Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,051 results · page 13 of 22
Jun 27, 2023Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite: Stored Cross-Site ScriptingCVE-2023-3412 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.0.0. This is due to a missing capability check on the ajax_store_save() function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modify plugin settings and inject malicious web scripts.
- Product
- Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jun 27, 2023Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite: Cross-Site Request ForgeryCVE-2023-3411 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.0. This is due to missing nonce validation on the ajax_store_save() function. This makes it possible for unauthenticated attackers to modify plugin settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jun 26, 2023Bludit 3.9.2 is vulnerable to Remote Code Execution (RCE) via /admin/ajax/upload-images.CVE-2020-20210 · Other software · Bludit · reported by MITREHigh 8.8
Bludit 3.9.2 is vulnerable to Remote Code Execution (RCE) via /admin/ajax/upload-images.
- Product
- Bludit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2023Talend Data Catalog before 8.0-20230221 contain a directory traversal vulnerability in HeaderImageServlet.CVE-2023-36301 · Other software · Talend · reported by MITREHigh 7.5
Talend Data Catalog before 8.0-20230221 contain a directory traversal vulnerability in HeaderImageServlet.
- Product
- Data Catalog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.talend.comhelp.talend.com
Jun 13, 2023A unrestricted file upload vulnerability was discovered in the ‘Browse and upload images’ feature of the CKEditor v1.2.3 plugin for Redmine, which allows arbitrCVE-2023-31541 · Other software · Ckeditor · reported by MITRECritical 9.8
A unrestricted file upload vulnerability was discovered in the ‘Browse and upload images’ feature of the CKEditor v1.2.3 plugin for Redmine, which allows arbitrary files to be uploaded to the server.
- Product
- Ckeditor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2023Ali Irani Auto Upload Images plugin <= 3.3 versions allows Stored Cross-Site Scripting: Cross-Site Request Forgery (CSRF)CVE-2022-42880 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Cross-Site Request Forgery (CSRF) vulnerability in Ali Irani Auto Upload Images plugin <= 3.3 versions allows Stored Cross-Site Scripting (XSS).
- Product
- Ali Irani Auto Upload Images plugin <= 3.3 versions allows Stored Cross-Site Scripting
- Fixed in
- 3.3.1
- What to do
- Update Ali Irani Auto Upload Images plugin <= 3.3 versions allows Stored Cross-Site Scripting to 3.3.1 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 6, 2023Gallery Images Ape: Arbitrary Plugin DeactivationCVE-2019-25149 · WordPress plugins & themes · reported by WordfenceHigh 7.6
The Gallery Images Ape plugin for WordPress is vulnerable to Arbitrary Plugin Deactivation in versions up to, and including, 2.0.6. This allows authenticated attackers with any capability level to deactivate any plugin on the site, including plugins necessary to site functionality or security.
- Product
- Gallery Images Ape
- Affected
- up to 2.0.6
- What to do
- Affects up to 2.0.6. Update Gallery Images Ape to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comwordfence.com
Jun 6, 2023notation is a CLI tool to sign and verify OCI artifacts and container images.CVE-2023-33959 · Other software · notaryproject · reported by GitHubHigh 8.3
notation is a CLI tool to sign and verify OCI artifacts and container images. An attacker who has compromised a registry can cause users to verify the wrong artifact. The problem has been fixed in the release v1.0.0-rc.6. Users should upgrade their notation-go library to v1.0.0-rc.6 or above. Users unable to upgrade may restrict container registries to a set of secure and trusted container registries.
- Product
- notation-go
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2023notation is a CLI tool to sign and verify OCI artifacts and container images.CVE-2023-33958 · Other software · notaryproject · reported by GitHubMedium 5.4
notation is a CLI tool to sign and verify OCI artifacts and container images. An attacker who has compromised a registry and added a high number of signatures to an artifact can cause denial of service of services on the machine, if a user runs notation verify command on the same machine. The problem has been fixed in the release v1.0.0-rc.6. Users should upgrade their notation packages to v1.0.0-rc.6 or above. Users unable to upgrade may restrict container registries to a set of secure and trusted container registries.
- Product
- notation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2023notation is a CLI tool to sign and verify OCI artifacts and container images.CVE-2023-33957 · Other software · notaryproject · reported by GitHubLow 2.6
notation is a CLI tool to sign and verify OCI artifacts and container images. An attacker who has compromised a registry and added a high number of signatures to an artifact can cause denial of service of services on the machine, if a user runs notation inspect command on the same machine. The problem has been fixed in the release v1.0.0-rc.6. Users should upgrade their notation packages to v1.0.0-rc.6 or above. Users are advised to upgrade. Users unable to upgrade may restrict container registries to a set of secure and trusted container registries.
- Product
- notation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2023Cross-Site Request Forgery (CSRF) vulnerability in Marty Thornley Import External Images plugin <= 1.4 versions.CVE-2022-46866 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Marty Thornley Import External Images plugin <= 1.4 versions.
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 23, 2023EasyImages2.0 ≤ 2.8.1 is vulnerable to Cross Site Scripting (XSS) via viewlog.php.CVE-2023-33599 · Other software · Easyimages2.0 Project · reported by MITREMedium 6.1
EasyImages2.0 ≤ 2.8.1 is vulnerable to Cross Site Scripting (XSS) via viewlog.php.
- Product
- Easyimages2.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2023 Files present on firmware images could allow an attacker to gain unauthorized access as a root user using hard-coded credentials.CVE-2023-2504 · Other software · BirdDog · reported by ics-cert@hq.dhs.govHigh 8.4
Files present on firmware images could allow an attacker to gain unauthorized access as a root user using hard-coded credentials.
- Product
- STUDIO R3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2023Cross-Site Request Forgery (CSRF) vulnerability in RoboSoft Photo Gallery, Images, Slider in Rbs Image Gallery plugin <= 3.2.11 versions.CVE-2023-24414 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in RoboSoft Photo Gallery, Images, Slider in Rbs Image Gallery plugin <= 3.2.11 versions.
- Affected
- up to 3.2.11
- What to do
- Affects up to 3.2.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 18, 2023Cross-Site Request Forgery (CSRF) vulnerability in Studio Wombat Shoppable Images plugin <= 1.2.3 versions.CVE-2023-25698 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Studio Wombat Shoppable Images plugin <= 1.2.3 versions.
- Fixed in
- 1.2.4
- What to do
- Update the plugin to 1.2.4 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 16, 2023Incorrect access control in Videogo v6.8.1 allows attackers to access images from other devices via modification of the Device Id parameter.CVE-2023-31679 · Other software · Videogo Project · reported by MITREHigh 7.5
Incorrect access control in Videogo v6.8.1 allows attackers to access images from other devices via modification of the Device Id parameter.
- Product
- Videogo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2023A Segmentation fault caused by a floating point exception exists in libheif 1.15.1 using crafted heif images via the heif::Fraction::round() function in box.cc,CVE-2023-29659 · Other software · Struktur · reported by MITREMedium 6.5
A Segmentation fault caused by a floating point exception exists in libheif 1.15.1 using crafted heif images via the heif::Fraction::round() function in box.cc, which causes a denial of service.
- Product
- Libheif
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.fedoraproject.org
May 4, 2023Double free validation vulnerability in setPinPadImages in mPOS TUI trustlet prior to SMR May-2023 Release 1 allows local attackers to access the trustlet memorCVE-2023-21500 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 6
Double free validation vulnerability in setPinPadImages in mPOS TUI trustlet prior to SMR May-2023 Release 1 allows local attackers to access the trustlet memory.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Apr 14, 2023SENAYAN Library Management System (SLiMS) Bulian v9.5.2 does not strip exif data from uploaded images.CVE-2023-29850 · Other software · Slims · reported by MITREHigh 7.5
SENAYAN Library Management System (SLiMS) Bulian v9.5.2 does not strip exif data from uploaded images. This allows attackers to obtain information such as the user's geolocation and device information.
- Product
- Senayan Library Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2023In BitmapExport.java, there is a possible failure to truncate images due to a logic error in the code.Product: AndroidVersions: Android kernelAndroid ID: A-2642CVE-2023-21036 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In BitmapExport.java, there is a possible failure to truncate images due to a logic error in the code.Product: AndroidVersions: Android kernelAndroid ID: A-264261868References: N/A
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Mar 5, 2023Cross-site Scripting (XSS) - Stored in GitHub repository icret/easyimages2.0 prior to 2.6.7.CVE-2023-1181 · Other software · icret · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository icret/easyimages2.0 prior to 2.6.7.
- Product
- icret/easyimages2.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2023Cross-Site Request Forgery (CSRF) vulnerability in RoboSoft Photo Gallery, Images, Slider in Rbs Image Gallery plugin <= 3.2.9 leading to galleries hierarchy chCVE-2022-45804 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in RoboSoft Photo Gallery, Images, Slider in Rbs Image Gallery plugin <= 3.2.9 leading to galleries hierarchy change, included plugin deactivate & activate.
- Fixed in
- 3.2.11
- What to do
- Update the plugin to 3.2.11 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Feb 27, 2023ShortPixel Adaptive Images: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-0334 · WordPress plugins & themes · reported by WPScanMedium 6.1
The ShortPixel Adaptive Images WordPress plugin before 3.6.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against any high privilege users such as admin
- Product
- ShortPixel Adaptive Images
- Fixed in
- 3.6.3
- What to do
- Update ShortPixel Adaptive Images to 3.6.3 or newer.
Feb 16, 2023Qaelum DOSE 18.08 through 21.1 before 21.2 allows Directory Traversal via the loadimages name parameter.CVE-2022-38731 · Other software · Qaelum · reported by MITREMedium 4.3
Qaelum DOSE 18.08 through 21.1 before 21.2 allows Directory Traversal via the loadimages name parameter. It allows a user to specify an arbitrary location on the server's filesystem from which to load an image. (Only images are displayed to the attacker. All other files are loaded but not displayed.) The Content-Type response header reflects the actual content type of the file being requested. This allows an attacker to enumerate files on the local system. Additionally, remote resources can be requested via a UNC path, allowing an attacker to coerce authentication out from the server to the attackers machine.
- Product
- Dose
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2023SQL Injection vulnerability in Ehoney version 2.0.0 in models/protocol.go and models/images.go, allows attackers to execute arbitrary code.CVE-2022-38868 · Other software · Ehoney Project · reported by MITREHigh 7.2
SQL Injection vulnerability in Ehoney version 2.0.0 in models/protocol.go and models/images.go, allows attackers to execute arbitrary code.
- Product
- Ehoney
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2023HP Factory Preinstalled Images on certain systems that shipped with Windows 10 versions 20H2 and earlier OS versions might allow escalation of privilege via exeCVE-2022-38396 · Other software · HP Inc. · reported by hp-security-alert@hp.comHigh 7.8
HP Factory Preinstalled Images on certain systems that shipped with Windows 10 versions 20H2 and earlier OS versions might allow escalation of privilege via execution of certain files outside the restricted path. This potential vulnerability was remediated starting with Windows 10 versions 21H2 on October 31, 2021.
- Product
- HP Factory Preinstalled Windows 10 20H2 Images
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hp.comsupport.hp.com
Feb 6, 2023syft is a a CLI tool and Go library for generating a Software Bill of Materials (SBOM) from container images and filesystems.CVE-2023-24827 · Other software · anchore · reported by GitHubMedium 6.5
syft is a a CLI tool and Go library for generating a Software Bill of Materials (SBOM) from container images and filesystems. A password disclosure flaw was found in Syft versions v0.69.0 and v0.69.1. This flaw leaks the password stored in the SYFT_ATTEST_PASSWORD environment variable. The `SYFT_ATTEST_PASSWORD` environment variable is for the `syft attest` command to generate attested SBOMs for the given container image. This environment variable is used to decrypt the private key (provided with `syft attest --key <path-to-key-file>`) during the signing process while generating an SBOM attestation. This vulnerability affects users running syft that have the `SYFT_ATTEST_PASSWORD` environment variable set with credentials (regardless of if the attest command is being used or not). Users that do not have the environment variable `SYFT_ATTEST_PASSWORD` set are not affected by this issue. The credentials are leaked in two ways: in the syft logs when `-vv` or `-vvv` are used in the syft command (which is any log level >= `DEBUG`) and in the attestation or SBOM only when the `syft-json` format is used. Note that as of v0.69.0 any generated attestations by the `syft attest` command are
- Product
- syft
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2023Buffer Overflow vulnerability in pdfimages in xpdf 4.03 allows attackers to crash the application via crafted command.CVE-2021-36493 · Other software · Xpdfreader · reported by MITREHigh 7.5
Buffer Overflow vulnerability in pdfimages in xpdf 4.03 allows attackers to crash the application via crafted command.
- Product
- Xpdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforum.xpdfreader.comforum.xpdfreader.com
Jan 31, 2023Easy Images v2.0 was discovered to contain an arbitrary file download vulnerability via the component /application/down.php.CVE-2022-48161 · Other software · Easy Images Project · reported by MITREHigh 7.5
Easy Images v2.0 was discovered to contain an arbitrary file download vulnerability via the component /application/down.php. This vulnerability is exploited via a crafted GET request.
- Product
- Easy Images
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2023In onActivityResult of AvatarPickerActivity.java, there is a possible way to access images belonging to other users due to a missing permission check.CVE-2023-20912 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In onActivityResult of AvatarPickerActivity.java, there is a possible way to access images belonging to other users due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-246301995
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Jan 23, 2023Optimize images ALT Text & names for SEO using AI: Does not have CSRF check in placeCVE-2022-4548 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Optimize images ALT Text & names for SEO using AI WordPress plugin before 2.0.8 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged-in admin change them via a CSRF attack.
- Product
- Optimize images ALT Text & names for SEO using AI
- Fixed in
- 2.0.8
- What to do
- Update Optimize images ALT Text & names for SEO using AI to 2.0.8 or newer.
Jan 18, 2023SQL Injection vulnerability in file /inxedu/demo_inxedu_open/src/main/resources/mybatis/inxedu/website/WebsiteImagesMapper.xml in inxedu 2.0.6 via the id value.CVE-2020-35326 · Other software · Inxedu · reported by MITRECritical 9.8
SQL Injection vulnerability in file /inxedu/demo_inxedu_open/src/main/resources/mybatis/inxedu/website/WebsiteImagesMapper.xml in inxedu 2.0.6 via the id value.
- Product
- Inxedu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2023Images Optimize and Upload CF7: Does not validate the file to be deleted via an AJAX action available to unauthenticated usersCVE-2022-4101 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Images Optimize and Upload CF7 WordPress plugin through 2.1.4 does not validate the file to be deleted via an AJAX action available to unauthenticated users, which could allow them to delete arbitrary files on the server via path traversal attack.
- Product
- Images Optimize and Upload CF7
- Affected
- up to 2.1.4
- What to do
- Affects up to 2.1.4. Update Images Optimize and Upload CF7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 9, 2023WPtouch: Does not properly validate images to be uploadedCVE-2022-3416 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WPtouch WordPress plugin before 4.3.45 does not properly validate images to be uploaded, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup)
- Product
- WPtouch
- Fixed in
- 4.3.45
- What to do
- Update WPtouch to 4.3.45 or newer.
Jan 3, 2023Spinnaker is an open source, multi-cloud continuous delivery platform for releasing software changes, and Spinnaker's Rosco microservice produces machine imagesCVE-2022-23506 · Other software · spinnaker · reported by GitHubMedium 4.3
Spinnaker is an open source, multi-cloud continuous delivery platform for releasing software changes, and Spinnaker's Rosco microservice produces machine images. Rosco prior to versions 1.29.2, 1.28.4, and 1.27.3 does not property mask secrets generated via packer builds. This can lead to exposure of sensitive AWS credentials in packer log files. Versions 1.29.2, 1.28.4, and 1.27.3 of Rosco contain fixes for this issue. A workaround is available. It's recommended to use short lived credentials via role assumption and IAM profiles. Additionally, credentials can be set in `/home/spinnaker/.aws/credentials` and `/home/spinnaker/.aws/config` as a volume mount for Rosco pods vs. setting credentials in roscos bake config properties. Last even with those it's recommend to use IAM Roles vs. long lived credentials. This drastically mitigates the risk of credentials exposure. If users have used static credentials, it's recommended to purge any bake logs for AWS, evaluate whether AWS_ACCESS_KEY, SECRET_KEY and/or other sensitive data has been introduced in log files and bake job logs. Then, rotate these credentials and evaluate potential improper use of those credentials.
- Product
- spinnaker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2023multimedial images: Does not properly sanitize and escape a parameter before using it in a SQL statementCVE-2022-4370 · WordPress plugins & themes · reported by WPScanHigh 7.2
The multimedial images WordPress plugin through 1.0b does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Admin.
- Product
- multimedial images
- Affected
- up to 1.0b
- What to do
- Affects up to 1.0b. Update multimedial images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Dec 30, 2022A vulnerability has been found in aerouk imageserve and classified as problematic.CVE-2017-20153 · Other software · aerouk · reported by VulDBLow 2.6
A vulnerability has been found in aerouk imageserve and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation of the argument REQUEST_URI leads to cross site scripting. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier of the patch is 2ac3cd4f90b4df66874fab171376ca26868604c4. It is recommended to apply a patch to fix this issue. The identifier VDB-217057 was assigned to this vulnerability.
- Product
- imageserve
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 30, 2022A vulnerability, which was classified as problematic, was found in aerouk imageserve.CVE-2017-20152 · Other software · aerouk · reported by VulDBLow 3.1
A vulnerability, which was classified as problematic, was found in aerouk imageserve. Affected is an unknown function of the file public/viewer.php of the component File Handler. The manipulation of the argument filelocation leads to path traversal. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is bd23c784f0e5cb12f66d15c100248449f87d72e2. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217056.
- Product
- imageserve
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2022Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro: Do not escape the cg_copy_start POST parameter before concatenating it to an SQL query in copy-gallery-imagesCVE-2022-4161 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_copy_start POST parameter before concatenating it to an SQL query in copy-gallery-images.php. This may allow malicious users with at least author privilege to leak sensitive information from the site's database.
- Product
- Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro
- Fixed in
- 19.1.5.1
- What to do
- Update Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro to 19.1.5.1 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Dec 26, 2022Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro: Do not escape the option_id GET parameter before concatenating it to an SQL query in export-images-dataCVE-2022-4151 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the option_id GET parameter before concatenating it to an SQL query in export-images-data.php. This may allow malicious users with at least author privilege to leak sensitive information from the site's database.
- Product
- Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro
- Fixed in
- 19.1.5.1
- What to do
- Update Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro to 19.1.5.1 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Dec 22, 2022A heap out of bounds read vulnerability exists in the handling of IPTC data while parsing TIFF images in OpenImageIO v2.3.19.0.CVE-2022-41649 · Other software · OpenImageIO Project · reported by talos-cna@cisco.comCritical 9.1
A heap out of bounds read vulnerability exists in the handling of IPTC data while parsing TIFF images in OpenImageIO v2.3.19.0. A specially-crafted TIFF file can cause a read of adjacent heap memory, which can leak sensitive process information. An attacker can provide a malicious file to trigger this vulnerability.
- Product
- OpenImageIO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orgsecurity.gentoo.org
Dec 22, 2022A heap out-of-bounds write vulnerability exists in the way OpenImageIO v2.3.19.0 processes RLE encoded BMP images.CVE-2022-38143 · Other software · OpenImageIO Project · reported by talos-cna@cisco.comCritical 9.8
A heap out-of-bounds write vulnerability exists in the way OpenImageIO v2.3.19.0 processes RLE encoded BMP images. A specially-crafted bmp file can write to arbitrary out of bounds memory, which can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
- Product
- OpenImageIO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.gentoo.orgtalosintelligence.com
Dec 21, 2022A vulnerability was found in Auto Upload Images up to 3.3.0 and classified as problematic.CVE-2022-4633 · Other software · Auto Upload Images Project · reported by VulDBMedium 4.3
A vulnerability was found in Auto Upload Images up to 3.3.0 and classified as problematic. Affected by this issue is some unknown functionality of the file src/setting-page.php of the component Settings Handler. The manipulation leads to cross-site request forgery. The attack may be launched remotely. Upgrading to version 3.3.1 is able to address this issue. The name of the patch is 895770ee93887ec78429c78ffdfb865bee6f9436. It is recommended to upgrade the affected component. VDB-216482 is the identifier assigned to this vulnerability.
- Product
- Auto Upload Images
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 21, 2022A vulnerability has been found in Auto Upload Images up to 3.3.0 and classified as problematic.CVE-2022-4632 · Other software · Auto Upload Images Project · reported by VulDBLow 3.5
A vulnerability has been found in Auto Upload Images up to 3.3.0 and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 3.3.1 is able to address this issue. The name of the patch is 895770ee93887ec78429c78ffdfb865bee6f9436. It is recommended to upgrade the affected component. The identifier VDB-216481 was assigned to this vulnerability.
- Product
- Auto Upload Images
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2022In Mahara 21.04 before 21.04.7, 21.10 before 21.10.5, 22.04 before 22.04.3, and 22.10 before 22.10.0, embedded images are accessible without a sufficient permisCVE-2022-42707 · Other software · Mahara · reported by MITREHigh 7.5
In Mahara 21.04 before 21.04.7, 21.10 before 21.10.5, 22.04 before 22.04.3, and 22.10 before 22.10.0, embedded images are accessible without a sufficient permission check under certain conditions.
- Product
- Mahara
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.launchpad.netmahara.org
Oct 31, 2022The provided HCL Launch Container images contain non-unique HTTPS certificates and a database encryption key.CVE-2021-27784 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.9
The provided HCL Launch Container images contain non-unique HTTPS certificates and a database encryption key. The fix provides directions and tools to replace the non-unique keys and certificates. This does not affect the standard installer packages.
- Product
- HCL Launch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Oct 21, 2022LibTIFF 4.4.0 has an out-of-bounds write in _TIFFmemcpy in libtiff/tif_unix.c:346 when called from extractImageSection, tools/tiffcrop.c:6860, allowing attackerCVE-2022-3627 · Other software · libtiff · reported by cve@gitlab.comMedium 5.5
LibTIFF 4.4.0 has an out-of-bounds write in _TIFFmemcpy in libtiff/tif_unix.c:346 when called from extractImageSection, tools/tiffcrop.c:6860, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 236b7191.
- Product
- libtiff
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2022LibTIFF 4.4.0 has an out-of-bounds write in _TIFFmemcpy in libtiff/tif_unix.c:346 when called from extractImageSection, tools/tiffcrop.c:6826, allowing attackerCVE-2022-3597 · Other software · libtiff · reported by cve@gitlab.comMedium 5.5
LibTIFF 4.4.0 has an out-of-bounds write in _TIFFmemcpy in libtiff/tif_unix.c:346 when called from extractImageSection, tools/tiffcrop.c:6826, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 236b7191.
- Product
- libtiff
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2022Qemu before 2.0 block driver for Hyper-V VHDX Images is vulnerable to infinite loops and other potential issues when calculating BAT entries, due to missing bouCVE-2014-0148 · Other software · Qemu · reported by Red HatMedium 5.5
Qemu before 2.0 block driver for Hyper-V VHDX Images is vulnerable to infinite loops and other potential issues when calculating BAT entries, due to missing bounds checks for block_size and logical_sector_size variables. These are used to derive other fields like 'sectors_per_block' etc. A user able to alter the Qemu disk image could ise this flaw to crash the Qemu instance resulting in DoS.
- Product
- Qemu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.qemu.orgrhn.redhat.com
Sep 23, 2022SWFTools commit 772e55a2 was discovered to contain a stack overflow via ImageStream::getPixel(unsigned char*) at /xpdf/Stream.cc.CVE-2022-35099 · Other software · Swftools · reported by MITREMedium 5.5
SWFTools commit 772e55a2 was discovered to contain a stack overflow via ImageStream::getPixel(unsigned char*) at /xpdf/Stream.cc.
- Product
- Swftools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.