Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,832 results · page 21 of 37
Jul 10, 2023Users with only access to launch VDA applications can launch an unauthorized desktop CVE-2023-24490 · Network & remote access · Citrix · reported by secure@citrix.comMedium 6.3
Users with only access to launch VDA applications can launch an unauthorized desktop
- Product
- Virtual Delivery Agents for Windows for CVAD and Citrix DaaS Security
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.citrix.comsupport.citrix.com
Jun 22, 2023Livebook is a web application for writing interactive and collaborative code notebooks.CVE-2023-35174 · Other software · livebook-dev · reported by GitHubHigh 8.6
Livebook is a web application for writing interactive and collaborative code notebooks. On Windows, it is possible to open a `livebook://` link from a browser which opens Livebook Desktop and triggers arbitrary code execution on victim's machine. Any user using Livebook Desktop on Windows is potentially vulnerable to arbitrary code execution when they expect Livebook to be opened from browser. This vulnerability has been fixed in version 0.8.2 and 0.9.3.
- Product
- livebook
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2023In onNullBinding of CallRedirectionProcessor.java, there is a possible long lived connection due to improper input validation.CVE-2023-21138 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In onNullBinding of CallRedirectionProcessor.java, there is a possible long lived connection due to improper input validation. This could lead to local escalation of privilege and background activity launches with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-273260090
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Jun 15, 2023Cross-Site Request Forgery (CSRF) vulnerability in Oliver Seidel, Bastian Germann cformsII plugin <= 15.0.4 versions.CVE-2023-25449 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Oliver Seidel, Bastian Germann cformsII plugin <= 15.0.4 versions.
- Fixed in
- 15.0.5
- What to do
- Update the plugin to 15.0.5 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 30, 2023SoLive 1.6.14 thru 1.6.20 for Android exists exposed component, the component provides the method to modify the SharedPreference file.CVE-2023-29732 · Other software · Loka · reported by MITRECritical 9.8
SoLive 1.6.14 thru 1.6.20 for Android exists exposed component, the component provides the method to modify the SharedPreference file. The attacker can use the method to modify the data in any SharedPreference file, these data will be loaded into the memory when the application is opened. Depending on how the data is used, this can result in various attack consequences, such as ad display exceptions.
- Product
- Solive
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2023SoLive 1.6.14 thru 1.6.20 for Android has an exposed component that provides a method to modify the SharedPreference file.CVE-2023-29731 · Other software · Loka · reported by MITREHigh 7.5
SoLive 1.6.14 thru 1.6.20 for Android has an exposed component that provides a method to modify the SharedPreference file. An attacker can leverage this method to inject a large amount of data into any SharedPreference file, which will be loaded into memory when the application is opened. When an attacker injects too much data, the application will trigger an OOM error and crash at startup, resulting in a persistent denial of service.
- Product
- Solive
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2023Amazon Alexa software version 8960323972 on Echo Dot 2nd generation and 3rd generation devices potentially allows attackers to deliver security-relevant commandCVE-2023-33248 · Other software · Amazon · reported by MITREHigh 7.6
Amazon Alexa software version 8960323972 on Echo Dot 2nd generation and 3rd generation devices potentially allows attackers to deliver security-relevant commands via an audio signal between 16 and 22 kHz (often outside the range of human adult hearing). Commands at these frequencies are essentially never spoken by authorized actors, but a substantial fraction of the commands are successful.
- Product
- Alexa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2023A proprietary protocol for iBoot devices is used for control and keepalive commands.CVE-2022-47311 · Other software · Dataprobe, Inc. · reported by ics-cert@hq.dhs.govHigh 8.5
A proprietary protocol for iBoot devices is used for control and keepalive commands. The function compares the username and password; it also contains the configuration data for the user specified. If the user does not exist, then it sends a value for username and password, which allows successful authentication for a connection.
- Product
- Dataprobe iBoot-PDU FW
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2023Improper neutralization of livestatus command delimiters in the RestAPI in Checkmk < 2.0.0p36, < 2.1.0p28, and < 2.2.0b8 (beta) allows arbitrary livestatus commCVE-2023-31208 · Other software · Checkmk GmbH · reported by security@checkmk.comHigh 8.3
Improper neutralization of livestatus command delimiters in the RestAPI in Checkmk < 2.0.0p36, < 2.1.0p28, and < 2.2.0b8 (beta) allows arbitrary livestatus command execution for authorized users.
- Product
- Checkmk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcheckmk.comcheckmk.com
May 12, 2023A vulnerability was found in Caton Live up to 2023-04-26 and classified as critical.CVE-2023-2682 · Other software · Caton · reported by VulDBMedium 6.3
A vulnerability was found in Caton Live up to 2023-04-26 and classified as critical. This issue affects some unknown processing of the file /cgi-bin/ping.cgi of the component Mini_HTTPD. The manipulation of the argument address with the input ;id;uname${IFS}-a leads to command injection. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-228911. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Live
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2023Pickup | Delivery | Dine-in date time: Does not sanitise and escape some of its settingsCVE-2023-0894 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Pickup | Delivery | Dine-in date time WordPress plugin through 1.0.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Pickup | Delivery | Dine-in date time
- Affected
- up to 1.0.9
- What to do
- Affects up to 1.0.9. Update Pickup | Delivery | Dine-in date time to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 3, 2023In imo.im 2022.11.1051, a path traversal vulnerability delivered via an unsanitized deeplink can force the application to write a file into the application's daCVE-2022-47757 · Other software · IMO · reported by MITRECritical 9.8
In imo.im 2022.11.1051, a path traversal vulnerability delivered via an unsanitized deeplink can force the application to write a file into the application's data directory. This may allow an attacker to save a shared library under a special directory which the app uses to dynamically load modules. Loading the library can lead to arbitrary code execution.
- Product
- IMO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2023Steveas WP Live Chat Shoutbox: Does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2023-1020 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Steveas WP Live Chat Shoutbox WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
- Product
- Steveas WP Live Chat Shoutbox
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update Steveas WP Live Chat Shoutbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 24, 2023Steveas WP Live Chat Shoutbox: Does not sanitise and escape a parameter before outputting it back in the ShoutboxCVE-2023-0899 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Steveas WP Live Chat Shoutbox WordPress plugin through 1.4.2 does not sanitise and escape a parameter before outputting it back in the Shoutbox, leading to Stored Cross-Site Scripting which could be used against high privilege users such as admins.
- Product
- Steveas WP Live Chat Shoutbox
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update Steveas WP Live Chat Shoutbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 19, 2023In startInstrumentation of ActivityManagerService.java, there is a possible way to keep the foreground service alive while the app is in the background.CVE-2023-21089 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In startInstrumentation of ActivityManagerService.java, there is a possible way to keep the foreground service alive while the app is in the background. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-237766679
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Apr 19, 2023In deliverOnFlushComplete of LocationProviderManager.java, there is a possible way to bypass background activity launch restrictions due to a logic error in theCVE-2023-21088 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In deliverOnFlushComplete of LocationProviderManager.java, there is a possible way to bypass background activity launch restrictions due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12 Android-12L Android-13Android ID: A-235823542
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Apr 17, 2023hap-wi/roxy-wi is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.CVE-2023-29004 · Other software · hap-wi · reported by GitHubMedium 6.5
hap-wi/roxy-wi is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. A Path Traversal vulnerability was found in the current version of Roxy-WI (6.3.9.0 at the moment of writing this report). The vulnerability can be exploited via an HTTP request to /app/options.py and the config_file_name parameter. Successful exploitation of this vulnerability could allow an attacker with user level privileges to obtain the content of arbitrary files on the file server within the scope of what the server process has access to. The root-cause of the vulnerability lies in the get_config function of the /app/modules/config/config.py file, which only checks for relative path traversal, but still allows to read files from absolute locations passed via the config_file_name parameter.
- Product
- roxy-wi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2023An issue was discovered in LIVEBOX Collaboration vDesk through v018.CVE-2022-45180 · Other software · Liveboxcloud · reported by MITREMedium 6.5
An issue was discovered in LIVEBOX Collaboration vDesk through v018. Broken Access Control exists under the /api/v1/vdesk_{DOMAIN]/export endpoint. A malicious user, authenticated to the product without any specific privilege, can use the API for exporting information about all users of the system (an operation intended to only be available to the system administrator).
- Product
- Vdesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgruppotim.itgruppotim.it
Apr 14, 2023An issue was discovered in LIVEBOX Collaboration vDesk through v018.CVE-2022-45178 · Other software · Liveboxcloud · reported by MITREHigh 8.8
An issue was discovered in LIVEBOX Collaboration vDesk through v018. Broken Access Control exists under the /api/v1/vdeskintegration/saml/user/createorupdate endpoint, the /settings/guest-settings endpoint, the /settings/samlusers-settings endpoint, and the /settings/users-settings endpoint. A malicious user (already logged in as a SAML User) is able to achieve privilege escalation from a low-privilege user (FGM user) to an administrative user (GGU user), including the administrator, or create new users even without an admin role.
- Product
- Vdesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgruppotim.itgruppotim.it
Apr 14, 2023An issue was discovered in LIVEBOX Collaboration vDesk through v018.CVE-2022-45175 · Other software · Liveboxcloud · reported by MITREMedium 6.5
An issue was discovered in LIVEBOX Collaboration vDesk through v018. An Insecure Direct Object Reference can occur under the 5.6.5-3/doc/{ID-FILE]/c/{N]/{C]/websocket endpoint. A malicious unauthenticated user can access cached files in the OnlyOffice backend of other users by guessing the file ID of a target file.
- Product
- Vdesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgruppotim.itgruppotim.it
Apr 14, 2023An issue was discovered in LIVEBOX Collaboration vDesk through v018.CVE-2022-45174 · Other software · Liveboxcloud · reported by MITRECritical 9.8
An issue was discovered in LIVEBOX Collaboration vDesk through v018. A Bypass of Two-Factor Authentication for SAML Users can occur under the /login/backup_code endpoint and the /api/v1/vdeskintegration/challenge endpoint. The correctness of the TOTP is not checked properly, and can be bypassed by passing any string as the backup code.
- Product
- Vdesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgruppotim.itgruppotim.it
Apr 14, 2023An issue was discovered in LIVEBOX Collaboration vDesk through v018.CVE-2022-45173 · Other software · Liveboxcloud · reported by MITRECritical 9.8
An issue was discovered in LIVEBOX Collaboration vDesk through v018. A Bypass of Two-Factor Authentication can occur under the /api/v1/vdeskintegration/challenge endpoint. Because only the client-side verifies whether a check was successful, an attacker can modify the response, and fool the application into concluding that the TOTP was correct.
- Product
- Vdesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgruppotim.itgruppotim.it
Apr 14, 2023An issue was discovered in LIVEBOX Collaboration vDesk through v018.CVE-2022-45170 · Other software · Liveboxcloud · reported by MITREMedium 6.5
An issue was discovered in LIVEBOX Collaboration vDesk through v018. A Cryptographic Issue can occur under the /api/v1/vencrypt/decrypt/file endpoint. A malicious user, logged into a victim's account, is able to decipher a file without knowing the key set by the user.
- Product
- Vdesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgruppotim.itgruppotim.it
Apr 13, 2023KYOCERA Mobile Print' v3.2.0.230119 and earlier, 'UTAX/TA MobilePrint' v3.2.0.230119 and earlier, and 'Olivetti Mobile Print' v3.2.0.230119 and earlier are vulnCVE-2023-25954 · Other software · Kyocera Document Solutions, TA Triumph-Adler GmbH, and Olivetti SpA · reported by vultures@jpcert.or.jpMedium 5.5
KYOCERA Mobile Print' v3.2.0.230119 and earlier, 'UTAX/TA MobilePrint' v3.2.0.230119 and earlier, and 'Olivetti Mobile Print' v3.2.0.230119 and earlier are vulnerable to improper intent handling. When a malicious app is installed on the victim user's Android device, the app may send an intent and direct the affected app to download malicious files or apps to the device without notification.
- Product
- KYOCERA Mobile Print, UTAX/TA MobilePrint, and Olivetti Mobile Print
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 12, 2023A stored HTML injection vulnerability in LiveAction LiveSP v21.1.2 allows attackers to execute arbitrary code via a crafted payload.CVE-2023-27775 · Other software · Liveaction · reported by MITREMedium 5.4
A stored HTML injection vulnerability in LiveAction LiveSP v21.1.2 allows attackers to execute arbitrary code via a crafted payload.
- Product
- Livesp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 11, 2023Android App 'Wolt Delivery: Food and more' version 4.27.2 and earlier uses hard-coded credentials (API key for an external service), which may allow a local attCVE-2023-22429 · Other software · Wolt · reported by vultures@jpcert.or.jpHigh 7.8
Android App 'Wolt Delivery: Food and more' version 4.27.2 and earlier uses hard-coded credentials (API key for an external service), which may allow a local attacker to obtain the hard-coded API key via reverse-engineering the application binary.
- Product
- Wolt Delivery: Food and more
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2023A cross-site scripting (XSS) vulnerability in LiveAction LiveSP v21.1.2 allows attackers to execute arbitrary web scripts or HTML.CVE-2023-24721 · Other software · Liveaction · reported by MITREMedium 5.4
A cross-site scripting (XSS) vulnerability in LiveAction LiveSP v21.1.2 allows attackers to execute arbitrary web scripts or HTML.
- Product
- Livesp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2023A Java insecure deserialization vulnerability in Adobe LiveCycle ES4 version 11.0 and earlier allows unauthenticated remote attackers to gain operating system cCVE-2023-28500 · Other software · Adobe · reported by MITRECritical 9.8
A Java insecure deserialization vulnerability in Adobe LiveCycle ES4 version 11.0 and earlier allows unauthenticated remote attackers to gain operating system code execution by submitting specially crafted Java serialized objects to a specific URL. Adobe LiveCycle ES4 version 11.0.1 and later may be vulnerable if the application is installed with Java environment 7u21 and earlier. Exploitation of the vulnerability depends on two factors: insecure deserialization methods used in the Adobe LiveCycle application, and the use of Java environments 7u21 and earlier. The code execution is performed in the context of the account that is running the Adobe LiveCycle application. If the account is privileged, exploitation provides privileged access to the operating system. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- Livecycle Es4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcoastalsecurity.gitbook.iocoastalsecurity.gitbook.io
Mar 27, 2023GoCD is an open source continuous delivery server.CVE-2023-28630 · Other software · gocd · reported by GitHubMedium 4.2
GoCD is an open source continuous delivery server. In GoCD versions from 20.5.0 and below 23.1.0, if the server environment is not correctly configured by administrators to provide access to the relevant PostgreSQL or MySQL backup tools, the credentials for database access may be unintentionally leaked to admin alerts on the GoCD user interface. The vulnerability is triggered only if the GoCD server host is misconfigured to have backups enabled, but does not have access to the `pg_dump` or `mysqldump` utility tools to backup the configured database type (PostgreSQL or MySQL respectively). In such cases, failure to launch the expected backup utility reports the shell environment used to attempt to launch in the server admin alert, which includes the plaintext database password supplied to the configured tool. This vulnerability does not affect backups of the default on-disk H2 database that GoCD is configured to use. This issue has been addressed and fixed in GoCD 23.1.0. Users are advised to upgrade. Users unable to upgrade may disable backups, or administrators should ensure that the required `pg_dump` (PostgreSQL) or `mysqldump` (MySQL) binaries are available on the GoCD server w
- Product
- gocd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2023GoCD is an open source continuous delivery server.CVE-2023-28629 · Other software · gocd · reported by GitHubMedium 5.4
GoCD is an open source continuous delivery server. GoCD versions before 23.1.0 are vulnerable to a stored XSS vulnerability, where pipeline configuration with a malicious pipeline label configuration can affect browser display of pipeline runs generated from that configuration. An attacker that has permissions to configure GoCD pipelines could include JavaScript elements within the label template, causing a XSS vulnerability to be triggered for any users viewing the Value Stream Map or Job Details for runs of the affected pipeline, potentially allowing them to perform arbitrary actions within the victim's browser context rather than their own. This issue has been fixed in GoCD 23.1.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- gocd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.gocd.orggithub.com
Mar 23, 2023NotrinosERP v0.7 was discovered to contain a SQL injection vulnerability via the OrderNumber parameter at /NotrinosERP/sales/customer_delivery.php.CVE-2023-24788 · Other software · Notrinos · reported by MITREHigh 8.8
NotrinosERP v0.7 was discovered to contain a SQL injection vulnerability via the OrderNumber parameter at /NotrinosERP/sales/customer_delivery.php.
- Product
- Notrinoserp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Mar 15, 2023Roxy-WI is a Web interface for managing Haproxy, Nginx, Apache, and Keepalived servers.CVE-2023-25804 · Other software · hap-wi · reported by GitHubHigh 7.5
Roxy-WI is a Web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. Versions prior to 6.3.5.0 have a limited path traversal vulnerability. An SSH key can be saved into an unintended location, for example the `/tmp` folder using a payload `../../../../../tmp/test111_dev`. This issue has been fixed in version 6.3.5.0.
- Product
- roxy-wi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2023Roxy-WI is a Web interface for managing Haproxy, Nginx, Apache, and Keepalived servers.CVE-2023-25803 · Other software · hap-wi · reported by GitHubHigh 7.5
Roxy-WI is a Web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. Versions prior to 6.3.5.0 have a directory traversal vulnerability that allows the inclusion of server-side files. This issue is fixed in version 6.3.5.0.
- Product
- roxy-wi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2023Roxy-WI is a Web interface for managing Haproxy, Nginx, Apache, and Keepalived servers.CVE-2023-25802 · Other software · hap-wi · reported by GitHubHigh 7.5
Roxy-WI is a Web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. Versions prior to 6.3.6.0 don't correctly neutralize `dir/../filename` sequences, such as `/etc/nginx/../passwd`, allowing an actor to gain information about a server. Version 6.3.6.0 has a patch for this issue.
- Product
- roxy-wi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2023 An XML External Entity injection (XXE) vulnerability in ENOVIA Live Collaboration V6R2013xE allows an attacker to read local files on the server.CVE-2023-1288 · Other software · Dassault Systèmes · reported by 3DS.Information-Security@3ds.comMedium 6.8
An XML External Entity injection (XXE) vulnerability in ENOVIA Live Collaboration V6R2013xE allows an attacker to read local files on the server.
- Product
- ENOVIA Live Collaboration
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2023 An XSL template vulnerability in ENOVIA Live Collaboration V6R2013xE allows Remote Code Execution.CVE-2023-1287 · Other software · Dassault Systèmes · reported by 3DS.Information-Security@3ds.comCritical 9
An XSL template vulnerability in ENOVIA Live Collaboration V6R2013xE allows Remote Code Execution.
- Product
- ENOVIA Live Collaboration
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2023Cubism Core in Live2D Cubism Editor 4.2.03 allows out-of-bounds write via a crafted Section Offset Table or Count Info Table in an MOC3 file.CVE-2023-27566 · Other software · Live2d · reported by MITREHigh 7.8
Cubism Core in Live2D Cubism Editor 4.2.03 allows out-of-bounds write via a crafted Section Offset Table or Count Info Table in an MOC3 file.
- Product
- Cubism Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.live2d.comgithub.com
Mar 2, 2023Saleor is a headless, GraphQL commerce platform delivering personalized shopping experiences.CVE-2023-26052 · Other software · saleor · reported by GitHubLow 3.7
Saleor is a headless, GraphQL commerce platform delivering personalized shopping experiences. Some internal Python exceptions are not handled properly and thus are returned in API as error messages. Some messages might contain sensitive information like infrastructure details in unauthenticated requests. This issue has been patched in versions 3.1.48, 3.7.59, 3.8.0, 3.9.27, 3.10.14 and 3.11.12.
- Product
- saleor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2023Saleor is a headless, GraphQL commerce platform delivering personalized shopping experiences.CVE-2023-26051 · Other software · saleor · reported by GitHubMedium 6.5
Saleor is a headless, GraphQL commerce platform delivering personalized shopping experiences. Some internal Python exceptions are not handled properly and thus are returned in API as error messages. Some messages might contain sensitive information like user email address in staff-authenticated requests.
- Product
- saleor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2023Page Builder: Live Composer: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4669 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Page Builder: Live Composer WordPress plugin before 1.5.23 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Page Builder: Live Composer
- Fixed in
- 1.5.23
- What to do
- Update Page Builder: Live Composer to 1.5.23 or newer.
Feb 20, 2023Livestatus Query Language (LQL) injection in the AuthUser HTTP query header of Tribe29's Checkmk <= 2.1.0p11, Checkmk <= 2.0.0p28, and all versions of Checkmk 1CVE-2022-47909 · Other software · Tribe29 · reported by security@checkmk.comMedium 6.8
Livestatus Query Language (LQL) injection in the AuthUser HTTP query header of Tribe29's Checkmk <= 2.1.0p11, Checkmk <= 2.0.0p28, and all versions of Checkmk 1.6.0 (EOL) allows an attacker to perform direct queries to the application's core from localhost.
- Product
- Checkmk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcheckmk.comsonarsource.com
Feb 16, 2023Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.CVE-2023-23947 · Other software · argoproj · reported by GitHubCritical 9.1
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All Argo CD versions starting with 2.3.0-rc1 and prior to 2.3.17, 2.4.23 2.5.11, and 2.6.2 are vulnerable to an improper authorization bug which allows users who have the ability to update at least one cluster secret to update any cluster secret. The attacker could use this access to escalate privileges (potentially controlling Kubernetes resources) or to break Argo CD functionality (by preventing connections to external clusters). A patch for this vulnerability has been released in Argo CD versions 2.6.2, 2.5.11, 2.4.23, and 2.3.17. Two workarounds are available. Either modify the RBAC configuration to completely revoke all `clusters, update` access, or use the `destinations` and `clusterResourceWhitelist` fields to apply similar restrictions as the `namespaces` and `clusterResources` fields.
- Product
- argo-cd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2023Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.CVE-2023-25163 · Other software · argoproj · reported by GitHubMedium 6.3
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v2.6.0-rc1 have an output sanitization bug which leaks repository access credentials in error messages. These error messages are visible to the user, and they are logged. The error message is visible when a user attempts to create or update an Application via the Argo CD API (and therefor the UI or CLI). The user must have `applications, create` or `applications, update` RBAC access to reach the code which may produce the error. The user is not guaranteed to be able to trigger the error message. They may attempt to spam the API with requests to trigger a rate limit error from the upstream repository. If the user has `repositories, update` access, they may edit an existing repository to introduce a URL typo or otherwise force an error message. But if they have that level of access, they are probably intended to have access to the credentials anyway. A patch for this vulnerability has been released in version 2.6.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- argo-cd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordargo-cd.readthedocs.iogithub.com
Jan 31, 2023An issue was discovered in LIVEBOX Collaboration vDesk before v018.CVE-2022-45172 · Other software · Liveboxcloud · reported by MITRECritical 9.8
An issue was discovered in LIVEBOX Collaboration vDesk before v018. Broken Access Control can occur under the /api/v1/registration/validateEmail endpoint, the /api/v1/vdeskintegration/user/adduser endpoint, and the /api/v1/registration/changePasswordUser endpoint. The web application is affected by flaws in authorization logic, through which a malicious user (with no privileges) is able to perform privilege escalation to the administrator role, and steal the accounts of any users on the system.
- Product
- Vdesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgruppotim.itgruppotim.it
Jan 26, 2023Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.CVE-2023-22736 · Other software · argoproj · reported by GitHubHigh 8.5
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions starting with 2.5.0-rc1 and above, prior to 2.5.8, and version 2.6.0-rc4, are vulnerable to an authorization bypass bug which allows a malicious Argo CD user to deploy Applications outside the configured allowed namespaces. Reconciled Application namespaces are specified as a comma-delimited list of glob patterns. When sharding is enabled on the Application controller, it does not enforce that list of patterns when reconciling Applications. For example, if Application namespaces are configured to be argocd-*, the Application controller may reconcile an Application installed in a namespace called other, even though it does not start with argocd-. Reconciliation of the out-of-bounds Application is only triggered when the Application is updated, so the attacker must be able to cause an update operation on the Application resource. This bug only applies to users who have explicitly enabled the "apps-in-any-namespace" feature by setting `application.namespaces` in the argocd-cmd-params-cm ConfigMap or otherwise setting the `--application-namespaces` flags on the Application controller and API server compo
- Product
- argo-cd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2023Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.CVE-2023-22482 · Other software · argoproj · reported by GitHubCritical 9
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions of Argo CD starting with v1.8.2 and prior to 2.3.13, 2.4.19, 2.5.6, and 2.6.0-rc-3 are vulnerable to an improper authorization bug causing the API to accept certain invalid tokens. OIDC providers include an `aud` (audience) claim in signed tokens. The value of that claim specifies the intended audience(s) of the token (i.e. the service or services which are meant to accept the token). Argo CD _does_ validate that the token was signed by Argo CD's configured OIDC provider. But Argo CD _does not_ validate the audience claim, so it will accept tokens that are not intended for Argo CD. If Argo CD's configured OIDC provider also serves other audiences (for example, a file storage service), then Argo CD will accept a token intended for one of those other audiences. Argo CD will grant the user privileges based on the token's `groups` claim, even though those groups were not intended to be used by Argo CD. This bug also increases the impact of a stolen token. If an attacker steals a valid token for a different audience, they can use it to access Argo CD. A patch for this vulnerability has been released in v
- Product
- argo-cd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2023Unauthenticated denial of serviceCVE-2022-27508 · Other software · Citirx · reported by secure@citrix.comHigh 7.5
Unauthenticated denial of service
- Product
- Citrix Application Delivery Controller (Citrix ADC) and Citrix Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.citrix.comsupport.citrix.com
Jan 26, 2023Authenticated denial of serviceCVE-2022-27507 · Other software · Citirx · reported by secure@citrix.comMedium 6.5
Authenticated denial of service
- Product
- Citrix Application Delivery Controller (Citrix ADC) and Citrix Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.citrix.comsupport.citrix.com
Jan 23, 2023A Cross-Site Request Forgery (CSRF) in the management portal of JetNexus/EdgeNexus ADC 4.2.8 allows attackers to escalate privileges and execute arbitrary code CVE-2022-37719 · Other software · Edgenexus · reported by MITREHigh 8.8
A Cross-Site Request Forgery (CSRF) in the management portal of JetNexus/EdgeNexus ADC 4.2.8 allows attackers to escalate privileges and execute arbitrary code via unspecified vectors.
- Product
- Application Delivery Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcryptnetix.comedgenexus.io
Jan 23, 2023The management portal component of JetNexus/EdgeNexus ADC 4.2.8 was discovered to contain a command injection vulnerability.CVE-2022-37718 · Other software · Edgenexus · reported by MITREHigh 8.8
The management portal component of JetNexus/EdgeNexus ADC 4.2.8 was discovered to contain a command injection vulnerability. This vulnerability allows authenticated attackers to execute arbitrary commands through a specially crafted payload. This vulnerability can also be exploited from an unauthenticated context via unspecified vectors
- Product
- Application Delivery Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcryptnetix.comedgenexus.io
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.