Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,692 results · page 22 of 34
Mar 3, 2022PeteReport Version 0.5 allows an authenticated admin user to inject persistent JavaScript code while adding an 'Attack Tree' by modifying the 'svg_file' parametCVE-2022-23051 · Other software · Petereport Project · reported by help@fluidattacks.comMedium 5.4
PeteReport Version 0.5 allows an authenticated admin user to inject persistent JavaScript code while adding an 'Attack Tree' by modifying the 'svg_file' parameter.
- Product
- Petereport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comgithub.com
Feb 17, 2022The Crypt_GPG extension before 1.6.7 for PHP does not prevent additional options in GPG calls, which presents a risk for certain environments and GPG versions.CVE-2022-24953 · Other software · Pear · reported by MITREMedium 5.3
The Crypt_GPG extension before 1.6.7 for PHP does not prevent additional options in GPG calls, which presents a risk for certain environments and GPG versions.
- Product
- Crypt GPG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2022Null source pointer passed as an argument to memcpy() function within TIFFReadDirectory() in tif_dirread.c in libtiff versions from 4.0 to 4.3.0 could lead to DCVE-2022-0562 · Other software · libtiff · reported by cve@gitlab.comMedium 5.5
Null source pointer passed as an argument to memcpy() function within TIFFReadDirectory() in tif_dirread.c in libtiff versions from 4.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users that compile libtiff from sources, a fix is available with commit 561599c.
- Product
- libtiff
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2022The Entity Embed module provides a filter to allow embedding entities in content fields.CVE-2020-13673 · Websites & servers · Drupal · reported by mlhess@drupal.orgMedium 6.1
The Entity Embed module provides a filter to allow embedding entities in content fields. In certain circumstances, the filter could allow an unprivileged user to inject HTML into a page when it is accessed by a trusted user with permission to embed entities. In some cases, this could lead to cross-site scripting.
- Product
- Entity Embed
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2022A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists that could cause modification of an existing file by adding at end ofCVE-2022-24312 · Other software · Schneider-electric · reported by cybersecurity@se.comCritical 9.8
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists that could cause modification of an existing file by adding at end of file or create a new file in the context of the Data Server potentially leading to remote code execution when an attacker sends a specially crafted message. Affected Product: Interactive Graphical SCADA System Data Server (V15.0.0.22020 and prior)
- Product
- Interactive Graphical Scada System Data Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.comzerodayinitiative.com
Feb 2, 2022PrinterLogic Web Stack versions 19.1.1.13 SP9 and below are vulnerable to SQL Injection, which may allow an attacker to access additional audit records.CVE-2021-42633 · Other software · Printerlogic · reported by MITREMedium 5.3
PrinterLogic Web Stack versions 19.1.1.13 SP9 and below are vulnerable to SQL Injection, which may allow an attacker to access additional audit records.
- Product
- Web Stack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportswigger.netsecurityaffairs.co
Jan 26, 2022SPIP 4.0.0 is affected by a Cross Site Scripting (XSS) vulnerability in ecrire/public/interfaces.php, adding the function safehtml to the vulnerable fields.CVE-2021-44120 · Other software · Spip · reported by MITREMedium 5.4
SPIP 4.0.0 is affected by a Cross Site Scripting (XSS) vulnerability in ecrire/public/interfaces.php, adding the function safehtml to the vulnerable fields. An editor is able to modify his personal information. If the editor has an article written and available, when a user goes to the public site and wants to read the author's information, the malicious code will be executed. The "Who are you" and "Website Name" fields are vulnerable.
- Product
- Spip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.spip.netgit.spip.net
Jan 11, 2022PuddingBot is a group management bot.CVE-2022-21669 · Other software · PuddingBot · reported by GitHubCritical 9.1
PuddingBot is a group management bot. In version 0.0.6-b933652 and prior, the bot token is publicly exposed in main.py, making it accessible to malicious actors. The bot token has been revoked and new version is already running on the server. As of time of publication, the maintainers are planning to update code to reflect this change at a later date.
- Product
- pudding-bot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2021In Brave Desktop 1.17 through 1.33 before 1.33.106, when CNAME-based adblocking and a proxying extension with a SOCKS fallback are enabled, additional DNS requeCVE-2021-45884 · Other software · Brave · reported by MITREHigh 7.5
In Brave Desktop 1.17 through 1.33 before 1.33.106, when CNAME-based adblocking and a proxying extension with a SOCKS fallback are enabled, additional DNS requests are issued outside of the proxying extension using the system's DNS settings, resulting in information disclosure. NOTE: this issue exists because of an incomplete fix for CVE-2021-21323 and CVE-2021-22916.
- Product
- Brave
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 23, 2021An additional, nondocumented administrative account exists in mySCADA myPRO Versions 8.20.0 and prior that is not exposed through the web interface, which cannoCVE-2021-43987 · Other software · mySCADA · reported by ics-cert@hq.dhs.govCritical 9.8
An additional, nondocumented administrative account exists in mySCADA myPRO Versions 8.20.0 and prior that is not exposed through the web interface, which cannot be deleted or changed through the regular web interface.
- Product
- myPRO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 23, 2021An access issue was addressed with additional sandbox restrictions on applications.CVE-2017-13910 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
An access issue was addressed with additional sandbox restrictions on applications. This issue is fixed in macOS High Sierra 10.13. An application may be able to access restricted files.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Dec 23, 2021A race condition was addressed with additional validation.CVE-2017-13905 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 8.1
A race condition was addressed with additional validation. This issue is fixed in tvOS 11.2, iOS 11.2, macOS High Sierra 10.13.2, Security Update 2017-002 Sierra, and Security Update 2017-005 El Capitan, watchOS 4.2. An application may be able to gain elevated privileges.
- Product
- watchOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Dec 22, 2021Adding a new pipeline in GoCD server version 21.3.0 has a functionality that could be abused to do an un-intended action in order to achieve a Server Side RequeCVE-2021-44659 · Other software · Thoughtworks · reported by MITRECritical 9.8
Adding a new pipeline in GoCD server version 21.3.0 has a functionality that could be abused to do an un-intended action in order to achieve a Server Side Request Forgery (SSRF). NOTE: the vendor's position is that the observed behavior is not a vulnerability, because the product's design allows an admin to configure outbound requests
- Product
- Gocd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2021Documents loaded with the CSP sandbox directive could have escaped the sandbox's script restriction by embedding additional content.CVE-2021-43543 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.1
Documents loaded with the CSP sandbox directive could have escaped the sandbox's script restriction by embedding additional content. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95.
- Product
- Thunderbird
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orglists.debian.org
Nov 22, 2021Croatia Control Asterix 2.8.1 has a heap-based buffer over-read, with additional details to be disclosed at a later date.CVE-2021-44144 · Other software · Crocontrol · reported by MITRECritical 9.1
Croatia Control Asterix 2.8.1 has a heap-based buffer over-read, with additional details to be disclosed at a later date.
- Product
- Asterix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2021A bypass of adding remote files in Concrete CMS (previously concrete5) File Manager leads to remote code execution in Concrete CMS (concrete5) versions 8.5.6 anCVE-2021-22968 · Other software · Concretecms · reported by support@hackerone.comHigh 7.2
A bypass of adding remote files in Concrete CMS (previously concrete5) File Manager leads to remote code execution in Concrete CMS (concrete5) versions 8.5.6 and below.The external file upload feature stages files in the public directory even if they have disallowed file extensions. They are stored in a directory with a random name, but it's possible to stall the uploads and brute force the directory name. You have to be an admin with the ability to upload files, but this bug gives you the ability to upload restricted file types and execute them depending on server configuration.To fix this, a check for allowed file extensions was added before downloading files to a tmp directory.Concrete CMS Security Team gave this a CVSS v3.1 score of 5.4 AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:H/A:NThis fix is also in Concrete version 9.0.0
- Product
- Concrete CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.concretecms.orghackerone.com
Oct 27, 2021Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where an attacker through specific configuration and with loCVE-2021-1117 · Other software · NVIDIA · reported by psirt@nvidia.comMedium 4.7
Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where an attacker through specific configuration and with local unprivileged system access may cause improper input validation, which may lead to denial of service.
- Product
- NVIDIA GPU Display Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvidia.custhelp.comnvidia.custhelp.com
Oct 21, 2021Snudown is a reddit-specific fork of the Sundown Markdown parser used by GitHub, with Python integration added.CVE-2021-41168 · Other software · reddit · reported by GitHubMedium 6.5
Snudown is a reddit-specific fork of the Sundown Markdown parser used by GitHub, with Python integration added. In affected versions snudown was found to be vulnerable to denial of service attacks to its reference table implementation. References written in markdown ` [reference_name]: https://www.example.com` are inserted into a hash table which was found to have a weak hash function, meaning that an attacker can reliably generate a large number of collisions for it. This makes the hash table vulnerable to a hash-collision DoS attack, a type of algorithmic complexity attack. Further the hash table allowed for duplicate entries resulting in long retrieval times. Proofs of concept and further discussion of the hash collision issue are discussed on the snudown GHSA(https://github.com/reddit/snudown/security/advisories/GHSA-6gvv-9q92-w5f6). Users are advised to update to version 1.7.0.
- Product
- snudown
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2021A race condition was addressed with additional validation.CVE-2020-29622 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.5
A race condition was addressed with additional validation. This issue is fixed in Security Update 2021-005 Catalina. Mounting a maliciously crafted NFS network share may lead to arbitrary code execution with system privileges.
- Product
- Security Update - Catalina
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Oct 18, 2021Podcast Subscribe Buttons: Allows users with any role capable of editing or adding posts to perform stored XSSCVE-2021-24743 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Podcast Subscribe Buttons WordPress plugin before 1.4.2 allows users with any role capable of editing or adding posts to perform stored XSS.
- Product
- Podcast Subscribe Buttons
- Fixed in
- 1.4.2
- What to do
- Update Podcast Subscribe Buttons to 1.4.2 or newer.
Sep 20, 2021MaianAffiliate v.1.0 is suffers from code injection by adding a new product via the admin panel.CVE-2021-39402 · Other software · Maianmedia · reported by MITREHigh 7.2
MaianAffiliate v.1.0 is suffers from code injection by adding a new product via the admin panel. The injected payload is reflected on the affiliate main page for all authenticated and unauthenticated visitors.
- Product
- Maianaffiliate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commaianscriptworld.co.uk
Sep 8, 2021This issue was addressed by removing additional entitlements.CVE-2021-30654 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
This issue was addressed by removing additional entitlements. This issue is fixed in GarageBand 10.4.3. A local attacker may be able to read sensitive information.
- Product
- GarageBand
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Sep 8, 2021A race condition was addressed with additional validation.CVE-2021-30652 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7
A race condition was addressed with additional validation. This issue is fixed in Security Update 2021-002 Catalina, Security Update 2021-003 Mojave, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5, macOS Big Sur 11.3. A malicious application may be able to gain root privileges.
- Product
- iOS and iPadOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Sep 2, 2021An issue in craigms/main.php of CraigMS 1.0 allows attackers to execute arbitrary commands via a crafted input entered into the DB Name field.CVE-2020-18048 · Other software · Bertanddip · reported by MITRECritical 9.8
An issue in craigms/main.php of CraigMS 1.0 allows attackers to execute arbitrary commands via a crafted input entered into the DB Name field.
- Product
- Craigms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcwe.mitre.orggithub.com
Aug 30, 2021Mautic versions before 3.3.4/4.0.0 are vulnerable to an inline JS XSS attack when viewing Mautic assets by utilizing inline JS in the title and adding a broken CVE-2021-27912 · Other software · Mautic · reported by security@mautic.orgHigh 7.1
Mautic versions before 3.3.4/4.0.0 are vulnerable to an inline JS XSS attack when viewing Mautic assets by utilizing inline JS in the title and adding a broken image URL as a remote asset. This can only be leveraged by an authenticated user with permission to create or edit assets.
- Product
- Mautic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 24, 2021An inherited permissions issue was addressed with additional restrictions.CVE-2021-30964 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
An inherited permissions issue was addressed with additional restrictions. This issue is fixed in macOS Monterey 12.1, watchOS 8.3, iOS 15.2 and iPadOS 15.2. A malicious application may be able to bypass Privacy preferences.
- Product
- watchOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Aug 24, 2021An access issue was addressed with additional sandbox restrictions.CVE-2021-30947 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Big Sur 11.6.2, tvOS 15.2, macOS Monterey 12.1, iOS 15.2 and iPadOS 15.2, watchOS 8.3. An application may be able to access a user's files.
- Product
- watchOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Aug 24, 2021An access issue was addressed with additional sandbox restrictions on third party applications.CVE-2021-30898 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
An access issue was addressed with additional sandbox restrictions on third party applications. This issue is fixed in iOS 15 and iPadOS 15. A malicious application may be able to access some of the user's Apple ID information, or recent in-app search terms.
- Product
- iOS and iPadOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Aug 24, 2021An inherited permissions issue was addressed with additional restrictions.CVE-2021-30892 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
An inherited permissions issue was addressed with additional restrictions. This issue is fixed in macOS Monterey 12.0.1, Security Update 2021-007 Catalina, macOS Big Sur 11.6.1. A malicious application may be able to modify protected parts of the file system.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Aug 24, 2021The issue was resolved with additional restrictions on CSS compositing.CVE-2021-30884 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 4.7
The issue was resolved with additional restrictions on CSS compositing. This issue is fixed in tvOS 15, watchOS 8, iOS 15 and iPadOS 15. Visiting a maliciously crafted website may reveal a user's browsing history.
- Product
- iOS and iPadOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comsupport.apple.com
Aug 24, 2021This issue was addressed by adding a new Remote Login option for opting into Full Disk Access for Secure Shell sessions.CVE-2021-30856 · Computers, phones & browsers · Apple · reported by product-security@apple.comCritical 9.1
This issue was addressed by adding a new Remote Login option for opting into Full Disk Access for Secure Shell sessions. This issue is fixed in macOS Big Sur 11.3. A malicious unsandboxed app on a system with Remote Login enabled may bypass Privacy preferences.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Aug 6, 2021Cross-Site Scripting (XSS) vulnerability in Subrion 4.2.1 via the title when adding a page.CVE-2020-22330 · Other software · Intelliants · reported by MITREMedium 6.1
Cross-Site Scripting (XSS) vulnerability in Subrion 4.2.1 via the title when adding a page.
- Product
- Subrion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2021Cross Site Scripting (XSS) vulnerability exists in Subrion CMS 4.2.2 when adding a blog and then editing an image file.CVE-2020-22392 · Other software · Intelliants · reported by MITREMedium 5.4
Cross Site Scripting (XSS) vulnerability exists in Subrion CMS 4.2.2 when adding a blog and then editing an image file.
- Product
- Subrion CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2021It was found in OpenShift, before version 4.8, that the generated certificate for the in-cluster Service CA, incorrectly included additional certificates.CVE-2021-3636 · Other software · Redhat · reported by Red HatMedium 4.6
It was found in OpenShift, before version 4.8, that the generated certificate for the in-cluster Service CA, incorrectly included additional certificates. The Service CA is automatically mounted into all pods, allowing them to safely connect to trusted in-cluster services that present certificates signed by the trusted Service CA. The incorrect inclusion of additional CAs in this certificate would allow an attacker that compromises any of the additional CAs to masquerade as a trusted in-cluster service.
- Product
- Openshift
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.redhat.com
Jul 29, 2021Apache jUDDI uses several classes related to Java's Remote Method Invocation (RMI) which (as an extension to UDDI) provides an alternate transport for accessingCVE-2021-37578 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Apache jUDDI uses several classes related to Java's Remote Method Invocation (RMI) which (as an extension to UDDI) provides an alternate transport for accessing UDDI services. RMI uses the default Java serialization mechanism to pass parameters in RMI invocations. A remote attacker can send a malicious serialized object to the above RMI entries. The objects get deserialized without any check on the incoming data. In the worst case, it may let the attacker run arbitrary code remotely. For both jUDDI web service applications and jUDDI clients, the usage of RMI is disabled by default. Since this is an optional feature and an extension to the UDDI protocol, the likelihood of impact is low. Starting with 3.3.10, all RMI related code was removed.
- Product
- Apache jUDDI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comlists.apache.org
Jul 26, 2021TechSmith Snagit 19.1.0.2653 uses Object Linking and Embedding (OLE) which can allow attackers to obfuscate and embed crafted files used to escalate privileges.CVE-2020-18171 · Other software · Techsmith · reported by MITREHigh 8.8
TechSmith Snagit 19.1.0.2653 uses Object Linking and Embedding (OLE) which can allow attackers to obfuscate and embed crafted files used to escalate privileges. NOTE: This implies that Snagit's use of OLE is a security vulnerability unto itself and it is not. See reference document for more details.
- Product
- Snagit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.google.comgithub.com
Jul 22, 2021NVIDIA Windows GPU Display Driver for Windows contains a vulnerability in the NVIDIA kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where dereferencCVE-2021-1096 · Other software · NVIDIA · reported by psirt@nvidia.comMedium 5.5
NVIDIA Windows GPU Display Driver for Windows contains a vulnerability in the NVIDIA kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where dereferencing a NULL pointer may lead to a system crash.
- Product
- NVIDIA GPU Display Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvidia.custhelp.comnvidia.custhelp.com
Jul 22, 2021NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where an out of boundCVE-2021-1094 · Other software · NVIDIA · reported by psirt@nvidia.comMedium 6.1
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where an out of bounds array access may lead to denial of service or information disclosure.
- Product
- NVIDIA GPU Display Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orgnvidia.custhelp.com
Jul 6, 2021Cross Site Scripting (XSS) vulnerability in phpList 3.5.3 via the login name field in Manage Administrators when adding a new admin.CVE-2020-22251 · Websites & servers · Phplist · reported by MITREMedium 4.8
Cross Site Scripting (XSS) vulnerability in phpList 3.5.3 via the login name field in Manage Administrators when adding a new admin.
- Product
- Phplist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2021An integer overflow exists in pywin32 prior to version b301 when adding an access control entry (ACE) to an access control list (ACL) that would cause the size CVE-2021-32559 · Other software · Mhammond · reported by MITREMedium 6.5
An integer overflow exists in pywin32 prior to version b301 when adding an access control entry (ACE) to an access control list (ACL) that would cause the size to be greater than 65535 bytes. An attacker who successfully exploited this vulnerability could crash the vulnerable process.
- Product
- Pywin32
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2021If a MIME encoded email contains an OpenPGP inline signed or encrypted message part, but also contains an additional unprotected part, Thunderbird did not indicCVE-2021-29957 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 4.3
If a MIME encoded email contains an OpenPGP inline signed or encrypted message part, but also contains an additional unprotected part, Thunderbird did not indicate that only parts of the message are protected. This vulnerability affects Thunderbird < 78.10.2.
- Product
- Thunderbird
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Jun 24, 2021If a Blob URL was loaded through some unusual user interaction, it could have been loaded by the System Principal and granted additional privileges that should CVE-2021-23999 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.8
If a Blob URL was loaded through some unusual user interaction, it could have been loaded by the System Principal and granted additional privileges that should not be granted to web content. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88.
- Product
- Firefox ESR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Jun 23, 2021Cross Site Scripting vulnerability in GetSimpleCMS 3.3.16 in admin/upload.php by adding comments or jpg and other file header information to the content of xla,CVE-2021-28977 · Other software · Get-simple · reported by MITREMedium 4.8
Cross Site Scripting vulnerability in GetSimpleCMS 3.3.16 in admin/upload.php by adding comments or jpg and other file header information to the content of xla, pages, and gzip files,
- Product
- Getsimplecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2021It was found that all OWASP ESAPI for Java up to version 2.0 RC2 are vulnerable to padding oracle attacks.CVE-2010-3300 · Other software · Owasp · reported by Red HatMedium 5.9
It was found that all OWASP ESAPI for Java up to version 2.0 RC2 are vulnerable to padding oracle attacks.
- Product
- Enterprise Security API For Java
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgusenix.org
Jun 2, 2021The merge-deep library before 3.0.3 for Node.js can be tricked into overwriting properties of Object.prototype or adding new properties to it.CVE-2021-26707 · Other software · Merge-deep Project · reported by MITRECritical 9.8
The merge-deep library before 3.0.3 for Node.js can be tricked into overwriting properties of Object.prototype or adding new properties to it. These properties are then inherited by every object in the program, thus facilitating prototype-pollution attacks against applications using this library.
- Product
- Merge-deep
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecurity.netapp.com
May 26, 2021IBM Cloud Pak for Data 3.0 could allow an authenticated user to obtain sensitive information when installed with additional plugins.CVE-2021-20486 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM Cloud Pak for Data 3.0 could allow an authenticated user to obtain sensitive information when installed with additional plugins. IBM X-Force ID: 197668.
- Product
- Cloud Pak for Data
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
May 17, 2021Cross Site Scripting (XSS) in emlog v6.0.0 allows remote attackers to execute arbitrary code by adding a crafted script as a link to a new blog post.CVE-2020-18194 · Other software · Emlog · reported by MITREMedium 6.1
Cross Site Scripting (XSS) in emlog v6.0.0 allows remote attackers to execute arbitrary code by adding a crafted script as a link to a new blog post.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2021The Python "Flask-Security-Too" package is used for adding security features to your Flask application.CVE-2021-32618 · Other software · Flask-Middleware · reported by GitHubLow 3.1
The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is an independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. All versions of Flask-Security-Too allow redirects after many successful views (e.g. /login) by honoring the ?next query param. There is code in FS to validate that the url specified in the next parameter is either relative OR has the same netloc (network location) as the requesting URL. This check utilizes Pythons urlsplit library. However many browsers are very lenient on the kind of URL they accept and 'fill in the blanks' when presented with a possibly incomplete URL. As a concrete example - setting http://login?next=\\\github.com will pass FS's relative URL check however many browsers will gladly convert this to http://github.com. Thus an attacker could send such a link to an unwitting user, using a legitimate site and have it redirect to whatever site they want. This is considered a low severity due to the fact that if Werkzeug is used (which is very common with Flask applications) as the WSGI layer, it by default ALWAYS ensures that the Location header is absolut
- Product
- flask-security
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2021When taxes are enabled, the "Additional tax classes" field was not properly sanitised or escaped before being output back in the admin dashboard, allowing high CVE-2021-24323 · WordPress plugins & themes · reported by WPScanMedium 4.8
When taxes are enabled, the "Additional tax classes" field was not properly sanitised or escaped before being output back in the admin dashboard, allowing high privilege users such as admin to use XSS payloads even when the unfiltered_html is disabled
- Fixed in
- 5.2.0
- What to do
- Update the plugin to 5.2.0 or newer.
May 10, 2021NoneCMS v1.3 has a CSRF vulnerability in public/index.php/admin/nav/add.html, as demonstrated by adding a navigation column which can be injected with arbitraryCVE-2020-23376 · Other software · 5none · reported by MITREMedium 6.1
NoneCMS v1.3 has a CSRF vulnerability in public/index.php/admin/nav/add.html, as demonstrated by adding a navigation column which can be injected with arbitrary web script or HTML via the name parameter to launch a stored XSS attack.
- Product
- Nonecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcwe.mitre.orggithub.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.