Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,150 results · page 20 of 43
Sep 12, 2023The installer in XAMPP through 8.1.12 allows local users to write to the C:\xampp directory.CVE-2022-47637 · Other software · xampp · reported by MITREMedium 6.7
The installer in XAMPP through 8.1.12 allows local users to write to the C:\xampp directory. Common use cases execute files under C:\xampp with administrative privileges.
- Product
- apache_distribution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordshinnai.altervista.orgshinnai.altervista.org
Sep 6, 2023Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not restrict 'timestamp' query parameters in multiple endpoints, allowing attackerCVE-2023-41932 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 6.5
Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not restrict 'timestamp' query parameters in multiple endpoints, allowing attackers with to delete attacker-specified directories on the Jenkins controller file system as long as they contain a file called 'history.xml'.
- Product
- Jenkins Job Configuration History Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Sep 6, 2023Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not property sanitize or escape the timestamp value from history entries when rendCVE-2023-41931 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not property sanitize or escape the timestamp value from history entries when rendering a history entry on the history view, resulting in a stored cross-site scripting (XSS) vulnerability.
- Product
- Jenkins Job Configuration History Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Aug 3, 2023A Persistent XSS vulnerability can be carried out in a certain field of Unica Campaign.CVE-2023-37501 · Other software · HCL Software · reported by psirt@hcl.comHigh 8.1
A Persistent XSS vulnerability can be carried out in a certain field of Unica Campaign. An attacker could hijack a user's session and perform other attacks.
- Product
- HCL Unica Campaign
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Aug 3, 2023The foundry campaigns service was found to be vulnerable to an unauthenticated information disclosure in a rest endpointCVE-2023-30950 · Other software · Palantir · reported by cve-coordination@palantir.comMedium 6.5
The foundry campaigns service was found to be vulnerable to an unauthenticated information disclosure in a rest endpoint
- Product
- com.palantir.campaigns:campaigns
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpalantir.safebase.uspalantir.safebase.us
Jul 28, 2023FFmpeg 0.7.0 and below was discovered to contain a code injection vulnerability in the component net.bramp.ffmpeg.FFmpeg.<constructor>.CVE-2023-39018 · Other software · Bramp · reported by MITRECritical 9.8
FFmpeg 0.7.0 and below was discovered to contain a code injection vulnerability in the component net.bramp.ffmpeg.FFmpeg.<constructor>. This vulnerability is exploited via passing an unchecked argument. NOTE: this is disputed by multiple third parties because there are no realistic use cases in which FFmpeg.java uses untrusted input for the path of the executable file.
- Product
- Ffmpeg-cli-wrapper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2023Microsoft Edge for Android (Chromium-based) Tampering VulnerabilityCVE-2023-36888 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.3
Microsoft Edge for Android (Chromium-based) Tampering Vulnerability
- Product
- Microsoft Edge for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jul 13, 2023A GRE dataset file within Systems Manager can be tampered with and distributed to PCUs.CVE-2023-30562 · Other software · Becton Dickinson & Co · reported by cybersecurity@bd.comMedium 6.7
A GRE dataset file within Systems Manager can be tampered with and distributed to PCUs.
- Product
- BD Alarisâ„¢ Guardrailsâ„¢ Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2023 A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause remote code execution when an admin user on DCE tampeCVE-2023-37199 · Other software · Schneider Electric · reported by cybersecurity@se.comMedium 6.8
A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause remote code execution when an admin user on DCE tampers with backups which are then manually restored.
- Product
- StruxureWare Data Center Expert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.comdownload.schneider-electric.com
Jul 10, 2023SAP Solution Manager (Diagnostics agent) - version 7.20, allows an attacker to tamper with headers in a client request.CVE-2023-36921 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 7.2
SAP Solution Manager (Diagnostics agent) - version 7.20, allows an attacker to tamper with headers in a client request. This misleads SAP Diagnostics Agent to serve poisoned content to the server. On successful exploitation, the attacker can cause a limited impact on confidentiality and availability of the application.
- Product
- SAP Solution Manager (Diagnostic Agent)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2023A floating point exception vulnerability was found in sox, in the read_samples function at sox/src/voc.c:334:18.CVE-2023-32627 · Other software · Red Hat · reported by Red HatMedium 6.2
A floating point exception vulnerability was found in sox, in the read_samples function at sox/src/voc.c:334:18. This flaw can lead to a denial of service.
- Product
- Red Hat Enterprise Linux 6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Jul 10, 2023Cross-site Scripting (XSS) - Generic in GitHub repository nilsteampassnet/teampass prior to 3.0.10.CVE-2023-3565 · Other software · nilsteampassnet · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Generic in GitHub repository nilsteampassnet/teampass prior to 3.0.10.
- Product
- nilsteampassnet/teampass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2023Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository nilsteampassnet/teampass prior to 3.0.10.CVE-2023-3553 · Other software · nilsteampassnet · reported by security@huntr.devHigh 7.5
Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository nilsteampassnet/teampass prior to 3.0.10.
- Product
- nilsteampassnet/teampass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2023Improper Encoding or Escaping of Output in GitHub repository nilsteampassnet/teampass prior to 3.0.10.CVE-2023-3552 · Other software · nilsteampassnet · reported by security@huntr.devMedium 5.4
Improper Encoding or Escaping of Output in GitHub repository nilsteampassnet/teampass prior to 3.0.10.
- Product
- nilsteampassnet/teampass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2023 Code Injection in GitHub repository nilsteampassnet/teampass prior to 3.0.10.CVE-2023-3551 · Other software · nilsteampassnet · reported by security@huntr.devHigh 7.2
Code Injection in GitHub repository nilsteampassnet/teampass prior to 3.0.10.
- Product
- nilsteampassnet/teampass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2023Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.10.CVE-2023-3531 · Other software · nilsteampassnet · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.10.
- Product
- nilsteampassnet/teampass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2023Directory traversal can occur in the Basecamp com.basecamp.bc3 application before 4.2.1 for Android, which may allow an attacker to write arbitrary files in theCVE-2023-36612 · Other software · Basecamp · reported by MITREHigh 7.5
Directory traversal can occur in the Basecamp com.basecamp.bc3 application before 4.2.1 for Android, which may allow an attacker to write arbitrary files in the application's private directory. Additionally, by using a malicious intent, the attacker may redirect the server's responses (containing sensitive information) to third-party applications by using a custom-crafted deeplink scheme.
- Product
- Basecamp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comhackerone.com
Jun 23, 2023 A REST interface in Apache StreamPipes (versions 0.69.0 to 0.91.0) was not properly restricted to admin-only access.CVE-2023-31469 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.8
A REST interface in Apache StreamPipes (versions 0.69.0 to 0.91.0) was not properly restricted to admin-only access. This allowed a non-admin user with valid login credentials to elevate privileges beyond the initially assigned roles. The issue is resolved by upgrading to StreamPipes 0.92.0.
- Product
- Apache StreamPipes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
Jun 21, 2023libtiff 4.5.0 is vulnerable to Buffer Overflow via extractContigSamplesShifted8bits() at /libtiff/tools/tiffcrop.c:3753.CVE-2023-25435 · Other software · Libtiff · reported by MITREMedium 5.5
libtiff 4.5.0 is vulnerable to Buffer Overflow via extractContigSamplesShifted8bits() at /libtiff/tools/tiffcrop.c:3753.
- Product
- Libtiff
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2023Buffer overflow in Wi-Fi Commissioning MicriumOS example in Silicon Labs Gecko SDK v4.2.3 or earlier allows connected device to write payload onto the stack.CVE-2023-2686 · Other software · silabs.com · reported by product-security@silabs.comCritical 9.8
Buffer overflow in Wi-Fi Commissioning MicriumOS example in Silicon Labs Gecko SDK v4.2.3 or earlier allows connected device to write payload onto the stack.
- Product
- Gecko Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.silabs.comgithub.com
Jun 15, 2023In readSampleData of NuMediaExtractor.cpp, there is a possible out of bounds write due to uninitialized data.CVE-2023-21127 · Computers, phones & browsers · Google · reported by security@android.comHigh 8.8
In readSampleData of NuMediaExtractor.cpp, there is a possible out of bounds write due to uninitialized data. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-275418191
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Jun 14, 2023libtiff 4.5.0 is vulnerable to Buffer Overflow via extractContigSamplesBytes() at /libtiff/tools/tiffcrop.c:3215.CVE-2023-25434 · Other software · Libtiff · reported by MITREHigh 8.8
libtiff 4.5.0 is vulnerable to Buffer Overflow via extractContigSamplesBytes() at /libtiff/tools/tiffcrop.c:3215.
- Product
- Libtiff
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2023Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.CVE-2023-3191 · Other software · nilsteampassnet · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.
- Product
- nilsteampassnet/teampass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2023Improper Encoding or Escaping of Output in GitHub repository nilsteampassnet/teampass prior to 3.0.9.CVE-2023-3190 · Other software · nilsteampassnet · reported by security@huntr.devMedium 4.6
Improper Encoding or Escaping of Output in GitHub repository nilsteampassnet/teampass prior to 3.0.9.
- Product
- nilsteampassnet/teampass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2023PWA for WP & AMP: Authorization bypassCVE-2021-4366 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The PWA for WP & AMP plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the pwaforwp_update_features_options function in versions up to, and including, 1.7.32. This makes it possible for authenticated attackers to change the otherwise restricted settings within the plugin.
- Product
- PWA for WP & AMP
- Affected
- up to 1.7.32
- What to do
- Affects up to 1.7.32. Update PWA for WP & AMP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comwpscan.com
Jun 6, 2023PWA for WP & AMP: Arbitrary file uploadsCVE-2021-4354 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The PWA for WP & AMP for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the pwaforwp_splashscreen_uploader function in versions up to, and including, 1.7.32. This makes it possible for authenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.
- Product
- PWA for WP & AMP
- Affected
- up to 1.7.32
- What to do
- Affects up to 1.7.32. Update PWA for WP & AMP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comwordfence.com
Jun 4, 2023Improper Access Control in GitHub repository nilsteampassnet/teampass prior to 3.0.9.CVE-2023-3095 · Other software · nilsteampassnet · reported by security@huntr.devMedium 6.5
Improper Access Control in GitHub repository nilsteampassnet/teampass prior to 3.0.9.
- Product
- nilsteampassnet/teampass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 3, 2023Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.CVE-2023-3086 · Other software · nilsteampassnet · reported by security@huntr.devCritical 9
Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.
- Product
- nilsteampassnet/teampass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 3, 2023Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.CVE-2023-3084 · Other software · nilsteampassnet · reported by security@huntr.devHigh 8.1
Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.
- Product
- nilsteampassnet/teampass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 3, 2023Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.CVE-2023-3083 · Other software · nilsteampassnet · reported by security@huntr.devHigh 8.7
Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.
- Product
- nilsteampassnet/teampass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2023libspdm is a sample implementation that follows the DMTF SPDM specifications.CVE-2023-32690 · Other software · DMTF · reported by GitHubMedium 5.7
libspdm is a sample implementation that follows the DMTF SPDM specifications. Prior to versions 2.3.3 and 3.0, following a successful CAPABILITIES response, a libspdm Requester stores the Responder's CTExponent into its context without validation. If the Requester sends a request message that requires a cryptography operation by the Responder, such as CHALLENGE, libspdm will calculate the timeout value using the Responder's unvalidated CTExponent. A patch is available in version 2.3.3. A workaround is also available. After completion of VCA, the Requester can check the value of the Responder's CTExponent. If it greater than or equal to 64, then the Requester can stop communication with the Responder.
- Product
- libspdm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 31, 2023A known cache speculation vulnerability, known as Branch History Injection (BHI) or Spectre-BHB, becomes actual again for the new hw AmpereOne.CVE-2023-3006 · Computers, phones & browsers · Linux · reported by Red HatMedium 5.5
A known cache speculation vulnerability, known as Branch History Injection (BHI) or Spectre-BHB, becomes actual again for the new hw AmpereOne. Spectre-BHB is similar to Spectre v2, except that malicious code uses the shared branch history (stored in the CPU Branch History Buffer, or BHB) to influence mispredicted branches within the victim's hardware context. Once that occurs, speculation caused by the mispredicted branches can cause cache allocation. This issue leads to obtaining information that should not be accessible.
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
May 31, 2023Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.CVE-2023-3009 · Other software · nilsteampassnet · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.
- Product
- nilsteampassnet/teampass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2023The Call Blocker application 6.6.3 for Android allows attackers to tamper with feature-related data, resulting in a severe elevation of privilege attack.CVE-2023-29728 · Other software · Applika · reported by MITRECritical 9.8
The Call Blocker application 6.6.3 for Android allows attackers to tamper with feature-related data, resulting in a severe elevation of privilege attack.
- Product
- Call Blocker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.complay.google.com
May 26, 2023Rekor's goals are to provide an immutable tamper resistant ledger of metadata generated within a software projects supply chain.CVE-2023-33199 · Other software · sigstore · reported by GitHubMedium 5.3
Rekor's goals are to provide an immutable tamper resistant ledger of metadata generated within a software projects supply chain. A malformed proposed entry of the `intoto/v0.0.2` type can cause a panic on a thread within the Rekor process. The thread is recovered so the client receives a 500 error message and service still continues, so the availability impact of this is minimal. This has been fixed in v1.2.0 of Rekor. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- rekor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2023A heap-based buffer overflow issue was discovered in libjpeg-turbo in h2v2_merged_upsample_internal() function of jdmrgext.c file.CVE-2023-2804 · Other software · Libjpeg-turbo · reported by Red HatMedium 6.5
A heap-based buffer overflow issue was discovered in libjpeg-turbo in h2v2_merged_upsample_internal() function of jdmrgext.c file. The vulnerability can only be exploited with 12-bit data precision for which the range of the sample data type exceeds the valid sample range, hence, an attacker could craft a 12-bit lossless JPEG image that contains out-of-range 12-bit samples. An application attempting to decompress such image using merged upsampling would lead to segmentation fault or buffer overflows, causing an application to crash.
- Product
- Libjpeg-turbo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
May 24, 2023Code Injection in GitHub repository nilsteampassnet/teampass prior to 3.0.9.CVE-2023-2859 · Other software · nilsteampassnet · reported by security@huntr.devHigh 8.8
Code Injection in GitHub repository nilsteampassnet/teampass prior to 3.0.9.
- Product
- nilsteampassnet/teampass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2023ActiveCampaign: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0233 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ActiveCampaign WordPress plugin before 8.1.12 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- ActiveCampaign
- Fixed in
- 8.1.12
- What to do
- Update ActiveCampaign to 8.1.12 or newer.
May 10, 2023Uncontrolled resource consumption in the Intel(R) Smart Campus Android application before version 9.9 may allow an authenticated user to potentially enable deniCVE-2022-46645 · Other software · Intel · reported by secure@intel.comMedium 5
Uncontrolled resource consumption in the Intel(R) Smart Campus Android application before version 9.9 may allow an authenticated user to potentially enable denial of service via local access.
- Product
- Smart Campus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2023When sampling randomness for a shared secret, the implementation of Kyber and FrodoKEM, did not check whether crypto/rand.Read() returns an error.CVE-2023-1732 · Other software · Cloudflare · reported by cna@cloudflare.comMedium 5.3
When sampling randomness for a shared secret, the implementation of Kyber and FrodoKEM, did not check whether crypto/rand.Read() returns an error. In rare deployment cases (error thrown by the Read() function), this could lead to a predictable shared secret. The tkn20 and blindrsa components did not check whether enough randomness was returned from the user provided randomness source. Typically the user provides crypto/rand.Reader, which in the vast majority of cases will always return the right number random bytes. In the cases where it does not, or the user provides a source that does not, the blinding for blindrsa is weak and integrity of the plaintext is not ensured in tkn20.
- Product
- CIRCL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2023A vulnerability has been discovered in Rocket.Chat, where editing messages can change the original timestamp, causing the UI to display messages in an incorrectCVE-2023-28317 · Other software · Rocket.chat · reported by support@hackerone.comMedium 5.3
A vulnerability has been discovered in Rocket.Chat, where editing messages can change the original timestamp, causing the UI to display messages in an incorrect order.
- Product
- Rocket.chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comhackerone.com
May 9, 2023A TOCTOU in ASP bootloader may allow an attacker to tamper with the SPI ROM following data read to memory potentially resulting in S3 data corruption and informCVE-2021-26356 · Other software · AMD · reported by psirt@amd.comHigh 7.4
A TOCTOU in ASP bootloader may allow an attacker to tamper with the SPI ROM following data read to memory potentially resulting in S3 data corruption and information disclosure.
- Product
- Ryzen™ 3000 Series Desktop Processors “Matisse” AM4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitHub repository nilsteampassnet/teampass prior to 3.0.7.CVE-2023-2591 · Other software · nilsteampassnet · reported by security@huntr.devMedium 5.4
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitHub repository nilsteampassnet/teampass prior to 3.0.7.
- Product
- nilsteampassnet/teampass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2023libspdm is a sample implementation that follows the DMTF SPDM specifications.CVE-2023-31127 · Other software · DMTF · reported by GitHubCritical 9
libspdm is a sample implementation that follows the DMTF SPDM specifications. A vulnerability has been identified in SPDM session establishment in libspdm prior to version 2.3.1. If a device supports both DHE session and PSK session with mutual authentication, the attacker may be able to establish the session with `KEY_EXCHANGE` and `PSK_FINISH` to bypass the mutual authentication. This is most likely to happen when the Requester begins a session using one method (DHE, for example) and then uses the other method's finish (PSK_FINISH in this example) to establish the session. The session hashes would be expected to fail in this case, but the condition was not detected. This issue only impacts the SPDM responder, which supports `KEY_EX_CAP=1 and `PSK_CAP=10b` at same time with mutual authentication requirement. The SPDM requester is not impacted. The SPDM responder is not impacted if `KEY_EX_CAP=0` or `PSK_CAP=0` or `PSK_CAP=01b`. The SPDM responder is not impacted if mutual authentication is not required. libspdm 1.0, 2.0, 2.1, 2.2, 2.3 are all impacted. Older branches are not maintained, but users of the 2.3 branch may receive a patch in version 2.3.2. The SPDM specification (DSP
- Product
- libspdm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2023Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.7.CVE-2023-2516 · Other software · nilsteampassnet · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.7.
- Product
- nilsteampassnet/teampass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2023Apache StreamPark 1.0.0 before 2.0.0 When the user successfully logs in, to modify his profile, the username will be passed to the server-layer as a parameter, CVE-2022-46365 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.1
Apache StreamPark 1.0.0 before 2.0.0 When the user successfully logs in, to modify his profile, the username will be passed to the server-layer as a parameter, but not verified whether the user name is the currently logged user and whether the user is legal, This will allow malicious attackers to send any username to modify and reset the account, Users of the affected versions should upgrade to Apache StreamPark 2.0.0 or later.
- Product
- Apache StreamPark (incubating)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
May 1, 2023Streampark allows any users to upload a jar as application, but there is no mandatory verification of the uploaded file type, causing users to upload some high-CVE-2022-45802 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Streampark allows any users to upload a jar as application, but there is no mandatory verification of the uploaded file type, causing users to upload some high-risk files, and may upload them to any directory, Users of the affected versions should upgrade to Apache StreamPark 2.0.0 or later
- Product
- Apache StreamPark (incubating)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
May 1, 2023Apache StreamPark 1.0.0 to 2.0.0 have a LDAP injection vulnerability.CVE-2022-45801 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.4
Apache StreamPark 1.0.0 to 2.0.0 have a LDAP injection vulnerability. LDAP Injection is an attack used to exploit web based applications that construct LDAP statements based on user input. When an application fails to properly sanitize user input, it's possible to modify LDAP statements through techniques similar to SQL Injection. LDAP injection attacks could result in the granting of permissions to unauthorized queries, and content modification inside the LDAP tree. This risk may only occur when the user logs in with ldap, and the user name and password login will not be affected, Users of the affected versions should upgrade to Apache StreamPark 2.0.0 or later.
- Product
- Apache StreamPark (incubating)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
Apr 26, 2023Static credentials exist in the PostgreSQL data used in ManageEngine Access Manager Plus (AMP) build 4309, ManageEngine Password Manager Pro, and ManageEngine PCVE-2023-2291 · Email & office · Zohocorp · reported by vulnreport@tenable.comHigh 7.8
Static credentials exist in the PostgreSQL data used in ManageEngine Access Manager Plus (AMP) build 4309, ManageEngine Password Manager Pro, and ManageEngine PAM360. These credentials could allow a malicious actor to modify configuration data that would escalate their permissions from that of a low-privileged user to an Administrative user.
- Product
- Manageengine Access Manager Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Apr 26, 2023Sangoma FreePBX 1805 through 2302 (when obtained as a ,.ISO file) places AMPDBUSER, AMPDBPASS, AMPMGRUSER, and AMPMGRPASS in the list of global variables.CVE-2023-26567 · Other software · Sangoma · reported by MITREHigh 8.1
Sangoma FreePBX 1805 through 2302 (when obtained as a ,.ISO file) places AMPDBUSER, AMPDBPASS, AMPMGRUSER, and AMPMGRPASS in the list of global variables. This exposes cleartext authentication credentials for the Asterisk Database (MariaDB/MySQL) and Asterisk Manager Interface. For example, an attacker can make a /ari/asterisk/variable?variable=AMPDBPASS API call.
- Product
- Freepbx Linux 7
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqsecure.com.cyfreepbx.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.