Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,763 results · page 21 of 56
Dec 16, 2022In Emby Server 4.6.7.0, the playlist name field is vulnerable to XSS stored where it is possible to steal the administrator access token and flip or steal the mCVE-2022-36223 · Other software · Emby · reported by MITREMedium 6.1
In Emby Server 4.6.7.0, the playlist name field is vulnerable to XSS stored where it is possible to steal the administrator access token and flip or steal the media server administrator account.
- Product
- Emby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2022Debug tool in Secomea SiteManager allows logged-in administrator to modify system state in an unintended manner.CVE-2022-38124 · Other software · Secomea · reported by VulnerabilityReporting@secomea.comMedium 5.7
Debug tool in Secomea SiteManager allows logged-in administrator to modify system state in an unintended manner.
- Product
- SiteManager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecomea.comsecomea.com
Dec 12, 2022In IFM Moneo Appliance with version up to 1.9.3 an unauthenticated remote attacker can reset the administrator password by only supplying the serial number and CVE-2022-3485 · Other software · ifm · reported by info@cert.vde.comCritical 9.8
In IFM Moneo Appliance with version up to 1.9.3 an unauthenticated remote attacker can reset the administrator password by only supplying the serial number and thus gain full control of the device.
- Product
- moneo appliance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcert.vde.com
Dec 11, 2022Under certain conditions, an attacker authenticated as a CMS administrator and with high privileges access to the Network in SAP BusinessObjects Business IntellCVE-2022-31596 · Network & remote access · SAP · reported by cna@sap.comMedium 6
Under certain conditions, an attacker authenticated as a CMS administrator and with high privileges access to the Network in SAP BusinessObjects Business Intelligence Platform (Monitoring DB) - version 430, can access BOE Monitoring database to retrieve and modify (non-personal) system data which would otherwise be restricted. Also, a potential attack could be used to leave the CMS's scope and impact the database. A successful attack could have a low impact on confidentiality, a high impact on integrity, and a low impact on availability.
- Product
- SAP Business Objects Platform (Monitoring DB)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comsap.com
Dec 8, 2022In JetBrains TeamCity between 2022.10 and 2022.10.1 connecting to AWS using the "Default Credential Provider Chain" allowed TeamCity project administrators to aCVE-2022-46831 · Other software · JetBrains · reported by cve@jetbrains.comMedium 6.6
In JetBrains TeamCity between 2022.10 and 2022.10.1 connecting to AWS using the "Default Credential Provider Chain" allowed TeamCity project administrators to access AWS resources normally limited to TeamCity system administrators.
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
Dec 8, 2022In certain Secustation products the administrator account password can be read.CVE-2022-40939 · Other software · Secu · reported by MITREMedium 4.9
In certain Secustation products the administrator account password can be read. This affects V2.5.5.3116-S50-SMA-B20171107A, V2.3.4.1301-M20-TSA-B20150617A, V2.5.5.3116-S50-RXA-B20180502A, V2.5.5.3116-S50-SMA-B20190723A, V2.5.5.3116-S50-SMB-B20161012A, V2.3.4.2103-S50-NTD-B20170508B, V2.5.5.3116-S50-SMB-B20160601A, V2.5.5.2601-S50-TSA-B20151229A, and V2.5.5.3116-S50-SMA-B20170217.
- Product
- Secustation Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcdsbz.gitbook.iocdsbz.gitbook.io
Dec 6, 2022 In all versions of BIG-IP, when running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance mode restrictiCVE-2022-41800 · Network & remote access · F5 · reported by f5sirt@f5.comHigh 8.7
In all versions of BIG-IP, when running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance mode restrictions, utilizing an undisclosed iControl REST endpoint. A successful exploit can allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- Product
- BIG-IP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.f5.comsupport.f5.com
Dec 6, 2022A Cross-Site Request Forgery (CSRF) in the Administrator List of MetInfo v7.7 allows attackers to arbitrarily add Super Administrator account.CVE-2022-44849 · Other software · Metinfo · reported by MITREHigh 8.8
A Cross-Site Request Forgery (CSRF) in the Administrator List of MetInfo v7.7 allows attackers to arbitrarily add Super Administrator account.
- Product
- Metinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 6, 2022Improper Input Validation of plugin files in Administrator Interface of Secomea GateManager allows a server administrator to inject code into the GateManager inCVE-2022-38123 · Other software · Secomea · reported by VulnerabilityReporting@secomea.comHigh 8.7
Improper Input Validation of plugin files in Administrator Interface of Secomea GateManager allows a server administrator to inject code into the GateManager interface. This issue affects: Secomea GateManager versions prior to 10.0.
- Product
- GateManager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecomea.comsecomea.com
Dec 5, 2022A default username and password for an administrator account was discovered in ZKTeco ZKTime 10.0 through 11.1.0, builds 20180901, 20190510.1, 20200309.3, 20200CVE-2021-39434 · Other software · Zkteco · reported by MITREHigh 7.5
A default username and password for an administrator account was discovered in ZKTeco ZKTime 10.0 through 11.1.0, builds 20180901, 20190510.1, 20200309.3, 20200930, 20201231, and 20210220.
- Product
- Zktime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcnvd.org.cncnvd.org.cn
Dec 5, 2022Syncee: Leaks the administrator token that can be used to take over the administrator's accountCVE-2022-3694 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Syncee WordPress plugin before 1.0.10 leaks the administrator token that can be used to take over the administrator's account.
- Product
- Syncee
- Fixed in
- 1.0.10
- What to do
- Update Syncee to 1.0.10 or newer.
Dec 1, 2022ThinkCMF version 6.0.7 is affected by a Cross Site Request Forgery (CSRF) vulnerability that allows a Super Administrator user to be injected into administrativCVE-2022-40489 · Other software · Thinkcmf · reported by MITREHigh 8.8
ThinkCMF version 6.0.7 is affected by a Cross Site Request Forgery (CSRF) vulnerability that allows a Super Administrator user to be injected into administrative users.
- Product
- Thinkcmf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 30, 2022In Zkteco BioTime < 8.5.3 Build:20200816.447, an employee can hijack an administrator session and cookies using blind cross-site scripting.CVE-2022-38801 · Other software · Zkteco · reported by MITREMedium 5.4
In Zkteco BioTime < 8.5.3 Build:20200816.447, an employee can hijack an administrator session and cookies using blind cross-site scripting.
- Product
- Biotime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comzkteco.com
Nov 28, 2022Bosscms v2.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Add function under the Administrator List module.CVE-2022-44937 · Other software · Bosscms · reported by MITREMedium 6.5
Bosscms v2.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Add function under the Administrator List module.
- Product
- Bosscms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 23, 2022An issue in the /index/user/user_edit.html component of YJCMS v1.0.9 allows unauthenticated attackers to obtain the Administrator account password.CVE-2022-45276 · Other software · Eyunjing · reported by MITRECritical 9.8
An issue in the /index/user/user_edit.html component of YJCMS v1.0.9 allows unauthenticated attackers to obtain the Administrator account password.
- Product
- Yjcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2022INTELBRAS SG 2404 MR 20180928-rel64938 allows authenticated attackers to arbitrarily create Administrator accounts via crafted user cookies.CVE-2022-43308 · Other software · Intelbras · reported by MITREHigh 7.8
INTELBRAS SG 2404 MR 20180928-rel64938 allows authenticated attackers to arbitrarily create Administrator accounts via crafted user cookies.
- Product
- SG 2404 POE Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comintelbras.com
Nov 17, 2022The ScratchLogin extension through 1.1 for MediaWiki does not escape verification failure messages, which allows users with administrator privileges to perform CVE-2022-42985 · Other software · Scratch-wiki · reported by MITREMedium 4.8
The ScratchLogin extension through 1.1 for MediaWiki does not escape verification failure messages, which allows users with administrator privileges to perform cross-site scripting (XSS).
- Product
- Scratch Login
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2022Doufox 0.0.4 contains a CSRF vulnerability that can add system administrator account.CVE-2022-42246 · Other software · Duofoxtechnologies · reported by MITREHigh 8.8
Doufox 0.0.4 contains a CSRF vulnerability that can add system administrator account.
- Product
- Duofox CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2022Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Reflected XSS - user can cause an administrator to trigger reflectedCVE-2022-43692 · Other software · Concretecms · reported by MITREMedium 6.1
Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Reflected XSS - user can cause an administrator to trigger reflected XSS with a url if the targeted administrator is using an old browser that lacks XSS protection. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+.
- Product
- Concrete CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.concretecms.orgdocumentation.concretecms.org
Nov 9, 2022An authentication bypass in Lin-CMS v0.2.1 allows attackers to escalate privileges to Super Administrator.CVE-2022-44244 · Other software · Lin-cms Project · reported by MITREMedium 6.6
An authentication bypass in Lin-CMS v0.2.1 allows attackers to escalate privileges to Super Administrator.
- Product
- Lin-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Nov 9, 2022DedeCMS v6.1.9 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily add Administrator accounts and modify Admin pCVE-2022-43031 · Other software · Dedecms · reported by MITREHigh 8.8
DedeCMS v6.1.9 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily add Administrator accounts and modify Admin passwords.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Nov 4, 2022XML External Entity (XXE) vulnerability in Trellix IPS Manager prior to 10.1 M8 allows a remote authenticated administrator to perform XXE attack in the adminisCVE-2022-3340 · Other software · Trellix · reported by trellixpsirt@trellix.comMedium 5.9
XML External Entity (XXE) vulnerability in Trellix IPS Manager prior to 10.1 M8 allows a remote authenticated administrator to perform XXE attack in the administrator interface part of the interface, which allows a saved XML configuration file to be imported.
- Product
- Trellix IPS Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkcm.trellix.comkcm.trellix.com
Oct 31, 2022The application was vulnerable to an authenticated information disclosure, allowing administrators to view unsalted user passwords, which could lead to the compCVE-2022-40295 · Websites & servers · PHP Point of Sale LLC · reported by vdp@themissinglink.com.auMedium 4.9
The application was vulnerable to an authenticated information disclosure, allowing administrators to view unsalted user passwords, which could lead to the compromise of plaintext passwords via offline attacks.
- Product
- PHP Point of Sale
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordthemissinglink.com.authemissinglink.com.au
Oct 27, 2022A Cross-Site Request Forgery (CSRF) in dzzoffice 2.02.1_SC_UTF8 allows attackers to arbitrarily create user accounts and grant Administrator rights to regular uCVE-2022-43340 · Other software · Dzzoffice · reported by MITREHigh 8.8
A Cross-Site Request Forgery (CSRF) in dzzoffice 2.02.1_SC_UTF8 allows attackers to arbitrarily create user accounts and grant Administrator rights to regular users.
- Product
- Dzzoffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2022WP All Export Pro: Does not limit some functionality during exports only to users with the Administrator roleCVE-2022-3394 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WP All Export Pro WordPress plugin before 1.7.9 does not limit some functionality during exports only to users with the Administrator role, allowing any logged in user which has been given privileges to perform exports to execute arbitrary code on the site. By default only administrators can run exports, but the privilege can be delegated to lower privileged users.
- Product
- WP All Export Pro
- Fixed in
- 1.7.9
- What to do
- Update WP All Export Pro to 1.7.9 or newer.
Oct 17, 202274cmsSE v3.12.0 allows authenticated attackers with low-level privileges to arbitrarily change the rights and credentials of the Super Administrator account.CVE-2022-41471 · Other software · 74cms · reported by MITREMedium 6.5
74cmsSE v3.12.0 allows authenticated attackers with low-level privileges to arbitrarily change the rights and credentials of the Super Administrator account.
- Product
- 74cmsse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2022RPCMS v3.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily add an administrator account.CVE-2022-41475 · Other software · Rpcms · reported by MITREHigh 8.8
RPCMS v3.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily add an administrator account.
- Product
- Rpcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2022Generex CS141 through 2.10 allows remote command execution by administrators via a web interface that reaches run_update in /usr/bin/gxserve-update.sh (e.g., coCVE-2022-42457 · Other software · Generex · reported by MITRECritical 9.1
Generex CS141 through 2.10 allows remote command execution by administrators via a web interface that reaches run_update in /usr/bin/gxserve-update.sh (e.g., command execution can occur via a reverse shell installed by install.sh).
- Product
- Cs141 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2022Insufficient escaping of the LaTeX preamble made it possible for site administrators to read files available to the HTTP server system account.CVE-2021-40694 · Other software · Moodle · reported by Red HatMedium 4.9
Insufficient escaping of the LaTeX preamble made it possible for site administrators to read files available to the HTTP server system account.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.redhat.com
Sep 28, 2022BigProf Online Invoicing System before 3.0 offers a functionality that allows an administrator to move the records of members across groups.CVE-2020-35675 · Other software · Bigprof · reported by MITREHigh 8.8
BigProf Online Invoicing System before 3.0 offers a functionality that allows an administrator to move the records of members across groups. The applicable endpoint (admin/pageTransferOwnership.php) lacks CSRF protection, resulting in an attacker being able to escalate their privileges to Administrator and effectively taking over the application.
- Product
- Online Invoicing System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlabs.ingredous.com
Sep 28, 2022Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 allows attackers to discover accounts via MySQL "select * from Administrator_users" and "select * from Users_users" rCVE-2020-15333 · Network & remote access · Zyxel · reported by MITREMedium 5.3
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 allows attackers to discover accounts via MySQL "select * from Administrator_users" and "select * from Users_users" requests.
- Product
- Cloudcnm Secumanager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpierrekim.github.iozyxel.com
Sep 26, 2022A tenant administrator Hitachi Content Platform (HCP) may modify the configuration in another tenant without authorization, potentially allowing unauthorized acCVE-2021-28052 · Other software · Hitachi Vantara · reported by hirt@hitachi.co.jpHigh 7.5
A tenant administrator Hitachi Content Platform (HCP) may modify the configuration in another tenant without authorization, potentially allowing unauthorized access to data in the other tenant. Also, a tenant user (non-administrator) may view configuration in another tenant without authorization. This issue affects: Hitachi Vantara Hitachi Content Platform versions prior to 8.3.7; 9.0.0 versions prior to 9.2.3.
- Product
- Hitachi Content Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordknowledge.hitachivantara.comhitachi.com
Sep 19, 2022A vulnerability in Suprema BioStar (aka Bio Star) 2 v2.8.16 allows attackers to escalate privileges to System Administrator via a crafted PUT request to the updCVE-2022-38351 · Other software · Supremainc · reported by MITREHigh 8.8
A vulnerability in Suprema BioStar (aka Bio Star) 2 v2.8.16 allows attackers to escalate privileges to System Administrator via a crafted PUT request to the update profile page.
- Product
- Biostar 2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnobugescapes.comnobugescapes.com
Sep 16, 2022A local unprivileged attacker may escalate to administrator privileges in Honeywell SoftMaster version 4.51, due to insecure permission assignment.CVE-2022-2332 · Other software · Honeywell · reported by ics-cert@hq.dhs.govMedium 6.2
A local unprivileged attacker may escalate to administrator privileges in Honeywell SoftMaster version 4.51, due to insecure permission assignment.
- Product
- SoftMaster
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcisa.govsecurity.honeywell.com
Sep 14, 2022Loan Management System 1.0 is vulnerable to SQL Injection at the login page, which allows unauthorized users to login as Administrator after injecting username CVE-2022-37138 · Other software · Razormist · reported by MITRECritical 9.8
Loan Management System 1.0 is vulnerable to SQL Injection at the login page, which allows unauthorized users to login as Administrator after injecting username form.
- Product
- Loan Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsourcecodester.com
Sep 13, 2022In NOKIA 1350 OMS R14.2, Insufficiently Protected Credentials (cleartext administrator password) occur in the edit configuration page.CVE-2022-39816 · Other software · Nokia · reported by MITREMedium 6.5
In NOKIA 1350 OMS R14.2, Insufficiently Protected Credentials (cleartext administrator password) occur in the edit configuration page. Exploitation requires an authenticated attacker.
- Product
- 1350 Optical Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgruppotim.itgruppotim.it
Sep 13, 2022A CSRF vulnerability in Shopxian CMS 3.0.0 could allow an unauthenticated, remote attacker to craft a malicious link, potentially causing the administrator to pCVE-2022-38329 · Other software · Shopxian · reported by MITREMedium 4.3
A CSRF vulnerability in Shopxian CMS 3.0.0 could allow an unauthenticated, remote attacker to craft a malicious link, potentially causing the administrator to perform unintended actions on an affected system. The vulnerability could allow attackers to modify or delete specific content through crafted requests, potentially leading to data loss and system integrity issues.
- Product
- Shopxian CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordalbert5888.github.iogithub.com
Sep 13, 2022Under certain conditions an attacker authenticated as a CMS administrator access the BOE Commentary database and retrieve (non-personal) system data, modify sysCVE-2022-32244 · Network & remote access · SAP SE · reported by cna@sap.comMedium 5.2
Under certain conditions an attacker authenticated as a CMS administrator access the BOE Commentary database and retrieve (non-personal) system data, modify system data but can't make the system unavailable. This needs the attacker to have high privilege access to the same physical/logical network to access information which would otherwise be restricted, leading to low impact on confidentiality and high impact on integrity of the application.
- Product
- SAP BusinessObjects Business Intelligence Platform (Commentary DB)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comsap.com
Sep 6, 2022IObit Malware Fighter v9.2 for Microsoft Windows lacks tamper protection, allowing authenticated attackers with Administrator privileges to modify processes witCVE-2022-37771 · Other software · Iobit · reported by MITREMedium 6.7
IObit Malware Fighter v9.2 for Microsoft Windows lacks tamper protection, allowing authenticated attackers with Administrator privileges to modify processes within the application and escalate privileges to SYSTEM via a crafted executable.
- Product
- Malware Fighter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmrvar0x.compacketstormsecurity.com
Sep 6, 2022PCProtect Endpoint prior to v5.17.470 for Microsoft Windows lacks tamper protection, allowing authenticated attackers with Administrator privileges to modify prCVE-2022-36670 · Other software · Pcprotect · reported by MITREMedium 6.7
PCProtect Endpoint prior to v5.17.470 for Microsoft Windows lacks tamper protection, allowing authenticated attackers with Administrator privileges to modify processes within the application and escalate privileges to SYSTEM via a crafted executable.
- Product
- Endpoint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmrvar0x.commrvar0x.com
Sep 1, 2022Apache ShenYu Admin has insecure permissions, which may allow low-privilege administrators to modify high-privilege administrator's passwords.CVE-2022-37435 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.8
Apache ShenYu Admin has insecure permissions, which may allow low-privilege administrators to modify high-privilege administrator's passwords. This issue affects Apache ShenYu 2.4.2 and 2.4.3.
- Product
- Apache ShenYu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
Aug 30, 2022HCL VersionVault Express exposes administrator credentials.CVE-2022-27560 · Other software · HCL Software · reported by psirt@hcl.comMedium 6
HCL VersionVault Express exposes administrator credentials.
- Product
- HCL VersionVault Express
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Aug 26, 2022Insecure permissions in cskefu v7.0.1 allows unauthenticated attackers to arbitrarily add administrator accounts.CVE-2022-36521 · Other software · Cskefu · reported by MITREHigh 7.5
Insecure permissions in cskefu v7.0.1 allows unauthenticated attackers to arbitrarily add administrator accounts.
- Product
- Cskefu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2022Pega Platform from 8.3 to 8.7.3 vulnerability may allow authenticated security administrators to alter CSRF settings directly.CVE-2022-35656 · Other software · Pegasystems · reported by security@pega.comMedium 4.5
Pega Platform from 8.3 to 8.7.3 vulnerability may allow authenticated security administrators to alter CSRF settings directly.
- Product
- Pega Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.pega.comsupport.pega.com
Aug 18, 2022Hardcoded JWT Secret in AgileConfig <1.6.8 Server allows remote attackers to use the generated JWT token to gain administrator access.CVE-2022-35540 · Other software · Dotnetcore · reported by MITRECritical 9.8
Hardcoded JWT Secret in AgileConfig <1.6.8 Server allows remote attackers to use the generated JWT token to gain administrator access.
- Product
- Agileconfig
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2022Softing Secure Integration Server, edgeConnector, and edgeAggregator software ships with the default administrator credentials as `admin` and password as `adminCVE-2022-2336 · Other software · Softing · reported by ics-cert@hq.dhs.govCritical 9.8
Softing Secure Integration Server, edgeConnector, and edgeAggregator software ships with the default administrator credentials as `admin` and password as `admin`. This allows Softing to log in to the server directly to perform administrative functions. Upon installation or upon first login, the application does not ask the user to change the `admin` password. There is no warning or prompt to ask the user to change the default password, and to change the password, many steps are required.
- Product
- Secure Integration Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordindustrial.softing.comcisa.gov
Aug 15, 2022WP-DBManager: Does not prevent administrators from running arbitrary commands on the server in multisite installationsCVE-2022-2354 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WP-DBManager WordPress plugin before 2.80.8 does not prevent administrators from running arbitrary commands on the server in multisite installations, where only super-administrators should.
- Product
- WP-DBManager
- Fixed in
- 2.80.8
- What to do
- Update WP-DBManager to 2.80.8 or newer.
Aug 12, 2022In Ivanti Pulse Secure Pulse Connect Secure (PCS) before 9.1R12, the administrator password is stored in the HTML source code of the "Maintenance > Push ConfiguCVE-2021-44720 · Network & remote access · Ivanti · reported by MITREHigh 7.2
In Ivanti Pulse Secure Pulse Connect Secure (PCS) before 9.1R12, the administrator password is stored in the HTML source code of the "Maintenance > Push Configuration > Targets > Target Name" targets.cgi screen. A read-only administrative user can escalate to a read-write administrative role.
- Product
- Connect Secure
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comkb.pulsesecure.net
Aug 8, 2022Directorist: Allows administrators to download other plugins from the same vendor directly to the siteCVE-2022-2046 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Directorist WordPress plugin before 7.2.3 allows administrators to download other plugins from the same vendor directly to the site, but does not check the URL domain it gets the zip files from. This could allow administrators to run code on the server, which is a problem in multisite configurations.
- Product
- Directorist
- Fixed in
- 7.2.3
- What to do
- Update Directorist to 7.2.3 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Aug 1, 2022Pandora FMS v7.0NG.759 allows Cross-Site Request Forgery in Bulk operation (User operation) resulting in elevation of privilege to Administrator group.CVE-2022-26309 · Other software · Artica PFMS · reported by security@pandorafms.comLow 3.7
Pandora FMS v7.0NG.759 allows Cross-Site Request Forgery in Bulk operation (User operation) resulting in elevation of privilege to Administrator group.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpandorafms.comincibe.es
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.