Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
153 results · page 2 of 4
Mar 11, 2025Cross Site Scripting vulnerability in Zucchetti Ad Hoc Infinity 2.4 allows an authenticated attacker to achieve Remote Code Execution via the /jsp/home.jsp, /jsCVE-2024-51322 · Other software · Zucchetti · reported by MITREMedium 5.4
Cross Site Scripting vulnerability in Zucchetti Ad Hoc Infinity 2.4 allows an authenticated attacker to achieve Remote Code Execution via the /jsp/home.jsp, /jsp/gsfr_feditorHTML.jsp, /servlet/SPVisualZoom, /jsp/gsmd_container.jsp components
- Product
- AD HOC Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmembers.backbox.orgmembers.backbox.org
Mar 11, 2025In Zucchetti Ad Hoc Infinity 2.4, an improper check on the m_cURL parameter allows an attacker to redirect the victim to an attacker-controlled website after thCVE-2024-51321 · Other software · Zucchetti · reported by MITREHigh 7.6
In Zucchetti Ad Hoc Infinity 2.4, an improper check on the m_cURL parameter allows an attacker to redirect the victim to an attacker-controlled website after the authentication.
- Product
- AD HOC Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2025Cross Site Scripting vulnerability in Zucchetti Ad Hoc Infinity 2.4 allows an authenticated attacker to achieve Remote Code Execution via the /servlet/gsdm_fsavCVE-2024-51320 · Other software · Zucchetti · reported by MITREMedium 5.4
Cross Site Scripting vulnerability in Zucchetti Ad Hoc Infinity 2.4 allows an authenticated attacker to achieve Remote Code Execution via the /servlet/gsdm_fsave_htmltmp, /servlet/gsdm_btlk_openfile components
- Product
- AD HOC Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmembers.backbox.orgmembers.backbox.org
Mar 11, 2025A local file include vulnerability in the /servlet/Report of Zucchetti Ad Hoc Infinity 2.4 allows an authenticated attacker to achieve Remote Code Execution by CVE-2024-51319 · Other software · Zucchetti · reported by MITREHigh 7.3
A local file include vulnerability in the /servlet/Report of Zucchetti Ad Hoc Infinity 2.4 allows an authenticated attacker to achieve Remote Code Execution by uploading a jsp web/reverse shell through /jsp/zimg_upload.jsp.
- Product
- AD HOC Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2025Pega Platform versions 8.1 to Infinity 24.2.0 are affected by an Stored XSS issue with profile.CVE-2024-12211 · Other software · Pegasystems · reported by security@pega.comMedium 5.4
Pega Platform versions 8.1 to Infinity 24.2.0 are affected by an Stored XSS issue with profile.
- Product
- Pega Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2024Pega Platform versions 8.1 to Infinity 24.2.0 are affected by an XSS issue with search.CVE-2024-10716 · Other software · Pegasystems · reported by security@pega.comMedium 5.9
Pega Platform versions 8.1 to Infinity 24.2.0 are affected by an XSS issue with search.
- Product
- Pega Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2024Pega Platform versions 6.x to Infinity 24.1.1 are affected by an issue with Improper Control of Generation of CodeCVE-2024-10094 · Other software · Pegasystems · reported by security@pega.comCritical 9.1
Pega Platform versions 6.x to Infinity 24.1.1 are affected by an issue with Improper Control of Generation of Code
- Product
- Pega Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2024Cybele Software Thinfinity Workspace before v7.0.2.113 was discovered to contain a hardcoded cryptographic key used for encryption.CVE-2024-40410 · Other software · cybelesoft · reported by MITREMedium 4.8
Cybele Software Thinfinity Workspace before v7.0.2.113 was discovered to contain a hardcoded cryptographic key used for encryption.
- Product
- thinfinity_workspace
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2024Cybele Software Thinfinity Workspace before v7.0.2.113 was discovered to contain an access control issue in the Create Profile section.CVE-2024-40408 · Other software · cybelesoft · reported by MITREHigh 7.3
Cybele Software Thinfinity Workspace before v7.0.2.113 was discovered to contain an access control issue in the Create Profile section. This vulnerability allows attackers to create arbitrary user profiles with elevated privileges.
- Product
- thinfinity_workspace
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2024A full path disclosure in Cybele Software Thinfinity Workspace before v7.0.2.113 allows attackers to obtain the root path of the application via unspecified vecCVE-2024-40407 · Other software · cybelesoft · reported by MITREHigh 7.5
A full path disclosure in Cybele Software Thinfinity Workspace before v7.0.2.113 allows attackers to obtain the root path of the application via unspecified vectors.
- Product
- thinfinity_workspace
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2024Incorrect access control in Cybele Software Thinfinity Workspace before v7.0.3.109 allows attackers to gain access to a secondary broker via a crafted request.CVE-2024-40405 · Other software · cybelesoft · reported by MITREHigh 8.1
Incorrect access control in Cybele Software Thinfinity Workspace before v7.0.3.109 allows attackers to gain access to a secondary broker via a crafted request.
- Product
- thinfinity_workspace
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2024Cybele Software Thinfinity Workspace before v7.0.2.113 was discovered to contain an access control issue in the API endpoint where Web Sockets connections are eCVE-2024-40404 · Other software · cybelesoft · reported by MITRECritical 9.8
Cybele Software Thinfinity Workspace before v7.0.2.113 was discovered to contain an access control issue in the API endpoint where Web Sockets connections are established.
- Product
- thinfinity_workspace
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2024Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an HTML Injection issue with Stage.CVE-2024-6702 · Other software · Pegasystems · reported by security@pega.comMedium 5.2
Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an HTML Injection issue with Stage.
- Product
- Pega Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2024Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an XSS issue with case type.CVE-2024-6701 · Other software · Pegasystems · reported by security@pega.comMedium 5.5
Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an XSS issue with case type.
- Product
- Pega Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2024Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an XSS issue with App name.CVE-2024-6700 · Other software · Pegasystems · reported by security@pega.comMedium 5.5
Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an XSS issue with App name.
- Product
- Pega Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2024Pexip Infinity before 34.1 has Improper Access Control for persons in a waiting room.CVE-2024-33850 · Other software · Pexip · reported by MITREMedium 4.3
Pexip Infinity before 34.1 has Improper Access Control for persons in a waiting room. They can see the conference roster list, and perform certain actions that should not be allowed before they are admitted to the meeting.
- Product
- Pexip Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pexip.comdocs.pexip.com
Jan 31, 2024Pega Platform versions 8.2.1 to Infinity 23.1.0 are affected by an Generated PDF issue that could expose file contents.CVE-2023-50165 · Other software · Pegasystems · reported by security@pega.comHigh 8.5
Pega Platform versions 8.2.1 to Infinity 23.1.0 are affected by an Generated PDF issue that could expose file contents.
- Product
- Pega Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.pega.comsupport.pega.com
Dec 25, 2023Pexip Infinity before 32 allows Webapp1 XSS via preconfigured links.CVE-2023-37225 · Other software · Pexip · reported by MITREMedium 6.1
Pexip Infinity before 32 allows Webapp1 XSS via preconfigured links.
- Product
- Pexip Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pexip.comdocs.pexip.com
Dec 25, 2023Pexip Infinity before 31.2 has Improper Input Validation for RTCP, allowing remote attackers to trigger an abort.CVE-2023-31455 · Other software · Pexip · reported by MITREHigh 7.5
Pexip Infinity before 31.2 has Improper Input Validation for RTCP, allowing remote attackers to trigger an abort.
- Product
- Pexip Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pexip.comdocs.pexip.com
Dec 25, 2023Pexip Infinity before 31.2 has Improper Input Validation for signalling, allowing remote attackers to trigger an abort.CVE-2023-31289 · Other software · Pexip · reported by MITREHigh 7.5
Pexip Infinity before 31.2 has Improper Input Validation for signalling, allowing remote attackers to trigger an abort.
- Product
- Pexip Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pexip.comdocs.pexip.com
Oct 18, 2023 Pega Platform versions 8.1 to Infinity 23.1.0 are affected by an XSS issue with ad-hoc case creation CVE-2023-32088 · Other software · Pegasystems · reported by security@pega.comMedium 4.6
Pega Platform versions 8.1 to Infinity 23.1.0 are affected by an XSS issue with ad-hoc case creation
- Product
- Pega Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.pega.comsupport.pega.com
Oct 18, 2023 Pega Platform versions 8.1 to Infinity 23.1.0 are affected by an XSS issue with task creation CVE-2023-32087 · Other software · Pegasystems · reported by security@pega.comMedium 4.6
Pega Platform versions 8.1 to Infinity 23.1.0 are affected by an XSS issue with task creation
- Product
- Pega Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.pega.comsupport.pega.com
Jun 9, 2023Pega Platform versions 7.2 to 8.8.1 are affected by an XSS issue.CVE-2023-26465 · Other software · Pegasystems · reported by security@pega.comMedium 6.1
Pega Platform versions 7.2 to 8.8.1 are affected by an XSS issue.
- Product
- Pega Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.pega.comsupport.pega.com
Mar 16, 2023Use of Insufficiently Random Values vulnerability in ABB Pulsar Plus System Controller NE843_S, ABB Infinity DC Power Plant.This issue affects Pulsar Plus SysteCVE-2022-26080 · Other software · ABB · reported by cybersecurity@ch.abb.comMedium 6.3
Use of Insufficiently Random Values vulnerability in ABB Pulsar Plus System Controller NE843_S, ABB Infinity DC Power Plant.This issue affects Pulsar Plus System Controller NE843_S : comcode 150042936; Infinity DC Power Plant: H5692448 G104 G842 G224L G630-4 G451C(2) G461(2) – comcode 150047415.
- Product
- Pulsar Plus System Controller NE843_S
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsearch.abb.comsearch.abb.com
Feb 24, 2023Cross-Site Request Forgery (CSRF) vulnerability in ABB Pulsar Plus System Controller NE843_S, ABB Infinity DC Power Plant allows Cross Site Request Forgery.ThisCVE-2022-1607 · Other software · ABB · reported by cybersecurity@ch.abb.comMedium 4.6
Cross-Site Request Forgery (CSRF) vulnerability in ABB Pulsar Plus System Controller NE843_S, ABB Infinity DC Power Plant allows Cross Site Request Forgery.This issue affects Pulsar Plus System Controller NE843_S : comcode 150042936; Infinity DC Power Plant: H5692448 G104 G842 G224L G630-4 G451C(2) G461(2) – comcode 150047415.
- Product
- Pulsar Plus System Controller NE843_S
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsearch.abb.comsearch.abb.com
Aug 22, 2022Pega Platform from 8.3 to 8.7.3 vulnerability may allow authenticated security administrators to alter CSRF settings directly.CVE-2022-35656 · Other software · Pegasystems · reported by security@pega.comMedium 4.5
Pega Platform from 8.3 to 8.7.3 vulnerability may allow authenticated security administrators to alter CSRF settings directly.
- Product
- Pega Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.pega.comsupport.pega.com
Aug 22, 2022Pega Platform from 7.3 to 8.7.3 is affected by an XSS issue due to a misconfiguration of a datapage setting.CVE-2022-35655 · Other software · Pegasystems · reported by security@pega.comMedium 6.1
Pega Platform from 7.3 to 8.7.3 is affected by an XSS issue due to a misconfiguration of a datapage setting.
- Product
- Pega Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.pega.comsupport.pega.com
Aug 22, 2022Pega Platform from 8.5.4 to 8.7.3 is affected by an XSS issue with an unauthenticated user and the redirect parameter.CVE-2022-35654 · Other software · Pegasystems · reported by security@pega.comMedium 6.1
Pega Platform from 8.5.4 to 8.7.3 is affected by an XSS issue with an unauthenticated user and the redirect parameter.
- Product
- Pega Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.pega.comsupport.pega.com
Jul 25, 2022Password authentication bypass vulnerability for local accounts can be used to bypass local authentication checks.CVE-2022-24083 · Other software · Pegasystems · reported by security@pega.comCritical 9.8
Password authentication bypass vulnerability for local accounts can be used to bypass local authentication checks.
- Product
- Pega Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.pega.comsupport.pega.com
Jul 19, 2022If an on-premise installation of the Pega Platform is configured with the port for the JMX interface exposed to the Internet and port filtering is not properly CVE-2022-24082 · Other software · Pegasystems · reported by security@pega.comCritical 9.8
If an on-premise installation of the Pega Platform is configured with the port for the JMX interface exposed to the Internet and port filtering is not properly configured, then it may be possible to upload serialized payloads to attack the underlying system. This does not affect systems running on PegaCloud due to its design and architecture.
- Product
- Pega Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comsupport.pega.com
Jul 17, 2022Pexip Infinity before 28.1 allows remote attackers to trigger a software abort via G.719.CVE-2022-32263 · Other software · Pexip · reported by MITREHigh 7.5
Pexip Infinity before 28.1 allows remote attackers to trigger a software abort via G.719.
- Product
- Pexip Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pexip.comdocs.pexip.com
Jul 17, 2022Pexip Infinity 27 before 28.0 allows remote attackers to trigger excessive resource consumption and termination because of registrar resource mishandling.CVE-2022-29286 · Other software · Pexip · reported by MITREHigh 7.5
Pexip Infinity 27 before 28.0 allows remote attackers to trigger excessive resource consumption and termination because of registrar resource mishandling.
- Product
- Pexip Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pexip.comdocs.pexip.com
Jul 17, 2022Pexip Infinity before 27.3 allows remote attackers to trigger excessive resource consumption via H.264.CVE-2022-27937 · Other software · Pexip · reported by MITREHigh 7.5
Pexip Infinity before 27.3 allows remote attackers to trigger excessive resource consumption via H.264.
- Product
- Pexip Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pexip.comdocs.pexip.com
Jul 17, 2022Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via H.323.CVE-2022-27936 · Other software · Pexip · reported by MITREHigh 7.5
Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via H.323.
- Product
- Pexip Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pexip.comdocs.pexip.com
Jul 17, 2022Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via Epic Telehealth.CVE-2022-27935 · Other software · Pexip · reported by MITREHigh 7.5
Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via Epic Telehealth.
- Product
- Pexip Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pexip.comdocs.pexip.com
Jul 17, 2022Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via HTTP.CVE-2022-27934 · Other software · Pexip · reported by MITREHigh 7.5
Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via HTTP.
- Product
- Pexip Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pexip.comdocs.pexip.com
Jul 17, 2022Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via One Touch Join.CVE-2022-27933 · Other software · Pexip · reported by MITREHigh 8.2
Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via One Touch Join.
- Product
- Pexip Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pexip.comdocs.pexip.com
Jul 17, 2022Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via One Touch Join.CVE-2022-27932 · Other software · Pexip · reported by MITREHigh 7.5
Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via One Touch Join.
- Product
- Pexip Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pexip.comdocs.pexip.com
Jul 17, 2022Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via the Session Initiation Protocol.CVE-2022-27931 · Other software · Pexip · reported by MITREHigh 7.5
Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via the Session Initiation Protocol.
- Product
- Pexip Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pexip.comdocs.pexip.com
Jul 17, 2022Pexip Infinity 27.x before 27.3 allows remote attackers to trigger a software abort via single-sign-on if a random Universally Unique Identifier is guessed.CVE-2022-27930 · Other software · Pexip · reported by MITREMedium 5.9
Pexip Infinity 27.x before 27.3 allows remote attackers to trigger a software abort via single-sign-on if a random Universally Unique Identifier is guessed.
- Product
- Pexip Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pexip.comdocs.pexip.com
Jul 17, 2022Pexip Infinity 27.x before 27.3 allows remote attackers to trigger a software abort via HTTP.CVE-2022-27929 · Other software · Pexip · reported by MITREHigh 7.5
Pexip Infinity 27.x before 27.3 allows remote attackers to trigger a software abort via HTTP.
- Product
- Pexip Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pexip.comdocs.pexip.com
Jul 17, 2022Pexip Infinity 27.x before 27.3 allows remote attackers to trigger a software abort via the Session Initiation Protocol.CVE-2022-27928 · Other software · Pexip · reported by MITREHigh 7.5
Pexip Infinity 27.x before 27.3 allows remote attackers to trigger a software abort via the Session Initiation Protocol.
- Product
- Pexip Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pexip.comdocs.pexip.com
Jul 17, 2022Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via One Touch Join.CVE-2022-26657 · Other software · Pexip · reported by MITREHigh 7.5
Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via One Touch Join.
- Product
- Pexip Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pexip.comdocs.pexip.com
Jul 17, 2022Pexip Infinity before 27.3 allows remote attackers to trigger a software abort, and possibly enumerate usernames, via One Touch Join.CVE-2022-26656 · Other software · Pexip · reported by MITREHigh 8.2
Pexip Infinity before 27.3 allows remote attackers to trigger a software abort, and possibly enumerate usernames, via One Touch Join.
- Product
- Pexip Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pexip.comdocs.pexip.com
Jul 17, 2022Pexip Infinity 27.x before 27.3 has Improper Input Validation.CVE-2022-26655 · Other software · Pexip · reported by MITREHigh 7.5
Pexip Infinity 27.x before 27.3 has Improper Input Validation. The client API allows remote attackers to trigger a software abort via a gateway call into Teams.
- Product
- Pexip Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pexip.comdocs.pexip.com
Jul 17, 2022Pexip Infinity before 27.3 allows remote attackers to force a software abort via HTTP.CVE-2022-26654 · Other software · Pexip · reported by MITREHigh 7.5
Pexip Infinity before 27.3 allows remote attackers to force a software abort via HTTP.
- Product
- Pexip Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pexip.comdocs.pexip.com
Jul 17, 2022Pexip Infinity 27.x before 27.2 has Improper Access Control.CVE-2022-25357 · Other software · Pexip · reported by MITREMedium 5.3
Pexip Infinity 27.x before 27.2 has Improper Access Control. An attacker can sometimes join a conference (call join) if it has a lock but not a PIN.
- Product
- Pexip Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pexip.comdocs.pexip.com
May 20, 2022Thinfinity VNC v4.0.0.1 contains a Cross-Origin Resource Sharing (CORS) vulnerability which can allow an unprivileged remote attacker, if they can trick a user CVE-2022-25227 · Other software · Cybelesoft · reported by help@fluidattacks.comHigh 8.8
Thinfinity VNC v4.0.0.1 contains a Cross-Origin Resource Sharing (CORS) vulnerability which can allow an unprivileged remote attacker, if they can trick a user into browse malicious site, to obtain an 'ID' that can be used to send websocket requests and achieve RCE.
- Product
- Thinfinity VNC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comfluidattacks.com
Feb 18, 2022Pexip Infinity before 27.0 has improper WebRTC input validation.CVE-2022-23228 · Other software · Pexip · reported by MITREHigh 7.5
Pexip Infinity before 27.0 has improper WebRTC input validation. An unauthenticated remote attacker can use excessive resources, temporarily causing denial of service.
- Product
- Pexip Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pexip.comdocs.pexip.com
Feb 18, 2022Pexip Infinity Connect before 1.8.0 mishandles TLS certificate validation.CVE-2021-29656 · Other software · Pexip · reported by MITRECritical 9.8
Pexip Infinity Connect before 1.8.0 mishandles TLS certificate validation. The allow list is not properly checked.
- Product
- Infinity Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pexip.comdocs.pexip.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.