Updated 11 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

512new WordPress flaws this week

391,181entries in the database

2,408 results · page 25 of 49

May 16, 2022A remote authentication bypass vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and belowCVE-2022-23657 · Other software · Arubanetworks · reported by security-alert@hpe.comCritical 10
A remote authentication bypass vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x and below. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability.
Product
Clearpass Policy Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record arubanetworks.com arubanetworks.com
May 12, 2022Improper input validation in the Intel(R) In-Band Manageability software before version 2.13.0 may allow a privileged user to potentially enable escalation of pCVE-2021-33108 · Other software · Intel · reported by secure@intel.comMedium 6.7
Improper input validation in the Intel(R) In-Band Manageability software before version 2.13.0 may allow a privileged user to potentially enable escalation of privilege via local access.
Product
In-band Manageability
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record intel.com intel.com
May 12, 2022Improper access control in the Intel(R) In-Band Manageability software before version 2.13.0 may allow a privileged user to potentially enable escalation of priCVE-2021-0194 · Other software · Intel · reported by secure@intel.comHigh 7.2
Improper access control in the Intel(R) In-Band Manageability software before version 2.13.0 may allow a privileged user to potentially enable escalation of privilege via network access.
Product
In-band Manageability
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record intel.com intel.com
May 12, 2022Improper authentication in the Intel(R) In-Band Manageability software before version 2.13.0 may allow a privileged user to potentially enable escalation of priCVE-2021-0193 · Other software · IBM · reported by secure@intel.comHigh 7.2
Improper authentication in the Intel(R) In-Band Manageability software before version 2.13.0 may allow a privileged user to potentially enable escalation of privilege via network access.
Product
In-band Manageability
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record intel.com intel.com
May 10, 2022A remote execution of arbitrary code vulnerability was discovered in ArubaOS-Switch Devices version(s): ArubaOS-Switch 15.xx.xxxx: All versions; ArubaOS-Switch CVE-2022-23677 · Other software · Arubanetworks · reported by security-alert@hpe.comHigh 8.1
A remote execution of arbitrary code vulnerability was discovered in ArubaOS-Switch Devices version(s): ArubaOS-Switch 15.xx.xxxx: All versions; ArubaOS-Switch 16.01.xxxx: All versions; ArubaOS-Switch 16.02.xxxx: K.16.02.0033 and below; ArubaOS-Switch 16.03.xxxx: All versions; ArubaOS-Switch 16.04.xxxx: All versions; ArubaOS-Switch 16.05.xxxx: All versions; ArubaOS-Switch 16.06.xxxx: All versions; ArubaOS-Switch 16.07.xxxx: All versions; ArubaOS-Switch 16.08.xxxx: KB/WB/WC/YA/YB/YC.16.08.0024 and below; ArubaOS-Switch 16.09.xxxx: KB/WB/WC/YA/YB/YC.16.09.0019 and below; ArubaOS-Switch 16.10.xxxx: KB/WB/WC/YA/YB/YC.16.10.0019 and below; ArubaOS-Switch 16.11.xxxx: KB/WB/WC/YA/YB/YC.16.11.0003 and below. Aruba has released upgrades for ArubaOS-Switch Devices that address these security vulnerabilities.
Product
5406r Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record arubanetworks.com arubanetworks.com
May 10, 2022A remote execution of arbitrary code vulnerability was discovered in ArubaOS-Switch Devices version(s): ArubaOS-Switch 15.xx.xxxx: All versions; ArubaOS-Switch CVE-2022-23676 · Other software · Arubanetworks · reported by security-alert@hpe.comCritical 9.8
A remote execution of arbitrary code vulnerability was discovered in ArubaOS-Switch Devices version(s): ArubaOS-Switch 15.xx.xxxx: All versions; ArubaOS-Switch 16.01.xxxx: All versions; ArubaOS-Switch 16.02.xxxx: K.16.02.0033 and below; ArubaOS-Switch 16.03.xxxx: All versions; ArubaOS-Switch 16.04.xxxx: All versions; ArubaOS-Switch 16.05.xxxx: All versions; ArubaOS-Switch 16.06.xxxx: All versions; ArubaOS-Switch 16.07.xxxx: All versions; ArubaOS-Switch 16.08.xxxx: KB/WB/WC/YA/YB/YC.16.08.0024 and below; ArubaOS-Switch 16.09.xxxx: KB/WB/WC/YA/YB/YC.16.09.0019 and below; ArubaOS-Switch 16.10.xxxx: KB/WB/WC/YA/YB/YC.16.10.0019 and below; ArubaOS-Switch 16.11.xxxx: KB/WB/WC/YA/YB/YC.16.11.0003 and below. Aruba has released upgrades for ArubaOS-Switch Devices that address these security vulnerabilities.
Product
5406r Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record arubanetworks.com arubanetworks.com
May 2, 2022Ad Invalid Click Protector (AICP): Does not have CSRF check deleting banned usersCVE-2022-0191 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Ad Invalid Click Protector (AICP) WordPress plugin before 1.2.7 does not have CSRF check deleting banned users, which could allow attackers to make a logged in admin remove arbitrary bans
Product
Ad Invalid Click Protector (AICP)
Fixed in
1.2.7
What to do
Update Ad Invalid Click Protector (AICP) to 1.2.7 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Apr 29, 2022IBM UrbanCode Deploy (UCD) 7.1.1.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.CVE-2021-39082 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.5
IBM UrbanCode Deploy (UCD) 7.1.1.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
Product
UrbanCode Deploy
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com
Apr 27, 2022IBM UrbanCode Deploy (UCD) 7.2.2.1 could allow an authenticated user with special permissions to obtain elevated privileges due to improper handling of permissiCVE-2022-22315 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.8
IBM UrbanCode Deploy (UCD) 7.2.2.1 could allow an authenticated user with special permissions to obtain elevated privileges due to improper handling of permissions. IBM X-Force ID: 217955.
Product
UrbanCode Deploy
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com
Apr 21, 2022A vulnerability in Kibana could expose sensitive information related to Elastic Stack monitoring in the Kibana page source.CVE-2022-23711 · Other software · Elastic · reported by security@elastic.coMedium 5.3
A vulnerability in Kibana could expose sensitive information related to Elastic Stack monitoring in the Kibana page source. Elastic Stack monitoring features provide a way to keep a pulse on the health and performance of your Elasticsearch cluster. Authentication with a vulnerable Kibana instance is not required to view the exposed information. The Elastic Stack monitoring exposure only impacts users that have set any of the optional monitoring.ui.elasticsearch.* settings in order to configure Kibana as a remote UI for Elastic Stack Monitoring. The same vulnerability in Kibana could expose other non-sensitive application-internal information in the page source.
Product
kibana
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record discuss.elastic.co discuss.elastic.co
Apr 19, 2022Vulnerability in the Oracle Banking Payments product of Oracle Financial Services Applications (component: Infrastructure).CVE-2022-21475 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 5.9
Vulnerability in the Oracle Banking Payments product of Oracle Financial Services Applications (component: Infrastructure). The supported version that is affected is 14.5. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Banking Payments. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Banking Payments accessible data as well as unauthorized read access to a subset of Oracle Banking Payments accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Banking Payments. CVSS 3.1 Base Score 5.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:L).
Product
Banking Payments
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com oracle.com
Apr 19, 2022Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications (component: Infrastructure).CVE-2022-21474 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 5.9
Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications (component: Infrastructure). The supported version that is affected is 14.5. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Banking Trade Finance. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Banking Trade Finance accessible data as well as unauthorized read access to a subset of Oracle Banking Trade Finance accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Banking Trade Finance. CVSS 3.1 Base Score 5.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:L).
Product
Banking Trade Finance
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com oracle.com
Apr 19, 2022Vulnerability in the Oracle Banking Treasury Management product of Oracle Financial Services Applications (component: Infrastructure).CVE-2022-21473 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 5.9
Vulnerability in the Oracle Banking Treasury Management product of Oracle Financial Services Applications (component: Infrastructure). The supported version that is affected is 14.5. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Banking Treasury Management. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Banking Treasury Management accessible data as well as unauthorized read access to a subset of Oracle Banking Treasury Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Banking Treasury Management. CVSS 3.1 Base Score 5.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:L).
Product
Banking Treasury Management
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com oracle.com
Apr 19, 2022Vulnerability in the Oracle FLEXCUBE Universal Banking product of Oracle Financial Services Applications (component: Infrastructure).CVE-2022-21472 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 5.9
Vulnerability in the Oracle FLEXCUBE Universal Banking product of Oracle Financial Services Applications (component: Infrastructure). Supported versions that are affected are 12.4, 14.0-14.3 and 14.5. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Universal Banking. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle FLEXCUBE Universal Banking accessible data as well as unauthorized read access to a subset of Oracle FLEXCUBE Universal Banking accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle FLEXCUBE Universal Banking. CVSS 3.1 Base Score 5.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:L).
Product
FLEXCUBE Universal Banking
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com oracle.com
Apr 13, 2022drivers/infiniband/ulp/rtrs/rtrs-clt.c in the Linux kernel before 5.16.12 has a double free related to rtrs_clt_dev_release.CVE-2022-29156 · Computers, phones & browsers · Linux · reported by MITREHigh 7.8
drivers/infiniband/ulp/rtrs/rtrs-clt.c in the Linux kernel before 5.16.12 has a double free related to rtrs_clt_dev_release.
Product
Linux Kernel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cdn.kernel.org github.com
Apr 8, 2022Online Banking System in PHP v1 was discovered to contain multiple SQL injection vulnerabilities at /staff_login.php via the Staff ID and Staff Password parametCVE-2022-27991 · Other software · Online Banking System Project · reported by MITREMedium 6.5
Online Banking System in PHP v1 was discovered to contain multiple SQL injection vulnerabilities at /staff_login.php via the Staff ID and Staff Password parameters.
Product
Online Banking System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 5, 2022Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter.CVE-2022-28116 · Other software · Online Banking System Project · reported by MITRECritical 9.8
Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter.
Product
Online Banking System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 1, 2022A remote code execution vulnerability due to incomplete check for 'xheader_decode_path_record' function's parameter length value in the ark library.CVE-2021-26623 · Other software · Bandisoft International Inc. · reported by vuln@krcert.or.krHigh 7.8
A remote code execution vulnerability due to incomplete check for 'xheader_decode_path_record' function's parameter length value in the ark library. Remote attackers can induce exploit malicious code using this function.
Product
Bandizip
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record krcert.or.kr krcert.or.kr
Apr 1, 2022IBM UrbanCode Deploy (UCD) 7.0.5, 7.1.0, 7.1.1, and 7.1.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensCVE-2022-22327 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.5
IBM UrbanCode Deploy (UCD) 7.0.5, 7.1.0, 7.1.1, and 7.1.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 218859.
Product
UrbanCode Deploy
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com
Mar 30, 2022Online Banking System Protect v1.0 was discovered to contain a local file inclusion (LFI) vulnerability via the pages parameter.CVE-2022-26646 · Other software · Oretnom23 · reported by MITRECritical 9.8
Online Banking System Protect v1.0 was discovered to contain a local file inclusion (LFI) vulnerability via the pages parameter.
Product
Banking System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 30, 2022A remote code execution (RCE) vulnerability in Online Banking System Protect v1.0 allows attackers to execute arbitrary code via a crafted PHP file uploaded thrCVE-2022-26645 · Other software · Oretnom23 · reported by MITRECritical 9.8
A remote code execution (RCE) vulnerability in Online Banking System Protect v1.0 allows attackers to execute arbitrary code via a crafted PHP file uploaded through the Upload Image function.
Product
Banking System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 30, 2022Online Banking System Protect v1.0 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities via parameters on user profile, system_info andCVE-2022-26644 · Other software · Oretnom23 · reported by MITREMedium 6.1
Online Banking System Protect v1.0 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities via parameters on user profile, system_info and accounts management.
Product
Banking System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 28, 2022Bank Mellat: Does not sanitize and escape the orderId parameter before outputting it back in an admin pageCVE-2022-0643 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Bank Mellat WordPress plugin through 1.3.7 does not sanitize and escape the orderId parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
Product
Bank Mellat
Affected
up to 1.3.7
What to do
Affects up to 1.3.7. Update Bank Mellat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 28, 2022TuziCMS 2.0.6 is affected by SQL injection in \App\Manage\Controller\BannerController.class.php.CVE-2022-23882 · Other software · Tuzicms · reported by MITRECritical 9.8
TuziCMS 2.0.6 is affected by SQL injection in \App\Manage\Controller\BannerController.class.php.
Product
Tuzicms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 25, 2022ALF-BanCO v8.2.5 and below was discovered to use a hardcoded password to encrypt the SQLite database containing the user's data.CVE-2022-25577 · Other software · Alf-banco · reported by MITRECritical 9.1
ALF-BanCO v8.2.5 and below was discovered to use a hardcoded password to encrypt the SQLite database containing the user's data. Attackers who are able to gain remote or local access to the system are able to read and modify the data.
Product
Alf-banco
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 19, 2022The matchmaking servers of Bandai Namco FromSoftware Dark Souls III through 2022-03-19 allow remote attackers to send arbitrary push requests to clients via a RCVE-2022-24125 · Other software · Fromsoftware · reported by MITREHigh 8.8
The matchmaking servers of Bandai Namco FromSoftware Dark Souls III through 2022-03-19 allow remote attackers to send arbitrary push requests to clients via a RequestSendMessageToPlayers request. For example, ability to send a push message to hundreds of thousands of machines is only restricted on the client side, and can thus be bypassed with a modified client.
Product
Dark Souls III
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fromsoftware.jp github.com
Mar 19, 2022A buffer overflow in the NRSessionSearchResult parser in Bandai Namco FromSoftware Dark Souls III through 2022-03-19 allows remote attackers to execute arbitrarCVE-2022-24126 · Other software · Fromsoftware · reported by MITRECritical 9.8
A buffer overflow in the NRSessionSearchResult parser in Bandai Namco FromSoftware Dark Souls III through 2022-03-19 allows remote attackers to execute arbitrary code via matchmaking servers, a different vulnerability than CVE-2021-34170.
Product
Dark Souls III
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fromsoftware.jp github.com
Mar 18, 2022Tenda AC9 v15.03.2.21 was discovered to contain multiple stack overflows via the NPTR, V12, V10 and V11 parameter in the Formsetqosband function.CVE-2022-25431 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda AC9 v15.03.2.21 was discovered to contain multiple stack overflows via the NPTR, V12, V10 and V11 parameter in the Formsetqosband function.
Product
Ac9 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 18, 2022Open Web Analytics (OWA) before 1.7.4 allows an unauthenticated remote attacker to obtain sensitive user information, which can be used to gain admin privilegesCVE-2022-24637 · Other software · Openwebanalytics · reported by MITRECritical 9.8
Open Web Analytics (OWA) before 1.7.4 allows an unauthenticated remote attacker to obtain sensitive user information, which can be used to gain admin privileges by leveraging cache hashes. This occurs because files generated with '<?php (instead of the intended "<?php sequence) aren't handled by the PHP interpreter.
Product
Open Web Analytics
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Mar 15, 2022Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via staff_login.php.CVE-2022-25494 · Other software · Online Banking System Project · reported by MITRECritical 9.8
Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via staff_login.php.
Product
Online Banking System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 10, 2022Abantecart through 1.3.2 allows remote authenticated administrators to execute arbitrary code by uploading an executable file, because the Catalog>Media ManagerCVE-2022-26521 · Other software · Abantecart · reported by MITREHigh 7.2
Abantecart through 1.3.2 allows remote authenticated administrators to execute arbitrary code by uploading an executable file, because the Catalog>Media Manager>Images settings can be changed by an administrator (e.g., by configuring .php to be a valid image file type).
Product
Abantecart
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com github.com
Mar 10, 2022Improper use of SMS buffer pointer in Shannon baseband prior to SMR Mar-2022 Release 1 allows OOB read.CVE-2022-25821 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comLow 3.3
Improper use of SMS buffer pointer in Shannon baseband prior to SMR Mar-2022 Release 1 allows OOB read.
Product
Samsung Mobile Devices
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com security.samsungmobile.com
Mar 10, 2022The login.jsp page of Quicklert for Digium 10.0.0 (1043) is affected by both Blind SQL Injection with Out-of-Band Interaction (DNS) and Blind Time-Based SQL InjCVE-2021-43969 · Other software · Quicklert · reported by MITREMedium 6.5
The login.jsp page of Quicklert for Digium 10.0.0 (1043) is affected by both Blind SQL Injection with Out-of-Band Interaction (DNS) and Blind Time-Based SQL Injections. Exploitation can be used to disclose all data within the database (up to and including the administrative accounts' login IDs and passwords) via the login.jsp uname parameter.
Product
Quicklert
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record quicklert.com assurainc.com
Mar 7, 2022WordPress Real Cookie Banner: GDPR (DSGVO) & ePrivacy Cookie Consent: Does not have CSRF checks in placeCVE-2022-0445 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WordPress Real Cookie Banner: GDPR (DSGVO) & ePrivacy Cookie Consent WordPress plugin before 2.14.2 does not have CSRF checks in place when resetting its settings, allowing attackers to make a logged in admin reset them via a CSRF attack
Product
WordPress Real Cookie Banner: GDPR (DSGVO) & ePrivacy Cookie Consent
Fixed in
2.14.2
What to do
Update WordPress Real Cookie Banner: GDPR (DSGVO) & ePrivacy Cookie Consent to 2.14.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 3, 2022A cross-site-scripting (XSS) vulnerability was discovered in the Data Preview Pane (previously known as Index Pattern Preview Pane) which could allow arbitrary CVE-2022-23710 · Other software · Elastic · reported by security@elastic.coMedium 6.1
A cross-site-scripting (XSS) vulnerability was discovered in the Data Preview Pane (previously known as Index Pattern Preview Pane) which could allow arbitrary JavaScript to be executed in a victim’s browser.
Product
kibana
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record discuss.elastic.co security.netapp.com
Mar 3, 2022A flaw was discovered in Kibana in which users with Read access to the Uptime feature could modify alerting rules.CVE-2022-23709 · Other software · Elastic · reported by security@elastic.coMedium 4.3
A flaw was discovered in Kibana in which users with Read access to the Uptime feature could modify alerting rules. A user with this privilege would be able to create new alerting rules or overwrite existing ones. However, any new or modified rules would not be enabled, and a user with this privilege could not modify alerting connectors. This effectively means that Read users could disable existing alerting rules.
Product
kibana
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record discuss.elastic.co discuss.elastic.co
Mar 2, 2022Bank Management System v1.o was discovered to contain a SQL injection vulnerability via the email parameter.CVE-2022-26171 · Other software · Bank Management System Project · reported by MITRECritical 9.8
Bank Management System v1.o was discovered to contain a SQL injection vulnerability via the email parameter.
Product
Bank Management System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 24, 2022A Directory Traversal vulnerability exists in WeBankPartners wecube-platform 3.2.1 via the file variable in PluginPackageController.java.CVE-2021-45746 · Other software · Webank · reported by MITREHigh 7.5
A Directory Traversal vulnerability exists in WeBankPartners wecube-platform 3.2.1 via the file variable in PluginPackageController.java.
Product
Wecube
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 18, 2022A Command injection vulnerability exists in Tenda AC10U AC1200 Smart Dual-band Wireless Router AC10U V1.0 Firmware V15.03.06.49_multi via the setUsbUnload functCVE-2021-45401 · Network & remote access · Tendacn · reported by MITRECritical 9.8
A Command injection vulnerability exists in Tenda AC10U AC1200 Smart Dual-band Wireless Router AC10U V1.0 Firmware V15.03.06.49_multi via the setUsbUnload functionality. The vulnerability is caused because the client controlled "deviceName" value is passed directly to the "doSystemCmd" function.
Product
Ac10u Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 11, 2022An XSS vulnerability was found in Kibana index patterns.CVE-2022-23707 · Other software · Elastic · reported by security@elastic.coMedium 5.4
An XSS vulnerability was found in Kibana index patterns. Using this vulnerability, an authenticated user with permissions to create index patterns can inject malicious javascript into the index pattern which could execute against other users
Product
Kibana
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record discuss.elastic.co discuss.elastic.co
Feb 11, 2022Improper input validation in Exynos baseband prior to SMR Feb-2022 Release 1 allows attackers to send arbitrary NAS signaling messages with fake base station.CVE-2022-23425 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comHigh 8.6
Improper input validation in Exynos baseband prior to SMR Feb-2022 Release 1 allows attackers to send arbitrary NAS signaling messages with fake base station.
Product
Samsung Mobile Devices
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com security.samsungmobile.com
Feb 9, 2022S/4HANA Supplier Factsheet exposes the private address and bank details of an Employee Business Partner with Supplier Role, AND Enterprise Search for Customer, CVE-2022-22542 · Network & remote access · SAP SE · reported by cna@sap.comMedium 6.5
S/4HANA Supplier Factsheet exposes the private address and bank details of an Employee Business Partner with Supplier Role, AND Enterprise Search for Customer, Supplier and Business Partner objects exposes the private address fields of Employee Business Partners, to an actor that is not explicitly authorized to have access to that information, which could compromise Confidentiality.
Product
SAP S/4HANA (Supplier Factsheet and Enterprise Search for Business Partner, Supplier and Customer)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com sap.com
Feb 7, 2022The IP2Location Country Blocker WordPress plugin before 2.26.5 bans can be bypassed by using a specific parameter in the URLCVE-2021-25096 · WordPress plugins & themes · reported by WPScanMedium 6.5
The IP2Location Country Blocker WordPress plugin before 2.26.5 bans can be bypassed by using a specific parameter in the URL
Product
IP2Location Country Blocker
Fixed in
2.26.5
What to do
Update IP2Location Country Blocker to 2.26.5 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 3, 2022Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function formSetQosBand.CVE-2022-24146 · Network & remote access · Tenda · reported by MITREHigh 7.5
Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function formSetQosBand. This vulnerability allows attackers to cause a Denial of Service (DoS) via the list parameter.
Product
Ax3 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 21, 2022Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via index.php.CVE-2022-23363 · Other software · Online Banking System Project · reported by MITRECritical 9.8
Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via index.php.
Product
Online Banking System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 18, 2022Random Banner: Stored Cross-Site ScriptingCVE-2022-0210 · WordPress plugins & themes · reported by WordfenceMedium 4.8
The Random Banner WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the category parameter found in the ~/include/models/model.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 4.1.4. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
Product
Random Banner
Affected
up to 4.1.4
What to do
Affects up to 4.1.4. Update Random Banner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Jan 18, 2022SoftVibe SARABAN for INFOMA 1.1 allows Unauthenticated unrestricted File Upload, that allows attackers to upload files with any file extension which can lead toCVE-2021-38697 · Other software · Softvibe · reported by MITRECritical 9.8
SoftVibe SARABAN for INFOMA 1.1 allows Unauthenticated unrestricted File Upload, that allows attackers to upload files with any file extension which can lead to arbitrary code execution.
Product
Saraban
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record infoma.net orangeo.tech
Jan 18, 2022SoftVibe SARABAN for INFOMA 1.1 has Incorrect Access Control vulnerability, that allows attackers to access signature files on the application without any autheCVE-2021-38696 · Other software · Softvibe · reported by MITREHigh 7.5
SoftVibe SARABAN for INFOMA 1.1 has Incorrect Access Control vulnerability, that allows attackers to access signature files on the application without any authentication.
Product
Saraban
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record infoma.net orangeo.tech
Jan 18, 2022SoftVibe SARABAN for INFOMA 1.1 is vulnerable to stored cross-site scripting (XSS) that allows users to store scripts in certain fields (e.g.CVE-2021-38695 · Other software · Softvibe · reported by MITREMedium 5.4
SoftVibe SARABAN for INFOMA 1.1 is vulnerable to stored cross-site scripting (XSS) that allows users to store scripts in certain fields (e.g. subject, description) of the document form.
Product
Saraban
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record infoma.net orangeo.tech
Jan 18, 2022SoftVibe SARABAN for INFOMA 1.1 allows SQL Injection.CVE-2021-38694 · Other software · Softvibe · reported by MITREHigh 7.5
SoftVibe SARABAN for INFOMA 1.1 allows SQL Injection.
Product
Saraban
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record infoma.net orangeo.tech

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.