Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,121 results · page 23 of 43
Jan 30, 2023Incorrect Privilege Assignment vulnerability in Hitachi Storage Plug-in for VMware vCenter allows remote authenticated users to cause privilege escalation.CVE-2022-4041 · Other software · Hitachi · reported by hirt@hitachi.co.jpMedium 5.9
Incorrect Privilege Assignment vulnerability in Hitachi Storage Plug-in for VMware vCenter allows remote authenticated users to cause privilege escalation. This issue affects Hitachi Storage Plug-in for VMware vCenter: from 04.8.0 before 04.9.1.
- Product
- Hitachi Storage Plug-in for VMware vCenter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhitachi.comhitachi.com
Jan 30, 2023Improper Authentication vulnerability in Toshiba Storage Security Software V1.2.0.7413 is that allows for sensitive information to be obtained via(local) passwoCVE-2022-30421 · Other software · Toshiba · reported by MITREHigh 7.8
Improper Authentication vulnerability in Toshiba Storage Security Software V1.2.0.7413 is that allows for sensitive information to be obtained via(local) password authentication module.
- Product
- Storage Security Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordglobal.11st.co.krglobal.gmarket.co.kr
Jan 26, 2023SQL Injection vulnerability in function getTableCreationQuery in CreateAddField.php in phpMyAdmin 5.x before 5.2.0 via the tbl_storage_engine or tbl_collation pCVE-2020-22452 · Websites & servers · reported by MITRECritical 9.8
SQL Injection vulnerability in function getTableCreationQuery in CreateAddField.php in phpMyAdmin 5.x before 5.2.0 via the tbl_storage_engine or tbl_collation parameters to tbl_create.php.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2023Western Digital has identified a weakness in the UFS standard that could result in a security vulnerability.CVE-2022-23005 · Other software · Jedec · reported by psirt@wdc.comHigh 8.7
Western Digital has identified a weakness in the UFS standard that could result in a security vulnerability. This vulnerability may exist in some systems where the Host boot ROM code implements the UFS Boot feature to boot from UFS compliant storage devices. The UFS Boot feature, as specified in the UFS standard, is provided by UFS devices to support platforms that need to download the system boot loader from external non-volatile storage locations. Several scenarios have been identified in which adversaries may disable the boot capability, or revert to an old boot loader code, if the host boot ROM code is improperly implemented. UFS Host Boot ROM implementers may be impacted by this vulnerability. UFS devices are only impacted when connected to a vulnerable UFS Host and are not independently impacted by this vulnerability. When present, the vulnerability is in the UFS Host implementation and is not a vulnerability in Western Digital UFS Devices. Western Digital has provided details of the vulnerability to the JEDEC standards body, multiple vendors of host processors, and software solutions providers.
- Product
- Universal Flash Storage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocuments.westerndigital.comwesterndigital.com
Jan 19, 2023 Cloud Mobility for Dell EMC Storage, versions 1.3.0.X and below contains an Improper Check for Certificate Revocation vulnerability.CVE-2023-23690 · Other software · Dell · reported by security_alert@emc.comHigh 7
Cloud Mobility for Dell EMC Storage, versions 1.3.0.X and below contains an Improper Check for Certificate Revocation vulnerability. A threat actor does not need any specific privileges to potentially exploit this vulnerability. An attacker could perform a man-in-the-middle attack and eavesdrop on encrypted communications from Cloud Mobility to Cloud Storage devices. Exploitation could lead to the compromise of secret and sensitive information, cloud storage connection downtime, and the integrity of the connection to the Cloud devices.
- Product
- Cloud Mobility for Dell Storage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2023A vulnerability exists in the FTP server of the Zyxel AX7501-B0 firmware prior to V5.17(ABPC.3)C0, which processes symbolic links on external storage media.CVE-2022-45440 · Network & remote access · Zyxel · reported by security@zyxel.com.twMedium 4.4
A vulnerability exists in the FTP server of the Zyxel AX7501-B0 firmware prior to V5.17(ABPC.3)C0, which processes symbolic links on external storage media. A local authenticated attacker with administrator privileges could abuse this vulnerability to access the root file system by creating a symbolic link on external storage media, such as a USB flash drive, and then logging into the FTP server on a vulnerable device.
- Product
- AX7501-B0 firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2023Mercedes-Benz XENTRY Retail Data Storage 7.8.1 allows remote attackers to cause a denial of service (device restart) via an unauthenticated API request.CVE-2023-23590 · Other software · Mercedes-benz · reported by MITREHigh 7.5
Mercedes-Benz XENTRY Retail Data Storage 7.8.1 allows remote attackers to cause a denial of service (device restart) via an unauthenticated API request. The attacker must be on the same network as the device.
- Product
- Xentry Retail Data Storage Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordb2bconnect.mercedes-benz.commedium.com
Jan 14, 2023Insecure Storage of Sensitive Information in GitHub repository publify/publify prior to 9.2.10.CVE-2022-2815 · Other software · publify · reported by security@huntr.devMedium 6.5
Insecure Storage of Sensitive Information in GitHub repository publify/publify prior to 9.2.10.
- Product
- publify/publify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2023Unproper laxist permissions on the temporary files used by MIME4J TempFileStorageProvider may lead to information disclosure to other local users.CVE-2022-45787 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.5
Unproper laxist permissions on the temporary files used by MIME4J TempFileStorageProvider may lead to information disclosure to other local users. This issue affects Apache James MIME4J version 0.8.8 and prior versions. We recommend users to upgrade to MIME4j version 0.8.9 or later.
- Product
- Apache James MIME4J
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
Dec 27, 2022Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-4734 · Other software · usememos · reported by security@huntr.devHigh 8.1
Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository usememos/memos prior to 0.9.1.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2022If two Workers were simultaneously initializing their CacheStorage, a data race could have occurred in the `ThirdPartyUtil` component.CVE-2022-42930 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 7.1
If two Workers were simultaneously initializing their CacheStorage, a data race could have occurred in the `ThirdPartyUtil` component. This vulnerability affects Firefox < 106.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Dec 19, 2022Cortex provides multi-tenant, long term storage for Prometheus.CVE-2022-23536 · Other software · cortexproject · reported by GitHubMedium 6.5
Cortex provides multi-tenant, long term storage for Prometheus. A local file inclusion vulnerability exists in Cortex versions 1.13.0, 1.13.1 and 1.14.0, where a malicious actor could remotely read local files as a result of parsing maliciously crafted Alertmanager configurations when submitted to the Alertmanager Set Configuration API. Only users of the Alertmanager service where `-experimental.alertmanager.enable-api` or `enable_api: true` is configured are affected. Affected Cortex users are advised to upgrade to patched versions 1.13.2 or 1.14.1. However as a workaround, Cortex administrators may reject Alertmanager configurations containing the `api_key_file` setting in the `opsgenie_configs` section before sending to the Set Alertmanager Configuration API.
- Product
- cortex
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcortexmetrics.iogithub.com
Dec 12, 2022 A cleartext storage of sensitive information vulnerability exists in PcVue versions 8.10 through 15.2.3.CVE-2022-4312 · Other software · ARC Informatique · reported by ics-cert@hq.dhs.govMedium 5.5
A cleartext storage of sensitive information vulnerability exists in PcVue versions 8.10 through 15.2.3. This could allow an unauthorized user with access the email and short messaging service (SMS) accounts configuration files to discover the associated simple mail transfer protocol (SMTP) account credentials and the SIM card PIN code. Successful exploitation of this vulnerability could allow an unauthorized user access to the underlying email account and SIM card.
- Product
- PcVue
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpcvuesolutions.compcvuesolutions.com
Dec 12, 2022A security vulnerability has been identified in HPE Nimble Storage Hybrid Flash Arrays and HPE Nimble Storage Secondary Flash Arrays which could potentially allCVE-2022-37930 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comMedium 6.7
A security vulnerability has been identified in HPE Nimble Storage Hybrid Flash Arrays and HPE Nimble Storage Secondary Flash Arrays which could potentially allow local disclosure of sensitive information.
- Product
- HPE Nimble Storage Hybrid Flash Arrays; Nimble Storage Secondary Flash Arrays
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hpe.comsupport.hpe.com
Dec 12, 2022Improper Privilege Management vulnerability in Hewlett Packard Enterprise Nimble Storage Hybrid Flash Arrays and Nimble Storage Secondary Flash Arrays.CVE-2022-37929 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comMedium 6.7
Improper Privilege Management vulnerability in Hewlett Packard Enterprise Nimble Storage Hybrid Flash Arrays and Nimble Storage Secondary Flash Arrays.
- Product
- HPE Nimble Storage Hybrid Flash Arrays; Nimble Storage Secondary Flash Arrays
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hpe.comsupport.hpe.com
Dec 12, 2022Insufficient Verification of Data Authenticity vulnerability in Hewlett Packard Enterprise HPE Nimble Storage Hybrid Flash Arrays and Nimble Storage Secondary FCVE-2022-37928 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 8
Insufficient Verification of Data Authenticity vulnerability in Hewlett Packard Enterprise HPE Nimble Storage Hybrid Flash Arrays and Nimble Storage Secondary Flash Arrays.
- Product
- HPE Nimble Storage Hybrid Flash Arrays; Nimble Storage Secondary Flash Arrays
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hpe.comsupport.hpe.com
Dec 6, 2022Uncontrolled resource consumption vulnerability in Cybozu Remote Service 4.0.0 to 4.0.3 allows a remote authenticated attacker to consume huge storage space, whCVE-2022-44608 · Other software · Cybozu, Inc. · reported by vultures@jpcert.or.jpHigh 7.5
Uncontrolled resource consumption vulnerability in Cybozu Remote Service 4.0.0 to 4.0.3 allows a remote authenticated attacker to consume huge storage space, which may result in a denial-of-service (DoS) condition.
- Product
- Cybozu Remote Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2022Plaintext storage of a password vulnerability exists in +F FS040U software versions v2.3.4 and earlier, which may allow an attacker to obtain the login passwordCVE-2022-43442 · Other software · FUJI SOFT INCORPORATED · reported by vultures@jpcert.or.jpMedium 4.6
Plaintext storage of a password vulnerability exists in +F FS040U software versions v2.3.4 and earlier, which may allow an attacker to obtain the login password of +F FS040U and log in to the management console.
- Product
- +F FS040U software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 24, 2022Cleartext Storage of Sensitive Information in Memory vulnerability in Mitsubishi Electric Corporation GX Works3 versions 1.015R and later, GX Works2 all versionCVE-2022-29832 · Other software · Mitsubishi Electric Corporation · reported by Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jpLow 3.7
Cleartext Storage of Sensitive Information in Memory vulnerability in Mitsubishi Electric Corporation GX Works3 versions 1.015R and later, GX Works2 all versions and GX Developer versions 8.40S and later allows a remote unauthenticated attacker to disclose sensitive information. As a result, unauthenticated users could obtain information about the project file for MELSEC safety CPU modules or project file for MELSEC Q/FX/L series with security setting.
- Product
- GX Works3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 24, 2022Cleartext Storage of Sensitive Information vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.087R and Motion Control Setting(GX Works3 reCVE-2022-29826 · Other software · Mitsubishi Electric Corporation · reported by Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jpMedium 6.8
Cleartext Storage of Sensitive Information vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.087R and Motion Control Setting(GX Works3 related software) versions from 1.000A to 1.042U allows a remote unauthenticated attacker to disclose sensitive information. As a result, unauthenticated users may view programs and project files or execute programs illegally.
- Product
- GX Works3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 24, 2022Cleartext Storage of Sensitive Information vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.095Z and Mitsubishi Electric MX OPC UA ModulCVE-2022-25164 · Other software · Mitsubishi Electric Corporation · reported by Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jpHigh 8.6
Cleartext Storage of Sensitive Information vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.095Z and Mitsubishi Electric MX OPC UA Module Configurator-R versions 1.08J and prior allows a remote unauthenticated attacker to disclose sensitive information. As a result, unauthenticated attackers can gain unauthorized access to the MELSEC CPU module and the MELSEC OPC UA server module.
- Product
- GX Works3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2022A vulnerability exists in the Intelligent Electronic Device (IED) Connectivity Package (ConnPack) credential storage function in Hitachi Energy’s PCM600 productCVE-2022-2513 · Other software · Hitachi Energy · reported by cybersecurity@hitachienergy.comHigh 7.1
A vulnerability exists in the Intelligent Electronic Device (IED) Connectivity Package (ConnPack) credential storage function in Hitachi Energy’s PCM600 product included in the versions listed below, where IEDs credentials are stored in a cleartext format in the PCM600 database and logs files. An attacker having get access to the exported backup file can exploit the vulnerability and obtain user credentials of the IEDs. Additionally, an attacker with administrator access to the PCM600 host machine can obtain other user credentials by analyzing database log files. The credentials may be used to perform unauthorized modifications such as loading incorrect configurations, reboot the IEDs or cause a denial-of-service on the IEDs.
- Product
- PCM600
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpublisher.hitachienergy.compublisher.hitachienergy.com
Nov 17, 2022A cross-site scripting (XSS) vulnerability in the add-fee.php component of Password Storage Application v1.0 allows attackers to execute arbitrary web scripts oCVE-2022-43142 · Other software · Password Storage Application Project · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in the add-fee.php component of Password Storage Application v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the cmddept parameter.
- Product
- Password Storage Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2022 IBM Sterling Partner Engagement Manager 2.0 allows encrypted storage of client data to be stored locally which can be read by another user on the system.CVE-2022-34354 · Other software · IBM · reported by psirt@us.ibm.comMedium 4
IBM Sterling Partner Engagement Manager 2.0 allows encrypted storage of client data to be stored locally which can be read by another user on the system. IBM X-Force ID: 230424.
- Product
- Partner Engagement Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Nov 14, 2022DMA transactions which are targeted at input buffers used for the StorageSecurityCommandDxe software SMI handler could cause SMRAM corruption through a TOCTOU aCVE-2022-34325 · Other software · Insyde · reported by MITREHigh 7.8
DMA transactions which are targeted at input buffers used for the StorageSecurityCommandDxe software SMI handler could cause SMRAM corruption through a TOCTOU attack. DMA transactions which are targeted at input buffers used for the software SMI handler used by the StorageSecurityCommandDxe driver could cause SMRAM corruption. This issue was discovered by Insyde engineering based on the general description provided by
- Product
- Insydeh2o
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2022Improper authorization vulnerability in StorageManagerService prior to SMR Nov-2022 Release 1 allows local attacker to call privileged API.CVE-2022-39883 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4
Improper authorization vulnerability in StorageManagerService prior to SMR Nov-2022 Release 1 allows local attacker to call privileged API.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Nov 8, 2022In getMountModeInternal of StorageManagerService.java, there is a possible prevention of package installation due to improper input validation.CVE-2022-20457 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In getMountModeInternal of StorageManagerService.java, there is a possible prevention of package installation due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-243924784
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Oct 28, 2022Simple Cold Storage Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/?page=bookings/view_details.CVE-2022-43230 · Other software · Simple Cold Storage Management System Project · reported by MITREHigh 7.2
Simple Cold Storage Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/?page=bookings/view_details.
- Product
- Simple Cold Storage Managment System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2022Simple Cold Storage Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /bookings/update_status.php.CVE-2022-43229 · Other software · Simple Cold Storage Management System Project · reported by MITREHigh 7.2
Simple Cold Storage Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /bookings/update_status.php.
- Product
- Simple Cold Storage Managment System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Oct 27, 2022Password Storage Application v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Setup page.CVE-2022-42993 · Other software · Password Storage Application Project · reported by MITREMedium 5.4
Password Storage Application v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Setup page.
- Product
- Password Storage Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2022IOWOW is a C utility library and persistent key/value storage engine.CVE-2022-23462 · Other software · Softmotions · reported by GitHubMedium 6.2
IOWOW is a C utility library and persistent key/value storage engine. Versions 1.4.15 and prior contain a stack buffer overflow vulnerability that allows for Denial of Service (DOS) when it parses scientific notation numbers present in JSON. A patch for this issue is available at commit a79d31e4cff1d5a08f665574b29fd885897a28fd in the `master` branch of the repository. There are no workarounds other than applying the patch.
- Product
- iowow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecuritylab.github.com
Oct 14, 2022Simple Cold Storage Management System v1.0 is vulnerable to SQL Injection via /csms/classes/Master.php?f=delete_storage.CVE-2022-42232 · Other software · Oretnom23 · reported by MITREHigh 7.2
Simple Cold Storage Management System v1.0 is vulnerable to SQL Injection via /csms/classes/Master.php?f=delete_storage.
- Product
- Simple Cold Storage Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2022The storage maintenance and debugging module has an array out-of-bounds read vulnerability.Successful exploitation of this vulnerability will cause incorrect stCVE-2022-41583 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
The storage maintenance and debugging module has an array out-of-bounds read vulnerability.Successful exploitation of this vulnerability will cause incorrect statistics of this module.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Oct 11, 2022Windows Storage Elevation of Privilege VulnerabilityCVE-2022-38027 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Windows Storage Elevation of Privilege Vulnerability
- Product
- Windows 11 version 22H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Oct 11, 2022Simple Cold Storage Management System v1.0 is vulnerable to SQL Injection via /csms/admin/?page=user/manage_user&id=.CVE-2022-42230 · Other software · Simple Cold Storage Management System Project · reported by MITREHigh 7.2
Simple Cold Storage Management System v1.0 is vulnerable to SQL Injection via /csms/admin/?page=user/manage_user&id=.
- Product
- Simple Cold Storage Managment System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2022Cloud Mobility for Dell Storage versions 1.3.0 and earlier contains an Improper Access Control vulnerability within the Postgres database.CVE-2022-34434 · Other software · Dell · reported by security_alert@emc.comMedium 6.7
Cloud Mobility for Dell Storage versions 1.3.0 and earlier contains an Improper Access Control vulnerability within the Postgres database. A threat actor with root level access to either the vApp or containerized versions of Cloud Mobility may potentially exploit this vulnerability, leading to the modification or deletion of tables that are required for many of the core functionalities of Cloud Mobility. Exploitation may lead to the compromise of integrity and availability of the normal functionality of the Cloud Mobility application.
- Product
- Cloud Mobility for Dell Storage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2022Dell Container Storage Modules 1.2 contains an OS Command Injection in goiscsi and gobrick libraries.CVE-2022-34427 · Other software · Dell · reported by security_alert@emc.comHigh 8.8
Dell Container Storage Modules 1.2 contains an OS Command Injection in goiscsi and gobrick libraries. A remote unauthenticated attacker could exploit this vulnerability leading to modification of intended OS command execution.
- Product
- Dell Container Storage Modules
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2022Dell Container Storage Modules 1.2 contains an Improper Limitation of a Pathname to a Restricted Directory in goiscsi and gobrick libraries which could lead to CVE-2022-34426 · Other software · Dell · reported by security_alert@emc.comHigh 8.8
Dell Container Storage Modules 1.2 contains an Improper Limitation of a Pathname to a Restricted Directory in goiscsi and gobrick libraries which could lead to OS command injection. A remote unauthenticated attacker could exploit this vulnerability leading to unintentional access to path outside of restricted directory.
- Product
- Dell Container Storage Modules
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2022PicUploader v2.6.3 was discovered to contain cross-site scripting (XSS) vulnerability via the setStorageParams function in SettingController.php.CVE-2022-41442 · Other software · Picuploader Project · reported by MITREMedium 6.1
PicUploader v2.6.3 was discovered to contain cross-site scripting (XSS) vulnerability via the setStorageParams function in SettingController.php.
- Product
- Picuploader
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2022Simple Cold Storage Management System v1.0 is vulnerable to SQL injection via /csms/admin/inquiries/view_details.php?id=.CVE-2022-42250 · Other software · Oretnom23 · reported by MITREHigh 7.2
Simple Cold Storage Management System v1.0 is vulnerable to SQL injection via /csms/admin/inquiries/view_details.php?id=.
- Product
- Simple Cold Storage Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2022Simple Cold Storage Management System v1.0 is vulnerable to SQL injection via /csms/admin/storages/view_storage.php?id=.CVE-2022-42249 · Other software · Oretnom23 · reported by MITREHigh 7.2
Simple Cold Storage Management System v1.0 is vulnerable to SQL injection via /csms/admin/storages/view_storage.php?id=.
- Product
- Simple Cold Storage Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2022Simple Cold Storage Management System v1.0 is vulnerable to SQL injection via /csms/admin/storages/manage_storage.php?id=.CVE-2022-42243 · Other software · Oretnom23 · reported by MITREHigh 7.2
Simple Cold Storage Management System v1.0 is vulnerable to SQL injection via /csms/admin/storages/manage_storage.php?id=.
- Product
- Simple Cold Storage Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2022Simple Cold Storage Management System v1.0 is vulnerable to SQL injection via /csms/classes/Master.php?f=delete_booking.CVE-2022-42242 · Other software · Oretnom23 · reported by MITREHigh 7.2
Simple Cold Storage Management System v1.0 is vulnerable to SQL injection via /csms/classes/Master.php?f=delete_booking.
- Product
- Simple Cold Storage Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2022Simple Cold Storage Management System v1.0 is vulnerable to SQL injection via /csms/classes/Master.php?f=delete_message.CVE-2022-42241 · Other software · Oretnom23 · reported by MITREHigh 7.2
Simple Cold Storage Management System v1.0 is vulnerable to SQL injection via /csms/classes/Master.php?f=delete_message.
- Product
- Simple Cold Storage Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2022Incorrect Privilege Assignment vulnerability in Hitachi Hitachi Storage Plug-in for VMware vCenter allows remote authenticated users to cause privilege escalatiCVE-2022-2637 · Other software · Hitachi · reported by hirt@hitachi.co.jpMedium 5.4
Incorrect Privilege Assignment vulnerability in Hitachi Hitachi Storage Plug-in for VMware vCenter allows remote authenticated users to cause privilege escalation.This issue affects Hitachi Storage Plug-in for VMware vCenter: from 04.8.0 before 04.9.0.
- Product
- Hitachi Storage Plug-in for VMware vCenter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhitachi.comhitachi.com
Sep 28, 2022Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has weak /opt/axess/var/blobstorage/ permissions.CVE-2020-15328 · Network & remote access · Zyxel · reported by MITREMedium 5.3
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has weak /opt/axess/var/blobstorage/ permissions.
- Product
- Cloudcnm Secumanager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpierrekim.github.iozyxel.com
Sep 28, 2022Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 uses ZODB storage without authentication.CVE-2020-15327 · Network & remote access · Zyxel · reported by MITREHigh 7.5
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 uses ZODB storage without authentication.
- Product
- Cloudcnm Secumanager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpierrekim.github.iozyxel.com
Sep 28, 2022Double free in DOMStorage in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.CVE-2019-5797 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 7.5
Double free in DOMStorage in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comcrbug.com
Sep 26, 2022Out of bounds write in Storage in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML paCVE-2022-3195 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
Out of bounds write in Storage in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comcrbug.com
Sep 23, 2022A cleartext storage of sensitive information exists in Rocket.Chat <v4.6.4 due to Oauth token being leaked in plaintext in Rocket.chat logs.CVE-2022-32217 · Other software · Rocket.chat · reported by support@hackerone.comMedium 5.3
A cleartext storage of sensitive information exists in Rocket.Chat <v4.6.4 due to Oauth token being leaked in plaintext in Rocket.chat logs.
- Product
- Rocket.chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comhackerone.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.