Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
15,261 results · page 133 of 306
Mar 18, 2022Syltek application before its 10.22.00 version, does not correctly check that a product ID has a valid payment associated to it.CVE-2021-4031 · Other software · Syltek · reported by cve-coordination@incibe.esHigh 7.5
Syltek application before its 10.22.00 version, does not correctly check that a product ID has a valid payment associated to it. This could allow an attacker to forge a request and bypass the payment system by marking items as payed without any verification.
- Product
- Syltek
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordincibe-cert.esincibe-cert.es
Mar 18, 2022The Web application of Brocade Fabric OS before versions Brocade Fabric OS v9.0.1a and v8.2.3a contains debug statements that expose sensitive information to thCVE-2021-27789 · Other software · Broadcom · reported by sirt@brocade.comMedium 6.5
The Web application of Brocade Fabric OS before versions Brocade Fabric OS v9.0.1a and v8.2.3a contains debug statements that expose sensitive information to the program's standard output device. An attacker who has compromised the FOS system may utilize this weakness to capture sensitive information, such as user credentials.
- Product
- Fabric Operating System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbroadcom.combroadcom.com
Mar 18, 2022The Online Admission System 1.0 allows an unauthenticated attacker to upload or transfer files of dangerous types to the application through documents.php, whicCVE-2021-45835 · Other software · Online Admission System Project · reported by MITRECritical 9.8
The Online Admission System 1.0 allows an unauthenticated attacker to upload or transfer files of dangerous types to the application through documents.php, which may be used to execute malicious code or lead to code execution.
- Product
- Online Admissions System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2022Zulip is an open source group chat application.CVE-2022-24751 · Other software · zulip · reported by GitHubMedium 5.4
Zulip is an open source group chat application. Starting with version 4.0 and prior to version 4.11, Zulip is vulnerable to a race condition during account deactivation, where a simultaneous access by the user being deactivated may, in rare cases, allow continued access by the deactivated user. A patch is available in version 4.11 on the 4.x branch and version 5.0-rc1 on the 5.x branch. Upgrading to a fixed version will, as a side effect, deactivate any cached sessions that may have been leaked through this bug. There are currently no known workarounds.
- Product
- zulip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2022The microweber application allows large characters to insert in the input field "fist & last name" which can allow attackers to cause a Denial of Service (DoS) CVE-2022-0968 · Other software · microweber · reported by security@huntr.devMedium 5.5
The microweber application allows large characters to insert in the input field "fist & last name" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request. in microweber/microweber in GitHub repository microweber/microweber prior to 1.2.12.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2022SyliusGridBundle is a package of generic data grids for Symfony applications.CVE-2022-24752 · Other software · Sylius · reported by GitHubCritical 9.8
SyliusGridBundle is a package of generic data grids for Symfony applications. Prior to versions 1.10.1 and 1.11-rc2, values added at the end of query sorting were passed directly to the database. The maintainers do not know if this could lead to direct SQL injections but took steps to remediate the vulnerability. The issue is fixed in versions 1.10.1 and 1.11-rc2. As a workaround, overwrite the`Sylius\Component\Grid\Sorting\Sorter.php` class and register it in the container. More information about this workaround is available in the GitHub Security Advisory.
- Product
- SyliusGridBundle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2022The microweber application allows large characters to insert in the input field "post title" which can allow attackers to cause a Denial of Service (DoS) via a CVE-2022-0961 · Other software · microweber · reported by security@huntr.devMedium 5.5
The microweber application allows large characters to insert in the input field "post title" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request. in GitHub repository microweber/microweber prior to 1.2.12.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 14, 2022IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 is vulnerable to server-side request forgery, caused by improper input of application server registraCVE-2021-39051 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 is vulnerable to server-side request forgery, caused by improper input of application server registration function. A remote attacker could exploit this vulnerability using the host address and port fields of the application server registration form in the portal UI to enumerate and attack services that are running on those hosts. IBM X-Force ID: 214441.
- Product
- Spectrum Copy Data Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Mar 14, 2022With administrator or admin privileges the application can be tricked into overwriting files in app_data/Config folder, e.g.CVE-2022-24387 · Other software · SmarterTools · reported by csirt@divd.nlCritical 9.1
With administrator or admin privileges the application can be tricked into overwriting files in app_data/Config folder, e.g. the systemsettings.xml file. THis is possible in SmarterTrack v100.0.8019.14010
- Product
- SmarterTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcsirt.divd.nlcsirt.divd.nl
Mar 11, 2022Wire-ios is a messaging application using the wire protocol on apple's ios platform.CVE-2022-23625 · Other software · wireapp · reported by GitHubMedium 6.5
Wire-ios is a messaging application using the wire protocol on apple's ios platform. In versions prior to 3.95 malformed resource identifiers may render the iOS Wire Client completely unusable by causing it to repeatedly crash on launch. These malformed resource identifiers can be generated and sent between Wire users. The root cause lies in [wireapp/wire-ios-transport](https://github.com/wireapp/wire-ios-transport), where code responsible for removing sensible tokens before logging may fail and lead to a crash (Swift exception) of the application. This causes undesirable behavior, however the (greater) Wire system is still functional. Users are advised to upgrade as soon as possible. There are no known workarounds for this issue.
- Product
- wire-ios
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2022The following Yokogawa Electric products hard-code the password for CAMS server applications: CENTUM VP versions from R5.01.00 to R5.04.20 and versions from R6.CVE-2022-23402 · Other software · Yokogawa Electric Corporation · reported by vultures@jpcert.or.jpCritical 9.8
The following Yokogawa Electric products hard-code the password for CAMS server applications: CENTUM VP versions from R5.01.00 to R5.04.20 and versions from R6.01.00 to R6.08.00, Exaopc versions from R3.72.00 to R3.79.00
- Product
- CENTUM VP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordweb-material3.yokogawa.comweb-material3.yokogawa.com
Mar 10, 2022An XML Entity Expansion (XEE) issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6CVE-2022-26662 · Other software · Tryton · reported by MITREHigh 7.5
An XML Entity Expansion (XEE) issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An unauthenticated user can send a crafted XML-RPC message to consume all the resources of the server.
- Product
- Proteus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.tryton.orgdiscuss.tryton.org
Mar 10, 2022An XXE issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton ApplicCVE-2022-26661 · Other software · Tryton · reported by MITREMedium 6.5
An XXE issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An authenticated user can make the server parse a crafted XML SEPA file to access arbitrary files on the system.
- Product
- Proteus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.tryton.orgdiscuss.tryton.org
Mar 10, 2022Due to missing authorization check, SAP NetWeaver Application Server for ABAP - versions 700, 701, 702, 731, allows an authenticated attacker, to access contentCVE-2022-26102 · Network & remote access · SAP SE · reported by cna@sap.comMedium 5.4
Due to missing authorization check, SAP NetWeaver Application Server for ABAP - versions 700, 701, 702, 731, allows an authenticated attacker, to access content on the start screen of any transaction that is available with in the same SAP system even if he/she isn't authorized for that transaction. A successful exploitation could expose information and in worst case manipulate data before the start screen is executed, resulting in limited impact on confidentiality and integrity of the application.
- Product
- SAP NetWeaver Application Server for ABAP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddam.sap.comlaunchpad.support.sap.com
Mar 10, 2022Improper access control vulnerability in BixbyTouch prior to version 2.2.00.6 in China models allows untrusted applications to load arbitrary URL and local fileCVE-2022-25824 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4
Improper access control vulnerability in BixbyTouch prior to version 2.2.00.6 in China models allows untrusted applications to load arbitrary URL and local files in webview.
- Product
- BixbyTouch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Mar 10, 2022PendingIntent hijacking vulnerability in Weather application prior to SMR Mar-2022 Release 1 allows local attackers to perform unauthorized action without permiCVE-2022-25815 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5.5
PendingIntent hijacking vulnerability in Weather application prior to SMR Mar-2022 Release 1 allows local attackers to perform unauthorized action without permission via hijacking the PendingIntent.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Mar 10, 2022An Improper access control vulnerability in StRetailModeReceiver in Wear OS 3.0 prior to Firmware update MAR-2022 Release allows untrusted applications to resetCVE-2022-24930 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4.4
An Improper access control vulnerability in StRetailModeReceiver in Wear OS 3.0 prior to Firmware update MAR-2022 Release allows untrusted applications to reset default app settings without a proper permission
- Product
- Samsung Wearable Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Mar 10, 2022The absence of filters when loading some sections in the web application of the vulnerable device allows attackers to inject malicious code that will be interprCVE-2022-24915 · Other software · IPCOMM · reported by ics-cert@hq.dhs.govHigh 8
The absence of filters when loading some sections in the web application of the vulnerable device allows attackers to inject malicious code that will be interpreted when a legitimate user accesses the web section where the information is displayed. Injection can be done on specific parameters. The injected code is executed when a legitimate user attempts to upload, copy, download, or delete an existing configuration (Administrative Services).
- Product
- IPCOMM ipDIO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2022The absence of filters when loading some sections in the web application of the vulnerable device allows attackers to inject malicious code that will be interprCVE-2022-22985 · Other software · IPCOMM · reported by ics-cert@hq.dhs.govHigh 8.8
The absence of filters when loading some sections in the web application of the vulnerable device allows attackers to inject malicious code that will be interpreted when a legitimate user accesses the specific web section where the information is displayed. Injection can be done on specific parameters. The injected code is executed when a legitimate user attempts to review history.
- Product
- IPCOMM ipDIO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2022In ims service, there is a possible unexpected application behavior due to incorrect privilege assignment.CVE-2022-20051 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comMedium 5.5
In ims service, there is a possible unexpected application behavior due to incorrect privilege assignment. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06219127; Issue ID: ALPS06219127.
- Product
- MT6731, MT6732, MT6735, MT6737, MT6739, MT6750, MT6750S, MT6752, MT6753, MT6755, MT6755S, MT6757, MT6757C, MT6757CD, MT6757CH, MT6758, MT6761, MT6762, MT6763, M
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcorp.mediatek.comcorp.mediatek.com
Mar 10, 2022A cross-site scripting (XSS) attack can cause arbitrary code (JavaScript) to run in a user's browser and can use an application as the vehicle for the attack.CVE-2021-33852 · Other software · Metaphorcreations · reported by disclose@cybersecurityworks.comMedium 5.4
A cross-site scripting (XSS) attack can cause arbitrary code (JavaScript) to run in a user's browser and can use an application as the vehicle for the attack. The XSS payload given in the "Duplicate Title" text box executes whenever the user opens the Settings Page of the Post Duplicator Plugin or the application root page after duplicating any of the existing posts.
- Product
- Post Duplicator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcybersecurityworks.comcybersecurityworks.com
Mar 10, 2022A cross-site scripting (XSS) attack can cause arbitrary code (JavaScript) to run in a user's browser and can use an application as the vehicle for the attack.CVE-2021-33851 · Other software · Apasionados · reported by disclose@cybersecurityworks.comMedium 5.4
A cross-site scripting (XSS) attack can cause arbitrary code (JavaScript) to run in a user's browser and can use an application as the vehicle for the attack. The XSS payload given in the "Custom logo link" executes whenever the user opens the Settings Page of the "Customize Login Image" Plugin.
- Product
- Customize Login Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcybersecurityworks.comcybersecurityworks.com
Mar 9, 2022Tablet Windows User Interface Application Elevation of Privilege VulnerabilityCVE-2022-24460 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Tablet Windows User Interface Application Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 8, 2022A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.29).CVE-2022-26317 · Other software · Siemens · reported by productcert@siemens.comMedium 6.5
A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.29). When returning the result of a completed Microflow execution call the affected framework does not correctly verify, if the request was initially made by the user requesting the result. Together with predictable identifiers for Microflow execution calls, this could allow a malicious attacker to retrieve information about arbitrary Microflow execution calls made by users within the affected system.
- Product
- Mendix Applications using Mendix 7
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comcert-portal.siemens.com
Mar 4, 2022" Insecure password storage issue.The application stores sensitive information in cleartext within a resource that might be accessible to another control sphereCVE-2021-27757 · Other software · Hcltech · reported by psirt@hcl.comHigh 7.5
" Insecure password storage issue.The application stores sensitive information in cleartext within a resource that might be accessible to another control sphere.Since the information is stored in cleartext, attackers could potentially read it and gain access to sensitive information."
- Product
- Bigfix Insights
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Mar 4, 2022In spring cloud gateway versions prior to 3.1.1+ , applications that are configured to enable HTTP2 and no key store or trusted certificates are set will be conCVE-2022-22946 · Other software · VMware · reported by security@vmware.comMedium 5.5
In spring cloud gateway versions prior to 3.1.1+ , applications that are configured to enable HTTP2 and no key store or trusted certificates are set will be configured to use an insecure TrustManager. This makes the gateway able to connect to remote services with invalid or custom certificates.
- Product
- Spring Cloud Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtanzu.vmware.comoracle.com
Mar 3, 2022Twisted is an event-based framework for internet applications, supporting Python 3.6+.CVE-2022-21716 · Other software · twisted · reported by GitHubHigh 7.5
Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 22.2.0, Twisted SSH client and server implement is able to accept an infinite amount of data for the peer's SSH version identifier. This ends up with a buffer using all the available memory. The attach is a simple as `nc -rv localhost 22 < /dev/zero`. A patch is available in version 22.2.0. There are currently no known workarounds.
- Product
- twisted
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2022The biometric lock in Devolutions Password Hub for iOS before 2021.3.4 allows attackers to access the application because of authentication bypass.CVE-2022-23849 · Other software · Devolutions · reported by MITREMedium 6.6
The biometric lock in Devolutions Password Hub for iOS before 2021.3.4 allows attackers to access the application because of authentication bypass. An attacker must rapidly make failed biometric authentication attempts.
- Product
- Password HUB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevolutions.netdevolutions.net
Feb 28, 2022An issue was discovered in the web application in Cherwell Service Management (CSM) 10.2.3.CVE-2022-26158 · Other software · Cherwell · reported by MITREMedium 6.1
An issue was discovered in the web application in Cherwell Service Management (CSM) 10.2.3. It accepts and reflects arbitrary domains supplied via a client-controlled Host header. Injection of a malicious URL in the Host: header of the HTTP Request results in a 302 redirect to an attacker-controlled page.
- Product
- Cherwell Service Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comhelp.cherwell.com
Feb 28, 2022An issue was discovered in the web application in Cherwell Service Management (CSM) 10.2.3.CVE-2022-26157 · Other software · Cherwell · reported by MITREMedium 5.3
An issue was discovered in the web application in Cherwell Service Management (CSM) 10.2.3. The ASP.NET_Sessionid cookie is not protected by the Secure flag. This makes it prone to interception by an attacker if traffic is sent over unencrypted channels.
- Product
- Cherwell Service Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comhelp.cherwell.com
Feb 28, 2022An issue was discovered in the web application in Cherwell Service Management (CSM) 10.2.3.CVE-2022-26156 · Other software · Cherwell · reported by MITREMedium 6.1
An issue was discovered in the web application in Cherwell Service Management (CSM) 10.2.3. Injection of a malicious payload within the RelayState= parameter of the HTTP request body results in the hijacking of the form action. Form-action hijacking vulnerabilities arise when an application places user-supplied input into the action URL of an HTML form. An attacker can use this vulnerability to construct a URL that, if visited by another application user, will modify the action URL of a form to point to the attacker's server.
- Product
- Cherwell Service Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comhelp.cherwell.com
Feb 28, 2022An issue was discovered in the web application in Cherwell Service Management (CSM) 10.2.3.CVE-2022-26155 · Other software · Cherwell · reported by MITREMedium 6.1
An issue was discovered in the web application in Cherwell Service Management (CSM) 10.2.3. XSS can occur via a payload in the SAMLResponse parameter of the HTTP request body.
- Product
- Cherwell Service Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comhelp.cherwell.com
Feb 24, 2022The Visual Voice Mail (VVM) application through 2022-02-24 for Android allows persistent access if an attacker temporarily controls an application that has the CVE-2022-23835 · Other software · Visual Voice Mail Project · reported by MITREHigh 8.1
The Visual Voice Mail (VVM) application through 2022-02-24 for Android allows persistent access if an attacker temporarily controls an application that has the READ_SMS permission, and reads an IMAP credentialing message that is (by design) not displayed to the victim within the AOSP SMS/MMS messaging application. (Often, the IMAP credentials are usable to listen to voice mail messages sent before the vulnerability was exploited, in addition to new ones.) NOTE: some vendors characterize this as not a "concrete and exploitable risk.
- Product
- Visual Voice Mail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2022IBM WebSphere Application Server 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 22.0.0.2 could allow a remote attacker to hijack the clickingCVE-2021-39038 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.4
IBM WebSphere Application Server 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 22.0.0.2 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 213968.
- Product
- WebSphere Application Server Liberty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Feb 24, 2022Anuko Time Tracker is an open source, web-based time tracking application written in PHP.CVE-2022-24708 · Other software · anuko · reported by GitHubMedium 6.5
Anuko Time Tracker is an open source, web-based time tracking application written in PHP. ttUser.class.php in Time Tracker versions prior to 1.20.0.5646 was not escaping primary group name for display. Because of that, it was possible for a logged in user to modify primary group name with elements of JavaScript. Such script could then be executed in user browser on subsequent requests on pages where primary group name was displayed. This is vulnerability has been fixed in version 1.20.0.5646. Users who are unable to upgrade may modify ttUser.class.php to use an additional call to htmlspecialchars when printing group name.
- Product
- timetracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2022Anuko Time Tracker is an open source, web-based time tracking application written in PHP.CVE-2022-24707 · Other software · anuko · reported by GitHubHigh 7.4
Anuko Time Tracker is an open source, web-based time tracking application written in PHP. UNION SQL injection and time-based blind injection vulnerabilities existed in Time Tracker Puncher plugin in versions of anuko timetracker prior to 1.20.0.5642. This was happening because the Puncher plugin was reusing code from other places and was relying on an unsanitized date parameter in POST requests. Because the parameter was not checked, it was possible to craft POST requests with malicious SQL for Time Tracker database. This issue has been resolved in in version 1.20.0.5642. Users unable to upgrade are advised to add their own checks to input.
- Product
- timetracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Feb 24, 2022zip4j up to v2.10.0 can throw various uncaught exceptions while parsing a specially crafted ZIP file, which could result in an application crash.CVE-2022-24615 · Other software · Zip4j Project · reported by MITREMedium 5.5
zip4j up to v2.10.0 can throw various uncaught exceptions while parsing a specially crafted ZIP file, which could result in an application crash. This could be used to mount a denial of service attack against services that use zip4j library.
- Product
- Zip4j
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2022metadata-extractor up to 2.16.0 can throw various uncaught exceptions while parsing a specially crafted JPEG file, which could result in an application crash.CVE-2022-24613 · Other software · Metadata-extractor Project · reported by MITREMedium 5.5
metadata-extractor up to 2.16.0 can throw various uncaught exceptions while parsing a specially crafted JPEG file, which could result in an application crash. This could be used to mount a denial of service attack against services that use metadata-extractor library.
- Product
- Metadata-extractor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 22, 2022Envoy is an open source edge and service proxy, designed for cloud-native applications.CVE-2022-23606 · Other software · envoyproxy · reported by GitHubMedium 4.4
Envoy is an open source edge and service proxy, designed for cloud-native applications. When a cluster is deleted via Cluster Discovery Service (CDS) all idle connections established to endpoints in that cluster are disconnected. A recursion was introduced in the procedure of disconnecting idle connections that can lead to stack exhaustion and abnormal process termination when a cluster has a large number of idle connections. This infinite recursion causes Envoy to crash. Users are advised to upgrade.
- Product
- envoy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 22, 2022Envoy is an open source edge and service proxy, designed for cloud-native applications.CVE-2022-21657 · Other software · envoyproxy · reported by GitHubMedium 6.8
Envoy is an open source edge and service proxy, designed for cloud-native applications. In affected versions Envoy does not restrict the set of certificates it accepts from the peer, either as a TLS client or a TLS server, to only those certificates that contain the necessary extendedKeyUsage (id-kp-serverAuth and id-kp-clientAuth, respectively). This means that a peer may present an e-mail certificate (e.g. id-kp-emailProtection), either as a leaf certificate or as a CA in the chain, and it will be accepted for TLS. This is particularly bad when combined with the issue described in pull request #630, in that it allows a Web PKI CA that is intended only for use with S/MIME, and thus exempted from audit or supervision, to issue TLS certificates that will be accepted by Envoy. As a result Envoy will trust upstream certificates that should not be trusted. There are no known workarounds to this issue. Users are advised to upgrade.
- Product
- envoy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 22, 2022Envoy is an open source edge and service proxy, designed for cloud-native applications.CVE-2022-21656 · Other software · envoyproxy · reported by GitHubHigh 7.4
Envoy is an open source edge and service proxy, designed for cloud-native applications. The default_validator.cc implementation used to implement the default certificate validation routines has a "type confusion" bug when processing subjectAltNames. This processing allows, for example, an rfc822Name or uniformResourceIndicator to be authenticated as a domain name. This confusion allows for the bypassing of nameConstraints, as processed by the underlying OpenSSL/BoringSSL implementation, exposing the possibility of impersonation of arbitrary servers. As a result Envoy will trust upstream certificates that should not be trusted.
- Product
- envoy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 22, 2022Envoy is an open source edge and service proxy, designed for cloud-native applications.CVE-2022-21655 · Other software · envoyproxy · reported by GitHubHigh 7.5
Envoy is an open source edge and service proxy, designed for cloud-native applications. The envoy common router will segfault if an internal redirect selects a route configured with direct response or redirect actions. This will result in a denial of service. As a workaround turn off internal redirects if direct response entries are configured on the same listener.
- Product
- envoy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 22, 2022Envoy is an open source edge and service proxy, designed for cloud-native applications.CVE-2022-21654 · Other software · envoyproxy · reported by GitHubHigh 7.4
Envoy is an open source edge and service proxy, designed for cloud-native applications. Envoy's tls allows re-use when some cert validation settings have changed from their default configuration. The only workaround for this issue is to ensure that default tls settings are used. Users are advised to upgrade.
- Product
- envoy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 22, 2022Envoy is an open source edge and service proxy, designed for cloud-native applications.CVE-2021-43826 · Other software · envoyproxy · reported by GitHubHigh 7.5
Envoy is an open source edge and service proxy, designed for cloud-native applications. In affected versions of Envoy a crash occurs when configured for :ref:`upstream tunneling <envoy_v3_api_field_extensions.filters.network.tcp_proxy.v3.TcpProxy.tunneling_config>` and the downstream connection disconnects while the the upstream connection or http/2 stream is still being established. There are no workarounds for this issue. Users are advised to upgrade.
- Product
- envoy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 22, 2022Envoy is an open source edge and service proxy, designed for cloud-native applications.CVE-2021-43825 · Other software · envoyproxy · reported by GitHubMedium 6.1
Envoy is an open source edge and service proxy, designed for cloud-native applications. Sending a locally generated response must stop further processing of request or response data. Envoy tracks the amount of buffered request and response data and aborts the request if the amount of buffered data is over the limit by sending 413 or 500 responses. However when the buffer overflows while response is processed by the filter chain the operation may not be aborted correctly and result in accessing a freed memory block. If this happens Envoy will crash resulting in a denial of service.
- Product
- envoy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 22, 2022Envoy is an open source edge and service proxy, designed for cloud-native applications.CVE-2021-43824 · Other software · envoyproxy · reported by GitHubHigh 7.5
Envoy is an open source edge and service proxy, designed for cloud-native applications. In affected versions a crafted request crashes Envoy when a CONNECT request is sent to JWT filter configured with regex match. This provides a denial of service attack vector. The only workaround is to not use regex in the JWT filter. Users are advised to upgrade.
- Product
- envoy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2022A locking protection bypass flaw was found in some versions of gnome-shell as shipped within CentOS Stream 8, when the "Application menu" or "Window list" GNOMECVE-2021-20315 · Other software · Gnome · reported by Red HatMedium 6.1
A locking protection bypass flaw was found in some versions of gnome-shell as shipped within CentOS Stream 8, when the "Application menu" or "Window list" GNOME extensions are enabled. This flaw allows a physical attacker who has access to a locked system to kill existing applications and start new ones as the locked user, even if the session is still locked.
- Product
- Gnome-shell
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.redhat.com
Feb 16, 2022IBM Maximo Anywhere 7.6.4.0 applications could allow obfuscation of the application source code.CVE-2019-4352 · Other software · IBM · reported by psirt@us.ibm.comLow 2.4
IBM Maximo Anywhere 7.6.4.0 applications could allow obfuscation of the application source code. IBM X-Force ID: 161494.
- Product
- Maximo Anywhere
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Feb 16, 2022IBM Maximo Anywhere 7.6.4.0 applications could disclose sensitive information to a user with physical access to the device.CVE-2019-4351 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.6
IBM Maximo Anywhere 7.6.4.0 applications could disclose sensitive information to a user with physical access to the device. IBM X-Force ID: 161493.
- Product
- Maximo Anywhere
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Feb 16, 2022IBM Maximo Anywhere 7.6.4.0 could allow an attacker to reverse engineer the application due to the lack of binary protection precautions.CVE-2019-4291 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM Maximo Anywhere 7.6.4.0 could allow an attacker to reverse engineer the application due to the lack of binary protection precautions. IBM X-Force ID: 160697.
- Product
- Maximo Anywhere
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.