Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,933 results · page 16 of 39
Jul 5, 2023Kanboard is project management software that focuses on the Kanban methodology.CVE-2023-36813 · Other software · kanboard · reported by GitHubHigh 7.1
Kanboard is project management software that focuses on the Kanban methodology. In versions prior to 1.2.31authenticated user is able to perform a SQL Injection, leading to a privilege escalation or loss of confidentiality. It appears that in some insert and update operations, the code improperly uses the PicoDB library to update/insert new information. Version 1.2.31 contains a fix for this issue.
- Product
- kanboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2023D-Link DSL-224 firmware version 3.0.10 allows post authentication command execution via an unspecified method.CVE-2023-32223 · Network & remote access · D-Link · reported by cna@cyber.gov.ilHigh 8.8
D-Link DSL-224 firmware version 3.0.10 allows post authentication command execution via an unspecified method.
- Product
- DSL-224 firmware version 3.0.10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2023D-Link DSL-G256DG version vBZ_1.00.27 web management interface allows authentication bypass via an unspecified method.CVE-2023-32222 · Network & remote access · D-Link · reported by cna@cyber.gov.ilCritical 9.8
D-Link DSL-G256DG version vBZ_1.00.27 web management interface allows authentication bypass via an unspecified method.
- Product
- DSL-G256DG firmware version vBZ_1.00.27
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2023In setInputMethodWithSubtypeIdLocked of InputMethodManagerService.java, there is a possible way to setup input methods that are not enabled due to improper inpuCVE-2023-21192 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In setInputMethodWithSubtypeIdLocked of InputMethodManagerService.java, there is a possible way to setup input methods that are not enabled due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-227207653
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Jun 28, 2023In onCreate of DataUsageSummary.java, there is a possible method for a guest user to enable or disable mobile data due to a permissions bypass.CVE-2023-21175 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In onCreate of DataUsageSummary.java, there is a possible method for a guest user to enable or disable mobile data due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-262243574
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Jun 28, 2023In multiple methods of DataUsageList.java, there is a possible way to learn about admin user's network activities due to a missing permission check.CVE-2023-21173 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In multiple methods of DataUsageList.java, there is a possible way to learn about admin user's network activities due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-262741858
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Jun 28, 2023Versions of the package git-commit-info before 2.0.2 are vulnerable to Command Injection such that the package-exported method gitCommitInfo () fails to sanitizCVE-2023-26134 · Other software · Git-commit-info Project · reported by report@snyk.ioCritical 9.8
Versions of the package git-commit-info before 2.0.2 are vulnerable to Command Injection such that the package-exported method gitCommitInfo () fails to sanitize its parameter commit, which later flows into a sensitive command execution API. As a result, attackers may inject malicious commands once they control the hash content.
- Product
- Git-commit-info
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2023An insecure permissions in /Taier/API/tenant/listTenant interface in DTStack Taier 1.3.0 allows attackers to view sensitive information via the getCookie methodCVE-2023-29860 · Other software · Dtstack · reported by MITREHigh 7.5
An insecure permissions in /Taier/API/tenant/listTenant interface in DTStack Taier 1.3.0 allows attackers to view sensitive information via the getCookie method.
- Product
- Taier
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2023Dynamic Linq 1.0.7.10 through 1.2.25 before 1.3.0 allows attackers to execute arbitrary code and commands when untrusted input to methods including Where, SelecCVE-2023-32571 · Other software · Dynamic-linq · reported by MITRECritical 9.8
Dynamic Linq 1.0.7.10 through 1.2.25 before 1.3.0 allows attackers to execute arbitrary code and commands when untrusted input to methods including Where, Select, OrderBy is parsed.
- Product
- Linq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comresearch.nccgroup.com
Jun 20, 2023An issue in WUZHI CMS v.4.1.0 allows a remote attacker to execute arbitrary code via the set_chache method of the function\common.func.php file.CVE-2020-21325 · Other software · Wuzhicms · reported by MITREHigh 8.8
An issue in WUZHI CMS v.4.1.0 allows a remote attacker to execute arbitrary code via the set_chache method of the function\common.func.php file.
- Product
- Wuzhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2023Cross Site Scripting vulnerability in khodakhah NodCMS v.3.0 allows a remote attacker to execute arbitrary code and gain access to senstivie information via a cCVE-2020-20697 · Other software · Nodcms · reported by MITREMedium 4.8
Cross Site Scripting vulnerability in khodakhah NodCMS v.3.0 allows a remote attacker to execute arbitrary code and gain access to senstivie information via a crafted script to the address parameter.
- Product
- Nodcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2023In several methods of JobStore.java, uncaught exceptions in job map parsing could lead to local persistent denial of service with no additional execution privilCVE-2023-21137 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In several methods of JobStore.java, uncaught exceptions in job map parsing could lead to local persistent denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-246541702
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Jun 15, 2023cmseasy v7.7.7.7 20230520 was discovered to contain a path traversal vulnerability via the add_action method at lib/admin/language_admin.php.CVE-2023-34880 · Other software · Cmseasy · reported by MITRECritical 9.8
cmseasy v7.7.7.7 20230520 was discovered to contain a path traversal vulnerability via the add_action method at lib/admin/language_admin.php. This vulnerability allows attackers to execute arbitrary code and perform a local file inclusion.
- Product
- Cmseasy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.pumpk1n.comblog.pumpk1n.com
Jun 12, 2023Milesight NCR/camera version 71.8.0.6-r5 allows authentication bypass through an unspecified method.CVE-2023-32220 · Other software · Milesight · reported by cna@cyber.gov.ilHigh 8.2
Milesight NCR/camera version 71.8.0.6-r5 allows authentication bypass through an unspecified method.
- Product
- NCR/camera
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2023A Mazda model (2015-2016) can be unlocked via an unspecified method.CVE-2023-32219 · Other software · Mazda · reported by cna@cyber.gov.ilMedium 6.5
A Mazda model (2015-2016) can be unlocked via an unspecified method.
- Product
- Mazda (2015-2016)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2023Kanboard is open source project management software that focuses on the Kanban methodology.CVE-2023-33970 · Other software · kanboard · reported by GitHubMedium 5.4
Kanboard is open source project management software that focuses on the Kanban methodology. A vulnerability related to a `missing access control` was found, which allows a User with the lowest privileges to leak all the tasks and projects titles within the software, even if they are not invited or it's a personal project. This could also lead to private/critical information being leaked if such information is in the title. This issue has been addressed in version 1.2.30. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- kanboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2023Kanboard is open source project management software that focuses on the Kanban methodology.CVE-2023-33969 · Other software · kanboard · reported by GitHubMedium 6.4
Kanboard is open source project management software that focuses on the Kanban methodology. A stored Cross site scripting (XSS) allows an attacker to execute arbitrary Javascript and any user who views the task containing the malicious code will be exposed to the XSS attack. Note: The default CSP header configuration blocks this javascript attack. This issue has been addressed in version 1.2.30. Users are advised to upgrade. Users unable to upgrade should ensure that they have a restrictive CSP header config.
- Product
- kanboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2023Kanboard is open source project management software that focuses on the Kanban methodology.CVE-2023-33968 · Other software · kanboard · reported by GitHubMedium 5.4
Kanboard is open source project management software that focuses on the Kanban methodology. Versions prior to 1.2.30 are subject to a missing access control vulnerability that allows a user with low privileges to create or transfer tasks to any project within the software, even if they have not been invited or the project is personal. The vulnerable features are `Duplicate to project` and `Move to project`, which both utilize the `checkDestinationProjectValues()` function to check his values. This issue has been addressed in version 1.2.30. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- kanboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2023Kanboard is open source project management software that focuses on the Kanban methodology.CVE-2023-33956 · Other software · kanboard · reported by GitHubMedium 4.3
Kanboard is open source project management software that focuses on the Kanban methodology. Versions prior to 1.2.30 are subject to an Insecure direct object reference (IDOR) vulnerability present in the application's URL parameter. This vulnerability enables any user to read files uploaded by any other user, regardless of their privileges or restrictions. By Changing the file_id any user can render all the files where MimeType is image uploaded under **/files** directory regard less of uploaded by any user. This vulnerability poses a significant impact and severity to the application's security. By manipulating the URL parameter, an attacker can access sensitive files that should only be available to authorized users. This includes confidential documents or any other type of file stored within the application. The ability to read these files can lead to various detrimental consequences, such as unauthorized disclosure of sensitive information, privacy breaches, intellectual property theft, or exposure of trade secrets. Additionally, it could result in legal and regulatory implications, reputation damage, financial losses, and potential compromise of user trust. Users are advised t
- Product
- kanboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2023IBM Aspera Connect 4.2.5 and IBM Aspera Cargo 4.2.5 transmits authentication credentials, but it uses an insecure method that is susceptible to unauthorized intCVE-2023-22862 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.9
IBM Aspera Connect 4.2.5 and IBM Aspera Cargo 4.2.5 transmits authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
- Product
- Aspera Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordibm.comexchange.xforce.ibmcloud.com
Jun 2, 2023mp4v2 v2.1.3 was discovered to contain a memory leak when a method calling MP4File::ReadBytes() had allocated memory but did not catch exceptions thrown by ReadCVE-2023-33717 · Other software · Mp4v2 Project · reported by MITREMedium 5.5
mp4v2 v2.1.3 was discovered to contain a memory leak when a method calling MP4File::ReadBytes() had allocated memory but did not catch exceptions thrown by ReadBytes()
- Product
- Mp4v2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2023Janino 3.1.9 and earlier are subject to denial of service (DOS) attacks when using the expression evaluator.guess parameter name method.CVE-2023-33546 · Other software · Janino Project · reported by MITREMedium 5.5
Janino 3.1.9 and earlier are subject to denial of service (DOS) attacks when using the expression evaluator.guess parameter name method. If the parser runs on user-supplied input, an attacker could supply content that causes the parser to crash due to a stack overflow. NOTE: this is disputed by multiple parties because Janino is not intended for use with untrusted input.
- Product
- Janino
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comjanino-compiler.github.io
May 31, 2023Story Saver for Instragram - Video Downloader 1.0.6 for Android has an exposed component that provides a method to modify the SharedPreference file.CVE-2023-29748 · Other software · Story Saver For Instagram - Video Downloader Project · reported by MITREHigh 7.5
Story Saver for Instragram - Video Downloader 1.0.6 for Android has an exposed component that provides a method to modify the SharedPreference file. An attacker can leverage this method to inject a large amount of data into any SharedPreference file, which will be loaded into memory when the application is opened. When an attacker injects too much data, the application will trigger an OOM error and crash at startup, resulting in a persistent denial of service.
- Product
- Story Saver For Instagram - Video Downloader
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 31, 2023Story Saver for Instragram - Video Downloader 1.0.6 for Android exists exposed component, the component provides the method to modify the SharedPreference file.CVE-2023-29747 · Other software · Story Saver For Instagram - Video Downloader Project · reported by MITRECritical 9.8
Story Saver for Instragram - Video Downloader 1.0.6 for Android exists exposed component, the component provides the method to modify the SharedPreference file. The attacker can use the method to modify the data in any SharedPreference file, these data will be loaded into the memory when the application is opened. Depending on how the data is used, this can result in various attack consequences, such as ad display exceptions.
- Product
- Story Saver For Instagram - Video Downloader
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2023SoLive 1.6.14 thru 1.6.20 for Android exists exposed component, the component provides the method to modify the SharedPreference file.CVE-2023-29732 · Other software · Loka · reported by MITRECritical 9.8
SoLive 1.6.14 thru 1.6.20 for Android exists exposed component, the component provides the method to modify the SharedPreference file. The attacker can use the method to modify the data in any SharedPreference file, these data will be loaded into the memory when the application is opened. Depending on how the data is used, this can result in various attack consequences, such as ad display exceptions.
- Product
- Solive
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2023SoLive 1.6.14 thru 1.6.20 for Android has an exposed component that provides a method to modify the SharedPreference file.CVE-2023-29731 · Other software · Loka · reported by MITREHigh 7.5
SoLive 1.6.14 thru 1.6.20 for Android has an exposed component that provides a method to modify the SharedPreference file. An attacker can leverage this method to inject a large amount of data into any SharedPreference file, which will be loaded into memory when the application is opened. When an attacker injects too much data, the application will trigger an OOM error and crash at startup, resulting in a persistent denial of service.
- Product
- Solive
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2023Kanboard is project management software that focuses on the Kanban methodology.CVE-2023-32685 · Other software · kanboard · reported by GitHubMedium 4.4
Kanboard is project management software that focuses on the Kanban methodology. Due to improper handling of elements under the `contentEditable` element, maliciously crafted clipboard content can inject arbitrary HTML tags into the DOM. A low-privileged attacker with permission to attach a document on a vulnerable Kanboard instance can trick the victim into pasting malicious screenshot data and achieve cross-site scripting if CSP is improperly configured. This issue has been patched in version 1.2.29.
- Product
- kanboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2023SQL injection in "/Framewrk/Home.jsp" file (POST method) in tCredence Analytics iDEAL Wealth and Funds - 1.0 iallows authenticated remote attackers to inject paCVE-2022-30025 · Other software · Credenceanalytics · reported by MITREMedium 6.5
SQL injection in "/Framewrk/Home.jsp" file (POST method) in tCredence Analytics iDEAL Wealth and Funds - 1.0 iallows authenticated remote attackers to inject payload via "v" parameter.
- Product
- Ideal - Wealth And Funds
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
May 23, 2023The `Toybox.Ant.BurstPayload.add` API method in CIQ API version 2.2.0 through 4.1.7 suffers from a type confusion vulnreability, which can result in an out-of-bCVE-2023-23306 · Other software · Garmin · reported by MITRECritical 9.8
The `Toybox.Ant.BurstPayload.add` API method in CIQ API version 2.2.0 through 4.1.7 suffers from a type confusion vulnreability, which can result in an out-of-bounds write operation. A malicious application could create a specially crafted `Toybox.Ant.BurstPayload` object, call its `add` method, override arbitrary memory and hijack the execution of the device's firmware.
- Product
- Connect-iq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.garmin.comgithub.com
May 23, 2023The `Toybox.Ant.GenericChannel.enableEncryption` API method in CIQ API version 3.2.0 through 4.1.7 does not validate its parameter, which can result in buffer oCVE-2023-23303 · Other software · Garmin · reported by MITRECritical 9.8
The `Toybox.Ant.GenericChannel.enableEncryption` API method in CIQ API version 3.2.0 through 4.1.7 does not validate its parameter, which can result in buffer overflows when copying various attributes. A malicious application could call the API method with specially crafted object and hijack the execution of the device's firmware.
- Product
- Connect-iq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.garmin.comgithub.com
May 23, 2023The `Toybox.GenericChannel.setDeviceConfig` API method in CIQ API version 1.2.0 through 4.1.7 does not validate its parameter, which can result in buffer overflCVE-2023-23302 · Other software · Garmin · reported by MITRECritical 9.8
The `Toybox.GenericChannel.setDeviceConfig` API method in CIQ API version 1.2.0 through 4.1.7 does not validate its parameter, which can result in buffer overflows when copying various attributes. A malicious application could call the API method with specially crafted object and hijack the execution of the device's firmware.
- Product
- Connect-iq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.garmin.comgithub.com
May 23, 2023The `Toybox.Cryptography.Cipher.initialize` API method in CIQ API version 3.0.0 through 4.1.7 does not validate its parameters, which can result in buffer overfCVE-2023-23300 · Other software · Garmin · reported by MITRECritical 9.8
The `Toybox.Cryptography.Cipher.initialize` API method in CIQ API version 3.0.0 through 4.1.7 does not validate its parameters, which can result in buffer overflows when copying data. A malicious application could call the API method with specially crafted parameters and hijack the execution of the device's firmware.
- Product
- Connect-iq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.garmin.comgithub.com
May 23, 2023The `Toybox.Graphics.BufferedBitmap.initialize` API method in CIQ API version 2.3.0 through 4.1.7 does not validate its parameters, which can result in integer CVE-2023-23298 · Other software · Garmin · reported by MITRECritical 9.8
The `Toybox.Graphics.BufferedBitmap.initialize` API method in CIQ API version 2.3.0 through 4.1.7 does not validate its parameters, which can result in integer overflows when allocating the underlying bitmap buffer. A malicious application could call the API method with specially crafted parameters and hijack the execution of the device's firmware.
- Product
- Connect-iq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.garmin.comdeveloper.garmin.com
May 16, 2023Jenkins Sidebar Link Plugin 2.2.1 and earlier does not restrict the path of files in a method implementing form validation, allowing attackers with Overall/ReadCVE-2023-32985 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
Jenkins Sidebar Link Plugin 2.2.1 and earlier does not restrict the path of files in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.
- Product
- Jenkins Sidebar Link Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2023Jenkins Email Extension Plugin does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to CVE-2023-32979 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
Jenkins Email Extension Plugin does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of files in the email-templates/ directory in the Jenkins home directory on the controller file system.
- Product
- Jenkins Email Extension Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2023A NoSQL injection vulnerability has been identified in the listEmojiCustom method call within Rocket.Chat.CVE-2023-28359 · Other software · Rocket.chat · reported by support@hackerone.comMedium 5.3
A NoSQL injection vulnerability has been identified in the listEmojiCustom method call within Rocket.Chat. This can be exploited by unauthenticated users when there is at least one custom emoji uploaded to the Rocket.Chat instance. The vulnerability causes a delay in the server response, with the potential for limited impact.
- Product
- Rocket.chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comhackerone.com
May 11, 2023An improper authorization vulnerability exists in Rocket.Chat <6.0 that could allow a hacker to manipulate the rid parameter and change the updateMessage methodCVE-2023-28325 · Other software · Rocket.chat · reported by support@hackerone.comMedium 6.5
An improper authorization vulnerability exists in Rocket.Chat <6.0 that could allow a hacker to manipulate the rid parameter and change the updateMessage method that only checks whether the user is allowed to edit message in the target room.
- Product
- Rocket.chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comhackerone.com
May 10, 2023A directory traversal vulnerability in the /get-artifact API method of the mlflow platform up to v2.0.1 allows attackers to read arbitrary files on the server vCVE-2023-30172 · Other software · Lfprojects · reported by MITREHigh 7.5
A directory traversal vulnerability in the /get-artifact API method of the mlflow platform up to v2.0.1 allows attackers to read arbitrary files on the server via the path parameter.
- Product
- Mlflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2023An authentication bypass vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker to gain access by exploiting the SetUser methodCVE-2023-28126 · Network & remote access · Ivanti · reported by support@hackerone.comMedium 5.9
An authentication bypass vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker to gain access by exploiting the SetUser method or can exploit the Race Condition in the authentication message.
- Product
- Avalanche
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforums.ivanti.comforums.ivanti.com
May 9, 2023Cross Site Scripting vulnerability found in Phodal CMD v.1.0 allows a local attacker to execute arbitrary code via the EMBED SRC function.CVE-2020-18280 · Other software · MD Project · reported by MITREMedium 6.1
Cross Site Scripting vulnerability found in Phodal CMD v.1.0 allows a local attacker to execute arbitrary code via the EMBED SRC function.
- Product
- MD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2023 EasyTor Applications – Authorization Bypass - EasyTor Applications may allow authorization bypass via unspecified method.CVE-2023-31182 · Other software · EasyTor Applications · reported by cna@cyber.gov.ilHigh 8.1
EasyTor Applications – Authorization Bypass - EasyTor Applications may allow authorization bypass via unspecified method.
- Product
- EasyTor Applications
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2023The vulnerability was found Moodle which exists due to insufficient sanitization of user-supplied data in external Wiki method for listing pages.CVE-2023-30944 · Other software · Moodle · reported by patrick@puiterwijk.orgMedium 5.6
The vulnerability was found Moodle which exists due to insufficient sanitization of user-supplied data in external Wiki method for listing pages. A remote attacker can send a specially crafted request to the affected application and execute limited SQL commands within the application database.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.moodle.orgbugzilla.redhat.com
Apr 25, 2023The authentication method in Laravel 8.x through 9.x before 9.32.0 was discovered to be vulnerable to user enumeration via timeless timing attacks with HTTP/2 mCVE-2022-40482 · Other software · Laravel · reported by MITREMedium 5.3
The authentication method in Laravel 8.x through 9.x before 9.32.0 was discovered to be vulnerable to user enumeration via timeless timing attacks with HTTP/2 multiplexing. This is caused by the early return inside the hasValidCredentials method in the Illuminate\Auth\SessionGuard class when a user is found to not exist.
- Product
- Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2023In JetBrains Ktor before 2.3.0 path traversal in the `resolveResource` method was possible CVE-2022-48476 · Other software · JetBrains · reported by cve@jetbrains.comHigh 7.5
In JetBrains Ktor before 2.3.0 path traversal in the `resolveResource` method was possible
- Product
- Ktor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
Apr 19, 2023In multiple methods of PackageInstallerSession.java, there is a possible way to start foreground services from the background due to a logic error in the code.CVE-2023-21099 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In multiple methods of PackageInstallerSession.java, there is a possible way to start foreground services from the background due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-243377226
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Apr 17, 2023An authenticated user with Gamma role authorization could have access to metadata information using non trivial methods in Apache Superset up to and including 2CVE-2023-27525 · Websites & servers · Apache Software Foundation · reported by security@apache.orgLow 3.1
An authenticated user with Gamma role authorization could have access to metadata information using non trivial methods in Apache Superset up to and including 2.0.1
- Product
- Apache Superset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
Apr 6, 2023It was discovered that aufs improperly managed inode reference counts in the vfsub_dentry_open() method.CVE-2020-11935 · Other software · Ubuntu · reported by security@ubuntu.comMedium 4.4
It was discovered that aufs improperly managed inode reference counts in the vfsub_dentry_open() method. A local attacker could use this vulnerability to cause a denial of service attack.
- Product
- Linux kernel (aufs filesystem module)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.launchpad.netubuntu.com
Apr 4, 2023In LangChain through 0.0.131, the LLMMathChain chain allows prompt injection attacks that can execute arbitrary code via the Python exec method.CVE-2023-29374 · Other software · Langchain · reported by MITRECritical 9.8
In LangChain through 0.0.131, the LLMMathChain chain allows prompt injection attacks that can execute arbitrary code via the Python exec method.
- Product
- Langchain
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2023Silverstripe Form Capture provides a method to capture simple silverstripe forms and an admin interface for users.CVE-2023-28851 · Other software · bigfork · reported by GitHubMedium 6.1
Silverstripe Form Capture provides a method to capture simple silverstripe forms and an admin interface for users. Starting in version 0.2.0 and prior to versions 1.0.2, 1.1.0, 2.2.5, and 3.1.1, improper escaping when presenting stored form submissions allowed for an attacker to perform a Cross-Site Scripting attack. The vulnerability was initially patched in version 1.0.2, and version 1.1.0 includes this patch. The bug was then accidentally re-introduced during a merge error, and has been re-patched in versions 2.2.5 and 3.1.1. There are no known workarounds for this vulnerability.
- Product
- silverstripe-form-capture
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2023Jenkins JaCoCo Plugin 3.3.2 and earlier does not escape class and method names shown on the UI, resulting in a stored cross-site scripting (XSS) vulnerability eCVE-2023-28669 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins JaCoCo Plugin 3.3.2 and earlier does not escape class and method names shown on the UI, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control input files for the 'Record JaCoCo coverage report' post-build action.
- Product
- Jenkins JaCoCo Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.