Updated 12 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,779exploited flaws on CISA’s list

40added in the last 30 days

548new WordPress flaws this week

397,870entries in the database

19,523 results · page 133 of 391

Sep 16, 2022Post SMTP Mailer/Email Log: Does not escape some of its settings before outputting them in the admins dashboardCVE-2022-2351 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Post SMTP Mailer/Email Log WordPress plugin before 2.1.4 does not escape some of its settings before outputting them in the admins dashboard, allowing high privilege users to perform Cross-Site Scripting attacks against other users even when the unfiltered_html capability is disallowed.
Product
Post SMTP Mailer/Email Log
Fixed in
2.1.4
What to do
Update Post SMTP Mailer/Email Log to 2.1.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 16, 2022Mobile Events Manager: Does not properly escape the Enquiry source fieldCVE-2022-1194 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Mobile Events Manager WordPress plugin before 1.4.8 does not properly escape the Enquiry source field when exporting events, or the Paid for field when exporting transactions as CSV, leading to a CSV injection vulnerability.
Product
Mobile Events Manager
Fixed in
1.4.8
What to do
Update Mobile Events Manager to 1.4.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 14, 2022The HoYoVerse (formerly miHoYo) Genshin Impact mhyprot2.sys 1.0.0.0 anti-cheat driver does not adequately restrict unprivileged function calls, allowing local, CVE-2020-36603 · Other software · Hoyoverse · reported by MITREMedium 6.5
The HoYoVerse (formerly miHoYo) Genshin Impact mhyprot2.sys 1.0.0.0 anti-cheat driver does not adequately restrict unprivileged function calls, allowing local, unprivileged users to execute arbitrary code with SYSTEM privileges on Microsoft Windows systems. The mhyprot2.sys driver must first be installed by a user with administrative privileges.
Product
Mhyprot2
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 13, 2022The WAVLINK Quantum D4G (WN531G3) running firmware version M31G3.V5030.200325 does not utilize anti-CSRF tokens, which, when combined with other issues (such asCVE-2022-40623 · Other software · WAVLINK · reported by cve@rapid7.comHigh 8.8
The WAVLINK Quantum D4G (WN531G3) running firmware version M31G3.V5030.200325 does not utilize anti-CSRF tokens, which, when combined with other issues (such as CVE-2022-35518), can lead to remote, unauthenticated command execution.
Product
WN531G3
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record youtu.be youtu.be
Sep 13, 2022The WAVLINK Quantum D4G (WN531G3) running firmware version M31G3.V5030.200325 uses IP addresses to hold sessions and does not not use session tokens.CVE-2022-40622 · Other software · WAVLINK · reported by cve@rapid7.comHigh 8.8
The WAVLINK Quantum D4G (WN531G3) running firmware version M31G3.V5030.200325 uses IP addresses to hold sessions and does not not use session tokens. Therefore, if an attacker changes their IP address to match the logged-in administrator's, or is behind the same NAT as the logged in administrator, session takeover is possible.
Product
WN531G3
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record youtu.be youtu.be
Sep 13, 2022IBM Control Desk 7.6.1 does not set the secure attribute on authorization tokens or session cookies.CVE-2022-22329 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM Control Desk 7.6.1 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 219124.
Product
Control Desk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com
Sep 13, 2022Unisys Data Exchange Management Studio before 6.0.IC2 and 7.x before 7.0.IC1 doesn't have an Anti-CSRF token to authenticate the POST request.CVE-2022-32555 · Other software · Unisys · reported by MITREHigh 8.8
Unisys Data Exchange Management Studio before 6.0.IC2 and 7.x before 7.0.IC1 doesn't have an Anti-CSRF token to authenticate the POST request. Thus, a cross-site request forgery attack could occur.
Product
Data Exchange Management Studio
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record public.support.unisys.com unisys.com
Sep 13, 2022SAP NetWeaver Enterprise Portal (KMC) - version 7.50, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting vulnerability.CVE-2022-35298 · Network & remote access · SAP SE · reported by cna@sap.comMedium 6.1
SAP NetWeaver Enterprise Portal (KMC) - version 7.50, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting vulnerability. KMC servlet is vulnerable to XSS attack. The execution of script content by a victim registered on the portal could compromise the confidentiality and integrity of victim’s web browser session.
Product
SAP NetWeaver Enterprise Portal (KMC)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com sap.com
Sep 13, 2022The CMS8000 device does not properly control or sanitize the SSID name of a new Wi-Fi access point.CVE-2022-3027 · Other software · Contec Health · reported by ics-cert@hq.dhs.govMedium 5.7
The CMS8000 device does not properly control or sanitize the SSID name of a new Wi-Fi access point. A threat actor could create an SSID with a malicious name, including non-standard characters that, when the device attempts connecting to the malicious SSID, the device can be exploited to write arbitrary files or display incorrect information.
Product
CMS8000 CONTEC ICU CCU Vital Signs Patient Monitor
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Sep 12, 2022On Linksys E5350 WiFi Router with firmware version 1.0.00.037 and lower, (and potentially other vendors/devices due to code reuse), the /SysInfo.htm URI does noCVE-2022-35572 · Network & remote access · Linksys · reported by MITREHigh 7.5
On Linksys E5350 WiFi Router with firmware version 1.0.00.037 and lower, (and potentially other vendors/devices due to code reuse), the /SysInfo.htm URI does not require a session ID. This web page calls a show_sysinfo function which retrieves WPA passwords, SSIDs, MAC Addresses, serial numbers, WPS Pins, and hardware/firmware versions, and prints this information into the web page. This web page is visible when remote management is enabled. A user who has access to the web interface of the device can extract these secrets. If the device has remote management enabled and is connected directly to the internet, this vulnerability is exploitable over the internet without interaction.
Product
E5350 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record willgu.es willgu.es
Sep 12, 2022In lighttpd 1.4.65, mod_wstunnel does not initialize a handler function pointer if an invalid HTTP request (websocket handshake) is received.CVE-2022-37797 · Other software · Lighttpd · reported by MITREHigh 7.5
In lighttpd 1.4.65, mod_wstunnel does not initialize a handler function pointer if an invalid HTTP request (websocket handshake) is received. It leads to null pointer dereference which crashes the server. It could be used by an external attacker to cause denial of service condition.
Product
Lighttpd
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.debian.org redmine.lighttpd.net
Sep 9, 2022The Baxter Spectrum WBM does not perform mutual authentication with the gateway server host.CVE-2022-26394 · Other software · Baxter · reported by productsecurity@baxter.comMedium 5.5
The Baxter Spectrum WBM does not perform mutual authentication with the gateway server host. This may allow an attacker to perform a man in the middle attack that modifies parameters making the network connection fail.
Product
Baxter Spectrum Wireless Battery Module (WBM)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record us-cert.gov cisa.gov
Sep 7, 2022The PlexTrac platform prior to version 1.17.0 does not restrict excessive authentication attempts for accounts configured to use the PlexTrac authentication proCVE-2022-37145 · Other software · Plextrac · reported by MITREHigh 7.5
The PlexTrac platform prior to version 1.17.0 does not restrict excessive authentication attempts for accounts configured to use the PlexTrac authentication provider. An unauthenticated remote attacker could perform a bruteforce attack on the login page with no time or attempt limitation in an attempt to obtain valid credentials for the platform users configured to use the PlexTrac authentication provider.
Product
Plextrac
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record controlgap.com controlgap.com
Sep 7, 2022The PlexTrac platform prior to API version 1.17.0 does not restrict excessive MFA TOTP submission attempts.CVE-2022-37144 · Other software · Plextrac · reported by MITREHigh 8.8
The PlexTrac platform prior to API version 1.17.0 does not restrict excessive MFA TOTP submission attempts. An unauthenticated remote attacker in possession of a valid username and password can bruteforce their way past MFA protections to login as the targeted user.
Product
Plextrac
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record controlgap.com controlgap.com
Sep 5, 2022The Netic User Export add-on before 2.0.6 for Atlassian Jira does not perform authorization checks.CVE-2022-38367 · Other software · Netic · reported by MITREMedium 5.3
The Netic User Export add-on before 2.0.6 for Atlassian Jira does not perform authorization checks. This might allow an unauthenticated user to export all users from Jira by making an HTTP request to the affected endpoint.
Product
User Export For Jira
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com marketplace.atlassian.com
Sep 5, 2022Fast Flow: Does not sanitise and escape some of its Widget settingsCVE-2022-2775 · WordPress plugins & themes · reported by WPScanMedium 5.5
The Fast Flow WordPress plugin before 1.2.13 does not sanitise and escape some of its Widget settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Fast Flow
Fixed in
1.2.13
What to do
Update Fast Flow to 1.2.13 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 5, 2022Visual Portfolio, Photo Gallery & Post Grid: Does not have proper authorisation checks in some of its REST endpointsCVE-2022-2597 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Visual Portfolio, Photo Gallery & Post Grid WordPress plugin before 2.19.0 does not have proper authorisation checks in some of its REST endpoints, allowing users with a role as low as contributor to call them and inject arbitrary CSS in arbitrary saved layouts
Product
Visual Portfolio, Photo Gallery & Post Grid
Fixed in
2.19.0
What to do
Update Visual Portfolio, Photo Gallery & Post Grid to 2.19.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 5, 2022Simple Payment Donations & Subscriptions: Does not sanitise and escape user input given in its formsCVE-2022-2565 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Simple Payment Donations & Subscriptions WordPress plugin before 4.2.1 does not sanitise and escape user input given in its forms, which could allow unauthenticated attackers to perform Cross-Site Scripting attacks against admins
Product
Simple Payment Donations & Subscriptions
Fixed in
4.2.1
What to do
Update Simple Payment Donations & Subscriptions to 4.2.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 5, 2022Visual Portfolio, Photo Gallery & Post Grid: Does not have proper authorisation checks in some of its REST endpointsCVE-2022-2543 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Visual Portfolio, Photo Gallery & Post Grid WordPress plugin before 2.18.0 does not have proper authorisation checks in some of its REST endpoints, allowing unauthenticated users to call them and inject arbitrary CSS in arbitrary saved layouts
Product
Visual Portfolio, Photo Gallery & Post Grid
Fixed in
2.18.0
What to do
Update Visual Portfolio, Photo Gallery & Post Grid to 2.18.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 5, 2022WP Database Backup: Does not escape some of its settingsCVE-2022-2271 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Database Backup WordPress plugin before 5.9 does not escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
WP Database Backup
Fixed in
5.9
What to do
Update WP Database Backup to 5.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 2, 2022BlueZ before 5.59 allows physically proximate attackers to obtain sensitive information because profiles/audio/avrcp.c does not validate params_len.CVE-2022-39176 · Other software · Bluez · reported by MITREHigh 8.8
BlueZ before 5.59 allows physically proximate attackers to obtain sensitive information because profiles/audio/avrcp.c does not validate params_len.
Product
Bluez
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugs.launchpad.net lists.debian.org
Sep 1, 2022Samba does not validate the Validated-DNS-Host-Name right for the dNSHostName attribute which could permit unprivileged users to write it.CVE-2022-32743 · Other software · Samba · reported by Red HatHigh 7.5
Samba does not validate the Validated-DNS-Host-Name right for the dNSHostName attribute which could permit unprivileged users to write it.
Product
Samba
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.samba.org docs.microsoft.com
Aug 31, 2022It was found that Quarkus 2.10.x does not terminate HTTP requests header context which may lead to unpredictable behavior.CVE-2022-2466 · Other software · Quarkus · reported by Red HatCritical 9.8
It was found that Quarkus 2.10.x does not terminate HTTP requests header context which may lead to unpredictable behavior.
Product
Quarkus
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 31, 2022CNCSoft: All versions prior to 1.01.32 does not properly sanitize input while processing a specific project file, allowing a possible stack-based buffer overfloCVE-2022-1405 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 7.8
CNCSoft: All versions prior to 1.01.32 does not properly sanitize input while processing a specific project file, allowing a possible stack-based buffer overflow condition.
Product
CNCSoft
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Aug 31, 2022Delta Electronics CNCSoft (All versions prior to 1.01.32) does not properly sanitize input while processing a specific project file, allowing a possible out-of-CVE-2022-1404 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govLow 3.3
Delta Electronics CNCSoft (All versions prior to 1.01.32) does not properly sanitize input while processing a specific project file, allowing a possible out-of-bounds read condition.
Product
CNCSoft
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Aug 29, 2022Export All URLs: Does not validate the path of the file to be removed on the systemCVE-2022-2638 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Export All URLs WordPress plugin before 4.4 does not validate the path of the file to be removed on the system which is supposed to be the CSV file. This could allow high privilege users to delete arbitrary file from the server
Product
Export All URLs
Fixed in
4.4
What to do
Update Export All URLs to 4.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 29, 2022Anti-Malware Security and Brute-Force Firewall: Does not sanitise and escape some parameters before outputting them back in an admin dashboardCVE-2022-2599 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Anti-Malware Security and Brute-Force Firewall WordPress plugin before 4.21.83 does not sanitise and escape some parameters before outputting them back in an admin dashboard, leading to Reflected Cross-Site Scripting
Product
Anti-Malware Security and Brute-Force Firewall
Fixed in
4.21.83
What to do
Update Anti-Malware Security and Brute-Force Firewall to 4.21.83 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 29, 2022Fluent Support: Does not properly sanitiseCVE-2022-2559 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Fluent Support WordPress plugin before 1.5.8 does not properly sanitise, validate and escape various parameters before using them in an SQL statement, leading to an SQL Injection vulnerability exploitable by high privilege users
Product
Fluent Support
Fixed in
1.5.8
What to do
Update Fluent Support to 1.5.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 29, 2022WP Hide & Security Enhancer: Does not escape a parameter before outputting it back in an attribute of a backend pageCVE-2022-2538 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Hide & Security Enhancer WordPress plugin before 1.8 does not escape a parameter before outputting it back in an attribute of a backend page, leading to a Reflected Cross-Site Scripting
Product
WP Hide & Security Enhancer
Fixed in
1.8
What to do
Update WP Hide & Security Enhancer to 1.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 29, 2022WooCommerce PDF Invoices & Packing Slips: Does not sanitise and escape some parameters before outputting them back in an attributes of an admin pageCVE-2022-2537 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WooCommerce PDF Invoices & Packing Slips WordPress plugin before 3.0.1 does not sanitise and escape some parameters before outputting them back in an attributes of an admin page, leading to Reflected Cross-Site Scripting.
Product
WooCommerce PDF Invoices & Packing Slips
Fixed in
3.0.1
What to do
Update WooCommerce PDF Invoices & Packing Slips to 3.0.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 29, 2022Simply Schedule Appointments: Does not sanitise and escape some of its settingsCVE-2022-2374 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simply Schedule Appointments WordPress plugin before 1.5.7.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Simply Schedule Appointments
Fixed in
1.5.7.7
What to do
Update Simply Schedule Appointments to 1.5.7.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 29, 2022WPIDE: Does not sanitize and validate the filename parameter before using it in a require statement in the admin dashboardCVE-2022-2261 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WPIDE WordPress plugin before 3.0 does not sanitize and validate the filename parameter before using it in a require statement in the admin dashboard, leading to a Local File Inclusion issue.
Product
WPIDE
Fixed in
3.0
What to do
Update WPIDE to 3.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 29, 2022Sensei LMS: Does not ensure that the sender of a private message is either the teacher or the original senderCVE-2022-2080 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Sensei LMS WordPress plugin before 4.5.2 does not ensure that the sender of a private message is either the teacher or the original sender, allowing any authenticated user to send messages to arbitrary private conversation via a IDOR attack. Note: Attackers are not able to see responses/messages between the teacher and student
Product
Sensei LMS
Fixed in
4.5.2
What to do
Update Sensei LMS to 4.5.2 or newer.
Full record and what to do →NVD record hackerone.com wpscan.com
Aug 29, 2022Sensei LMS: Does not have proper permissions set in one of its REST endpointCVE-2022-2034 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Sensei LMS WordPress plugin before 4.5.0 does not have proper permissions set in one of its REST endpoint, allowing unauthenticated users to access private messages sent to teachers
Product
Sensei LMS
Fixed in
4.5.0
What to do
Update Sensei LMS to 4.5.0 or newer.
Full record and what to do →NVD record hackerone.com wpscan.com
Aug 29, 2022Stop Spam Comments: Does not properly generate the Javascript access token for preventing abuse of comment sectionCVE-2022-1663 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Stop Spam Comments WordPress plugin through 0.2.1.2 does not properly generate the Javascript access token for preventing abuse of comment section, allowing threat authors to easily collect the value and add it to the request.
Product
Stop Spam Comments
Affected
up to 0.2.1.2
What to do
Affects up to 0.2.1.2. Update Stop Spam Comments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 29, 2022Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps): Does not properly sanitize some parameters before inserting them into SQL queriesCVE-2022-1123 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps) WordPress plugin before 3.12.5 does not properly sanitize some parameters before inserting them into SQL queries. As a result, high privilege users could perform SQL injection attacks.
Product
Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps)
Fixed in
3.12.5
What to do
Update Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps) to 3.12.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 27, 2022In MariaDB before 10.9.2, compress_write in extra/mariabackup/ds_compress.cc does not release data_mutex upon a stream write failure, which allows local users tCVE-2022-38791 · Other software · Mariadb · reported by MITREMedium 5.5
In MariaDB before 10.9.2, compress_write in extra/mariabackup/ds_compress.cc does not release data_mutex upon a stream write failure, which allows local users to trigger a deadlock.
Product
Mariadb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jira.mariadb.org lists.fedoraproject.org
Aug 26, 2022It was discovered that an internal Prosody library to load XML based on libexpat does not properly restrict the XML features allowed in parsed XML data.CVE-2022-0217 · Other software · Prosody · reported by Red HatHigh 7.5
It was discovered that an internal Prosody library to load XML based on libexpat does not properly restrict the XML features allowed in parsed XML data. Given suitable attacker input, this results in expansion of recursive entity references from DTDs (CWE-776). In addition, depending on the libexpat version used, it may also allow injections using XML External Entity References (CWE-611).
Product
Prosody
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.redhat.com prosody.im
Aug 26, 2022A flaw was found in Red Hat JBoss Core Services HTTP Server in all versions, where it does not properly normalize the path component of a request URL contains dCVE-2021-3688 · Other software · Redhat · reported by Red HatMedium 4.8
A flaw was found in Red Hat JBoss Core Services HTTP Server in all versions, where it does not properly normalize the path component of a request URL contains dot-dot-semicolon(s). This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks. The highest threat from this vulnerability is to data confidentiality and integrity.
Product
Jboss Core Services Httpd
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com bugzilla.redhat.com
Aug 23, 2022Jenkins Job Configuration History Plugin 1165.v8cc9fd1f4597 and earlier does not escape the job name on the System Configuration History page, resulting in a stCVE-2022-38664 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Job Configuration History Plugin 1165.v8cc9fd1f4597 and earlier does not escape the job name on the System Configuration History page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure job names.
Product
Jenkins Job Configuration History Plugin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com jenkins.io
Aug 23, 2022Jenkins Git Plugin 4.11.4 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log provided by the Git Username and PasswoCVE-2022-38663 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 6.5
Jenkins Git Plugin 4.11.4 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log provided by the Git Username and Password (`gitUsernamePassword`) credentials binding.
Product
Jenkins Git Plugin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com jenkins.io
Aug 22, 2022Fiserv Prologue through 2020-12-16 does not properly protect the database password.CVE-2020-35992 · Other software · Fiserv · reported by MITREMedium 6.5
Fiserv Prologue through 2020-12-16 does not properly protect the database password. If an attacker were to gain access to the configuration file (specifically, the LogPassword attribute within appconfig.ini), they would be able to decrypt the password stored within the configuration file. This would yield cleartext credentials for the database (to gain access to financial records of customers stored within the database), and in some cases would allow remote login to the database.
Product
Prologue
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com fiserv.com
Aug 22, 2022The file upload wizard in Zengenti Contensis Classic before 15.2.1.79 does not correctly check that a user has authenticated.CVE-2022-34919 · Other software · Zengenti · reported by MITRECritical 9.8
The file upload wizard in Zengenti Contensis Classic before 15.2.1.79 does not correctly check that a user has authenticated. By uploading a crafted aspx file, it is possible to execute arbitrary commands.
Product
Contensis
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com zengenti.com
Aug 22, 2022Frappe ERPNext 12.29.0 is vulnerable to XSS where the software does not neutralize or incorrectly neutralize user-controllable input before it is placed in outpCVE-2022-28598 · Other software · Frappe · reported by MITREMedium 6.1
Frappe ERPNext 12.29.0 is vulnerable to XSS where the software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is used as a web page that is served to other users.
Product
Erpnext
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com github.com
Aug 22, 2022Auto-hyperlink URLs: Does not set rel="noopener noreferer" on generated linksCVE-2022-2600 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Auto-hyperlink URLs WordPress plugin through 5.4.1 does not set rel="noopener noreferer" on generated links, which can lead to Tab Nabbing by giving the target site access to the source tab through the window.opener DOM object.
Product
Auto-hyperlink URLs
Affected
up to 5.4.1
What to do
Affects up to 5.4.1. Update Auto-hyperlink URLs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 22, 2022Better Search Replace: Does not properly sanitise and escape table data before inserting it into a SQL queryCVE-2022-2593 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Better Search Replace WordPress plugin before 1.4.1 does not properly sanitise and escape table data before inserting it into a SQL query, which could allow high privilege users to perform SQL Injection attacks
Product
Better Search Replace
Fixed in
1.4.1
What to do
Update Better Search Replace to 1.4.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 22, 2022Duplicator: Does not authenticate or authorize visitors before displaying information about the system suchCVE-2022-2552 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Duplicator WordPress plugin before 1.4.7 does not authenticate or authorize visitors before displaying information about the system such as server software, php version and full file system path to the site.
Product
Duplicator
Fixed in
1.4.7
What to do
Update Duplicator to 1.4.7 or newer.
Full record and what to do →NVD record github.com wpscan.com
Aug 22, 2022Ninja Job Board: Does not protect the directory where it stores uploaded resumesCVE-2022-2544 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Ninja Job Board WordPress plugin before 1.3.3 does not protect the directory where it stores uploaded resumes, making it vulnerable to unauthenticated Directory Listing which allows the download of uploaded resumes.
Product
Ninja Job Board
Fixed in
1.3.3
What to do
Update Ninja Job Board to 1.3.3 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Aug 22, 2022Feed Them Social: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2022-2532 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Feed Them Social WordPress plugin before 3.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
Product
Feed Them Social
Fixed in
3.0.1
What to do
Update Feed Them Social to 3.0.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 22, 2022WP phpMyAdmin: Does not escape some of its settingsCVE-2022-2407 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP phpMyAdmin WordPress plugin before 5.2.0.4 does not escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
WP phpMyAdmin
Fixed in
5.2.0.4
What to do
Update WP phpMyAdmin to 5.2.0.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.