Updated 10 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

512new WordPress flaws this week

391,181entries in the database

2,235 results · page 19 of 45

Jun 7, 2023 Datalogics Library APDFLThe v18.0.4PlusP1e and prior contains a stack-based buffer overflow due to documents containing corrupted fonts, which could allow an aCVE-2023-1709 · Other software · Siemens · reported by ics-cert@hq.dhs.govHigh 7.8
Datalogics Library APDFLThe v18.0.4PlusP1e and prior contains a stack-based buffer overflow due to documents containing corrupted fonts, which could allow an attack that causes an unhandled crash during the rendering process.
Product
JT2Go
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert-portal.siemens.com cisa.gov
Jun 5, 2023The xml-rs crate before 0.8.14 for Rust and Crab allows a denial of service (panic) via an invalid <! token (such as <!DOCTYPEs/%<!A nesting) in an XML documentCVE-2023-34411 · Other software · XML Library Project · reported by MITREHigh 7.5
The xml-rs crate before 0.8.14 for Rust and Crab allows a denial of service (panic) via an invalid <! token (such as <!DOCTYPEs/%<!A nesting) in an XML document. The earliest affected version is 0.8.9.
Product
XML Library
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 2, 2023If temporary "one-time" permissions, such as the ability to use the Camera, were granted to a document loaded using a file: URL, that permission persisted in thCVE-2023-28161 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.8
If temporary "one-time" permissions, such as the ability to use the Camera, were granted to a document loaded using a file: URL, that permission persisted in that tab for all other documents loaded from a file: URL. This is potentially dangerous if the local files came from different sources, such as in a download directory. This vulnerability affects Firefox < 111.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Jun 2, 2023A duplicate `SystemPrincipal` object could be created when parsing a non-system html document via `DOMParser::ParseFromSafeString`.CVE-2023-23604 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.5
A duplicate `SystemPrincipal` object could be created when parsing a non-system html document via `DOMParser::ParseFromSafeString`. This could have lead to bypassing web security checks. This vulnerability affects Firefox < 109.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Jun 2, 2023Unrestricted Upload of File with Dangerous Type vulnerability in Mobatime web application (Documentary proof upload modules) allows a malicious user to Upload aCVE-2023-3032 · Other software · Mobatime · reported by vulnerability@ncsc.chHigh 8.1
Unrestricted Upload of File with Dangerous Type vulnerability in Mobatime web application (Documentary proof upload modules) allows a malicious user to Upload a Web Shell to a Web Server.This issue affects Mobatime web application: through 06.7.22.
Product
Mobatime web application
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record borelenzo.github.io borelenzo.github.io
May 31, 2023Multiple models of the Uniview IP Camera (e.g., IPC_G6103 B6103.16.10.B25.201218, IPC_G61, IPC21, IPC23, IPC32, IPC36, IPC62, and IPC_HCMN) offer an undocumenteCVE-2021-45039 · Other software · Uniview · reported by MITRECritical 9.8
Multiple models of the Uniview IP Camera (e.g., IPC_G6103 B6103.16.10.B25.201218, IPC_G61, IPC21, IPC23, IPC32, IPC36, IPC62, and IPC_HCMN) offer an undocumented UDP service on port 7788 that allows a remote unauthenticated attacker to overflow an internal buffer and achieve code execution. By using this buffer overflow, a remote attacker can start the telnetd service. This service has a hardcoded default username and password (root/123456). Although it has a restrictive shell, this can be easily bypassed via the built-in ECHO shell command.
Product
Camera Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ssd-disclosure.com uniview.com
May 25, 2023Improper access control in editor components of The Document Foundation LibreOffice allowed an attacker to craft a document that would cause external links to bCVE-2023-2255 · Other software · The Document Foundation · reported by security@documentfoundation.orgMedium 5.3
Improper access control in editor components of The Document Foundation LibreOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt. In the affected versions of LibreOffice documents that used "floating frames" linked to external files, would load the contents of those frames without prompting the user for permission to do so. This was inconsistent with the treatment of other linked content in LibreOffice. This issue affects: The Document Foundation LibreOffice 7.4 versions prior to 7.4.7; 7.5 versions prior to 7.5.3.
Product
LibreOffice
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.debian.org security.gentoo.org
May 25, 2023Improper Validation of Array Index vulnerability in the spreadsheet component of The Document Foundation LibreOffice allows an attacker to craft a spreadsheet dCVE-2023-0950 · Other software · The Document Foundation · reported by security@documentfoundation.orgHigh 7.8
Improper Validation of Array Index vulnerability in the spreadsheet component of The Document Foundation LibreOffice allows an attacker to craft a spreadsheet document that will cause an array index underflow when loaded. In the affected versions of LibreOffice certain malformed spreadsheet formulas, such as AGGREGATE, could be created with less parameters passed to the formula interpreter than it expected, leading to an array index underflow, in which case there is a risk that arbitrary code could be executed. This issue affects: The Document Foundation LibreOffice 7.4 versions prior to 7.4.6; 7.5 versions prior to 7.5.1.
Product
LibreOffice
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.debian.org security.gentoo.org
May 24, 2023The Dynamic Data Mapping module in Liferay Portal 7.4.3.67, and Liferay DXP 7.4 update 67 does not limit Document and Media files which can be downloaded from aCVE-2023-33948 · Other software · Liferay · reported by security@liferay.comMedium 5.3
The Dynamic Data Mapping module in Liferay Portal 7.4.3.67, and Liferay DXP 7.4 update 67 does not limit Document and Media files which can be downloaded from a Form, which allows remote attackers to download any file from Document and Media via a crafted URL.
Product
Portal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record liferay.dev liferay.dev
May 18, 2023OpenText Documentum Content Server before 23.2 has a flaw that allows for privilege escalation from a non-privileged Documentum user to root.CVE-2023-31871 · Other software · Opentext · reported by MITREHigh 7.8
OpenText Documentum Content Server before 23.2 has a flaw that allows for privilege escalation from a non-privileged Documentum user to root. The software comes prepackaged with a root owned SUID binary dm_secure_writer. The binary has security controls in place preventing creation of a file in a non-owned directory, or as the root user. However, these controls can be carefully bypassed to allow for an arbitrary file write as root.
Product
Documentum Content Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com gist.github.com
May 11, 2023LuaTeX before 1.17.0 allows a document (compiled with the default settings) to make arbitrary network requests.CVE-2023-32668 · Other software · Luatex Project · reported by MITREMedium 5.5
LuaTeX before 1.17.0 allows a document (compiled with the default settings) to make arbitrary network requests. This occurs because full access to the socket library is permitted by default, as stated in the documentation. This also affects TeX Live before 2023 r66984 and MiKTeX before 23.5.
Product
Luatex
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gitlab.lisn.upsaclay.fr gitlab.lisn.upsaclay.fr
May 10, 2023Shenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 allows unauthenticated remote code execution via an XML document.CVE-2023-30353 · Network & remote access · Tenda · reported by MITRECritical 9.8
Shenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 allows unauthenticated remote code execution via an XML document.
Product
Cp3 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
May 2, 2023Design documents with matching document IDs, from databases on the same cluster, may share a mutable Javascript environment when using these design document funCVE-2023-26268 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 4.4
Design documents with matching document IDs, from databases on the same cluster, may share a mutable Javascript environment when using these design document functions: * validate_doc_update * list * filter * filter views (using view functions as filters) * rewrite * update This doesn't affect map/reduce or search (Dreyfus) index functions. Users are recommended to upgrade to a version that is no longer affected by this issue (Apache CouchDB 3.3.2 or 3.2.3). Workaround: Avoid using design documents from untrusted sources which may attempt to cache or store data in the Javascript environment.
Product
Apache CouchDB
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.couchdb.org lists.apache.org
Apr 25, 2023An XXE issue was discovered in Nokia NetAct before 22 FP2211 via an XML document to a Performance Manager page.CVE-2023-26058 · Other software · Nokia · reported by MITREMedium 6.5
An XXE issue was discovered in Nokia NetAct before 22 FP2211 via an XML document to a Performance Manager page. Input validation and a proper XML parser configuration are missing. For an external attacker, it is very difficult to exploit this, because a few dynamically created parameters such as Jsession-id, a CSRF token, and an Nxsrf token would be needed. The attack can realistically only be performed by an internal user.
Product
Netact
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nokia.com ptsecurity.com
Apr 25, 2023An XXE issue was discovered in Nokia NetAct before 22 FP2211 via an XML document to the Configuration Dashboard page.CVE-2023-26057 · Other software · Nokia · reported by MITREMedium 6.5
An XXE issue was discovered in Nokia NetAct before 22 FP2211 via an XML document to the Configuration Dashboard page. Input validation and a proper XML parser configuration are missing. For an external attacker, it is very difficult to exploit this, because a few dynamically created parameters such as Jsession-id, a CSRF token, and an Nxsrf token would be needed. The attack can realistically only be performed by an internal user.
Product
Netact
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nokia.com ptsecurity.com
Apr 25, 2023An issue was discovered in the Open Document feature in Telindus Apsal 3.14.2022.235 b.CVE-2023-26098 · Other software · Telindus · reported by MITREHigh 8.2
An issue was discovered in the Open Document feature in Telindus Apsal 3.14.2022.235 b. An attacker may upload a crafted file to execute arbitrary code.
Product
Apsal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cds.thalesgroup.com excellium-services.com
Apr 13, 2023KYOCERA Mobile Print' v3.2.0.230119 and earlier, 'UTAX/TA MobilePrint' v3.2.0.230119 and earlier, and 'Olivetti Mobile Print' v3.2.0.230119 and earlier are vulnCVE-2023-25954 · Other software · Kyocera Document Solutions, TA Triumph-Adler GmbH, and Olivetti SpA · reported by vultures@jpcert.or.jpMedium 5.5
KYOCERA Mobile Print' v3.2.0.230119 and earlier, 'UTAX/TA MobilePrint' v3.2.0.230119 and earlier, and 'Olivetti Mobile Print' v3.2.0.230119 and earlier are vulnerable to improper intent handling. When a malicious app is installed on the victim user's Android device, the app may send an intent and direct the affected app to download malicious files or apps to the device without notification.
Product
KYOCERA Mobile Print, UTAX/TA MobilePrint, and Olivetti Mobile Print
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp play.google.com
Apr 6, 2023SQL injection vulnerability found in Tailor Management System v.1 allows a remote attacker to execute arbitrary code via the detail parameter of the document.phCVE-2020-36073 · Other software · Tailor Management System Project · reported by MITREHigh 8.8
SQL injection vulnerability found in Tailor Management System v.1 allows a remote attacker to execute arbitrary code via the detail parameter of the document.php page.
Product
Tailor Management System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 5, 2023A use-after-free vulnerability exists within the way Ichitaro Word Processor 2022, version 1.0.1.57600, processes protected documents.CVE-2022-43664 · Other software · Ichitaro · reported by talos-cna@cisco.comHigh 7.8
A use-after-free vulnerability exists within the way Ichitaro Word Processor 2022, version 1.0.1.57600, processes protected documents. A specially crafted document can trigger reuse of freed memory, which can lead to further memory corruption and potentially result in arbitrary code execution. An attacker can provide a malicious document to trigger this vulnerability.
Product
Ichitaro
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp talosintelligence.com
Mar 31, 2023Nextcloud richdocuments is a Nextcloud app integrating the office suit Collabora Online.CVE-2023-28645 · Other software · nextcloud · reported by GitHubMedium 5.7
Nextcloud richdocuments is a Nextcloud app integrating the office suit Collabora Online. In affected versions the secure view feature of the rich documents app can be bypassed by using unprotected internal API endpoint of the rich documents app. It is recommended that the Nextcloud Office app (richdocuments) is upgraded to 8.0.0-beta.1, 7.0.2 or 6.3.2. Users unable to upgrade may mitigate the issue by taking steps to restrict the ability to download documents. This includes ensuring that the `WOPI configuration` is configured to only serve documents between Nextcloud and Collabora. It is highly recommended to define the list of Collabora server IPs as the allow list within the Office admin settings of Nextcloud.
Product
security-advisories
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.nextcloud.com github.com
Mar 28, 2023The function X509_VERIFY_PARAM_add0_policy() is documented to implicitly enable the certificate policy check when doing certificate verification.CVE-2023-0466 · Websites & servers · OpenSSL · reported by openssl-security@openssl.orgMedium 5.3
The function X509_VERIFY_PARAM_add0_policy() is documented to implicitly enable the certificate policy check when doing certificate verification. However the implementation of the function does not enable the check which allows certificates with invalid or incorrect policies to pass the certificate verification. As suddenly enabling the policy check could break existing deployments it was decided to keep the existing behavior of the X509_VERIFY_PARAM_add0_policy() function. Instead the applications that require OpenSSL to perform certificate policy check need to use X509_VERIFY_PARAM_set1_policies() or explicitly enable the policy check by calling X509_VERIFY_PARAM_set_flags() with the X509_V_FLAG_POLICY_CHECK flag argument. Certificate policy checks are disabled by default in OpenSSL and are not commonly used by applications.
Product
OpenSSL
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com git.openssl.org
Mar 24, 2023Apache OpenOffice documents can contain links that call internal macros with arbitrary arguments.CVE-2022-47502 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.8
Apache OpenOffice documents can contain links that call internal macros with arbitrary arguments. Several URI Schemes are defined for this purpose. Links can be activated by clicks, or by automatic document events. The execution of such links must be subject to user approval. In the affected versions of OpenOffice, approval for certain links is not requested; when activated, such links could therefore result in arbitrary script execution.
Product
Apache OpenOffice
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com openwall.com
Mar 23, 2023Awsm Innovations Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Unrestricted Upload of File with Dangerous TypeCVE-2023-23707 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Unrestricted Upload of File with Dangerous Type vulnerability in Awsm Innovations Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files allows Stored XSS via upload of SVG and HTML files. This issue affects Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files plugin <= 2.7.1 versions.
Product
Awsm Innovations Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files
Affected
up to 2.7.1
What to do
Affects up to 2.7.1. Update Awsm Innovations Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 18, 2023ONLYOFFICE Docs through 7.3 on certain Linux distributions allows local users to gain privileges via a Trojan horse libgcc_s.so.1 in the current working directoCVE-2022-48422 · Other software · Onlyoffice · reported by MITREHigh 7.8
ONLYOFFICE Docs through 7.3 on certain Linux distributions allows local users to gain privileges via a Trojan horse libgcc_s.so.1 in the current working directory, which may be any directory in which an ONLYOFFICE document is located.
Product
Document Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forum.onlyoffice.com forum.onlyoffice.com
Mar 1, 2023Insufficient input sanitization in the documentation feature of Devolutions Server 2022.3.12 and earlier allows an authenticated attacker to perform an SQL InjeCVE-2023-0953 · Other software · Devolutions · reported by security@devolutions.netHigh 8.8
Insufficient input sanitization in the documentation feature of Devolutions Server 2022.3.12 and earlier allows an authenticated attacker to perform an SQL Injection, potentially resulting in unauthorized access to system resources.
Product
Devolutions Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record devolutions.net devolutions.net
Feb 21, 2023esdoc-publish-html-plugin is a plugin for the document maintenance software ESDoc.CVE-2021-32858 · Other software · esdoc · reported by GitHubMedium 6.1
esdoc-publish-html-plugin is a plugin for the document maintenance software ESDoc. TheHTML sanitizer in esdoc-publish-html-plugin 1.1.2 and prior can be bypassed which may lead to cross-site scripting (XSS) issues. There are no known patches for this issue.
Product
esdoc-publish-html-plugin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com securitylab.github.com
Feb 20, 2023No authorisation controls in the RestAPI documentation for Tribe29's Checkmk <= 2.1.0p13 and Checkmk <= 2.0.0p29 which may lead to unintended information discloCVE-2022-48318 · Other software · Tribe29 · reported by security@checkmk.comMedium 5.3
No authorisation controls in the RestAPI documentation for Tribe29's Checkmk <= 2.1.0p13 and Checkmk <= 2.0.0p29 which may lead to unintended information disclosure through automatically generated user specific tags within Rest API documentation.
Product
Checkmk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record checkmk.com checkmk.com
Feb 16, 2023In WAGO Unmanaged Switch (852-111/000-001) in firmware version 01 an undocumented configuration interface without authorization allows an remote attacker to reaCVE-2022-3843 · Other software · WAGO · reported by info@cert.vde.comCritical 9.1
In WAGO Unmanaged Switch (852-111/000-001) in firmware version 01 an undocumented configuration interface without authorization allows an remote attacker to read system information and configure a limited set of parameters.
Product
Unmanaged Switch 852-111/000-001
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.vde.com cert.vde.com
Feb 13, 2023Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform, and Nextcloud Office is a document collaboration app for the saCVE-2023-25159 · Other software · nextcloud · reported by GitHubLow 2.3
Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform, and Nextcloud Office is a document collaboration app for the same platform. Nextcloud Server 24.0.x prior to 24.0.8 and 25.0.x prior to 25.0.1, Nextcloud Enterprise Server 24.0.x prior to 24.0.8 and 25.0.x prior to 25.0.1, and Nextcloud Office (Richdocuments) App 6.x prior to 6.3.1 and 7.x prior to 7.0.1 have previews accessible without a watermark. The download should be hidden and the watermark should get applied. This issue is fixed in Nextcloud Server 25.0.1 and 24.0.8, Nextcloud Enterprise Server 25.0.1 and 24.0.8, and Nextcloud Office (Richdocuments) App 7.0.1 (for 25) and 6.3.1 (for 24). No known workarounds are available.
Product
security-advisories
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 8, 2023Nextcloud office/richdocuments is an office suit for the nextcloud server platform.CVE-2023-25150 · Other software · nextcloud · reported by GitHubMedium 5.8
Nextcloud office/richdocuments is an office suit for the nextcloud server platform. In affected versions the Collabora integration can be tricked to provide access to any file without proper permission validation. As a result any user with access to Collabora can obtain the content of other users files. It is recommended that the Nextcloud Office App (Collabora Integration) is updated to 7.0.2 (Nextcloud 25), 6.3.2 (Nextcloud 24), 5.0.10 (Nextcloud 23), 4.2.9 (Nextcloud 21-22), or 3.8.7 (Nextcloud 15-20). There are no known workarounds for this issue.
Product
security-advisories
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 7, 2023LogicalDOC Enterprise and Community Edition (CE) are vulnerable to a stored (persistent, or "Type II") cross-site scripting (XSS) condition in the document versCVE-2022-47418 · Other software · LogicalDOC · reported by cve@rapid7.comMedium 5.4
LogicalDOC Enterprise and Community Edition (CE) are vulnerable to a stored (persistent, or "Type II") cross-site scripting (XSS) condition in the document version comments.
Product
LogicalDOC Enterprise
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rapid7.com rapid7.com
Feb 7, 2023LogicalDOC Enterprise and Community Edition (CE) are vulnerable to a stored (persistent, or "Type II") cross-site scripting (XSS) condition in the document fileCVE-2022-47417 · Other software · LogicalDOC · reported by cve@rapid7.comMedium 5.4
LogicalDOC Enterprise and Community Edition (CE) are vulnerable to a stored (persistent, or "Type II") cross-site scripting (XSS) condition in the document file name.
Product
LogicalDOC Enterprise
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rapid7.com rapid7.com
Feb 7, 2023 If an attacker has access to the console for OpenKM (and is authenticated), a stored XSS vulnerability is reachable in the document "note" functionality.CVE-2022-47414 · Other software · OpenKM · reported by cve@rapid7.comMedium 5.4
If an attacker has access to the console for OpenKM (and is authenticated), a stored XSS vulnerability is reachable in the document "note" functionality.
Product
OpenKM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rapid7.com rapid7.com
Feb 7, 2023 Given a malicious document provided by an attacker, the OpenKM DMS is vulnerable to a stored (persistent, or "Type II") XSS condition.CVE-2022-47413 · Other software · OpenKM · reported by cve@rapid7.comMedium 5.4
Given a malicious document provided by an attacker, the OpenKM DMS is vulnerable to a stored (persistent, or "Type II") XSS condition.
Product
OpenKM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rapid7.com rapid7.com
Feb 7, 2023Given a malicious document provided by an attacker, the ONLYOFFICE Workspace DMS is vulnerable to a stored (persistent, or "Type II") cross-site scripting (XSS)CVE-2022-47412 · Other software · ONLYOFFICE · reported by cve@rapid7.comMedium 5.4
Given a malicious document provided by an attacker, the ONLYOFFICE Workspace DMS is vulnerable to a stored (persistent, or "Type II") cross-site scripting (XSS) condition.
Product
Workspace
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com rapid7.com
Feb 3, 2023WEPA Print Away does not verify that a user has authorization to access documents before generating print orders and associated release codes.CVE-2022-42909 · Other software · WEPA · reported by cve-coordination@incibe.esMedium 6.5
WEPA Print Away does not verify that a user has authorization to access documents before generating print orders and associated release codes. This could allow an attacker to generate print orders and release codes for documents they don´t own and print hem without authorization. In order to exploit this vulnerability, the user must have an account with wepanow.com or any of the institutions they serve, and be logged in.
Product
Wepa Print Away
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record enrique.wtf incibe-cert.es
Jan 26, 2023Modelina is a library for generating data models based on inputs such as AsyncAPI, OpenAPI, or JSON Schema documents.CVE-2023-23619 · Other software · asyncapi · reported by GitHubCritical 9.9
Modelina is a library for generating data models based on inputs such as AsyncAPI, OpenAPI, or JSON Schema documents. Versions prior to 1.0.0 are vulnerable to Code injection. This issue affects anyone who is using the default presets and/or does not handle the functionality themself. This issue has been partially mitigated in version 1.0.0, with the maintainer's GitHub Security Advisory (GHSA) noting "It is impossible to fully guard against this, because users have access to the original raw information. However, as of version 1, if you only access the constrained models, you will not encounter this issue. Further similar situations are NOT seen as a security issue, but intended behavior." The suggested workaround from the maintainers is "Fully custom presets that change the entire rendering process which can then escape the user input."
Product
modelina
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 12, 2023EXFO - BV-10 Performance Endpoint Unit Undocumented privileged user.CVE-2022-39185 · Other software · EXFO · reported by cna@cyber.gov.ilCritical 9.8
EXFO - BV-10 Performance Endpoint Unit Undocumented privileged user. Unit has an undocumented hard-coded privileged user.
Product
BV-10 Performance Endpoint Unit
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gov.il gov.il
Jan 9, 2023The ABAP Keyword Documentation of SAP NetWeaver Application Server - versions 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, for ABAP and ABAP Platform CVE-2023-0013 · Network & remote access · SAP · reported by cna@sap.comMedium 6.1
The ABAP Keyword Documentation of SAP NetWeaver Application Server - versions 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, for ABAP and ABAP Platform does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. On successful exploitation an attacker can cause limited impact on confidentiality and integrity of the application.
Product
NetWeaver AS for ABAP and ABAP Platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com sap.com
Dec 27, 2022Parsing malicious or large YAML documents can consume excessive amounts of CPU or memory.CVE-2022-3064 · Other software · gopkg.in/yaml.v2 · reported by security@golang.orgHigh 7.5
Parsing malicious or large YAML documents can consume excessive amounts of CPU or memory.
Product
gopkg.in/yaml.v2
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 25, 2022Planet eStream before 6.72.10.07 allows unauthenticated upload of arbitrary files: Choose a Video / Related Media or Upload Document.CVE-2022-45896 · Other software · Planetestream · reported by MITRECritical 9.8
Planet eStream before 6.72.10.07 allows unauthenticated upload of arbitrary files: Choose a Video / Related Media or Upload Document. Upload2.ashx can be used, or Ajax.asmx/ProcessUpload2. This leads to remote code execution.
Product
Planet Estream
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sec-consult.com sec-consult.com
Dec 23, 2022Typora through 1.3.8 allows XSS if a document containing an SVG element with an attacker-controlled onload attribute is exported and then used at a victim's oriCVE-2022-40011 · Other software · Typora · reported by MITREMedium 6.1
Typora through 1.3.8 allows XSS if a document containing an SVG element with an attacker-controlled onload attribute is exported and then used at a victim's origin.
Product
Typora
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com typora.io
Dec 22, 2022When receiving an HTML email that specified to load an <code>iframe</code> element from a remote location, a request to the remote document was sent.CVE-2022-3034 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 4.3
When receiving an HTML email that specified to load an <code>iframe</code> element from a remote location, a request to the remote document was sent. However, Thunderbird didn't display the document. This vulnerability affects Thunderbird < 102.2.1 and Thunderbird < 91.13.1.
Product
Thunderbird
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Dec 22, 2022When receiving an HTML email that contained an <code>iframe</code> element, which used a <code>srcdoc</code> attribute to define the inner HTML document, remoteCVE-2022-3032 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.5
When receiving an HTML email that contained an <code>iframe</code> element, which used a <code>srcdoc</code> attribute to define the inner HTML document, remote objects specified in the nested document, for example images or videos, were not blocked. Rather, the network was accessed, the objects were loaded and displayed. This vulnerability affects Thunderbird < 102.2.1 and Thunderbird < 91.13.1.
Product
Thunderbird
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Dec 22, 2022A cross-origin iframe referencing an XSLT document would inherit the parent domain's permissions (such as microphone or camera access).CVE-2022-38473 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.8
A cross-origin iframe referencing an XSLT document would inherit the parent domain's permissions (such as microphone or camera access). This vulnerability affects Thunderbird < 102.2, Thunderbird < 91.13, Firefox ESR < 91.13, Firefox ESR < 102.2, and Firefox < 104.
Product
Thunderbird
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Dec 22, 2022SVG <code><use></code> tags that referenced a same-origin document could have resulted in script execution if attacker input was sanitized via the HTML SaCVE-2022-34475 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.1
SVG <code><use></code> tags that referenced a same-origin document could have resulted in script execution if attacker input was sanitized via the HTML Sanitizer API. This would have required the attacker to reference a same-origin JavaScript file containing the script to be executed. This vulnerability affects Firefox < 102.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Dec 22, 2022Documents in deeply-nested cross-origin browsing contexts could have obtained permissions granted to the top-level origin, bypassing the existing prompt and wroCVE-2022-29909 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.8
Documents in deeply-nested cross-origin browsing contexts could have obtained permissions granted to the top-level origin, bypassing the existing prompt and wrongfully inheriting the top-level permissions. This vulnerability affects Thunderbird < 91.9, Firefox ESR < 91.9, and Firefox < 100.
Product
Thunderbird
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Dec 22, 2022If a document created a sandboxed iframe without <code>allow-scripts</code>, and subsequently appended an element to the iframe's document that e.g.CVE-2022-22759 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.6
If a document created a sandboxed iframe without <code>allow-scripts</code>, and subsequently appended an element to the iframe's document that e.g. had a JavaScript event handler - the event handler would have run despite the iframe's sandbox. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Dec 22, 2022By using XSL Transforms, a malicious webserver could have served a user an XSL document that would continue to execute JavaScript (within the bounds of the sameCVE-2022-22755 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.8
By using XSL Transforms, a malicious webserver could have served a user an XSL document that would continue to execute JavaScript (within the bounds of the same-origin policy) even after the tab was closed. This vulnerability affects Firefox < 97.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Dec 14, 2022Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri.CVE-2022-23516 · Other software · flavorjones · reported by GitHubHigh 7.5
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah >= 2.2.0, < 2.19.1 uses recursion for sanitizing CDATA sections, making it susceptible to stack exhaustion and raising a SystemStackError exception. This may lead to a denial of service through CPU resource consumption. This issue is patched in version 2.19.1. Users who are unable to upgrade may be able to mitigate this vulnerability by limiting the length of the strings that are sanitized.
Product
loofah
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com lists.debian.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.