Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

1,114 results · page 14 of 23

Oct 25, 2023Unauthenticated SQL injection in the GetStudentGroupStudents method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of allCVE-2023-26568 · Other software · IDAttend Pty Ltd · reported by vdp@themissinglink.com.auCritical 9.8
Unauthenticated SQL injection in the GetStudentGroupStudents method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of all data by unauthenticated attackers.
Product
IDWeb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record themissinglink.com.au themissinglink.com.au
Oct 25, 2023Reflected cross-site scripting in the StudentSearch component in IDAttend’s IDWeb application 3.1.052 and earlier allows hijacking of a user’s browsing session CVE-2023-1356 · Other software · IDAttend Pty Ltd · reported by vdp@themissinglink.com.auHigh 7.5
Reflected cross-site scripting in the StudentSearch component in IDAttend’s IDWeb application 3.1.052 and earlier allows hijacking of a user’s browsing session by attackers who have convinced the said user to click on a malicious link.
Product
IDWeb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record themissinglink.com.au themissinglink.com.au
Oct 23, 2023Frappe is a full-stack web application framework that uses Python and MariaDB on the server side and an integrated client side library.CVE-2023-46127 · Other software · frappe · reported by GitHubMedium 5.4
Frappe is a full-stack web application framework that uses Python and MariaDB on the server side and an integrated client side library. A malicious Frappe user with desk access could create documents containing HTML payloads allowing HTML Injection. This vulnerability has been patched in version 14.49.0.
Product
frappe
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 19, 2023 The affected product is vulnerable to a cross-site scripting vulnerability, which could allow an attacker to access the web application to introduce arbitrary CVE-2023-40153 · Other software · DEXMA · reported by ics-cert@hq.dhs.govMedium 5.4
The affected product is vulnerable to a cross-site scripting vulnerability, which could allow an attacker to access the web application to introduce arbitrary Java Script by injecting an XSS payload into the 'hostname' parameter of the vulnerable software.
Product
DexGate
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Oct 12, 2023A stored XSS has been found in the Zabbix web application in the Maps element if a URL field is set with spaces before URL.CVE-2023-32721 · Other software · Zabbix · reported by security@zabbix.comHigh 7.6
A stored XSS has been found in the Zabbix web application in the Maps element if a URL field is set with spaces before URL.
Product
Zabbix
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.debian.org support.zabbix.com
Oct 11, 2023NAXSI is an open-source maintenance web application firewall (WAF) for NGINX.CVE-2023-45132 · Other software · wargio · reported by GitHubCritical 9.1
NAXSI is an open-source maintenance web application firewall (WAF) for NGINX. An issue present starting in version 1.3 and prior to version 1.6 allows someone to bypass the WAF when a malicious `X-Forwarded-For` IP matches `IgnoreIP` `IgnoreCIDR` rules. This old code was arranged to allow older NGINX versions to also support `IgnoreIP` `IgnoreCIDR` when multiple reverse proxies were present. The issue is patched in version 1.6. As a workaround, do not set any `IgnoreIP` `IgnoreCIDR` for older versions.
Product
naxsi
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 9, 2023SAP NetWeaver AS Java (GRMG Heartbeat application) - version 7.50, allows an attacker to send a crafted request from a vulnerable web application, causing limitCVE-2023-42477 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.5
SAP NetWeaver AS Java (GRMG Heartbeat application) - version 7.50, allows an attacker to send a crafted request from a vulnerable web application, causing limited impact on confidentiality and integrity of the application.
Product
SAP NetWeaver AS Java
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record me.sap.com sap.com
Oct 4, 2023Zope is an open-source web application server.CVE-2023-44389 · Other software · zopefoundation · reported by GitHubLow 3.1
Zope is an open-source web application server. The title property, available on most Zope objects, can be used to store script code that is executed while viewing the affected object in the Zope Management Interface (ZMI). All versions of Zope 4 and Zope 5 are affected. Patches will be released with Zope versions 4.8.11 and 5.8.6.
Product
Zope
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 3, 2023It has been identified that the web application does not correctly filter input parameters, allowing SQL injections, DoS or information disclosure.CVE-2023-4098 · Other software · QSige de IDM Sistemas · reported by cve-coordination@incibe.esHigh 8.8
It has been identified that the web application does not correctly filter input parameters, allowing SQL injections, DoS or information disclosure. As a prerequisite, it is necessary to log into the application.
Product
QSige
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record incibe.es incibe.es
Oct 3, 2023A Cross-site Request Forgery (CSRF) vulnerability in Pandora FMS allows an attacker to force authenticated users to send a request to a web application they areCVE-2023-24518 · Other software · Artica PFMS · reported by cve-coordination@incibe.esMedium 6.7
A Cross-site Request Forgery (CSRF) vulnerability in Pandora FMS allows an attacker to force authenticated users to send a request to a web application they are currently authenticated against. This issue affects Pandora FMS version 767 and earlier versions on all platforms.
Product
Pandora FMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pandorafms.com pandorafms.com
Sep 28, 2023PrestaShop is an Open Source e-commerce web application.CVE-2023-43664 · Websites & servers · PrestaShop · reported by GitHubMedium 4.3
PrestaShop is an Open Source e-commerce web application. In the Prestashop Back office interface, an employee can list all modules without any access rights: method `ajaxProcessGetPossibleHookingListForModule` doesn't check access rights. This issue has been addressed in commit `15bd281c` which is included in version 8.1.2. Users are advised to upgrade. There are no known workaround for this issue.
Product
PrestaShop
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 28, 2023PrestaShop is an Open Source e-commerce web application.CVE-2023-43663 · Websites & servers · PrestaShop · reported by GitHubMedium 6.3
PrestaShop is an Open Source e-commerce web application. In affected versions any module can be disabled or uninstalled from back office, even with low user right. This allows low privileged users to disable portions of a shops functionality. Commit `ce1f6708` addresses this issue and is included in version 8.1.2. Users are advised to upgrade. There are no known workarounds for this issue.
Product
PrestaShop
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 21, 2023Zope is an open-source web application server.CVE-2023-42458 · Other software · zopefoundation · reported by GitHubLow 3.7
Zope is an open-source web application server. Prior to versions 4.8.10 and 5.8.5, there is a stored cross site scripting vulnerability for SVG images. Note that an image tag with an SVG image as source is never vulnerable, even when the SVG image contains malicious code. To exploit the vulnerability, an attacker would first need to upload an image, and then trick a user into following a specially crafted link. Patches are available in Zope 4.8.10 and 5.8.5. As a workaround, make sure the "Add Documents, Images, and Files" permission is only assigned to trusted roles. By default, only the Manager has this permission.
Product
Zope
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com github.com
Sep 20, 2023The web application stores credentials in clear text in the "admin.xml" file, which can be accessed without logging into the website, which could allow an attacCVE-2022-47561 · Other software · Ormazabal · reported by cve-coordination@incibe.esHigh 7.3
The web application stores credentials in clear text in the "admin.xml" file, which can be accessed without logging into the website, which could allow an attacker to obtain credentials related to all users, including admin users, in clear text, and use them to subsequently execute malicious actions.
Product
ekorCCP
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record incibe.es incibe.es
Sep 18, 2023 The web application that owns the device clearly stores the credentials within the user management section.CVE-2023-39452 · Other software · Socomec · reported by ics-cert@hq.dhs.govHigh 7.5
The web application that owns the device clearly stores the credentials within the user management section. Obtaining this information can be done remotely due to the incorrect management of the sessions in the web application.
Product
MODULYS GP (MOD3GP-SY-120K)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Sep 18, 2023 Thanks to the weaknesses that the web application has at the user management level, an attacker could obtain the information from the headers that is necCVE-2023-39446 · Other software · Socomec · reported by ics-cert@hq.dhs.govHigh 8.9
Thanks to the weaknesses that the web application has at the user management level, an attacker could obtain the information from the headers that is necessary to create specially designed URLs and originate malicious actions when a legitimate user is logged into the web application.
Product
MODULYS GP (MOD3GP-SY-120K)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Sep 18, 2023 Persistent cross-site scripting (XSS) in the web application of MOD3GP-SY-120K allows an authenticated remote attacker to introduce arbitrary JavaScripCVE-2023-38582 · Other software · Socomec · reported by ics-cert@hq.dhs.govMedium 6.3
Persistent cross-site scripting (XSS) in the web application of MOD3GP-SY-120K allows an authenticated remote attacker to introduce arbitrary JavaScript by injecting an XSS payload into the field MAIL_RCV. When a legitimate user attempts to access to the vulnerable page of the web application, the XSS payload will be executed.
Product
MODULYS GP (MOD3GP-SY-120K)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Sep 18, 2023Sending some requests in the web application of the vulnerable device allows information to be obtained due to the lack of security in the authentication procesCVE-2023-41965 · Other software · Socomec · reported by ics-cert@hq.dhs.govHigh 7.5
Sending some requests in the web application of the vulnerable device allows information to be obtained due to the lack of security in the authentication process.
Product
MODULYS GP (MOD3GP-SY-120K)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Sep 18, 2023 Session management within the web application is incorrect and allows attackers to steal session cookies to perform a multitude of actions that the wCVE-2023-41084 · Other software · Socomec · reported by ics-cert@hq.dhs.govCritical 10
Session management within the web application is incorrect and allows attackers to steal session cookies to perform a multitude of actions that the web app allows on the device.
Product
MODULYS GP (MOD3GP-SY-120K)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Sep 18, 2023 The absence of filters when loading some sections in the web application of the vulnerable device allows potential attackers to inject malicious coCVE-2023-40221 · Other software · Socomec · reported by ics-cert@hq.dhs.govHigh 8.8
The absence of filters when loading some sections in the web application of the vulnerable device allows potential attackers to inject malicious code that will be interpreted when a legitimate user accesses the web section (MAIL SERVER) where the information is displayed. Injection can be done on parameter MAIL_RCV. When a legitimate user attempts to review NOTIFICATION/MAIL SERVER, the injected code will be executed.
Product
MODULYS GP (MOD3GP-SY-120K)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Sep 14, 2023In Ericsson Mobile Switching Center Server (MSC-S) before IS 3.1 CP22, the SIS web application allows relative path traversal via a specific parameter in the htCVE-2021-28485 · Other software · Ericsson · reported by MITREMedium 4.3
In Ericsson Mobile Switching Center Server (MSC-S) before IS 3.1 CP22, the SIS web application allows relative path traversal via a specific parameter in the https request after authentication, which allows access to files on the system that are not intended to be accessible via the web application.
Product
Mobile Switching Center Server BC 18a Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ericsson.com gruppotim.it
Sep 8, 2023IBM Aspera Faspex 5.0.5 could allow a remote attacker to gather sensitive information about the web application, caused by an insecure configuration.CVE-2022-22409 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM Aspera Faspex 5.0.5 could allow a remote attacker to gather sensitive information about the web application, caused by an insecure configuration. IBM X-Force ID: 222592.
Product
Aspera Faspex
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com
Aug 28, 2023jupyter-server is the backend for Jupyter web applications.CVE-2023-40170 · Other software · jupyter-server · reported by GitHubMedium 4.6
jupyter-server is the backend for Jupyter web applications. Improper cross-site credential checks on `/files/` URLs could allow exposure of certain file contents, or accessing files when opening untrusted files via "Open image in new tab". This issue has been addressed in commit `87a49272728` which has been included in release `2.7.2`. Users are advised to upgrade. Users unable to upgrade may use the lower performance `--ContentsManager.files_handler_class=jupyter_server.files.handlers.FilesHandler`, which implements the correct checks.
Product
jupyter_server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 28, 2023jupyter-server is the backend for Jupyter web applications.CVE-2023-39968 · Other software · jupyter-server · reported by GitHubMedium 4.3
jupyter-server is the backend for Jupyter web applications. Open Redirect Vulnerability. Maliciously crafted login links to known Jupyter Servers can cause successful login or an already logged-in session to be redirected to arbitrary sites, which should be restricted to Jupyter Server-served URLs. This issue has been addressed in commit `29036259` which is included in release 2.7.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Product
jupyter_server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 25, 2023OWASP Coraza WAF is a golang modsecurity compatible web application firewall library.CVE-2023-40586 · Other software · corazawaf · reported by GitHubHigh 7.5
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. Due to the misuse of `log.Fatalf`, the application using coraza crashed after receiving crafted requests from attackers. The application will immediately crash after receiving a malicious request that triggers an error in `mime.ParseMediaType`. This issue was patched in version 3.0.1.
Product
coraza
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 7, 2023PrestaShop is an open source e-commerce web application.CVE-2023-39530 · Websites & servers · PrestaShop · reported by GitHubMedium 6.5
PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, it is possible to delete files from the server via the CustomerMessage API. Version 8.1.1 contains a patch for this issue. There are no known workarounds.
Product
PrestaShop
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 7, 2023PrestaShop is an open source e-commerce web application.CVE-2023-39529 · Websites & servers · PrestaShop · reported by GitHubMedium 6.7
PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, it is possible to delete a file from the server by using the Attachments controller and the Attachments API. Version 8.1.1 contains a patch for this issue. There are no known workarounds.
Product
PrestaShop
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 7, 2023PrestaShop is an open source e-commerce web application.CVE-2023-39528 · Websites & servers · PrestaShop · reported by GitHubMedium 6.8
PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, the `displayAjaxEmailHTML` method can be used to read any file on the server, potentially even outside of the project if the server is not correctly configured. Version 8.1.1 contains a patch for this issue. There are no known workarounds.
Product
PrestaShop
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 7, 2023PrestaShop is an open source e-commerce web application.CVE-2023-39527 · Websites & servers · PrestaShop · reported by GitHubHigh 8.3
PrestaShop is an open source e-commerce web application. Versions prior to 1.7.8.10, 8.0.5, and 8.1.1 are vulnerable to cross-site scripting through the `isCleanHTML` method. Versions 1.7.8.10, 8.0.5, and 8.1.1 contain a patch. There are no known workarounds.
Product
PrestaShop
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 7, 2023PrestaShop is an open source e-commerce web application.CVE-2023-39526 · Websites & servers · PrestaShop · reported by GitHubCritical 9.1
PrestaShop is an open source e-commerce web application. Versions prior to 1.7.8.10, 8.0.5, and 8.1.1 are vulnerable to remote code execution through SQL injection and arbitrary file write in the back office. Versions 1.7.8.10, 8.0.5, and 8.1.1 contain a patch. There are no known workarounds.
Product
PrestaShop
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 7, 2023PrestaShop is an open source e-commerce web application.CVE-2023-39525 · Websites & servers · PrestaShop · reported by GitHubMedium 6.5
PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, in the back office, files can be compromised using path traversal by replaying the import file deletion query with a specified file path that uses the traversal path. Version 8.1.1 contains a patch for this issue. There are no known workarounds.
Product
PrestaShop
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 7, 2023PrestaShop is an open source e-commerce web application.CVE-2023-39524 · Websites & servers · PrestaShop · reported by GitHubMedium 6.7
PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, SQL injection possible in the product search field, in BO's product page. Version 8.1.1 contains a patch for this issue. There are no known workarounds.
Product
PrestaShop
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 19, 2023An OS command injection vulnerability was found in the Avaya Aura Device Services Web application which could allow remote code execution as the Web server userCVE-2023-3722 · Other software · Avaya · reported by securityalerts@avaya.comHigh 8.6
An OS command injection vulnerability was found in the Avaya Aura Device Services Web application which could allow remote code execution as the Web server user via a malicious uploaded file. This issue affects Avaya Aura Device Services version 8.1.4.0 and earlier.
Product
Aura Device Services
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record download.avaya.com download.avaya.com
Jul 19, 2023In GeoVision GV-ADR2701 cameras, an attacker could edit the login response to access the web application.CVE-2023-3638 · Other software · GeoVision · reported by ics-cert@hq.dhs.govCritical 9.8
In GeoVision GV-ADR2701 cameras, an attacker could edit the login response to access the web application.
Product
GV-ADR2701
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Jul 18, 2023A CSV injection vulnerability was found in the Avaya Call Management System (CMS) Supervisor web application which allows a user with administrative privileges CVE-2023-3527 · Other software · Avaya · reported by securityalerts@avaya.comMedium 6.8
A CSV injection vulnerability was found in the Avaya Call Management System (CMS) Supervisor web application which allows a user with administrative privileges to input crafted data which, when exported to a CSV file, may attempt arbitrary command execution on the system used to open the file by a spreadsheet software such as Microsoft Excel.
Product
Avaya Call Management System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record download.avaya.com download.avaya.com
Jul 18, 2023Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: MS Excel Specific).CVE-2023-22037 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.5
Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: MS Excel Specific). Supported versions that are affected are 12.2.3-12.2.12. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Web Applications Desktop Integrator, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Web Applications Desktop Integrator accessible data as well as unauthorized read access to a subset of Oracle Web Applications Desktop Integrator accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Web Applications Desktop Integrator. CVSS 3.1 Base Score 6.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L).
Product
Web Applications Desktop Integrator
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com oracle.com
Jul 17, 2023The XPRTLD web application in Veritas InfoScale Operations Manager (VIOM) before 8.0.0.410 allows an authenticated attacker to upload all types of files to the CVE-2023-38404 · Other software · Veritas · reported by MITREHigh 7.2
The XPRTLD web application in Veritas InfoScale Operations Manager (VIOM) before 8.0.0.410 allows an authenticated attacker to upload all types of files to the server. An authenticated attacker can then execute the malicious file to perform command execution on the remote server.
Product
Infoscale Operations Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record veritas.com veritas.com
Jul 17, 2023 Reactive web applications that use Spring HATEOAS to produce hypermedia-based responses might be exposed to malicious forwarded headers if they are not behind CVE-2023-34036 · Other software · Spring · reported by security@vmware.comMedium 5.3
Reactive web applications that use Spring HATEOAS to produce hypermedia-based responses might be exposed to malicious forwarded headers if they are not behind a trusted proxy that ensures correctness of such headers, or if they don't have anything else in place to handle (and possibly discard) forwarded headers either in WebFlux or at the level of the underlying HTTP server. For the application to be affected, it needs to satisfy the following requirements: * It needs to use the reactive web stack (Spring WebFlux) and Spring HATEOAS to create links in hypermedia-based responses. * The application infrastructure does not guard against clients submitting (X-)Forwarded… headers.
Product
Spring HATEOAS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record spring.io spring.io
Jul 13, 2023Reflected XSS attacks, occur when a malicious script is reflected off a web application to the victim's browser.CVE-2023-29457 · Other software · Zabbix · reported by security@zabbix.comMedium 6.3
Reflected XSS attacks, occur when a malicious script is reflected off a web application to the victim's browser. The script can be activated through Action form fields, which can be sent as request to a website with a vulnerability that enables execution of malicious scripts.
Product
Zabbix
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.debian.org support.zabbix.com
Jul 13, 2023Reflected XSS attacks, also known as non-persistent attacks, occur when a malicious script is reflected off a web application to the victim's browser.CVE-2023-29455 · Other software · Zabbix · reported by security@zabbix.comMedium 5.4
Reflected XSS attacks, also known as non-persistent attacks, occur when a malicious script is reflected off a web application to the victim's browser. The script is activated through a link, which sends a request to a website with a vulnerability that enables execution of malicious scripts.
Product
Zabbix
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.debian.org support.zabbix.com
Jul 13, 2023Stored or persistent cross-site scripting (XSS) is a type of XSS where the attacker first sends the payload to the web application, then the application saves tCVE-2023-29454 · Other software · Zabbix · reported by security@zabbix.comMedium 5.4
Stored or persistent cross-site scripting (XSS) is a type of XSS where the attacker first sends the payload to the web application, then the application saves the payload (e.g., in a database or server-side text files), and finally, the application unintentionally executes the payload for every victim visiting its web pages.
Product
Zabbix
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.debian.org support.zabbix.com
Jun 28, 2023Reflected XSS affects the ‘mode’ parameter in the /admin functionality of the web application in versions <=2.0.44CVE-2023-3034 · Other software · BKG · reported by vulnerability@ncsc.chMedium 4.7
Reflected XSS affects the ‘mode’ parameter in the /admin functionality of the web application in versions <=2.0.44
Product
NTRIP Professional Caster
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record igs.bkg.bund.de igs.bkg.bund.de
Jun 22, 2023Livebook is a web application for writing interactive and collaborative code notebooks.CVE-2023-35174 · Other software · livebook-dev · reported by GitHubHigh 8.6
Livebook is a web application for writing interactive and collaborative code notebooks. On Windows, it is possible to open a `livebook://` link from a browser which opens Livebook Desktop and triggers arbitrary code execution on victim's machine. Any user using Livebook Desktop on Windows is potentially vulnerable to arbitrary code execution when they expect Livebook to be opened from browser. This vulnerability has been fixed in version 0.8.2 and 0.9.3.
Product
livebook
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 11, 2023The Danfoss AK-EM100 web applications allow for an authenticated user to perform OS command injection through the web application parameters.CVE-2023-25911 · Other software · Danfoss · reported by csirt@divd.nlCritical 9.9
The Danfoss AK-EM100 web applications allow for an authenticated user to perform OS command injection through the web application parameters.
Product
AK-EM100
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record csirt.divd.nl csirt.divd.nl
Jun 11, 2023The Danfoss AK-EM100 web applications allow for Local File Inclusion in the file parameter.CVE-2023-22586 · Other software · Danfoss · reported by csirt@divd.nlHigh 7.7
The Danfoss AK-EM100 web applications allow for Local File Inclusion in the file parameter.
Product
AK-EM100
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record csirt.divd.nl csirt.divd.nl
Jun 11, 2023The Danfoss AK-EM100 web applications allow for Reflected Cross-Site Scripting in the title parameter.CVE-2023-22585 · Other software · Danfoss · reported by csirt@divd.nlCritical 9
The Danfoss AK-EM100 web applications allow for Reflected Cross-Site Scripting in the title parameter.
Product
AK-EM100
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record csirt.divd.nl csirt.divd.nl
Jun 11, 2023The Danfoss AK-EM100 web applications allow for Reflected Cross-Site Scripting.CVE-2023-22582 · Other software · Danfoss · reported by csirt@divd.nlCritical 9
The Danfoss AK-EM100 web applications allow for Reflected Cross-Site Scripting.
Product
AK-EM100
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record csirt.divd.nl csirt.divd.nl
Jun 7, 2023The local Vuforia web application does not support HTTPS, and federated credentials are passed via basic authentication.CVE-2023-29168 · Other software · PTC · reported by ics-cert@hq.dhs.govLow 3.7
The local Vuforia web application does not support HTTPS, and federated credentials are passed via basic authentication.
Product
Vuforia Studio
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record https cisa.gov
Jun 2, 2023Incorrect Authorization vulnerability in Mobatime web application allows Privilege Escalation, Exploiting Incorrectly Configured Access Control Security Levels.CVE-2023-3033 · Other software · Mobatime · reported by vulnerability@ncsc.chMedium 6.8
Incorrect Authorization vulnerability in Mobatime web application allows Privilege Escalation, Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mobatime web application: through 06.7.22.
Product
Mobatime web application
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record borelenzo.github.io borelenzo.github.io
Jun 2, 2023Unrestricted Upload of File with Dangerous Type vulnerability in Mobatime web application (Documentary proof upload modules) allows a malicious user to Upload aCVE-2023-3032 · Other software · Mobatime · reported by vulnerability@ncsc.chHigh 8.1
Unrestricted Upload of File with Dangerous Type vulnerability in Mobatime web application (Documentary proof upload modules) allows a malicious user to Upload a Web Shell to a Web Server.This issue affects Mobatime web application: through 06.7.22.
Product
Mobatime web application
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record borelenzo.github.io borelenzo.github.io

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.