Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
91 results · page 2 of 2
May 7, 2024Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults.CVE-2024-34346 · Other software · denoland · reported by GitHubHigh 8.4
Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. The Deno sandbox may be unexpectedly weakened by allowing file read/write access to privileged files in various locations on Unix and Windows platforms. For example, reading `/proc/self/environ` may provide access equivalent to `--allow-env`, and writing `/proc/self/mem` may provide access equivalent to `--allow-all`. Users who grant read and write access to the entire filesystem may not realize that these access to these files may have additional, unintended consequences. The documentation did not reflect that this practice should be undertaken to increase the strength of the security sandbox. Users who run code with `--allow-read` or `--allow-write` may unexpectedly end up granting additional permissions via file-system operations. Deno 1.43 and above require explicit `--allow-all` access to read or write `/etc`, `/dev` on unix platform (as well as `/proc` and `/sys` on linux platforms), and any path starting with `\\` on Windows.
- Product
- deno
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 18, 2024Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults.CVE-2024-32477 · Other software · denoland · reported by GitHubHigh 7.7
Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. By using ANSI escape sequences and a race between `libc::tcflush(0, libc::TCIFLUSH)` and reading standard input, it's possible to manipulate the permission prompt and force it to allow an unsafe action regardless of the user input. Some ANSI escape sequences act as a info request to the master terminal emulator and the terminal emulator sends back the reply in the PTY channel. standard streams also use this channel to send and get data. For example the `\033[6n` sequence requests the current cursor position. These sequences allow us to append data to the standard input of Deno. This vulnerability allows an attacker to bypass Deno permission policy. This vulnerability is fixed in 1.42.2.
- Product
- deno
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2024Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults.CVE-2024-27936 · Other software · denoland · reported by GitHubHigh 8.8
Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. Starting in version 1.32.1 and prior to version 1.41.0 of the deno library, maliciously crafted permission request can show the spoofed permission prompt by inserting a broken ANSI escape sequence into the request contents. Deno is stripping any ANSI escape sequences from the permission prompt, but permissions given to the program are based on the contents that contain the ANSI escape sequences. Any Deno program can spoof the content of the interactive permission prompt by inserting a broken ANSI code, which allows a malicious Deno program to display the wrong file path or program name to the user. Version 1.41.0 of the deno library contains a patch for the issue.
- Product
- deno
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2024Deno is a JavaScript, TypeScript, and WebAssembly runtime.CVE-2024-27935 · Other software · denoland · reported by GitHubHigh 7.2
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.35.1 and prior to version 1.36.3, a vulnerability in Deno's Node.js compatibility runtime allows for cross-session data contamination during simultaneous asynchronous reads from Node.js streams sourced from sockets or files. The issue arises from the re-use of a global buffer (BUF) in stream_wrap.ts used as a performance optimization to limit allocations during these asynchronous read operations. This can lead to data intended for one session being received by another session, potentially resulting in data corruption and unexpected behavior. This affects all users of Deno that use the node.js compatibility layer for network communication or other streams, including packages that may require node.js libraries indirectly. Version 1.36.3 contains a patch for this issue.
- Product
- deno
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2024Deno is a JavaScript, TypeScript, and WebAssembly runtime.CVE-2024-27934 · Other software · denoland · reported by GitHubHigh 8.4
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.36.2 and prior to version 1.40.3, use of inherently unsafe `*const c_void` and `ExternalPointer` leads to use-after-free access of the underlying structure, resulting in arbitrary code execution. Use of inherently unsafe `*const c_void` and `ExternalPointer` leads to use-after-free access of the underlying structure, which is exploitable by an attacker controlling the code executed inside a Deno runtime to obtain arbitrary code execution on the host machine regardless of permissions. This bug is known to be exploitable for both `*const c_void` and `ExternalPointer` implementations. Version 1.40.3 fixes this issue.
- Product
- deno
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2024Deno is a JavaScript, TypeScript, and WebAssembly runtime.CVE-2024-27933 · Other software · denoland · reported by GitHubHigh 8.2
Deno is a JavaScript, TypeScript, and WebAssembly runtime. In version 1.39.0, use of raw file descriptors in `op_node_ipc_pipe()` leads to premature close of arbitrary file descriptors, allowing standard input to be re-opened as a different resource resulting in permission prompt bypass. Node child_process IPC relies on the JS side to pass the raw IPC file descriptor to `op_node_ipc_pipe()`, which returns a `IpcJsonStreamResource` ID associated with the file descriptor. On closing the resource, the raw file descriptor is closed together. Use of raw file descriptors in `op_node_ipc_pipe()` leads to premature close of arbitrary file descriptors. This allow standard input (fd 0) to be closed and re-opened for a different resource, which allows a silent permission prompt bypass. This is exploitable by an attacker controlling the code executed inside a Deno runtime to obtain arbitrary code execution on the host machine regardless of permissions. This bug is known to be exploitable. There is a working exploit that achieves arbitrary code execution by bypassing prompts from zero permissions, additionally abusing the fact that Cache API lacks filesystem permission checks. The attack can
- Product
- deno
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2024Deno is a JavaScript, TypeScript, and WebAssembly runtime.CVE-2024-27932 · Other software · denoland · reported by GitHubMedium 4.6
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.8.0 and prior to version 1.40.4, Deno improperly checks that an import specifier's hostname is equal to or a child of a token's hostname, which can cause tokens to be sent to servers they shouldn't be sent to. An auth token intended for `example[.]com` may be sent to `notexample[.]com`. Anyone who uses DENO_AUTH_TOKENS and imports potentially untrusted code is affected. Version 1.40.0 contains a patch for this issue
- Product
- deno
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2024OpenOlat is an open source web-based e-learning platform for teaching, learning, assessment and communication.CVE-2024-28198 · Other software · OpenOLAT · reported by GitHubMedium 4.6
OpenOlat is an open source web-based e-learning platform for teaching, learning, assessment and communication. By manually manipulating http requests when using the draw.io integration it is possible to read arbitrary files as the configured system user and SSRF. The problem is fixed in version 18.1.6 and 18.2.2. It is advised to upgrade to the latest version of 18.1.x or 18.2.x. Users unable to upgrade may work around this issue by disabling the Draw.io module or the entire REST API which will secure the system.
- Product
- OpenOLAT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2024Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults.CVE-2024-27931 · Other software · denoland · reported by GitHubMedium 5.8
Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. Insufficient validation of parameters in `Deno.makeTemp*` APIs would allow for creation of files outside of the allowed directories. This may allow the user to overwrite important files on the system that may affect other systems. A user may provide a prefix or suffix to a `Deno.makeTemp*` API containing path traversal characters. This is fixed in Deno 1.41.1.
- Product
- deno
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2024The Frentix GmbH OpenOlat LMS is affected by stored a Cross-Site Scripting (XSS) vulnerability.CVE-2024-25974 · Other software · Frentix GmbH · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfMedium 5.4
The Frentix GmbH OpenOlat LMS is affected by stored a Cross-Site Scripting (XSS) vulnerability. It is possible to upload files within the Media Center of OpenOlat version 18.1.5 (or lower) as an authenticated user without any other rights. Although the filetypes are limited, an SVG image containing an XSS payload can be uploaded. After a successful upload the file can be shared with groups of users (including admins) who can be attacked with the JavaScript payload.
- Product
- OpenOlat LMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgr.sec-consult.com
Feb 20, 2024The Frentix GmbH OpenOlat LMS is affected by multiple stored Cross-Site Scripting (XSS) vulnerabilities.CVE-2024-25973 · Other software · Frentix GmbH · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfMedium 5.4
The Frentix GmbH OpenOlat LMS is affected by multiple stored Cross-Site Scripting (XSS) vulnerabilities. An attacker with rights to create or edit groups can create a course with a name that contains an XSS payload. Furthermore, attackers with the permissions to create or rename a catalog (sub-category) can enter unfiltered input in the name field. In addition, attackers who are allowed to create curriculums can also enter unfiltered input in the name field. This allows an attacker to execute stored JavaScript code with the permissions of the victim in the context of the user's browser.
- Product
- OpenOlat LMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgr.sec-consult.com
Sep 27, 2023xrdp is an open source remote desktop protocol server.CVE-2023-42822 · Other software · neutrinolabs · reported by GitHubMedium 4.6
xrdp is an open source remote desktop protocol server. Access to the font glyphs in xrdp_painter.c is not bounds-checked . Since some of this data is controllable by the user, this can result in an out-of-bounds read within the xrdp executable. The vulnerability allows an out-of-bounds read within a potentially privileged process. On non-Debian platforms, xrdp tends to run as root. Potentially an out-of-bounds write can follow the out-of-bounds read. There is no denial-of-service impact, providing xrdp is running in forking mode. This issue has been addressed in release 0.9.23.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- xrdp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2023xrdp is an open source remote desktop protocol (RDP) server.CVE-2023-40184 · Other software · neutrinolabs · reported by GitHubLow 2.6
xrdp is an open source remote desktop protocol (RDP) server. In versions prior to 0.9.23 improper handling of session establishment errors allows bypassing OS-level session restrictions. The `auth_start_session` function can return non-zero (1) value on, e.g., PAM error which may result in in session restrictions such as max concurrent sessions per user by PAM (ex ./etc/security/limits.conf) to be bypassed. Users (administrators) don't use restrictions by PAM are not affected. This issue has been addressed in release version 0.9.23. Users are advised to upgrade. There are no known workarounds for this issue.
- Product
- xrdp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 31, 2023Deno is a runtime for JavaScript and TypeScript.CVE-2023-33966 · Other software · denoland · reported by GitHubHigh 8.6
Deno is a runtime for JavaScript and TypeScript. In deno 1.34.0 and deno_runtime 0.114.0, outbound HTTP requests made using the built-in `node:http` or `node:https` modules are incorrectly not checked against the network permission allow list (`--allow-net`). Dependencies relying on these built-in modules are subject to the vulnerability too. Users of Deno versions prior to 1.34.0 are unaffected. Deno Deploy users are unaffected. This problem has been patched in Deno v1.34.1 and deno_runtime 0.114.1 and all users are recommended to update to this version. No workaround is available for this issue.
- Product
- deno
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2023Deno is a simple, modern and secure runtime for JavaScript and TypeScript that uses V8 and is built in Rust.CVE-2023-28446 · Other software · denoland · reported by GitHubHigh 8.8
Deno is a simple, modern and secure runtime for JavaScript and TypeScript that uses V8 and is built in Rust. Arbitrary program names without any ANSI filtering allows any malicious program to clear the first 2 lines of a `op_spawn_child` or `op_kill` prompt and replace it with any desired text. This works with any command on the respective platform, giving the program the full ability to choose what program they wanted to run. This problem can not be exploited on systems that do not attach an interactive prompt (for example headless servers). This issue has been patched in version 1.31.2.
- Product
- deno
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2023Deno is a runtime for JavaScript and TypeScript that uses V8 and is built in Rust.CVE-2023-28445 · Other software · denoland · reported by GitHubCritical 9.9
Deno is a runtime for JavaScript and TypeScript that uses V8 and is built in Rust. Resizable ArrayBuffers passed to asynchronous functions that are shrunk during the asynchronous operation could result in an out-of-bound read/write. It is unlikely that this has been exploited in the wild, as the only version affected is Deno 1.32.0. Deno Deploy users are not affected. The problem has been resolved by disabling resizable ArrayBuffers temporarily in Deno 1.32.1. Deno 1.32.2 will re-enable resizable ArrayBuffers with a proper fix. As a workaround, run with `--v8-flags=--no-harmony-rab-gsab` to disable resizable ArrayBuffers.
- Product
- deno
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2023Deno is a runtime for JavaScript and TypeScript that uses V8 and is built in Rust.CVE-2023-22499 · Other software · denoland · reported by GitHubHigh 7.5
Deno is a runtime for JavaScript and TypeScript that uses V8 and is built in Rust. Multi-threaded programs were able to spoof interactive permission prompt by rewriting the prompt to suggest that program is waiting on user confirmation to unrelated action. A malicious program could clear the terminal screen after permission prompt was shown and write a generic message. This situation impacts users who use Web Worker API and relied on interactive permission prompt. The reproduction is very timing sensitive and can’t be reliably reproduced on every try. This problem can not be exploited on systems that do not attach an interactive prompt (for example headless servers). The problem has been fixed in Deno v1.29.3; it is recommended all users update to this version. Users are advised to upgrade. Users unable to upgrade may run with --no-prompt flag to disable interactive permission prompts.
- Product
- deno
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2022xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP).CVE-2022-23493 · Other software · neutrinolabs · reported by GitHubCritical 9.1
xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Read in xrdp_mm_trans_process_drdynvc_channel_close() function. There are no known workarounds for this issue. Users are advised to upgrade.
- Product
- xrdp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2022xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP).CVE-2022-23484 · Other software · neutrinolabs · reported by GitHubHigh 8.2
xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a Integer Overflow in xrdp_mm_process_rail_update_window_text() function. There are no known workarounds for this issue. Users are advised to upgrade.
- Product
- xrdp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2022xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP).CVE-2022-23483 · Other software · neutrinolabs · reported by GitHubHigh 7.5
xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Read in libxrdp_send_to_channel() function. There are no known workarounds for this issue. Users are advised to upgrade.
- Product
- xrdp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2022xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP).CVE-2022-23482 · Other software · neutrinolabs · reported by GitHubNone
xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Read in xrdp_sec_process_mcs_data_CS_CORE() function. There are no known workarounds for this issue. Users are advised to upgrade.
- Product
- xrdp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2022xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP).CVE-2022-23481 · Other software · neutrinolabs · reported by GitHubNone
xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Read in xrdp_caps_process_confirm_active() function. There are no known workarounds for this issue. Users are advised to upgrade.
- Product
- xrdp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2022xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP).CVE-2022-23480 · Other software · neutrinolabs · reported by GitHubCritical 9.1
xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a buffer over flow in devredir_proc_client_devlist_announce_req() function. There are no known workarounds for this issue. Users are advised to upgrade.
- Product
- xrdp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2022xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP).CVE-2022-23479 · Other software · neutrinolabs · reported by GitHubCritical 9.1
xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a buffer over flow in xrdp_mm_chan_data_in() function. There are no known workarounds for this issue. Users are advised to upgrade.
- Product
- xrdp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2022xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP).CVE-2022-23478 · Other software · neutrinolabs · reported by GitHubCritical 9.1
xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Write in xrdp_mm_trans_process_drdynvc_channel_open() function. There are no known workarounds for this issue. Users are advised to upgrade.
- Product
- xrdp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2022xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP).CVE-2022-23477 · Other software · neutrinolabs · reported by GitHubCritical 9.1
xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a buffer over flow in audin_send_open() function. There are no known workarounds for this issue. Users are advised to upgrade.
- Product
- xrdp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2022xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP).CVE-2022-23468 · Other software · neutrinolabs · reported by GitHubMedium 6.5
xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a buffer over flow in xrdp_login_wnd_create() function. There are no known workarounds for this issue. Users are advised to upgrade.
- Product
- xrdp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2022Deno is a runtime for JavaScript and TypeScript.CVE-2022-24783 · Other software · denoland · reported by GitHubCritical 10
Deno is a runtime for JavaScript and TypeScript. The versions of Deno between release 1.18.0 and 1.20.2 (inclusive) are vulnerable to an attack where a malicious actor controlling the code executed in a Deno runtime could bypass all permission checks and execute arbitrary shell code. This vulnerability does not affect users of Deno Deploy. The vulnerability has been patched in Deno 1.20.3. There is no workaround. All users are recommended to upgrade to 1.20.3 immediately.
- Product
- deno
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 7, 2022xrdp is an open source remote desktop protocol (RDP) server.CVE-2022-23613 · Other software · neutrinolabs · reported by GitHubHigh 7.8
xrdp is an open source remote desktop protocol (RDP) server. In affected versions an integer underflow leading to a heap overflow in the sesman server allows any unauthenticated attacker which is able to locally access a sesman server to execute code as root. This vulnerability has been patched in version 0.9.18.1 and above. Users are advised to upgrade. There are no known workarounds.
- Product
- xrdp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2021OpenOlat is a web-basedlearning management system.CVE-2021-41242 · Other software · OpenOLAT · reported by GitHubHigh 8.1
OpenOlat is a web-basedlearning management system. A path traversal vulnerability exists in OpenOlat prior to versions 15.5.12 and 16.0.5. By providing a filename that contains a relative path as a parameter in some REST methods, it is possible to create directory structures and write files anywhere on the target system. The attack could be used to write files anywhere in the web root folder or outside, depending on the configuration of the system and the properly configured permission of the application server user. The attack requires an OpenOlat user account, an enabled REST API and the rights on a business object to call the vulnerable REST calls. The problem is fixed in version 15.5.12 and 16.0.5. There is a workaround available. The vulnerability requires the REST module to be enabled. Disabling the REST module or limiting the REST module via some firewall or web-server access rules to be accessed only be trusted systems will mitigate the risk.
- Product
- OpenOLAT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2021OpenOlat is a web-based e-learning platform for teaching, learning, assessment and communication, an LMS, a learning management system.CVE-2021-41152 · Other software · OpenOLAT · reported by GitHubHigh 7.7
OpenOlat is a web-based e-learning platform for teaching, learning, assessment and communication, an LMS, a learning management system. In affected versions by manipulating the HTTP request an attacker can modify the path of a requested file download in the folder component to point to anywhere on the target system. The attack could be used to read any file accessible in the web root folder or outside, depending on the configuration of the system and the properly configured permission of the application server user. The attack requires an OpenOlat user account or the enabled guest user feature together with the usage of the folder component in a course. The attack does not allow writing of arbitrary files, it allows only reading of files and also only ready of files that the attacker knows the exact path which is very unlikely at least for OpenOlat data files. The problem is fixed in version 15.5.8 and 16.0.1 It is advised to upgrade to version 16.0.x. There are no known workarounds to fix this problem, an upgrade is necessary.
- Product
- OpenOLAT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2021OpenOlat is a web-based learning management system (LMS).CVE-2021-39181 · Other software · OpenOLAT · reported by GitHubHigh 8.8
OpenOlat is a web-based learning management system (LMS). Prior to version 15.3.18, 15.5.3, and 16.0.0, using a prepared import XML file (e.g. a course) any class on the Java classpath can be instantiated, including spring AOP bean factories. This can be used to execute code arbitrary code by the attacker. The attack requires an OpenOlat user account with the authoring role. It can not be exploited by unregistered users. The problem is fixed in versions 15.3.18, 15.5.3, and 16.0.0. There are no known workarounds aside from upgrading.
- Product
- OpenOLAT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2021OpenOLAT is a web-based learning management system (LMS).CVE-2021-39180 · Other software · OpenOLAT · reported by GitHubHigh 8.1
OpenOLAT is a web-based learning management system (LMS). A path traversal vulnerability exists in versions prior to 15.3.18, 15.5.3, and 16.0.0. Using a specially prepared ZIP file, it is possible to overwrite any file that is writable by the application server user (e.g. the tomcat user). Depending on the configuration this can be limited to files of the OpenOlat user data directory, however, if not properly set up, the attack could also be used to overwrite application server config files, java code or even operating system files. The attack could be used to corrupt or modify any OpenOlat file such as course structures, config files or temporary test data. Those attack would require in-depth knowledge of the installation and thus more theoretical. If the app server configuration allows the execution of jsp files and the path to the context is known, it is also possible to execute java code. If the app server runs with the same user that is used to deploy the OpenOlat code or has write permissions on the OpenOlat code files and the path to the context is know, code injection is possible. The attack requires an OpenOlat user account to upload a ZIP file and trigger the unzip metho
- Product
- OpenOLAT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 28, 2021Deno is a runtime for JavaScript and TypeScript that uses V8 and is built in Rust.CVE-2021-32619 · Other software · denoland · reported by GitHubCritical 9.8
Deno is a runtime for JavaScript and TypeScript that uses V8 and is built in Rust. In Deno versions 1.5.0 to 1.10.1, modules that are dynamically imported through `import()` or `new Worker` might have been able to bypass network and file system permission checks when statically importing other modules. The vulnerability has been patched in Deno release 1.10.2.
- Product
- deno
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2020Nolan Ray from Apple Information Security identified a security vulnerability in Spinnaker, all versions prior to version 1.23.4, 1.22.4 or 1.21.5.CVE-2020-9301 · Computers, phones & browsers · Linuxfoundation · reported by security-report@netflix.comHigh 8.8
Nolan Ray from Apple Information Security identified a security vulnerability in Spinnaker, all versions prior to version 1.23.4, 1.22.4 or 1.21.5. The vulnerability exists within the handling of SpEL expressions that allows an attacker to read and write arbitrary files within the orca container via authenticated HTTP POST requests.
- Product
- Spinnaker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2020The xrdp-sesman service before version 0.9.13.1 can be crashed by connecting over port 3350 and supplying a malicious payload.CVE-2020-4044 · Other software · neutrinolabs · reported by GitHubHigh 7.5
The xrdp-sesman service before version 0.9.13.1 can be crashed by connecting over port 3350 and supplying a malicious payload. Once the xrdp-sesman process is dead, an unprivileged attacker on the server could then proceed to start their own imposter sesman service listening on port 3350. This will allow them to capture any user credentials that are submitted to XRDP and approve or reject arbitrary login credentials. For xorgxrdp sessions in particular, this allows an unauthorized user to hijack an existing session. This is a buffer overflow attack, so there may be a risk of arbitrary code execution as well.
- Product
- xrdp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Jul 4, 2018The mint function of a smart contract implementation for Unolabo (UNLB), an Ethereum token, has an integer overflow that allows the owner of the contract to setCVE-2018-13189 · Other software · Unolabo Project · reported by MITREHigh 7.5
The mint function of a smart contract implementation for Unolabo (UNLB), an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
- Product
- Unolabo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 23, 2017The scp_v0s_accept function in sesman/libscp/libscp_v0.c in the session manager in xrdp through 0.9.4 uses an untrusted integer as a write length, which allows CVE-2017-16927 · Other software · Neutrinolabs · reported by MITREHigh 8.4
The scp_v0s_accept function in sesman/libscp/libscp_v0.c in the session manager in xrdp through 0.9.4 uses an untrusted integer as a write length, which allows local users to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted input stream.
- Product
- Xrdp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgroups.google.com
Mar 17, 2017xrdp 0.9.1 calls the PAM function auth_start_session() in an incorrect location, leading to PAM session modules not being properly initialized, with a potentialCVE-2017-6967 · Other software · Neutrinolabs · reported by MITREHigh 7.3
xrdp 0.9.1 calls the PAM function auth_start_session() in an incorrect location, leading to PAM session modules not being properly initialized, with a potential consequence of incorrect configurations or elevation of privileges, aka a pam_limits.so bypass.
- Product
- Xrdp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.launchpad.netgithub.com
Dec 16, 2016An issue was discovered in xrdp before 0.9.1.CVE-2013-1430 · Other software · Neutrinolabs · reported by security@debian.orgCritical 9.8
An issue was discovered in xrdp before 0.9.1. When successfully logging in using RDP into an xrdp session, the file ~/.vnc/sesman_${username}_passwd is created. Its content is the equivalent of the user's cleartext password, DES encrypted with a known key.
- Product
- Xrdp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comgithub.com
Dec 31, 2002The document management module in NOLA 1.1.1 and 1.1.2 does not restrict the types of files that are uploaded, which allows remote attackers to upload and execuCVE-2002-1841 · Other software · Noguska · reported by MITREMedium 5
The document management module in NOLA 1.1.1 and 1.1.2 does not restrict the types of files that are uploaded, which allows remote attackers to upload and execute arbitrary PHP files with extensions such as .php4.
- Product
- Nola
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.