Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,774 results · page 19 of 36
Feb 8, 2024Cross Site Scripting vulnerability in Daily Habit Tracker v.1.0 allows a remote attacker to execute arbitrary code via the day, exercise, pray, read_book, vitamCVE-2024-24494 · Other software · Remyandrade · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in Daily Habit Tracker v.1.0 allows a remote attacker to execute arbitrary code via the day, exercise, pray, read_book, vitamins, laundry, alcohol and meat parameters in the add-tracker.php and update-tracker.php components.
- Product
- Daily Habit Tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2024Portugal CTT Tracking for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-24878 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marco Almeida | Webdados Portugal CTT Tracking for WooCommerce portugal-ctt-tracking-woocommerce.This issue affects Portugal CTT Tracking for WooCommerce: from n/a through <= 2.1.
- Product
- Portugal CTT Tracking for WooCommerce
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update Portugal CTT Tracking for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 23, 2024In rds_recv_track_latency in net/rds/af_rds.c in the Linux kernel through 6.7.1, there is an off-by-one error for an RDS_MSG_RX_DGRAM_TRACE_MAX comparison, resuCVE-2024-23849 · Computers, phones & browsers · Linux · reported by MITREMedium 5.5
In rds_recv_track_latency in net/rds/af_rds.c in the Linux kernel through 6.7.1, there is an off-by-one error for an RDS_MSG_RX_DGRAM_TRACE_MAX comparison, resulting in out-of-bounds access.
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.suse.comgit.kernel.org
Jan 22, 2024An out-of-bounds read vulnerability was found in Netfilter Connection Tracking (conntrack) in the Linux kernel.CVE-2023-39197 · Other software · Red Hat · reported by Red HatMedium 4
An out-of-bounds read vulnerability was found in Netfilter Connection Tracking (conntrack) in the Linux kernel. This flaw allows a remote user to disclose sensitive information via the DCCP protocol.
- Product
- Red Hat Enterprise Linux 6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Jan 17, 2024Track The Click: Does not properly sanitize query parameters to the stats REST endpoint before using them in a database queryCVE-2023-5041 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Track The Click WordPress plugin before 0.3.12 does not properly sanitize query parameters to the stats REST endpoint before using them in a database query, allowing a logged in user with an author role or higher to perform time based blind SQLi attacks on the database.
- Product
- Track The Click
- Fixed in
- 0.3.12
- What to do
- Update Track The Click to 0.3.12 or newer.
Jan 16, 2024Budget and Expense Tracker System v1.0 is vulnerable to SQL Injection via /expense_budget/admin/?page=reports/budget&date_start=2023-12-28&date_end=CVE-2024-22628 · Other software · Oretnom23 · reported by MITREHigh 7.2
Budget and Expense Tracker System v1.0 is vulnerable to SQL Injection via /expense_budget/admin/?page=reports/budget&date_start=2023-12-28&date_end=
- Product
- Budget And Expense Tracker System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2024Traccar is an open source GPS tracking system.CVE-2023-50729 · Other software · traccar · reported by GitHubHigh 8.4
Traccar is an open source GPS tracking system. Prior to 5.11, Traccar is affected by an unrestricted file upload vulnerability in File feature allows attackers to execute arbitrary code on the server. This vulnerability is more prevalent because Traccar is recommended to run web servers as root user. It is also more dangerous because it can write or overwrite files in arbitrary locations. Version 5.11 was published to fix this vulnerability.
- Product
- traccar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2024In JetBrains YouTrack before 2023.3.22666 stored XSS via markdown was possibleCVE-2024-22370 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.6
In JetBrains YouTrack before 2023.3.22666 stored XSS via markdown was possible
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
Jan 8, 2024It was discovered that the eBPF implementation in the Linux kernel did not properly track bounds information for 32 bit registers when performing div and mod opCVE-2021-3600 · Other software · The Linux Kernel Organization · reported by security@ubuntu.comHigh 7.8
It was discovered that the eBPF implementation in the Linux kernel did not properly track bounds information for 32 bit registers when performing div and mod operations. A local attacker could use this to possibly execute arbitrary code.
- Product
- linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcve.mitre.orggit.kernel.org
Jan 8, 2024Puma is a web server for Ruby/Rack applications built for parallelism.CVE-2024-21647 · Other software · puma · reported by GitHubMedium 5.9
Puma is a web server for Ruby/Rack applications built for parallelism. Prior to version 6.4.2, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies in a way that allowed HTTP request smuggling. Fixed versions limits the size of chunk extensions. Without this limit, an attacker could cause unbounded resource (CPU, network bandwidth) consumption. This vulnerability has been fixed in versions 6.4.2 and 5.6.8.
- Product
- puma
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2024A memory leak problem was found in ctnetlink_create_conntrack in net/netfilter/nf_conntrack_netlink.c in the Linux Kernel.CVE-2023-7192 · Other software · Red Hat · reported by Red HatMedium 5.5
A memory leak problem was found in ctnetlink_create_conntrack in net/netfilter/nf_conntrack_netlink.c in the Linux Kernel. This issue may allow a local attacker with CAP_NET_ADMIN privileges to cause a denial of service (DoS) attack due to a refcount overflow.
- Product
- Red Hat Enterprise Linux 8.2 Advanced Update Support
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Jan 1, 2024In wlan driver, there is a possible PIN crack due to use of insufficiently random values.CVE-2023-32831 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comMedium 5.5
In wlan driver, there is a possible PIN crack due to use of insufficiently random values. This could lead to local information disclosure with no execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00325055; Issue ID: MSV-868.
- Product
- MT6890, MT7612, MT7613, MT7615, MT7622, MT7626, MT7629, MT7915, MT7916, MT7981, MT7986
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcorp.mediatek.comcorp.mediatek.com
Dec 25, 2023openCRX 5.2.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Name field after creation of a Tracker in Manage Activity.CVE-2023-27150 · Other software · Opencrx · reported by MITREMedium 5.4
openCRX 5.2.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Name field after creation of a Tracker in Manage Activity.
- Product
- Opencrx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordesecforte.comopencrx.org
Dec 22, 2023Grackle is a GraphQL server written in functional Scala, built on the Typelevel stack.CVE-2023-50730 · Other software · typelevel · reported by GitHubHigh 7.5
Grackle is a GraphQL server written in functional Scala, built on the Typelevel stack. The GraphQL specification requires that GraphQL fragments must not form cycles, either directly or indirectly. Prior to Grackle version 0.18.0, that requirement wasn't checked, and queries with cyclic fragments would have been accepted for type checking and compilation. The attempted compilation of such fragments would result in a JVM `StackOverflowError` being thrown. Some knowledge of an applications GraphQL schema would be required to construct such a query, however no knowledge of any application-specific performance or other behavioural characteristics would be needed. Grackle uses the cats-parse library for parsing GraphQL queries. Prior to version 0.18.0, Grackle made use of the cats-parse `recursive` operator. However, `recursive` is not currently stack safe. `recursive` was used in three places in the parser: nested selection sets, nested input values (lists and objects), and nested list type declarations. Consequently, queries with deeply nested selection sets, input values or list types could be constructed which exploited this, causing a JVM `StackOverflowException` to be thrown duri
- Product
- grackle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 20, 2023SEO Change Monitor – Track Website Changes: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-33209 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CrawlSpider SEO Change Monitor – Track Website Changes.This issue affects SEO Change Monitor – Track Website Changes: from n/a through 1.2.
- Product
- SEO Change Monitor – Track Website Changes
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update SEO Change Monitor – Track Website Changes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 19, 2023A session rendering issue was addressed with improved session tracking.CVE-2023-42940 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.7
A session rendering issue was addressed with improved session tracking. This issue is fixed in macOS Sonoma 14.2.1. A user who shares their screen may unintentionally share the incorrect content.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgsupport.apple.com
Dec 15, 2023A Remote Code Execution vulnerability exist in Uffizio's GPS Tracker all versions.CVE-2020-17485 · Other software · Uffizio · reported by MITRECritical 9.8
A Remote Code Execution vulnerability exist in Uffizio's GPS Tracker all versions. The web server can be compromised by uploading and executing a web/reverse shell. An attacker could then run commands, browse system files, and browse local resources
- Product
- GPS Tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2023An Open Redirection vulnerability exists in Uffizio's GPS Tracker all versions allows an attacker to construct a URL within the application that causes a redireCVE-2020-17484 · Other software · Uffizio · reported by MITREMedium 6.1
An Open Redirection vulnerability exists in Uffizio's GPS Tracker all versions allows an attacker to construct a URL within the application that causes a redirection to an arbitrary external domain.
- Product
- GPS Tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2023An improper access control vulnerability exists in Uffizio's GPS Tracker all versions that lead to sensitive information disclosure of all the connected devicesCVE-2020-17483 · Other software · Uffizio · reported by MITREHigh 7.5
An improper access control vulnerability exists in Uffizio's GPS Tracker all versions that lead to sensitive information disclosure of all the connected devices. By visiting the vulnerable host at port 9000, we see it responds with a JSON body that has all the details about the devices which have been deployed.
- Product
- GPS Tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2023Track Geolocation Of Users Using Contact Form 7: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49188 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ZealousWeb Track Geolocation Of Users Using Contact Form 7 allows Stored XSS.This issue affects Track Geolocation Of Users Using Contact Form 7: from n/a through 2.0.
- Product
- Track Geolocation Of Users Using Contact Form 7
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Track Geolocation Of Users Using Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 15, 2023In JetBrains YouTrack before 2023.3.22268 authorization check for inline comments inside thread replies was missedCVE-2023-50871 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.3
In JetBrains YouTrack before 2023.3.22268 authorization check for inline comments inside thread replies was missed
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
Dec 14, 2023Credit Tracker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49152 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Labs64 Credit Tracker allows Stored XSS.This issue affects Credit Tracker: from n/a through 1.1.17.
- Product
- Credit Tracker
- Affected
- up to 1.1.17
- What to do
- Affects up to 1.1.17. Update Credit Tracker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 7, 2023A Blind SQL injection issue in ajax.php in GaatiTrack Courier Management System 1.0 allows an unauthenticated attacker to inject a payload via the email parametCVE-2023-48823 · Other software · Mayurik · reported by MITRECritical 9.8
A Blind SQL injection issue in ajax.php in GaatiTrack Courier Management System 1.0 allows an unauthenticated attacker to inject a payload via the email parameter during login.
- Product
- Courier Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Dec 7, 2023A Cross Site Scripting (XSS) vulnerability in GaatiTrack Courier Management System 1.0 allows a remote attacker to inject JavaScript via the page parameter to lCVE-2023-48206 · Other software · Mayurik · reported by MITREMedium 6.1
A Cross Site Scripting (XSS) vulnerability in GaatiTrack Courier Management System 1.0 allows a remote attacker to inject JavaScript via the page parameter to login.php or header.php.
- Product
- Courier Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Dec 4, 2023In transcodeQ*ToFloat of btif_avrcp_audio_track.cc, there is a possible out of bounds write due to a missing bounds check.CVE-2023-40087 · Computers, phones & browsers · Google · reported by security@android.comHigh 8.8
In transcodeQ*ToFloat of btif_avrcp_audio_track.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to paired device escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comsource.android.com
Nov 28, 2023raptor-web is a CMS for game server communities that can be used to host information and keep track of players.CVE-2023-49078 · Other software · zediious · reported by GitHubMedium 5.4
raptor-web is a CMS for game server communities that can be used to host information and keep track of players. In version 0.4.4 of raptor-web, it is possible to craft a malicious URL that will result in a reflected cross-site scripting vulnerability. A user controlled URL parameter is loaded into an internal template that has autoescape disabled. This is a cross-site scripting vulnerability that affects all deployments of `raptor-web` on version `0.4.4`. Any victim who clicks on a malicious crafted link will be affected. This issue has been patched 0.4.4.1.
- Product
- raptor-web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2023Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Veon Computer Service Tracking Software allows SQL InjectiCVE-2023-2889 · Other software · Veon Computer · reported by iletisim@usom.gov.trCritical 9.8
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Veon Computer Service Tracking Software allows SQL Injection. This issue affects Service Tracking Software: before crm 2.0.
- Product
- Service Tracking Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Nov 3, 2023Best Practical Request Tracker (RT) 5 before 5.0.5 allows Information Disclosure via a transaction search in the transaction query builder.CVE-2023-45024 · Other software · Bestpractical · reported by MITREHigh 7.5
Best Practical Request Tracker (RT) 5 before 5.0.5 allows Information Disclosure via a transaction search in the transaction query builder.
- Product
- Request Tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.bestpractical.comdocs.bestpractical.com
Nov 3, 2023Best Practical Request Tracker (RT) before 4.4.7 and 5.x before 5.0.5 allows Information Exposure in responses to mail-gateway REST API calls.CVE-2023-41260 · Other software · best_practical_solutions · reported by MITREHigh 7.5
Best Practical Request Tracker (RT) before 4.4.7 and 5.x before 5.0.5 allows Information Exposure in responses to mail-gateway REST API calls.
- Product
- request_tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.bestpractical.comdocs.bestpractical.com
Nov 3, 2023Best Practical Request Tracker (RT) before 4.4.7 and 5.x before 5.0.5 allows Information Disclosure via fake or spoofed RT email headers in an email message or CVE-2023-41259 · Other software · best_practical_solutions · reported by MITREHigh 7.5
Best Practical Request Tracker (RT) before 4.4.7 and 5.x before 5.0.5 allows Information Disclosure via fake or spoofed RT email headers in an email message or a mail-gateway REST API call.
- Product
- request_tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.bestpractical.comdocs.bestpractical.com
Nov 2, 2023In the module "Pixel Plus: Events + CAPI + Pixel Catalog for Facebook Module" (facebookconversiontrackingplus) up to version 2.4.9 from Smart Modules for PrestaCVE-2023-46352 · Other software · Smartmodules · reported by MITREHigh 7.5
In the module "Pixel Plus: Events + CAPI + Pixel Catalog for Facebook Module" (facebookconversiontrackingplus) up to version 2.4.9 from Smart Modules for PrestaShop, a guest can download personal information without restriction. Due to a lack of permissions control, a guest can access exports from the module which can lead to a leak of personal information from ps_customer table such as name / surname / email.
- Product
- Facebookconversiontrackingplus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaddons.prestashop.comsecurity.friendsofpresta.org
Nov 2, 2023An information leak in VISION MEAT WORKS Track Diner 10/10mbl v13.6.1 allows attackers to obtain the channel access token and send crafted messages.CVE-2023-39051 · Other software · Lycorp · reported by MITREHigh 7.5
An information leak in VISION MEAT WORKS Track Diner 10/10mbl v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
- Product
- Line Mini App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comliff.line.me
Nov 1, 2023GPAC 2.3-DEV-rev605-gfc9e29089-master contains a SEGV in gpac/MP4Box in gf_isom_find_od_id_for_track /afltest/gpac/src/isomedia/media_odf.c:522:14.CVE-2023-46930 · Other software · gpac · reported by MITREMedium 5.5
GPAC 2.3-DEV-rev605-gfc9e29089-master contains a SEGV in gpac/MP4Box in gf_isom_find_od_id_for_track /afltest/gpac/src/isomedia/media_odf.c:522:14.
- Product
- gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2023Kimai is a web-based multi-user time-tracking application.CVE-2023-46245 · Other software · kimai · reported by GitHubHigh 7.2
Kimai is a web-based multi-user time-tracking application. Versions prior to 2.1.0 are vulnerable to a Server-Side Template Injection (SSTI) which can be escalated to Remote Code Execution (RCE). The vulnerability arises when a malicious user uploads a specially crafted Twig file, exploiting the software's PDF and HTML rendering functionalities. Version 2.1.0 enables security measures for custom Twig templates.
- Product
- kimai
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2023CallRail Phone Call Tracking: Stored Cross-Site ScriptingCVE-2023-5051 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The CallRail Phone Call Tracking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'callrail_form' shortcode in versions up to, and including, 0.5.2 due to insufficient input sanitization and output escaping on the 'form_id' user supplied attribute. This makes it possible for authenticated attackers with contributor level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- CallRail Phone Call Tracking
- Affected
- up to 0.5.2
- What to do
- Affects up to 0.5.2. Update CallRail Phone Call Tracking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 26, 2023Conversios Track Google Analytics 4, Facebook Pixel & Conversions API: Unauth. Reflected Cross-Site Scripting (XSS)CVE-2023-46094 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Conversios Track Google Analytics 4, Facebook Pixel & Conversions API via Google Tag Manager for WooCommerce plugin <= 6.5.3 versions.
- Product
- Conversios Track Google Analytics 4, Facebook Pixel & Conversions API
- Fixed in
- 6.5.4
- What to do
- Update Conversios Track Google Analytics 4, Facebook Pixel & Conversions API to 6.5.4 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Oct 25, 2023The leakage of the client secret in VISION MEAT WORKS TrackDiner10/10_mc Line v13.6.1 allows attackers to obtain the channel access token and send crafted broadCVE-2023-39734 · Other software · Linecorp · reported by MITREHigh 8.2
The leakage of the client secret in VISION MEAT WORKS TrackDiner10/10_mc Line v13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages.
- Product
- Trackdiner10/10 MC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comliff.line.me
Oct 16, 2023MantisBT is an open source bug tracker.CVE-2023-44394 · Other software · mantisbt · reported by GitHubMedium 4.3
MantisBT is an open source bug tracker. Due to insufficient access-level checks on the Wiki redirection page, any user can reveal private Projects' names, by accessing wiki.php with sequentially incremented IDs. This issue has been addressed in commit `65c44883f` which has been included in release `2.25.8`. Users are advised to upgrade. Users unable to upgrade should disable wiki integration ( `$g_wiki_enable = OFF;`).
- Product
- mantisbt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2023A flaw was found in the tracker-miners package.CVE-2023-5557 · Other software · Red Hat · reported by Red HatHigh 7.5
A flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously-crafted file to execute code outside the sandbox if the tracker-extract process has first been compromised by a separate vulnerability.
- Product
- Red Hat Enterprise Linux 8
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Sep 27, 2023Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Hedef Tracking Admin Panel allows SQL Injection.CVE-2023-4737 · Other software · Hedef Tracking · reported by iletisim@usom.gov.trCritical 9.8
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Hedef Tracking Admin Panel allows SQL Injection. This issue affects Admin Panel: before 1.2.
- Product
- Admin Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Sep 27, 2023MeterSphere is a one-stop open source continuous testing platform, covering functions such as test tracking, interface testing, UI testing and performance testiCVE-2023-41878 · Other software · metersphere · reported by GitHubMedium 4.6
MeterSphere is a one-stop open source continuous testing platform, covering functions such as test tracking, interface testing, UI testing and performance testing. The Selenium VNC config used in Metersphere is using a weak password by default, attackers can login to vnc and obtain high permissions. This issue has been addressed in version 2.10.7 LTS. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- metersphere
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2023SQL injection vulnerability in FIT2CLOUD RackShift v1.7.1 allows attackers to execute arbitrary code via the `sort` parameter to taskService.list(), bareMetalSeCVE-2023-42405 · Other software · Fit2cloud · reported by MITRECritical 9.8
SQL injection vulnerability in FIT2CLOUD RackShift v1.7.1 allows attackers to execute arbitrary code via the `sort` parameter to taskService.list(), bareMetalService.list(), and switchService.list().
- Product
- Rackshift
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2023CSV Injection vulnerability in GNOME time tracker version 3.0.2, allows local attackers to execute arbitrary code via crafted .tsv file when creating a new recoCVE-2023-36250 · Other software · Gnome · reported by MITREHigh 7.8
CSV Injection vulnerability in GNOME time tracker version 3.0.2, allows local attackers to execute arbitrary code via crafted .tsv file when creating a new record.
- Product
- Gnome-time Tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2023Incorrect access control in the User Registration page of Crypto Currency Tracker (CCT) before v9.5 allows unauthenticated attackers to register as an Admin accCVE-2023-37759 · Other software · Trendylogics · reported by MITRECritical 9.8
Incorrect access control in the User Registration page of Crypto Currency Tracker (CCT) before v9.5 allows unauthenticated attackers to register as an Admin account via a crafted POST request.
- Product
- Crypto Currency Tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodecanyon.netpacketstormsecurity.com
Sep 6, 2023PendingIntent hijacking in LmsAssemblyTrackerCTC prior to SMR Sep-2023 Release 1 allows local attacker to gain arbitrary file access.CVE-2023-30720 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4.7
PendingIntent hijacking in LmsAssemblyTrackerCTC prior to SMR Sep-2023 Release 1 allows local attacker to gain arbitrary file access.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Sep 5, 2023Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BMA Personnel Tracking System allows SQL Injection.CVE-2023-35068 · Other software · BMA · reported by iletisim@usom.gov.trCritical 9.8
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BMA Personnel Tracking System allows SQL Injection. This issue affects Personnel Tracking System: before 20230904.
- Product
- Personnel Tracking System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Sep 4, 2023Orders Tracking for WooCommerce: Doesn't validate the file_url parameterCVE-2023-4216 · WordPress plugins & themes · reported by WPScanLow 2.7
The Orders Tracking for WooCommerce WordPress plugin before 1.2.6 doesn't validate the file_url parameter when importing a CSV file, allowing high privilege users with the manage_woocommerce capability to access any file on the web server via a Traversal attack. The content retrieved is however limited to the first line of the file.
- Product
- Orders Tracking for WooCommerce
- Fixed in
- 1.2.6
- What to do
- Update Orders Tracking for WooCommerce to 1.2.6 or newer.
Aug 31, 2023Order Tracking Pro: Stored Cross-Site ScriptingCVE-2023-4500 · WordPress plugins & themes · reported by WordfenceMedium 4.7
The Order Tracking Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the order status parameter in versions up to, and including, 3.3.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers (admin or higher) to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- Order Tracking Pro
- Affected
- up to 3.3.6
- What to do
- Affects up to 3.3.6. Update Order Tracking Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Aug 31, 2023Order Tracking Pro: Reflected Cross-Site ScriptingCVE-2023-4471 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Order Tracking Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the start_date and end_date parameters in versions up to, and including, 3.3.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Order Tracking Pro
- Affected
- up to 3.3.6
- What to do
- Affects up to 3.3.6. Update Order Tracking Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 30, 2023User Activity Tracking and Log: Does not have proper CSRF checksCVE-2023-4150 · WordPress plugins & themes · reported by WPScanMedium 4.3
The User Activity Tracking and Log WordPress plugin before 4.0.9 does not have proper CSRF checks when managing its license, which could allow attackers to make logged in admins update and deactivate the plugin's license via CSRF attacks
- Product
- User Activity Tracking and Log
- Fixed in
- 4.0.9
- What to do
- Update User Activity Tracking and Log to 4.0.9 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.