Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,121 results · page 24 of 43
Sep 20, 2022A file upload vulnerability exists in the storage feature of pagekit 1.0.18, which allows an attacker to upload malicious filesCVE-2022-38916 · Other software · Pagekit · reported by MITRECritical 9.8
A file upload vulnerability exists in the storage feature of pagekit 1.0.18, which allows an attacker to upload malicious files
- Product
- Pagekit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2022Double free vulnerability in the storage module.CVE-2022-39002 · Other software · Huawei · reported by psirt@huawei.comCritical 9.8
Double free vulnerability in the storage module. Successful exploitation of this vulnerability will cause the memory to be freed twice.
- Product
- Emui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Sep 14, 2022ThinkPHP v6.0.13 was discovered to contain a deserialization vulnerability via the component League\Flysystem\Cached\Storage\Psr6Cache.CVE-2022-38352 · Other software · Thinkphp · reported by MITRECritical 9.8
ThinkPHP v6.0.13 was discovered to contain a deserialization vulnerability via the component League\Flysystem\Cached\Storage\Psr6Cache. This vulnerability allows attackers to execute arbitrary code via a crafted payload.
- Product
- Thinkphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2022The Blink1Control2 application <= 2.2.7 uses weak password encryption and an insecure method of storage.CVE-2022-35513 · Other software · Blink1 · reported by MITREHigh 7.5
The Blink1Control2 application <= 2.2.7 uses weak password encryption and an insecure method of storage.
- Product
- Blink1control2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Sep 7, 2022A Cleartext Storage of Sensitive Information vulnerability in SUSE Rancher allows authenticated Cluster Owners, Cluster Members, Project Owners, Project MembersCVE-2021-36782 · Other software · SUSE · reported by meissner@suse.deCritical 9.9
A Cleartext Storage of Sensitive Information vulnerability in SUSE Rancher allows authenticated Cluster Owners, Cluster Members, Project Owners, Project Members and User Base to use the Kubernetes API to retrieve plaintext version of sensitive data. This issue affects: SUSE Rancher Rancher versions prior to 2.5.16; Rancher versions prior to 2.6.7.
- Product
- Rancher
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.suse.comgithub.com
Sep 6, 2022OS Command Injection vulnerability in Hitachi RAID Manager Storage Replication Adapter allows remote authenticated users to execute arbitrary OS commands.CVE-2022-34883 · Other software · Hitachi · reported by hirt@hitachi.co.jpHigh 7.2
OS Command Injection vulnerability in Hitachi RAID Manager Storage Replication Adapter allows remote authenticated users to execute arbitrary OS commands. This issue affects: Hitachi RAID Manager Storage Replication Adapter 02.01.04 versions prior to 02.03.02 on Windows; 02.05.00 versions prior to 02.05.01 on Windows and Docker.
- Product
- RAID Manager Storage Replication Adapter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhitachi.comhitachi.com
Sep 6, 2022Information Exposure Through an Error Message vulnerability in Hitachi RAID Manager Storage Replication Adapter allows remote authenticated users to gain sensitCVE-2022-34882 · Other software · Hitachi · reported by hirt@hitachi.co.jpCritical 9
Information Exposure Through an Error Message vulnerability in Hitachi RAID Manager Storage Replication Adapter allows remote authenticated users to gain sensitive information. This issue affects: Hitachi RAID Manager Storage Replication Adapter 02.01.04 versions prior to 02.03.02 on Windows; 02.05.00 versions prior to 02.05.01 on Windows and Docker.
- Product
- RAID Manager Storage Replication Adapter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhitachi.comhitachi.com
Aug 30, 2022Dell Container Storage Modules 1.2 contains a path traversal vulnerability in goiscsi and gobrick libraries.CVE-2022-34375 · Other software · Dell · reported by security_alert@emc.comHigh 8.8
Dell Container Storage Modules 1.2 contains a path traversal vulnerability in goiscsi and gobrick libraries. A remote authenticated malicious user with low privileges could exploit this vulnerability leading to unintentional access to path outside of restricted directory.
- Product
- Dell Container Storage Modules
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2022Dell Container Storage Modules 1.2 contains an OS command injection in goiscsi and gobrick libraries.CVE-2022-34374 · Other software · Dell · reported by security_alert@emc.comHigh 8.8
Dell Container Storage Modules 1.2 contains an OS command injection in goiscsi and gobrick libraries. A remote authenticated malicious user with low privileges could exploit this vulnerability leading to to execute arbitrary OS commands on the affected system.
- Product
- Dell Container Storage Modules
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2022SmartFabric storage software version 1.0.0 contains a Command-Injection vulnerability.CVE-2022-31232 · Other software · Dell · reported by security_alert@emc.comHigh 8.6
SmartFabric storage software version 1.0.0 contains a Command-Injection vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability to gain access and perform actions on the affected system.
- Product
- Smart Fabric Storage Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2022A key length flaw was found in Red Hat Ceph Storage.CVE-2021-3979 · Other software · Redhat · reported by Red HatMedium 6.5
A key length flaw was found in Red Hat Ceph Storage. An attacker can exploit the fact that the key length is incorrectly passed in an encryption algorithm to create a non random key, which is weaker and can be exploited for loss of confidentiality and integrity on encrypted disks.
- Product
- Ceph Storage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Aug 25, 2022Odyssey passes to client unencrypted bytes from man-in-the-middle When Odyssey storage is configured to use the PostgreSQL server using 'trust' authentication wCVE-2021-43767 · Other software · Postgresql · reported by patrick@puiterwijk.orgMedium 5.9
Odyssey passes to client unencrypted bytes from man-in-the-middle When Odyssey storage is configured to use the PostgreSQL server using 'trust' authentication with a 'clientcert' requirement or to use 'cert' authentication, a man-in-the-middle attacker can inject false responses to the client's first few queries. Despite the use of SSL certificate verification and encryption, Odyssey will pass these results to client as if they originated from valid server. This is similar to CVE-2021-23222 for PostgreSQL.
- Product
- Postgresql
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.compostgresql.org
Aug 19, 2022Insecure Storage of Sensitive Information in GitHub repository chatwoot/chatwoot prior to 2.6.0.CVE-2022-1021 · Other software · chatwoot · reported by security@huntr.devMedium 5.4
Insecure Storage of Sensitive Information in GitHub repository chatwoot/chatwoot prior to 2.6.0.
- Product
- chatwoot/chatwoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 16, 2022When using Ingest Actions to configure a destination that resides on Amazon Simple Storage Service (S3) in Splunk Web, TLS certificate validation is not correctCVE-2022-37437 · Other software · Splunk · reported by prodsec@splunk.comHigh 7.4
When using Ingest Actions to configure a destination that resides on Amazon Simple Storage Service (S3) in Splunk Web, TLS certificate validation is not correctly performed and tested for the destination. The vulnerability only affects connections between Splunk Enterprise and an Ingest Actions Destination through Splunk Web and only applies to environments that have configured TLS certificate validation. It does not apply to Destinations configured directly in the outputs.conf configuration file. The vulnerability affects Splunk Enterprise version 9.0.0 and does not affect versions below 9.0.0, including the 8.1.x and 8.2.x versions.
- Product
- Splunk Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 16, 2022Emerson OpenBSI through 2022-04-29 mishandles credential storage.CVE-2022-29959 · Other software · Emerson · reported by MITREMedium 5.5
Emerson OpenBSI through 2022-04-29 mishandles credential storage. It is an engineering environment for the ControlWave and Bristol Babcock line of RTUs. This environment provides access control functionality through user authentication and privilege management. The credentials for various users are stored insecurely in the SecUsers.ini file by using a simple string transformation rather than a cryptographic mechanism.
- Product
- Openbsi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 15, 2022Apache OpenOffice supports the storage of passwords for web connections in the user's configuration database.CVE-2022-37401 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.8
Apache OpenOffice supports the storage of passwords for web connections in the user's configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in OpenOffice existed where master key was poorly encoded resulting in weakening its entropy from 128 to 43 bits making the stored passwords vulnerable to a brute force attack if an attacker has access to the users stored config. This issue affects: Apache OpenOffice versions prior to 4.1.13. Reference: CVE-2022-26307 - LibreOffice
- Product
- Apache OpenOffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenoffice.org
Aug 15, 2022Apache OpenOffice supports the storage of passwords for web connections in the user's configuration database.CVE-2022-37400 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.8
Apache OpenOffice supports the storage of passwords for web connections in the user's configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in OpenOffice existed where the required initialization vector for encryption was always the same which weakens the security of the encryption making them vulnerable if an attacker has access to the user's configuration data. This issue affects: Apache OpenOffice versions prior to 4.1.13. Reference: CVE-2022-26306 - LibreOffice
- Product
- Apache OpenOffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenoffice.org
Aug 15, 2022Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository cockpit-hq/cockpit prior to 2.2.2.CVE-2022-2818 · Other software · cockpit-hq · reported by security@huntr.devCritical 9.8
Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository cockpit-hq/cockpit prior to 2.2.2.
- Product
- cockpit-hq/cockpit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2022Linux deployments of StorageGRID (formerly StorageGRID Webscale) versions 11.6.0 through 11.6.0.2 deployed with a Linux kernel version less than 4.7.0 are susceCVE-2022-23238 · Other software · Netapp · reported by security-alert@netapp.comMedium 6.5
Linux deployments of StorageGRID (formerly StorageGRID Webscale) versions 11.6.0 through 11.6.0.2 deployed with a Linux kernel version less than 4.7.0 are susceptible to a vulnerability which could allow a remote unauthenticated attacker to view limited metrics information and modify alert email recipients and content.
- Product
- Storagegrid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.comsecurity.netapp.com
Aug 10, 2022VMware Workstation (16.x prior to 16.2.4) contains an unprotected storage of credentials vulnerability.CVE-2022-22983 · Other software · VMware · reported by security@vmware.comMedium 5.9
VMware Workstation (16.x prior to 16.2.4) contains an unprotected storage of credentials vulnerability. A malicious actor with local user privileges to the victim machine may exploit this vulnerability leading to the disclosure of user passwords of the remote server connected through VMware Workstation.
- Product
- Workstation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2022Dell Wyse Management Suite 3.6.1 and below contains an Plain-text Password Storage Vulnerability in UI.CVE-2022-33928 · Other software · Dell · reported by security_alert@emc.comMedium 6.4
Dell Wyse Management Suite 3.6.1 and below contains an Plain-text Password Storage Vulnerability in UI. An attacker with low privileges could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed credentials to access the vulnerable application with privileges of the compromised account.
- Product
- Wyse Management Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 9, 2022Storage Spaces Direct Elevation of Privilege VulnerabilityCVE-2022-35792 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Storage Spaces Direct Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Aug 9, 2022Storage Spaces Direct Elevation of Privilege VulnerabilityCVE-2022-35765 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Storage Spaces Direct Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Aug 9, 2022Storage Spaces Direct Elevation of Privilege VulnerabilityCVE-2022-35764 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Storage Spaces Direct Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Aug 9, 2022Storage Spaces Direct Elevation of Privilege VulnerabilityCVE-2022-35763 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Storage Spaces Direct Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Aug 9, 2022Storage Spaces Direct Elevation of Privilege VulnerabilityCVE-2022-35762 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Storage Spaces Direct Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Aug 5, 2022Improper access control vulnerability in WebApp in Cameralyzer prior to versions 3.2.22, 3.3.22, 3.4.22 and 3.5.51 allows attackers to access external storage aCVE-2022-36832 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4
Improper access control vulnerability in WebApp in Cameralyzer prior to versions 3.2.22, 3.3.22, 3.4.22 and 3.5.51 allows attackers to access external storage as Cameralyzer privilege.
- Product
- Cameralyzer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Aug 2, 2022Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology Storage Analyzer before 2.1.0-0390 CVE-2022-27618 · Network & remote access · Synology · reported by security@synology.comMedium 6.8
Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology Storage Analyzer before 2.1.0-0390 allows remote authenticated users to delete arbitrary files via unspecified vectors.
- Product
- Storage Analyzer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsynology.comsynology.com
Aug 2, 2022This affects all versions of package s3-kilatstorage.CVE-2020-28424 · Other software · S3-kilatstorage Project · reported by report@snyk.ioHigh 7.2
This affects all versions of package s3-kilatstorage.
- Product
- S3-kilatstorage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.snyk.iosecurity.snyk.io
Aug 1, 2022MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0.CVE-2022-35919 · Other software · minio · reported by GitHubHigh 7.4
MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. In affected versions all 'admin' users authorized for `admin:ServerUpdate` can selectively trigger an error that in response, returns the content of the path requested. Any normal OS system would allow access to contents at any arbitrary paths that are readable by MinIO process. Users are advised to upgrade. Users unable to upgrade may disable ServerUpdate API by denying the `admin:ServerUpdate` action for your admin users via IAM policies.
- Product
- minio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Aug 1, 2022IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could disclose sensitive information due to improper privilege management for storage provider types.CVE-2022-34338 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could disclose sensitive information due to improper privilege management for storage provider types. IBM X-Force ID: 229962.
- Product
- Robotic Process Automation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jul 26, 2022HashiCorp Vault Enterprise 1.7.0 through 1.9.7, 1.10.4, and 1.11.0 clusters using Integrated Storage expose an unauthenticated API endpoint that could be abusedCVE-2022-36129 · Other software · Hashicorp · reported by MITRECritical 9.1
HashiCorp Vault Enterprise 1.7.0 through 1.9.7, 1.10.4, and 1.11.0 clusters using Integrated Storage expose an unauthenticated API endpoint that could be abused to override the voter status of a node within a Vault HA cluster, introducing potential for future data loss or catastrophic failure. Fixed in Vault Enterprise 1.9.8, 1.10.5, and 1.11.1.
- Product
- Vault
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.hashicorp.comdiscuss.hashicorp.com
Jul 25, 2022LibreOffice supports the storage of passwords for web connections in the user’s configuration database.CVE-2022-26307 · Other software · The Document Foundation · reported by security@documentfoundation.orgHigh 8.8
LibreOffice supports the storage of passwords for web connections in the user’s configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in LibreOffice existed where master key was poorly encoded resulting in weakening its entropy from 128 to 43 bits making the stored passwords vulerable to a brute force attack if an attacker has access to the users stored config. This issue affects: The Document Foundation LibreOffice 7.2 versions prior to 7.2.7; 7.3 versions prior to 7.3.3.
- Product
- LibreOffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comlists.debian.org
Jul 25, 2022LibreOffice supports the storage of passwords for web connections in the user’s configuration database.CVE-2022-26306 · Other software · The Document Foundation · reported by security@documentfoundation.orgHigh 7.5
LibreOffice supports the storage of passwords for web connections in the user’s configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in LibreOffice existed where the required initialization vector for encryption was always the same which weakens the security of the encryption making them vulnerable if an attacker has access to the user's configuration data. This issue affects: The Document Foundation LibreOffice 7.2 versions prior to 7.2.7; 7.3 versions prior to 7.3.1.
- Product
- LibreOffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comlists.debian.org
Jul 25, 2022Use after free in storage in Google Chrome prior to 100.0.4896.88 allowed an attacker who convinced a user to install a malicious extension to potentially perfoCVE-2022-1312 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comCritical 9.6
Use after free in storage in Google Chrome prior to 100.0.4896.88 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted Chrome Extension.
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comcrbug.com
Jul 25, 2022Use after free in storage in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.CVE-2022-1305 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
Use after free in storage in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comcrbug.com
Jul 25, 2022This affects all versions of package google-cloudstorage-commands.CVE-2020-28436 · Computers, phones & browsers · Google-cloudstorage-commands Project · reported by report@snyk.ioHigh 7.3
This affects all versions of package google-cloudstorage-commands.
- Product
- Google-cloudstorage-commands
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecurity.snyk.io
Jul 20, 2022Blogifier v3.0 was discovered to contain an arbitrary file upload vulnerability at /api/storage/upload/PostImage.CVE-2022-35569 · Other software · Blogifier · reported by MITREMedium 4.8
Blogifier v3.0 was discovered to contain an arbitrary file upload vulnerability at /api/storage/upload/PostImage. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted file.
- Product
- Blogifier
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 19, 2022Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Core).CVE-2022-21563 · Other software · Oracle Corporation · reported by secalert_us@oracle.comLow 3.4
Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Core). The supported version that is affected is 8.8. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle ZFS Storage Appliance Kit executes to compromise Oracle ZFS Storage Appliance Kit. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle ZFS Storage Appliance Kit accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle ZFS Storage Appliance Kit. CVSS 3.1 Base Score 3.4 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L).
- Product
- Sun ZFS Storage Appliance Kit (AK) Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 19, 2022Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Core).CVE-2022-21513 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.2
Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Core). The supported version that is affected is 8.8. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle ZFS Storage Appliance Kit executes to compromise Oracle ZFS Storage Appliance Kit. While the vulnerability is in Oracle ZFS Storage Appliance Kit, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle ZFS Storage Appliance Kit. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
- Product
- Sun ZFS Storage Appliance Kit (AK) Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2022In multiple functions of StorageManagerService.java and UserManagerService.java, there is a possible way to leave user's directories unencrypted due to a logic CVE-2022-20219 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In multiple functions of StorageManagerService.java and UserManagerService.java, there is a possible way to leave user's directories unencrypted due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-224585613
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Jul 13, 2022A stored cross-site scripting (XSS) vulnerability in the component audit/class.audit.php of osTicket-plugins - Storage-FS before commit a7842d494889fd5533d13debCVE-2022-32074 · Other software · Enhancesoft · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in the component audit/class.audit.php of osTicket-plugins - Storage-FS before commit a7842d494889fd5533d13deb3c6a7789768795ae allows attackers to execute arbitrary web scripts or HTML via a crafted SVG file.
- Product
- Osticket
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2022Azure Storage Library Information Disclosure VulnerabilityCVE-2022-30187 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.7
Azure Storage Library Information Disclosure Vulnerability
- Product
- Azure Storage Blobs client library for .NET
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jul 12, 2022Improper input validation in Contacts Storage prior to SMR Jul-2022 Release 1 allows attacker to access arbitrary file.CVE-2022-33690 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4
Improper input validation in Contacts Storage prior to SMR Jul-2022 Release 1 allows attacker to access arbitrary file.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Jul 10, 2022The PureStorage-OpenConnect/swagger repository through 1.1.5 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31524 · Other software · Purestorage · reported by MITRECritical 9.3
The PureStorage-OpenConnect/swagger repository through 1.1.5 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Pure Swagger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2022Cloud Mobility for Dell EMC Storage, 1.3.0.XXX contains a RCE vulnerability.CVE-2022-33936 · Other software · Dell · reported by security_alert@emc.comHigh 8
Cloud Mobility for Dell EMC Storage, 1.3.0.XXX contains a RCE vulnerability. A non-privileged user could potentially exploit this vulnerability, leading to achieving a root shell. This is a critical issue; so Dell recommends customers to upgrade at the earliest opportunity.
- Product
- Cloud Mobility for Dell Storage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2022MariaDB v10.4 to v10.7 was discovered to contain an use-after-poison in prepare_inplace_add_virtual at /storage/innobase/handler/handler0alter.cc.CVE-2022-32081 · Other software · Mariadb · reported by MITREHigh 7.5
MariaDB v10.4 to v10.7 was discovered to contain an use-after-poison in prepare_inplace_add_virtual at /storage/innobase/handler/handler0alter.cc.
- Product
- Mariadb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjira.mariadb.orglists.fedoraproject.org
Jun 30, 2022An IBM Spectrum Protect storage agent could allow a remote attacker to perform a brute force attack by allowing unlimited attempts to login to the storage agentCVE-2022-22487 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.8
An IBM Spectrum Protect storage agent could allow a remote attacker to perform a brute force attack by allowing unlimited attempts to login to the storage agent without locking the administrative ID. A remote attacker could exploit this vulnerability using brute force techniques to gain unauthorized administrative access to both the IBM Spectrum Protect storage agent and the IBM Spectrum Protect Server 8.1.0.000 through 8.1.14 with which it communicates. IBM X-Force ID: 226326.
- Product
- Spectrum Protect Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jun 29, 2022ThinkPHP v6.0.12 was discovered to contain a deserialization vulnerability via the component vendor\league\flysystem-cached-adapter\src\Storage\AbstractCache.phCVE-2022-33107 · Other software · Thinkphp · reported by MITRECritical 9.8
ThinkPHP v6.0.12 was discovered to contain a deserialization vulnerability via the component vendor\league\flysystem-cached-adapter\src\Storage\AbstractCache.php. This vulnerability allows attackers to execute arbitrary code via a crafted payload.
- Product
- Thinkphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2022The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability.CVE-2022-28172 · Network & remote access · hikvision · reported by hsrc@hikvision.comMedium 6.5
The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability. Due to the insufficient input validation, attacker can exploit the vulnerability to XSS attack by sending messages with malicious commands to the affected device.
- Product
- DS-A71024/48/72R,DS-A80624S,DS-A81016S,DS-A72024/72R,DS-A80316S,DS-A82024D
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comhikvision.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.