Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,078 results · page 17 of 42
Jul 17, 2023ProfileGrid: Unauthorized modification of dataCVE-2023-3403 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The ProfileGrid plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'pm_upload_csv' function in versions up to, and including, 5.5.1. This makes it possible for authenticated attackers, with subscriber-level permissions or above to import new users and update existing users.
- Product
- ProfileGrid
- Affected
- up to 5.5.1
- What to do
- Affects up to 5.5.1. Update ProfileGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 12, 2023DigiExam up to v14.0.2 lacks integrity checks for native modules, allowing attackers to access PII and takeover accounts on shared computers.CVE-2023-33668 · Other software · Digiexam · reported by MITRECritical 9.8
DigiExam up to v14.0.2 lacks integrity checks for native modules, allowing attackers to access PII and takeover accounts on shared computers.
- Product
- Digiexam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2023RAYS Grid: Cross-Site Request ForgeryCVE-2021-4423 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The RAYS Grid plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.2. This is due to missing or incorrect nonce validation on the rsgd_insert_update() function. This makes it possible for unauthenticated attackers to update post fields via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- RAYS Grid
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update RAYS Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comblog.nintechnet.com
Jul 5, 2023Improper validation of integrity check vulnerability in Smart Switch PC prior to version 4.3.23052_1 allows local attackers to delete arbitrary directory using CVE-2023-30673 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5.5
Improper validation of integrity check vulnerability in Smart Switch PC prior to version 4.3.23052_1 allows local attackers to delete arbitrary directory using directory junction.
- Product
- Smart Switch PC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Jul 5, 2023A cross-site scripting (XSS) vulnerability in Selenium Grid v3.141.59 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected iCVE-2020-23452 · Other software · Selenium · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in Selenium Grid v3.141.59 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the hub parameter under the /grid/console page.
- Product
- Selenium Grid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2023Reliance on Cookies without Validation and Integrity Checking in a Security Decision vulnerability in TMT Lockcell allows Privilege Abuse, Authentication BypassCVE-2023-3050 · Other software · TMT · reported by iletisim@usom.gov.trCritical 9.8
Reliance on Cookies without Validation and Integrity Checking in a Security Decision vulnerability in TMT Lockcell allows Privilege Abuse, Authentication Bypass. This issue affects Lockcell: before 15.
- Product
- Lockcell
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfordefence.comsiberguvenlik.gov.tr
May 25, 2023Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in CBOT Chatbot allows Adversary in the Middle (AiTM).CVE-2023-2885 · Other software · CBOT · reported by iletisim@usom.gov.trHigh 8.1
Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in CBOT Chatbot allows Adversary in the Middle (AiTM). This issue affects Chatbot: before Core: v4.0.3.4 Panel: v4.0.3.7.
- Product
- Chatbot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
May 23, 2023Cross-Site Request Forgery (CSRF) vulnerability in RadiusTheme The Post Grid plugin <= 5.0.4 versions.CVE-2022-46853 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in RadiusTheme The Post Grid plugin <= 5.0.4 versions.
- Fixed in
- 5.0.5
- What to do
- Update the plugin to 5.0.5 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 10, 2023in-toto is a framework to protect supply chain integrity.CVE-2023-32076 · Other software · in-toto · reported by GitHubMedium 5.5
in-toto is a framework to protect supply chain integrity. The in-toto configuration is read from various directories and allows users to configure the behavior of the framework. The files are from directories following the XDG base directory specification. In versions 1.4.0 and prior, among the files read is `.in_totorc` which is a hidden file in the directory in which in-toto is run. If an attacker controls the inputs to a supply chain step, they can mask their activities by also passing in an `.in_totorc` file that includes the necessary exclude patterns and settings. RC files are widely used in other systems and security issues have been discovered in their implementations as well. Maintainers found in their conversations with in-toto adopters that `in_totorc` is not their preferred way to configure in-toto. As none of the options supported in `in_totorc` is unique, and can be set elsewhere using API parameters or CLI arguments, the maintainers decided to drop support for `in_totorc`. in-toto's `user_settings` module has been dropped altogether in commit 3a21d84f40811b7d191fa7bd17265c1f99599afd. Users may also sandbox functionary code as a security measure.
- Product
- in-toto
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2023Missing Support for an Integrity Check in Shenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 allows attackers to update the device with crafted firmwarCVE-2023-30356 · Network & remote access · Tenda · reported by MITREHigh 7.5
Missing Support for an Integrity Check in Shenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 allows attackers to update the device with crafted firmware
- Product
- Cp3 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2023Insufficient input validation in ABL may enable a privileged attacker to corrupt ASP memory, potentially resulting in a loss of integrity or code execution.CVE-2021-46773 · Other software · AMD · reported by psirt@amd.comHigh 8.8
Insufficient input validation in ABL may enable a privileged attacker to corrupt ASP memory, potentially resulting in a loss of integrity or code execution.
- Product
- Ryzen™ 2000 series Desktop Processors “Raven Ridge” AM4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2023Insufficient input validation on the model specific register: VM_HSAVE_PA may potentially lead to loss of SEV-SNP guest memory integrity.CVE-2022-23818 · Other software · AMD · reported by psirt@amd.comHigh 7.5
Insufficient input validation on the model specific register: VM_HSAVE_PA may potentially lead to loss of SEV-SNP guest memory integrity.
- Product
- 3rd Gen AMD EPYC™
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2023Improper input validation in ABL may enable an attacker with physical access, to perform arbitrary memory overwrites, potentially leading to a loss of integrityCVE-2021-46775 · Other software · AMD · reported by psirt@amd.comMedium 6.8
Improper input validation in ABL may enable an attacker with physical access, to perform arbitrary memory overwrites, potentially leading to a loss of integrity and code execution.
- Product
- 2nd Gen AMD EPYC™
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2023Insufficient input validation in the SMU may allow an attacker to corrupt SMU SRAM potentially leading to a loss of integrity or denial of service.CVE-2021-46762 · Other software · AMD · reported by psirt@amd.comLow 3.9
Insufficient input validation in the SMU may allow an attacker to corrupt SMU SRAM potentially leading to a loss of integrity or denial of service.
- Product
- 2nd Gen AMD EPYC™
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2023Insufficient input validation of mailbox data in the SMU may allow an attacker to coerce the SMU to corrupt SMRAM, potentially leading to a loss of integrity anCVE-2021-26379 · Other software · AMD · reported by psirt@amd.comCritical 9.8
Insufficient input validation of mailbox data in the SMU may allow an attacker to coerce the SMU to corrupt SMRAM, potentially leading to a loss of integrity and privilege escalation.
- Product
- 2nd Gen AMD EPYC™
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 3, 2023 In the pre connection stage, an improper enforcement of message integrity vulnerability exists in BIG-IP Edge Client for Windows and Mac OS.CVE-2023-22372 · Network & remote access · F5 · reported by f5sirt@f5.comMedium 5.9
In the pre connection stage, an improper enforcement of message integrity vulnerability exists in BIG-IP Edge Client for Windows and Mac OS. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- Product
- BIG-IP Edge Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2023A potential security vulnerability has been identified in the system BIOS for certain HP PC products which may allow loss of integrity.CVE-2022-31643 · Other software · HP Inc. · reported by hp-security-alert@hp.comMedium 5.5
A potential security vulnerability has been identified in the system BIOS for certain HP PC products which may allow loss of integrity. HP is releasing firmware updates to mitigate the potential vulnerability.
- Product
- HP PC BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hp.comsupport.hp.com
Apr 11, 2023A download of code without Integrity check vulnerability [CWE-494] in FortiClientMac version 7.0.0 through 7.0.7, 6.4 all versions, 6.2 all versions, 6.0 all vCVE-2023-22635 · Network & remote access · Fortinet · reported by psirt@fortinet.comHigh 7.3
A download of code without Integrity check vulnerability [CWE-494] in FortiClientMac version 7.0.0 through 7.0.7, 6.4 all versions, 6.2 all versions, 6.0 all versions, 5.6 all versions, 5.4 all versions, 5.2 all versions, 5.0 all versions and 4.0 all versions may allow a local attacker to escalate their privileges via modifying the installer upon upgrade.
- Product
- FortiClientMac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.comfortiguard.com
Mar 29, 2023This vulnerability allows network-adjacent attackers to compromise the integrity of downloaded information on affected installations of NETGEAR R6700v3 1.0.4.12CVE-2022-27644 · Network & remote access · NETGEAR · reported by zdi-disclosures@trendmicro.comHigh 8.8
This vulnerability allows network-adjacent attackers to compromise the integrity of downloaded information on affected installations of NETGEAR R6700v3 1.0.4.120_10.0.91 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the downloading of files via HTTPS. The issue results from the lack of proper validation of the certificate presented by the server. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-15797.
- Product
- R6700v3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.netgear.comzerodayinitiative.com
Mar 25, 2023A vulnerability was found in grinnellplans-php up to 3.0.CVE-2015-10097 · Other software · Grinnellplans · reported by VulDBMedium 6.3
A vulnerability was found in grinnellplans-php up to 3.0. It has been declared as critical. Affected by this vulnerability is the function interface_disp_page/interface_disp_page of the file read.php. The manipulation leads to sql injection. The attack can be launched remotely. The identifier of the patch is 57e4409e19203a94495140ff1b5a697734d17cfb. It is recommended to apply a patch to fix this issue. The identifier VDB-223801 was assigned to this vulnerability.
- Product
- Grinnellplans
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2023ProfileGrid: Provides an AJAX endpoint for resetting a user password but does not implement proper authorizationCVE-2023-0940 · WordPress plugins & themes · reported by WPScanHigh 8.8
The ProfileGrid WordPress plugin before 5.3.1 provides an AJAX endpoint for resetting a user password but does not implement proper authorization. This allows a user with low privileges, such as subscriber, to change the password of any account, including Administrator ones.
- Product
- ProfileGrid
- Fixed in
- 5.3.1
- What to do
- Update ProfileGrid to 5.3.1 or newer.
Mar 2, 2023StorageGRID (formerly StorageGRID Webscale) versions prior to 11.6.0.8 are susceptible to a Denial of Service (DoS) vulnerability.CVE-2022-38734 · Other software · Netapp · reported by security-alert@netapp.comHigh 7.5
StorageGRID (formerly StorageGRID Webscale) versions prior to 11.6.0.8 are susceptible to a Denial of Service (DoS) vulnerability. A successful exploit could lead to to a crash of the Local Distribution Router (LDR) service.
- Product
- Storagegrid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.comsecurity.netapp.com
Feb 16, 2023It was discovered that the Magritte-ftp was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactory API.CVE-2022-48307 · Other software · Palantir · reported by cve-coordination@palantir.comMedium 6.3
It was discovered that the Magritte-ftp was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactory API. A malicious attacker in a privileged network position could abuse this to perform a man-in-the-middle attack. A successful man-in-the-middle attack would allow them to intercept, read, or modify network communications to and from the affected service. In the case of a successful man in the middle attack on magritte-ftp, an attacker would be able to read and modify network traffic such as authentication tokens or raw data entering a Palantir Foundry stack.
- Product
- Foundry Magritte
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2023Responsive Gallery Grid: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0060 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Responsive Gallery Grid WordPress plugin before 2.3.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Responsive Gallery Grid
- Fixed in
- 2.3.9
- What to do
- Update Responsive Gallery Grid to 2.3.9 or newer.
Feb 6, 2023Post Category Image With Grid and Slider: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4747 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Post Category Image With Grid and Slider WordPress plugin before 1.4.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Post Category Image With Grid and Slider
- Fixed in
- 1.4.8
- What to do
- Update Post Category Image With Grid and Slider to 1.4.8 or newer.
Feb 2, 2023The use of the cyclic redundancy check (CRC) algorithm for integrity check during firmware update makes TRENDnet TV-IP651WI Network Camera firmware version v1.0CVE-2023-23120 · Other software · Trendnet · reported by MITREMedium 5.9
The use of the cyclic redundancy check (CRC) algorithm for integrity check during firmware update makes TRENDnet TV-IP651WI Network Camera firmware version v1.07.01 and earlier vulnerable to firmware modification attacks. An attacker can conduct a man-in-the-middle (MITM) attack to modify the new firmware image and bypass the checksum verification.
- Product
- Tv-ip651wi Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2023The use of the cyclic redundancy check (CRC) algorithm for integrity check during firmware update makes Ubiquiti airFiber AF2X Radio firmware version 3.2.2 and CVE-2023-23119 · Other software · UI · reported by MITREMedium 5.9
The use of the cyclic redundancy check (CRC) algorithm for integrity check during firmware update makes Ubiquiti airFiber AF2X Radio firmware version 3.2.2 and earlier vulnerable to firmware modification attacks. An attacker can conduct a man-in-the-middle (MITM) attack to modify the new firmware image and bypass the checksum verification.
- Product
- Af-2x Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.ui.comhackmd.io
Feb 1, 2023All versions of Landis+Gyr E850 (ZMQ200) are vulnerable to CWE-784: Reliance on Cookies Without Validation and Integrity.CVE-2022-3083 · Other software · Landis+Gyr · reported by ics-cert@hq.dhs.govLow 3.9
All versions of Landis+Gyr E850 (ZMQ200) are vulnerable to CWE-784: Reliance on Cookies Without Validation and Integrity. The device's web application navigation depends on the value of the session cookie. The web application could become inaccessible for the user if an attacker changes the cookie values.
- Product
- E850 (ZMQ200)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2023Post Grid, Post Carousel, & List Category Posts: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0097 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Post Grid, Post Carousel, & List Category Posts WordPress plugin before 2.4.19 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Post Grid, Post Carousel, & List Category Posts
- Fixed in
- 2.4.19
- What to do
- Update Post Grid, Post Carousel, & List Category Posts to 2.4.19 or newer.
Jan 17, 2023An issue was discovered on GE Grid Solutions MS3000 devices before 3.7.6.25p0_3.2.2.17p0_4.7p0.CVE-2022-43977 · Other software · GE · reported by MITRECritical 9.8
An issue was discovered on GE Grid Solutions MS3000 devices before 3.7.6.25p0_3.2.2.17p0_4.7p0. The debug port accessible via TCP (a qconn service) lacks access control.
- Product
- MS 3000 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwid.cert-bund.dewid.cert-bund.de
Jan 17, 2023An issue was discovered in FC46-WebBridge on GE Grid Solutions MS3000 devices before 3.7.6.25p0_3.2.2.17p0_4.7p0.CVE-2022-43976 · Other software · GE · reported by MITRECritical 9.8
An issue was discovered in FC46-WebBridge on GE Grid Solutions MS3000 devices before 3.7.6.25p0_3.2.2.17p0_4.7p0. Direct access to the API is possible on TCP port 8888 via programs located in the cgi-bin folder without any authentication.
- Product
- MS 3000 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwid.cert-bund.dewid.cert-bund.de
Jan 17, 2023An issue was discovered in FC46-WebBridge on GE Grid Solutions MS3000 devices before 3.7.6.25p0_3.2.2.17p0_4.7p0.CVE-2022-43975 · Other software · GE · reported by MITREHigh 7.5
An issue was discovered in FC46-WebBridge on GE Grid Solutions MS3000 devices before 3.7.6.25p0_3.2.2.17p0_4.7p0. A vulnerability in the web server allows arbitrary files and configurations to be read via directory traversal over TCP port 8888.
- Product
- MS 3000 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwid.cert-bund.dewid.cert-bund.de
Jan 15, 2023A vulnerability classified as critical was found in visegripped Stracker.CVE-2022-4889 · Other software · visegripped · reported by VulDBMedium 5.5
A vulnerability classified as critical was found in visegripped Stracker. Affected by this vulnerability is the function getHistory of the file doc_root/public_html/stracker/api.php. The manipulation of the argument symbol/startDate/endDate leads to sql injection. The identifier of the patch is 63e1b040373ee5b6c7d1e165ecf5ae1603d29e0a. It is recommended to apply a patch to fix this issue. The identifier VDB-218377 was assigned to this vulnerability.
- Product
- Stracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2023Tiki before 24.1, when the Spreadsheets feature is enabled, allows lib/sheet/grid.php PHP Object Injection because of an unserialize call.CVE-2023-22850 · Other software · Tiki · reported by MITREHigh 8.8
Tiki before 24.1, when the Spreadsheets feature is enabled, allows lib/sheet/grid.php PHP Object Injection because of an unserialize call.
- Product
- Tiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkarmainsecurity.comtiki.org
Jan 11, 2023TOCTOU in the ASP may allow a physical attacker to write beyond the buffer bounds, potentially leading to a loss of integrity or denial of service.CVE-2023-20523 · Other software · AMD · reported by psirt@amd.comMedium 5.7
TOCTOU in the ASP may allow a physical attacker to write beyond the buffer bounds, potentially leading to a loss of integrity or denial of service.
- Product
- 2nd Gen EPYC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2023Failure to validate addresses provided by software to BIOS commands may result in a potential loss of integrity of guest memory in a confidential compute enviroCVE-2022-23814 · Other software · AMD · reported by psirt@amd.comMedium 5.3
Failure to validate addresses provided by software to BIOS commands may result in a potential loss of integrity of guest memory in a confidential compute environment.
- Product
- 3rd Gen EPYC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2023The software interfaces to ASP and SMU may not enforce the SNP memory security policy resulting in a potential loss of integrity of guest memory in a confidentiCVE-2022-23813 · Other software · AMD · reported by psirt@amd.comMedium 5.3
The software interfaces to ASP and SMU may not enforce the SNP memory security policy resulting in a potential loss of integrity of guest memory in a confidential compute environment.
- Product
- 2nd Gen EPYC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2023Insufficient validation of address mapping to IO in ASP (AMD Secure Processor) may result in a loss of memory integrity in the SNP guest.CVE-2021-26396 · Other software · AMD · reported by psirt@amd.comMedium 4.4
Insufficient validation of address mapping to IO in ASP (AMD Secure Processor) may result in a loss of memory integrity in the SNP guest.
- Product
- 3rd Gen EPYC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2023Failure to verify the mode of CPU execution at the time of SNP_INIT may lead to a potential loss of memory integrity for SNP guests.CVE-2021-26328 · Other software · AMD · reported by psirt@amd.comMedium 4.4
Failure to verify the mode of CPU execution at the time of SNP_INIT may lead to a potential loss of memory integrity for SNP guests.
- Product
- 3rd Gen EPYC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2023A vulnerability was found in lukehutch Gribbit.CVE-2014-125071 · Other software · lukehutch · reported by VulDBMedium 5.5
A vulnerability was found in lukehutch Gribbit. It has been classified as problematic. Affected is the function messageReceived of the file src/gribbit/request/HttpRequestHandler.java. The manipulation leads to missing origin validation in websockets. The name of the patch is 620418df247aebda3dd4be1dda10fe229ea505dd. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217716.
- Product
- Gribbit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2023A vulnerability was found in himiklab yii2-jqgrid-widget up to 1.0.7.CVE-2014-125051 · Other software · himiklab · reported by VulDBMedium 5.5
A vulnerability was found in himiklab yii2-jqgrid-widget up to 1.0.7. It has been declared as critical. This vulnerability affects the function addSearchOptionsRecursively of the file JqGridAction.php. The manipulation leads to sql injection. Upgrading to version 1.0.8 is able to address this issue. The name of the patch is a117e0f2df729e3ff726968794d9a5ac40e660b9. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-217564.
- Product
- yii2-jqgrid-widget
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2022Emerson DeltaV Distributed Control System (DCS) has insufficient verification of firmware integrity (an inadequate checksum approach, and no signature).CVE-2022-30260 · Other software · Emerson · reported by MITREHigh 7.8
Emerson DeltaV Distributed Control System (DCS) has insufficient verification of firmware integrity (an inadequate checksum approach, and no signature). This affects versions before 14.3 of DeltaV M-series, DeltaV S-series, DeltaV P-series, DeltaV SIS, and DeltaV CIOC/EIOC/WIOC IO cards.
- Product
- Deltav Distributed Control System SQ Controller Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2022Certain General Electric Renewable Energy products download firmware without an integrity check.CVE-2022-24117 · Other software · GE · reported by MITRECritical 9.8
Certain General Electric Renewable Energy products download firmware without an integrity check. This affects iNET and iNET II before 8.3.0, SD before 6.4.7, TD220X before 2.0.16, and TD220MAX before 1.2.6.
- Product
- Inet 900 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2022When loading a script with Subresource Integrity, attackers with an injection capability could trigger the reuse of previously cached entries with incorrect, diCVE-2022-36315 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 4.3
When loading a script with Subresource Integrity, attackers with an injection capability could trigger the reuse of previously cached entries with incorrect, different integrity metadata. This vulnerability affects Firefox < 103.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Dec 19, 2022A vulnerability classified as critical was found in laravel-jqgrid.CVE-2021-4262 · Other software · unspecified · reported by VulDBMedium 5.5
A vulnerability classified as critical was found in laravel-jqgrid. Affected by this vulnerability is the function getRows of the file src/Mgallegos/LaravelJqgrid/Repositories/EloquentRepositoryAbstract.php. The manipulation leads to sql injection. The name of the patch is fbc2d94f43d0dc772767a5bdb2681133036f935e. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216271.
- Product
- laravel-jqgrid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2022A vulnerability classified as problematic has been found in cgriego active_attr up to 0.15.2.CVE-2021-4250 · Other software · cgriego · reported by VulDBLow 3.5
A vulnerability classified as problematic has been found in cgriego active_attr up to 0.15.2. This affects the function call of the file lib/active_attr/typecasting/boolean_typecaster.rb of the component Regex Handler. The manipulation of the argument value leads to denial of service. The exploit has been disclosed to the public and may be used. Upgrading to version 0.15.3 is able to address this issue. The name of the patch is dab95e5843b01525444b82bd7b336ef1d79377df. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216207.
- Product
- active_attr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2022An authenticated attacker can impact the integrity of the ArubaOS bootloader on 7xxx series controllers.CVE-2022-37908 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comMedium 5.8
An authenticated attacker can impact the integrity of the ArubaOS bootloader on 7xxx series controllers. Successful exploitation can compromise the hardware chain of trust on the impacted controller.
- Product
- Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
Nov 29, 2022D-Link DNR-322L Download of Code Without Integrity Check VulnerabilityCVE-2022-40799 · Network & remote access · D-Link · reported by MITREExploitedHigh 8.8
D-Link DNR-322L contains a download of code without integrity check vulnerability that could allow an authenticated attacker to execute OS level commands on the device. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
- Product
- DNR-322L
- On CISA’s list since
- Aug 5, 2025 (federal fix deadline Aug 26, 2025)
- What to do
- Attackers are using this now. Install D-Link’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA cataloggitlab.comgitlab.com
Nov 25, 2022A specific file on the sERP server if Kyungrinara(ERP solution) has a fixed password with the SYSTEM authority.CVE-2022-41157 · Other software · Webcash Co.,Ltd · reported by vuln@krcert.or.krHigh 8.1
A specific file on the sERP server if Kyungrinara(ERP solution) has a fixed password with the SYSTEM authority. This vulnerability could allow attackers to leak or steal sensitive information or execute malicious commands.
- Product
- sERP Server 2.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkrcert.or.krkrcert.or.kr
Nov 14, 2022ProfileGrid: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2022-3578 · WordPress plugins & themes · reported by WPScanMedium 6.1
The ProfileGrid WordPress plugin before 5.1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
- Product
- ProfileGrid
- Fixed in
- 5.1.1
- What to do
- Update ProfileGrid to 5.1.1 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.