Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

575new WordPress flaws this week

391,358entries in the database

2,323 results · page 24 of 47

Oct 29, 2023In International Color Consortium DemoIccMAX 79ecb74, CIccXformMatrixTRC::GetCurve in IccCmm.cpp in libSampleICC.a has a NULL pointer dereference.CVE-2023-46867 · Other software · Color · reported by MITREMedium 6.5
In International Color Consortium DemoIccMAX 79ecb74, CIccXformMatrixTRC::GetCurve in IccCmm.cpp in libSampleICC.a has a NULL pointer dereference.
Product
Demoiccmax
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 29, 2023In International Color Consortium DemoIccMAX 79ecb74, CIccCLUT::Interp3d in IccProfLib/IccTagLut.cpp in libSampleICC.a attempts to access array elements at out-CVE-2023-46866 · Other software · Color · reported by MITREMedium 6.5
In International Color Consortium DemoIccMAX 79ecb74, CIccCLUT::Interp3d in IccProfLib/IccTagLut.cpp in libSampleICC.a attempts to access array elements at out-of-bounds indexes.
Product
Demoiccmax
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 26, 2023 In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share v12 SP0 Build (1204.77), the affected applications lack proper validation of user-supplied datCVE-2023-39427 · Other software · Ashlar-Vellum · reported by ics-cert@hq.dhs.govHigh 7.8
In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share v12 SP0 Build (1204.77), the affected applications lack proper validation of user-supplied data when parsing XE files. This could lead to an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process.
Product
Cobalt
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Oct 26, 2023ILIAS (2013-09-12 release) contains a medium-criticality Directory Traversal local file inclusion vulnerability in the ScormAicc module.CVE-2023-45867 · Other software · Ilias · reported by MITREMedium 6.5
ILIAS (2013-09-12 release) contains a medium-criticality Directory Traversal local file inclusion vulnerability in the ScormAicc module. An attacker with a privileged account, typically holding the tutor role, can exploit this to gain unauthorized access to and potentially retrieve confidential files stored on the web server. The attacker can access files that are readable by the web server user www-data; this may include sensitive configuration files and documents located outside the documentRoot. The vulnerability is exploited by an attacker who manipulates the file parameter in a URL, inserting directory traversal sequences in order to access unauthorized files. This manipulation allows the attacker to retrieve sensitive files, such as /etc/passwd, potentially compromising the system's security. This issue poses a significant risk to confidentiality and is remotely exploitable over the internet.
Product
Ilias
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rehmeinfosec.de rehmeinfosec.de
Oct 23, 2023In International Color Consortium DemoIccMAX 79ecb74, there is an out-of-bounds read in the CIccPRMG::GetChroma function in IccProfLib/IccPrmg.cpp in libSampleICVE-2023-46603 · Other software · Color · reported by MITREHigh 8.8
In International Color Consortium DemoIccMAX 79ecb74, there is an out-of-bounds read in the CIccPRMG::GetChroma function in IccProfLib/IccPrmg.cpp in libSampleICC.a.
Product
Demoiccmax
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 23, 2023In International Color Consortium DemoIccMAX 79ecb74, there is a stack-based buffer overflow in the icFixXml function in IccXML/IccLibXML/IccUtilXml.cpp in libICVE-2023-46602 · Other software · Color · reported by MITREHigh 8.8
In International Color Consortium DemoIccMAX 79ecb74, there is a stack-based buffer overflow in the icFixXml function in IccXML/IccLibXML/IccUtilXml.cpp in libIccXML.a.
Product
Demoiccmax
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 15, 2023NULL Pointer Dereference in GitHub repository seleniumhq/selenium prior to 4.14.0.CVE-2023-5590 · Other software · seleniumhq · reported by security@huntr.devHigh 7.5
NULL Pointer Dereference in GitHub repository seleniumhq/selenium prior to 4.14.0.
Product
seleniumhq/selenium
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com huntr.dev
Oct 13, 2023Microsoft Edge (Chromium-based) Spoofing VulnerabilityCVE-2023-36559 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.2
Microsoft Edge (Chromium-based) Spoofing Vulnerability
Product
Microsoft Edge (Chromium-based)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com msrc.microsoft.com
Oct 10, 2023A buffer overflow in Macrium Reflect 8.1.7544 and below allows attackers to escalate privileges or execute arbitrary code.CVE-2023-43896 · Other software · Macrium · reported by MITREHigh 7.8
A buffer overflow in Macrium Reflect 8.1.7544 and below allows attackers to escalate privileges or execute arbitrary code.
Product
Reflect
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record knowledgebase.macrium.com northwave-cybersecurity.com
Oct 4, 2023IBM Security Guardium 11.5 could disclose sensitive information due to a missing or insecure SameSite attribute for a sensitive cookie.CVE-2022-43906 · Other software · IBM · reported by psirt@us.ibm.comLow 3.1
IBM Security Guardium 11.5 could disclose sensitive information due to a missing or insecure SameSite attribute for a sensitive cookie. IBM X-Force ID: 240897.
Product
Security Guardium
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com https
Sep 29, 2023Cambium Enterprise Wi-Fi System Software before 6.4.2 does not sanitize the ping host argument in device-agent.CVE-2022-35908 · Other software · Cambiumnetworks · reported by MITREHigh 8.8
Cambium Enterprise Wi-Fi System Software before 6.4.2 does not sanitize the ping host argument in device-agent.
Product
Enterprise Wi-fi
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.cambiumnetworks.com cambiumnetworks.com
Sep 28, 2023Google Chromium libvpx Heap Buffer Overflow VulnerabilityCVE-2023-5217 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedHigh 8.8
Google Chromium libvpx contains a heap buffer overflow vulnerability in vp8 encoding that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could impact web browsers using libvpx, including but not limited to Google Chrome.
Product
Chromium libvpx
On CISA’s list since
Oct 2, 2023 (federal fix deadline Oct 23, 2023)
What to do
Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog seclists.org seclists.org
Sep 27, 2023Cilium is a networking, observability, and security solution with an eBPF-based dataplane.CVE-2023-41333 · Other software · cilium · reported by GitHubMedium 6.9
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. An attacker with the ability to create or modify CiliumNetworkPolicy objects in a particular namespace is able to affect traffic on an entire Cilium cluster, potentially bypassing policy enforcement in other namespaces. By using a crafted `endpointSelector` that uses the `DoesNotExist` operator on the `reserved:init` label, the attacker can create policies that bypass namespace restrictions and affect the entire Cilium cluster. This includes potentially allowing or denying all traffic. This attack requires API server access, as described in the Kubernetes API Server Attacker section of the Cilium Threat Model. This issue has been resolved in Cilium versions 1.14.2, 1.13.7, and 1.12.14. As a workaround an admission webhook can be used to prevent the use of `endpointSelectors` that use the `DoesNotExist` operator on the `reserved:init` label in CiliumNetworkPolicies.
Product
cilium
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.cilium.io github.com
Sep 27, 2023Cilium is a networking, observability, and security solution with an eBPF-based dataplane.CVE-2023-41332 · Other software · cilium · reported by GitHubLow 3.5
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. In Cilium clusters where Cilium's Layer 7 proxy has been disabled, creating workloads with `policy.cilium.io/proxy-visibility` annotations (in Cilium >= v1.13) or `io.cilium.proxy-visibility` annotations (in Cilium <= v1.12) causes the Cilium agent to segfault on the node to which the workload is assigned. Existing traffic on the affected node will continue to flow, but the Cilium agent on the node will not able to process changes to workloads running on the node. This will also prevent workloads from being able to start on the affected node. The denial of service will be limited to the node on which the workload is scheduled, however an attacker may be able to schedule workloads on the node of their choosing, which could lead to targeted attacks. This issue has been resolved in Cilium versions 1.14.2, 1.13.7, and 1.12.14. Users unable to upgrade can avoid this denial of service attack by enabling the Layer 7 proxy.
Product
cilium
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 27, 2023Cilium is a networking, observability, and security solution with an eBPF-based dataplane.CVE-2023-39347 · Other software · cilium · reported by GitHubHigh 7.6
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. An attacker with the ability to update pod labels can cause Cilium to apply incorrect network policies. This issue arises due to the fact that on pod update, Cilium incorrectly uses user-provided pod labels to select the policies which apply to the workload in question. This can affect Cilium network policies that use the namespace, service account or cluster constructs to restrict traffic, Cilium clusterwide network policies that use Cilium namespace labels to select the Pod and Kubernetes network policies. Non-existent construct names can be provided, which bypass all network policies applicable to the construct. For example, providing a pod with a non-existent namespace as the value of the `io.kubernetes.pod.namespace` label results in none of the namespaced CiliumNetworkPolicies applying to the pod in question. This attack requires the attacker to have Kubernetes API Server access, as described in the Cilium Threat Model. This issue has been resolved in: Cilium versions 1.14.2, 1.13.7, and 1.12.14. Users are advised to upgrade. As a workaround an admission webhook can be used to prevent p
Product
cilium
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.cilium.io github.com
Sep 15, 2023Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityCVE-2023-36735 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.6
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Product
Microsoft Edge (Chromium-based)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com msrc.microsoft.com
Sep 15, 2023Microsoft Edge (Chromium-based) Spoofing VulnerabilityCVE-2023-36727 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.1
Microsoft Edge (Chromium-based) Spoofing Vulnerability
Product
Microsoft Edge (Chromium-based)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com msrc.microsoft.com
Sep 15, 2023Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityCVE-2023-36562 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.1
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Product
Microsoft Edge (Chromium-based)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com msrc.microsoft.com
Sep 12, 2023Google Chromium WebP Heap-Based Buffer Overflow VulnerabilityCVE-2023-4863 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedHigh 8.8
Google Chromium WebP contains a heap-based buffer overflow vulnerability that allows a remote attacker to perform an out-of-bounds memory write via a crafted HTML page. This vulnerability can affect applications that use the WebP Codec.
Product
Chromium WebP
On CISA’s list since
Sep 13, 2023 (federal fix deadline Oct 4, 2023)
What to do
Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog openwall.com openwall.com
Sep 5, 2023Google Chromium V8 Type Confusion VulnerabilityCVE-2023-4762 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedHigh 8.8
Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute code via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Product
Chromium V8
On CISA’s list since
Feb 6, 2024 (federal fix deadline Feb 27, 2024)
What to do
Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog chromereleases.googleblog.com crbug.com
Sep 4, 2023IBM Security Guardium 10.6, 11.3, and 11.4 could allow an authenticated user to cause a denial of service due to due to improper input validation.CVE-2022-43903 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM Security Guardium 10.6, 11.3, and 11.4 could allow an authenticated user to cause a denial of service due to due to improper input validation. IBM X-Force ID: 240894.
Product
Security Guardium
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com
Aug 27, 2023IBM Security Guardium Data Encryption (IBM Guardium Cloud Key Manager (GCKM) 1.10.3)) could allow a remote attacker to obtain sensitive information when a detaiCVE-2023-26272 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM Security Guardium Data Encryption (IBM Guardium Cloud Key Manager (GCKM) 1.10.3)) could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 248133.
Product
Guardium Cloud Key Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com
Aug 27, 2023IBM Security Guardium Data Encryption (IBM Guardium Cloud Key Manager (GCKM) 1.10.3)) uses an inadequate account lockout setting that could allow a remote attacCVE-2023-26271 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM Security Guardium Data Encryption (IBM Guardium Cloud Key Manager (GCKM) 1.10.3)) uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 248126.
Product
Guardium Cloud Key Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com
Aug 27, 2023IBM Security Guardium Data Encryption (IBM Guardium Cloud Key Manager (GCKM) 1.10.3)) could allow a remote attacker to execute arbitrary code on the system, cauCVE-2023-26270 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM Security Guardium Data Encryption (IBM Guardium Cloud Key Manager (GCKM) 1.10.3)) could allow a remote attacker to execute arbitrary code on the system, caused by an angular template injection flaw. By sending specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 248119.
Product
Guardium Cloud Key Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com
Aug 27, 2023IBM Security Guardium 11.3 and 11.4 could disclose sensitive information to an attacker due to improper restriction of excessive authentication attempts.CVE-2022-43904 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.5
IBM Security Guardium 11.3 and 11.4 could disclose sensitive information to an attacker due to improper restriction of excessive authentication attempts. IBM X-Force ID: 240895.
Product
Security Guardium
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com https
Aug 27, 2023IBM Security Guardium 11.4 is vulnerable to SQL injection.CVE-2023-33852 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.6
IBM Security Guardium 11.4 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 257614.
Product
Security Guardium
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com
Aug 27, 2023IBM Security Guardium 11.3, 11.4, and 11.5 could allow an unauthorized user to enumerate usernames by sending a specially crafted HTTP request.CVE-2023-30437 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM Security Guardium 11.3, 11.4, and 11.5 could allow an unauthorized user to enumerate usernames by sending a specially crafted HTTP request. IBM X-Force ID: 252293.
Product
Security Guardium
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com
Aug 27, 2023IBM Security Guardium 11.3, 11.4, and 11.5 is vulnerable to cross-site scripting.CVE-2023-30436 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.5
IBM Security Guardium 11.3, 11.4, and 11.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 252292.
Product
Security Guardium
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com
Aug 27, 2023IBM Security Guardium 11.3, 11.4, and 11.5 is vulnerable to stored cross-site scripting.CVE-2023-30435 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.9
IBM Security Guardium 11.3, 11.4, and 11.5 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 252291.
Product
Security Guardium
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com
Aug 27, 2023IBM Security Guardium 11.4 is vulnerable to cross-site scripting.CVE-2022-43909 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.6
IBM Security Guardium 11.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 240905.
Product
Security Guardium
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com
Aug 27, 2023IBM Security Guardium 11.4 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request.CVE-2022-43907 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.2
IBM Security Guardium 11.4 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 240901.
Product
Security Guardium
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com
Aug 25, 2023Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityCVE-2023-36741 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.3
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Product
Microsoft Edge (Chromium-based)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com msrc.microsoft.com
Aug 24, 2023Silverware Games is a premium social network where people can play games online.CVE-2023-40182 · Other software · mesosoi · reported by GitHubLow 3.7
Silverware Games is a premium social network where people can play games online. When using the Recovery form, a noticeably different amount of time passes depending of whether the specified email address presents in our database or not. This has been fixed in version 1.3.7.
Product
silverwaregames-io-issue-tracker
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 24, 2023Silverware Games is a premium social network where people can play games online.CVE-2023-40179 · Other software · mesosoi · reported by GitHubMedium 5.3
Silverware Games is a premium social network where people can play games online. Prior to version 1.3.6, the Password Recovery form would throw an error if the specified email was not found in our database. It would only display the "Enter the code" form if the email is associated with a member of the site. Since version 1.3.6, the "Enter the code" form is always returned, showing the message "If the entered email is associated with an account, a code will be sent now". This change prevents potential violators from determining if our site has a user with the specified email.
Product
silverwaregames-io-issue-tracker
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 21, 2023Microsoft Edge (Chromium-based) Information Disclosure VulnerabilityCVE-2023-38158 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comLow 3.1
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
Product
Microsoft Edge (Chromium-based)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com msrc.microsoft.com
Aug 21, 2023Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityCVE-2023-36787 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Product
Microsoft Edge (Chromium-based)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com msrc.microsoft.com
Aug 16, 2023IBM Security Guardium 10.6, 11.3, 11.4, and 11.5 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially CVE-2023-35893 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.9
IBM Security Guardium 10.6, 11.3, 11.4, and 11.5 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 258824.
Product
Security Guardium
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com
Aug 12, 2023Premium Packages - Sell Digital Products Securely: Privilege escalationCVE-2023-4293 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Premium Packages - Sell Digital Products Securely plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.7.4 due to insufficient restriction on the 'wpdmpp_update_profile' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modify their user role by supplying the 'profile[role]' parameter during a profile update.
Product
Premium Packages - Sell Digital Products Securely
Affected
up to 5.7.4
What to do
Affects up to 5.7.4. Update Premium Packages - Sell Digital Products Securely to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 11, 2023Cross Site Scripting (XSS) vulnerability in Name Input Field in Contact Us form in Laborator Kalium before 3.0.4, allows remote attackers to execute arbitrary cCVE-2020-24075 · Other software · Laborator · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability in Name Input Field in Contact Us form in Laborator Kalium before 3.0.4, allows remote attackers to execute arbitrary code.
Product
Kalium
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.laborator.co documentation.laborator.co
Aug 10, 2023Insufficient control flow management in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable denial of service via lCVE-2022-43505 · Other software · Intel · reported by secure@intel.comMedium 4.1
Insufficient control flow management in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable denial of service via local access.
Product
Pentium J6426 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record intel.com security.netapp.com
Aug 10, 2023Improper buffer restrictions in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via locaCVE-2022-27879 · Other software · Intel · reported by secure@intel.comMedium 5.3
Improper buffer restrictions in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access.
Product
Pentium J6426 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record intel.com security.netapp.com
Aug 7, 2023Microsoft Edge (Chromium-based) Security Feature Bypass VulnerabilityCVE-2023-38157 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
Product
Microsoft Edge (Chromium-based)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com msrc.microsoft.com
Aug 2, 2023 Specific F5 BIG-IP platforms with Cavium Nitrox FIPS HSM cards generate a deterministic password for the Crypto User account.CVE-2023-3470 · Network & remote access · F5 · reported by f5sirt@f5.comMedium 6
Specific F5 BIG-IP platforms with Cavium Nitrox FIPS HSM cards generate a deterministic password for the Crypto User account. The predictable nature of the password allows an authenticated user with TMSH access to the BIG-IP system, or anyone with physical access to the FIPS HSM, the information required to generate the correct password. On vCMP systems, all Guests share the same deterministic password, allowing those with TMSH access on one Guest to access keys of a different Guest. The following BIG-IP hardware platforms are affected: 10350v-F, i5820-DF, i7820-DF, i15820-DF, 5250v-F, 7200v-F, 10200v-F, 6900-F, 8900-F, 11000-F, and 11050-F. The BIG-IP rSeries r5920-DF and r10920-DF are not affected, nor does the issue affect software FIPS implementations or network HSM configurations. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Product
BIG-IP
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record my.f5.com my.f5.com
Jul 31, 2023grid-kit-premium: Does not escape some parametersCVE-2023-3292 · WordPress plugins & themes · reported by WPScanMedium 6.1
The grid-kit-premium WordPress plugin before 2.2.0 does not escape some parameters as well as generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
grid-kit-premium
Fixed in
2.2.0
What to do
Update grid-kit-premium to 2.2.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 21, 2023Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityCVE-2023-38187 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Product
Microsoft Edge (Chromium-based)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com msrc.microsoft.com
Jul 21, 2023Microsoft Edge (Chromium-based) Spoofing VulnerabilityCVE-2023-35392 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.7
Microsoft Edge (Chromium-based) Spoofing Vulnerability
Product
Microsoft Edge (Chromium-based)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com msrc.microsoft.com
Jul 20, 2023Office Suite Premium Version v10.9.1.42602 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the filter parameter at /api?path=CVE-2023-38617 · Other software · Mobisystems · reported by MITREMedium 6.1
Office Suite Premium Version v10.9.1.42602 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the filter parameter at /api?path=files.
Product
Office Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Jul 20, 2023Office Suite Premium v10.9.1.42602 was discovered to contain a local file inclusion (LFI) vulnerability via the component /etc/hosts.CVE-2023-37601 · Other software · Mobisystems · reported by MITREHigh 7.5
Office Suite Premium v10.9.1.42602 was discovered to contain a local file inclusion (LFI) vulnerability via the component /etc/hosts.
Product
Office Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Jul 20, 2023Office Suite Premium Version v10.9.1.42602 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the id parameter at /api?path=profCVE-2023-37600 · Other software · Mobisystems · reported by MITREMedium 6.1
Office Suite Premium Version v10.9.1.42602 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the id parameter at /api?path=profile.
Product
Office Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Jul 18, 2023 IBM Security Guardium 11.3 could allow a local user to escalate their privileges due to improper permission controls.CVE-2022-43910 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.4
IBM Security Guardium 11.3 could allow a local user to escalate their privileges due to improper permission controls. IBM X-Force ID: 240908.
Product
Security Guardium
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.