Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,692 results · page 18 of 34
Sep 3, 2023In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privilegesCVE-2023-38452 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comHigh 7.8
In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges
- Product
- SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2023In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privilegesCVE-2023-38451 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comHigh 7.8
In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges
- Product
- SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2023In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privilegesCVE-2023-38450 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comHigh 7.8
In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges
- Product
- SC9832E/SC9863A/T606/T612/T616/T610/T618
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2023In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privilegesCVE-2023-38449 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comHigh 7.8
In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges
- Product
- SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2023In vowifiservice, there is a possible missing permission check.This could lead to local denial of service with no additional execution privilegesCVE-2023-38448 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 5.5
In vowifiservice, there is a possible missing permission check.This could lead to local denial of service with no additional execution privileges
- Product
- SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2023In vowifiservice, there is a possible missing permission check.This could lead to local denial of service with no additional execution privilegesCVE-2023-38447 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 5.5
In vowifiservice, there is a possible missing permission check.This could lead to local denial of service with no additional execution privileges
- Product
- SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2023In vowifiservice, there is a possible missing permission check.This could lead to local denial of service with no additional execution privilegesCVE-2023-38446 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 5.5
In vowifiservice, there is a possible missing permission check.This could lead to local denial of service with no additional execution privileges
- Product
- SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2023In vowifiservice, there is a possible missing permission check.This could lead to local denial of service with no additional execution privilegesCVE-2023-38445 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 5.5
In vowifiservice, there is a possible missing permission check.This could lead to local denial of service with no additional execution privileges
- Product
- SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2023In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privilegesCVE-2023-38444 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comHigh 7.8
In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges
- Product
- SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2023In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privilegesCVE-2023-38443 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comHigh 7.8
In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges
- Product
- SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2023In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privilegesCVE-2023-38442 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 5.5
In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges
- Product
- SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2023In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privilegesCVE-2023-38441 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 5.5
In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges
- Product
- SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2023In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privilegesCVE-2023-38440 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 5.5
In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges
- Product
- SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2023In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privilegesCVE-2023-38439 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 5.5
In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges
- Product
- SC9832E/SC9863A/T606/T612/T616/T610/T618
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2023In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privilegesCVE-2023-38438 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 5.5
In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges
- Product
- SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2023In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privilegesCVE-2023-38437 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 5.5
In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges
- Product
- SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2023In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privilegesCVE-2023-38436 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 5.5
In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges
- Product
- SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2023In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privilegesCVE-2023-33918 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 5.5
In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges
- Product
- SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2023In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privilegesCVE-2023-33917 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 5.5
In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges
- Product
- SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2023In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privilegesCVE-2023-33916 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 5.5
In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges
- Product
- SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2023An issue was discovered in function TIFFReadDirectory libtiff before 4.4.0 allows attackers to cause a denial of service via crafted TIFF file.CVE-2022-40090 · Other software · Libtiff · reported by MITREMedium 6.5
An issue was discovered in function TIFFReadDirectory libtiff before 4.4.0 allows attackers to cause a denial of service via crafted TIFF file.
- Product
- Libtiff
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2023File Upload vulnerability in BoidCMS v.2.0.0 allows a remote attacker to execute arbitrary code by adding a GIF header to bypass MIME type checks.CVE-2023-38836 · Other software · Boidcms · reported by MITREHigh 8.8
File Upload vulnerability in BoidCMS v.2.0.0 allows a remote attacker to execute arbitrary code by adding a GIF header to bypass MIME type checks.
- Product
- Boidcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Aug 16, 2023WP Remote Users Sync: Unauthorized access of data and addition of dataCVE-2023-4374 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Remote Users Sync plugin for WordPress is vulnerable to unauthorized access of data and addition of data due to a missing capability check on the 'refresh_logs_async' functions in versions up to, and including, 1.2.11. This makes it possible for authenticated attackers with subscriber privileges or above, to view logs.
- Product
- WP Remote Users Sync
- Affected
- up to 1.2.11
- What to do
- Affects up to 1.2.11. Update WP Remote Users Sync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 15, 2023A missing authorization check allows an arbitrary authenticated user to perform certain operations through the API of CLA-assistant by executing specific additiCVE-2023-39438 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 8.1
A missing authorization check allows an arbitrary authenticated user to perform certain operations through the API of CLA-assistant by executing specific additional steps. This allows an arbitrary authenticated user to read CLA information including information of the persons who signed them as well as custom fields the CLA requester had configured. In addition, an arbitrary authenticated user can update or delete the CLA-configuration for repositories or organizations using CLA-assistant. The stored access tokens for GitHub are not affected, as these are redacted from the API-responses.
- Product
- CLA Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 15, 2023SQL Injection vulnerability in eVotingSystem-PHP v.1.0 allows a remote attacker to execute arbitrary code and obtain sensitive information via the user input fiCVE-2023-38916 · Other software · Mohammad-ajazuddin · reported by MITREHigh 8.8
SQL Injection vulnerability in eVotingSystem-PHP v.1.0 allows a remote attacker to execute arbitrary code and obtain sensitive information via the user input fields.
- Product
- Evotingsystem-php
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2023When adding a remote backup location, an authenticated user can pass arbitrary OS commands through the username field.CVE-2023-3267 · Other software · CyberPower · reported by trellixpsirt@trellix.comCritical 9.1
When adding a remote backup location, an authenticated user can pass arbitrary OS commands through the username field. The username is passed without sanitization into CMD running as NT/Authority System. An authenticated attacker can leverage this vulnerability to execute arbitrary code with system-level access to the CyberPower PowerPanel Enterprise server.
- Product
- PowerPanel Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtrellix.comtrellix.com
Aug 7, 2023A use-after-free flaw was found in the Linux kernel’s Netfilter functionality when adding a rule with NFTA_RULE_CHAIN_ID.CVE-2023-4147 · Other software · Red Hat · reported by Red HatHigh 7.8
A use-after-free flaw was found in the Linux kernel’s Netfilter functionality when adding a rule with NFTA_RULE_CHAIN_ID. This flaw allows a local user to crash or escalate their privileges on the system.
- Product
- Red Hat Enterprise Linux 9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Aug 6, 2023In Contacts service, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privilegesCVE-2023-33912 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 5.5
In Contacts service, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges
- Product
- SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2023In vowifi service, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privilegesCVE-2023-33911 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 5.5
In vowifi service, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges
- Product
- SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2023In Contacts Service, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privilegesCVE-2023-33910 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 5.5
In Contacts Service, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges
- Product
- SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2023In Contacts service, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privilegesCVE-2023-33909 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 5.5
In Contacts service, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges
- Product
- SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2023In Contacts Service, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privilegesCVE-2023-33906 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 5.5
In Contacts Service, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges
- Product
- SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2023Cross Site Scripting (XSS) vulnerability in DuxCMS 2.1 allows remote attackers to run arbitrary code via the content, time, copyfrom parameters when adding or eCVE-2020-36763 · Other software · Duxcms Project · reported by MITREMedium 5.4
Cross Site Scripting (XSS) vulnerability in DuxCMS 2.1 allows remote attackers to run arbitrary code via the content, time, copyfrom parameters when adding or editing a post.
- Product
- Duxcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2023The issue was addressed with additional permissions checks.CVE-2023-38608 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
The issue was addressed with additional permissions checks. This issue is fixed in macOS Ventura 13.5. An app may be able to access user-sensitive data.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Jul 26, 2023A permissions issue was addressed with additional restrictions.CVE-2023-38602 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Monterey 12.6.8, macOS Ventura 13.5, macOS Big Sur 11.7.9. An app may be able to modify protected parts of the file system.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Jul 26, 2023A downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing restrictions.CVE-2023-36862 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
A downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing restrictions. This issue is fixed in macOS Ventura 13.5. An app may be able to determine a user’s current location.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Jul 22, 2023A vulnerability was found in Bug Finder Wedding Wonders 1.0.CVE-2023-3832 · Other software · Bug Finder · reported by VulDBLow 3.5
A vulnerability was found in Bug Finder Wedding Wonders 1.0. It has been classified as problematic. Affected is an unknown function of the file /user/ticket/create of the component Ticket Handler. The manipulation of the argument message leads to cross site scripting. It is possible to launch the attack remotely. VDB-235158 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Wedding Wonders
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2023Mattermost WelcomeBot plugin fails to to validate the membership status when inviting or adding users to channels allowing guest accounts to be added or invitedCVE-2023-3613 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comLow 3.5
Mattermost WelcomeBot plugin fails to to validate the membership status when inviting or adding users to channels allowing guest accounts to be added or invited to channels by default.
- Product
- Mattermost Plugins
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jul 12, 2023In getPendingIntentLaunchFlags of ActivityOptions.java, there is a possible elevation of privilege due to a confused deputy with no additional execution privileCVE-2023-20918 · Computers, phones & browsers · Google · reported by security@android.comCritical 9.8
In getPendingIntentLaunchFlags of ActivityOptions.java, there is a possible elevation of privilege due to a confused deputy with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comandroid.googlesource.com
Jul 10, 2023Improper Handling of Additional Special Element in GitHub repository squidex/squidex prior to 7.4.0.CVE-2023-3580 · Other software · squidex · reported by security@huntr.devMedium 4.3
Improper Handling of Additional Special Element in GitHub repository squidex/squidex prior to 7.4.0.
- Product
- squidex/squidex
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2023Improper Access Control leads to adding a high-privilege user affecting Elenos ETG150 FM transmitter running on version 3.12 by exploiting user's role within thCVE-2023-34672 · Other software · elenos · reported by MITREHigh 8.8
Improper Access Control leads to adding a high-privilege user affecting Elenos ETG150 FM transmitter running on version 3.12 by exploiting user's role within the admin profile. An attack could occur over the public Internet in some cases.
- Product
- etg150
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordstrik3r.gitbook.iostrik3r.gitbook.io
Jun 23, 2023This issue was addressed by adding additional SQLite logging restrictions.CVE-2023-32422 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
This issue was addressed by adding additional SQLite logging restrictions. This issue is fixed in iOS 16.5 and iPadOS 16.5, tvOS 16.5, macOS Ventura 13.4. An app may be able to bypass Privacy preferences.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Jun 23, 2023A permissions issue was addressed by removing vulnerable code and adding additional checks.CVE-2023-32363 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
A permissions issue was addressed by removing vulnerable code and adding additional checks. This issue is fixed in macOS Ventura 13.4. An app may be able to bypass Privacy preferences.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Jun 23, 2023The issue was addressed with additional permissions checks.CVE-2023-27940 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 6.3
The issue was addressed with additional permissions checks. This issue is fixed in iOS 15.7.6 and iPadOS 15.7.6, macOS Monterey 12.6.6, macOS Ventura 13.4. A sandboxed app may be able to observe system-wide network connections.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Jun 22, 2023Content on the groups page required additional sanitizing to prevent an XSS risk.CVE-2023-35131 · Other software · Moodle · reported by patrick@puiterwijk.orgMedium 6.1
Content on the groups page required additional sanitizing to prevent an XSS risk. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8 and 3.11 to 3.11.14.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comlists.fedoraproject.org
Jun 22, 2023When adding non-visible components to the UI in server side, content is sent to the browser in Vaadin 10.0.0 through 10.0.22, 11.0.0 through 14.10.0, 15.0.0 thrCVE-2023-25499 · Other software · vaadin · reported by security@vaadin.comMedium 5.7
When adding non-visible components to the UI in server side, content is sent to the browser in Vaadin 10.0.0 through 10.0.22, 11.0.0 through 14.10.0, 15.0.0 through 22.0.28, 23.0.0 through 23.3.12, 24.0.0 through 24.0.5 and 24.1.0.alpha1 to 24.1.0.beta1, resulting in potential information disclosure.
- Product
- vaadin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2023When adding an external mail account, processing of POP3 "capabilities" responses are not limited to plausible sizes.CVE-2023-26434 · Other software · OX Software GmbH · reported by security@open-xchange.comMedium 4.3
When adding an external mail account, processing of POP3 "capabilities" responses are not limited to plausible sizes. Attacker with access to a rogue POP3 service could trigger requests that lead to excessive resource usage and eventually service unavailability. We now limit accepted POP3 server response to reasonable length/size. No publicly available exploits are known.
- Product
- OX App Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jun 20, 2023When adding an external mail account, processing of IMAP "capabilities" responses are not limited to plausible sizes.CVE-2023-26433 · Other software · OX Software GmbH · reported by security@open-xchange.comMedium 4.3
When adding an external mail account, processing of IMAP "capabilities" responses are not limited to plausible sizes. Attacker with access to a rogue IMAP service could trigger requests that lead to excessive resource usage and eventually service unavailability. We now limit accepted IMAP server response to reasonable length/size. No publicly available exploits are known.
- Product
- OX App Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jun 20, 2023When adding an external mail account, processing of SMTP "capabilities" responses are not limited to plausible sizes.CVE-2023-26432 · Other software · OX Software GmbH · reported by security@open-xchange.comMedium 4.3
When adding an external mail account, processing of SMTP "capabilities" responses are not limited to plausible sizes. Attacker with access to a rogue SMTP service could trigger requests that lead to excessive resource usage and eventually service unavailability. We now limit accepted SMTP server response to reasonable length/size. No publicly available exploits are known.
- Product
- OX App Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jun 15, 2023In several methods of JobStore.java, uncaught exceptions in job map parsing could lead to local persistent denial of service with no additional execution privilCVE-2023-21137 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In several methods of JobStore.java, uncaught exceptions in job map parsing could lead to local persistent denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-246541702
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.