Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,121 results · page 20 of 43
Dec 13, 2023IBM SAN Volume Controller, IBM Storwize, IBM FlashSystem and IBM Storage Virtualize 8.3 products use default passwords for a privileged user.CVE-2023-43042 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.5
IBM SAN Volume Controller, IBM Storwize, IBM FlashSystem and IBM Storage Virtualize 8.3 products use default passwords for a privileged user. IBM X-Force ID: 266874.
- Product
- Storage Virtualize
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comhttps
Dec 13, 2023IBM System Storage Virtualization Engine TS7700 3957-VEC, 3948-VED and 3957-VEC could allow a remote attacker to obtain sensitive information when a detailed teCVE-2023-49878 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM System Storage Virtualization Engine TS7700 3957-VEC, 3948-VED and 3957-VEC could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 272652.
- Product
- System Storage Virtualization Engine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Dec 13, 2023IBM System Storage Virtualization Engine TS7700 3957-VEC, 3948-VED and 3957-VEC could allow a remote authenticated user to obtain sensitive information, caused CVE-2023-49877 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM System Storage Virtualization Engine TS7700 3957-VEC, 3948-VED and 3957-VEC could allow a remote authenticated user to obtain sensitive information, caused by improper filtering of URLs. By submitting a specially crafted HTTP GET request, an attacker could exploit this vulnerability to view application source code, system configuration information, or other sensitive data related to the Management Interface. IBM X-Force ID: 272651.
- Product
- System Storage Virtualization Engine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Dec 7, 2023SENEC Storage Box V1,V2 and V3 accidentially expose a management UI accessible with publicly known admin credentials.CVE-2023-39171 · Other software · SENEC · reported by info@cert.vde.comHigh 7.2
SENEC Storage Box V1,V2 and V3 accidentially expose a management UI accessible with publicly known admin credentials.
- Product
- Storage Box V1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Dec 7, 2023The affected devices use publicly available default credentials with administrative privileges.CVE-2023-39169 · Other software · SENEC · reported by info@cert.vde.comCritical 9.8
The affected devices use publicly available default credentials with administrative privileges.
- Product
- Storage Box V1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Dec 7, 2023The affected devices transmit sensitive information unencrypted allowing a remote unauthenticated attacker to capture and modify network traffic.CVE-2023-39172 · Other software · SENEC · reported by info@cert.vde.comCritical 9.1
The affected devices transmit sensitive information unencrypted allowing a remote unauthenticated attacker to capture and modify network traffic.
- Product
- Storage Box V1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Dec 7, 2023In SENEC Storage Box V1,V2 and V3 an unauthenticated remote attacker can obtain the devices' logfiles that contain sensitive data.CVE-2023-39167 · Other software · SENEC · reported by info@cert.vde.comHigh 7.5
In SENEC Storage Box V1,V2 and V3 an unauthenticated remote attacker can obtain the devices' logfiles that contain sensitive data.
- Product
- Storage Box V1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Dec 4, 2023 Dell DM5500 5.14.0.0, contain a Plain-text Password Storage Vulnerability in the appliance.CVE-2023-44300 · Other software · Dell · reported by security_alert@emc.comMedium 5.5
Dell DM5500 5.14.0.0, contain a Plain-text Password Storage Vulnerability in the appliance. A local attacker with privileges could potentially exploit this vulnerability, leading to the disclosure of certain service credentials. The attacker may be able to use the exposed credentials to access the vulnerable application with privileges of the compromised account.
- Product
- Dell PowerProtect Data Manager DM5500 Appliance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2023Nextcloud Server provides data storage for Nextcloud, an open source cloud platform.CVE-2023-48306 · Other software · nextcloud · reported by GitHubMedium 5
Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.11, 26.0.6, and 27.1.0 of Nextcloud Server and starting in version 22.0.0 and prior to versions 22.2.10.16, 23.0.12.11, 24.0.12.7, 25.0.11, 26.0.6, and 27.1.0 of Nextcloud Enterprise Server, the DNS pin middleware was vulnerable to DNS rebinding allowing an attacker to perform SSRF as a final result. Nextcloud Server 25.0.11, 26.0.6, and 27.1.0 and Nextcloud Enterprise Server 22.2.10.16, 23.0.12.11, 24.0.12.7, 25.0.11, 26.0.6, and 27.1.0 contain patches for this issue. No known workarounds are available.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2023Nextcloud Server provides data storage for Nextcloud, an open source cloud platform.CVE-2023-48305 · Other software · nextcloud · reported by GitHubMedium 4.2
Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.11, 26.0.6, and 27.1.0 of Nextcloud Server and Nextcloud Enterprise Server, when the log level was set to debug, the user_ldap app logged user passwords in plaintext into the log file. If the log file was then leaked or shared in any way the users' passwords would be leaked. Nextcloud Server and Nextcloud Enterprise Server versions 25.0.11, 26.0.6, and 27.1.0 contain a patch for this issue. As a workaround, change config setting `loglevel` to `1` or higher (should always be higher than 1 in production environments).
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2023Nextcloud Server provides data storage for Nextcloud, an open source cloud platform.CVE-2023-48304 · Other software · nextcloud · reported by GitHubMedium 4.3
Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.11, 26.0.6, and 27.1.0 of Nextcloud Server and starting in version 22.0.0 and prior to versions 22.2.10.16, 23.0.12.11, 24.0.12.7, 25.0.11, 26.0.6, and 27.1.0 of Nextcloud Enterprise Server, an attacker could enable and disable the birthday calendar for any user on the same server. Nextcloud Server 25.0.11, 26.0.6, and 27.1.0 and Nextcloud Enterprise Server 22.2.10.16, 23.0.12.11, 24.0.12.7, 25.0.11, 26.0.6, and 27.1.0 contain patches for this issue. No known workarounds are available.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2023Nextcloud Server provides data storage for Nextcloud, an open source cloud platform.CVE-2023-48303 · Other software · nextcloud · reported by GitHubLow 2.4
Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.11, 26.0.6, and 27.1.0 of Nextcloud Server and Nextcloud Enterprise Server, admins can change authentication details of user configured external storage. Nextcloud Server and Nextcloud Enterprise Server versions 25.0.11, 26.0.6, and 27.1.0 contain a patch for this issue. No known workarounds are available.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2023Nextcloud Server provides data storage for Nextcloud, an open source cloud platform.CVE-2023-48302 · Other software · nextcloud · reported by GitHubLow 3.5
Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.13, 26.0.8, and 27.1.3 of Nextcloud Server and Nextcloud Enterprise Server, when a user is tricked into copy pasting HTML code without markup (Ctrl+Shift+V) the markup will actually render. Nextcloud Server and Nextcloud Enterprise Server versions 25.0.13, 26.0.8, and 27.1.3 contain a fix for this issue. As a workaround, disable app text.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2023Nextcloud Server provides data storage for Nextcloud, an open source cloud platform.CVE-2023-48301 · Other software · nextcloud · reported by GitHubLow 3.5
Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.13, 26.0.8, and 27.1.3 of Nextcloud Server and Nextcloud Enterprise Server, an attacker could insert links into circles name that would be opened when clicking the circle name in a search filter. Nextcloud Server and Nextcloud Enterprise Server versions 25.0.13, 26.0.8, and 27.1.3 contain a fix for this issue. As a workaround, disable app circles.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2023Nextcloud Server provides data storage for Nextcloud, an open source cloud platform.CVE-2023-48239 · Other software · nextcloud · reported by GitHubHigh 8.5
Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.13, 26.0.8, and 27.1.3 of Nextcloud Server and starting in version 20.0.0 and prior to versions 20.0.14.16, 21.0.9.13, 22.2.10.15, 23.0.12.12, 24.0.12.8, 25.0.13, 26.0.8, and 27.1.3 of Nextcloud Enterprise Server, a malicious user could update any personal or global external storage, making them inaccessible for everyone else as well. Nextcloud Server 25.0.13, 26.0.8, and 27.1.3 and Nextcloud Enterprise Server is upgraded to 20.0.14.16, 21.0.9.13, 22.2.10.15, 23.0.12.12, 24.0.12.8, 25.0.13, 26.0.8, and 27.1.3 contain a patch for this issue. As a workaround, disable app files_external. This workaround also makes the external storage inaccessible but retains the configurations until a patched version has been deployed.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2023When using X11, text selected by the page using the Selection API was erroneously copied into the primary selection, a temporary storage not unlike the clipboarCVE-2023-6208 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.8
When using X11, text selected by the page using the Selection API was erroneously copied into the primary selection, a temporary storage not unlike the clipboard. *This bug only affects Firefox on X11. Other systems are unaffected.* This vulnerability affects Firefox < 120, Firefox ESR < 115.5.0, and Thunderbird < 115.5.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orglists.debian.org
Nov 14, 2023Insecure inherited permissions in some Intel Rapid Storage Technology software before version 16.8.5.1014.9 may allow an authenticated user to potentially enablCVE-2023-39230 · Other software · Intel · reported by secure@intel.comMedium 6.7
Insecure inherited permissions in some Intel Rapid Storage Technology software before version 16.8.5.1014.9 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- Rapid Storage Technology
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2023Improper access control in firmware for some Intel(R) Optane(TM) SSD products may allow an unauthenticated user to potentially enable information disclosure viaCVE-2023-27879 · Other software · Intel · reported by secure@intel.comMedium 6.8
Improper access control in firmware for some Intel(R) Optane(TM) SSD products may allow an unauthenticated user to potentially enable information disclosure via physical access.
- Product
- Optane Memory H20 With Solid State Storage Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2023Improper input validation in firmware for some Intel(R) Optane(TM) SSD products may allow a privileged user to potentially enable escalation of privilege via loCVE-2023-27519 · Other software · Intel · reported by secure@intel.comMedium 6.9
Improper input validation in firmware for some Intel(R) Optane(TM) SSD products may allow a privileged user to potentially enable escalation of privilege via local access.
- Product
- Optane Memory H20 With Solid State Storage Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2023Improper Initialization in firmware for some Intel(R) Optane(TM) SSD products may allow an authenticated user to potentially enable denial of service via local CVE-2023-27306 · Other software · Intel · reported by secure@intel.comMedium 6.5
Improper Initialization in firmware for some Intel(R) Optane(TM) SSD products may allow an authenticated user to potentially enable denial of service via local access.
- Product
- Optane Memory H20 With Solid State Storage Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2023Exposure of sensitive information to an unauthorized actor in firmware for some Intel(R) Optane(TM) SSD products may allow an unauthenticated user to potentiallCVE-2023-24588 · Other software · Intel · reported by secure@intel.comMedium 5.9
Exposure of sensitive information to an unauthorized actor in firmware for some Intel(R) Optane(TM) SSD products may allow an unauthenticated user to potentially enable information disclosure via physical access.
- Product
- Optane Memory H20 With Solid State Storage Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2023Insufficient control flow management in firmware for some Intel(R) Optane(TM) SSD products may allow a privileged user to potentially enable denial of service vCVE-2023-24587 · Other software · Intel · reported by secure@intel.comMedium 6.9
Insufficient control flow management in firmware for some Intel(R) Optane(TM) SSD products may allow a privileged user to potentially enable denial of service via local access.
- Product
- Optane Memory H20 With Solid State Storage Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2023Windows Storage Elevation of Privilege VulnerabilityCVE-2023-36399 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.1
Windows Storage Elevation of Privilege Vulnerability
- Product
- Windows Server 2022, 23H2 Edition (Server Core installation)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Nov 8, 2023The remote PIN module has a vulnerability that causes incorrect information storage locations.Successful exploitation of this vulnerability may affect confidentCVE-2023-46757 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
The remote PIN module has a vulnerability that causes incorrect information storage locations.Successful exploitation of this vulnerability may affect confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Oct 31, 2023Uncontrolled resource consumption vulnerability in Cybozu Remote Service 4.1.0 to 4.1.1 allows a remote authenticated attacker to consume huge storage space or CVE-2023-46278 · Other software · Cybozu, Inc. · reported by vultures@jpcert.or.jpMedium 6.5
Uncontrolled resource consumption vulnerability in Cybozu Remote Service 4.1.0 to 4.1.1 allows a remote authenticated attacker to consume huge storage space or cause significantly delayed communication.
- Product
- Cybozu Remote Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2023 EisBaer Scada - CWE-256: Plaintext Storage of a PasswordCVE-2023-42493 · Other software · EisBaer Scada · reported by cna@cyber.gov.ilHigh 7.1
EisBaer Scada - CWE-256: Plaintext Storage of a Password
- Product
- v3.0.6433.1964
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2023When an AWS DynamoDB table is used for user attribute storage, it is possible to retrieve the attributes of another user using a maliciously crafted request CVE-2023-34085 · Other software · Ping Identity · reported by responsible-disclosure@pingidentity.comLow 2.6
When an AWS DynamoDB table is used for user attribute storage, it is possible to retrieve the attributes of another user using a maliciously crafted request
- Product
- PingFederate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pingidentity.compingidentity.com
Oct 23, 2023IBM Security Verify Governance 10.0 does not encrypt sensitive or critical information before storage or transmission.CVE-2023-33837 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.1
IBM Security Verify Governance 10.0 does not encrypt sensitive or critical information before storage or transmission. IBM X-Force ID: 256020.
- Product
- Security Verify Governance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Oct 20, 2023An integer overflow in Silicon Labs Gecko Bootloader version 4.3.1 and earlier allows unbounded memory access when reading from or writing to storage slots.CVE-2023-3487 · Other software · silabs.com · reported by product-security@silabs.comHigh 7.7
An integer overflow in Silicon Labs Gecko Bootloader version 4.3.1 and earlier allows unbounded memory access when reading from or writing to storage slots.
- Product
- GSDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.silabs.comgithub.com
Oct 19, 2023Directory Traversal vulnerability in the storage functionality of the API in Yamcs 5.8.6 allows attackers to delete arbitrary files via crafted HTTP DELETE requCVE-2023-45278 · Other software · Spaceapplications · reported by MITRECritical 9.1
Directory Traversal vulnerability in the storage functionality of the API in Yamcs 5.8.6 allows attackers to delete arbitrary files via crafted HTTP DELETE request.
- Product
- Yamcs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlinkedin.com
Oct 17, 2023Vulnerability in the Sun ZFS Storage Appliance product of Oracle Systems (component: Core).CVE-2023-22130 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 5.9
Vulnerability in the Sun ZFS Storage Appliance product of Oracle Systems (component: Core). The supported version that is affected is 8.8.60. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Sun ZFS Storage Appliance. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Sun ZFS Storage Appliance. CVSS 3.1 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H).
- Product
- Sun ZFS Storage Appliance Kit (AK) Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2023An issue was discovered in drivers/usb/storage/ene_ub6250.c for the ENE UB6250 reader driver in the Linux kernel before 6.2.5.CVE-2023-45862 · Computers, phones & browsers · Linux · reported by MITREMedium 5.5
An issue was discovered in drivers/usb/storage/ene_ub6250.c for the ENE UB6250 reader driver in the Linux kernel before 6.2.5. An object could potentially extend beyond the end of an allocation.
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcdn.kernel.orggit.kernel.org
Oct 13, 2023Nextcloud Server provides data storage for Nextcloud, an open source cloud platform.CVE-2023-39960 · Other software · nextcloud · reported by GitHubMedium 5
Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server starting with 25.0.0 and prior to 25.09 and 26.04; as well as Nextcloud Enterprise Server starting with 22.0.0 and prior to 22.2.10.14, 23.0.12.9, 24.0.12.5, 25.0.9, and 26.0.4; missing protection allows an attacker to brute force passwords on the WebDAV API. Nextcloud Server 25.0.9 and 26.0.4 and Nextcloud Enterprise Server 22.2.10.14, 23.0.12.9, 24.0.12.5, 25.0.9, and 26.0.4 contain patches for this issue. No known workarounds are available.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2023The Statutory Reporting application has a vulnerable file storage location, potentially enabling low privileged attacker to read server files with minimal impacCVE-2023-42475 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
The Statutory Reporting application has a vulnerable file storage location, potentially enabling low privileged attacker to read server files with minimal impact on confidentiality.
- Product
- SAP S/4HANA Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2023IBM Spectrum Protect Client and IBM Storage Protect for Virtual Environments 8.1.0.0 through 8.1.19.0 could allow a local user to execute arbitrary code on the CVE-2023-35897 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.4
IBM Spectrum Protect Client and IBM Storage Protect for Virtual Environments 8.1.0.0 through 8.1.19.0 could allow a local user to execute arbitrary code on the system using a specially crafted file, caused by a DLL hijacking flaw. IBM X-Force ID: 259246.
- Product
- Storage Protect Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Oct 5, 2023 Dell SmartFabric Storage Software version 1.3 and lower contain an improper input validation vulnerability.CVE-2023-32485 · Other software · Dell · reported by security_alert@emc.comCritical 9.8
Dell SmartFabric Storage Software version 1.3 and lower contain an improper input validation vulnerability. A remote unauthenticated attacker may exploit this vulnerability and escalate privileges up to the highest administration level. This is a critical severity vulnerability affecting user authentication. Dell recommends customers to upgrade at the earliest opportunity.
- Product
- Dell SmartFabric Storage Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2023 Dell SmartFabric Storage Software v1.4 (and earlier) contains an OS Command Injection Vulnerability in the CLI use of the ‘more’ command.CVE-2023-4401 · Other software · Dell · reported by security_alert@emc.comHigh 7.8
Dell SmartFabric Storage Software v1.4 (and earlier) contains an OS Command Injection Vulnerability in the CLI use of the ‘more’ command. A local or remote authenticated attacker could potentially exploit this vulnerability, leading to the ability to gain root-level access.
- Product
- Dell SmartFabric Storage Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2023 Dell SmartFabric Storage Software v1.4 (and earlier) contains an Improper Input Validation vulnerability in RADIUS configuration.CVE-2023-43073 · Other software · Dell · reported by security_alert@emc.comMedium 4.3
Dell SmartFabric Storage Software v1.4 (and earlier) contains an Improper Input Validation vulnerability in RADIUS configuration. An authenticated remote attacker could potentially exploit this vulnerability, leading to gaining unauthorized access to data.
- Product
- Dell SmartFabric Storage Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2023 Dell SmartFabric Storage Software v1.4 (and earlier) contains an improper access control vulnerability in the CLI.CVE-2023-43072 · Other software · Dell · reported by security_alert@emc.comMedium 4.4
Dell SmartFabric Storage Software v1.4 (and earlier) contains an improper access control vulnerability in the CLI. A local possibly unauthenticated attacker could potentially exploit this vulnerability, leading to ability to execute arbritrary shell commands.
- Product
- Dell SmartFabric Storage Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2023 Dell SmartFabric Storage Software v1.4 (and earlier) contains possible vulnerabilities for HTML injection or CVS formula injection which might escalate to crosCVE-2023-43071 · Other software · Dell · reported by security_alert@emc.comMedium 4.4
Dell SmartFabric Storage Software v1.4 (and earlier) contains possible vulnerabilities for HTML injection or CVS formula injection which might escalate to cross-site scripting attacks in HTML pages in the GUI. A remote authenticated attacker could potentially exploit these issues, leading to various injection type attacks.
- Product
- Dell SmartFabric Storage Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2023 Dell SmartFabric Storage Software v1.4 (and earlier) contains a Path Traversal Vulnerability in the HTTP interface.CVE-2023-43070 · Other software · Dell · reported by security_alert@emc.comMedium 6.3
Dell SmartFabric Storage Software v1.4 (and earlier) contains a Path Traversal Vulnerability in the HTTP interface. A remote authenticated attacker could potentially exploit this vulnerability, leading to modify or write arbitrary files to arbitrary locations in the license container.
- Product
- Dell SmartFabric Storage Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2023 Dell SmartFabric Storage Software v1.4 (and earlier) contain(s) an OS Command Injection Vulnerability in the CLI.CVE-2023-43069 · Other software · Dell · reported by security_alert@emc.comHigh 7.8
Dell SmartFabric Storage Software v1.4 (and earlier) contain(s) an OS Command Injection Vulnerability in the CLI. An authenticated local attacker could potentially exploit this vulnerability, leading to possible injection of parameters to curl or docker.
- Product
- Dell SmartFabric Storage Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2023 Dell SmartFabric Storage Software v1.4 (and earlier) contains an OS Command Injection Vulnerability in the restricted shell in SSH.CVE-2023-43068 · Other software · Dell · reported by security_alert@emc.comHigh 7.8
Dell SmartFabric Storage Software v1.4 (and earlier) contains an OS Command Injection Vulnerability in the restricted shell in SSH. An authenticated remote attacker could potentially exploit this vulnerability, leading to execute arbitrary commands.
- Product
- Dell SmartFabric Storage Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2023A flaw exists in VASA which allows users with access to a vSphere/ESXi VMware admin on a FlashArray to gain root access through privilege escalation.CVE-2023-36628 · Other software · Pure Storage · reported by psirt@purestorage.comHigh 8.8
A flaw exists in VASA which allows users with access to a vSphere/ESXi VMware admin on a FlashArray to gain root access through privilege escalation.
- Product
- FlashArray Purity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.purestorage.comsupport.purestorage.com
Oct 2, 2023A flaw exists in FlashArray Purity wherein under limited circumstances, an array administrator can alter the retention lock of a pgroup and disable pgroup SafeMCVE-2023-32572 · Other software · Pure Storage · reported by psirt@purestorage.comMedium 6.5
A flaw exists in FlashArray Purity wherein under limited circumstances, an array administrator can alter the retention lock of a pgroup and disable pgroup SafeMode protection.
- Product
- FlashArray Purity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2023A flaw exists in FlashArray Purity whereby an array administrator by configuring an external key manager can affect the availability of data on the system incluCVE-2023-28373 · Other software · Pure Storage · reported by psirt@purestorage.comMedium 4.4
A flaw exists in FlashArray Purity whereby an array administrator by configuring an external key manager can affect the availability of data on the system including snapshots protected by SafeMode.
- Product
- FlashArray Purity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.purestorage.comsupport.purestorage.com
Oct 2, 2023A flaw exists in FlashBlade Purity whereby a user with access to an administrative account on a FlashBlade that is configured with timezone-dependent snapshot sCVE-2023-36627 · Other software · Pure Storage · reported by psirt@purestorage.comHigh 7.7
A flaw exists in FlashBlade Purity whereby a user with access to an administrative account on a FlashBlade that is configured with timezone-dependent snapshot schedules can configure a timezone to prevent the schedule from functioning properly.
- Product
- FlashBlade Purity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.purestorage.comsupport.purestorage.com
Oct 2, 2023A flaw exists in FlashBlade Purity whereby an authenticated user with access to FlashBlade’s object store protocol can impact the availability of the system’s dCVE-2023-31042 · Other software · Pure Storage · reported by psirt@purestorage.comHigh 7.7
A flaw exists in FlashBlade Purity whereby an authenticated user with access to FlashBlade’s object store protocol can impact the availability of the system’s data access and replication protocols.
- Product
- FlashBlade Purity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.purestorage.comsupport.purestorage.com
Oct 2, 2023A flaw exists in FlashBlade Purity (OE) Version 4.1.0 whereby a user with privileges to extend an object’s retention period can affect the availability of the CVE-2023-28372 · Other software · Pure Storage · reported by psirt@purestorage.comMedium 6.5
A flaw exists in FlashBlade Purity (OE) Version 4.1.0 whereby a user with privileges to extend an object’s retention period can affect the availability of the object lock.
- Product
- FlashBlade
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.purestorage.comsupport.purestorage.com
Sep 27, 2023Sensitive information disclosure due to cleartext storage of sensitive information.CVE-2023-44159 · Other software · Acronis · reported by security@acronis.comHigh 7.5
Sensitive information disclosure due to cleartext storage of sensitive information. The following products are affected: Acronis Cyber Protect 15 (Linux, Windows) before build 35979.
- Product
- Acronis Cyber Protect 15
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity-advisory.acronis.comsecurity-advisory.acronis.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.