Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,223 results · page 19 of 45
Jan 10, 2024The vulnerability allows an unauthenticated remote attacker to send malicious network requests containing arbitrary client-side script code and obtain its execuCVE-2023-48255 · Other software · Rexroth · reported by psirt@bosch.comMedium 6.3
The vulnerability allows an unauthenticated remote attacker to send malicious network requests containing arbitrary client-side script code and obtain its execution inside a victim’s session via a crafted URL, HTTP request, or simply by waiting for the victim to view the poisoned log.
- Product
- Nexo cordless nutrunner NXA015S-36V (0608842001)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.bosch.compsirt.bosch.com
Jan 10, 2024The vulnerability allows an authenticated remote attacker to perform actions exceeding their authorized access via crafted HTTP requests.CVE-2023-48252 · Other software · Rexroth · reported by psirt@bosch.comHigh 8.8
The vulnerability allows an authenticated remote attacker to perform actions exceeding their authorized access via crafted HTTP requests.
- Product
- Nexo cordless nutrunner NXA015S-36V (0608842001)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.bosch.compsirt.bosch.com
Jan 1, 2024affiliate-toolkit: Lacks authorization and authentication for requests to it's affiliate-toolkit-starter/tools/atkp_imagereceiverCVE-2023-5877 · WordPress plugins & themes · reported by WPScanCritical 9.8
The affiliate-toolkit WordPress plugin before 3.4.3 lacks authorization and authentication for requests to it's affiliate-toolkit-starter/tools/atkp_imagereceiver.php endpoint, allowing unauthenticated visitors to make requests to arbitrary URL's, including RFC1918 private addresses, leading to a Server Side Request Forgery (SSRF) issue.
- Product
- affiliate-toolkit
- Fixed in
- 3.4.3
- What to do
- Update affiliate-toolkit to 3.4.3 or newer.
Dec 29, 2023Sending specially crafted HTTP requests and inspector messages to Wrangler's dev server could result in any file on the user's computer being accessible over thCVE-2023-7079 · Other software · Cloudflare · reported by cna@cloudflare.comMedium 6.4
Sending specially crafted HTTP requests and inspector messages to Wrangler's dev server could result in any file on the user's computer being accessible over the local network. An attacker that could trick any user on the local network into opening a malicious website could also read any file.
- Product
- wrangler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2023Sending specially crafted HTTP requests to Miniflare's server could result in arbitrary HTTP and WebSocket requests being sent from the server.CVE-2023-7078 · Other software · Cloudflare · reported by cna@cloudflare.comHigh 7.5
Sending specially crafted HTTP requests to Miniflare's server could result in arbitrary HTTP and WebSocket requests being sent from the server. If Miniflare was configured to listen on external network interfaces (as was the default in wrangler until 3.19.0), an attacker on the local network could access other local servers.
- Product
- miniflare
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2023ReVanced API proxies requests needed to feed the ReVanced Manager and website with data.CVE-2023-52075 · Other software · ReVanced · reported by GitHubHigh 7.5
ReVanced API proxies requests needed to feed the ReVanced Manager and website with data. Up to and including commit 71f81f7f20cd26fd707335bca9838fa3e7df20d2, ReVanced API lacks error caching causing rate limit to be triggered thus increasing server load. This causes a denial of service for all users using the API. It is recommended to implement proper error caching.
- Product
- revanced-api
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2023A stored cross-site scripting (XSS) vulnerability in the component admin/AdminRequestSqlController.php of thirty bees before 1.5.0 allows attackers to execute aCVE-2023-45957 · Other software · Thirtybees · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in the component admin/AdminRequestSqlController.php of thirty bees before 1.5.0 allows attackers to execute arbitrary web script or HTML via $e->getMessage() error mishandling.
- Product
- Thirty Bees
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2023 A successful CSRF attack could force the user to perform state changing requests on the application.CVE-2023-6689 · Other software · EFACEC · reported by ics-cert@hq.dhs.govHigh 8.2
A successful CSRF attack could force the user to perform state changing requests on the application. If the victim is an administrative account, a CSRF attack could compromise the entire web application.
- Product
- BCU 500
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2023 Through the exploitation of active user sessions, an attacker could send custom requests to cause a denial-of-service condition on the device.CVE-2023-50707 · Other software · EFACEC · reported by ics-cert@hq.dhs.govCritical 9.6
Through the exploitation of active user sessions, an attacker could send custom requests to cause a denial-of-service condition on the device.
- Product
- BCU 500
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2023 An attacker could create malicious requests to obtain sensitive information about the web server.CVE-2023-50705 · Other software · EFACEC · reported by ics-cert@hq.dhs.govMedium 5.3
An attacker could create malicious requests to obtain sensitive information about the web server.
- Product
- UC 500E
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2023In some instances, the user-agent would allow push requests which lacked a valid VAPID even though the push manager subscription defined one.CVE-2023-6868 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 4.3
In some instances, the user-agent would allow push requests which lacked a valid VAPID even though the push manager subscription defined one. This could allow empty messages to be sent from unauthorized parties. *This bug only affects Firefox on Android.* This vulnerability affects Firefox < 121.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgsecurity.gentoo.org
Dec 11, 2023When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subsequent requests using that file unaware of the HSTS CVE-2023-46219 · Other software · curl · reported by support@hackerone.comMedium 5.3
When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subsequent requests using that file unaware of the HSTS status they should otherwise use.
- Product
- curl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2023`nuxt-api-party` is an open source module to proxy API requests.CVE-2023-49800 · Other software · johannschopplich · reported by GitHubHigh 7.5
`nuxt-api-party` is an open source module to proxy API requests. The library allows the user to send many options directly to `ofetch`. There is no filter on which options are available. We can abuse the retry logic to cause the server to crash from a stack overflow. fetchOptions are obtained directly from the request body. A malicious user can construct a URL known to not fetch successfully, then set the retry attempts to a high value, this will cause a stack overflow as ofetch error handling works recursively resulting in a denial of service. This issue has been addressed in version 0.22.1. Users are advised to upgrade. Users unable to upgrade should limit ofetch options.
- Product
- nuxt-api-party
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2023`nuxt-api-party` is an open source module to proxy API requests.CVE-2023-49799 · Other software · johannschopplich · reported by GitHubHigh 7.5
`nuxt-api-party` is an open source module to proxy API requests. nuxt-api-party attempts to check if the user has passed an absolute URL to prevent the aforementioned attack. This has been recently changed to use the regular expression `^https?://`, however this regular expression can be bypassed by an absolute URL with leading whitespace. For example `\nhttps://whatever.com` which has a leading newline. According to the fetch specification, before a fetch is made the URL is normalized. "To normalize a byte sequence potentialValue, remove any leading and trailing HTTP whitespace bytes from potentialValue.". This means the final request will be normalized to `https://whatever.com` bypassing the check and nuxt-api-party will send a request outside of the whitelist. This could allow us to leak credentials or perform Server-Side Request Forgery (SSRF). This vulnerability has been addressed in version 0.22.1. Users are advised to upgrade. Users unable to upgrade should revert to the previous method of detecting absolute URLs.
- Product
- nuxt-api-party
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfetch.spec.whatwg.orgfetch.spec.whatwg.org
Nov 28, 2023An authenticated malicious user could initiate multiple concurrent requests, each requesting multiple dashboard exports, leading to a possible denial of serviceCVE-2023-42504 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.8
An authenticated malicious user could initiate multiple concurrent requests, each requesting multiple dashboard exports, leading to a possible denial of service. This issue affects Apache Superset: before 3.0.0
- Product
- Apache Superset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comlists.apache.org
Nov 28, 2023A race condition in go-resty can result in HTTP request body disclosure across requests.CVE-2023-45286 · Other software · github.com/go-resty/resty/v2 · reported by security@golang.orgMedium 5.9
A race condition in go-resty can result in HTTP request body disclosure across requests. This condition can be triggered by calling sync.Pool.Put with the same *bytes.Buffer more than once, when request retries are enabled and a retry occurs. The call to sync.Pool.Get will then return a bytes.Buffer that hasn't had bytes.Buffer.Reset called on it. This dirty buffer will contain the HTTP request body from an unrelated request, and go-resty will append the current HTTP request body to it, sending two bodies in one request. The sync.Pool in question is defined at package level scope, so a completely unrelated server could receive the request body.
- Product
- github.com/go-resty/resty/v2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 28, 2023In Spring Boot versions 2.7.0 - 2.7.17, 3.0.0-3.0.12 and 3.1.0-3.1.5, it is possible for a user to provide specially crafted HTTP requests that may cause a deniCVE-2023-34055 · Other software · Spring · reported by security@vmware.comMedium 5.3
In Spring Boot versions 2.7.0 - 2.7.17, 3.0.0-3.0.12 and 3.1.0-3.1.5, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Specifically, an application is vulnerable when all of the following are true: * the application uses Spring MVC or Spring WebFlux * org.springframework.boot:spring-boot-actuator is on the classpath
- Product
- Spring Boot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.comspring.io
Nov 28, 2023In Spring Framework versions 6.0.0 - 6.0.13, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condiCVE-2023-34053 · Other software · Spring · reported by security@vmware.comMedium 5.3
In Spring Framework versions 6.0.0 - 6.0.13, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Specifically, an application is vulnerable when all of the following are true: * the application uses Spring MVC or Spring WebFlux * io.micrometer:micrometer-core is on the classpath * an ObservationRegistry is configured in the application to record observations Typically, Spring Boot applications need the org.springframework.boot:spring-boot-actuator dependency to meet all conditions.
- Product
- Spring Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.comspring.io
Nov 27, 2023WordPress Backup & Migration: Does not authorize some AJAX requestsCVE-2023-5737 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WordPress Backup & Migration WordPress plugin before 1.4.4 does not authorize some AJAX requests, allowing users with a role as low as Subscriber to update some plugin settings.
- Product
- WordPress Backup & Migration
- Fixed in
- 1.4.4
- What to do
- Update WordPress Backup & Migration to 1.4.4 or newer.
Nov 27, 2023Mattermost fails to limit the log size of server logs allowing an attacker sending specially crafted requests to different endpoints to potentially overflow theCVE-2023-48369 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 4.3
Mattermost fails to limit the log size of server logs allowing an attacker sending specially crafted requests to different endpoints to potentially overflow the log.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Nov 23, 2023The API endpoints in Ironman PowerShell Universal 3.0.0 through 4.2.0 allow remote attackers to execute arbitrary commands via crafted HTTP requests if a param CVE-2023-49213 · Other software · Ironmansoftware · reported by MITREHigh 8.8
The API endpoints in Ironman PowerShell Universal 3.0.0 through 4.2.0 allow remote attackers to execute arbitrary commands via crafted HTTP requests if a param block is used, due to invalid sanitization of input strings. The fixed versions are 3.10.2, 4.1.10, and 4.2.1.
- Product
- Powershell Universal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.ironmansoftware.comdocs.powershelluniversal.com
Nov 15, 2023Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in a runtime environment, and the enforcement of privCVE-2023-48224 · Other software · ethyca · reported by GitHubHigh 8.2
Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in a runtime environment, and the enforcement of privacy regulations in code. The Fides Privacy Center allows data subject users to submit privacy and consent requests to data controller users of the Fides web application. Privacy requests allow data subjects to submit a request to access all person data held by the data controller, or delete/erase it. Consent request allows data subject users to modify their privacy preferences for how the data controller uses their personal data e.g. data sales and sharing consent opt-in/opt-out. If `subject_identity_verification_required` in the `[execution]` section of `fides.toml` or the env var `FIDES__EXECUTION__SUBJECT_IDENTITY_VERIFICATION_REQUIRED` is set to `True` on the fides webserver backend, data subjects are sent a one-time code to their email address or phone number, depending on messaging configuration, and the one-time code must be entered in the Privacy Center UI by the data subject before the privacy or consent request is submitted. It was identified that the one-time code values for these requests were generated by the p
- Product
- fides
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2023HashiCorp Vault and Vault Enterprise inbound client requests triggering a policy check can lead to an unbounded consumption of memory.CVE-2023-5954 · Other software · HashiCorp · reported by security@hashicorp.comMedium 5.9
HashiCorp Vault and Vault Enterprise inbound client requests triggering a policy check can lead to an unbounded consumption of memory. A large number of these requests may lead to denial-of-service. Fixed in Vault 1.15.2, 1.14.6, and 1.13.10.
- Product
- Vault
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.hashicorp.comsecurity.netapp.com
Nov 8, 2023Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in your runtime environment, and the enforcement of pCVE-2023-47114 · Other software · ethyca · reported by GitHubMedium 4.3
Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in your runtime environment, and the enforcement of privacy regulations in your code. The Fides web application allows data subject users to request access to their personal data. If the request is approved by the data controller user operating the Fides web application, the data subject's personal data can then retrieved from connected systems and data stores before being bundled together as a data subject access request package for the data subject to download. Supported data formats for the package include json and csv, but the most commonly used format is a series of HTML files compressed in a ZIP file. Once downloaded and unzipped, the data subject user can browse the HTML files on their local machine. It was identified that there was no validation of input coming from e.g. the connected systems and data stores which is later reflected in the downloaded data. This can result in an HTML injection that can be abused e.g. for phishing attacks or malicious JavaScript code execution, but only in the context of the data subject's browser accessing a HTML page using the `file://
- Product
- fides
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 8, 2023A time-of-check to time-of-use (TOCTOU) bug in handling of IOCTL (input/output control) requests.CVE-2023-5760 · Other software · Avast/AVG · reported by security@nortonlifelock.comHigh 8.2
A time-of-check to time-of-use (TOCTOU) bug in handling of IOCTL (input/output control) requests. This TOCTOU bug leads to an out-of-bounds write vulnerability which can be further exploited, allowing an attacker to gain full local privilege escalation on the system.This issue affects Avast/Avg Antivirus: 23.8.
- Product
- Avast/Avg Antivirus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.norton.comsupport.norton.com
Nov 6, 2023Mattermost fails to properly validate requests to the Calls plugin, allowing an attacker sending a request without a User Agent header to cause a panic and crasCVE-2023-5967 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 4.3
Mattermost fails to properly validate requests to the Calls plugin, allowing an attacker sending a request without a User Agent header to cause a panic and crash the Calls plugin
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Nov 4, 2023LOYTEC LINX-151, LINX-212, LVIS-3ME12-A1, LIOB-586, LIOB-580 V2, LIOB-588, L-INX Configurator devices (all versions) send password-change requests via cleartextCVE-2023-46380 · Other software · loytec · reported by MITREHigh 7.5
LOYTEC LINX-151, LINX-212, LVIS-3ME12-A1, LIOB-586, LIOB-580 V2, LIOB-588, L-INX Configurator devices (all versions) send password-change requests via cleartext HTTP.
- Product
- lvis-3me12-a1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Nov 3, 2023Chunghwa Telecom NOKIA G-040W-Q Firewall function does not block ICMP TIMESTAMP requests by default, an unauthenticated remote attacker can exploit this vulneraCVE-2023-41354 · Other software · Chunghwa Telecom · reported by twcert@cert.org.twMedium 4
Chunghwa Telecom NOKIA G-040W-Q Firewall function does not block ICMP TIMESTAMP requests by default, an unauthenticated remote attacker can exploit this vulnerability by sending a crafted package, resulting in partially sensitive information exposed to an actor.
- Product
- NOKIA G-040W-Q
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Nov 2, 2023Requests to fetch image metadata could be abused to include SQL queries that would be executed unchecked.CVE-2023-26454 · Other software · OX Software GmbH · reported by security@open-xchange.comHigh 7.6
Requests to fetch image metadata could be abused to include SQL queries that would be executed unchecked. Exploiting this vulnerability requires at least access to adjacent networks of the imageconverter service, which is not exposed to public networks by default. Arbitrary SQL statements could be executed in the context of the services database user account. API requests are now properly checked for valid content and attempts to circumvent this check are being logged as error. No publicly available exploits are known.
- Product
- OX App Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.open-xchange.comsoftware.open-xchange.com
Nov 2, 2023Requests to cache an image could be abused to include SQL queries that would be executed unchecked.CVE-2023-26453 · Other software · OX Software GmbH · reported by security@open-xchange.comHigh 7.6
Requests to cache an image could be abused to include SQL queries that would be executed unchecked. Exploiting this vulnerability requires at least access to adjacent networks of the imageconverter service, which is not exposed to public networks by default. Arbitrary SQL statements could be executed in the context of the services database user account. API requests are now properly checked for valid content and attempts to circumvent this check are being logged as error. No publicly available exploits are known.
- Product
- OX App Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.open-xchange.comsoftware.open-xchange.com
Nov 2, 2023Requests to cache an image and return its metadata could be abused to include SQL queries that would be executed unchecked.CVE-2023-26452 · Other software · OX Software GmbH · reported by security@open-xchange.comHigh 7.6
Requests to cache an image and return its metadata could be abused to include SQL queries that would be executed unchecked. Exploiting this vulnerability requires at least access to adjacent networks of the imageconverter service, which is not exposed to public networks by default. Arbitrary SQL statements could be executed in the context of the services database user account. API requests are now properly checked for valid content and attempts to circumvent this check are being logged as error. No publicly available exploits are known.
- Product
- OX App Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.open-xchange.comsoftware.open-xchange.com
Oct 31, 2023 Poorly constructed webap requests and URI components with special characters trigger unhandled errors and exceptions, disclosing information about the underlyiCVE-2023-5516 · Other software · Hitachi Energy · reported by cybersecurity@hitachienergy.comMedium 5.3
Poorly constructed webap requests and URI components with special characters trigger unhandled errors and exceptions, disclosing information about the underlying technology and other sensitive information details. The website unintentionally reveals sensitive information including technical details like version Info, endpoints, backend server, Internal IP. etc., which can potentially expose additional attack surface containing other interesting vulnerabilities.
- Product
- eSOMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpublisher.hitachienergy.compublisher.hitachienergy.com
Oct 27, 2023In Memcached before 1.6.22, an off-by-one error exists when processing proxy requests in proxy mode, if \n is used instead of \r\n.CVE-2023-46853 · Other software · memcached · reported by MITRECritical 9.8
In Memcached before 1.6.22, an off-by-one error exists when processing proxy requests in proxy mode, if \n is used instead of \r\n.
- Product
- memcached
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2023In Memcached before 1.6.22, a buffer overflow exists when processing multiget requests in proxy mode, if there are many spaces after the "get" substring.CVE-2023-46852 · Other software · memcached · reported by MITREHigh 7.5
In Memcached before 1.6.22, a buffer overflow exists when processing multiget requests in proxy mode, if there are many spaces after the "get" substring.
- Product
- memcached
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2023 Sielco PolyEco1000 is vulnerable to an attacker escalating their privileges by modifying passwords in POST requests.CVE-2023-46661 · Other software · Sielco · reported by ics-cert@hq.dhs.govCritical 9.8
Sielco PolyEco1000 is vulnerable to an attacker escalating their privileges by modifying passwords in POST requests.
- Product
- PolyEco1000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2023An issue has been identified with how Elasticsearch handled incoming requests on the HTTP layer.CVE-2023-31418 · Other software · Elastic · reported by security@elastic.coHigh 7.5
An issue has been identified with how Elasticsearch handled incoming requests on the HTTP layer. An unauthenticated user could force an Elasticsearch node to exit with an OutOfMemory error by sending a moderate number of malformed HTTP requests. The issue was identified by Elastic Engineering and we have no indication that the issue is known or that it is being exploited in the wild.
- Product
- Elasticsearch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.elastic.cosecurity.netapp.com
Oct 26, 2023 The application interface allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests.CVE-2023-45317 · Other software · Sielco · reported by ics-cert@hq.dhs.govHigh 8.8
The application interface allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain actions with administrative privileges if a logged-in user visits a malicious web site.
- Product
- Analog FM transmitter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2023Using iterative requests an attacker was able to learn the size of an opaque response, as well as the contents of a server-supplied Vary header.CVE-2023-5722 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 5.3
Using iterative requests an attacker was able to learn the size of an opaque response, as well as the contents of a server-supplied Vary header. This vulnerability affects Firefox < 119.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgsecurity.gentoo.org
Oct 25, 2023Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in runtime environments, helping enforce privacy reguCVE-2023-46126 · Other software · ethyca · reported by GitHubLow 3.9
Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in runtime environments, helping enforce privacy regulations in code. The Fides web application allows users to edit consent and privacy notices such as cookie banners. The vulnerability makes it possible to craft a payload in the privacy policy URL which triggers JavaScript execution when the privacy notice is served by an integrated website. The domain scope of the executed JavaScript is that of the integrated website. Exploitation is limited to Admin UI users with the contributor role or higher. The vulnerability has been patched in Fides version `2.22.1`.
- Product
- fides
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2023Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in a runtime environment, and the enforcement of privCVE-2023-46125 · Other software · ethyca · reported by GitHubMedium 6.5
Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in a runtime environment, and the enforcement of privacy regulations in code. The Fides webserver API allows users to retrieve its configuration using the `GET api/v1/config` endpoint. The configuration data is filtered to suppress most sensitive configuration information before it is returned to the user, but even the filtered data contains information about the internals and the backend infrastructure, such as various settings, servers’ addresses and ports and database username. This information is useful for administrative users as well as attackers, thus it should not be revealed to low-privileged users. This vulnerability allows Admin UI users with roles lower than the owner role e.g. the viewer role to retrieve the config information using the API. The vulnerability has been patched in Fides version `2.22.1`.
- Product
- fides
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2023Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in runtime environments, and the enforcement of privaCVE-2023-46124 · Other software · ethyca · reported by GitHubHigh 8.2
Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in runtime environments, and the enforcement of privacy regulations in code. The Fides web application allows a custom integration to be uploaded as a ZIP file containing configuration and dataset definitions in YAML format. It was discovered that specially crafted YAML dataset and config files allow a malicious user to perform arbitrary requests to internal systems and exfiltrate data outside the environment (also known as a Server-Side Request Forgery). The application does not perform proper validation to block attempts to connect to internal (including localhost) resources. The vulnerability has been patched in Fides version `2.22.1`.
- Product
- fides
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2023PingFederate Administrative Console dependency contains a weakness where console becomes unresponsive with crafted Java class loading enumeration requests CVE-2023-39219 · Other software · Ping Identity · reported by responsible-disclosure@pingidentity.comHigh 7.5
PingFederate Administrative Console dependency contains a weakness where console becomes unresponsive with crafted Java class loading enumeration requests
- Product
- PingFederate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pingidentity.compingidentity.com
Oct 11, 2023A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption.CVE-2023-39325 · Other software · Go standard library · reported by security@golang.orgHigh 7.5
A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a new request while the existing one is still executing. With the fix applied, HTTP/2 servers now bound the number of simultaneously executing handler goroutines to the stream concurrency limit (MaxConcurrentStreams). New requests arriving when at the limit (which can only happen after the client has reset an existing, in-flight request) will be queued until a handler exits. If the request queue grows too large, the server will terminate the connection. This issue is also fixed in golang.org/x/net/http2 for users manually configuring HTTP/2. The default stream concurrency limit is 250 streams (requests) per HTTP/2 connection. This value may be adjusted using the golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams setting and the ConfigureServer function.
- Product
- net/http
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2023When TCP Verified Accept is enabled on a TCP profile that is configured on a Virtual Server, undisclosed requests can cause an increase in memory resource utiliCVE-2023-40542 · Network & remote access · F5 · reported by f5sirt@f5.comHigh 7.5
When TCP Verified Accept is enabled on a TCP profile that is configured on a Virtual Server, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
- Product
- BIG-IP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2023HPE MSA Controller prior to version IN210R004 could be remotely exploited to allow inconsistent interpretation of HTTP requests.CVE-2023-30910 · Other software · Hewlett Packer Enterprise (HPE) · reported by security-alert@hpe.comMedium 5.4
HPE MSA Controller prior to version IN210R004 could be remotely exploited to allow inconsistent interpretation of HTTP requests.
- Product
- HPE MSA Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hpe.comsupport.hpe.com
Oct 9, 2023 Insufficient Control Flow Management in RDT400 in SICK APU allows an unprivileged remote attacker to potentially enable hidden functionality via HTTP requests.CVE-2023-5102 · Other software · SICK AG · reported by psirt@sick.deMedium 5.3
Insufficient Control Flow Management in RDT400 in SICK APU allows an unprivileged remote attacker to potentially enable hidden functionality via HTTP requests.
- Product
- APU0200
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2023Missing Authorization in RDT400 in SICK APU allows an unprivileged remote attacker to modify data via HTTP requests that no not require authentication.CVE-2023-43700 · Other software · SICK AG · reported by psirt@sick.deHigh 7.7
Missing Authorization in RDT400 in SICK APU allows an unprivileged remote attacker to modify data via HTTP requests that no not require authentication.
- Product
- APU0200
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2023Kong Insomnia 2023.4.0 on macOS allows attackers to execute code and access restricted files, or make requests for TCC permissions, by using the DYLD_INSERT_LIBCVE-2023-40299 · Other software · kong_insomnia · reported by MITREHigh 7.8
Kong Insomnia 2023.4.0 on macOS allows attackers to execute code and access restricted files, or make requests for TCC permissions, by using the DYLD_INSERT_LIBRARIES environment variable.
- Product
- macos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2023A Server-Side Request Forgery issue in the OpenID Connect Issuer in LemonLDAP::NG before 2.17.1 allows authenticated remote attackers to send GET requests to arCVE-2023-44469 · Other software · Lemonldap-ng · reported by MITREMedium 4.3
A Server-Side Request Forgery issue in the OpenID Connect Issuer in LemonLDAP::NG before 2.17.1 allows authenticated remote attackers to send GET requests to arbitrary URLs through the request_uri authorization parameter. This is similar to CVE-2020-10770.
- Product
- Lemonldap\
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.ow2.orggitlab.ow2.org
Sep 28, 2023A Vault Enterprise Sentinel Role Governing Policy created by an operator to restrict access to resources in one namespace can be applied to requests outside in CVE-2023-3775 · Other software · HashiCorp · reported by security@hashicorp.comMedium 4.2
A Vault Enterprise Sentinel Role Governing Policy created by an operator to restrict access to resources in one namespace can be applied to requests outside in another non-descendant namespace, potentially resulting in denial of service. Fixed in Vault Enterprise 1.15.0, 1.14.4, 1.13.8.
- Product
- Vault Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.hashicorp.comdiscuss.hashicorp.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.