Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
72 results · page 2 of 2
Jul 17, 2023CasaOS is an open-source Personal Cloud system.CVE-2023-37266 · Other software · IceWhaleTech · reported by GitHubCritical 9.8
CasaOS is an open-source Personal Cloud system. Unauthenticated attackers can craft arbitrary JWTs and access features that usually require authentication and execute arbitrary commands as `root` on CasaOS instances. This problem was addressed by improving the validation of JWTs in commit `705bf1f`. This patch is part of CasaOS 0.4.4. Users should upgrade to CasaOS 0.4.4. If they can't, they should temporarily restrict access to CasaOS to untrusted users, for instance by not exposing it publicly.
- Product
- CasaOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2023CasaOS is an open-source Personal Cloud system.CVE-2023-37265 · Other software · IceWhaleTech · reported by GitHubCritical 9.8
CasaOS is an open-source Personal Cloud system. Due to a lack of IP address verification an unauthenticated attackers can execute arbitrary commands as `root` on CasaOS instances. The problem was addressed by improving the detection of client IP addresses in `391dd7f`. This patch is part of CasaOS 0.4.4. Users should upgrade to CasaOS 0.4.4. If they can't, they should temporarily restrict access to CasaOS to untrusted users, for instance by not exposing it publicly.
- Product
- CasaOS-Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 11, 2023Cross-Site Request Forgery (CSRF) vulnerability in Andy Whalen Galleria plugin <= 1.0.3 versions.CVE-2023-35780 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Andy Whalen Galleria plugin <= 1.0.3 versions.
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 18, 2023A vulnerability classified as problematic has been found in whaleal IceFrog 1.1.8.CVE-2023-3308 · Other software · whaleal · reported by VulDBMedium 5.5
A vulnerability classified as problematic has been found in whaleal IceFrog 1.1.8. Affected is an unknown function of the component Aviator Template Engine. The manipulation leads to deserialization. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-231804.
- Product
- IceFrog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2022User invites for Funkwhale v1.2.8 do not permanently expire after being used for signup and can be used again after an account has been deleted.CVE-2022-45292 · Other software · Funkwhale · reported by MITREMedium 5.3
User invites for Funkwhale v1.2.8 do not permanently expire after being used for signup and can be used again after an account has been deleted.
- Product
- Funkwhale
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddev.funkwhale.audiodev.funkwhale.audio
Jun 26, 2022NAVER Whale browser mobile app before 1.10.6.2 allows the attacker to bypass its browser unlock function via incognito mode.CVE-2020-9754 · Other software · NAVER · reported by cve@navercorp.comMedium 5.3
NAVER Whale browser mobile app before 1.10.6.2 allows the attacker to bypass its browser unlock function via incognito mode.
- Product
- NAVER Whale browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcve.naver.comcve.naver.com
Mar 17, 2022Whale browser before 3.12.129.18 allowed extensions to replace JavaScript files of the HWP viewer website which could access to local HWP files.CVE-2022-24075 · Other software · NAVER · reported by cve@navercorp.comMedium 6.5
Whale browser before 3.12.129.18 allowed extensions to replace JavaScript files of the HWP viewer website which could access to local HWP files. When the HWP files were opened, the replaced script could read the files.
- Product
- NAVER Whale browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcve.naver.comcve.naver.com
Mar 17, 2022Whale Bridge, a default extension in Whale browser before 3.12.129.18, allowed to receive any SendMessage request from the content script itself that could leadCVE-2022-24074 · Other software · NAVER · reported by cve@navercorp.comCritical 9.8
Whale Bridge, a default extension in Whale browser before 3.12.129.18, allowed to receive any SendMessage request from the content script itself that could lead to controlling Whale Bridge if the rendering process compromises.
- Product
- NAVER Whale browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcve.naver.comcve.naver.com
Mar 17, 2022The Web Request API in Whale browser before 3.12.129.18 allowed to deny access to the extension store or redirect to any URL when users access the store.CVE-2022-24073 · Other software · NAVER · reported by cve@navercorp.comHigh 7.1
The Web Request API in Whale browser before 3.12.129.18 allowed to deny access to the extension store or redirect to any URL when users access the store.
- Product
- NAVER Whale browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcve.naver.comcve.naver.com
Mar 17, 2022The devtools API in Whale browser before 3.12.129.18 allowed extension developers to inject arbitrary JavaScript into the extension store web page via devtools.CVE-2022-24072 · Other software · NAVER · reported by cve@navercorp.comMedium 6.1
The devtools API in Whale browser before 3.12.129.18 allowed extension developers to inject arbitrary JavaScript into the extension store web page via devtools.inspectedWindow, leading to extensions downloading and uploading when users open the developer tool.
- Product
- NAVER Whale browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcve.naver.comcve.naver.com
Mar 10, 2022CasaOS before v0.2.7 was discovered to contain a command injection vulnerability.CVE-2022-24193 · Other software · Icewhale · reported by MITRECritical 9.8
CasaOS before v0.2.7 was discovered to contain a command injection vulnerability.
- Product
- Casaos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2022A Built-in extension in Whale browser before 3.12.129.46 allows attackers to compromise the rendering process which could lead to controlling browser internal ACVE-2022-24071 · Other software · NAVER · reported by cve@navercorp.comMedium 4.3
A Built-in extension in Whale browser before 3.12.129.46 allows attackers to compromise the rendering process which could lead to controlling browser internal APIs.
- Product
- NAVER Whale browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcve.naver.comcve.naver.com
Nov 2, 2021Whale browser for iOS before 1.14.0 has an inconsistent user interface issue that allows an attacker to obfuscate the address bar which may lead to address bar CVE-2021-33593 · Other software · NAVER · reported by cve@navercorp.comMedium 5.3
Whale browser for iOS before 1.14.0 has an inconsistent user interface issue that allows an attacker to obfuscate the address bar which may lead to address bar spoofing.
- Product
- NAVER Whale browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcve.naver.comcve.naver.com
May 19, 2020Whale Browser Installer before 1.2.0.5 versions don't support signature verification for Flash installer.CVE-2020-9753 · Other software · NAVER Corporation · reported by cve@navercorp.comCritical 9.1
Whale Browser Installer before 1.2.0.5 versions don't support signature verification for Flash installer.
- Product
- Whale Browser Installer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcve.naver.comcve.naver.com
Oct 11, 2018The Whale browser installer 0.4.3.0 and earlier versions allows DLL hijacking.CVE-2018-12449 · Other software · NAVER Corporation · reported by cve@navercorp.comHigh 7.8
The Whale browser installer 0.4.3.0 and earlier versions allows DLL hijacking.
- Product
- Whale Browser Installer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcve.naver.comcve.naver.com
Aug 2, 2018Whale Browser before 1.3.48.4 displays no URL information but only a title of a web page on the browser's address bar when visiting a non-http page, which allowCVE-2018-12448 · Other software · NAVER Corporation · reported by cve@navercorp.comMedium 5.3
Whale Browser before 1.3.48.4 displays no URL information but only a title of a web page on the browser's address bar when visiting a non-http page, which allows an attacker to display a malicious web page with a fake domain name.
- Product
- Whale Browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcve.naver.comcve.naver.com
Jul 3, 2018Whale Browser before 1.0.41.8 displays no URL information but only a title of a web page on the browser's address bar when visiting a blank page, which allows aCVE-2018-7635 · Other software · Navercorp · reported by MITREMedium 5.3
Whale Browser before 1.0.41.8 displays no URL information but only a title of a web page on the browser's address bar when visiting a blank page, which allows an attacker to display a malicious web page with a fake domain name.
- Product
- Whale
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcve.naver.comcve.naver.com
Jun 15, 2018The path of Whale update service was unquoted in NAVER Whale before 1.0.40.7.CVE-2018-9859 · Other software · Navercorp · reported by MITREHigh 8.1
The path of Whale update service was unquoted in NAVER Whale before 1.0.40.7. This vulnerability can be used for persistent privilege escalation if it's available to create an executable file with System privilege by other vulnerable applications.
- Product
- Whale
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcve.naver.comcve.naver.com
Jan 7, 2018The Installer in Whale allows DLL hijacking.CVE-2017-15913 · Other software · Navercorp · reported by MITREHigh 7.8
The Installer in Whale allows DLL hijacking.
- Product
- Whale
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugbounty.whale.naver.comcve.naver.com
Apr 16, 2009Multiple stack-based buffer overflows in the Whale Client Components ActiveX control (WhlMgr.dll), as used in Microsoft Intelligent Application Gateway (IAG) beCVE-2007-2238 · Computers, phones & browsers · Microsoft · reported by cret@cert.orgHigh 9.3
Multiple stack-based buffer overflows in the Whale Client Components ActiveX control (WhlMgr.dll), as used in Microsoft Intelligent Application Gateway (IAG) before 3.7 SP2, allow remote attackers to execute arbitrary code via long arguments to the (1) CheckForUpdates or (2) UpdateComponents methods.
- Product
- Intelligent Application Gateway 2007
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comkb.cert.org
Sep 8, 2005SQL injection vulnerability in BlueWhaleCRM allows remote attackers to execute arbitrary SQL commands via the Account ID field.CVE-2005-2867 · Other software · Bluewhalecrm · reported by MITREHigh 7.5
SQL injection vulnerability in BlueWhaleCRM allows remote attackers to execute arbitrary SQL commands via the Account ID field.
- Product
- Bluewhalecrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecurityfocus.com
Dec 31, 2003Whale Communications e-Gap 2.5 on Windows 2000 allows remote attackers to obtain the source code for the login page via the HTTP TRACE method, which bypasses thCVE-2003-1127 · Other software · Whale Communications · reported by MITREMedium 5
Whale Communications e-Gap 2.5 on Windows 2000 allows remote attackers to obtain the source code for the login page via the HTTP TRACE method, which bypasses the preprocessor.
- Product
- E-gap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgprocheckup.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.