Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,762 results · page 19 of 56
Oct 2, 2023A flaw exists in FlashArray Purity wherein under limited circumstances, an array administrator can alter the retention lock of a pgroup and disable pgroup SafeMCVE-2023-32572 · Other software · Pure Storage · reported by psirt@purestorage.comMedium 6.5
A flaw exists in FlashArray Purity wherein under limited circumstances, an array administrator can alter the retention lock of a pgroup and disable pgroup SafeMode protection.
- Product
- FlashArray Purity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2023A flaw exists in FlashArray Purity whereby an array administrator by configuring an external key manager can affect the availability of data on the system incluCVE-2023-28373 · Other software · Pure Storage · reported by psirt@purestorage.comMedium 4.4
A flaw exists in FlashArray Purity whereby an array administrator by configuring an external key manager can affect the availability of data on the system including snapshots protected by SafeMode.
- Product
- FlashArray Purity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.purestorage.comsupport.purestorage.com
Oct 2, 2023Cross-Site Request Forgery vulnerability, whose exploitation could allow an attacker to perform different actions on the platform as an administrator, simply byCVE-2023-4659 · Other software · Free5Gc · reported by cve-coordination@incibe.esCritical 9.8
Cross-Site Request Forgery vulnerability, whose exploitation could allow an attacker to perform different actions on the platform as an administrator, simply by changing the token value to "admin". It is also possible to perform POST, GET and DELETE requests without any token value. Therefore, an unprivileged remote user is able to create, delete and modify users within theapplication.
- Product
- Open5Gc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2023An attacker with standard privileges on macOS when requesting administrator privileges from the application can submit input which causes a buffer overflow resuCVE-2023-40307 · Network & remote access · SAP SE · reported by cna@sap.comMedium 6.3
An attacker with standard privileges on macOS when requesting administrator privileges from the application can submit input which causes a buffer overflow resulting in a crash of the application. This could make the application unavailable and allow reading or modification of data.
- Product
- SAP Privileges
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2023The `PaperCutNG Mobility Print` version 1.0.3512 application allows an unauthenticated attacker to perform a CSRF attack on an instance administrator to confiCVE-2023-2508 · Other software · PaperCut MF/NG · reported by help@fluidattacks.comMedium 5.3
The `PaperCutNG Mobility Print` version 1.0.3512 application allows an unauthenticated attacker to perform a CSRF attack on an instance administrator to configure the clients host (in the "configure printer discovery" section). This is possible because the application has no protections against CSRF attacks, like Anti-CSRF tokens, header origin validation, samesite cookies, etc.
- Product
- Mobility Print
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.compapercut.com
Sep 15, 2023A cross-site scripting (XSS) vulnerability in FileBrowser before v2.23.0 allows an authenticated attacker to escalate privileges to Administrator via user interCVE-2023-39612 · Other software · Filebrowser · reported by MITRECritical 9
A cross-site scripting (XSS) vulnerability in FileBrowser before v2.23.0 allows an authenticated attacker to escalate privileges to Administrator via user interaction with a crafted HTML file or URL.
- Product
- Filebrowser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfebin0x4e4a.wordpress.comgithub.com
Sep 14, 2023I-doit pro 25 and below and I-doit open 25 and below employ weak password requirements for Administrator account creation.CVE-2023-37756 · Other software · I-doit · reported by MITRECritical 9.8
I-doit pro 25 and below and I-doit open 25 and below employ weak password requirements for Administrator account creation. Attackers are able to easily guess users' passwords via a bruteforce attack.
- Product
- I-doit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2023i-doit pro 25 and below and I-doit open 25 and below are configured with insecure default administrator credentials, and there is no warning or prompt to ask usCVE-2023-37755 · Other software · I-doit · reported by MITRECritical 9.8
i-doit pro 25 and below and I-doit open 25 and below are configured with insecure default administrator credentials, and there is no warning or prompt to ask users to change the default password and account name. Unauthenticated attackers can exploit this vulnerability to obtain Administrator privileges, resulting in them being able to perform arbitrary system operations or cause a Denial of Service (DoS).
- Product
- I-doit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2023HKcms v2.3.0.230709 is vulnerable to Cross Site Scripting (XSS) allowing administrator cookies to be stolen.CVE-2023-40786 · Other software · Hkcms · reported by MITREMedium 5.4
HKcms v2.3.0.230709 is vulnerable to Cross Site Scripting (XSS) allowing administrator cookies to be stolen.
- Product
- Hkcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2023Zero Trust Administrators have the ability to disallow end users from disabling WARP on their devices.CVE-2023-3747 · Other software · Cloudflare · reported by cna@cloudflare.comMedium 5.5
Zero Trust Administrators have the ability to disallow end users from disabling WARP on their devices. Override codes can also be created by the Administrators to allow a device to temporarily be disconnected from WARP, however, due to lack of server side validation, an attacker with local access to the device, could extend the maximum allowed disconnected time of WARP client granted by an override code by changing the date & time on the local device where WARP is running.
- Product
- WARP Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevelopers.cloudflare.complay.google.com
Sep 5, 2023Tenda AC6 US_AC6V4.0RTL_V02.03.01.26_cn.bin allows attackers (who have the administrator password) to cause a denial of service (device crash) via a long stringCVE-2021-40546 · Network & remote access · tenda · reported by MITREMedium 4.9
Tenda AC6 US_AC6V4.0RTL_V02.03.01.26_cn.bin allows attackers (who have the administrator password) to cause a denial of service (device crash) via a long string in the wifiPwd_5G parameter to /goform/setWifi.
- Product
- ac6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2023Aruba AirWave before 8.0.7 allows XSS attacks agsinat an administrator.CVE-2015-1390 · Other software · HP · reported by MITREMedium 6.1
Aruba AirWave before 8.0.7 allows XSS attacks agsinat an administrator.
- Product
- Airwave
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
Sep 3, 2023 Farsight Tech Nordic AB ProVide version 14.5 - Multiple XSS vulnerabilities (CWE-79) can be exploited by a user with administrator privilege.CVE-2023-37222 · Other software · Farsight Tech Nordic · reported by cna@cyber.gov.ilMedium 4.8
Farsight Tech Nordic AB ProVide version 14.5 - Multiple XSS vulnerabilities (CWE-79) can be exploited by a user with administrator privilege.
- Product
- AB ProVide
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2023All Users Messenger: Does not prevent non-administrator users from deleting messages from the all-users messengerCVE-2023-4023 · WordPress plugins & themes · reported by WPScanMedium 4.3
The All Users Messenger WordPress plugin through 1.24 does not prevent non-administrator users from deleting messages from the all-users messenger.
- Product
- All Users Messenger
- Affected
- up to 1.24
- What to do
- Affects up to 1.24. Update All Users Messenger to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 29, 2023 An arbitrary file write vulnerability exists where an authenticated, remote attacker with administrator privileges could alter logging variables to overwrite aCVE-2023-3252 · Other software · Tenable · reported by vulnreport@tenable.comMedium 6.8
An arbitrary file write vulnerability exists where an authenticated, remote attacker with administrator privileges could alter logging variables to overwrite arbitrary files on the remote host with log data, which could lead to a denial of service condition.
- Product
- Nessus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Aug 29, 2023 A pass-back vulnerability exists where an authenticated, remote attacker with administrator privileges could uncover stored SMTP credentials within the Nessus CVE-2023-3251 · Other software · Tenable · reported by vulnreport@tenable.comMedium 4.1
A pass-back vulnerability exists where an authenticated, remote attacker with administrator privileges could uncover stored SMTP credentials within the Nessus application.This issue affects Nessus: before 10.6.0.
- Product
- Nessus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Aug 13, 2023Genesys Administrator Extension (GAX) before 9.0.105.15 is vulnerable to Cross Site Scripting (XSS) via the Business Structure page of the iWD plugin, aka GAX-1CVE-2023-23208 · Other software · Genesys · reported by MITREMedium 6.1
Genesys Administrator Extension (GAX) before 9.0.105.15 is vulnerable to Cross Site Scripting (XSS) via the Business Structure page of the iWD plugin, aka GAX-11261.
- Product
- Administrator Extension
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.genesys.comdocs.genesys.com
Aug 10, 2023A previously generated artifact by an administrator could be accessed by an attacker.CVE-2023-32561 · Network & remote access · Ivanti · reported by support@hackerone.comHigh 7.5
A previously generated artifact by an administrator could be accessed by an attacker. The contents of this artifact could lead to authentication bypass. Fixed in version 6.4.1.
- Product
- Avalanche
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforums.ivanti.comforums.ivanti.com
Aug 9, 2023An authenticated administrator can upload a SAML configuration file with the wrong format, with the application not checking the correct file format.CVE-2023-23903 · Other software · Nozomi Networks · reported by prodsec@nozominetworks.comMedium 6.9
An authenticated administrator can upload a SAML configuration file with the wrong format, with the application not checking the correct file format. Every subsequent application request will return an error. The whole application in rendered unusable until a console intervention.
- Product
- Guardian
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.nozominetworks.comsecurity.nozominetworks.com
Aug 3, 2023An issue in a hidden API in ZKTeco BioTime v8.5.5 allows unauthenticated attackers to arbitrarily reset the Administrator password via a crafted web request.CVE-2023-38949 · Other software · Zkteco · reported by MITREHigh 7.5
An issue in a hidden API in ZKTeco BioTime v8.5.5 allows unauthenticated attackers to arbitrarily reset the Administrator password via a crafted web request.
- Product
- Biotime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordclaroty.comclaroty.com
Aug 3, 2023A user is capable of assigning him/herself to arbitrary groups by reusing a POST request issued by an administrator.CVE-2023-37498 · Other software · HCL Software · reported by psirt@hcl.comHigh 8.1
A user is capable of assigning him/herself to arbitrary groups by reusing a POST request issued by an administrator. It is possible that an attacker could potentially escalate their privileges.
- Product
- HCL Unica Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Aug 3, 2023Fabasoft Cloud Enterprise Client 23.3.0.130 allows a user to escalate their privileges to local administrator.CVE-2023-32764 · Other software · fabasoft · reported by MITREHigh 7.8
Fabasoft Cloud Enterprise Client 23.3.0.130 allows a user to escalate their privileges to local administrator.
- Product
- cloud_enterprise_client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.supportservices.fabasoft.comcompass-security.com
Aug 3, 2023 Due to insufficient file permissions, unprivileged users could gain access to unencrypted administrator credentials allowing the configuration of the applicatiCVE-2023-21409 · Other software · Axis Communications AB · reported by product-security@axis.comHigh 8.4
Due to insufficient file permissions, unprivileged users could gain access to unencrypted administrator credentials allowing the configuration of the application.
- Product
- AXIS License Plate Verifier
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2023 A broken access control was found allowing for privileged escalation of the operator account to gain administrator privileges.CVE-2023-21407 · Other software · Axis Communications AB · reported by product-security@axis.comHigh 8.8
A broken access control was found allowing for privileged escalation of the operator account to gain administrator privileges.
- Product
- AXIS License Plate Verifier
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2023An issue in the delete function in the UserController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete the Administrator's role infoCVE-2023-38989 · Other software · Jeesite · reported by MITREMedium 4.3
An issue in the delete function in the UserController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete the Administrator's role information.
- Product
- Jeesite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2023A Cross-Site Request Forgery (CSRF) in the Admin portal of Cockpit CMS v2.5.2 allows attackers to execute arbitrary Administrator commands.CVE-2023-37650 · Other software · Agentejo · reported by MITREHigh 8.8
A Cross-Site Request Forgery (CSRF) in the Admin portal of Cockpit CMS v2.5.2 allows attackers to execute arbitrary Administrator commands.
- Product
- Cockpit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comghostccamm.com
Jul 19, 2023Privilege Escalation to root administrator (nsroot) CVE-2023-3467 · Network & remote access · Citrix · reported by secure@citrix.comHigh 8
Privilege Escalation to root administrator (nsroot)
- Product
- NetScaler ADC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.citrix.comsupport.citrix.com
Jul 12, 2023Exposure of sensitive information to an unauthorized actor vulnerability in SonicWall GMS and Analytics allows authenticated attacker to read administrator passCVE-2023-34134 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comMedium 6.5
Exposure of sensitive information to an unauthorized actor vulnerability in SonicWall GMS and Analytics allows authenticated attacker to read administrator password hash via a web service call. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.
- Product
- GMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.global.sonicwall.comsonicwall.com
Jul 12, 2023A vulnerability exists in Palo Alto Networks PAN-OS software that enables an authenticated administrator with the privilege to commit a specifically created conCVE-2023-38046 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comMedium 5.5
A vulnerability exists in Palo Alto Networks PAN-OS software that enables an authenticated administrator with the privilege to commit a specifically created configuration to read local files and resources from the system.
- Product
- PAN-OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.paloaltonetworks.comsecurity.paloaltonetworks.com
Jul 11, 2023An unauthenticated user could log into iSTAR Ultra, iSTAR Ultra LT, iSTAR Ultra G2, and iSTAR Edge G2 with administrator rights.CVE-2023-3127 · Other software · Sensormatic Electronics, a subsidiary of Johnson Controls, Inc. · reported by productsecurity@jci.comHigh 7.5
An unauthenticated user could log into iSTAR Ultra, iSTAR Ultra LT, iSTAR Ultra G2, and iSTAR Edge G2 with administrator rights.
- Product
- iSTAR Ultra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcisa.govjohnsoncontrols.com
Jul 10, 2023An authenticated administrator is allowed to remotely execute arbitrary shell commands via the API.CVE-2021-42081 · Other software · OSNEXUS · reported by csirt@divd.nlCritical 9.1
An authenticated administrator is allowed to remotely execute arbitrary shell commands via the API. POC http://<IP_ADDRESS>/qstorapi/storageSystemModify?storageSystem=&newName=quantastor&newDescription=;ls${IFS}-al&newLocation=4&newEnclosureLayoutId=5&newDnsServerList=;ls${IFS}-al&externalHostName=&newNTPServerList=;ls${IFS}-al
- Product
- QuantaStor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcsirt.divd.nlcsirt.divd.nl
Jul 10, 2023An authenticated administrator is able to prepare an alert that is able to execute an SSRF attack.CVE-2021-42079 · Other software · OSNEXUS · reported by csirt@divd.nlMedium 6.2
An authenticated administrator is able to prepare an alert that is able to execute an SSRF attack. This is exclusively with POST requests. POC Step 1: Prepare the SSRF with a request like this: GET /qstorapi/alertConfigSet?senderEmailAddress=a&smtpServerIpAddress=BURPCOLLABHOST&smtpServerPort=25&smtpUsername=a&smtpPassword=1&smtpAuthType=1&customerSupportEmailAddress=1&poolFreeSpaceWarningThreshold=1&poolFreeSpaceAlertThreshold=1&poolFreeSpaceCriticalAlertThreshold=1&pagerDutyServiceKey=1&slackWebhookUrl=http://<target>&enableAlertTypes&enableAlertTypes=1&disableAlertTypes=1&pauseAlertTypes=1&mattermostWebhookUrl=http://<TARGET> HTTP/1.1 Host: <HOSTNAME> Accept-Encoding: gzip, deflate Accept: */* Accept-Language: en User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Safari/537.36 Connection: close authorization: Basic <BASIC_AUTH_HASH> Content-Type: application/json Content-Length: 0 Step 2: Trigger this alert with this request GET /qstorapi/alertRaise?title=test&message=test&severity=1 HTTP/1.1 Host: <HOSTNAME> Accept-Encoding: gzip, deflate Accept: */* Accept-Language: en User-Agent: Mozilla/5.0 (Wi
- Product
- QuantaStor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcisrt.divd.nlcsirt.divd.nl
Jul 7, 2023A Cross-Site Scripting (XSS) vulnerability found in UniFi Network (Version 7.3.83 and earlier) allows a malicious actor with Site Administrator credentials to eCVE-2023-32000 · Network & remote access · Ubiquiti · reported by support@hackerone.comMedium 4.8
A Cross-Site Scripting (XSS) vulnerability found in UniFi Network (Version 7.3.83 and earlier) allows a malicious actor with Site Administrator credentials to escalate privileges by persuading an Administrator to visit a malicious web page.
- Product
- UniFi Network Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.ui.comcommunity.ui.com
Jul 6, 2023A Cross-Site Request Forgery (CSRF) in the component /public/admin/profile/update.html of YznCMS v1.1.0 allows attackers to arbitrarily change the AdministratorCVE-2023-37131 · Other software · Yzncms · reported by MITREMedium 6.5
A Cross-Site Request Forgery (CSRF) in the component /public/admin/profile/update.html of YznCMS v1.1.0 allows attackers to arbitrarily change the Administrator password via a crafted POST request.
- Product
- Yzncms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 5, 2023The websocket configuration endpoint of the Loxone Miniserver Go Gen.2 before 14.1.5.9 allows remote authenticated administrators to inject arbitrary OS commandCVE-2023-36622 · Other software · loxone · reported by MITREHigh 7.2
The websocket configuration endpoint of the Loxone Miniserver Go Gen.2 before 14.1.5.9 allows remote authenticated administrators to inject arbitrary OS commands via the timezone parameter.
- Product
- miniserver_go_gen_2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2023A backup file vulnerability found in UniFi applications (Version 7.3.83 and earlier) running on Linux operating systems allows application administrators to exeCVE-2023-28365 · Network & remote access · Ubiquiti Inc. · reported by support@hackerone.comCritical 9.1
A backup file vulnerability found in UniFi applications (Version 7.3.83 and earlier) running on Linux operating systems allows application administrators to execute malicious commands on the host device being restored.
- Product
- UniFi Network application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.ui.comcommunity.ui.com
Jun 27, 2023Cross Site Request Forgery (CSRF) vulnerability was discovered in CatfishCMS 4.8.63 that would allow attackers to obtain administrator permissions via /index.phCVE-2020-18409 · Other software · Catfishcms Project · reported by MITREMedium 6.8
Cross Site Request Forgery (CSRF) vulnerability was discovered in CatfishCMS 4.8.63 that would allow attackers to obtain administrator permissions via /index.php/admin/index/modifymanage.html.
- Product
- Catfishcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2023A stored cross site scripting (XSS) vulnerability in /index.php?admin-master-article-edit of Chaoji CMS v2.18 that allows attackers to obtain administrator privCVE-2020-18410 · Other software · Chaoji CMS Project · reported by MITREMedium 4.8
A stored cross site scripting (XSS) vulnerability in /index.php?admin-master-article-edit of Chaoji CMS v2.18 that allows attackers to obtain administrator privileges.
- Product
- Chaoji CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2023A Cross site request forgery (CSRF) vulnerability was discovered in FeiFeiCMS v4.1.190209, which allows attackers to create administrator accounts via /index.phCVE-2020-18418 · Other software · Feifeicms · reported by MITREHigh 8.8
A Cross site request forgery (CSRF) vulnerability was discovered in FeiFeiCMS v4.1.190209, which allows attackers to create administrator accounts via /index.php?s=Admin-Admin-Insert.
- Product
- Feifeicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2023An unauthenticated XML external entity injection (XXE) vulnerability exists in LXCA's Common Information Model (CIM) server that could result in read-only accesCVE-2023-3113 · Other software · Lenovo · reported by psirt@lenovo.comHigh 8.2
An unauthenticated XML external entity injection (XXE) vulnerability exists in LXCA's Common Information Model (CIM) server that could result in read-only access to specific files.
- Product
- Lenovo XClarity Administrator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lenovo.comsupport.lenovo.com
Jun 26, 2023A valid, authenticated LXCA user with elevated privileges may be able to delete folders in the LXCA filesystem through a specifically crafted web API call due tCVE-2023-34422 · Other software · Lenovo · reported by psirt@lenovo.comMedium 6.5
A valid, authenticated LXCA user with elevated privileges may be able to delete folders in the LXCA filesystem through a specifically crafted web API call due to insufficient input validation.
- Product
- Lenovo XClarity Administrator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lenovo.comsupport.lenovo.com
Jun 26, 2023A valid, authenticated LXCA user with elevated privileges may be able to replace filesystem data through a specifically crafted web API call due to insufficientCVE-2023-34421 · Other software · Lenovo · reported by psirt@lenovo.comMedium 6.5
A valid, authenticated LXCA user with elevated privileges may be able to replace filesystem data through a specifically crafted web API call due to insufficient input validation.
- Product
- Lenovo XClarity Administrator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lenovo.comsupport.lenovo.com
Jun 26, 2023A valid, authenticated LXCA user with elevated privileges may be able to execute command injections through crafted calls to a specific web API.CVE-2023-34420 · Other software · Lenovo · reported by psirt@lenovo.comHigh 7.2
A valid, authenticated LXCA user with elevated privileges may be able to execute command injections through crafted calls to a specific web API.
- Product
- Lenovo XClarity Administrator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lenovo.comsupport.lenovo.com
Jun 26, 2023A valid, authenticated LXCA user may be able to gain unauthorized access to events and other data stored in LXCA due to a SQL injection vulnerability in a speciCVE-2023-34418 · Other software · Lenovo · reported by psirt@lenovo.comHigh 8.1
A valid, authenticated LXCA user may be able to gain unauthorized access to events and other data stored in LXCA due to a SQL injection vulnerability in a specific web API.
- Product
- Lenovo XClarity Administrator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lenovo.comsupport.lenovo.com
Jun 23, 2023Yoga Class Registration System version 1.0 allows an administrator to execute commands on the server.CVE-2023-1722 · Other software · Yoga Class Registration System · reported by help@fluidattacks.comCritical 9.1
Yoga Class Registration System version 1.0 allows an administrator to execute commands on the server. This is possible because the application does not correctly validate the thumbnails of the classes uploaded by the administrators.
- Product
- Yoga Class Registration System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comsourcecodester.com
Jun 23, 2023Yoga Class Registration System version 1.0 allows an administrator to execute commands on the server.CVE-2023-1721 · Other software · Yoga Class Registration System · reported by help@fluidattacks.comCritical 9.1
Yoga Class Registration System version 1.0 allows an administrator to execute commands on the server. This is possible because the application does not correctly validate the thumbnails of the classes uploaded by the administrators.
- Product
- Yoga Class Registration System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comsourcecodester.com
Jun 23, 2023A permission issue in BigFix WebUI Insights site version 14 allows an authenticated, unprivileged operator to access an administrator page.CVE-2023-23344 · Other software · HCL Software · reported by psirt@hcl.comLow 3
A permission issue in BigFix WebUI Insights site version 14 allows an authenticated, unprivileged operator to access an administrator page.
- Product
- HCL BigFix WebUI Insights
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Jun 20, 2023Improper deletion of resource in the user management feature in Devolutions Server 2023.1.8 and earlier allows an administrator to view users vaults of deletedCVE-2023-2400 · Other software · Devolutions · reported by security@devolutions.netLow 2.7
Improper deletion of resource in the user management feature in Devolutions Server 2023.1.8 and earlier allows an administrator to view users vaults of deleted users via database access.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevolutions.netdevolutions.net
Jun 13, 2023 Rockwell Automation's FactoryTalk System Services uses a hard-coded cryptographic key to generate administrator cookies.CVE-2023-2637 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comHigh 7.3
Rockwell Automation's FactoryTalk System Services uses a hard-coded cryptographic key to generate administrator cookies. Hard-coded cryptographic key may lead to privilege escalation. This vulnerability may allow a local, authenticated non-admin user to generate an invalid administrator cookie giving them administrative privileges to the FactoryTalk Policy Manger database. This may allow the threat actor to make malicious changes to the database that will be deployed when a legitimate FactoryTalk Policy Manager user deploys a security policy model. User interaction is required for this vulnerability to be successfully exploited.
- Product
- FactoryTalk System Services
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.custhelp.comrockwellautomation.custhelp.com
Jun 5, 2023Incorrect Authorization vulnerability in Mobatime mobile application AMXGT100 allows a low-privileged user to impersonate anyone else, including administratorsTCVE-2023-3066 · Other software · Mobatime · reported by vulnerability@ncsc.chHigh 8.1
Incorrect Authorization vulnerability in Mobatime mobile application AMXGT100 allows a low-privileged user to impersonate anyone else, including administratorsThis issue affects Mobatime mobile application AMXGT100: through 1.3.20.
- Product
- Mobatime mobile application AMXGT100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordborelenzo.github.ioborelenzo.github.io
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.