Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,059 results · page 14 of 22
Jul 5, 2022Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CCVE-2022-26365 · Computers, phones & browsers · Linux · reported by security@xen.orgHigh 7.1
Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740). Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend (CVE-2022-33741, CVE-2022-33742).
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comxenbits.xen.org
Jun 27, 2022LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g.CVE-2022-31088 · Other software · LDAPAccountManager · reported by GitHubMedium 5.3
LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 the user name field at login could be used to enumerate LDAP data. This is only the case for LDAP search configuration. This issue has been fixed in version 8.0.
- Product
- lam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2022LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g.CVE-2022-31087 · Other software · LDAPAccountManager · reported by GitHubHigh 7.8
LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 the tmp directory, which is accessible by /lam/tmp/, allows interpretation of .php (and .php5/.php4/.phpt/etc) files. An attacker capable of writing files under www-data privileges can write a web-shell into this directory, and gain a Code Execution on the host. This issue has been fixed in version 8.0. Users unable to upgrade should disallow executing PHP scripts in (/var/lib/ldap-account-manager/)tmp directory.
- Product
- lam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2022LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g.CVE-2022-31086 · Other software · LDAPAccountManager · reported by GitHubHigh 8.8
LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 incorrect regular expressions allow to upload PHP scripts to config/templates/pdf. This vulnerability could lead to a Remote Code Execution if the /config/templates/pdf/ directory is accessible for remote users. This is not a default configuration of LAM. This issue has been fixed in version 8.0. There are no known workarounds for this issue.
- Product
- lam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2022LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g.CVE-2022-31085 · Other software · LDAPAccountManager · reported by GitHubMedium 6.1
LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 the session files include the LDAP user name and password in clear text if the PHP OpenSSL extension is not installed or encryption is disabled by configuration. This issue has been fixed in version 8.0. Users unable to upgrade should install the PHP OpenSSL extension and make sure session encryption is enabled in LAM main configuration.
- Product
- lam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2022LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g.CVE-2022-31084 · Other software · LDAPAccountManager · reported by GitHubHigh 8.1
LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 There are cases where LAM instantiates objects from arbitrary classes. An attacker can inject the first constructor argument. This can lead to code execution if non-LAM classes are instantiated that execute code during object creation. This issue has been fixed in version 8.0.
- Product
- lam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2022Greenlight is a simple front-end interface for your BigBlueButton server.CVE-2022-31039 · Other software · bigbluebutton · reported by GitHubMedium 4.3
Greenlight is a simple front-end interface for your BigBlueButton server. In affected versions an attacker can view any room's settings even though they are not authorized to do so. Only the room owner and administrator should be able to view a room's settings. This issue has been patched in release version 2.12.6.
- Product
- greenlight
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 18, 2022Hydrogen is a React-based framework for building dynamic, Shopify-powered custom storefronts.CVE-2022-29230 · Other software · Shopify · reported by GitHubMedium 6.3
Hydrogen is a React-based framework for building dynamic, Shopify-powered custom storefronts. There is a potential Cross-Site Scripting (XSS) vulnerability where an arbitrary user is able to execute scripts on pages that are built with Hydrogen. This affects all versions of Hydrogen starting from version 0.10.0 to 0.18.0. This vulnerability is exploitable in applications whose hydrating data is user controlled. All Hydrogen users should upgrade their project to version 0.19.0. There is no current workaround, and users should update as soon as possible. Additionally, the Content Security Policy is not an effective mitigation for this vulnerability.
- Product
- hydrogen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2022LDAP Account Manager (LAM) is an open source web frontend for managing entries stored in an LDAP directory.CVE-2022-24851 · Other software · LDAPAccountManager · reported by GitHubHigh 8.1
LDAP Account Manager (LAM) is an open source web frontend for managing entries stored in an LDAP directory. The profile editor tool has an edit profile functionality, the parameters on this page are not properly sanitized and hence leads to stored XSS attacks. An authenticated user can store XSS payloads in the profiles, which gets triggered when any other user try to access the edit profile page. The pdf editor tool has an edit pdf profile functionality, the logoFile parameter in it is not properly sanitized and an user can enter relative paths like ../../../../../../../../../../../../../usr/share/icons/hicolor/48x48/apps/gvim.png via tools like burpsuite. Later when a pdf is exported using the edited profile the pdf icon has the image on that path(if image is present). Both issues require an attacker to be able to login to LAM admin interface. The issue is fixed in version 7.9.1.
- Product
- lam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2022Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack.CVE-2022-24843 · Other software · flipped-aurora · reported by GitHubHigh 7.5
Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. Gin-vue-admin 2.50 has arbitrary file read vulnerability due to a lack of parameter validation. This has been resolved in version 2.5.1. There are no known workarounds for this issue.
- Product
- gin-vue-admin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2022Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack.CVE-2022-24844 · Other software · flipped-aurora · reported by GitHubHigh 8.1
Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. The problem occurs in the following code in server/service/system/sys_auto_code_pgsql.go, which means that PostgreSQL must be used as the database for this vulnerability to occur. Users must: Require JWT login） and be using PostgreSQL to be affected. This issue has been resolved in version 2.5.1. There are no known workarounds.
- Product
- gin-vue-admin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2022Cross-site Scripting (XSS) vulnerability in Citrix StoreFront affects version 1912 before CU5 and version 3.12 before CU9CVE-2022-27503 · Network & remote access · Citrix · reported by secure@citrix.comMedium 6.1
Cross-site Scripting (XSS) vulnerability in Citrix StoreFront affects version 1912 before CU5 and version 3.12 before CU9
- Product
- StoreFront
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.citrix.comsupport.citrix.com
Apr 6, 2022Podium is a library for building micro frontends.CVE-2022-24822 · Other software · podium-lib · reported by GitHubHigh 7.5
Podium is a library for building micro frontends. @podium/layout is a module for building a Podium layout server, and @podium/proxy is a module for proxying HTTP requests from a layout server to a podlet server. In @podium/layout prior to version 4.6.110 and @podium/proxy prior to version 4.2.74, an attacker using the `Trailer` header as part of the request against proxy endpoints has the ability to take down the server. All Podium layouts that include podlets with proxy endpoints are affected. `@podium/layout`, which is the main way developers/users are vulnerable to this exploit, has been patched in version `4.6.110`. All earlier versions are vulnerable.`@podium/proxy`, which is the source of the vulnerability and is used by `@podium/layout` has been patched in version `4.2.74`. All earlier versions are vulnerable. It is not easily possible to work around this issue without upgrading.
- Product
- proxy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2022The rc-httpd component through 2022-03-31 for 9front (Plan 9 fork) allows ..%2f directory traversal if serve-static is used.CVE-2022-28380 · Other software · Rc-httpd Project · reported by MITREHigh 7.5
The rc-httpd component through 2022-03-31 for 9front (Plan 9 fork) allows ..%2f directory traversal if serve-static is used.
- Product
- Rc-httpd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddesuarchive.orggit.9front.org
Mar 21, 2022BookingPress: Fails to properly sanitize user supplied POST data before it is used in a dynamically constructed SQL query via the bookingpress_front_get_category_services AJAX action (available to unauthenticated users)CVE-2022-0739 · WordPress plugins & themes · reported by WPScanCritical 9.8
The BookingPress WordPress plugin before 1.0.11 fails to properly sanitize user supplied POST data before it is used in a dynamically constructed SQL query via the bookingpress_front_get_category_services AJAX action (available to unauthenticated users), leading to an unauthenticated SQL Injection
- Product
- BookingPress
- Fixed in
- 1.0.11
- What to do
- Update BookingPress to 1.0.11 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 21, 2022Accounted time is shown in the Ticket Detail View (External Interface), even if ExternalFrontend::TicketDetailView###AccountedTimeDisplay is disabled.CVE-2022-1004 · Other software · OTRS AG · reported by security@otrs.comMedium 4.3
Accounted time is shown in the Ticket Detail View (External Interface), even if ExternalFrontend::TicketDetailView###AccountedTimeDisplay is disabled.
- Product
- OTRS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 14, 2022Volto is a ReactJS-based frontend for the Plone Content Management System.CVE-2022-24740 · Other software · plone · reported by GitHubMedium 5
Volto is a ReactJS-based frontend for the Plone Content Management System. Between versions 14.0.0-alpha.5 and 15.0.0-alpha.0, a user could have their authentication cookie replaced with an authentication cookie from another user, effectively giving them control of the other user's account and privileges. This occurs when using an outdated version of the `react-cookie` library and a server is under high load. A proof of concept does not currently exist, but it is possible for this issue to occur in the wild. The patch and fix is present in Volto 15.0.0-alpha.0. As a workaround, one may manually upgrade the `react-cookie` package to 4.1.1 and then override all Volto components that use this library.
- Product
- volto
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 14, 2022Photo Gallery by 10Web: Does not validate and escape the bwg_tag_id_bwg_thumbnails_0 parameter before using it in a SQL statement via the bwg_frontend_data AJAX action (available to unauthenticated and authenticated userCVE-2022-0169 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Photo Gallery by 10Web WordPress plugin before 1.6.0 does not validate and escape the bwg_tag_id_bwg_thumbnails_0 parameter before using it in a SQL statement via the bwg_frontend_data AJAX action (available to unauthenticated and authenticated users), leading to an unauthenticated SQL injection
- Product
- Photo Gallery by 10Web
- Fixed in
- 1.6.0
- What to do
- Update Photo Gallery by 10Web to 1.6.0 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 10, 2022Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilitiCVE-2022-23042 · Other software · unspecified · reported by security@xen.orgHigh 7
Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV device frontends are using the grant table interfaces for removing access rights of the backends in ways being subject to race conditions, resulting in potential data leaks, data corruption by malicious backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they assume that a following removal of the granted access will always succeed, which is not true in case the backend has mapped the granted page between those two operations. As a result the backend can keep access to the memory page of the guest no matter how the page will be used after the frontend I/O has finished. The xenbus driver has a similar problem, as it doesn't check the success of removing the granted access of a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038 gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront
- Product
- unspecified
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orgxenbits.xenproject.org
Mar 10, 2022Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilitiCVE-2022-23041 · Other software · unspecified · reported by security@xen.orgHigh 7
Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV device frontends are using the grant table interfaces for removing access rights of the backends in ways being subject to race conditions, resulting in potential data leaks, data corruption by malicious backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they assume that a following removal of the granted access will always succeed, which is not true in case the backend has mapped the granted page between those two operations. As a result the backend can keep access to the memory page of the guest no matter how the page will be used after the frontend I/O has finished. The xenbus driver has a similar problem, as it doesn't check the success of removing the granted access of a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038 gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront
- Product
- unspecified
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orgxenbits.xenproject.org
Mar 10, 2022Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilitiCVE-2022-23040 · Other software · unspecified · reported by security@xen.orgHigh 7
Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV device frontends are using the grant table interfaces for removing access rights of the backends in ways being subject to race conditions, resulting in potential data leaks, data corruption by malicious backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they assume that a following removal of the granted access will always succeed, which is not true in case the backend has mapped the granted page between those two operations. As a result the backend can keep access to the memory page of the guest no matter how the page will be used after the frontend I/O has finished. The xenbus driver has a similar problem, as it doesn't check the success of removing the granted access of a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038 gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront
- Product
- unspecified
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orgxenbits.xenproject.org
Mar 10, 2022Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilitiCVE-2022-23039 · Other software · unspecified · reported by security@xen.orgHigh 7
Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV device frontends are using the grant table interfaces for removing access rights of the backends in ways being subject to race conditions, resulting in potential data leaks, data corruption by malicious backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they assume that a following removal of the granted access will always succeed, which is not true in case the backend has mapped the granted page between those two operations. As a result the backend can keep access to the memory page of the guest no matter how the page will be used after the frontend I/O has finished. The xenbus driver has a similar problem, as it doesn't check the success of removing the granted access of a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038 gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront
- Product
- unspecified
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orgxenbits.xenproject.org
Mar 10, 2022Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilitiCVE-2022-23038 · Other software · unspecified · reported by security@xen.orgHigh 7
Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV device frontends are using the grant table interfaces for removing access rights of the backends in ways being subject to race conditions, resulting in potential data leaks, data corruption by malicious backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they assume that a following removal of the granted access will always succeed, which is not true in case the backend has mapped the granted page between those two operations. As a result the backend can keep access to the memory page of the guest no matter how the page will be used after the frontend I/O has finished. The xenbus driver has a similar problem, as it doesn't check the success of removing the granted access of a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038 gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront
- Product
- unspecified
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orgxenbits.xenproject.org
Mar 10, 2022Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilitiCVE-2022-23037 · Other software · unspecified · reported by security@xen.orgHigh 7
Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV device frontends are using the grant table interfaces for removing access rights of the backends in ways being subject to race conditions, resulting in potential data leaks, data corruption by malicious backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they assume that a following removal of the granted access will always succeed, which is not true in case the backend has mapped the granted page between those two operations. As a result the backend can keep access to the memory page of the guest no matter how the page will be used after the frontend I/O has finished. The xenbus driver has a similar problem, as it doesn't check the success of removing the granted access of a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038 gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront
- Product
- unspecified
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orgxenbits.xenproject.org
Mar 10, 2022Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilitiCVE-2022-23036 · Other software · unspecified · reported by security@xen.orgHigh 7
Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV device frontends are using the grant table interfaces for removing access rights of the backends in ways being subject to race conditions, resulting in potential data leaks, data corruption by malicious backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they assume that a following removal of the granted access will always succeed, which is not true in case the backend has mapped the granted page between those two operations. As a result the backend can keep access to the memory page of the guest no matter how the page will be used after the frontend I/O has finished. The xenbus driver has a similar problem, as it doesn't check the success of removing the granted access of a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038 gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront
- Product
- unspecified
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orgxenbits.xenproject.org
Mar 9, 2022An authenticated user can create a link with reflected Javascript code inside it for graphs’ page and send it to other users.CVE-2022-24919 · Other software · Zabbix · reported by security@zabbix.comLow 3.7
An authenticated user can create a link with reflected Javascript code inside it for graphs’ page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict. Malicious code has access to all the same objects as the rest of the web page and can make arbitrary modifications to the contents of the page being displayed to a victim during social engineering attacks.
- Product
- Frontend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orglists.debian.org
Mar 9, 2022An authenticated user can create a link with reflected Javascript code inside it for items’ page and send it to other users.CVE-2022-24918 · Other software · Zabbix · reported by security@zabbix.comLow 3.7
An authenticated user can create a link with reflected Javascript code inside it for items’ page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict. Malicious code has access to all the same objects as the rest of the web page and can make arbitrary modifications to the contents of the page being displayed to a victim during social engineering attacks.
- Product
- Frontend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orglists.fedoraproject.org
Mar 9, 2022An authenticated user can create a link with reflected Javascript code inside it for services’ page and send it to other users.CVE-2022-24917 · Other software · Zabbix · reported by security@zabbix.comLow 3.7
An authenticated user can create a link with reflected Javascript code inside it for services’ page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict. Malicious code has access to all the same objects as the rest of the web page and can make arbitrary modifications to the contents of the page being displayed to a victim during social engineering attacks.
- Product
- Frontend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orglists.debian.org
Mar 9, 2022An authenticated user can create a link with reflected XSS payload for actions’ pages, and send it to other users.CVE-2022-24349 · Other software · Zabbix · reported by security@zabbix.comMedium 4.6
An authenticated user can create a link with reflected XSS payload for actions’ pages, and send it to other users. Malicious code has access to all the same objects as the rest of the web page and can make arbitrary modifications to the contents of the page being displayed to a victim. This attack can be implemented with the help of social engineering and expiration of a number of factors - an attacker should have authorized access to the Zabbix Frontend and allowed network connection between a malicious server and victim’s computer, understand attacked infrastructure, be recognized by the victim as a trustee and use trusted communication channel.
- Product
- Frontend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orglists.debian.org
Mar 8, 2022alltube is an html front end for youtube-dl.CVE-2022-24739 · Other software · Rudloff · reported by GitHubHigh 7.3
alltube is an html front end for youtube-dl. On releases prior to 3.0.3, an attacker could craft a special HTML page to trigger either an open redirect attack or a Server-Side Request Forgery attack (depending on how AllTube is configured). The impact is mitigated by the fact the SSRF attack is only possible when the `stream` option is enabled in the configuration. (This option is disabled by default.) 3.0.3 contains a fix for this vulnerability.
- Product
- alltube
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2022Cross-site scripting (XSS) vulnerability in the Frontend Taglib module in Liferay Portal 7.4.0 and 7.4.1 allows remote attackers to inject arbitrary web script CVE-2021-38264 · Other software · Liferay · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the Frontend Taglib module in Liferay Portal 7.4.0 and 7.4.1 allows remote attackers to inject arbitrary web script or HTML into the management toolbar search via the `keywords` parameter. This issue is caused by an incomplete fix in CVE-2021-35463.
- Product
- Liferay Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.liferay.devportal.liferay.dev
Jan 27, 2022There is a front-end sql injection vulnerability in cszcms 1.2.9 via cszcms/controllers/Member.php#viewUserCVE-2021-46377 · Other software · Cskaza · reported by MITRECritical 9.8
There is a front-end sql injection vulnerability in cszcms 1.2.9 via cszcms/controllers/Member.php#viewUser
- Product
- Cszcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 24, 2022WP User Frontend: Does not validate and escape the status parameter before using it in a SQL statement in the Subscribers dashboardCVE-2021-25076 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP User Frontend WordPress plugin before 3.5.26 does not validate and escape the status parameter before using it in a SQL statement in the Subscribers dashboard, leading to an SQL injection. Due to the lack of sanitisation and escaping, this could also lead to Reflected Cross-Site Scripting
- Product
- WP User Frontend
- Fixed in
- 3.5.26
- What to do
- Update WP User Frontend to 3.5.26 or newer.
Full record and what to do →NVD recordpacketstormsecurity.complugins.trac.wordpress.org
Jan 14, 2022Frontier is Substrate's Ethereum compatibility layer.CVE-2022-21685 · Other software · paritytech · reported by GitHubMedium 6.5
Frontier is Substrate's Ethereum compatibility layer. Prior to commit number `8a93fdc6c9f4eb1d2f2a11b7ff1d12d70bf5a664`, a bug in Frontier's MODEXP precompile implementation can cause an integer underflow in certain conditions. This will cause a node crash for debug builds. For release builds (and production WebAssembly binaries), the impact is limited as it can only cause a normal EVM out-of-gas. Users who do not use MODEXP precompile in their runtime are not impacted. A patch is available in pull request #549.
- Product
- frontier
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2022Zabbix Frontend Improper Access Control VulnerabilityCVE-2022-23134 · Other software · Zabbix · reported by security@zabbix.comExploitedLow 3.7
Malicious actors can pass step checks and potentially change the configuration of Zabbix Frontend.
- Product
- Frontend
- On CISA’s list since
- Feb 22, 2022 (federal fix deadline Mar 8, 2022)
- What to do
- Attackers are using this now. Install Zabbix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA cataloglists.debian.orglists.fedoraproject.org
Jan 13, 2022An authenticated user can create a hosts group from the configuration with XSS payload, which will be available for other users.CVE-2022-23133 · Other software · Zabbix · reported by security@zabbix.comMedium 6.3
An authenticated user can create a hosts group from the configuration with XSS payload, which will be available for other users. When XSS is stored by an authenticated malicious actor and other users try to search for groups during new host creation, the XSS payload will fire and the actor can steal session cookies and perform session hijacking to impersonate users or take over their accounts.
- Product
- Frontend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orglists.fedoraproject.org
Jan 13, 2022Zabbix Frontend Authentication Bypass VulnerabilityCVE-2022-23131 · Other software · Zabbix · reported by security@zabbix.comExploitedCritical 9.1
Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML.
- Product
- Frontend
- On CISA’s list since
- Feb 22, 2022 (federal fix deadline Mar 8, 2022)
- What to do
- Attackers are using this now. Install Zabbix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogsupport.zabbix.comsupport.zabbix.com
Dec 27, 2021WPFront User Role Editor: Does not sanitise and escape the changes-saved parameter before outputting it back in the admin dashboardCVE-2021-24984 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WPFront User Role Editor WordPress plugin before 3.2.1.11184 does not sanitise and escape the changes-saved parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting
- Product
- WPFront User Role Editor
- Fixed in
- 3.2.1.11184
- What to do
- Update WPFront User Role Editor to 3.2.1.11184 or newer.
Dec 20, 2021`solidus_frontend` is the cart and storefront for the Solidus e-commerce project.CVE-2021-43846 · Other software · solidusio · reported by GitHubMedium 5.3
`solidus_frontend` is the cart and storefront for the Solidus e-commerce project. Versions of `solidus_frontend` prior to 3.1.5, 3.0.5, and 2.11.14 contain a cross-site request forgery (CSRF) vulnerability that allows a malicious site to add an item to the user's cart without their knowledge. Versions 3.1.5, 3.0.5, and 2.11.14 contain a patch for this issue. The patch adds CSRF token verification to the "Add to cart" action. Adding forgery protection to a form that missed it can have some side effects. Other CSRF protection strategies as well as a workaround involving modifcation to config/application.rb` are available. More details on these mitigations are available in the GitHub Security Advisory.
- Product
- solidus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2021The package md-to-pdf before 5.0.0 are vulnerable to Remote Code Execution (RCE) due to utilizing the library gray-matter to parse front matter content, withoutCVE-2021-23639 · Other software · Markdown TO PDF Project · reported by report@snyk.ioCritical 9.8
The package md-to-pdf before 5.0.0 are vulnerable to Remote Code Execution (RCE) due to utilizing the library gray-matter to parse front matter content, without disabling the JS engine.
- Product
- Markdown TO PDF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 18, 2021Insecure Boot Image vulnerability in Hitachi Energy Relion Relion 670/650/SAM600-IO series allows an attacker who manages to get access to the front network porCVE-2021-35535 · Other software · Hitachi Energy · reported by cybersecurity@hitachienergy.comHigh 8.1
Insecure Boot Image vulnerability in Hitachi Energy Relion Relion 670/650/SAM600-IO series allows an attacker who manages to get access to the front network port and to cause a reboot sequences of the device may exploit the vulnerability, where there is a tiny time gap during the booting process where an older version of VxWorks is loaded prior to application firmware booting, could exploit the vulnerability in the older version of VxWorks and cause a denial-of-service on the product. This issue affects: Hitachi Energy Relion 670 Series 2.2.2 all revisions; 2.2.3 versions prior to 2.2.3.3. Hitachi Energy Relion 670/650 Series 2.2.0 all revisions; 2.2.4 all revisions. Hitachi Energy Relion 670/650/SAM600-IO 2.2.1 all revisions.
- Product
- Relion 670 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsearch.abb.comsearch.abb.com
Nov 17, 2021spree_auth_devise is an open source library which provides authentication and authorization services for use with the Spree storefront framework by using an undCVE-2021-41275 · Other software · spree · reported by GitHubCritical 9.3
spree_auth_devise is an open source library which provides authentication and authorization services for use with the Spree storefront framework by using an underlying Devise authentication framework. In affected versions spree_auth_devise is subject to a CSRF vulnerability that allows user account takeover. All applications using any version of the frontend component of spree_auth_devise are affected if protect_from_forgery method is both: Executed whether as: A before_action callback (the default). A prepend_before_action (option prepend: true given) before the :load_object hook in Spree::UserController (most likely order to find). Configured to use :null_session or :reset_session strategies (:null_session is the default in case the no strategy is given, but rails --new generated skeleton use :exception). Users are advised to update their spree_auth_devise gem. For users unable to update it may be possible to change your strategy to :exception. Please see the linked GHSA for more workaround details. ### Impact CSRF vulnerability that allows user account takeover. All applications using any version of the frontend component of `spree_auth_devise` are affected if `protect_from_forg
- Product
- spree_auth_devise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 8, 2021Multiple Cross Site Scripting (XSS) vulnerabilities exist in VFront 0.99.5 via the (1) s parameter in search_all.php and the (2) msg parameter in add.attach.phpCVE-2021-39420 · Other software · Vfront · reported by MITREMedium 6.1
Multiple Cross Site Scripting (XSS) vulnerabilities exist in VFront 0.99.5 via the (1) s parameter in search_all.php and the (2) msg parameter in add.attach.php.
- Product
- Vfront
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsisl.lab.uic.edusisl.lab.uic.edu
Nov 8, 2021The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible WordPress plugin before 6.5.12, when used in combination with aCVE-2021-24835 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible WordPress plugin before 6.5.12, when used in combination with another WCFM - WooCommerce Multivendor plugin such as WCFM - WooCommerce Multivendor Marketplace, does not escape the withdrawal_vendor parameter before using it in a SQL statement, allowing low privilege users such as Subscribers to perform SQL injection attacks
- Product
- WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible
- Fixed in
- 6.5.12
- What to do
- Update WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible to 6.5.12 or newer.
Nov 8, 2021Storefront Footer Text: Does not sanitize and escape the "Footer Credit Text" added to pagesCVE-2021-24607 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Storefront Footer Text WordPress plugin through 1.0.1 does not sanitize and escape the "Footer Credit Text" added to pages, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered-html capability is disallowed.
- Product
- Storefront Footer Text
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Storefront Footer Text to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 18, 2021Easy Download Manager and File Sharing Plugin with frontend file upload – a better Media Library — Shared Files: Does not sanitise and escape some of its settings before outputting them in attributesCVE-2021-24736 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Easy Download Manager and File Sharing Plugin with frontend file upload – a better Media Library — Shared Files WordPress plugin before 1.6.57 does not sanitise and escape some of its settings before outputting them in attributes, which could lead to Stored Cross-Site Scripting issues.
- Product
- Easy Download Manager and File Sharing Plugin with frontend file upload – a better Media Library — Shared Files
- Fixed in
- 1.6.57
- What to do
- Update Easy Download Manager and File Sharing Plugin with frontend file upload – a better Media Library — Shared Files to 1.6.57 or newer.
Oct 13, 2021Frontier is Substrate's Ethereum compatibility layer.CVE-2021-41138 · Other software · paritytech · reported by GitHubMedium 5.3
Frontier is Substrate's Ethereum compatibility layer. In the newly introduced signed Frontier-specific extrinsic for `pallet-ethereum`, a large part of transaction validation logic was only called in transaction pool validation, but not in block execution. Malicious validators can take advantage of this to put invalid transactions into a block. The attack is limited in that the signature is always validated, and the majority of the validation is done again in the subsequent `pallet-evm` execution logic. However, do note that a chain ID replay attack was possible. In addition, spamming attacks are of main concerns, while they are limited by Substrate block size limits and other factors. The issue is patched in commit `146bb48849e5393004be5c88beefe76fdf009aba`.
- Product
- frontier
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2021Simple Social Media Share Buttons: Does not escape the Share Title settings before outputting it in the frontend pages or posts (depending on the settings used)CVE-2021-24656 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple Social Media Share Buttons WordPress plugin before 3.2.4 does not escape the Share Title settings before outputting it in the frontend pages or posts (depending on the settings used), allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Simple Social Media Share Buttons
- Fixed in
- 3.2.4
- What to do
- Update Simple Social Media Share Buttons to 3.2.4 or newer.
Oct 11, 2021Frontend Uploader: Does not prevent HTML files from being uploaded via its formCVE-2021-24563 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Frontend Uploader WordPress plugin through 1.3.2 does not prevent HTML files from being uploaded via its form, allowing unauthenticated user to upload a malicious HTML file containing JavaScript for example, which will be triggered when someone access the file directly
- Product
- Frontend Uploader
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update Frontend Uploader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Sep 6, 2021WPFront Notification Bar: Does not properly sanitise and escape its settingsCVE-2021-24601 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WPFront Notification Bar WordPress plugin before 2.1.0.08087 does not properly sanitise and escape its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- WPFront Notification Bar
- Fixed in
- 2.1.0.08087
- What to do
- Update WPFront Notification Bar to 2.1.0.08087 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.