    MySQL Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordsecurity.netapp.comoracle.com

  • Jan 16, 2024Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL).CVE-2024-20969 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 5.5

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 5.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H).

    Product
    MySQL Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordsecurity.netapp.comoracle.com

  • Jan 16, 2024Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication).CVE-2024-20967 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 5.5

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 5.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H).

    Product
    MySQL Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordsecurity.netapp.comoracle.com

  • Jan 16, 2024Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).CVE-2024-20965 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 4.9

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    Product
    MySQL NDB Cluster
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordsecurity.netapp.comsecurity.netapp.com

  • Jan 16, 2024Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Encryption).CVE-2024-20963 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.5

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Encryption). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

    Product
    MySQL Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordsecurity.netapp.comoracle.com

  • Jan 16, 2024Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).CVE-2024-20961 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.5

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

    Product
    MySQL Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordsecurity.netapp.comoracle.com

  • Dec 22, 2023Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL datCVE-2023-51649 · Other software · nautobot · reported by GitHubLow 3.5

    Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. When submitting a Job to run via a Job Button, only the model-level `extras.run_job` permission is checked (i.e., does the user have permission to run Jobs in general). Object-level permissions (i.e., does the user have permission to run this specific Job?) are not enforced by the URL/view used in this case. A user with permissions to run even a single Job can actually run all configured JobButton Jobs. Fix will be available in Nautobot 1.6.8 and 2.1.0

    Product
    nautobot
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordgithub.comgithub.com

  • Dec 12, 2023Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL datCVE-2023-50263 · Other software · nautobot · reported by GitHubLow 3.7

    Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. In Nautobot 1.x and 2.0.x prior to 1.6.7 and 2.0.6, the URLs `/files/get/?name=...` and `/files/download/?name=...` are used to provide admin access to files that have been uploaded as part of a run request for a Job that has FileVar inputs. Under normal operation these files are ephemeral and are deleted once the Job in question runs. In the default implementation used in Nautobot, as provided by `django-db-file-storage`, these URLs do not by default require any user authentication to access; they should instead be restricted to only users who have permissions to view Nautobot's `FileProxy` model instances. Note that no URL mechanism is provided for listing or traversal of the available file `name` values, so in practice an unauthenticated user would have to guess names to discover arbitrary files for download, but if a user knows the file name/path value, they can access it without authenticating, so we are considering this a vulnerability. Fixes are included in Nautobot 1.6.7 and Nautobot 2.0.6. No known workar

    Product
    nautobot
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordgithub.comgithub.com

  • Dec 12, 2023The xaviershay-dm-rails gem 0.10.3.8 for Ruby allows local users to discover MySQL credentials by listing a process and its arguments.CVE-2015-2179 · Other software · Xaviershay-dm-rails Porject · reported by MITREMedium 5.5

    The xaviershay-dm-rails gem 0.10.3.8 for Ruby allows local users to discover MySQL credentials by listing a process and its arguments.

    Product
    Xaviershay-dm-rails
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordvapid.dhs.orgvapid.dhs.org

  • Nov 24, 2023Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux.CVE-2023-48712 · Other software · warp-tech · reported by GitHubHigh 7.1

    Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. In affected versions there is a privilege escalation vulnerability through a non-admin user's account. Limited users can impersonate another user's account if only single-factor authentication is configured. If a user knows an admin username, opens the login screen and attempts to authenticate with an incorrect password they can subsequently enter a valid non-admin username and password they will be logged in as the admin user. All installations prior to version 0.9.0 are affected. All users are advised to upgrade. There are no known workarounds for this vulnerability.

    Product
    warpgate
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordgithub.comgithub.com

  • Nov 20, 2023Cross-site scripting vulnerability in LuxCal Web Calendar prior to 5.2.4M (MySQL version) and LuxCal Web Calendar prior to 5.2.4L (SQLite version) allows a remoCVE-2023-47175 · Other software · LuxSoft · reported by vultures@jpcert.or.jpMedium 6.1

    Cross-site scripting vulnerability in LuxCal Web Calendar prior to 5.2.4M (MySQL version) and LuxCal Web Calendar prior to 5.2.4L (SQLite version) allows a remote unauthenticated attacker to execute an arbitrary script on the web browser of the user who is accessing the product.

    Product
    LuxCal Web Calendar
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordjvn.jpluxsoft.eu

  • Nov 20, 2023SQL injection vulnerability in LuxCal Web Calendar prior to 5.2.4M (MySQL version) and LuxCal Web Calendar prior to 5.2.4L (SQLite version) allows a remote unauCVE-2023-46700 · Other software · LuxSoft · reported by vultures@jpcert.or.jpCritical 9.8

    SQL injection vulnerability in LuxCal Web Calendar prior to 5.2.4M (MySQL version) and LuxCal Web Calendar prior to 5.2.4L (SQLite version) allows a remote unauthenticated attacker to execute an arbitrary SQL command by sending a crafted request, and obtain or alter information stored in the database.

    Product
    LuxCal Web Calendar
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordjvn.jpluxsoft.eu

  • Nov 17, 2023LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems.CVE-2023-48294 · Other software · librenms · reported by GitHubMedium 4.3

    LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. In affected versions of LibreNMS when a user accesses their device dashboard, one request is sent to `graph.php` to access graphs generated on the particular Device. This request can be accessed by a low privilege user and they can enumerate devices on librenms with their id or hostname. Leveraging this vulnerability a low privilege user can see all devices registered by admin users. This vulnerability has been addressed in commit `489978a923` which has been included in release version 23.11.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

    Product
    librenms
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordgithub.comgithub.com

  • Nov 17, 2023LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems.CVE-2023-46745 · Other software · librenms · reported by GitHubMedium 5.3

    LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. In affected versions the login method has no rate limit. An attacker may be able to leverage this vulnerability to gain access to user accounts. This issue has been addressed in version 23.11.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

    Product
    librenms
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordgithub.comgithub.com

  • Nov 17, 2023LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems.CVE-2023-48295 · Other software · librenms · reported by GitHubMedium 6.3

    LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. Affected versions are subject to a cross site scripting (XSS) vulnerability in the device group popups. This issue has been addressed in commit `faf66035ea` which has been included in release version 23.11.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

    Product
    librenms
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordgithub.comgithub.com

  • Oct 25, 2023Nautobot is a Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database.CVE-2023-46128 · Other software · nautobot · reported by GitHubMedium 6.5

    Nautobot is a Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. In Nautobot 2.0.x, certain REST API endpoints, in combination with the `?depth=<N>` query parameter, can expose hashed user passwords as stored in the database to any authenticated user with access to these endpoints. The passwords are not exposed in plaintext. This vulnerability has been patched in version 2.0.3.

    Product
    nautobot
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordgithub.comgithub.com

  • Oct 17, 2023Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML).CVE-2023-22115 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 4.9

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.33 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    Product
    MySQL Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordsecurity.netapp.comoracle.com

  • Oct 17, 2023Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).CVE-2023-22114 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 4.9

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.34 and prior and 8.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    Product
    MySQL Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordsecurity.netapp.comoracle.com

  • Oct 17, 2023Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Encryption).CVE-2023-22113 · Other software · Oracle Corporation · reported by secalert_us@oracle.comLow 2.7

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Encryption). Supported versions that are affected are 8.0.33 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Server accessible data. CVSS 3.1 Base Score 2.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N).

    Product
    MySQL Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordsecurity.netapp.comoracle.com

  • Oct 17, 2023Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).CVE-2023-22112 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 4.9

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.34 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    Product
    MySQL Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordsecurity.netapp.comoracle.com

  • Oct 17, 2023Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: UDF).CVE-2023-22111 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 4.9

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: UDF). Supported versions that are affected are 8.0.33 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    Product
    MySQL Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordsecurity.netapp.comoracle.com

  • Oct 17, 2023Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).CVE-2023-22110 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 4.9

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.33 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    Product
    MySQL Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordsecurity.netapp.comoracle.com

  • Oct 17, 2023Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).CVE-2023-22104 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 4.9

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    Product
    MySQL Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordsecurity.netapp.comoracle.com

  • Oct 17, 2023Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).CVE-2023-22103 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 4.9

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.34 and prior and 8.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    Product
    MySQL Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordsecurity.netapp.comoracle.com

  • Oct 17, 2023Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J).CVE-2023-22102 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.3

    Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.1.0 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in MySQL Connectors, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).

    Product
    MySQL Connectors
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordsecurity.netapp.comoracle.com

  • Oct 17, 2023Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).CVE-2023-22097 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 4.9

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.34 and prior and 8.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    Product
    MySQL Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordsecurity.netapp.comoracle.com

  • Oct 17, 2023Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).CVE-2023-22095 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.5

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). The supported version that is affected is 8.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

    Product
    MySQL Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordsecurity.netapp.comoracle.com

  • Oct 17, 2023Vulnerability in the MySQL Installer product of Oracle MySQL (component: Installer: General).CVE-2023-22094 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.9

    Vulnerability in the MySQL Installer product of Oracle MySQL (component: Installer: General). Supported versions that are affected are Prior to 1.6.8. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where MySQL Installer executes to compromise MySQL Installer. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in MySQL Installer, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all MySQL Installer accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Installer. Note: This patch is used in MySQL Server bundled version 8.0.35 and 5.7.44. CVSS 3.1 Base Score 7.9 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H).

    Product
    MySQL Installer
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.comoracle.com

  • Oct 17, 2023Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).CVE-2023-22092 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 4.9

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.34 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    Product
    MySQL Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordsecurity.netapp.comoracle.com

  • Oct 17, 2023Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).CVE-2023-22084 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 4.9

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.43 and prior, 8.0.34 and prior and 8.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    Product
    MySQL Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordlists.debian.orglists.fedoraproject.org

  • Oct 17, 2023Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).CVE-2023-22079 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.5

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.34 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

    Product
    MySQL Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordsecurity.netapp.comoracle.com

  • Oct 17, 2023Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).CVE-2023-22078 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 4.9

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.34 and prior and 8.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    Product
    MySQL Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordsecurity.netapp.comoracle.com

  • Oct 17, 2023Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).CVE-2023-22070 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 4.9

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.34 and prior and 8.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    Product
    MySQL Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordsecurity.netapp.comoracle.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Get in touch

Tell us what you're building.

A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.

01The person who'll do the work writes back
02A short call, then a written plan with the price
03Nothing starts until you say yes
04Hacked or down right now? Call, and we pick up the same day
843-331-6339

Not ready to talk yet? Run the free website check and see what Google sees.

What do you need?
Build
Grow
Protect
Urgent

No newsletter, no sales sequence. Just a reply.