Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,269 results · page 14 of 26
Jul 3, 2022Authentication bypass by capture-replay vulnerability exists in Machine automation controller NX7 series all models V1.28 and earlier, Machine automation controCVE-2022-33971 · Other software · OMRON Corporation · reported by vultures@jpcert.or.jpHigh 7.5
Authentication bypass by capture-replay vulnerability exists in Machine automation controller NX7 series all models V1.28 and earlier, Machine automation controller NX1 series all models V1.48 and earlier, and Machine automation controller NJ series all models V 1.48 and earlier, which may allow an adjacent attacker who can analyze the communication between the controller and the specific software used by OMRON internally to cause a denial-of-service (DoS) condition or execute a malicious program.
- Product
- Machine automation controller NJ series, Machine automation controller NX series, Automation software 'Sysmac Studio', and Programmable Terminal (PT) NA series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 3, 2022Authentication bypass by capture-replay vulnerability exists in Machine automation controller NJ series all models V 1.48 and earlier, Machine automation controCVE-2022-33208 · Other software · OMRON Corporation · reported by vultures@jpcert.or.jpHigh 8.1
Authentication bypass by capture-replay vulnerability exists in Machine automation controller NJ series all models V 1.48 and earlier, Machine automation controller NX7 series all models V1.28 and earlier, Machine automation controller NX1 series all models V1.48 and earlier, Automation software 'Sysmac Studio' all models V1.49 and earlier, and Programmable Terminal (PT) NA series NA5-15W/NA5-12W/NA5-9W/NA5-7W models Runtime V1.15 and earlier, which may allow a remote attacker who can analyze the communication between the affected controller and automation software 'Sysmac Studio' and/or a Programmable Terminal (PT) to access the controller.
- Product
- Machine automation controller NJ series, Machine automation controller NX series, Automation software 'Sysmac Studio', and Programmable Terminal (PT) NA series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2022.NET and Visual Studio Information Disclosure VulnerabilityCVE-2022-30184 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
.NET and Visual Studio Information Disclosure Vulnerability
- Product
- .NET 6.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comlists.fedoraproject.org
Jun 15, 2022Azure RTOS GUIX Studio Information Disclosure VulnerabilityCVE-2022-30180 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Azure RTOS GUIX Studio Information Disclosure Vulnerability
- Product
- Azure RTOS GUIX Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jun 15, 2022Azure RTOS GUIX Studio Remote Code Execution VulnerabilityCVE-2022-30179 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Azure RTOS GUIX Studio Remote Code Execution Vulnerability
- Product
- Azure RTOS GUIX Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jun 15, 2022Azure RTOS GUIX Studio Remote Code Execution VulnerabilityCVE-2022-30178 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Azure RTOS GUIX Studio Remote Code Execution Vulnerability
- Product
- Azure Real Time Operating System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jun 15, 2022Azure RTOS GUIX Studio Remote Code Execution VulnerabilityCVE-2022-30177 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Azure RTOS GUIX Studio Remote Code Execution Vulnerability
- Product
- Azure RTOS GUIX Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jun 14, 2022SAP NetWeaver Developer Studio (NWDS) - version 7.50, is based on Eclipse, which contains the logging framework log4j in version 1.x.CVE-2022-29615 · Network & remote access · SAP SE · reported by cna@sap.comLow 3.4
SAP NetWeaver Developer Studio (NWDS) - version 7.50, is based on Eclipse, which contains the logging framework log4j in version 1.x. The application's confidentiality and integrity could have a low impact due to the vulnerabilities associated with version 1.x.
- Product
- SAP NetWeaver Developer Studio (NWDS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comsap.com
Jun 12, 2022A cross-site scripting (XSS) vulnerability in the SEOmatic plugin 3.4.10 for Craft CMS 3 allows remote attackers to inject arbitrary web script via a GET to /inCVE-2021-41750 · Other software · Nystudio107 · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in the SEOmatic plugin 3.4.10 for Craft CMS 3 allows remote attackers to inject arbitrary web script via a GET to /index.php?action=seomatic/file/seo-file-link with url parameter containing the base64 encoded URL of a malicious web page / file and fileName parameter containing an arbitrary filename with the intended content-type to be rendered in the user's browser as the extension.
- Product
- Seomatic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2022In the SEOmatic plugin up to 3.4.11 for Craft CMS 3, it is possible for unauthenticated attackers to perform a Server-Side Template Injection, allowing for remoCVE-2021-41749 · Other software · Nystudio107 · reported by MITRECritical 9.8
In the SEOmatic plugin up to 3.4.11 for Craft CMS 3, it is possible for unauthenticated attackers to perform a Server-Side Template Injection, allowing for remote code execution.
- Product
- Seomatic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2022A Cross Site Request Forgery (CSRF) vulnerability exists in TheDayLightStudio Fuel CMS 1.5.0 via a POST call to /fuel/sitevariables/delete/4.CVE-2021-44117 · Other software · Thedaylightstudio · reported by MITREHigh 8.8
A Cross Site Request Forgery (CSRF) vulnerability exists in TheDayLightStudio Fuel CMS 1.5.0 via a POST call to /fuel/sitevariables/delete/4.
- Product
- Fuel CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgetfuelcms.com
May 16, 2022Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands viaCVE-2021-23267 · Other software · Crafter Software · reported by security@craftersoftware.comHigh 7.6
Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via FreeMarker static methods.
- Product
- Crafter CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.craftercms.orgdocs.craftercms.org
May 10, 2022Visual Studio Code Remote Code Execution VulnerabilityCVE-2022-30129 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Visual Studio Code Remote Code Execution Vulnerability
- Product
- Visual Studio Code
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comblog.sonarsource.com
May 10, 2022Visual Studio Remote Code Execution VulnerabilityCVE-2022-29148 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Visual Studio Remote Code Execution Vulnerability
- Product
- Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
May 10, 2022.NET and Visual Studio Denial of Service VulnerabilityCVE-2022-29145 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
.NET and Visual Studio Denial of Service Vulnerability
- Product
- .NET 6.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comlists.fedoraproject.org
May 10, 2022.NET and Visual Studio Denial of Service VulnerabilityCVE-2022-29117 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
.NET and Visual Studio Denial of Service Vulnerability
- Product
- .NET 6.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comlists.fedoraproject.org
May 10, 2022.NET and Visual Studio Denial of Service VulnerabilityCVE-2022-23267 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
.NET and Visual Studio Denial of Service Vulnerability
- Product
- .NET Core 3.1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comlists.fedoraproject.org
May 3, 2022A stored cross-site scripting (XSS) vulnerability exists in FUEL-CMS 1.5.1 that allows an authenticated user to upload a malicious .pdf file which acts as a stoCVE-2022-28599 · Other software · Thedaylightstudio · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability exists in FUEL-CMS 1.5.1 that allows an authenticated user to upload a malicious .pdf file which acts as a stored XSS payload. If this stored XSS payload is triggered by an administrator it will trigger a XSS attack.
- Product
- Fuel CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2022Visual Studio Code Elevation of Privilege VulnerabilityCVE-2022-26921 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.3
Visual Studio Code Elevation of Privilege Vulnerability
- Product
- Visual Studio Code
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 15, 2022Visual Studio Elevation of Privilege VulnerabilityCVE-2022-24513 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Visual Studio Elevation of Privilege Vulnerability
- Product
- Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 12, 2022GitHub: Git for Windows' uninstaller vulnerable to DLL hijacking when run under the SYSTEM user account.CVE-2022-24767 · Computers, phones & browsers · Microsoft · reported by GitHubHigh 7.8
GitHub: Git for Windows' uninstaller vulnerable to DLL hijacking when run under the SYSTEM user account.
- Product
- Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Apr 11, 2022Daylight Studio Fuel CMS 1.5.1 is vulnerable to HTML Injection.CVE-2022-27156 · Other software · Thedaylightstudio · reported by MITREMedium 5.4
Daylight Studio Fuel CMS 1.5.1 is vulnerable to HTML Injection.
- Product
- Fuel CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 11, 2022In Studio-42 elFinder 2.1.60, there is a vulnerability that causes remote code execution through file name bypass for file upload.CVE-2022-27115 · Other software · Std42 · reported by MITRECritical 9.8
In Studio-42 elFinder 2.1.60, there is a vulnerability that causes remote code execution through file name bypass for file upload.
- Product
- Elfinder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2022A File Upload vulnerability exists in Studio-42 elFinder 2.0.4 to 2.1.59 via connector.minimal.php, which allows a remote malicious user to upload arbitrary filCVE-2021-43421 · Other software · Std42 · reported by MITRECritical 9.8
A File Upload vulnerability exists in Studio-42 elFinder 2.0.4 to 2.1.59 via connector.minimal.php, which allows a remote malicious user to upload arbitrary files and execute PHP code.
- Product
- Elfinder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2022Rockwell Automation Studio 5000 Logix Designer (all versions) are vulnerable when an attacker who achieves administrator access on a workstation running Studio CVE-2022-1159 · Other software · Rockwell Automation · reported by ics-cert@hq.dhs.govHigh 7.7
Rockwell Automation Studio 5000 Logix Designer (all versions) are vulnerable when an attacker who achieves administrator access on a workstation running Studio 5000 Logix Designer could inject controller code undetectable to a user.
- Product
- Studio 5000 Logix Designer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2022A remote code execution (RCE) vulnerability in Beekeeper Studio v3.2.0 allows attackers to execute arbitrary code via a crafted payload injected into the displaCVE-2022-26174 · Other software · Beekeeperstudio · reported by MITRECritical 9.8
A remote code execution (RCE) vulnerability in Beekeeper Studio v3.2.0 allows attackers to execute arbitrary code via a crafted payload injected into the display fields.
- Product
- Beekeeper-studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2022In Click Studios (SA) Pty Ltd Passwordstate 9435, users with access to a passwordlist can gain access to additional password lists without permissions.CVE-2022-25570 · Other software · Clickstudios · reported by MITREMedium 6.5
In Click Studios (SA) Pty Ltd Passwordstate 9435, users with access to a passwordlist can gain access to additional password lists without permissions. Specifically, an authenticated user who has write permissions to a password list in one folder (with the default permission model) can extend his permissions to all other password lists in the same folder.
- Product
- Passwordstate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsysadms.declickstudios.com.au
Mar 11, 2022A Server-side Template Injection (SSTI) vulnerability exists in Nystudio107 Seomatic 3.4.12 in src/helpers/UrlHelper.php via the host header.CVE-2021-44618 · Other software · Nystudio107 · reported by MITRECritical 9.8
A Server-side Template Injection (SSTI) vulnerability exists in Nystudio107 Seomatic 3.4.12 in src/helpers/UrlHelper.php via the host header.
- Product
- Seomatic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2022Visual Studio Code Spoofing VulnerabilityCVE-2022-24526 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.1
Visual Studio Code Spoofing Vulnerability
- Product
- Visual Studio Code
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 9, 2022.NET and Visual Studio Remote Code Execution VulnerabilityCVE-2022-24512 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.3
.NET and Visual Studio Remote Code Execution Vulnerability
- Product
- Microsoft Visual Studio 2019 version 16.7 (includes 16.0 – 16.6)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 9, 2022.NET and Visual Studio Denial of Service VulnerabilityCVE-2022-24464 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
.NET and Visual Studio Denial of Service Vulnerability
- Product
- .NET 6.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Feb 24, 2022A Cross Site Scripting (XSS) vulnerability exists in FUEL-CMS 1.5.1 in the Assets page via an SVG file.CVE-2021-44607 · Other software · Thedaylightstudio · reported by MITREMedium 5.4
A Cross Site Scripting (XSS) vulnerability exists in FUEL-CMS 1.5.1 in the Assets page via an SVG file.
- Product
- Fuel CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2022SAS Web Report Studio 4.4 allows XSS.CVE-2022-25256 · Other software · SAS · reported by MITREMedium 6.1
SAS Web Report Studio 4.4 allows XSS. /SASWebReportStudio/logonAndRender.do has two parameters: saspfs_request_backlabel_list and saspfs_request_backurl_list. The first one affects the content of the button placed in the top left. The second affects the page to which the user is directed after pressing the button, e.g., a malicious web page. In addition, the second parameter executes JavaScript, which means XSS is possible by adding a javascript: URL.
- Product
- Web Report Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2022Visual Studio Code Remote Development Extension Remote Code Execution VulnerabilityCVE-2022-21991 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.1
Visual Studio Code Remote Development Extension Remote Code Execution Vulnerability
- Product
- Visual Studio Code
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Feb 9, 2022.NET Denial of Service VulnerabilityCVE-2022-21986 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
.NET Denial of Service Vulnerability
- Product
- Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Feb 8, 2022Studio 42 elFinder through 2.1.31 allows XSS via an SVG document.CVE-2021-45919 · Other software · Std42 · reported by MITREMedium 5.4
Studio 42 elFinder through 2.1.31 allows XSS via an SVG document.
- Product
- Elfinder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtrustwave.comtrustwave.com
Jan 18, 2022IBM Cloud Pak for Automation 21.0.1 and 21.0.2 - Business Automation Studio Component is vulnerable to HTTP header injection, caused by improper validation of iCVE-2021-29872 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.4
IBM Cloud Pak for Automation 21.0.1 and 21.0.2 - Business Automation Studio Component is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. By sending a specially crafted HTTP request, a remote attacker could exploit this vulnerability to inject HTTP HOST header, which will allow the attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 206228.
- Product
- Cloud Pak for Automation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jan 14, 2022WECON LeviStudioU Versions 2019-09-21 and prior are vulnerable to a heap-based buffer overflow, which may allow an attacker to remotely execute code.CVE-2021-23157 · Other software · WECON · reported by ics-cert@hq.dhs.govHigh 7.8
WECON LeviStudioU Versions 2019-09-21 and prior are vulnerable to a heap-based buffer overflow, which may allow an attacker to remotely execute code.
- Product
- LeviStudioU
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcisa.govzerodayinitiative.com
Jan 14, 2022WECON LeviStudioU Versions 2019-09-21 and prior are vulnerable to a stack-based buffer overflow, which may allow an attacker to remotely execute code.CVE-2021-23138 · Other software · WECON · reported by ics-cert@hq.dhs.govHigh 7.8
WECON LeviStudioU Versions 2019-09-21 and prior are vulnerable to a stack-based buffer overflow, which may allow an attacker to remotely execute code.
- Product
- LeviStudioU
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcisa.govzerodayinitiative.com
Dec 17, 2021Buffer Overflow Vulnerability exists in ajaxsoundstudio.com n Pyo < 1.03 in the Server_debug function, which allows remote attackers to conduct DoS attacks by dCVE-2021-41499 · Other software · PYO Project · reported by MITREHigh 7.5
Buffer Overflow Vulnerability exists in ajaxsoundstudio.com n Pyo < 1.03 in the Server_debug function, which allows remote attackers to conduct DoS attacks by deliberately passing on an overlong audio file name.
- Product
- PYO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2021Buffer overflow in ajaxsoundstudio.com Pyo < and 1.03 in the Server_jack_init function.CVE-2021-41498 · Other software · PYO Project · reported by MITREHigh 7.5
Buffer overflow in ajaxsoundstudio.com Pyo < and 1.03 in the Server_jack_init function. which allows attackers to conduct Denial of Service attacks by arbitrary constructing a overlong server name.
- Product
- PYO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2021Visual Studio Code Spoofing VulnerabilityCVE-2021-43908 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.3
Visual Studio Code Spoofing Vulnerability
- Product
- Visual Studio Code
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Dec 15, 2021Visual Studio Code WSL Extension Remote Code Execution VulnerabilityCVE-2021-43907 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.8
Visual Studio Code WSL Extension Remote Code Execution Vulnerability
- Product
- Visual Studio Code WSL Extension
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Dec 15, 2021Visual Studio Code Remote Code Execution VulnerabilityCVE-2021-43891 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Visual Studio Code Remote Code Execution Vulnerability
- Product
- Visual Studio Code
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Dec 15, 2021ASP.NET Core and Visual Studio Elevation of Privilege VulnerabilityCVE-2021-43877 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
ASP.NET Core and Visual Studio Elevation of Privilege Vulnerability
- Product
- Microsoft Visual Studio 2019 version 16.7 (includes 16.0 – 16.6)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Dec 14, 2021An issue was discovered in UiPath App Studio 21.4.4.CVE-2021-44043 · Other software · Uipath · reported by MITREMedium 5.4
An issue was discovered in UiPath App Studio 21.4.4. There is a persistent XSS vulnerability in the file-upload functionality for uploading icons when attempting to create new Apps. An attacker with minimal privileges in the application can build their own App and upload a malicious file containing an XSS payload, by uploading an arbitrary file and modifying the MIME type in a subsequent HTTP request. This then allows the file to be stored and retrieved from the server by other users in the same organization.
- Product
- App Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.uipath.comdocs.uipath.com
Dec 13, 2021WECON LeviStudioU Versions 2019-09-21 and prior are vulnerable to multiple stack-based buffer overflow instances while parsing project files, which may allow anCVE-2021-43983 · Other software · WECON · reported by ics-cert@hq.dhs.govHigh 7.8
WECON LeviStudioU Versions 2019-09-21 and prior are vulnerable to multiple stack-based buffer overflow instances while parsing project files, which may allow an attacker to execute arbitrary code.
- Product
- LeviStudioU
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcisa.govzerodayinitiative.com
Nov 9, 2021Visual Studio Code Elevation of Privilege VulnerabilityCVE-2021-42322 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Visual Studio Code Elevation of Privilege Vulnerability
- Product
- Visual Studio Code
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Nov 9, 2021Visual Studio Elevation of Privilege VulnerabilityCVE-2021-42319 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.7
Visual Studio Elevation of Privilege Vulnerability
- Product
- Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Nov 9, 2021Diagnostics Hub Standard Collector Elevation of Privilege VulnerabilityCVE-2021-42277 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Diagnostics Hub Standard Collector Elevation of Privilege Vulnerability
- Product
- Microsoft Visual Studio 2015 Update 3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.