Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,888 results · page 22 of 38
Dec 28, 2022ISOS firmwares from versions 1.81 to 2.00 contain hardcoded credentials from embedded StreamX installer that integrators are not forced to change.CVE-2022-4780 · Other software · elvexys · reported by vulnerability@ncsc.chMedium 4.5
ISOS firmwares from versions 1.81 to 2.00 contain hardcoded credentials from embedded StreamX installer that integrators are not forced to change.
- Product
- ISOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordelvexys.comelvexys.com
Dec 15, 2022An issue was discovered in Mbed TLS before 2.28.2 and 3.x before 3.3.0.CVE-2022-46393 · Computers, phones & browsers · ARM · reported by MITRECritical 9.8
An issue was discovered in Mbed TLS before 2.28.2 and 3.x before 3.3.0. There is a potential heap-based buffer overflow and heap-based buffer over-read in DTLS if MBEDTLS_SSL_DTLS_CONNECTION_ID is enabled and MBEDTLS_SSL_CID_IN_LEN_MAX > 2 * MBEDTLS_SSL_CID_OUT_LEN_MAX.
- Product
- Mbed TLS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2022An issue was discovered in Mbed TLS before 2.28.2 and 3.x before 3.3.0.CVE-2022-46392 · Computers, phones & browsers · ARM · reported by MITREMedium 5.3
An issue was discovered in Mbed TLS before 2.28.2 and 3.x before 3.3.0. An adversary with access to precise enough information about memory accesses (typically, an untrusted operating system attacking a secure enclave) can recover an RSA private key after observing the victim performing a single private-key operation, if the window size (MBEDTLS_MPI_WINDOW_SIZE) used for the exponentiation is 3 or smaller.
- Product
- Mbed TLS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2022An authenticated user can embed malicious content with XSS into the admin group policy page.CVE-2022-25630 · Other software · Symantec · reported by secure@symantec.comMedium 5.4
An authenticated user can embed malicious content with XSS into the admin group policy page.
- Product
- Messaging Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comsupport.broadcom.com
Nov 30, 2022SEPPMail's web frontend, user input is not embedded correctly in the web page and therefore leads to cross-site scripting vulnerabilities (XSS).CVE-2021-31740 · Other software · Seppmail · reported by MITREMedium 6.1
SEPPMail's web frontend, user input is not embedded correctly in the web page and therefore leads to cross-site scripting vulnerabilities (XSS).
- Product
- Seppmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpentagrid.chpentagrid.ch
Nov 6, 2022In Mahara 21.04 before 21.04.7, 21.10 before 21.10.5, 22.04 before 22.04.3, and 22.10 before 22.10.0, embedded images are accessible without a sufficient permisCVE-2022-42707 · Other software · Mahara · reported by MITREHigh 7.5
In Mahara 21.04 before 21.04.7, 21.10 before 21.10.5, 22.04 before 22.04.3, and 22.10 before 22.10.0, embedded images are accessible without a sufficient permission check under certain conditions.
- Product
- Mahara
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.launchpad.netmahara.org
Nov 4, 2022Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX.CVE-2022-39344 · Other software · azure-rtos · reported by GitHubCritical 9.8
Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX. Prior to version 6.1.12, the USB DFU UPLOAD functionality may be utilized to introduce a buffer overflow resulting in overwrite of memory contents. In particular cases this may allow an attacker to bypass security features or execute arbitrary code. The implementation of `ux_device_class_dfu_control_request` function prevents buffer overflow during handling of DFU UPLOAD command when current state is `UX_SYSTEM_DFU_STATE_DFU_IDLE`. This issue has been patched, please upgrade to version 6.1.12. As a workaround, add the `UPLOAD_LENGTH` check in all possible states.
- Product
- usbx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2022 The application was identified to have an CSV injection in data export functionality, allowing for malicious code to be embedded within export data and then trCVE-2022-40294 · Websites & servers · PHP Point of Sale LLC · reported by vdp@themissinglink.com.auHigh 8.8
The application was identified to have an CSV injection in data export functionality, allowing for malicious code to be embedded within export data and then triggered in exported data viewers.
- Product
- PHP Point of Sale
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordthemissinglink.com.authemissinglink.com.au
Oct 13, 2022Azure RTOS USBX is a high-performance USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX.CVE-2022-39293 · Other software · azure-rtos · reported by GitHubHigh 8.6
Azure RTOS USBX is a high-performance USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX. The case is, in [_ux_host_class_pima_read](https://github.com/azure-rtos/usbx/blob/master/common/usbx_host_classes/src/ux_host_class_pima_read.c), there is data length from device response, returned in the very first packet, and read by [L165 code](https://github.com/azure-rtos/usbx/blob/082fd9db09a3669eca3358f10b8837a5c1635c0b/common/usbx_host_classes/src/ux_host_class_pima_read.c#L165), as header_length. Then in [L178 code](https://github.com/azure-rtos/usbx/blob/082fd9db09a3669eca3358f10b8837a5c1635c0b/common/usbx_host_classes/src/ux_host_class_pima_read.c#L178), there is a “if” branch, which check the expression of “(header_length - UX_HOST_CLASS_PIMA_DATA_HEADER_SIZE) > data_length” where if header_length is smaller than UX_HOST_CLASS_PIMA_DATA_HEADER_SIZE, calculation could overflow and then [L182 code](https://github.com/azure-rtos/usbx/blob/082fd9db09a3669eca3358f10b8837a5c1635c0b/common/usbx_host_classes/src/ux_host_class_pima_read.c#L182) the calculation of data_length is also overflow, this way the later [while loop start from L192
- Product
- usbx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2022Azure RTOS USBx is a USB host, device, and on-the-go (OTG) embedded stack, fully integrated with Azure RTOS ThreadX and available for all Azure RTOS ThreadX–supCVE-2022-36063 · Other software · azure-rtos · reported by GitHubHigh 7.6
Azure RTOS USBx is a USB host, device, and on-the-go (OTG) embedded stack, fully integrated with Azure RTOS ThreadX and available for all Azure RTOS ThreadX–supported processors. Azure RTOS USBX implementation of host support for USB CDC ECM includes an integer underflow and a buffer overflow in the `_ux_host_class_cdc_ecm_mac_address_get` function which may be potentially exploited to achieve remote code execution or denial of service. Setting mac address string descriptor length to a `0` or `1` allows an attacker to introduce an integer underflow followed (string_length) by a buffer overflow of the `cdc_ecm -> ux_host_class_cdc_ecm_node_id` array. This may allow one to redirect the code execution flow or introduce a denial of service. The fix has been included in USBX release [6.1.12](https://github.com/azure-rtos/usbx/releases/tag/v6.1.12_rel). Improved mac address string descriptor length validation to check for unexpectedly small values may be used as a workaround.
- Product
- usbx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2022Cryptocurrency Pricing list and Ticker: Does not sanitise and escape the ccpw_setpage parameter before outputting it back in pages where its shortcode is embedCVE-2021-25044 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Cryptocurrency Pricing list and Ticker WordPress plugin through 1.5 does not sanitise and escape the ccpw_setpage parameter before outputting it back in pages where its shortcode is embed, leading to a Reflected Cross-Site Scripting issue
- Product
- Cryptocurrency Pricing list and Ticker
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update Cryptocurrency Pricing list and Ticker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2022A vulnerability in the self-healing functionality of Cisco IOS XE Software for Embedded Wireless Controllers on Catalyst Access Points could allow an authenticaCVE-2022-20855 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.9
A vulnerability in the self-healing functionality of Cisco IOS XE Software for Embedded Wireless Controllers on Catalyst Access Points could allow an authenticated, local attacker to escape the restricted controller shell and execute arbitrary commands on the underlying operating system of the access point. This vulnerability is due to improper checks throughout the restart of certain system processes. An attacker could exploit this vulnerability by logging on to an affected device and executing certain CLI commands. A successful exploit could allow the attacker to execute arbitrary commands on the underlying OS as root. To successfully exploit this vulnerability, an attacker would need valid credentials for a privilege level 15 user of the wireless controller.
- Product
- Cisco IOS XE Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comtools.cisco.com
Sep 30, 2022A vulnerability in the UDP processing functionality of Cisco IOS XE Software for Embedded Wireless Controllers on Catalyst 9100 Series Access Points could allowCVE-2022-20848 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 8.6
A vulnerability in the UDP processing functionality of Cisco IOS XE Software for Embedded Wireless Controllers on Catalyst 9100 Series Access Points could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. This vulnerability is due to the improper processing of UDP datagrams. An attacker could exploit this vulnerability by sending malicious UDP datagrams to an affected device. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition.
- Product
- Cisco IOS XE Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comtools.cisco.com
Aug 8, 2022websda.c in GoAhead WebServer 2.1.8 has insufficient nonce entropy because the nonce calculation relies on the hardcoded onceuponatimeinparadise value, which doCVE-2021-41615 · Other software · Embedthis · reported by MITRECritical 9.8
websda.c in GoAhead WebServer 2.1.8 has insufficient nonce entropy because the nonce calculation relies on the hardcoded onceuponatimeinparadise value, which does not follow the secret-data guideline for HTTP Digest Access Authentication in RFC 7616 section 3.3 (or RFC 2617 section 3.2.1). NOTE: 2.1.8 is a version from 2003; however, the affected websda.c code appears in multiple derivative works that may be used in 2021. Recent GoAhead software is unaffected.
- Product
- Goahead
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevel.rtems.orggithub.com
Aug 2, 2022The embedded neutralization of Script-Related HTML Tag, was by-passed in the case of some extra conditions.CVE-2022-1293 · Other software · Thales · reported by psirt@thalesgroup.comMedium 5.7
The embedded neutralization of Script-Related HTML Tag, was by-passed in the case of some extra conditions.
- Product
- Citadel Web Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2022An issue was discovered in Mbed TLS before 2.28.1 and 3.x before 3.2.0.CVE-2022-35409 · Computers, phones & browsers · ARM · reported by MITRECritical 9.1
An issue was discovered in Mbed TLS before 2.28.1 and 3.x before 3.2.0. In some configurations, an unauthenticated attacker can send an invalid ClientHello message to a DTLS server that causes a heap-based buffer over-read of up to 255 bytes. This can cause a server crash or possibly information disclosure based on error responses. Affected configurations have MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE enabled and MBEDTLS_SSL_IN_CONTENT_LEN less than a threshold that depends on the configuration: 258 bytes if using mbedtls_ssl_cookie_check, and possibly up to 571 bytes with a custom cookie check function.
- Product
- Mbed TLS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Jul 12, 2022The schema (aka Embedding schema.org vocabulary) extension before 1.13.1 and 2.x before 2.5.1 for TYPO3 allows XSS.CVE-2022-33154 · Other software · Schema Project · reported by MITREMedium 5.4
The schema (aka Embedding schema.org vocabulary) extension before 1.13.1 and 2.x before 2.5.1 for TYPO3 allows XSS.
- Product
- Schema
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2022Mini-Tmall v1.0 is vulnerable to Insecure Permissions via tomcat-embed-jasper.CVE-2022-30929 · Other software · Mini Tmall Project · reported by MITREHigh 8.8
Mini-Tmall v1.0 is vulnerable to Insecure Permissions via tomcat-embed-jasper.
- Product
- Mini Tmall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2022When performing the inference shape operation of Affine, Concat, MatMul, ArgMinMax, EmbeddingLookup, and Gather operators, if the input shape size is 0, it willCVE-2021-33648 · Other software · Mindspore · reported by securities@openeuler.orgHigh 7.5
When performing the inference shape operation of Affine, Concat, MatMul, ArgMinMax, EmbeddingLookup, and Gather operators, if the input shape size is 0, it will access data outside of bounds of shape which allocated from heap buffers.
- Product
- Mindspore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2022Jenkins Embeddable Build Status Plugin 2.0.3 and earlier does not correctly perform the ViewStatus permission check in the HTTP endpoint it provides for "unprotCVE-2022-34180 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comHigh 7.5
Jenkins Embeddable Build Status Plugin 2.0.3 and earlier does not correctly perform the ViewStatus permission check in the HTTP endpoint it provides for "unprotected" status badge access, allowing attackers without any permissions to obtain the build status badge icon for any attacker-specified job and/or build.
- Product
- Jenkins Embeddable Build Status Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2022Jenkins Embeddable Build Status Plugin 2.0.3 and earlier allows specifying a `style` query parameter that is used to choose a different SVG image style without CVE-2022-34179 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comHigh 7.5
Jenkins Embeddable Build Status Plugin 2.0.3 and earlier allows specifying a `style` query parameter that is used to choose a different SVG image style without restricting possible values, resulting in a relative path traversal vulnerability that allows attackers without Overall/Read permission to specify paths to other SVG images on the Jenkins controller file system.
- Product
- Jenkins Embeddable Build Status Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2022Jenkins Embeddable Build Status Plugin 2.0.3 allows specifying a 'link' query parameter that build status badges will link to, without restricting possible valuCVE-2022-34178 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 6.1
Jenkins Embeddable Build Status Plugin 2.0.3 allows specifying a 'link' query parameter that build status badges will link to, without restricting possible values, resulting in a reflected cross-site scripting (XSS) vulnerability.
- Product
- Jenkins Embeddable Build Status Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2022In grantEmbeddedWindowFocus of WindowManagerService.java, there is a possible way to change an input channel for embedded hierarchy due to a permissions bypass.CVE-2022-20192 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In grantEmbeddedWindowFocus of WindowManagerService.java, there is a possible way to change an input channel for embedded hierarchy due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12LAndroid ID: A-215912712
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Jun 8, 2022CP Image Store with Slideshow: Does not sanitise and escape the ordering_by query parameter before using it in a SQL statement in pages where the [codepeople-image-store] is embedCVE-2022-1692 · WordPress plugins & themes · reported by WPScanCritical 9.8
The CP Image Store with Slideshow WordPress plugin before 1.0.68 does not sanitise and escape the ordering_by query parameter before using it in a SQL statement in pages where the [codepeople-image-store] is embed, allowing unauthenticated users to perform an SQL injection attack
- Product
- CP Image Store with Slideshow
- Fixed in
- 1.0.68
- What to do
- Update CP Image Store with Slideshow to 1.0.68 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Jun 2, 2022An issue was discovered in src/http/httpLib.c in EmbedThis Appweb Community Edition 8.2.1, allows attackers to cause a denial of service via the stream paramterCVE-2021-33254 · Other software · Embedthis · reported by MITREHigh 7.5
An issue was discovered in src/http/httpLib.c in EmbedThis Appweb Community Edition 8.2.1, allows attackers to cause a denial of service via the stream paramter to the parseUri function.
- Product
- Appweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordawxylitol.github.ioawxylitol.github.io
May 27, 2022The Master operator may be able to embed script tag in HTML with alert pop-up display cookie.CVE-2021-27781 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.6
The Master operator may be able to embed script tag in HTML with alert pop-up display cookie.
- Product
- HCL BigFix Mobile / Modern Client Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
May 24, 2022Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack.CVE-2022-29246 · Other software · azure-rtos · reported by GitHubCritical 9.8
Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack. Prior to version 6.1.11, he USBX DFU UPLOAD functionality may be utilized to introduce a buffer overflow resulting in overwrite of memory contents. In particular cases this may allow an attacker to bypass security features or execute arbitrary code. The implementation of `ux_device_class_dfu_control_request` function does not assure that a buffer overflow will not occur during handling of the DFU UPLOAD command. When an attacker issues the `UX_SLAVE_CLASS_DFU_COMMAND_UPLOAD` control transfer request with `wLenght` larger than the buffer size (`UX_SLAVE_REQUEST_CONTROL_MAX_LENGTH`, 256 bytes), depending on the actual implementation of `dfu -> ux_slave_class_dfu_read`, a buffer overflow may occur. In example `ux_slave_class_dfu_read` may read 4096 bytes (or more up to 65k) to a 256 byte buffer ultimately resulting in an overflow. Furthermore in case an attacker has some control over the read flash memory, this may result in execution of arbitrary code and platform compromise. A fix for this issue has been included in USBX release 6.1.11. As a workaround, align request and buffer size to assure that buffer boun
- Product
- usbx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2022Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack.CVE-2022-29223 · Other software · azure-rtos · reported by GitHubHigh 7.5
Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack. In versions prior to 6.1.10, an attacker can cause a buffer overflow by providing the Azure RTOS USBX host stack a HUB descriptor with `bNbPorts` set to a value greater than `UX_MAX_TT` which defaults to 8. For a `bNbPorts` value of 255, the implementation of `ux_host_class_hub_descriptor_get` function will modify the contents of `hub` -> `ux_host_class_hub_device` -> `ux_device_hub_tt` array violating the end boundary by 255 - `UX_MAX_TT` items. The USB host stack needs to validate the number of ports reported by the hub, and if the value is larger than UX_MAX_TT, USB stack needs to reject the request. This fix has been included in USBX release 6.1.10.
- Product
- usbx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2022Gmedia Photo Gallery: Does not sanitise and escape the Album's name before outputting it in pages/posts with a media embedCVE-2022-0873 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Gmedia Photo Gallery WordPress plugin before 1.20.0 does not sanitise and escape the Album's name before outputting it in pages/posts with a media embed, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered-html capability is disallowed
- Product
- Gmedia Photo Gallery
- Fixed in
- 1.20.0
- What to do
- Update Gmedia Photo Gallery to 1.20.0 or newer.
May 10, 2022A vulnerability in Black Duck Hub’s embedded MadCap Flare documentation files could allow an unauthenticated remote attacker to conduct a cross-site scripting aCVE-2022-30278 · Other software · Synopsys · reported by disclosure@synopsys.comMedium 6.1
A vulnerability in Black Duck Hub’s embedded MadCap Flare documentation files could allow an unauthenticated remote attacker to conduct a cross-site scripting attack. The vulnerability is due to improper validation of user-supplied input to MadCap Flare's framework embedded within Black Duck Hub's Help Documentation to supply content. An attacker could exploit this vulnerability by convincing a user to click a link designed to pass malicious input to the interface. A successful exploit could allow the attacker to conduct cross-site scripting attacks and gain access to sensitive browser-based information.
- Product
- Black Duck Hub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsynopsys.comsynopsys.com
May 3, 2022ARM mbed product Version 6.3.0 is vulnerable to integer wrap-around in malloc_wrapper function, which can lead to arbitrary memory allocation, resulting in unexCVE-2021-27435 · Computers, phones & browsers · ARM · reported by ics-cert@hq.dhs.govHigh 7.3
ARM mbed product Version 6.3.0 is vulnerable to integer wrap-around in malloc_wrapper function, which can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code injection/execution.
- Product
- mbed
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 3, 2022ARM mbed-ualloc memory library version 1.3.0 is vulnerable to integer wrap-around in function mbed_krbs, which can lead to arbitrary memory allocation, resultinCVE-2021-27433 · Computers, phones & browsers · ARM · reported by ics-cert@hq.dhs.govHigh 7.3
ARM mbed-ualloc memory library version 1.3.0 is vulnerable to integer wrap-around in function mbed_krbs, which can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code injection/execution.
- Product
- mbed-ualloc memory library
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2022Mahara before 20.10.5, 21.04.4, 21.10.2, and 22.04.0 allows stored XSS when a particular Cascading Style Sheets (CSS) class for embedly is used, and JavaScript CVE-2022-29584 · Other software · Mahara · reported by MITREMedium 5.4
Mahara before 20.10.5, 21.04.4, 21.10.2, and 22.04.0 allows stored XSS when a particular Cascading Style Sheets (CSS) class for embedly is used, and JavaScript code is constructed to perform an action.
- Product
- Mahara
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.launchpad.netmahara.org
Apr 25, 2022The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName].CVE-2022-29078 · Other software · EJS · reported by MITRECritical 9.8
The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).
- Product
- EJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2022A vulnerability in IP ingress packet processing of the Cisco Embedded Wireless Controller with Catalyst Access Points Software could allow an unauthenticated, rCVE-2022-20622 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 8.6
A vulnerability in IP ingress packet processing of the Cisco Embedded Wireless Controller with Catalyst Access Points Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, causing a denial of service (DoS) condition. The device may experience a performance degradation in traffic processing or high CPU usage prior to the unexpected reload. This vulnerability is due to improper rate limiting of IP packets to the management interface. An attacker could exploit this vulnerability by sending a steady stream of IP traffic at a high rate to the management interface of the affected device. A successful exploit could allow the attacker to cause the device to reload.
- Product
- Cisco Aironet Access Point Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comtools.cisco.com
Apr 15, 2022XSS via Embedded SVG in SVG Diagram Format in GitHub repository plantuml/plantuml prior to 1.2022.4.CVE-2022-1231 · Other software · plantuml · reported by security@huntr.devMedium 6.1
XSS via Embedded SVG in SVG Diagram Format in GitHub repository plantuml/plantuml prior to 1.2022.4. Stored XSS in the context of the diagram embedder. Depending on the actual context, this ranges from stealing secrets to account hijacking or even to code execution for example in desktop applications. Web based applications are the ones most affected. Since the SVG format allows clickable links in diagrams, it is commonly used in plugins for web based projects (like the Confluence plugin, etc. see https://plantuml.com/de/running).
- Product
- plantuml/plantuml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2022A Denial of Service vulnerability exists in mbed TLS 3.0.0 and earlier in the mbedtls_pkcs12_derivation function when an input password's length is 0.CVE-2021-43666 · Computers, phones & browsers · ARM · reported by MITREHigh 7.5
A Denial of Service vulnerability exists in mbed TLS 3.0.0 and earlier in the mbedtls_pkcs12_derivation function when an input password's length is 0.
- Product
- Mbed TLS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Mar 21, 2022In Dreamacro Clash for Windows v0.11.4, an attacker could embed a malicious iframe in a website with a crafted URL that would launch the Clash Windows client anCVE-2020-24772 · Other software · Clash Project · reported by MITREHigh 8.8
In Dreamacro Clash for Windows v0.11.4, an attacker could embed a malicious iframe in a website with a crafted URL that would launch the Clash Windows client and force it to open a remote SMB share. Windows will perform NTLM authentication when opening the SMB share and that request can be relayed (using a tool like responder) for code execution (or captured for hash cracking).
- Product
- Clash
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2022The Entity Embed module provides a filter to allow embedding entities in content fields.CVE-2020-13673 · Websites & servers · Drupal · reported by mlhess@drupal.orgMedium 6.1
The Entity Embed module provides a filter to allow embedding entities in content fields. In certain circumstances, the filter could allow an unprivileged user to inject HTML into a page when it is accessed by a trusted user with permission to embed entities. In some cases, this could lead to cross-site scripting.
- Product
- Entity Embed
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 7, 2022SupportCandy: Does not sanitise and escape the query string before outputting it back in pages with the [wpsc_create_ticket] shortcode embedCVE-2021-24878 · WordPress plugins & themes · reported by WPScanMedium 6.1
The SupportCandy WordPress plugin before 2.2.7 does not sanitise and escape the query string before outputting it back in pages with the [wpsc_create_ticket] shortcode embed, leading to a Reflected Cross-Site Scripting issue
- Product
- SupportCandy
- Fixed in
- 2.2.7
- What to do
- Update SupportCandy to 2.2.7 or newer.
Feb 4, 2022Embed Swagger: Reflected Cross-Site ScriptingCVE-2022-0381 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Embed Swagger WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to insufficient escaping/sanitization and validation via the url parameter found in the ~/swagger-iframe.php file which allows attackers to inject arbitrary web scripts onto the page, in versions up to and including 1.0.0.
- Product
- Embed Swagger
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Embed Swagger to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgist.github.complugins.trac.wordpress.org
Feb 2, 2022JHEAD is a simple command line tool for displaying and some manipulation of EXIF header data embedded in Jpeg images from digital cameras.CVE-2020-26208 · Other software · Jhead Project · reported by GitHubMedium 5.3
JHEAD is a simple command line tool for displaying and some manipulation of EXIF header data embedded in Jpeg images from digital cameras. In affected versions there is a heap-buffer-overflow on jhead-3.04/jpgfile.c:285 ReadJpegSections. Crafted jpeg images can be provided to the user resulting in a program crash or potentially incorrect exif information retrieval. Users are advised to upgrade. There is no known workaround for this issue.
- Product
- Jhead
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.launchpad.netgithub.com
Feb 1, 2022Document Embedder: Contains a AJAX action endpointCVE-2021-24868 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Document Embedder WordPress plugin before 1.7.9 contains a AJAX action endpoint, which could allow any authenticated user, such as subscriber to enumerate the title of arbitrary private and draft posts.
- Product
- Document Embedder
- Fixed in
- 1.7.9
- What to do
- Update Document Embedder to 1.7.9 or newer.
Feb 1, 2022Document Embedder: Contains a REST endpointCVE-2021-24775 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Document Embedder WordPress plugin before 1.7.5 contains a REST endpoint, which could allow unauthenticated users to enumerate the title of arbitrary private and draft posts.
- Product
- Document Embedder
- Fixed in
- 1.7.5
- What to do
- Update Document Embedder to 1.7.5 or newer.
Jan 25, 2022The code that performs password matching when using 'Basic' HTTP authentication does not use a constant-time memcmp and has no rate-limiting.CVE-2021-43298 · Other software · embedthis · reported by reefs@jfrog.comCritical 9.8
The code that performs password matching when using 'Basic' HTTP authentication does not use a constant-time memcmp and has no rate-limiting. This means that an unauthenticated network attacker can brute-force the HTTP basic password, byte-by-byte, by recording the webserver's response time until the unauthorized (401) response.
- Product
- goahead
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2022Embedded web server command injection vulnerability in Lexmark devices through 2021-12-07.CVE-2021-44735 · Other software · Lexmark · reported by MITRECritical 9.8
Embedded web server command injection vulnerability in Lexmark devices through 2021-12-07.
- Product
- B2236 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lexmark.comzerodayinitiative.com
Jan 20, 2022Embedded web server input sanitization vulnerability in Lexmark devices through 2021-12-07, which can which can lead to remote code execution on the device.CVE-2021-44734 · Other software · Lexmark · reported by MITRECritical 9.8
Embedded web server input sanitization vulnerability in Lexmark devices through 2021-12-07, which can which can lead to remote code execution on the device.
- Product
- B2236 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lexmark.comzerodayinitiative.com
Dec 26, 2021An issue was discovered in the rust-embed crate before 6.3.0 for Rust.CVE-2021-45712 · Other software · Rust-embed Project · reported by MITREHigh 7.5
An issue was discovered in the rust-embed crate before 6.3.0 for Rust. A ../ directory traversal can sometimes occur in debug mode.
- Product
- Rust-embed
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comrustsec.org
Dec 21, 2021In Mbed TLS before 3.1.0, psa_aead_generate_nonce allows policy bypass or oracle-based decryption when the output buffer is at memory locations accessible to anCVE-2021-45451 · Computers, phones & browsers · ARM · reported by MITREHigh 7.5
In Mbed TLS before 3.1.0, psa_aead_generate_nonce allows policy bypass or oracle-based decryption when the output buffer is at memory locations accessible to an untrusted application.
- Product
- Mbed TLS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.fedoraproject.org
Dec 21, 2021In Mbed TLS before 2.28.0 and 3.x before 3.1.0, psa_cipher_generate_iv and psa_cipher_encrypt allow policy bypass or oracle-based decryption when the output bufCVE-2021-45450 · Other software · Trustedfirmware · reported by MITREHigh 7.5
In Mbed TLS before 2.28.0 and 3.x before 3.1.0, psa_cipher_generate_iv and psa_cipher_encrypt allow policy bypass or oracle-based decryption when the output buffer is at memory locations accessible to an untrusted application.
- Product
- Mbed TLS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.