Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
143 results · page 2 of 3
Apr 29, 2024Open Networking Foundation SD-RAN ONOS onos-kpimon 0.4.7 allows blocking of the errCh channel within the Start function of the monitoring package.CVE-2023-52725 · Other software · open_networking_foundation · reported by MITREMedium 6.5
Open Networking Foundation SD-RAN ONOS onos-kpimon 0.4.7 allows blocking of the errCh channel within the Start function of the monitoring package.
- Product
- sd-ran_onos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2024Open Networking Foundation SD-RAN onos-kpimon 0.4.7 allows out-of-bounds array access in the processIndicationFormat1 function.CVE-2023-52724 · Computers, phones & browsers · Linuxfoundation · reported by MITREHigh 8.1
Open Networking Foundation SD-RAN onos-kpimon 0.4.7 allows out-of-bounds array access in the processIndicationFormat1 function.
- Product
- Onos-kpimon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2024A permissions issue was addressed to help ensure Personas are always protected.CVE-2024-23295 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
A permissions issue was addressed to help ensure Personas are always protected. This issue is fixed in visionOS 1.1. An unauthenticated user may be able to use an unprotected Persona.
- Product
- visionOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comseclists.org
Jan 16, 2024A GPU kernel can read sensitive data from another GPU kernel (even from another user or app) through an optimized GPU memory region called _local memory_ on varCVE-2023-4969 · Other software · Khronos Group · reported by cret@cert.orgMedium 6.5
A GPU kernel can read sensitive data from another GPU kernel (even from another user or app) through an optimized GPU memory region called _local memory_ on various architectures.
- Product
- OpenCL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.trailofbits.comkb.cert.org
Jan 12, 2024An issue was discovered in the Phonos extension in MediaWiki before 1.40.2.CVE-2024-23178 · Other software · Mediawiki · reported by MITREMedium 5.4
An issue was discovered in the Phonos extension in MediaWiki before 1.40.2. PhonosButton.js allows i18n-based XSS via the phonos-purge-needed-error message.
- Product
- Mediawiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.wikimedia.orgphabricator.wikimedia.org
Dec 14, 2023Download of Code Without Integrity Check vulnerability in PHOENIX CONTACT MULTIPROG, PHOENIX CONTACT ProConOS eCLR (SDK) allows an unauthenticated remote attackCVE-2023-5592 · Other software · PHOENIX CONTACT · reported by info@cert.vde.comHigh 7.5
Download of Code Without Integrity Check vulnerability in PHOENIX CONTACT MULTIPROG, PHOENIX CONTACT ProConOS eCLR (SDK) allows an unauthenticated remote attacker to download and execute applications without integrity checks on the device which may result in a complete loss of integrity.
- Product
- MULTIPROG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcert.vde.com
Dec 14, 2023Incorrect Permission Assignment for Critical Resource vulnerability in PHOENIX CONTACT MULTIPROG, PHOENIX CONTACT ProConOS eCLR (SDK) allows an unauthenticated CVE-2023-0757 · Other software · PHOENIX CONTACT · reported by info@cert.vde.comCritical 9.8
Incorrect Permission Assignment for Critical Resource vulnerability in PHOENIX CONTACT MULTIPROG, PHOENIX CONTACT ProConOS eCLR (SDK) allows an unauthenticated remote attacker to upload arbitrary malicious code and gain full access on the affected device.
- Product
- MULTIPROG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcert.vde.com
Nov 9, 2023Cross-Site Request Forgery (CSRF) vulnerability in Chronosly Chronosly Events Calendar plugin <= 2.6.2 versions.CVE-2023-31093 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Chronosly Chronosly Events Calendar plugin <= 2.6.2 versions.
- Affected
- up to 2.6.2
- What to do
- Affects up to 2.6.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 2, 2023RMI was not requiring authentication when calling ChronosRMIService:setEventOrganizer.CVE-2023-26455 · Other software · OX Software GmbH · reported by security@open-xchange.comMedium 5.6
RMI was not requiring authentication when calling ChronosRMIService:setEventOrganizer. Attackers with local or adjacent network access could abuse the RMI service to modify calendar items using RMI. RMI access is restricted to localhost by default. The interface has been updated to require authenticated requests. No publicly available exploits are known.
- Product
- OX App Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.open-xchange.comsoftware.open-xchange.com
Jul 10, 2023A vulnerability was found in TamronOS up to 20230703.CVE-2023-3606 · Other software · Tamronos · reported by VulDBMedium 6.3
A vulnerability was found in TamronOS up to 20230703. It has been classified as critical. This affects an unknown part of the file /api/ping. The manipulation of the argument host leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-233475. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Tamronos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2023A cross-site scripting (XSS) vulnerability in Open Networking Foundation ONOS from version v1.9.0 to v2.7.0 allows attackers to execute arbitrary web scripts orCVE-2023-30093 · Other software · Onosproject · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in Open Networking Foundation ONOS from version v1.9.0 to v2.7.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the url parameter of the API documentation dashboard.
- Product
- Onos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordedoardoottavianelli.ityoutube.com
Apr 20, 2023This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Sonos One Speaker 70.3-35220.CVE-2023-27355 · Other software · Sonos · reported by zdi-disclosures@trendmicro.comHigh 8.8
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Sonos One Speaker 70.3-35220. Authentication is not required to exploit this vulnerability. The specific flaw exists within the MPEG-TS parser. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-19773.
- Product
- One Speaker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzerodayinitiative.comzerodayinitiative.com
Apr 20, 2023This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Sonos One Speaker 70.3-35220.CVE-2023-27354 · Other software · Sonos · reported by zdi-disclosures@trendmicro.comMedium 6.5
This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Sonos One Speaker 70.3-35220. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of the SMB directory query command. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before reading from memory. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-19727.
- Product
- One Speaker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzerodayinitiative.comzerodayinitiative.com
Apr 20, 2023This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Sonos One Speaker 70.3-35220.CVE-2023-27353 · Other software · Sonos · reported by zdi-disclosures@trendmicro.comMedium 6.5
This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Sonos One Speaker 70.3-35220. Authentication is not required to exploit this vulnerability. The specific flaw exists within the msprox endpoint. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-19846.
- Product
- One Speaker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzerodayinitiative.comzerodayinitiative.com
Apr 20, 2023This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Sonos One Speaker 70.3-35220.CVE-2023-27352 · Other software · Sonos · reported by zdi-disclosures@trendmicro.comHigh 8.8
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Sonos One Speaker 70.3-35220. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of the SMB directory query command. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-19845.
- Product
- One Speaker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzerodayinitiative.comzerodayinitiative.com
Apr 20, 2023An issue was discovered in ONOS 2.5.1.CVE-2022-29944 · Other software · Opennetworking · reported by MITREMedium 5.3
An issue was discovered in ONOS 2.5.1. There is an incorrect comparison of paths installed by intents. An existing intents does not redirect to a new path, even if a new intent that shares the path with higher priority is installed.
- Product
- Onos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwiki.onosproject.orgusenix.org
Apr 20, 2023An issue was discovered in ONOS 2.5.1.CVE-2022-29609 · Other software · Opennetworking · reported by MITREMedium 5.3
An issue was discovered in ONOS 2.5.1. An intent with the same source and destination shows the INSTALLING state, indicating that its flow rules are installing. Improper handling of such an intent is misleading to a network operator.
- Product
- Onos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwiki.onosproject.orgusenix.org
Apr 20, 2023An issue was discovered in ONOS 2.5.1.CVE-2022-29608 · Other software · Opennetworking · reported by MITREHigh 7.5
An issue was discovered in ONOS 2.5.1. An intent with a port that is an intermediate point of its path installs an invalid flow rule, causing a network loop.
- Product
- Onos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwiki.onosproject.orgusenix.org
Apr 20, 2023An issue was discovered in ONOS 2.5.1.CVE-2022-29607 · Other software · Opennetworking · reported by MITREHigh 7.5
An issue was discovered in ONOS 2.5.1. Modification of an existing intent to have the same source and destination shows the INSTALLED state without any flow rule. Improper handling of such an intent is misleading to a network operator.
- Product
- Onos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwiki.onosproject.orgusenix.org
Apr 20, 2023An issue was discovered in ONOS 2.5.1.CVE-2022-29606 · Other software · Opennetworking · reported by MITRECritical 9.8
An issue was discovered in ONOS 2.5.1. An intent with a large port number shows the CORRUPT state, which is misleading to a network operator. Improper handling of such port numbers causes inconsistency between intent and flow rules in the network.
- Product
- Onos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwiki.onosproject.orgusenix.org
Apr 20, 2023An issue was discovered in ONOS 2.5.1.CVE-2022-29605 · Other software · Opennetworking · reported by MITREHigh 7.5
An issue was discovered in ONOS 2.5.1. IntentManager attempts to install the IPv6 flow rules of an intent into an OpenFlow 1.0 switch that does not support IPv6. Improper handling of the difference in capabilities of the intent and switch is misleading to a network operator.
- Product
- Onos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwiki.onosproject.orgusenix.org
Apr 20, 2023An issue was discovered in ONOS 2.5.1.CVE-2022-29604 · Other software · Opennetworking · reported by MITRECritical 9.8
An issue was discovered in ONOS 2.5.1. An intent with an uppercase letter in a device ID shows the CORRUPT state, which is misleading to a network operator. Improper handling of case sensitivity causes inconsistency between intent and flow rules in the network.
- Product
- Onos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwiki.onosproject.orgusenix.org
Apr 20, 2023An issue was discovered in ONOS 2.5.1.CVE-2022-24109 · Other software · Opennetworking · reported by MITREMedium 6.5
An issue was discovered in ONOS 2.5.1. To attack an intent installed by a normal user, a remote attacker can install a duplicate intent with a different key, and then remove the duplicate one. This will remove the flow rules of the intent, even though the intent still exists in the controller.
- Product
- Onos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwiki.onosproject.orgusenix.org
Apr 20, 2023An issue was discovered in ONOS 2.5.1.CVE-2022-24035 · Other software · Opennetworking · reported by MITREHigh 7.5
An issue was discovered in ONOS 2.5.1. The purge-requested intent remains on the list, but it does not respond to changes in topology (e.g., link failure). In combination with other applications, it could lead to a failure of network management.
- Product
- Onos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwiki.onosproject.orgusenix.org
Apr 20, 2023An issue was discovered in ONOS 2.5.1.CVE-2021-38364 · Other software · Opennetworking · reported by MITREMedium 6.5
An issue was discovered in ONOS 2.5.1. There is an incorrect comparison of flow rules installed by intents. A remote attacker can install or remove a new intent, and consequently modify or delete the existing flow rules related to other intents.
- Product
- Onos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopennetworking.orgusenix.org
Apr 20, 2023An issue was discovered in ONOS 2.5.1.CVE-2021-38363 · Other software · Opennetworking · reported by MITREHigh 7.5
An issue was discovered in ONOS 2.5.1. In IntentManager, the install-requested intent (which causes an exception) remains in pendingMap (in memory) forever. Deletion is possible neither by a user nor by the intermittent Intent Cleanup process.
- Product
- Onos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopennetworking.orgusenix.org
Apr 4, 2023An issue found in Directus API v.2.2.0 allows a remote attacker to cause a denial of service via a great amount of HTTP requests.CVE-2020-19850 · Other software · Monospace · reported by MITREMedium 6.5
An issue found in Directus API v.2.2.0 allows a remote attacker to cause a denial of service via a great amount of HTTP requests.
- Product
- Directus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2023A cross-site scripting (XSS) vulnerability in Open Networking Foundation ONOS from version v1.9.0 to v2.7.0 allows attackers to execute arbitrary web scripts orCVE-2023-24279 · Other software · Opennetworking · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in Open Networking Foundation ONOS from version v1.9.0 to v2.7.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the url parameter of the API documentation dashboard.
- Product
- Onos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordedoardoottavianelli.itedoardoottavianelli.it
Dec 26, 2022In Directus before 9.7.0, the default settings of CORS_ORIGIN and CORS_ENABLED are true.CVE-2022-26969 · Other software · Monospace · reported by MITRECritical 9.8
In Directus before 9.7.0, the default settings of CORS_ORIGIN and CORS_ENABLED are true.
- Product
- Directus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.mozilla.orggithub.com
Oct 20, 2022Some versions of Sonos One (1st and 2nd generation) allow partial or full memory access via attacker controlled hardware that can be attached to the Mini-PCI ExCVE-2020-9285 · Other software · Sonos · reported by MITREMedium 6.8
Some versions of Sonos One (1st and 2nd generation) allow partial or full memory access via attacker controlled hardware that can be attached to the Mini-PCI Express slot on the motherboard that hosts the WiFi card on the device.
- Product
- ONE Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtnpitsecurity.comtnpitsecurity.com
Aug 16, 2022tifig v0.2.2 was discovered to contain a resource allocation issue via operator new(unsigned long) at asan_new_delete.cpp.CVE-2022-36155 · Other software · Monostream · reported by MITREMedium 5.5
tifig v0.2.2 was discovered to contain a resource allocation issue via operator new(unsigned long) at asan_new_delete.cpp.
- Product
- Tifig
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 16, 2022tifig v0.2.2 was discovered to contain a segmentation violation via std::vector<unsigned int, std::allocator<unsigned int> >::size() const at /bits/stl_vector.hCVE-2022-36153 · Other software · Monostream · reported by MITREMedium 5.5
tifig v0.2.2 was discovered to contain a segmentation violation via std::vector<unsigned int, std::allocator<unsigned int> >::size() const at /bits/stl_vector.h.
- Product
- Tifig
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 16, 2022tifig v0.2.2 was discovered to contain a memory leak via operator new[](unsigned long) at /asan/asan_new_delete.cpp.CVE-2022-36152 · Other software · Monostream · reported by MITREMedium 5.5
tifig v0.2.2 was discovered to contain a memory leak via operator new[](unsigned long) at /asan/asan_new_delete.cpp.
- Product
- Tifig
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 16, 2022tifig v0.2.2 was discovered to contain a segmentation violation via getType() at /common/bbox.cpp.CVE-2022-36151 · Other software · Monostream · reported by MITREMedium 5.5
tifig v0.2.2 was discovered to contain a segmentation violation via getType() at /common/bbox.cpp.
- Product
- Tifig
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 16, 2022tifig v0.2.2 was discovered to contain a heap-buffer overflow via __asan_memmove at /asan/asan_interceptors_memintrinsics.cpp.CVE-2022-36150 · Other software · Monostream · reported by MITREMedium 5.5
tifig v0.2.2 was discovered to contain a heap-buffer overflow via __asan_memmove at /asan/asan_interceptors_memintrinsics.cpp.
- Product
- Tifig
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 16, 2022tifig v0.2.2 was discovered to contain a heap-use-after-free via temInfoEntry().CVE-2022-36149 · Other software · Monostream · reported by MITREMedium 5.5
tifig v0.2.2 was discovered to contain a heap-use-after-free via temInfoEntry().
- Product
- Tifig
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 21, 2022An unauthenticated, remote attacker could upload malicious logic to the devices based on ProConOS/ProConOS eCLR in order to gain full control over the device.CVE-2022-31801 · Other software · PHOENIX CONTACT · reported by info@cert.vde.comCritical 9.8
An unauthenticated, remote attacker could upload malicious logic to the devices based on ProConOS/ProConOS eCLR in order to gain full control over the device.
- Product
- MULTIPROG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcert.vde.com
Jun 21, 2022An unauthenticated, remote attacker could upload malicious logic to devices based on ProConOS/ProConOS eCLR in order to gain full control over the device.CVE-2022-31800 · Other software · PHOENIX CONTACT · reported by info@cert.vde.comCritical 9.8
An unauthenticated, remote attacker could upload malicious logic to devices based on ProConOS/ProConOS eCLR in order to gain full control over the device.
- Product
- ILC 1x0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcert.vde.com
Feb 18, 2022This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sonos One Speaker prior to 3.4.1 (S2 systems) and 11.2.13 builCVE-2022-24049 · Other software · Sonos · reported by zdi-disclosures@trendmicro.comCritical 9.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sonos One Speaker prior to 3.4.1 (S2 systems) and 11.2.13 build 57923290 (S1 systems). Authentication is not required to exploit this vulnerability. The specific flaw exists within the ALAC audio codec. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15798.
- Product
- One Speaker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzerodayinitiative.comzerodayinitiative.com
Feb 18, 2022This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Sonos One Speaker prior to 3.4.1 (S2 systems) and 11CVE-2022-24046 · Other software · Sonos · reported by zdi-disclosures@trendmicro.comHigh 8.8
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Sonos One Speaker prior to 3.4.1 (S2 systems) and 11.2.13 build 57923290 (S1 systems). Authentication is not required to exploit this vulnerability. The specific flaw exists within the anacapd daemon. The issue results from the lack of proper validation of user-supplied data, which can result in an integer underflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15828.
- Product
- One Speaker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzerodayinitiative.comzerodayinitiative.com
Feb 8, 2022Reflected cross-site scripting vulnerability in the checkbox of php_mailform versions prior to Version 1.40 allows a remote unauthenticated attacker to inject aCVE-2022-22142 · Other software · econosys system · reported by vultures@jpcert.or.jpMedium 6.1
Reflected cross-site scripting vulnerability in the checkbox of php_mailform versions prior to Version 1.40 allows a remote unauthenticated attacker to inject an arbitrary script via unspecified vectors.
- Product
- php_mailform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2022Reflected cross-site scripting vulnerability in the attached file name of php_mailform versions prior to Version 1.40 allows a remote unauthenticated attacker tCVE-2022-21805 · Other software · econosys system · reported by vultures@jpcert.or.jpMedium 6.1
Reflected cross-site scripting vulnerability in the attached file name of php_mailform versions prior to Version 1.40 allows a remote unauthenticated attacker to inject an arbitrary script via unspecified vectors.
- Product
- php_mailform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2022RegistrationMagic: Does not escape user input in its rm_chronos_ajax AJAX action before using it in a SQL statementCVE-2021-24862 · WordPress plugins & themes · reported by WPScanHigh 7.2
The RegistrationMagic WordPress plugin before 5.0.1.6 does not escape user input in its rm_chronos_ajax AJAX action before using it in a SQL statement when duplicating tasks in batches, which could lead to a SQL injection issue
- Product
- RegistrationMagic
- Fixed in
- 5.0.1.6
- What to do
- Update RegistrationMagic to 5.0.1.6 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Dec 21, 2021Cronos is a commercial implementation of a blockchain.CVE-2021-43839 · Other software · crypto-org-chain · reported by GitHubHigh 7.5
Cronos is a commercial implementation of a blockchain. In Cronos nodes running versions before v0.6.5, it is possible to take transaction fees from Cosmos SDK's FeeCollector for the current block by sending a custom crafted MsgEthereumTx. This problem has been patched in Cronos v0.6.5. There are no tested workarounds. All validator node operators are recommended to upgrade to Cronos v0.6.5 at their earliest possible convenience.
- Product
- cronos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2021An issue in Atomix v3.1.5 allows a malicious Atomix node to remove states of ONOS storage via abuse of primitive operations.CVE-2020-35214 · Other software · Atomix · reported by MITREHigh 8.1
An issue in Atomix v3.1.5 allows a malicious Atomix node to remove states of ONOS storage via abuse of primitive operations.
- Product
- Atomix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.google.comdocs.google.com
Dec 16, 2021An issue in Atomix v3.1.5 allows attackers to cause a denial of service (DoS) via false link event messages sent to a master ONOS node.CVE-2020-35213 · Other software · Atomix · reported by MITREHigh 8.1
An issue in Atomix v3.1.5 allows attackers to cause a denial of service (DoS) via false link event messages sent to a master ONOS node.
- Product
- Atomix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.google.comdocs.google.com
Dec 21, 2020An XXE attack can occur in Kronos WebTA 5.0.4 when SAML is used.CVE-2020-35604 · Other software · Kronos · reported by MITRECritical 9.8
An XXE attack can occur in Kronos WebTA 5.0.4 when SAML is used.
- Product
- Web Time And Attendance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmindpointgroup.commindpointgroup.com
Oct 6, 2020Stored cross-site scripting vulnerability in CMONOS.JP ver2.0.20191009 and earlier allows remote attackers to inject arbitrary script via unspecified vectors.CVE-2020-5631 · Other software · CMONOS Co. Ltd. · reported by vultures@jpcert.or.jpMedium 6.1
Stored cross-site scripting vulnerability in CMONOS.JP ver2.0.20191009 and earlier allows remote attackers to inject arbitrary script via unspecified vectors.
- Product
- CMONOS.JP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2020An encryption-bypass issue was discovered on Espressif ESP-IDF devices through 4.2, ESP8266_NONOS_SDK devices through 3.0.3, and ESP8266_RTOS_SDK devices througCVE-2020-12638 · Other software · Espressif · reported by MITREMedium 6.8
An encryption-bypass issue was discovered on Espressif ESP-IDF devices through 4.2, ESP8266_NONOS_SDK devices through 3.0.3, and ESP8266_RTOS_SDK devices through 3.3. Broadcasting forged beacon frames forces a device to change its authentication mode to OPEN, effectively disabling its 802.11 encryption.
- Product
- Esp-idf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2020A Blind SQL Injection vulnerability in Kronos WebTA 3.8.x and later before 4.0 (affecting the com.threeis.webta.H352premPayRequest servlet's SortBy parameter) aCVE-2020-14982 · Other software · Kronos · reported by MITREMedium 6.5
A Blind SQL Injection vulnerability in Kronos WebTA 3.8.x and later before 4.0 (affecting the com.threeis.webta.H352premPayRequest servlet's SortBy parameter) allows an attacker with the Employee, Supervisor, or Timekeeper role to read sensitive data from the database.
- Product
- Web Time And Attendance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmindpointgroup.commindpointgroup.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.