Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,675 results · page 20 of 34
Nov 9, 2023The leakage of channel access token in craft_members Line 13.6.1 allows remote attackers to send malicious notifications to victims.CVE-2023-47366 · Other software · Linecorp · reported by MITREMedium 6.5
The leakage of channel access token in craft_members Line 13.6.1 allows remote attackers to send malicious notifications to victims.
- Product
- Line
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2023The leakage of channel access token in F.B.P members Line 13.6.1 allows remote attackers to send malicious notifications to victims.CVE-2023-47363 · Other software · Linecorp · reported by MITREMedium 6.5
The leakage of channel access token in F.B.P members Line 13.6.1 allows remote attackers to send malicious notifications to victims.
- Product
- Line
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2023ARMember: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2022-46808 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Repute Infosystems ARMember armember-membership allows SQL Injection.This issue affects ARMember: from n/a through 3.4.11.
- Product
- ARMember
- Affected
- up to 3.4.11
- What to do
- Affects up to 3.4.11. Update ARMember to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Oct 31, 2023Memberlite Shortcodes: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2023-5237 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Memberlite Shortcodes WordPress plugin before 1.3.9 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin.
- Product
- Memberlite Shortcodes
- Fixed in
- 1.3.9
- What to do
- Update Memberlite Shortcodes to 1.3.9 or newer.
Full record and what to do →NVD recordresearch.cleantalk.orgwpscan.com
Oct 26, 2023Missing Encryption of Security Keys vulnerability in Silicon Labs Ember ZNet SDK on 32 bit, ARM (SecureVault High modules) allows potential modification or extCVE-2023-41096 · Other software · silabs.com · reported by product-security@silabs.comMedium 6.8
Missing Encryption of Security Keys vulnerability in Silicon Labs Ember ZNet SDK on 32 bit, ARM (SecureVault High modules) allows potential modification or extraction of network credentials stored in flash. This issue affects Silicon Labs Ember ZNet SDK: 7.3.1 and earlier.
- Product
- Ember ZNet SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiliconlabs.lightning.force.comsiliconlabs.lightning.force.com
Oct 25, 2023The leakage of the client secret in Fukunaga_memberscard Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages.CVE-2023-39736 · Other software · linecorp · reported by MITREHigh 8.2
The leakage of the client secret in Fukunaga_memberscard Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages.
- Product
- fukunaga_memberscard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comliff.line.me
Oct 20, 2023ARMember Lite - Membership: Stored Cross-Site ScriptingCVE-2023-3996 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The ARMember Lite - Membership Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 4.0.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- ARMember Lite - Membership
- Affected
- up to 4.0.16
- What to do
- Affects up to 4.0.16. Update ARMember Lite - Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.svn.wordpress.orgplugins.svn.wordpress.org
Oct 20, 2023Paid Memberships Pro: Cross-Site Request ForgeryCVE-2020-36754 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Paid Memberships Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4.2. This is due to missing or incorrect nonce validation on the pmpro_page_save() function. This makes it possible for unauthenticated attackers to save pages via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Paid Memberships Pro
- Affected
- up to 2.4.2
- What to do
- Affects up to 2.4.2. Update Paid Memberships Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comblog.nintechnet.com
Oct 16, 2023Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API overlay_del.cgi is vulnerable to path traversal attacks that allows for filCVE-2023-21415 · Other software · Axis Communications AB · reported by product-security@axis.comMedium 6.5
Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API overlay_del.cgi is vulnerable to path traversal attacks that allows for file deletion. This flaw can only be exploited after authenticating with an operator- or administrator-privileged service account. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.
- Product
- AXIS OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2023TouchLink packets processed after timeout or out of range due to Operation on a Resource after Expiration and Missing Release of Resource after Effective LifetiCVE-2023-41094 · Other software · Silicon Labs · reported by product-security@silabs.comCritical 10
TouchLink packets processed after timeout or out of range due to Operation on a Resource after Expiration and Missing Release of Resource after Effective Lifetime may allow a device to be added outside of valid TouchLink range or pairing duration This issue affects Ember ZNet 7.1.x from 7.1.3 through 7.1.5; 7.2.x from 7.2.0 through 7.2.3; Version 7.3 and later are unaffected
- Product
- Ember ZNet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.silabs.comcommunity.silabs.com
Oct 2, 2023Mattermost fails to check the Show Full Name option at the /api/v4/teams/TEAM_ID/top/team_members endpoint allowing a member to get the full name of another useCVE-2023-5160 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 4.3
Mattermost fails to check the Show Full Name option at the /api/v4/teams/TEAM_ID/top/team_members endpoint allowing a member to get the full name of another user even if the Show Full Name option was disabled
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Sep 29, 2023Mattermost fails to properly validate the permissions when soft deleting a team allowing a team member to soft delete other teams that they are not part of CVE-2023-5195 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 6.5
Mattermost fails to properly validate the permissions when soft deleting a team allowing a team member to soft delete other teams that they are not part of
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Sep 20, 2023Cross Site Request Forgery (CSRF) vulnerability in icmsdev iCMSv.7.0.16 allows a remote attacker to execute arbitrary code via the user.admincp.php, members.admCVE-2023-42321 · Other software · Icmsdev · reported by MITREHigh 8.8
Cross Site Request Forgery (CSRF) vulnerability in icmsdev iCMSv.7.0.16 allows a remote attacker to execute arbitrary code via the user.admincp.php, members.admincp.php, and group.admincp.php files.
- Product
- Icms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comicmsdev.com
Sep 20, 2023An information leak in kokoroe_members card Line 13.6.1 allows attackers to obtain the channel access token and send crafted messages.CVE-2023-39045 · Other software · Kokoroe Members Card Project · reported by MITREMedium 6.5
An information leak in kokoroe_members card Line 13.6.1 allows attackers to obtain the channel access token and send crafted messages.
- Product
- Kokoroe Members Card
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2023An information leak in THE_B_members card v13.6.1 allows attackers to obtain the channel access token and send crafted messages.CVE-2023-39058 · Other software · The B Members Card Project · reported by MITREMedium 6.5
An information leak in THE_B_members card v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
- Product
- The B Members Card
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2023Simple Membership: Reflected Cross-Site ScriptingCVE-2023-4719 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Simple Membership plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `list_type` parameter in versions up to, and including, 4.3.5 due to insufficient input sanitization and output escaping. Using this vulnerability, unauthenticated attackers could inject arbitrary web scripts into pages that are being executed if they can successfully trick a user into taking an action, such as clicking a malicious link.
- Product
- Simple Membership
- Affected
- up to 4.3.5
- What to do
- Affects up to 4.3.5. Update Simple Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Aug 30, 2023Cross Site Scripting vulnerabiltiy in Badaso v.0.0.1 thru v.2.9.7 allows a remote attacker to execute arbitrary code via a crafted payload to the Name of memberCVE-2023-38970 · Other software · Uatech · reported by MITREMedium 5.4
Cross Site Scripting vulnerabiltiy in Badaso v.0.0.1 thru v.2.9.7 allows a remote attacker to execute arbitrary code via a crafted payload to the Name of member parameter in the add new member function.
- Product
- Badaso
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.companda002.hashnode.dev
Aug 11, 2023An issue was discovered in getRememberedSerializedIdentity function in CookieRememberMeManager class in lerry903 RuoYi version 3.4.0, allows remote attackers toCVE-2021-28411 · Other software · Ruoyi · reported by MITRECritical 9.8
An issue was discovered in getRememberedSerializedIdentity function in CookieRememberMeManager class in lerry903 RuoYi version 3.4.0, allows remote attackers to escalate privileges.
- Product
- Ruoyi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2023Protection mechanism failure for some Intel(R) Arc(TM) graphics cards A770 and A750 Limited Edition sold between October of 2022 and December of 2022 may allow CVE-2022-41984 · Other software · Intel · reported by secure@intel.comMedium 4.4
Protection mechanism failure for some Intel(R) Arc(TM) graphics cards A770 and A750 Limited Edition sold between October of 2022 and December of 2022 may allow a privileged user to potentially enable denial of service via local access.
- Product
- ARC A750 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2023Improper access control for some Intel(R) Arc(TM) graphics cards A770 and A750 Limited Edition sold between October of 2022 and December of 2022 may allow an auCVE-2022-38973 · Other software · Intel · reported by secure@intel.comLow 3.3
Improper access control for some Intel(R) Arc(TM) graphics cards A770 and A750 Limited Edition sold between October of 2022 and December of 2022 may allow an authenticated user to potentially enable denial of service or infomation disclosure via local access.
- Product
- ARC A750 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 9, 2023Improper URL validation vulnerability in Samsung Members prior to version 14.0.07.1 allows attackers to access sensitive information.CVE-2023-30703 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comLow 3.3
Improper URL validation vulnerability in Samsung Members prior to version 14.0.07.1 allows attackers to access sensitive information.
- Product
- Samsung Members
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Aug 8, 2023SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the membermonth parameter within the /QueryView.phCVE-2023-38765 · Other software · Churchcrm · reported by MITREHigh 7.5
SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the membermonth parameter within the /QueryView.php.
- Product
- Churchcrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchurchcrm.iodemo.churchcrm.io
Jul 31, 2023Fuge CMS v1.0 contains an Open Redirect vulnerability in member/RegisterAct.java.CVE-2023-34917 · Other software · CMS Project · reported by MITREMedium 6.1
Fuge CMS v1.0 contains an Open Redirect vulnerability in member/RegisterAct.java.
- Product
- CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2023Repute InfoSystems ARMember: Auth. (admin+) Stored Cross-Site Scripting (XSS)CVE-2022-47421 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Repute InfoSystems ARMember (free), Repute InfoSystems ARMember (premium) plugins.
- Product
- Repute InfoSystems ARMember
- What to do
- Update Repute InfoSystems ARMember to the newest version.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 17, 2023Mattermost WelcomeBot plugin fails to to validate the membership status when inviting or adding users to channels allowing guest accounts to be added or invitedCVE-2023-3613 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comLow 3.5
Mattermost WelcomeBot plugin fails to to validate the membership status when inviting or adding users to channels allowing guest accounts to be added or invited to channels by default.
- Product
- Mattermost Plugins
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jul 17, 2023Mattermost fails to verify channel membership when linking a board to a channel allowing a low-privileged authenticated user to link a Board to a private channeCVE-2023-3582 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 4.3
Mattermost fails to verify channel membership when linking a board to a channel allowing a low-privileged authenticated user to link a Board to a private channel they don't have access to,
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jul 17, 2023Membership: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-3182 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Membership WordPress plugin before 3.2.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Membership
- Fixed in
- 3.2.3
- What to do
- Update Membership to 3.2.3 or newer.
Jul 17, 2023Cross-Site Request Forgery (CSRF) vulnerability in Ultimate Member plugin <= 2.6.0 versions.CVE-2023-31216 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Ultimate Member plugin <= 2.6.0 versions.
- Affected
- up to 2.6.0
- What to do
- Affects up to 2.6.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 12, 2023ARMember: Cross-Site Request ForgeryCVE-2023-3011 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The ARMember plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.0.5. This is due to missing or incorrect nonce validation on the arm_check_user_cap function. This makes it possible for unauthenticated attackers to perform multiple unauthorized actions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- ARMember
- Affected
- up to 4.0.5
- What to do
- Affects up to 4.0.5. Update ARMember to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jul 12, 2023WP-Members Membership: Unauthorized plugin settings updateCVE-2023-2869 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP-Members Membership plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the do_field_reorder function in versions up to, and including, 3.4.7.3. This makes it possible for authenticated attackers with subscriber-level access to reorder form elements on login forms.
- Product
- WP-Members Membership
- Affected
- up to 3.4.7.3
- What to do
- Affects up to 3.4.7.3. Update WP-Members Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 5, 2023Cross Site Scripting (XSS) in Sophos Sophos iView (The EOL was December 31st 2020) in grpname parameter that allows arbitrary script to be executed.CVE-2023-33335 · Network & remote access · Sophos · reported by MITREMedium 6.1
Cross Site Scripting (XSS) in Sophos Sophos iView (The EOL was December 31st 2020) in grpname parameter that allows arbitrary script to be executed.
- Product
- Iview
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordinf0seq.github.ioinf0seq.github.io
Jul 4, 2023Ultimate Member: Does not prevent visitors from creating user accounts with arbitrary capabilitiesCVE-2023-3460 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Ultimate Member WordPress plugin before 2.6.7 does not prevent visitors from creating user accounts with arbitrary capabilities, effectively allowing attackers to create administrator accounts at will. This is actively being exploited in the wild.
- Product
- Ultimate Member
- Fixed in
- 2.6.7
- What to do
- Update Ultimate Member to 2.6.7 or newer.
Full record and what to do →NVD recordblog.wpscan.comwpscan.com
Jun 23, 2023POS Codekop v2.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the nm_member parameter at print.php.CVE-2023-36346 · Other software · Codekop · reported by MITREMedium 6.1
POS Codekop v2.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the nm_member parameter at print.php.
- Product
- Codekop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comyoutube.com
Jun 19, 2023Mozilla developers and community members Ronald Crane, Andrew McCreight, Randell Jesup and the Mozilla Fuzzing Team reported memory safety bugs present in FirefCVE-2023-32216 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.8
Mozilla developers and community members Ronald Crane, Andrew McCreight, Randell Jesup and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 112. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 113.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgsecurity.gentoo.org
Jun 18, 2023VirtualSquare picoTCP (aka PicoTCP-NG) through 2.1 lacks certain size calculations before attempting to set a value of an mss structure member.CVE-2023-35848 · Other software · Virtualsquare · reported by MITREHigh 7.5
VirtualSquare picoTCP (aka PicoTCP-NG) through 2.1 lacks certain size calculations before attempting to set a value of an mss structure member.
- Product
- Picotcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2023Mattermost fails to check channel membership when accessing message threads, allowing an attacker to access arbitrary posts by using the message threads API.CVE-2023-2787 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 6.5
Mattermost fails to check channel membership when accessing message threads, allowing an attacker to access arbitrary posts by using the message threads API.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jun 16, 2023Mattermost fails to properly check the permissions when executing commands allowing a member with no permissions to post a message in a channel to actually postCVE-2023-2786 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 4.3
Mattermost fails to properly check the permissions when executing commands allowing a member with no permissions to post a message in a channel to actually post it by executing channel commands.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jun 2, 2023Mozilla developers and community members Gabriele Svelto, Andrew Osmond, Emily McDonough, Sebastian Hengst, Andrew McCreight and the Mozilla Fuzzing Team reportCVE-2023-32215 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.8
Mozilla developers and community members Gabriele Svelto, Andrew Osmond, Emily McDonough, Sebastian Hengst, Andrew McCreight and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 112 and Firefox ESR 102.10. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgsecurity.gentoo.org
Jun 2, 2023Members of the <code>DEVMODEW</code> struct set by the printer device driver weren't being validated and could have resulted in invalid values which in turn wouCVE-2023-25738 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.5
Members of the <code>DEVMODEW</code> struct set by the printer device driver weren't being validated and could have resulted in invalid values which in turn would cause the browser to attempt out of bounds access to related variables.<br>*This bug only affects Firefox on Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
May 21, 2023In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, configuration routines don't mask passwords in the member configuration properly.CVE-2023-33264 · Other software · Hazelcast · reported by MITREMedium 4.3
In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, configuration routines don't mask passwords in the member configuration properly. This allows Hazelcast Management Center users to view some of the secrets.
- Product
- Hazelcast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2023WCFM Membership – WooCommerce Memberships for Multivendor Marketplace: Insecure Direct Object ReferencesCVE-2023-2276 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WCFM Membership – WooCommerce Memberships for Multivendor Marketplace plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 2.10.7. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for unauthenticated attackers to change user passwords and potentially take over administrator accounts.
- Product
- WCFM Membership – WooCommerce Memberships for Multivendor Marketplace
- Affected
- up to 2.10.7
- What to do
- Affects up to 2.10.7. Update WCFM Membership – WooCommerce Memberships for Multivendor Marketplace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordlana.codesplugins.trac.wordpress.org
May 11, 2023A vulnerability has been identified in Rocket.Chat, where the ACL checks in the Slash Command /mute occur after checking whether a user is a member of a given cCVE-2023-28357 · Other software · Rocket.chat · reported by support@hackerone.comMedium 4.3
A vulnerability has been identified in Rocket.Chat, where the ACL checks in the Slash Command /mute occur after checking whether a user is a member of a given channel, leaking private channel members to unauthorized users. This allows authenticated users to enumerate whether a username is a member of a channel that they do not have access to.
- Product
- Rocket.chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comhackerone.com
May 8, 2023Ghost is an app for new-media creators with tools to build a website, publish content, send newsletters, and offer paid subscriptions to members.CVE-2023-31133 · Other software · TryGhost · reported by GitHubHigh 7.5
Ghost is an app for new-media creators with tools to build a website, publish content, send newsletters, and offer paid subscriptions to members. Prior to version 5.46.1, due to a lack of validation when filtering on the public API endpoints, it is possible to reveal private fields via a brute force attack. Ghost(Pro) has already been patched. Maintainers can find no evidence that the issue was exploited on Ghost(Pro) prior to the patch being added. Self-hosters are impacted if running Ghost a version below v5.46.1. v5.46.1 contains a fix for this issue. As a workaround, add a block for requests to `/ghost/api/content/*` where the `filter` query parameter contains `password` or `email`.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2023Membership Database: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-0514 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Membership Database WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Membership Database
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Membership Database to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 28, 2023wuzhicms v4.1.0 is vulnerable to Cross Site Scripting (XSS) in the Member Center, Account Settings.CVE-2023-30123 · Other software · Wuzhicms · reported by MITREMedium 5.4
wuzhicms v4.1.0 is vulnerable to Cross Site Scripting (XSS) in the Member Center, Account Settings.
- Product
- Wuzhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2023PWS Personal Weather Station Dashboard (PWS_Dashboard) LTS December 2020 (2012_lts) allows remote code execution by injecting PHP code into settings.php.CVE-2022-45291 · Other software · Pwsdashboard · reported by MITREHigh 7.2
PWS Personal Weather Station Dashboard (PWS_Dashboard) LTS December 2020 (2012_lts) allows remote code execution by injecting PHP code into settings.php. Attacks can use the PWS_printfile.php, PWS_frame_text.php, PWS_listfile.php, PWS_winter.php, and PWS_easyweathersetup.php endpoints. A contributing factor is a hardcoded login password of support, which is not documented. (This is not the same as the documented setup password, which is 12345.) The issue was fixed in late 2022.
- Product
- Personal Weather Station Dashboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcavefxa.compwsdashboard.com
Apr 13, 2023protobuf-c before 1.4.1 has an unsigned integer overflow in parse_required_member.CVE-2022-48468 · Other software · Protobuf-c Project · reported by MITREMedium 5.5
protobuf-c before 1.4.1 has an unsigned integer overflow in parse_required_member.
- Product
- Protobuf-c
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2023WCFM Membership: Cross-Site Request ForgeryCVE-2022-4941 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The WCFM Membership plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.9.10 due to missing nonce checks on various AJAX actions. This makes it possible for unauthenticated attackers to perform a wide variety of actions such as modifying membership details, changing renewal information, controlling membership approvals, and more, via a forged request granted they can trick a site's administrator into performing an action such as clicking on a link.
- Product
- WCFM Membership
- Affected
- up to 2.9.10
- What to do
- Affects up to 2.9.10. Update WCFM Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 5, 2023WCFM Membership: Unauthorized modification and access of dataCVE-2022-4940 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The WCFM Membership plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 2.10.0 due to missing capability checks on various AJAX actions. This makes it possible for unauthenticated attackers to perform a wide variety of actions such as modifying membership details, changing renewal information, controlling membership approvals, and more.
- Product
- WCFM Membership
- Affected
- up to 2.10.0
- What to do
- Affects up to 2.10.0. Update WCFM Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 5, 2023WCFM Membership: Privilege escalationCVE-2022-4939 · WordPress plugins & themes · reported by WordfenceCritical 9.8
THe WCFM Membership plugin for WordPress is vulnerable to privilege escalation in versions up to, and including 2.10.0, due to a missing capability check on the wp_ajax_nopriv_wcfm_ajax_controller AJAX action that controls membership settings. This makes it possible for unauthenticated attackers to modify the membership registration form in a way that allows them to set the role for registration to that of any user including administrators. Once configured, the attacker can then register as an administrator.
- Product
- WCFM Membership
- Affected
- up to 2.10.0
- What to do
- Affects up to 2.10.0. Update WCFM Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.