Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,387 results · page 15 of 28
Jan 3, 2024WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels: Unauthorized access of dataCVE-2023-7068 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on theprint_packinglist action in all versions up to, and including, 4.3.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to export orders which can contain sensitive information.
- Product
- WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels
- Affected
- up to 4.3.0
- What to do
- Affects up to 4.3.0. Update WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 4, 2023A Cross-Site Scripting (XSS) vulnerability in the recipe preparation component within /api/objects/recipes and note component within /api/objects/shopping_listsCVE-2023-48866 · Other software · Grocy Project · reported by MITREMedium 5.4
A Cross-Site Scripting (XSS) vulnerability in the recipe preparation component within /api/objects/recipes and note component within /api/objects/shopping_lists/ of Grocy <= 4.0.3 allows attackers to obtain the victim's cookies.
- Product
- Grocy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnitipoom-jar.github.io
Nov 30, 2023An Untrusted search path vulnerability in notepad++ 6.5 allows local users to gain escalated privileges through the msimg32.dll file in the current working direCVE-2023-47452 · Other software · Notepad-plus-plus · reported by MITREHigh 7.8
An Untrusted search path vulnerability in notepad++ 6.5 allows local users to gain escalated privileges through the msimg32.dll file in the current working directory.
- Product
- Notepad++
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 30, 2023A vulnerability classified as problematic was found in NotePad++ up to 8.1.CVE-2023-6401 · Other software · Notepad-plus-plus · reported by VulDBMedium 5.3
A vulnerability classified as problematic was found in NotePad++ up to 8.1. Affected by this vulnerability is an unknown functionality of the file dbghelp.exe. The manipulation leads to uncontrolled search path. An attack has to be approached locally. The identifier VDB-246421 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Notepad++
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2023Microsoft OneNote Spoofing VulnerabilityCVE-2023-36769 · Email & office · Microsoft · reported by secure@microsoft.comMedium 4.6
Microsoft OneNote Spoofing Vulnerability
- Product
- Microsoft Office 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Oct 28, 2023Proxmox proxmox-widget-toolkit before 4.0.9, as used in multiple Proxmox products, allows XSS via the edit notes feature.CVE-2023-46854 · Other software · Proxmox · reported by MITREMedium 5.4
Proxmox proxmox-widget-toolkit before 4.0.9, as used in multiple Proxmox products, allows XSS via the edit notes feature.
- Product
- Proxmox-widget-toolkit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.proxmox.comgit.proxmox.com
Oct 25, 2023Missing authentication in the SetStudentNotes method in IDAttend’s IDWeb application 3.1.052 and earlier allows modification of student data by unauthenticatedCVE-2023-26571 · Other software · IDAttend Pty Ltd · reported by vdp@themissinglink.com.auHigh 7.5
Missing authentication in the SetStudentNotes method in IDAttend’s IDWeb application 3.1.052 and earlier allows modification of student data by unauthenticated attackers.
- Product
- IDWeb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordthemissinglink.com.authemissinglink.com.au
Oct 22, 2023A vulnerability has been found in vnotex vnote up to 3.17.0 and classified as problematic.CVE-2023-5701 · Other software · vnotex · reported by VulDBMedium 4.3
A vulnerability has been found in vnotex vnote up to 3.17.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Markdown File Handler. The manipulation with the input <xss onclick="alert(1)" style=display:block>Click here</xss> leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-243139. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- vnote
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2023Modern Footnotes: Stored Cross-Site ScriptingCVE-2023-5618 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Modern Footnotes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in versions up to, and including, 1.4.16 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Modern Footnotes
- Affected
- up to 1.4.16
- What to do
- Affects up to 1.4.16. Update Modern Footnotes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgresearch.cleantalk.org
Oct 9, 2023A potential vulnerability in a driver used during manufacturing process on some consumer Lenovo Notebook devices that was mistakenly not deactivated may allow aCVE-2022-3431 · Other software · Lenovo · reported by psirt@lenovo.comMedium 6.7
A potential vulnerability in a driver used during manufacturing process on some consumer Lenovo Notebook devices that was mistakenly not deactivated may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM variable.
- Product
- BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lenovo.comsupport.lenovo.com
Sep 21, 2023 As noted in the “VTPM.md” file in the eve documentation, “VTPM is a server listening on port 8877 in EVE, exposing limited functionality of the TPM to the clieCVE-2023-43632 · Other software · LF-Edge, Zededa · reported by cve@asrg.ioCritical 9
As noted in the “VTPM.md” file in the eve documentation, “VTPM is a server listening on port 8877 in EVE, exposing limited functionality of the TPM to the clients. VTPM allows clients to execute tpm2-tools binaries from a list of hardcoded options” The communication with this server is done using protobuf, and the data is comprised of 2 parts: 1. Header 2. Data When a connection is made, the server is waiting for 4 bytes of data, which will be the header, and these 4 bytes would be parsed as uint32 size of the actual data to come. Then, in the function “handleRequest” this size is then used in order to allocate a payload on the stack for the incoming data. As this payload is allocated on the stack, this will allow overflowing the stack size allocated for the relevant process with freely controlled data. * An attacker can crash the system. * An attacker can gain control over the system, specifically on the “vtpm_server” process which has very high privileges.
- Product
- EVE OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2023Jenkins 2.423 and earlier, LTS 2.414.1 and earlier does not escape the value of the 'caption' constructor parameter of 'ExpandableDetailsNote', resulting in a sCVE-2023-43495 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins 2.423 and earlier, LTS 2.414.1 and earlier does not escape the value of the 'caption' constructor parameter of 'ExpandableDetailsNote', resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control this parameter.
- Product
- Jenkins
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Sep 18, 2023Cross Site Scripting vulnerability in Summernote Rich Text Editor v.0.8.18 and before allows a remote attacker to execute arbitrary code via a crafted script toCVE-2023-42371 · Other software · Summernote · reported by MITREMedium 5.4
Cross Site Scripting vulnerability in Summernote Rich Text Editor v.0.8.18 and before allows a remote attacker to execute arbitrary code via a crafted script to the insert link function in the editor component.
- Product
- Rich Text Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhacker.soarescorp.comsummernote.org
Sep 15, 2023A flaw was found in the Kubernetes service for notebooks in RHODS, where it does not prevent pods from other namespaces and applications from making requests toCVE-2023-0923 · Other software · Red Hat · reported by Red HatHigh 8.8
A flaw was found in the Kubernetes service for notebooks in RHODS, where it does not prevent pods from other namespaces and applications from making requests to the Jupyter API. This flaw can lead to file content exposure and other issues.
- Product
- RHODS-1.22-RHEL-8
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Aug 25, 2023Notepad++ is a free and open-source source code editor.CVE-2023-40166 · Other software · notepad-plus-plus · reported by GitHubMedium 5.5
Notepad++ is a free and open-source source code editor. Versions 8.5.6 and prior are vulnerable to heap buffer read overflow in `FileManager::detectLanguageFromTextBegining `. The exploitability of this issue is not clear. Potentially, it may be used to leak internal memory allocation information. As of time of publication, no known patches are available in existing versions of Notepad++.
- Product
- notepad-plus-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecuritylab.github.comsecuritylab.github.com
Aug 25, 2023Notepad++ is a free and open-source source code editor.CVE-2023-40164 · Other software · notepad-plus-plus · reported by GitHubMedium 5.5
Notepad++ is a free and open-source source code editor. Versions 8.5.6 and prior are vulnerable to global buffer read overflow in `nsCodingStateMachine::NextStater`. The exploitability of this issue is not clear. Potentially, it may be used to leak internal memory allocation information. As of time of publication, no known patches are available in existing versions of Notepad++.
- Product
- notepad-plus-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecuritylab.github.comsecuritylab.github.com
Aug 25, 2023Notepad++ is a free and open-source source code editor.CVE-2023-40036 · Other software · notepad-plus-plus · reported by GitHubMedium 5.5
Notepad++ is a free and open-source source code editor. Versions 8.5.6 and prior are vulnerable to global buffer read overflow in `CharDistributionAnalysis::HandleOneChar`. The exploitability of this issue is not clear. Potentially, it may be used to leak internal memory allocation information. As of time of publication, no known patches are available in existing versions of Notepad++.
- Product
- notepad-plus-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecuritylab.github.comsecuritylab.github.com
Aug 25, 2023Notepad++ is a free and open-source source code editor.CVE-2023-40031 · Other software · notepad-plus-plus · reported by GitHubHigh 7.8
Notepad++ is a free and open-source source code editor. Versions 8.5.6 and prior are vulnerable to heap buffer write overflow in `Utf8_16_Read::convert`. This issue may lead to arbitrary code execution. As of time of publication, no known patches are available in existing versions of Notepad++.
- Product
- notepad-plus-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecuritylab.github.comsecuritylab.github.com
Aug 23, 2023A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevated privileges to cauCVE-2022-3746 · Other software · Lenovo · reported by psirt@lenovo.comMedium 6.7
A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevated privileges to cause some peripherals to work abnormally due to an exposed Embedded Controller (EC) interface.
- Product
- Notebook
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lenovo.comsupport.lenovo.com
Aug 23, 2023A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevated privileges to vieCVE-2022-3745 · Other software · Lenovo · reported by psirt@lenovo.comMedium 4.4
A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevated privileges to view incoming and returned data from SMI.
- Product
- Notebook
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lenovo.comsupport.lenovo.com
Aug 23, 2023A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevated privileges to unlCVE-2022-3744 · Other software · Lenovo · reported by psirt@lenovo.comMedium 6.7
A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevated privileges to unlock UEFI variables due to a hard-coded SMI handler credential.
- Product
- Notebook
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lenovo.comsupport.lenovo.com
Aug 23, 2023A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevated privileges under CVE-2022-3743 · Other software · Lenovo · reported by psirt@lenovo.comMedium 4.4
A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevated privileges under certain conditions the ability to enumerate Embedded Controller (EC) commands.
- Product
- Notebook
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lenovo.comsupport.lenovo.com
Aug 23, 2023A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevated privileges to exeCVE-2022-3742 · Other software · Lenovo · reported by psirt@lenovo.comMedium 6.7
A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevated privileges to execute arbitrary code due to improper buffer validation.
- Product
- Notebook
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lenovo.comsupport.lenovo.com
Aug 17, 2023A buffer overflow has been identified in the SystemUserMasterHddPwdDxe driver in some Lenovo Notebook products which may allow an attacker with local access andCVE-2023-4028 · Other software · Lenovo · reported by psirt@lenovo.comMedium 6.7
A buffer overflow has been identified in the SystemUserMasterHddPwdDxe driver in some Lenovo Notebook products which may allow an attacker with local access and elevated privileges to execute arbitrary code.
- Product
- Lenovo Notebook
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lenovo.comsupport.lenovo.com
Aug 17, 2023A buffer overflow has been identified in the SetupUtility driver in some Lenovo Notebook products which may allow an attacker with local access and elevated priCVE-2023-34419 · Other software · Lenovo · reported by psirt@lenovo.comMedium 6.7
A buffer overflow has been identified in the SetupUtility driver in some Lenovo Notebook products which may allow an attacker with local access and elevated privileges to execute arbitrary code.
- Product
- Lenovo Notebook
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lenovo.comsupport.lenovo.com
Aug 10, 2023Notes is a note-taking app for Nextcloud, an open-source cloud platform.CVE-2023-39955 · Other software · nextcloud · reported by GitHubLow 3.5
Notes is a note-taking app for Nextcloud, an open-source cloud platform. Starting in version 4.4.0 and prior to version 4.8.0, when creating a note file with HTML, the content is rendered in the preview instead of the file being offered to download. Nextcloud Notes app version 4.8.0 contains a patch for the issue. No known workarounds are available.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 9, 2023A SQL injection vulnerability exists in the “notes view” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to CVE-2022-48600 · Other software · ScienceLogic · reported by contact@securifera.comHigh 8.8
A SQL injection vulnerability exists in the “notes view” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a SQL query. This allows for the injection of arbitrary SQL before being executed against the database.
- Product
- SL 1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurifera.comsecurifera.com
Aug 8, 2023Azure HDInsight Jupyter Notebook Spoofing VulnerabilityCVE-2023-35394 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.6
Azure HDInsight Jupyter Notebook Spoofing Vulnerability
- Product
- Azure HDInsight
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Aug 4, 2023HedgeDoc is software for creating real-time collaborative markdown notes.CVE-2023-38487 · Other software · hedgedoc · reported by GitHubMedium 6.5
HedgeDoc is software for creating real-time collaborative markdown notes. Prior to version 1.9.9, the API of HedgeDoc 1 can be used to create notes with an alias matching the ID of existing notes. The affected existing note can then not be accessed anymore and is effectively hidden by the new one. When the freeURL feature is enabled (by setting the `allowFreeURL` config option or the `CMD_ALLOW_FREEURL` environment variable to `true`), any user with the appropriate permissions can create a note by making a POST request to the `/new/<ALIAS>` API endpoint. The `<ALIAS>` parameter can be set to the ID of an existing note. HedgeDoc did not verify whether the provided `<ALIAS>` value corresponds to a valid ID of an existing note and always allowed creation of the new note. When a visitor tried to access the existing note, HedgeDoc will first search for a note with a matching alias before it searches using the ID, therefore only the new note can be accessed. Depending on the permission settings of the HedgeDoc instance, the issue can be exploited only by logged-in users or by all (including non-logged-in) users. The exploit requires knowledge of the ID of the target note. Attackers cou
- Product
- hedgedoc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2023Livebook is a web application for writing interactive and collaborative code notebooks.CVE-2023-35174 · Other software · livebook-dev · reported by GitHubHigh 8.6
Livebook is a web application for writing interactive and collaborative code notebooks. On Windows, it is possible to open a `livebook://` link from a browser which opens Livebook Desktop and triggers arbitrary code execution on victim's machine. Any user using Livebook Desktop on Windows is potentially vulnerable to arbitrary code execution when they expect Livebook to be opened from browser. This vulnerability has been fixed in version 0.8.2 and 0.9.3.
- Product
- livebook
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2023Improper permission control vulnerability in the Notepad app.Successful exploitation of the vulnerability may lead to privilege escalation, which affects availaCVE-2023-34159 · Other software · Huawei · reported by psirt@huawei.comCritical 9.8
Improper permission control vulnerability in the Notepad app.Successful exploitation of the vulnerability may lead to privilege escalation, which affects availability and confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Jun 13, 2023Microsoft OneNote Spoofing VulnerabilityCVE-2023-33140 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Microsoft OneNote Spoofing Vulnerability
- Product
- Microsoft OneNote for Universal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comgithub.com
Jun 8, 2023Incorrect access control in Chamilo v1.11.x up to v1.11.18 allows a student to arbitrarily access and modify another student's personal notes.CVE-2023-34962 · Other software · Chamilo · reported by MITREHigh 8.1
Incorrect access control in Chamilo v1.11.x up to v1.11.18 allows a student to arbitrarily access and modify another student's personal notes.
- Product
- Chamilo LMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 28, 2023Yank Note (YN) 3.52.1 allows execution of arbitrary code when a crafted file is opened, e.g., via nodeRequire('child_process').CVE-2023-31874 · Other software · Yank-note · reported by MITREHigh 8.8
Yank Note (YN) 3.52.1 allows execution of arbitrary code when a crafted file is opened, e.g., via nodeRequire('child_process').
- Product
- Yank Note
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
May 27, 2023Omni-notes is an open source note-taking application for Android.CVE-2023-33188 · Other software · federicoiosue · reported by GitHubMedium 6.3
Omni-notes is an open source note-taking application for Android. The Omni-notes Android app had an insufficient path validation vulnerability when displaying the details of a note received through an externally-provided intent. The paths of the note's attachments were not properly validated, allowing malicious or compromised applications in the same device to force Omni-notes to copy files from its internal storage to its external storage directory, where they would have become accessible to any component with permission to read the external storage. Updating to the newest version (6.2.7) of Omni-notes Android fixes this vulnerability.
- Product
- Omni-Notes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2023Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via a crafted payload to the personal notes CVE-2023-31807 · Other software · Chamilo · reported by MITREMedium 5.4
Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via a crafted payload to the personal notes function.
- Product
- Chamilo LMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.chamilo.orgsupport.chamilo.org
Apr 25, 2023A stored Cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the NoteEditor.php.CVE-2023-26843 · Other software · Churchcrm · reported by MITREMedium 5.4
A stored Cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the NoteEditor.php.
- Product
- Churchcrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2023go-bbs v1 was discovered to contain an arbitrary file download vulnerability via the component /api/v1/download.CVE-2023-27755 · Other software · 71note · reported by MITREHigh 8.8
go-bbs v1 was discovered to contain an arbitrary file download vulnerability via the component /api/v1/download.
- Product
- Go-bbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2023The Mustache pix helper contained a potential Mustache injection risk if combined with user input (note: This did not appear to be implemented/exploitable anywhCVE-2023-28333 · Other software · Moodle · reported by patrick@puiterwijk.orgCritical 9.8
The Mustache pix helper contained a potential Mustache injection risk if combined with user input (note: This did not appear to be implemented/exploitable anywhere in the core Moodle LMS).
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comlists.fedoraproject.org
Mar 6, 2023AgileBio Electronic Lab Notebook v4.234 was discovered to contain a local file inclusion vulnerability.CVE-2023-24217 · Other software · Agilebio · reported by MITREHigh 8.8
AgileBio Electronic Lab Notebook v4.234 was discovered to contain a local file inclusion vulnerability.
- Product
- Electronic Lab Notebook
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comlabcollector.com
Feb 18, 2023A vulnerability, which was classified as problematic, was found in cxasm notepad-- 1.22.CVE-2023-0909 · Other software · cxasm · reported by VulDBLow 3.3
A vulnerability, which was classified as problematic, was found in cxasm notepad-- 1.22. This affects an unknown part of the component Directory Comparison Handler. The manipulation leads to denial of service. The attack needs to be approached locally. The associated identifier of this vulnerability is VDB-221475.
- Product
- notepad--
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2023Microsoft OneNote Elevation of Privilege VulnerabilityCVE-2023-21721 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Microsoft OneNote Elevation of Privilege Vulnerability
- Product
- Microsoft OneNote for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Feb 7, 2023 If an attacker has access to the console for OpenKM (and is authenticated), a stored XSS vulnerability is reachable in the document "note" functionality.CVE-2022-47414 · Other software · OpenKM · reported by cve@rapid7.comMedium 5.4
If an attacker has access to the console for OpenKM (and is authenticated), a stored XSS vulnerability is reachable in the document "note" functionality.
- Product
- OpenKM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 31, 2023Notepad++ v8.4.1 was discovered to contain a stack overflow via the component Finder::add().CVE-2022-31902 · Other software · Notepad-plus-plus · reported by MITREMedium 5.5
Notepad++ v8.4.1 was discovered to contain a stack overflow via the component Finder::add().
- Product
- Notepad++
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2023A buffer overflow in the SystemBootManagerDxe driver in some Lenovo Notebook products may allow an attacker with local privileges to execute arbitrary code.CVE-2022-1892 · Other software · Lenovo · reported by psirt@lenovo.comMedium 6.7
A buffer overflow in the SystemBootManagerDxe driver in some Lenovo Notebook products may allow an attacker with local privileges to execute arbitrary code.
- Product
- BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lenovo.comsupport.lenovo.com
Jan 26, 2023A buffer overflow in the SystemLoadDefaultDxe driver in some Lenovo Notebook products may allow an attacker with local privileges to execute arbitrary code.CVE-2022-1891 · Other software · Lenovo · reported by psirt@lenovo.comMedium 6.7
A buffer overflow in the SystemLoadDefaultDxe driver in some Lenovo Notebook products may allow an attacker with local privileges to execute arbitrary code.
- Product
- BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lenovo.comsupport.lenovo.com
Jan 26, 2023A buffer overflow in the ReadyBootDxe driver in some Lenovo Notebook products may allow an attacker with local privileges to execute arbitrary code.CVE-2022-1890 · Other software · Lenovo · reported by psirt@lenovo.comMedium 6.7
A buffer overflow in the ReadyBootDxe driver in some Lenovo Notebook products may allow an attacker with local privileges to execute arbitrary code.
- Product
- BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lenovo.comsupport.lenovo.com
Jan 23, 2023A potential vulnerability in the WMI Setup driver on some consumer Lenovo Notebook devices may allow an attacker with elevated privileges to modify secure boot CVE-2022-3430 · Other software · Lenovo · reported by psirt@lenovo.comMedium 6.7
A potential vulnerability in the WMI Setup driver on some consumer Lenovo Notebook devices may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM variable.
- Product
- BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lenovo.comsupport.lenovo.com
Jan 19, 2023Buffer overflow in function Notepad_plus::addHotSpot in Notepad++ v8.4.3 and earlier allows attackers to crash the application via two crafted files.CVE-2022-31901 · Other software · Notepad-plus-plus · reported by MITREMedium 6.5
Buffer overflow in function Notepad_plus::addHotSpot in Notepad++ v8.4.3 and earlier allows attackers to crash the application via two crafted files.
- Product
- Notepad++
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2023Vulnerability in the PeopleSoft Enterprise CS Academic Advisement product of Oracle PeopleSoft (component: Advising Notes).CVE-2023-21831 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 5.3
Vulnerability in the PeopleSoft Enterprise CS Academic Advisement product of Oracle PeopleSoft (component: Advising Notes). The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise CS Academic Advisement. Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise CS Academic Advisement accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
- Product
- PeopleSoft Enterprise CS Academic Advisement
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.