Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
220 results · page 2 of 5
Oct 29, 2024Cross Site Scripting vulnerability in TeslaLogger Admin Panel before v.1.59.6 allows a remote attacker to execute arbitrary code via the New Journey field.CVE-2024-48461 · Other software · telsalogger · reported by MITREMedium 4.8
Cross Site Scripting vulnerability in TeslaLogger Admin Panel before v.1.59.6 allows a remote attacker to execute arbitrary code via the New Journey field.
- Product
- admin_panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commohammedshine.github.io
Sep 11, 2024WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes): Arbitrary file movement and readingCVE-2024-7626 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) plugin for WordPress is vulnerable to arbitrary file movement and reading due to insufficient file path validation in the save_edit_profile_details() function in all versions up to, and including, 1.6.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to move arbitrary files on the server, which can easily lead to remote code execution when the right file is moved (such as wp-config.php). This can also lead to the reading of arbitrary files that may contain sensitive information like wp-config.php.
- Product
- WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes)
- Affected
- up to 1.6.9
- What to do
- Affects up to 1.6.9. Update WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 25, 2024PX4-Autopilot v1.14.3 was discovered to contain a buffer overflow via the topic_name parameter at /logger/logged_topics.cpp.CVE-2024-38952 · Other software · dronecode · reported by MITREHigh 7.5
PX4-Autopilot v1.14.3 was discovered to contain a buffer overflow via the topic_name parameter at /logger/logged_topics.cpp.
- Product
- px4_drone_autopilot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2024Stored Cross-Site Scripting (XSS) vulnerabilities have been identified in OpenText ArcSight Logger.CVE-2024-4190 · Other software · OpenText · reported by security@opentext.comHigh 8.4
Stored Cross-Site Scripting (XSS) vulnerabilities have been identified in OpenText ArcSight Logger. The vulnerabilities could be remotely exploited.
- Product
- ArcSight Logger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.microfocus.comportal.microfocus.com
May 14, 2024A deserialization of untrusted data vulnerability exists in common code used by FlexLogger and InstrumentStudio that may result in remote code execution.CVE-2024-4044 · Other software · NI · reported by security@ni.comHigh 7.8
A deserialization of untrusted data vulnerability exists in common code used by FlexLogger and InstrumentStudio that may result in remote code execution. Successful exploitation requires an attacker to get a user to open a specially crafted project file. This vulnerability affects NI FlexLogger 2024 Q1 and prior versions as well as NI InstrumentStudio 2024 Q1 and prior versions.
- Product
- FlexLogger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2024Dell Repository Manager, versions 3.4.2 through 3.4.4,contains a Path Traversal vulnerability in logger module.CVE-2024-28977 · Other software · Dell · reported by security_alert@emc.comLow 3.3
Dell Repository Manager, versions 3.4.2 through 3.4.4,contains a Path Traversal vulnerability in logger module. A local attacker with low privileges could potentially exploit this vulnerability to gain unauthorized read access to the files stored on the server filesystem with the privileges of the running web application.
- Product
- Dell Repository Manager (DRM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2024Zemana AntiLogger v2.74.204.664 is vulnerable to a Denial of Service (DoS) vulnerability by triggering the 0x80002004 and 0x80002010 IOCTL codes of the zam64.syCVE-2024-2204 · Other software · Zemana · reported by help@fluidattacks.comMedium 5.5
Zemana AntiLogger v2.74.204.664 is vulnerable to a Denial of Service (DoS) vulnerability by triggering the 0x80002004 and 0x80002010 IOCTL codes of the zam64.sys and zamguard64.sys drivers.
- Product
- AntiLogger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comzemana.com
Mar 15, 2024Zemana AntiLogger v2.74.204.664 is vulnerable to a Memory Information Leak vulnerability by triggering the 0x80002020 IOCTL code of the zam64.sys and zamguard64CVE-2024-2180 · Other software · Zemana · reported by help@fluidattacks.comMedium 5.5
Zemana AntiLogger v2.74.204.664 is vulnerable to a Memory Information Leak vulnerability by triggering the 0x80002020 IOCTL code of the zam64.sys and zamguard64.sys drivers
- Product
- AntiLogger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comzemana.com
Mar 14, 2024Zemana AntiLogger v2.74.204.664 is vulnerable to an Arbitrary Process Termination vulnerability by triggering the 0x80002048 IOCTL code of the zam64.sys and zamCVE-2024-1853 · Other software · Zemena · reported by help@fluidattacks.comMedium 5.5
Zemana AntiLogger v2.74.204.664 is vulnerable to an Arbitrary Process Termination vulnerability by triggering the 0x80002048 IOCTL code of the zam64.sys and zamguard64.sys drivers.
- Product
- AntiLogger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comzemana.com
Mar 5, 2024A CWE-122 “Heap-based Buffer Overflow” vulnerability in the “logger_generic” function of the “Ax_rtu” binary allows a remote authenticated attacker to trigger aCVE-2023-45591 · Other software · AiLux · reported by prodsec@nozominetworks.comHigh 7.5
A CWE-122 “Heap-based Buffer Overflow” vulnerability in the “logger_generic” function of the “Ax_rtu” binary allows a remote authenticated attacker to trigger a memory corruption in the context of the binary. This may result in a Denial-of-Service (DoS) condition, possibly in the execution of arbitrary code with the same privileges of the process (root), or have other unspecified impacts on the device. This issue affects: AiLux imx6 bundle below version imx6_1.0.7-2.
- Product
- imx6 bundle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnozominetworks.comnozominetworks.com
Jul 12, 2023In DMPixelLogger_ProcessDmCommand of DMPixelLogger.cpp, there is a possible out of bounds read due to a missing bounds check.CVE-2023-35694 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.5
In DMPixelLogger_ProcessDmCommand of DMPixelLogger.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Jul 12, 2023Lana Email Logger: Stored Cross-Site ScriptingCVE-2023-3166 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Lana Email Logger plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, Lana Email Logger due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Lana Email Logger
- Affected
- up to Lana
- What to do
- Affects up to Lana. Update Lana Email Logger to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jun 13, 2023Potential XML External Entity Injection in ArcSight Logger versions prior to 7.3.0.CVE-2023-24470 · Other software · Microfocus · reported by security@opentext.comCritical 9.1
Potential XML External Entity Injection in ArcSight Logger versions prior to 7.3.0.
- Product
- Arcsight Logger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.microfocus.commicrofocus.com
Jun 13, 2023Potential Cross-Site Scripting in ArcSight Logger versions prior to 7.3.0CVE-2023-24469 · Other software · Microfocus · reported by security@opentext.comMedium 6.1
Potential Cross-Site Scripting in ArcSight Logger versions prior to 7.3.0
- Product
- Arcsight Logger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.microfocus.commicrofocus.com
Jun 4, 2023A vulnerability was found in Blogger Importer Plugin up to 0.5 on WordPress.CVE-2013-10027 · WordPress plugins & themes · reported by VulDBMedium 4.3
A vulnerability was found in Blogger Importer Plugin up to 0.5 on WordPress. It has been classified as problematic. Affected is the function start/restart of the file blogger-importer.php. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. Upgrading to version 0.6 is able to address this issue. The patch is identified as b83fa4f862b0f19a54cfee76060ec9c2e7f7ca70. It is recommended to upgrade the affected component. VDB-230658 is the identifier assigned to this vulnerability.
- Product
- Blogger Importer
- Affected
- up to 0.5
- What to do
- Affects up to 0.5. Update Blogger Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 22, 2023Improper authentication vulnerability in T&D Corporation and ESPEC MIC CORP.CVE-2023-27388 · Other software · T&D Corporation and ESPEC MIC CORP. · reported by vultures@jpcert.or.jpCritical 9.8
Improper authentication vulnerability in T&D Corporation and ESPEC MIC CORP. data logger products allows a remote unauthenticated attacker to login to the product as a registered user. Affected products and versions are as follows: T&D Corporation data logger products (TR-71W/72W all firmware versions, RTR-5W all firmware versions, WDR-7 all firmware versions, WDR-3 all firmware versions, and WS-2 all firmware versions), and ESPEC MIC CORP. data logger products (RT-12N/RS-12N all firmware versions, RT-22BN all firmware versions, and TEU-12N all firmware versions).
- Product
- T&D Corporation and ESPEC MIC CORP. data logger products
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpmonitoring.especmic.co.jp
May 22, 2023Cross-site request forgery (CSRF) in T&D Corporation and ESPEC MIC CORP.CVE-2023-27387 · Other software · T&D Corporation and ESPEC MIC CORP. · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) in T&D Corporation and ESPEC MIC CORP. data logger products allows a remote unauthenticated attacker to conduct an arbitrary operation by having a logged-in user view a malicious page. Affected products and versions are as follows: T&D Corporation data logger products (TR-71W/72W all firmware versions, RTR-5W all firmware versions, WDR-7 all firmware versions, WDR-3 all firmware versions, and WS-2 all firmware versions), and ESPEC MIC CORP. data logger products (RT-12N/RS-12N all firmware versions, RT-22BN all firmware versions, and TEU-12N all firmware versions).
- Product
- T&D Corporation and ESPEC MIC CORP. data logger products
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpmonitoring.especmic.co.jp
May 22, 2023Missing authentication for critical function exists in T&D Corporation and ESPEC MIC CORP.CVE-2023-23545 · Other software · T&D Corporation and ESPEC MIC CORP. · reported by vultures@jpcert.or.jpMedium 5.3
Missing authentication for critical function exists in T&D Corporation and ESPEC MIC CORP. data logger products, which may allow a remote unauthenticated attacker to alter the product settings without authentication. Affected products and versions are as follows: T&D Corporation data logger products (TR-71W/72W all firmware versions, RTR-5W all firmware versions, WDR-7 all firmware versions, WDR-3 all firmware versions, and WS-2 all firmware versions), and ESPEC MIC CORP. data logger products (RT-12N/RS-12N all firmware versions, RT-22BN all firmware versions, and TEU-12N all firmware versions).
- Product
- T&D Corporation and ESPEC MIC CORP. data logger products
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpmonitoring.especmic.co.jp
May 22, 2023Client-side enforcement of server-side security issue exists in T&D Corporation and ESPEC MIC CORP.CVE-2023-22654 · Other software · T&D Corporation and ESPEC MIC CORP. · reported by vultures@jpcert.or.jpMedium 5.4
Client-side enforcement of server-side security issue exists in T&D Corporation and ESPEC MIC CORP. data logger products, which may lead to an arbitrary script execution on a logged-in user's web browser. Affected products and versions are as follows: T&D Corporation data logger products (TR-71W/72W all firmware versions, RTR-5W all firmware versions, WDR-7 all firmware versions, WDR-3 all firmware versions, and WS-2 all firmware versions), and ESPEC MIC CORP. data logger products (RT-12N/RS-12N all firmware versions, RT-22BN all firmware versions, and TEU-12N all firmware versions).
- Product
- T&D Corporation and ESPEC MIC CORP. data logger products
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpmonitoring.especmic.co.jp
Jan 26, 2023Campbell Scientific dataloggers CR6, CR300, CR800, CR1000 and CR3000 may allow an attacker to download configuration files, which may contain sensitive informatCVE-2023-0321 · Other software · Campbell Scientific · reported by cve-coordination@incibe.esCritical 9.1
Campbell Scientific dataloggers CR6, CR300, CR800, CR1000 and CR3000 may allow an attacker to download configuration files, which may contain sensitive information about the internal network. From factory defaults, the mentioned datalogges have HTTP and PakBus enabled. The devices, with the default configuration, allow this situation via the PakBus port. The exploitation of this vulnerability may allow an attacker to download, modify, and upload new configuration files.
- Product
- CR6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackplayers.comincibe-cert.es
Dec 27, 2022Unsanitized input in the default logger in github.com/gin-gonic/gin before v1.6.0 allows remote attackers to inject arbitrary log lines.CVE-2020-36567 · Other software · github.com/gin-gonic/gin · reported by security@golang.orgHigh 7.5
Unsanitized input in the default logger in github.com/gin-gonic/gin before v1.6.0 allows remote attackers to inject arbitrary log lines.
- Product
- github.com/gin-gonic/gin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2022A sequence injection vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 which could allow is a possible shell escape in the Lint and CommonLogger compCVE-2022-30123 · Other software · Rack Project · reported by support@hackerone.comCritical 10
A sequence injection vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 which could allow is a possible shell escape in the Lint and CommonLogger components of Rack.
- Product
- Rack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.rubyonrails.orgsecurity.gentoo.org
Oct 17, 2022Search Logger: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-3131 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Search Logger WordPress plugin through 0.9 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users
- Product
- Search Logger
- Affected
- up to 0.9
- What to do
- Affects up to 0.9. Update Search Logger to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 31, 2022Potential vulnerabilities have been identified in Micro Focus ArcSight Logger.CVE-2022-26331 · Other software · Micro Focus · reported by security@opentext.comMedium 6.1
Potential vulnerabilities have been identified in Micro Focus ArcSight Logger. The vulnerabilities could be remotely exploited resulting in Information Disclosure, or Self Cross-Site Scripting (XSS). This issue affects: Micro Focus ArcSight Logger versions prior to v7.2.2 version and prior versions.
- Product
- Micro Focus ArcSight Logger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.microfocus.commicrofocus.com
Aug 31, 2022Potential vulnerabilities have been identified in Micro Focus ArcSight Logger.CVE-2022-26330 · Other software · Micro Focus · reported by security@opentext.comMedium 6.5
Potential vulnerabilities have been identified in Micro Focus ArcSight Logger. The vulnerabilities could be remotely exploited resulting in Information Disclosure, or Self Cross-Site Scripting (XSS). This issue affects: Micro Focus ArcSight Logger versions prior to v7.2.2 version and prior versions.
- Product
- Micro Focus ArcSight Logger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.microfocus.commicrofocus.com
May 24, 2022Merchandise Online Store 1.0 is vulnerable to SQL Injection via /vloggers_merch/classes/Master.php?f=delete_product.CVE-2022-30454 · Other software · Merchandise Online Store Project · reported by MITRECritical 9.8
Merchandise Online Store 1.0 is vulnerable to SQL Injection via /vloggers_merch/classes/Master.php?f=delete_product.
- Product
- Merchandise Online Store
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2022Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/?p=products&c=.CVE-2022-30403 · Other software · Merchandise Online Store Product · reported by MITREHigh 7.2
Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/?p=products&c=.
- Product
- Merchandise Online Store
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2022Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/admin/?page=maintenance/manage_sub_category&id=.CVE-2022-30402 · Other software · Merchandise Online Store Project · reported by MITREHigh 7.2
Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/admin/?page=maintenance/manage_sub_category&id=.
- Product
- Merchandise Online Store
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2022Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/?p=view_product&id=.CVE-2022-30401 · Other software · Merchandise Online Store Project · reported by MITREHigh 7.2
Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/?p=view_product&id=.
- Product
- Merchandise Online Store
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2022Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/admin/orders/view_order.php?view=user&id=.CVE-2022-30400 · Other software · Merchandise Online Store Project · reported by MITREHigh 7.2
Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/admin/orders/view_order.php?view=user&id=.
- Product
- Merchandise Online Store
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2022Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/admin/?page=maintenance/manage_category&id=.CVE-2022-30399 · Other software · Merchandise Online Store Project · reported by MITREHigh 7.2
Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/admin/?page=maintenance/manage_category&id=.
- Product
- Merchandise Online Store
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2022Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/admin/?page=orders/view_order&id=.CVE-2022-30398 · Other software · Merchandise Online Store Project · reported by MITREHigh 7.2
Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/admin/?page=orders/view_order&id=.
- Product
- Merchandise Online Store
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2022Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/admin/?page=inventory/manage_inventory&id=.CVE-2022-30396 · Other software · Merchandise Online Store Project · reported by MITREHigh 7.2
Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/admin/?page=inventory/manage_inventory&id=.
- Product
- Merchandise Online Store
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2022Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/classes/Master.php?f=delete_cart.CVE-2022-30395 · Other software · Merchandise Online Store Project · reported by MITRECritical 9.8
Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/classes/Master.php?f=delete_cart.
- Product
- Merchandise Online Store
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2022Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/admin/?page=product/manage_product&id=.CVE-2022-30393 · Other software · Merchandise Online Store Project · reported by MITREHigh 7.2
Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/admin/?page=product/manage_product&id=.
- Product
- Merchandise Online Store
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2022Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/classes/Master.php?f=delete_sub_category.CVE-2022-30392 · Other software · Merchandise Online Store Project · reported by MITRECritical 9.8
Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/classes/Master.php?f=delete_sub_category.
- Product
- Merchandise Online Store
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2022Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/classes/Master.php?f=delete_category.CVE-2022-30391 · Other software · Merchandise Online Store Project · reported by MITRECritical 9.8
Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/classes/Master.php?f=delete_category.
- Product
- Merchandise Online Store
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2022Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/classes/Master.php?f=pay_order.CVE-2022-30387 · Other software · Merchandise Online Store Project · reported by MITRECritical 9.8
Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/classes/Master.php?f=pay_order.
- Product
- Merchandise Online Store
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2022Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/classes/Master.php?f=delete_featured.CVE-2022-30386 · Other software · Merchandise Online Store Project · reported by MITRECritical 9.8
Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/classes/Master.php?f=delete_featured.
- Product
- Merchandise Online Store
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2022Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/classes/Master.php?f=delete_order.CVE-2022-30385 · Other software · Merchandise Online Store Project · reported by MITRECritical 9.8
Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/classes/Master.php?f=delete_order.
- Product
- Merchandise Online Store
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2022Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/classes/Master.php?f=delete_inventory.CVE-2022-30384 · Other software · Merchandise Online Store Project · reported by MITRECritical 9.8
Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/classes/Master.php?f=delete_inventory.
- Product
- Merchandise Online Store
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2022Merchandise Online Store v1.0 is vulnerable to file deletion via /vloggers_merch/classes/Master.php?f=delete_img.CVE-2022-30381 · Other software · Merchandise Online Store Project · reported by MITREMedium 6.5
Merchandise Online Store v1.0 is vulnerable to file deletion via /vloggers_merch/classes/Master.php?f=delete_img.
- Product
- Merchandise Online Store
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2022A reflected cross site scripting (XSS) vulnerability in Xtend Voice Logger 1.0 allows attackers to execute arbitrary web scripts or HTML, via the path of the erCVE-2020-23618 · Other software · Xtendtech · reported by MITREMedium 6.1
A reflected cross site scripting (XSS) vulnerability in Xtend Voice Logger 1.0 allows attackers to execute arbitrary web scripts or HTML, via the path of the error page.
- Product
- Voice Logger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordxtendtech.comgist.github.com
Apr 21, 2022There is a cross-site scripting (XSS) vulnerability in an NI Web Server component installed with several NI products.CVE-2022-27237 · Other software · NI · reported by MITREMedium 6.1
There is a cross-site scripting (XSS) vulnerability in an NI Web Server component installed with several NI products. Depending on the product(s) in use, remediation guidance includes: install SystemLink version 2021 R3 or later, install FlexLogger 2022 Q2 or later, install LabVIEW 2021 SP1, install G Web Development 2022 R1 or later, or install Static Test Software Suite version 1.2 or later.
- Product
- Flexlogger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2022In connsyslogger, there is a possible symbolic link following due to improper link resolution.CVE-2022-20050 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comMedium 6.7
In connsyslogger, there is a possible symbolic link following due to improper link resolution. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06335038; Issue ID: ALPS06335038.
- Product
- MT6762, MT6765, MT6768, MT6769, MT6779, MT6781, MT6785, MT6795, MT6797, MT6799, MT6833, MT6853, MT6853T, MT6873, MT6875, MT6877, MT6880, MT6883, MT6885, MT6889,
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcorp.mediatek.comcorp.mediatek.com
Jan 10, 2022Implicit Intent hijacking vulnerability in ActivityMetricsLogger prior to SMR Jan-2022 Release 1 allows attackers to get running application information.CVE-2022-22267 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4
Implicit Intent hijacking vulnerability in ActivityMetricsLogger prior to SMR Jan-2022 Release 1 allows attackers to get running application information.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Sep 6, 2021ulfius_uri_logger in Ulfius HTTP Framework before 2.7.4 omits con_info initialization and a con_info->request NULL check for certain malformed HTTP requests.CVE-2021-40540 · Other software · Ulfius Project · reported by MITRECritical 9.8
ulfius_uri_logger in Ulfius HTTP Framework before 2.7.4 omits con_info initialization and a con_info->request NULL check for certain malformed HTTP requests.
- Product
- Ulfius
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
May 7, 2021Out of bound write in logger due to prefix size is not validated while prepended to logging string in Snapdragon Auto, Snapdragon Compute, Snapdragon ConnectiviCVE-2020-11294 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 5.9
Out of bound write in logger due to prefix size is not validated while prepended to logging string in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
- Product
- Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Apr 5, 2021JH 404 Logger: Doesn't sanitise the referer and path of 404 pagesCVE-2021-24176 · WordPress plugins & themes · reported by WPScanMedium 5.4
The JH 404 Logger WordPress plugin through 1.1 doesn't sanitise the referer and path of 404 pages, when they are output in the dashboard, which leads to executing arbitrary JavaScript code in the WordPress dashboard.
- Product
- JH 404 Logger
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update JH 404 Logger to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordganofins.comwpscan.com
Mar 4, 2021SonLogger before 6.4.1 is affected by Unauthenticated Arbitrary File Upload.CVE-2021-27964 · Other software · Sfcyazilim · reported by MITRECritical 9.8
SonLogger before 6.4.1 is affected by Unauthenticated Arbitrary File Upload. An attacker can send a POST request to /Config/SaveUploadedHotspotLogoFile without any authentication or session header. There is no check for the file extension or content of the uploaded file.
- Product
- Sonlogger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.