Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,933 results · page 17 of 39
Mar 29, 2023In JetBrains IntelliJ IDEA before 2023.1 the NTLM hash could leak through an API method used in the IntelliJ IDEA built-in web server.CVE-2022-48433 · Other software · JetBrains · reported by cve@jetbrains.comMedium 6.1
In JetBrains IntelliJ IDEA before 2023.1 the NTLM hash could leak through an API method used in the IntelliJ IDEA built-in web server.
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
Mar 27, 2023The InputMethod module has a vulnerability of serialization/deserialization mismatch.CVE-2023-26547 · Other software · Huawei · reported by psirt@huawei.comHigh 7.8
The InputMethod module has a vulnerability of serialization/deserialization mismatch. Successful exploitation of this vulnerability may cause privilege escalation.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Mar 21, 2023An authenticated attacker can leverage an exposed resource.db() accessor method to smuggle Python method calls via a Jinja template, which can lead to code execCVE-2023-1306 · Other software · Rapid7 · reported by cve@rapid7.comHigh 8.8
An authenticated attacker can leverage an exposed resource.db() accessor method to smuggle Python method calls via a Jinja template, which can lead to code execution. This issue was resolved in the Managed and SaaS deployments on February 1, 2023, and in version 23.2.1 of the Self-Managed version of InsightCloudSec.
- Product
- InsightCloudSec
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.divvycloud.comnephosec.com
Mar 21, 2023An authenticated attacker can leverage an exposed getattr() method via a Jinja template to smuggle OS commands and perform other actions that are normally expecCVE-2023-1304 · Other software · Rapid7 · reported by cve@rapid7.comHigh 8.8
An authenticated attacker can leverage an exposed getattr() method via a Jinja template to smuggle OS commands and perform other actions that are normally expected to be private methods. This issue was resolved in the Managed and SaaS deployments on February 1, 2023, and in version 23.2.1 of the Self-Managed version of InsightCloudSec.
- Product
- InsightCloudSec
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.divvycloud.comnephosec.com
Mar 15, 2023Insecure Permissions vulnerability found in OpenGoofy Hippo4j v.1.4.3 allows attacker toescalate privileges via the AddUser method of the UserController functioCVE-2023-27095 · Other software · Opengoofy · reported by MITREMedium 6.5
Insecure Permissions vulnerability found in OpenGoofy Hippo4j v.1.4.3 allows attacker toescalate privileges via the AddUser method of the UserController function in Tenant Management module.
- Product
- Hippo4j
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2023An issue found in Ofcms v.1.1.4 allows a remote attacker to to escalate privileges via the respwd method in SysUserController.CVE-2023-24760 · Other software · Ofcms Project · reported by MITREHigh 8.8
An issue found in Ofcms v.1.1.4 allows a remote attacker to to escalate privileges via the respwd method in SysUserController.
- Product
- Ofcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2023HashiCorp Vault and Vault Enterprise’s approle auth method allowed any authenticated user with access to an approle destroy endpoint to destroy the secret ID ofCVE-2023-24999 · Other software · HashiCorp · reported by security@hashicorp.comMedium 4.4
HashiCorp Vault and Vault Enterprise’s approle auth method allowed any authenticated user with access to an approle destroy endpoint to destroy the secret ID of any other role by providing the secret ID accessor. This vulnerability is fixed in Vault 1.13.0, 1.12.4, 1.11.8, 1.10.11 and above.
- Product
- Vault
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.hashicorp.comsecurity.netapp.com
Mar 9, 2023All versions of the package node-bluetooth are vulnerable to Buffer Overflow via the findSerialPortChannel method due to improper user input length validation.CVE-2023-26110 · Other software · Node-bluetooth Project · reported by report@snyk.ioHigh 7.3
All versions of the package node-bluetooth are vulnerable to Buffer Overflow via the findSerialPortChannel method due to improper user input length validation.
- Product
- Node-bluetooth
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.snyk.iosecurity.snyk.io
Mar 9, 2023All versions of the package node-bluetooth-serial-port are vulnerable to Buffer Overflow via the findSerialPortChannel method due to improper user input length CVE-2023-26109 · Other software · Node-bluetooth-serial-port Project · reported by report@snyk.ioHigh 7.3
All versions of the package node-bluetooth-serial-port are vulnerable to Buffer Overflow via the findSerialPortChannel method due to improper user input length validation.
- Product
- Node-bluetooth-serial-port
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.snyk.iosecurity.snyk.io
Mar 8, 2023The ScalarMult and ScalarBaseMult methods of the P256 Curve may return an incorrect result if called with some specific unreduced scalars (a scalar larger than CVE-2023-24532 · Other software · Go standard library · reported by security@golang.orgMedium 5.3
The ScalarMult and ScalarBaseMult methods of the P256 Curve may return an incorrect result if called with some specific unreduced scalars (a scalar larger than the order of the curve). This does not impact usages of crypto/ecdsa or crypto/ecdh.
- Product
- crypto/internal/nistec
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2023The undo_mark_statuses_as_sensitive method in app/services/approve_appeal_service.rb in Mastodon 3.5.x before 3.5.3 does not use the server's representative accCVE-2022-48364 · Other software · Joinmastodon · reported by MITREMedium 4.3
The undo_mark_statuses_as_sensitive method in app/services/approve_appeal_service.rb in Mastodon 3.5.x before 3.5.3 does not use the server's representative account, resulting in moderator identity disclosure when a moderator approves the appeal of a user whose status update was marked as sensitive.
- Product
- Mastodon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2023Hyperium Hyper before 0.14.19 does not allow for customization of the max_header_list_size method in the H2 third-party software, allowing attackers to perform CVE-2022-31394 · Other software · Hyper · reported by MITREHigh 7.5
Hyperium Hyper before 0.14.19 does not allow for customization of the max_header_list_size method in the H2 third-party software, allowing attackers to perform HTTP2 attacks.
- Product
- Hyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 17, 2023An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank charactCVE-2023-24329 · Other software · Siemens · reported by MITREHigh 7.5
An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters.
- Product
- SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2023Priority Windows may allow Command Execution via SQL Injection using an unspecified method.CVE-2023-23459 · Other software · Priority · reported by cna@cyber.gov.ilCritical 9.1
Priority Windows may allow Command Execution via SQL Injection using an unspecified method.
- Product
- Priority for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2023Directory traversal vulnerability in phpcms 1.9.25 allows remote attackers to delete arbitrary files via unfiltered $file parameter to unlink method in include/CVE-2021-36425 · Websites & servers · Phpwcms · reported by MITREMedium 5.4
Directory traversal vulnerability in phpcms 1.9.25 allows remote attackers to delete arbitrary files via unfiltered $file parameter to unlink method in include/inc_act/act_ftptakeover.php file.
- Product
- Phpwcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 31, 2023Buffer Overflow Vulnerability in D-Link DIR-825 v1.33.0.44ebdd4-embedded and below allows attacker to execute arbitrary code via the GetConfig method to the /CPCVE-2022-47035 · Other software · Dlink · reported by MITRECritical 9.8
Buffer Overflow Vulnerability in D-Link DIR-825 v1.33.0.44ebdd4-embedded and below allows attacker to execute arbitrary code via the GetConfig method to the /CPE endpoint.
- Product
- Dir-825 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupportannouncement.us.dlink.comdlink.com
Jan 26, 2023Jenkins visualexpert Plugin 1.3 and earlier does not restrict the names of files in methods implementing form validation, allowing attackers with Item/ConfigureCVE-2023-24455 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
Jenkins visualexpert Plugin 1.3 and earlier does not restrict the names of files in methods implementing form validation, allowing attackers with Item/Configure permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.
- Product
- Jenkins visualexpert Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2023Jenkins PWauth Security Realm Plugin 0.4 and earlier does not restrict the names of files in methods implementing form validation, allowing attackers with OveraCVE-2023-24449 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
Jenkins PWauth Security Realm Plugin 0.4 and earlier does not restrict the names of files in methods implementing form validation, allowing attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.
- Product
- Jenkins PWauth Security Realm Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2023Versions of the package simple-git before 3.16.0 are vulnerable to Remote Code Execution (RCE) via the clone(), pull(), push() and listRemote() methods, due to CVE-2022-25860 · Other software · Simple-git Project · reported by report@snyk.ioHigh 8.1
Versions of the package simple-git before 3.16.0 are vulnerable to Remote Code Execution (RCE) via the clone(), pull(), push() and listRemote() methods, due to improper input sanitization. This vulnerability exists due to an incomplete fix of [CVE-2022-25912](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3112221).
- Product
- Simple-git
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2023All versions of the package smartctl are vulnerable to Command Injection via the info method due to improper input sanitization.CVE-2022-21810 · Other software · Smartctl Project · reported by report@snyk.ioHigh 7.4
All versions of the package smartctl are vulnerable to Command Injection via the info method due to improper input sanitization.
- Product
- Smartctl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecurity.snyk.io
Jan 16, 2023Conditional Payment Methods for WooCommerce: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-4547 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Conditional Payment Methods for WooCommerce WordPress plugin through 1.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by [high privilege users such as admin|users with a role as low as admin.
- Product
- Conditional Payment Methods for WooCommerce
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Conditional Payment Methods for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Dec 27, 2022Web Sockets do not execute any AuthenticateMethod methods which may be set, leading to a nil pointer dereference if the returned UserData pointer is assumed to CVE-2021-4236 · Other software · github.com/ecnepsnai/web · reported by security@golang.orgCritical 9.8
Web Sockets do not execute any AuthenticateMethod methods which may be set, leading to a nil pointer dereference if the returned UserData pointer is assumed to be non-nil, or authentication bypass. This issue only affects WebSockets with an AuthenticateMethod hook. Request handlers that do not explicitly use WebSockets are not vulnerable.
- Product
- github.com/ecnepsnai/web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2022Token validation methods are susceptible to a timing side-channel during HMAC comparison.CVE-2015-10004 · Other software · github.com/robbert229/jwt · reported by security@golang.orgHigh 7.5
Token validation methods are susceptible to a timing side-channel during HMAC comparison. With a large enough number of requests over a low latency connection, an attacker may use this to determine the expected HMAC.
- Product
- github.com/robbert229/jwt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2022The RemoteAddr and LocalAddr methods on the returned net.Conn may call themselves, leading to an infinite loop which will crash the program due to a stack overfCVE-2013-10005 · Other software · github.com/btcsuite/go-socks · reported by security@golang.orgHigh 7.5
The RemoteAddr and LocalAddr methods on the returned net.Conn may call themselves, leading to an infinite loop which will crash the program due to a stack overflow.
- Product
- github.com/btcsuite/go-socks
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2022Cross-Site Tracing occurs when a server will echo a request back via the Trace method, allowing an XSS attack to access to authorization headers and cookies inaCVE-2022-45411 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.1
Cross-Site Tracing occurs when a server will echo a request back via the Trace method, allowing an XSS attack to access to authorization headers and cookies inaccessible to JavaScript (such as cookies protected by HTTPOnly). To mitigate this attack, browsers placed limits on <code>fetch()</code> and XMLHttpRequest; however some webservers have implemented non-standard headers such as <code>X-Http-Method-Override</code> that override the HTTP method, and made this attack possible again. Thunderbird has applied the same mitigations to the use of this and similar headers. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107.
- Product
- Firefox ESR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Dec 22, 2022If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution, they could have achieved execution of attacker-controllCVE-2022-1802 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.8
If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution, they could have achieved execution of attacker-controlled JavaScript code in a privileged context. This vulnerability affects Firefox ESR < 91.9.1, Firefox < 100.0.2, Firefox for Android < 100.3.0, and Thunderbird < 91.9.1.
- Product
- Firefox ESR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Dec 21, 2022The package vm2 before 3.9.10 are vulnerable to Arbitrary Code Execution due to the usage of prototype lookup for the WeakMap.prototype.set method.CVE-2022-25893 · Other software · Vm2 Project · reported by report@snyk.ioCritical 9.8
The package vm2 before 3.9.10 are vulnerable to Arbitrary Code Execution due to the usage of prototype lookup for the WeakMap.prototype.set method. Exploiting this vulnerability leads to access to a host object and a sandbox compromise.
- Product
- Vm2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2022In GetResolvedMethod of entrypoint_utils-inl.h, there is a possible use after free due to a stale cache.CVE-2022-20502 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In GetResolvedMethod of entrypoint_utils-inl.h, there is a possible use after free due to a stale cache. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-222166527
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Dec 12, 2022Boa Web Server versions 0.94.13 through 0.94.14 fail to validate the correct security constraint on the HEAD HTTP method allowing everyone to bypass the Basic ACVE-2022-45956 · Other software · BOA · reported by MITREMedium 5.3
Boa Web Server versions 0.94.13 through 0.94.14 fail to validate the correct security constraint on the HEAD HTTP method allowing everyone to bypass the Basic Authorization mechanism.
- Product
- BOA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Nov 24, 2022Dangerous method exposed which can lead to RCE in qmpass/leadshop v1.4.15 allows an attacker to control the target host by calling any function in leadshop.php CVE-2022-4136 · Other software · qmpaas · reported by security@huntr.devCritical 9.8
Dangerous method exposed which can lead to RCE in qmpass/leadshop v1.4.15 allows an attacker to control the target host by calling any function in leadshop.php via the GET method.
- Product
- qmpaas/leadshop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 23, 2022Insecure method vulnerability in which allowed HTTP methods are disclosed.CVE-2022-38115 · Other software · SolarWinds · reported by psirt@solarwinds.comMedium 5.3
Insecure method vulnerability in which allowed HTTP methods are disclosed. E.g., OPTIONS, DELETE, TRACE, and PUT
- Product
- SolarWinds SEM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.solarwinds.comsolarwinds.com
Nov 9, 2022VMware Workspace ONE Assist prior to 22.10 contains a Broken Authentication Method vulnerability.CVE-2022-31686 · Other software · VMware · reported by security@vmware.comCritical 9.8
VMware Workspace ONE Assist prior to 22.10 contains a Broken Authentication Method vulnerability. A malicious actor with network access to Workspace ONE Assist may be able to obtain administrative access without the need to authenticate to the application.
- Product
- Workspace ONE Assist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 8, 2022In initializeFromParcelLocked of BaseBundle.java, there is a possible method arbitrary code execution due to a confused deputy.CVE-2022-20452 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In initializeFromParcelLocked of BaseBundle.java, there is a possible method arbitrary code execution due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-240138318
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Oct 31, 2022 Delta Electronics InfraSuite Device Master versions 00.00.01a and prior allow unauthenticated users to trigger the WriteConfiguration method, which could allowCVE-2022-41776 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 7.5
Delta Electronics InfraSuite Device Master versions 00.00.01a and prior allow unauthenticated users to trigger the WriteConfiguration method, which could allow an attacker to provide new values for user configuration files such as UserListInfo.xml. This could lead to the changing of administrative passwords.
- Product
- InfraSuite Device Master
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2022Feather-Sequalize cleanQuery method uses insecure recursive logic to filter unsupported keys from the query object.CVE-2022-29823 · Other software · Feather js · reported by csirt@divd.nlCritical 10
Feather-Sequalize cleanQuery method uses insecure recursive logic to filter unsupported keys from the query object. This results in a Remote Code Execution (RCE) with privileges of application.
- Product
- Feathers-Sequalize
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcsirt.divd.nlcsirt.divd.nl
Oct 17, 2022Passster: Stores the password inside a cookie named "passster" using base64 encoding methodCVE-2022-3206 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Passster WordPress plugin before 3.5.5.5.2 stores the password inside a cookie named "passster" using base64 encoding method which is easy to decode. This puts the password at risk in case the cookies get leaked.
- Product
- Passster
- Fixed in
- 3.5.5.5.2
- What to do
- Update Passster to 3.5.5.5.2 or newer.
Oct 12, 2022HashiCorp Vault and Vault Enterprise’s TLS certificate auth method did not initially load the optionally configured CRL issued by the role's CA into memory on sCVE-2022-41316 · Other software · Hashicorp · reported by MITREMedium 5.3
HashiCorp Vault and Vault Enterprise’s TLS certificate auth method did not initially load the optionally configured CRL issued by the role's CA into memory on startup, resulting in the revocation list not being checked if the CRL has not yet been retrieved. Fixed in 1.12.0, 1.11.4, 1.10.7, and 1.9.10.
- Product
- Vault
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.hashicorp.comdiscuss.hashicorp.com
Oct 11, 2022An issue in the fetch() method in the BasicProfile class of org.ini4j through version v0.5.4 allows attackers to cause a Denial of Service (DoS) via unspecifiedCVE-2022-41404 · Other software · Ini4j Project · reported by MITREHigh 7.5
An issue in the fetch() method in the BasicProfile class of org.ini4j through version v0.5.4 allows attackers to cause a Denial of Service (DoS) via unspecified vectors.
- Product
- Ini4j
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Oct 11, 2022SAP Customer Data Cloud (Gigya mobile app for Android) - version 7.4, uses encryption method which lacks proper diffusion and does not hide the patterns well.CVE-2022-41209 · Network & remote access · SAP SE · reported by cna@sap.comMedium 5.2
SAP Customer Data Cloud (Gigya mobile app for Android) - version 7.4, uses encryption method which lacks proper diffusion and does not hide the patterns well. This can lead to information disclosure. In certain scenarios, application might also be susceptible to replay attacks.
- Product
- SAP Customer Data Cloud (Gigya)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comsap.com
Oct 11, 2022In getInputMethodWindowVisibleHeight of InputMethodManagerService.java, there is a possible way to determine when another app is showing an IME due to a missingCVE-2022-20394 · Computers, phones & browsers · Google · reported by security@android.comMedium 5
In getInputMethodWindowVisibleHeight of InputMethodManagerService.java, there is a possible way to determine when another app is showing an IME due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-204906124
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Sep 28, 2022Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a "Use of GET Request Method With Sensitive Query Strings" issue for /cnr requests.CVE-2020-15338 · Network & remote access · Zyxel · reported by MITREMedium 5.3
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a "Use of GET Request Method With Sensitive Query Strings" issue for /cnr requests.
- Product
- Cloudcnm Secumanager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpierrekim.github.iozyxel.com
Sep 28, 2022Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a "Use of GET Request Method With Sensitive Query Strings" issue for /registerCpe requests.CVE-2020-15337 · Network & remote access · Zyxel · reported by MITREMedium 5.3
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a "Use of GET Request Method With Sensitive Query Strings" issue for /registerCpe requests.
- Product
- Cloudcnm Secumanager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpierrekim.github.iozyxel.com
Sep 23, 2022A information disclosure vulnerability exists in Rocket.Chat <v5 where the getUserMentionsByChannel meteor server method discloses messages from private channelCVE-2022-35249 · Other software · Rocket.chat · reported by support@hackerone.comMedium 4.3
A information disclosure vulnerability exists in Rocket.Chat <v5 where the getUserMentionsByChannel meteor server method discloses messages from private channels and direct messages regardless of the users access permission to the room.
- Product
- Rocket.chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comhackerone.com
Sep 23, 2022A information disclosure vulnerability exists in Rocket.chat <v5, <v4.8.2 and <v4.7.5 where the lack of ACL checks in the getRoomRoles Meteor method leak channeCVE-2022-35247 · Other software · Rocket.chat · reported by support@hackerone.comMedium 4.3
A information disclosure vulnerability exists in Rocket.chat <v5, <v4.8.2 and <v4.7.5 where the lack of ACL checks in the getRoomRoles Meteor method leak channel members with special roles to unauthorized clients.
- Product
- Rocket.chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comhackerone.com
Sep 23, 2022A NoSQL-Injection information disclosure vulnerability vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 in the getS3FileUrl Meteor server method thaCVE-2022-35246 · Other software · Rocket.chat · reported by support@hackerone.comMedium 4.3
A NoSQL-Injection information disclosure vulnerability vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 in the getS3FileUrl Meteor server method that can disclose arbitrary file upload URLs to users that should not be able to access.
- Product
- Rocket.chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comhackerone.com
Sep 23, 2022An information disclosure vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 since the getReadReceipts Meteor server method does not properly filter uCVE-2022-32228 · Other software · Rocket.chat · reported by support@hackerone.comMedium 4.3
An information disclosure vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 since the getReadReceipts Meteor server method does not properly filter user inputs that are passed to MongoDB queries, allowing $regex queries to enumerate arbitrary Message IDs.
- Product
- Rocket.chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comhackerone.com
Sep 23, 2022An improper access control vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 due to input data in the getUsersOfRoom Meteor server method is not typeCVE-2022-32226 · Other software · Rocket.chat · reported by support@hackerone.comMedium 4.3
An improper access control vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 due to input data in the getUsersOfRoom Meteor server method is not type validated, so that MongoDB query operator objects are accepted by the server, so that instead of a matching rid String a$regex query can be executed, bypassing the room access permission check for every but the first matching room.
- Product
- Rocket.chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comhackerone.com
Sep 23, 2022An information disclosure vulnerability exists in Rocket.Chat <v5 due to the getUserMentionsByChannel meteor server method discloses messages from private channCVE-2022-32220 · Other software · Rocket.chat · reported by support@hackerone.comMedium 6.5
An information disclosure vulnerability exists in Rocket.Chat <v5 due to the getUserMentionsByChannel meteor server method discloses messages from private channels and direct messages regardless of the users access permission to the room.
- Product
- Rocket.chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comhackerone.com
Sep 23, 2022An information disclosure vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 due to the actionLinkHandler method was found to allow Message ID EnumeraCVE-2022-32218 · Other software · Rocket.chat · reported by support@hackerone.comMedium 4.3
An information disclosure vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 due to the actionLinkHandler method was found to allow Message ID Enumeration with Regex MongoDB queries.
- Product
- Rocket.chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comhackerone.com
Sep 21, 2022In Keylime before 6.3.0, Revocation Notifier uses a fixed /tmp path for UNIX domain socket which can allow unprivileged users a method to prohibit keylime operaCVE-2022-23950 · Other software · Keylime · reported by patrick@puiterwijk.orgHigh 7.5
In Keylime before 6.3.0, Revocation Notifier uses a fixed /tmp path for UNIX domain socket which can allow unprivileged users a method to prohibit keylime operations.
- Product
- Keylime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.