Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,323 results · page 23 of 47
Jan 29, 2024The Relevanssi WordPress plugin before 4.22.0, Relevanssi Premium WordPress plugin before 2.25.0 allows any unauthenticated user to read draft and private postsCVE-2023-7199 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Relevanssi WordPress plugin before 4.22.0, Relevanssi Premium WordPress plugin before 2.25.0 allows any unauthenticated user to read draft and private posts via a crafted request
- Product
- Relevanssi
- Fixed in
- 4.22.0
- What to do
- Update Relevanssi to 4.22.0 or newer.
Full record and what to do →NVD recordwpscan.comrelevanssi.com
Jan 26, 2024Microsoft Edge (Chromium-based) Spoofing VulnerabilityCVE-2024-21336 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comLow 2.5
Microsoft Edge (Chromium-based) Spoofing Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jan 25, 2024Microsoft Edge for Android Spoofing VulnerabilityCVE-2024-21387 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.3
Microsoft Edge for Android Spoofing Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jan 25, 2024Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityCVE-2024-21385 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.3
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jan 25, 2024Microsoft Edge (Chromium-based) Spoofing VulnerabilityCVE-2024-21383 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comLow 3.3
Microsoft Edge (Chromium-based) Spoofing Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jan 25, 2024Microsoft Edge for Android Information Disclosure VulnerabilityCVE-2024-21382 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.3
Microsoft Edge for Android Information Disclosure Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jan 25, 2024Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityCVE-2024-21326 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.6
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jan 24, 2024Trillium is a composable toolkit for building internet applications with async rust.CVE-2024-23644 · Other software · trillium-rs · reported by GitHubMedium 6.8
Trillium is a composable toolkit for building internet applications with async rust. In `trillium-http` prior to 0.3.12 and `trillium-client` prior to 0.5.4, insufficient validation of outbound header values may lead to request splitting or response splitting attacks in scenarios where attackers have sufficient control over headers. This only affects use cases where attackers have control of request headers, and can insert "\r\n" sequences. Specifically, if untrusted and unvalidated input is inserted into header names or values. Outbound `trillium_http::HeaderValue` and `trillium_http::HeaderName` can be constructed infallibly and were not checked for illegal bytes when sending requests from the client or responses from the server. Thus, if an attacker has sufficient control over header values (or names) in a request or response that they could inject `\r\n` sequences, they could get the client and server out of sync, and then pivot to gain control over other parts of requests or responses. (i.e. exfiltrating data from other requests, SSRF, etc.) In `trillium-http` versions 0.3.12 and later, if a header name is invalid in server response headers, the specific header and any assoc
- Product
- trillium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2024Google Chromium V8 Out-of-Bounds Memory Access VulnerabilityCVE-2024-0519 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedHigh 8.8
Google Chromium V8 Engine contains an out-of-bounds memory access vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
- Product
- Chromium V8
- On CISA’s list since
- Jan 17, 2024 (federal fix deadline Feb 7, 2024)
- What to do
- Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogchromereleases.googleblog.comcrbug.com
Jan 16, 2024EventON Premium WordPress plugin before 4.5.6, EventON: Do not have authorisation in an AJAX actionCVE-2024-0238 · WordPress plugins & themes · reported by WPScanMedium 6.1
The EventON Premium WordPress plugin before 4.5.6, EventON WordPress plugin before 2.2.8 do not have authorisation in an AJAX action, and does not ensure that the post to be updated belong to the plugin, allowing unauthenticated users to update arbitrary post metadata.
- Product
- EventON Premium WordPress plugin before 4.5.6, EventON
- Fixed in
- 4.5.6
- What to do
- Update EventON Premium WordPress plugin before 4.5.6, EventON to 4.5.6 or newer.
Jan 13, 2024Chromium Embedded Framework (CEF) is a simple framework for embedding Chromium-based browsers in other applications.`CefVideoConsumerOSR::OnFrameCaptured` does CVE-2024-21640 · Computers, phones & browsers · chromiumembedded · reported by GitHubMedium 5.4
Chromium Embedded Framework (CEF) is a simple framework for embedding Chromium-based browsers in other applications.`CefVideoConsumerOSR::OnFrameCaptured` does not check `pixel_format` properly, which leads to out-of-bounds read out of the sandbox. This vulnerability was patched in commit 1f55d2e.
- Product
- cef
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2024CEF (Chromium Embedded Framework ) is a simple framework for embedding Chromium-based browsers in other applications.CVE-2024-21639 · Computers, phones & browsers · chromiumembedded · reported by GitHubMedium 5.3
CEF (Chromium Embedded Framework ) is a simple framework for embedding Chromium-based browsers in other applications. `CefLayeredWindowUpdaterOSR::OnAllocatedSharedMemory` does not check the size of the shared memory, which leads to out-of-bounds read outside the sandbox. This vulnerability was patched in commit 1f55d2e.
- Product
- cef
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2024Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityCVE-2024-21337 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.2
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jan 11, 2024Microsoft Edge (Chromium-based) Security Feature Bypass VulnerabilityCVE-2024-20675 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.3
Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jan 8, 2024WP Blogs' Planetarium: Does not have CSRF check in placeCVE-2023-6532 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Blogs' Planetarium WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- WP Blogs' Planetarium
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update WP Blogs' Planetarium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordmagos-securitas.comwpscan.com
Dec 27, 2023Nexkey is a lightweight fork of Misskey v12 optimized for small to medium size servers.CVE-2023-52077 · Other software · nexryai · reported by GitHubHigh 8.9
Nexkey is a lightweight fork of Misskey v12 optimized for small to medium size servers. Prior to 12.23Q4.5, Nexkey allows external apps using tokens issued by administrators and moderators to call admin APIs. This allows malicious third-party apps to perform operations such as updating server settings, as well as compromise object storage and email server credentials. This issue has been patched in 12.23Q4.5.
- Product
- nexkey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 21, 2023Google Chromium WebRTC Heap Buffer Overflow VulnerabilityCVE-2023-7024 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedHigh 8.8
Google Chromium WebRTC, an open-source project providing web browsers with real-time communication, contains a heap buffer overflow vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could impact web browsers using WebRTC, including but not limited to Google Chrome.
- Product
- Chromium WebRTC
- On CISA’s list since
- Jan 2, 2024 (federal fix deadline Jan 23, 2024)
- What to do
- Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogchromereleases.googleblog.comcrbug.com
Dec 19, 2023IBM Security Guardium Key Lifecycle Manager 4.3 is vulnerable to cross-site scripting.CVE-2023-47707 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.4
IBM Security Guardium Key Lifecycle Manager 4.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 271522.
- Product
- Security Guardium Key Lifecycle Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Dec 19, 2023IBM Security Guardium Key Lifecycle Manager 4.3 could allow an authenticated user to manipulate username data due to improper input validation.CVE-2023-47705 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM Security Guardium Key Lifecycle Manager 4.3 could allow an authenticated user to manipulate username data due to improper input validation. IBM X-Force ID: 271228.
- Product
- Security Guardium Key Lifecycle Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Dec 19, 2023IBM Security Guardium Key Lifecycle Manager 4.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returneCVE-2023-47703 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM Security Guardium Key Lifecycle Manager 4.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 271197.
- Product
- Security Guardium Key Lifecycle Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Dec 19, 2023IBM Security Guardium Key Lifecycle Manager 4.3 could allow a remote attacker to traverse directories on the system.CVE-2023-47702 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM Security Guardium Key Lifecycle Manager 4.3 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view modify files on the system. IBM X-Force ID: 271196.
- Product
- Security Guardium Key Lifecycle Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Dec 19, 2023IBM Security Guardium Key Lifecycle Manager 4.3 could allow an authenticated user to upload files of a dangerous file type.CVE-2023-47706 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.6
IBM Security Guardium Key Lifecycle Manager 4.3 could allow an authenticated user to upload files of a dangerous file type. IBM X-Force ID: 271341.
- Product
- Security Guardium Key Lifecycle Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Dec 19, 2023IBM Security Guardium Key Lifecycle Manager 4.3 contains plain text hard-coded credentials or other secrets in source code repository.CVE-2023-47704 · Other software · IBM · reported by psirt@us.ibm.comMedium 4
IBM Security Guardium Key Lifecycle Manager 4.3 contains plain text hard-coded credentials or other secrets in source code repository. IBM X-Force ID: 271220.
- Product
- Security Guardium Key Lifecycle Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Dec 18, 2023 Cambium ePMP Force 300-25 version 4.7.0.1 is vulnerable to a code injection vulnerability that could allow an attacker to perform remote code execution and gaiCVE-2023-6691 · Other software · Cambium · reported by ics-cert@hq.dhs.govHigh 7.8
Cambium ePMP Force 300-25 version 4.7.0.1 is vulnerable to a code injection vulnerability that could allow an attacker to perform remote code execution and gain root privileges.
- Product
- ePMP Force 300-25
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 14, 2023Microsoft Edge (Chromium-based) Security Feature Bypass VulnerabilityCVE-2023-36878 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.3
Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Dec 9, 2023SyncTrayzor 1.1.29 enables CEF (Chromium Embedded Framework) remote debugging, allowing a local attacker to control the application.CVE-2021-46899 · Other software · Antonymale · reported by MITREHigh 7.8
SyncTrayzor 1.1.29 enables CEF (Chromium Embedded Framework) remote debugging, allowing a local attacker to control the application.
- Product
- Synctrayzor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2023Microsoft Edge (Chromium-based) Information Disclosure VulnerabilityCVE-2023-38174 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.3
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Dec 7, 2023Microsoft Edge (Chromium-based) Information Disclosure VulnerabilityCVE-2023-36880 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.8
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Dec 7, 2023Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityCVE-2023-35618 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.6
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Nov 30, 2023Premium Addons PRO: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-37868 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Leap13 Premium Addons PRO.This issue affects Premium Addons PRO: from n/a through 2.9.0.
- Product
- Premium Addons PRO
- Affected
- up to 2.9.0
- What to do
- Affects up to 2.9.0. Update Premium Addons PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 29, 2023Google Skia Integer Overflow VulnerabilityCVE-2023-6345 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedCritical 9.6
Google Chromium Skia contains an integer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a malicious file. This vulnerability affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products.
- Product
- Chromium Skia
- On CISA’s list since
- Nov 30, 2023 (federal fix deadline Dec 21, 2023)
- What to do
- Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogchromereleases.googleblog.comcrbug.com
Nov 28, 2023IBM Security Guardium 11.3, 11.4, and 11.5 is potentially vulnerable to CSV injection.CVE-2023-42004 · Other software · IBM · reported by psirt@us.ibm.comHigh 8
IBM Security Guardium 11.3, 11.4, and 11.5 is potentially vulnerable to CSV injection. A remote attacker could execute malicious commands due to improper validation of csv file contents. IBM X-Force ID: 265262.
- Product
- Security Guardium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Nov 21, 2023Kibana contains an embedded version of the Chromium browser that the Reporting feature uses to generate the downloadable reports.CVE-2021-22142 · Other software · Elastic · reported by security@elastic.coMedium 6.6
Kibana contains an embedded version of the Chromium browser that the Reporting feature uses to generate the downloadable reports. If a user with permissions to generate reports is able to render arbitrary HTML with this browser, they may be able to leverage known Chromium vulnerabilities to conduct further attacks. Kibana contains a number of protections to prevent this browser from rendering arbitrary content.
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.elastic.coelastic.co
Nov 21, 2023fastbots is a library for fast bot and scraper development using selenium and the Page Object Model (POM) design.CVE-2023-48699 · Other software · ubertidavide · reported by GitHubHigh 8.4
fastbots is a library for fast bot and scraper development using selenium and the Page Object Model (POM) design. Prior to version 0.1.5, an attacker could modify the locators.ini locator file with python code that without proper validation it's executed and it could lead to rce. The vulnerability is in the function `def __locator__(self, locator_name: str)` in `page.py`. In order to mitigate this issue, upgrade to fastbots version 0.1.5 or above.
- Product
- fastbots
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 18, 2023Yoast Local Premium: Cross-Site Request Forgery (CSRF)CVE-2023-28780 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Cross-Site Request Forgery (CSRF) vulnerability in Yoast Yoast Local Premium.This issue affects Yoast Local Premium: from n/a through 14.8.
- Product
- Yoast Local Premium
- Affected
- up to 14.8
- What to do
- Affects up to 14.8. Update Yoast Local Premium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 18, 2023In International Color Consortium DemoIccMAX 3e7948b, CIccCLUT::Interp2d in IccTagLut.cpp in libSampleICC.a has an out-of-bounds read.CVE-2023-48736 · Other software · Color · reported by MITREMedium 6.5
In International Color Consortium DemoIccMAX 3e7948b, CIccCLUT::Interp2d in IccTagLut.cpp in libSampleICC.a has an out-of-bounds read.
- Product
- Demoiccmax
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2023Microsoft Edge (Chromium-based) Spoofing VulnerabilityCVE-2023-36026 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.3
Microsoft Edge (Chromium-based) Spoofing Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Nov 16, 2023Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityCVE-2023-36008 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.6
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Nov 14, 2023Nukium nkmgls before version 3.0.2 is vulnerable to Cross Site Scripting (XSS) via NkmGlsCheckoutModuleFrontController::displayAjaxSavePhoneMobile.CVE-2023-47309 · Other software · Nukium · reported by MITREMedium 5.4
Nukium nkmgls before version 3.0.2 is vulnerable to Cross Site Scripting (XSS) via NkmGlsCheckoutModuleFrontController::displayAjaxSavePhoneMobile.
- Product
- GLS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.friendsofpresta.orgsecurity.friendsofpresta.org
Nov 14, 2023A cross-site scripting (XSS) vulnerability in CesiumJS v1.111 allows attackers to execute arbitrary code in the context of the victim's browser via sending a crCVE-2023-48094 · Other software · Cesium · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in CesiumJS v1.111 allows attackers to execute arbitrary code in the context of the victim's browser via sending a crafted payload to /container_files/public_html/doc/index.html. NOTE: the vendor’s position is that Apps/Sandcastle/standalone.html is part of the CesiumGS/cesium GitHub repository, but is demo code that is not part of the CesiumJS JavaScript library product.
- Product
- Cesiumjs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Nov 10, 2023Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityCVE-2023-36027 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.1
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Nov 9, 2023Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityCVE-2023-36024 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.1
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Nov 9, 2023Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityCVE-2023-36014 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.3
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Nov 9, 2023Cross-Site Request Forgery (CSRF) vulnerability in Mat Bao Corp WP Helper Premium plugin <= 4.5.1 versions.CVE-2023-46614 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Mat Bao Corp WP Helper Premium plugin <= 4.5.1 versions.
- Fixed in
- 4.5.2
- What to do
- Update the plugin to 4.5.2 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 6, 2023Microsoft Edge (Chromium-based) Information Disclosure VulnerabilityCVE-2023-36409 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Nov 5, 2023** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Magnesium-PHP up to 0.3.0.CVE-2017-20187 · Other software · Floriangaerber · reported by VulDBLow 3.5
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Magnesium-PHP up to 0.3.0. It has been classified as problematic. Affected is the function formatEmailString of the file src/Magnesium/Message/Base.php. The manipulation of the argument email/name leads to injection. Upgrading to version 0.3.1 is able to address this issue. The patch is identified as 500d340e1f6421007413cc08a8383475221c2604. It is recommended to upgrade the affected component. VDB-244482 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- Magnesium-php
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2023In International Color Consortium DemoIccMAX 79ecb74, a CIccXmlArrayType:::ParseText function (for unsigned short) in IccUtilXml.cpp in libIccXML.a has an out-oCVE-2023-47249 · Other software · Color · reported by MITREMedium 6.5
In International Color Consortium DemoIccMAX 79ecb74, a CIccXmlArrayType:::ParseText function (for unsigned short) in IccUtilXml.cpp in libIccXML.a has an out-of-bounds read.
- Product
- Demoiccmax
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 2, 2023Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityCVE-2023-36034 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.3
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Nov 2, 2023Microsoft Edge (Chromium-based) Spoofing VulnerabilityCVE-2023-36029 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.3
Microsoft Edge (Chromium-based) Spoofing Vulnerability
- Product
- Microsoft Edge for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Nov 2, 2023Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityCVE-2023-36022 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.6
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.