Updated 11 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

1,460 results · page 17 of 30

Nov 16, 2023An attacker is able to gain remote code execution on a server hosting the H2O dashboard through it's POJO model import feature.CVE-2023-6016 · Other software · h2oai · reported by security@huntr.devCritical 9.8
An attacker is able to gain remote code execution on a server hosting the H2O dashboard through it's POJO model import feature.
Product
h2oai/h2o-3
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record huntr.com huntr.com
Nov 9, 2023The CSV grade import method contained an XSS risk for users importing the spreadsheet, if it contained unsafe content.CVE-2023-5541 · Other software · Moodle · reported by patrick@puiterwijk.orgLow 3.3
The CSV grade import method contained an XSS risk for users importing the spreadsheet, if it contained unsafe content.
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.moodle.org bugzilla.redhat.com
Nov 7, 2023WordPress Comments Import & Export: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-45370 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Improper Neutralization of Formula Elements in a CSV File vulnerability in WebToffee WordPress Comments Import & Export.This issue affects WordPress Comments Import & Export: from n/a through 2.3.1.
Product
WordPress Comments Import & Export
Affected
up to 2.3.1
What to do
Affects up to 2.3.1. Update WordPress Comments Import & Export to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023Product Reviews Import Export for WooCommerce: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-46802 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Improper Neutralization of Formula Elements in a CSV File vulnerability in WebToffee Product Reviews Import Export for WooCommerce.This issue affects Product Reviews Import Export for WooCommerce: from n/a through 1.4.8.
Product
Product Reviews Import Export for WooCommerce
Affected
up to 1.4.8
What to do
Affects up to 1.4.8. Update Product Reviews Import Export for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023Allura Discussion and Allura Forum importing does not restrict URL values specified in attachments.CVE-2023-46851 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 4.9
Allura Discussion and Allura Forum importing does not restrict URL values specified in attachments. Project administrators can run these imports, which could cause Allura to read local files and expose them. Exposing internal files then can lead to other exploits, like session hijacking, or remote code execution. This issue affects Apache Allura from 1.0.1 through 1.15.0. Users are recommended to upgrade to version 1.16.0, which fixes the issue. If you are unable to upgrade, set "disable_entry_points.allura.importers = forge-tracker, forge-discussion" in your .ini config file.
Product
Apache Allura
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record allura.apache.org lists.apache.org
Nov 1, 2023Insecure temporary file creation in bitrix/modules/crm/lib/order/import/instagram.php in Bitrix24 22.0.300 hosted on Apache HTTP Server allows remote authenticaCVE-2023-1713 · Other software · Bitrix24 · reported by info@starlabs.sgHigh 8.8
Insecure temporary file creation in bitrix/modules/crm/lib/order/import/instagram.php in Bitrix24 22.0.300 hosted on Apache HTTP Server allows remote authenticated attackers to execute arbitrary code via uploading a crafted ".htaccess" file.
Product
Bitrix24
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record starlabs.sg starlabs.sg
Oct 25, 2023TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formPortFw.CVE-2023-46555 · Other software · totolink · reported by MITRECritical 9.8
TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formPortFw.
Product
x2000r_firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com totolink.cn
Oct 17, 2023D-Link Online behavior audit gateway DAR-7000 V31R02B1413C is vulnerable to SQL Injection via /importexport.php.CVE-2023-44693 · Network & remote access · d-link · reported by MITRECritical 9.8
D-Link Online behavior audit gateway DAR-7000 V31R02B1413C is vulnerable to SQL Injection via /importexport.php.
Product
dar-7000
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 16, 2023Weaver Xtreme Theme Support: Unserialises the content of an imported fileCVE-2023-4971 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Weaver Xtreme Theme Support WordPress plugin before 6.3.1 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import a malicious file and a suitable gadget chain is present on the blog.
Product
Weaver Xtreme Theme Support
Fixed in
6.3.1
What to do
Update Weaver Xtreme Theme Support to 6.3.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 9, 2023SAP PowerDesigner Client - version 16.7, does not sufficiently validate BPMN2 XML document imported from an untrusted source.CVE-2023-40310 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.5
SAP PowerDesigner Client - version 16.7, does not sufficiently validate BPMN2 XML document imported from an untrusted source. As a result, URLs of external entities in BPMN2 file, although not used, would be accessed during import. A successful attack could impact availability of SAP PowerDesigner Client.
Product
SAP PowerDesigner Client
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record me.sap.com sap.com
Oct 6, 2023In NASA Open MCT (aka openmct) before 3.1.0, prototype pollution can occur via an import action.CVE-2023-45282 · Other software · Nasa · reported by MITREHigh 7.5
In NASA Open MCT (aka openmct) before 3.1.0, prototype pollution can occur via an import action.
Product
Openmct
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 5, 2023A vulnerability classified as problematic has been found in WP Ultimate CSV Importer Plugin 3.7.2 on WordPress.CVE-2015-10125 · WordPress plugins & themes · reported by VulDBMedium 4.3
A vulnerability classified as problematic has been found in WP Ultimate CSV Importer Plugin 3.7.2 on WordPress. This affects an unknown part. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 3.7.3 is able to address this issue. The identifier of the patch is 13c30af721d3f989caac72dd0f56cf0dc40fad7e. It is recommended to upgrade the affected component. The identifier VDB-241317 was assigned to this vulnerability.
Fixed in
3.7.3
What to do
Update the plugin to 3.7.3 or newer.
Full record and what to do →NVD record github.com github.com
Oct 5, 2023Prixan prixanconnect up to v1.62 was discovered to contain a SQL injection vulnerability via the component CartsGuruCatalogModuleFrontController::importProductsCVE-2023-40920 · Other software · Prixan · reported by MITRECritical 9.8
Prixan prixanconnect up to v1.62 was discovered to contain a SQL injection vulnerability via the component CartsGuruCatalogModuleFrontController::importProducts().
Product
Prixanconnect
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.friendsofpresta.org security.friendsofpresta.org
Oct 3, 2023Cross-Site Request Forgery (CSRF) vulnerability in Meks Video Importer, Meks Time Ago, Meks ThemeForest Smart Widget, Meks Smart Author Widget, Meks Audio PlayeCVE-2023-25989 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Meks Video Importer, Meks Time Ago, Meks ThemeForest Smart Widget, Meks Smart Author Widget, Meks Audio Player, Meks Easy Maps, Meks Easy Photo Feed Widget, Meks Simple Flickr Widget, Meks Easy Ads Widget, Meks Smart Social Widget plugins leading to dismiss or the popup.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 3, 2023Memory Corruption in HLOS while importing a cryptographic key into KeyMaster Trusted Application.CVE-2023-24850 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory Corruption in HLOS while importing a cryptographic key into KeyMaster Trusted Application.
Product
Snapdragon
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record qualcomm.com qualcomm.com
Sep 25, 2023Import XML and RSS Feeds: Contains a web shellCVE-2023-4521 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Import XML and RSS Feeds WordPress plugin before 2.1.5 contains a web shell, allowing unauthenticated attackers to perform RCE. The plugin/vendor was not compromised and the files are the result of running a PoC for a previously reported issue (https://wpscan.com/vulnerability/d4220025-2272-4d5f-9703-4b2ac4a51c42) and not deleting the created files when releasing the new version.
Product
Import XML and RSS Feeds
Fixed in
2.1.5
What to do
Update Import XML and RSS Feeds to 2.1.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 25, 2023Import XML and RSS Feeds: Does not filter file extensions for uploaded filesCVE-2023-4300 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Import XML and RSS Feeds WordPress plugin before 2.1.4 does not filter file extensions for uploaded files, allowing an attacker to upload a malicious PHP file, leading to Remote Code Execution.
Product
Import XML and RSS Feeds
Fixed in
2.1.4
What to do
Update Import XML and RSS Feeds to 2.1.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 20, 2023SimpleImportProduct Prestashop Module v6.2.9 was discovered to contain a SQL injection vulnerability via the key parameter at send.php.CVE-2023-39675 · Other software · Myprestamodules · reported by MITRECritical 9.8
SimpleImportProduct Prestashop Module v6.2.9 was discovered to contain a SQL injection vulnerability via the key parameter at send.php.
Product
Product Catalog (csv, Excel) Import
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.sorcery.ie sorcery.ie
Sep 20, 2023MyPrestaModules Prestashop Module v6.2.9 and UpdateProducts Prestashop Module v3.6.9 were discovered to contain a PHPInfo information disclosure vulnerability vCVE-2023-39677 · Other software · Myprestamodules · reported by MITREHigh 7.5
MyPrestaModules Prestashop Module v6.2.9 and UpdateProducts Prestashop Module v3.6.9 were discovered to contain a PHPInfo information disclosure vulnerability via send.php.
Product
Product Catalog (csv, Excel) Import
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.sorcery.ie myprestamodules.com
Sep 18, 2023Certain WithSecure products allow a remote crash of a scanning engine via processing of an import struct in a PE file.CVE-2023-42522 · Other software · Withsecure · reported by MITREHigh 7.5
Certain WithSecure products allow a remote crash of a scanning engine via processing of an import struct in a PE file. This affects WithSecure Client Security 15, WithSecure Server Security 15, WithSecure Email and Server Security 15, WithSecure Elements Endpoint Protection 17 and later, WithSecure Client Security for Mac 15, WithSecure Elements Endpoint Protection for Mac 17 and later, Linux Security 64 12.0 , Linux Protection 12.0, and WithSecure Atlant (formerly F-Secure Atlant) 1.0.35-1.
Product
Client Security
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record withsecure.com withsecure.com
Sep 13, 2023Important: Authentication Bypass CVE-2023-41081 The mod_jk component of Apache Tomcat Connectors in some circumstances, such as when a configuration included "CVE-2023-41081 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
Important: Authentication Bypass CVE-2023-41081 The mod_jk component of Apache Tomcat Connectors in some circumstances, such as when a configuration included "JkOptions +ForwardDirectories" but the configuration did not provide explicit mounts for all possible proxied requests, mod_jk would use an implicit mapping and map the request to the first defined worker. Such an implicit mapping could result in the unintended exposure of the status worker and/or bypass security constraints configured in httpd. As of JK 1.2.49, the implicit mapping functionality has been removed and all mappings must now be via explicit configuration. Only mod_jk is affected by this issue. The ISAPI redirector is not affected. This issue affects Apache Tomcat Connectors (mod_jk only): from 1.2.0 through 1.2.48. Users are recommended to upgrade to version 1.2.49, which fixes the issue. History 2023-09-13 Original advisory 2023-09-28 Updated summary
Product
Apache Tomcat Connectors
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com lists.apache.org
Sep 11, 2023In multiple locations, there is a possible way to import contacts belonging to other users due to a confused deputy.CVE-2023-35680 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In multiple locations, there is a possible way to import contacts belonging to other users due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record android.googlesource.com source.android.com
Sep 11, 2023In multiple files, there is a possible way to import a contact from another user due to a missing permission check.CVE-2023-35665 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In multiple files, there is a possible way to import a contact from another user due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record android.googlesource.com source.android.com
Sep 6, 2023A non Admin authenticated user could incorrectly create resources using the import charts feature, on Apache Superset up to and including 2.1.0.CVE-2023-27526 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 4.3
A non Admin authenticated user could incorrectly create resources using the import charts feature, on Apache Superset up to and including 2.1.0.
Product
Apache Superset
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org lists.apache.org
Sep 1, 2023SQL Injection vulnerability in Chamilo LMS v.1.11 thru v.1.11.20 allows a remote privileged attacker to obtain sensitive information via the import sessions funCVE-2023-39582 · Other software · Chamilo · reported by MITREMedium 4.9
SQL Injection vulnerability in Chamilo LMS v.1.11 thru v.1.11.20 allows a remote privileged attacker to obtain sensitive information via the import sessions functions.
Product
Chamilo LMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.chamilo.org support.chamilo.org
Aug 22, 2023 IBM Robotic Process Automation 21.0.0 through 21.0.7.1 and 23.0.0 through 23.0.1 is vulnerable to incorrect privilege assignment when importing users from an LCVE-2023-38734 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.6
IBM Robotic Process Automation 21.0.0 through 21.0.7.1 and 23.0.0 through 23.0.1 is vulnerable to incorrect privilege assignment when importing users from an LDAP directory. IBM X-Force ID: 262481.
Product
Robotic Process Automation
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com
Aug 7, 2023import-in-the-middle is a module loading interceptor specifically for ESM modules.CVE-2023-38704 · Other software · DataDog · reported by GitHubHigh 8.1
import-in-the-middle is a module loading interceptor specifically for ESM modules. The import-in-the-middle loader works by generating a wrapper module on the fly. The wrapper uses the module specifier to load the original module and add some wrapping code. Prior to version 1.4.2, it allows for remote code execution in cases where an application passes user-supplied input directly to the `import()` function. This vulnerability has been patched in import-in-the-middle version 1.4.2. Some workarounds are available. Do not pass any user-supplied input to `import()`. Instead, verify it against a set of allowed values. If using import-in-the-middle, directly or indirectly, and support for EcmaScript Modules is not needed, ensure that no options are set, either via command-line or the `NODE_OPTIONS` environment variable, that would enable loader hooks.
Product
import-in-the-middle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 3, 2023WP Ultimate CSV Importer: Remote Code ExecutionCVE-2023-4142 · WordPress plugins & themes · reported by WordfenceHigh 8
The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 7.9.8 via the '->cus1' parameter. This allows authenticated attackers with author-level permissions or above, if the administrator previously grants access in the plugin settings, to execute code on the server. The author resolved this vulnerability by removing the ability for authors and editors to import files, please note that this means remote code execution is still possible for site administrators, use the plugin with caution.
Product
WP Ultimate CSV Importer
Affected
up to 7.9.8
What to do
Affects up to 7.9.8. Update WP Ultimate CSV Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 3, 2023WP Ultimate CSV Importer: Remote Code ExecutionCVE-2023-4141 · WordPress plugins & themes · reported by WordfenceHigh 8
The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 7.9.8 via the '->cus2' parameter. This allows authenticated attackers with author-level permissions or above, if the administrator previously grants access in the plugin settings, to create a PHP file and execute code on the server. The author resolved this vulnerability by removing the ability for authors and editors to import files, please note that this means php file creation is still allowed for site administrators, use the plugin with caution.
Product
WP Ultimate CSV Importer
Affected
up to 7.9.8
What to do
Affects up to 7.9.8. Update WP Ultimate CSV Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 3, 2023WP Ultimate CSV Importer: Privilege escalationCVE-2023-4140 · WordPress plugins & themes · reported by WordfenceMedium 6.6
The WP Ultimate CSV Importer plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 7.9.8 due to insufficient restriction on the 'get_header_values' function. This makes it possible for authenticated attackers, with minimal permissions such as an author, if the administrator previously grants access in the plugin settings, to modify their user role by supplying the 'wp_capabilities->cus1' parameter.
Product
WP Ultimate CSV Importer
Affected
up to 7.9.8
What to do
Affects up to 7.9.8. Update WP Ultimate CSV Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 3, 2023WP Ultimate CSV Importer: Sensitive Information ExposureCVE-2023-4139 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Sensitive Information Exposure via Directory Listing due to missing restriction in export folder indexing in versions up to, and including, 7.9.8. This makes it possible for unauthenticated attackers to list and view exported files.
Product
WP Ultimate CSV Importer
Affected
up to 7.9.8
What to do
Affects up to 7.9.8. Update WP Ultimate CSV Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 3, 2023Path traversal vulnerability in Importing Mobile Device Data of Cybozu Remote Service 3.1.2 allows a remote authenticated attacker to cause a denial-of-service CVE-2022-26838 · Other software · Cybozu, Inc. · reported by vultures@jpcert.or.jpMedium 6.5
Path traversal vulnerability in Importing Mobile Device Data of Cybozu Remote Service 3.1.2 allows a remote authenticated attacker to cause a denial-of-service (DoS) condition.
Product
Cybozu Remote Service
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp kb.cybozu.support
Jul 17, 2023Export and Import Users and Customers: Unauthorized modification of dataCVE-2023-3459 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Export and Import Users and Customers plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'hf_update_customer' function called via an AJAX action in versions up to, and including, 2.4.1. This makes it possible for authenticated attackers, with shop manager-level permissions to change user passwords and potentially take over administrator accounts.
Product
Export and Import Users and Customers
Affected
up to 2.4.1
What to do
Affects up to 2.4.1. Update Export and Import Users and Customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 13, 2023Alaris Systems Manager does not perform input validation during the Device Import Function.CVE-2023-30564 · Other software · Becton Dickinson & Co · reported by cybersecurity@bd.comMedium 6.9
Alaris Systems Manager does not perform input validation during the Device Import Function.
Product
BD Alarisâ„¢ Systems Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bd.com bd.com
Jul 13, 2023A malicious file could be uploaded into a System Manager User Import Function resulting in a hijacked session.CVE-2023-30563 · Other software · Becton Dickinson & Co · reported by cybersecurity@bd.comHigh 8.2
A malicious file could be uploaded into a System Manager User Import Function resulting in a hijacked session.
Product
BD Alarisâ„¢ Systems Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bd.com bd.com
Jul 1, 2023Import / Export Customizer Settings: Cross-Site Request ForgeryCVE-2020-36737 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Import / Export Customizer Settings plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.3. This is due to missing or incorrect nonce validation on the astra_admin_errors() function. This makes it possible for unauthenticated attackers to display an import status via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Import / Export Customizer Settings
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Import / Export Customizer Settings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Jun 28, 2023A Buffer Overflow vulnerability in importshp plugin in LibreCAD 2.2.0 allows attackers to obtain sensitive information via a crafted DBF file.CVE-2023-30259 · Other software · Librecad · reported by MITREMedium 5.5
A Buffer Overflow vulnerability in importshp plugin in LibreCAD 2.2.0 allows attackers to obtain sensitive information via a crafted DBF file.
Product
Librecad
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 19, 2023Slider Revolution: Does not check for valid image files upon importCVE-2023-2359 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Slider Revolution WordPress plugin through 6.6.12 does not check for valid image files upon import, leading to an arbitrary file upload which may be escalated to Remote Code Execution in some server configurations.
Product
Slider Revolution
Affected
up to 6.6.12
What to do
Affects up to 6.6.12. Update Slider Revolution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 19, 2023Service workers could reveal script base URL due to dynamic `import()`.CVE-2023-32208 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 5.3
Service workers could reveal script base URL due to dynamic `import()`. This vulnerability affects Firefox < 113.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org security.gentoo.org
Jun 7, 2023 Before importing a project into Vuforia, a user could modify the “resourceDirectory” attribute in the appConfig.json file to be a different path.CVE-2023-29502 · Other software · PTC · reported by ics-cert@hq.dhs.govMedium 6.2
Before importing a project into Vuforia, a user could modify the “resourceDirectory” attribute in the appConfig.json file to be a different path.
Product
Vuforia Studio
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record https cisa.gov
Jun 6, 2023Ultimate GDPR & CCPA: Unauthenticated settings import and exportCVE-2021-4348 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Ultimate GDPR & CCPA plugin for WordPress is vulnerable to unauthenticated settings import and export via the export_settings & import_settings functions in versions up to, and including, 2.4. This makes it possible for unauthenticated attackers to change plugin settings and conduct attacks such as redirecting visitors to malicious sites.
Product
Ultimate GDPR & CCPA
Affected
up to 2.4
What to do
Affects up to 2.4. Update Ultimate GDPR & CCPA to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordfence.com
Jun 6, 2023An issue in D-Link DIR-842V2 v1.0.3 allows attackers to execute arbitrary commands via importing a crafted file.CVE-2023-33781 · Other software · Dlink · reported by MITREHigh 8.8
An issue in D-Link DIR-842V2 v1.0.3 allows attackers to execute arbitrary commands via importing a crafted file.
Product
Dir-842v2 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com dlink.com
Jun 6, 2023axTLS v2.1.5 was discovered to contain a heap buffer overflow in the bi_import function in axtls-code/crypto/bigint.c.CVE-2023-33613 · Other software · Axtls Project · reported by MITREMedium 5.5
axTLS v2.1.5 was discovered to contain a heap buffer overflow in the bi_import function in axtls-code/crypto/bigint.c. This vulnerability allows attackers to cause a Denial of Service (DoS) when parsing a private key.
Product
Axtls
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sourceforge.net sourceforge.net
Jun 4, 2023A vulnerability was found in Blogger Importer Plugin up to 0.5 on WordPress.CVE-2013-10027 · WordPress plugins & themes · reported by VulDBMedium 4.3
A vulnerability was found in Blogger Importer Plugin up to 0.5 on WordPress. It has been classified as problematic. Affected is the function start/restart of the file blogger-importer.php. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. Upgrading to version 0.6 is able to address this issue. The patch is identified as b83fa4f862b0f19a54cfee76060ec9c2e7f7ca70. It is recommended to upgrade the affected component. VDB-230658 is the identifier assigned to this vulnerability.
Product
Blogger Importer
Affected
up to 0.5
What to do
Affects up to 0.5. Update Blogger Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com vuldb.com
Jun 2, 2023When importing a SPKI RSA public key as ECDSA P-256, the key would be handled incorrectly causing the tab to crash.CVE-2023-25742 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.5
When importing a SPKI RSA public key as ECDSA P-256, the key would be handled incorrectly causing the tab to crash. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Jun 2, 2023It is identified a vulnerability of insufficient authentication in an important specific function of Status PowerBPM.CVE-2023-25780 · Other software · Status Internet Co.,Ltd. · reported by twcert@cert.org.twMedium 5.7
It is identified a vulnerability of insufficient authentication in an important specific function of Status PowerBPM. A LAN attacker with normal user privilege can exploit this vulnerability to modify substitute agent to arbitrary users, resulting in serious consequence.
Product
PowerBPM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record twcert.org.tw twcert.org.tw
May 30, 2023Autoptimize: Does not sanitise and escape the settings imported from a previous exportCVE-2023-2113 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Autoptimize WordPress plugin before 3.1.7 does not sanitise and escape the settings imported from a previous export, allowing high privileged users (such as an administrator) to inject arbitrary javascript into the admin panel, even when the unfiltered_html capability is disabled, such as in a multisite setup.
Product
Autoptimize
Fixed in
3.1.7
What to do
Update Autoptimize to 3.1.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 25, 2023Cross-Site Request Forgery (CSRF) vulnerability in Marty Thornley Import External Images plugin <= 1.4 versions.CVE-2022-46866 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Marty Thornley Import External Images plugin <= 1.4 versions.
Affected
up to 1.4
What to do
Affects up to 1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 22, 2023Cross-Site Request Forgery (CSRF) vulnerability in SecondLineThemes Auto YouTube Importer plugin <= 1.0.3 versions.CVE-2023-23797 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in SecondLineThemes Auto YouTube Importer plugin <= 1.0.3 versions.
Fixed in
1.0.4
What to do
Update the plugin to 1.0.4 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
May 18, 2023 Compiler removal of buffer clearing in sli_se_opaque_import_key in Silicon Labs Gecko Platform SDK v4.2.1 and earlier results in key material duplicatioCVE-2023-2481 · Other software · silabs.com · reported by product-security@silabs.comMedium 5.3
Compiler removal of buffer clearing in sli_se_opaque_import_key in Silicon Labs Gecko Platform SDK v4.2.1 and earlier results in key material duplication to RAM.
Product
Gecko Platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.silabs.com github.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.