Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,374 results · page 25 of 48
Nov 4, 2022A vulnerability in Cisco Email Security Appliance (ESA) and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attacker to conduct an HTTCVE-2022-20772 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4.7
A vulnerability in Cisco Email Security Appliance (ESA) and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attacker to conduct an HTTP response splitting attack. This vulnerability is due to the failure of the application or its environment to properly sanitize input values. An attacker could exploit this vulnerability by injecting malicious HTTP headers, controlling the response body, or splitting the response into multiple responses.
- Product
- Cisco Secure Email
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.comsec.cloudapps.cisco.com
Oct 25, 2022Kadence WooCommerce Email Designer: Unserialises the content of an imported fileCVE-2022-3335 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Kadence WooCommerce Email Designer WordPress plugin before 1.5.7 unserialises the content of an imported file, which could lead to PHP object injections issues when an admin import (intentionally or not) a malicious file and a suitable gadget chain is present on the blog.
- Product
- Kadence WooCommerce Email Designer
- Fixed in
- 1.5.7
- What to do
- Update Kadence WooCommerce Email Designer to 1.5.7 or newer.
Oct 21, 2022Biplob Adhikari's Accordions – Multiple Accordions or FAQs Builder: Auth. WordPress Options Change (siteurl, users_can_register, default_role, admin_email and new_admin_email)CVE-2022-38104 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Auth. WordPress Options Change (siteurl, users_can_register, default_role, admin_email and new_admin_email) vulnerability in Biplob Adhikari's Accordions – Multiple Accordions or FAQs Builder plugin (versions <= 2.0.3 on WordPress.
- Product
- Biplob Adhikari's Accordions – Multiple Accordions or FAQs Builder
- Affected
- up to 2.0.3
- What to do
- Affects up to 2.0.3. Update Biplob Adhikari's Accordions – Multiple Accordions or FAQs Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Oct 19, 2022OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the email parameter in the Check Email function.CVE-2022-43018 · Other software · Opencats · reported by MITREMedium 6.1
OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the email parameter in the Check Email function.
- Product
- Opencats
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2022Email addresses were leaked in WebHook logs in GitLab EE affecting all versions from 9.3 prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1CVE-2022-3293 · Websites & servers · GitLab · reported by cve@gitlab.comLow 3.5
Email addresses were leaked in WebHook logs in GitLab EE affecting all versions from 9.3 prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2022An external attacker is able to send a specially crafted email (with many recipients) and trigger a potential DoS of the systemCVE-2022-39052 · Other software · OTRS AG · reported by security@otrs.comHigh 7.5
An external attacker is able to send a specially crafted email (with many recipients) and trigger a potential DoS of the system
- Product
- OTRS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2022In Zimbra Collaboration Suite (ZCS) 8.8.15, /h/search?action=voicemail&action=listen accepts a phone parameter that is vulnerable to Reflected XSS.CVE-2022-41350 · Email & office · Zimbra · reported by MITREMedium 6.1
In Zimbra Collaboration Suite (ZCS) 8.8.15, /h/search?action=voicemail&action=listen accepts a phone parameter that is vulnerable to Reflected XSS. This allows executing arbitrary JavaScript on the victim's machine.
- Product
- Collaboration
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwiki.zimbra.comwiki.zimbra.com
Oct 12, 2022OpenCart 3.x Newsletter Custom Popup was discovered to contain a SQL injection vulnerability via the email parameter at index.php?route=extension/module/so_newlCVE-2022-41403 · Other software · Newsletter Subscribe (popup + Regular Module) Project · reported by MITRECritical 9.8
OpenCart 3.x Newsletter Custom Popup was discovered to contain a SQL injection vulnerability via the email parameter at index.php?route=extension/module/so_newletter_custom_popup/newsletter.
- Product
- Newsletter Subscribe (popup + Regular Module)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Oct 11, 2022Interspire Email Marketer through 6.5.0 allows arbitrary file upload via a surveys_submit.php "create survey and submit survey" operation, which can cause a .phCVE-2022-40777 · Other software · Interspire · reported by MITREHigh 8.8
Interspire Email Marketer through 6.5.0 allows arbitrary file upload via a surveys_submit.php "create survey and submit survey" operation, which can cause a .php file to be accessible under a /admin/temp/surveys/ URI. NOTE: this issue exists because of an incomplete fix for CVE-2018-19550.
- Product
- Email Marketer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwitter.cominterspire.com
Oct 11, 2022In queryInternal of CallLogProvider.java, there is a possible access to voicemail information due to SQL injection.CVE-2022-20351 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In queryInternal of CallLogProvider.java, there is a possible access to voicemail information due to SQL injection. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-224771921
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Oct 7, 2022An access-control vulnerability in Gradle Enterprise 2022.4 through 2022.3.1 allows remote attackers to prevent backups from occurring, and send emails with arbCVE-2022-41574 · Other software · Gradle · reported by MITREHigh 7.5
An access-control vulnerability in Gradle Enterprise 2022.4 through 2022.3.1 allows remote attackers to prevent backups from occurring, and send emails with arbitrary text content to the configured installation-administrator contact address, via HTTP access to an accidentally exposed internal endpoint. This is fixed in 2022.3.2.
- Product
- Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.gradle.comsecurity.gradle.com
Sep 26, 2022Post SMTP Mailer/Email Log: Does not have proper authorisation in some AJAX actionsCVE-2022-2352 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Post SMTP Mailer/Email Log WordPress plugin before 2.1.7 does not have proper authorisation in some AJAX actions, which could allow high privilege users such as admin to perform blind SSRF on multisite installations for example.
- Product
- Post SMTP Mailer/Email Log
- Fixed in
- 2.1.7
- What to do
- Update Post SMTP Mailer/Email Log to 2.1.7 or newer.
Sep 16, 2022Post SMTP Mailer/Email Log: Does not escape some of its settings before outputting them in the admins dashboardCVE-2022-2351 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Post SMTP Mailer/Email Log WordPress plugin before 2.1.4 does not escape some of its settings before outputting them in the admins dashboard, allowing high privilege users to perform Cross-Site Scripting attacks against other users even when the unfiltered_html capability is disallowed.
- Product
- Post SMTP Mailer/Email Log
- Fixed in
- 2.1.4
- What to do
- Update Post SMTP Mailer/Email Log to 2.1.4 or newer.
Sep 9, 2022Improper access control and intent redirection in Samsung Email prior to 6.1.70.20 allows attacker to access specific formatted file and execute privileged behaCVE-2022-36864 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4
Improper access control and intent redirection in Samsung Email prior to 6.1.70.20 allows attacker to access specific formatted file and execute privileged behavior.
- Product
- Samsung Email
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Sep 6, 2022In MtkEmail, there is a possible escalation of privilege due to fragment injection.CVE-2022-26469 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comHigh 7.8
In MtkEmail, there is a possible escalation of privilege due to fragment injection. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07216598; Issue ID: ALPS07216598.
- Product
- MT6580, MT6735, MT6737, MT6739, MT6761, MT6765, MT6768, MT6771, MT6779, MT6781, MT6785, MT6833, MT6853, MT6855, MT6873, MT6877, MT6879, MT6883, MT6885, MT6889,
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcorp.mediatek.comcorp.mediatek.com
Sep 5, 2022The Directorist WordPress plugin before 7.3.1 discloses the email address of all users in an AJAX action available to both unauthenticated and any authenticatedCVE-2022-2376 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Directorist WordPress plugin before 7.3.1 discloses the email address of all users in an AJAX action available to both unauthenticated and any authenticated users
- Product
- Directorist
- Fixed in
- 7.3.1
- What to do
- Update Directorist to 7.3.1 or newer.
Sep 2, 2022Discourse through 2.8.7 allows admins to send invitations to arbitrary email addresses at an unlimited rate.CVE-2022-37458 · Other software · Discourse · reported by MITREHigh 7.2
Discourse through 2.8.7 allows admins to send invitations to arbitrary email addresses at an unlimited rate.
- Product
- Discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2022IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to a denial of service via email flooding caused by sending a specially-crafted request.CVE-2022-30614 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.5
IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to a denial of service via email flooding caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume all available CPU resources. IBM X-Force ID: 227591.
- Product
- Cognos Analytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comsecurity.netapp.com
Aug 31, 2022Online Ordering System v2.3.2 was discovered to contain a SQL injection vulnerability via the user_email parameter at /admin/login.php.CVE-2022-36581 · Other software · Online Ordering System Project · reported by MITREHigh 7.5
Online Ordering System v2.3.2 was discovered to contain a SQL injection vulnerability via the user_email parameter at /admin/login.php.
- Product
- Online Ordering System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2022Zulip is an open-source team collaboration tool with topic-based threading that combines email and chat.CVE-2022-36048 · Other software · zulip · reported by GitHubMedium 4.3
Zulip is an open-source team collaboration tool with topic-based threading that combines email and chat. When displaying messages with embedded remote images, Zulip normally loads the image preview via a go-camo proxy server. However, an attacker who can send messages could include a crafted URL that tricks the server into embedding a remote image reference directly. This could allow the attacker to infer the viewer’s IP address and browser fingerprinting information. This vulnerability is fixed in Zulip Server 5.6. Zulip organizations with image and link previews [disabled](https://zulip.com/help/allow-image-link-previews) are not affected.
- Product
- zulip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2022Tenda M3 V1.0.0.12(4856) was discovered to contain a heap buffer overflow vulnerability in the function formEmailTest.CVE-2022-38566 · Network & remote access · Tenda · reported by MITREHigh 7.5
Tenda M3 V1.0.0.12(4856) was discovered to contain a heap buffer overflow vulnerability in the function formEmailTest. This vulnerability allows attackers to cause a Denial of Service (DoS) via the mailname parameter.
- Product
- M3 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2022Tenda M3 V1.0.0.12(4856) was discovered to contain a heap buffer overflow vulnerability in the function formEmailTest.CVE-2022-38565 · Network & remote access · Tenda · reported by MITREHigh 7.5
Tenda M3 V1.0.0.12(4856) was discovered to contain a heap buffer overflow vulnerability in the function formEmailTest. This vulnerability allows attackers to cause a Denial of Service (DoS) via the mailpwd parameter.
- Product
- M3 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2022A flaw was found in keycloak where an attacker is able to register himself with the username same as the email ID of any existing user.CVE-2021-3754 · Other software · Redhat · reported by Red HatMedium 5.3
A flaw was found in keycloak where an attacker is able to register himself with the username same as the email ID of any existing user. This may cause trouble in getting password recovery email in case the user forgets the password.
- Product
- Keycloak
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Aug 25, 2022MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to Cross Site Scripting (XSS) via the currentRequest parameter.CVE-2022-37238 · Other software · Altn · reported by MITREMedium 5.4
MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to Cross Site Scripting (XSS) via the currentRequest parameter.
- Product
- Security Gateway For Email Servers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfiles.mdaemon.comgtn.com.np
Aug 25, 2022MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to Cross Site Scripting (XSS) via the Blacklist endpoint.CVE-2022-37245 · Other software · Altn · reported by MITREMedium 5.4
MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to Cross Site Scripting (XSS) via the Blacklist endpoint.
- Product
- Security Gateway For Email Servers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfiles.mdaemon.comgtn.com.np
Aug 25, 2022MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to IFRAME Injectionvia the currentRequest parameter.CVE-2022-37244 · Other software · Altn · reported by MITREMedium 5.4
MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to IFRAME Injectionvia the currentRequest parameter. after login leads to inject malicious tag leads to IFRAME injection.
- Product
- Security Gateway For Email Servers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfiles.mdaemon.comgtn.com.np
Aug 25, 2022MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to Cross Site Scripting (XSS) via the whitelist endpoint.CVE-2022-37243 · Other software · Altn · reported by MITREMedium 5.4
MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to Cross Site Scripting (XSS) via the whitelist endpoint.
- Product
- Security Gateway For Email Servers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfiles.mdaemon.comgtn.com.np
Aug 25, 2022MDaemon Technologies SecurityGateway for Email Servers 8.5.2, is vulnerable to HTTP Response splitting via the data parameter.CVE-2022-37242 · Other software · Altn · reported by MITRECritical 9.8
MDaemon Technologies SecurityGateway for Email Servers 8.5.2, is vulnerable to HTTP Response splitting via the data parameter.
- Product
- Security Gateway For Email Servers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfiles.mdaemon.comgtn.com.np
Aug 25, 2022MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to Cross Site Scripting (XSS) via the data_leak_list_ajax endpoint.CVE-2022-37241 · Other software · Altn · reported by MITREMedium 5.4
MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to Cross Site Scripting (XSS) via the data_leak_list_ajax endpoint.
- Product
- Security Gateway For Email Servers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfiles.mdaemon.comgtn.com.np
Aug 25, 2022MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to HTTP Response splitting via the format parameter.CVE-2022-37240 · Other software · Altn · reported by MITRECritical 9.8
MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to HTTP Response splitting via the format parameter.
- Product
- Security Gateway For Email Servers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfiles.mdaemon.comgtn.com.np
Aug 25, 2022MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to Cross Site Scripting (XSS) via the rulles_list_ajax endpoint.CVE-2022-37239 · Other software · Altn · reported by MITREMedium 5.4
MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to Cross Site Scripting (XSS) via the rulles_list_ajax endpoint.
- Product
- Security Gateway For Email Servers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfiles.mdaemon.comgtn.com.np
Aug 22, 2022HTML injection combined with path traversal in the Email service in Gravitee API Management before 1.25.3 allows anonymous users to read arbitrary files via a /CVE-2019-25075 · Other software · Gravitee · reported by MITREMedium 6.1
HTML injection combined with path traversal in the Email service in Gravitee API Management before 1.25.3 allows anonymous users to read arbitrary files via a /management/users/register request.
- Product
- API Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2022Abandoned Cart Recovery for WooCommerce, Follow Up Emails, Newsletter Builder & Marketing Automation By Autonami: Does not have authorisation and CSRF checks in one of its AJAX actionCVE-2022-2389 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Abandoned Cart Recovery for WooCommerce, Follow Up Emails, Newsletter Builder & Marketing Automation By Autonami WordPress plugin before 2.1.2 does not have authorisation and CSRF checks in one of its AJAX action, allowing any authenticated users, such as subscriber to create automations
- Product
- Abandoned Cart Recovery for WooCommerce, Follow Up Emails, Newsletter Builder & Marketing Automation By Autonami
- Fixed in
- 2.1.2
- What to do
- Update Abandoned Cart Recovery for WooCommerce, Follow Up Emails, Newsletter Builder & Marketing Automation By Autonami to 2.1.2 or newer.
Aug 5, 2022Intent redirection vulnerability using implicit intent in Samsung email prior to version 6.1.70.20 allows attacker to get sensitive information.CVE-2022-36837 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 6.2
Intent redirection vulnerability using implicit intent in Samsung email prior to version 6.1.70.20 allows attacker to get sensitive information.
- Product
- Samsung email
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Aug 4, 2022Nextcloud Mail is an email application for the nextcloud personal cloud product.CVE-2022-31119 · Other software · nextcloud · reported by GitHubLow 3.1
Nextcloud Mail is an email application for the nextcloud personal cloud product. Affected versions of Nextcloud mail would log user passwords to disk in the event of a misconfiguration. Should an attacker gain access to the logs complete access to affected accounts would be obtainable. It is recommended that the Nextcloud Mail is upgraded to 1.12.1. Operators should inspect their logs and remove passwords which have been logged. There are no workarounds to prevent logging in the event of a misconfiguration.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2022Nextcloud Mail is an email application for the nextcloud personal cloud product.CVE-2022-31132 · Other software · nextcloud · reported by GitHubHigh 8.3
Nextcloud Mail is an email application for the nextcloud personal cloud product. Affected versions shipped with a CSS minifier on the path `./vendor/cerdic/css-tidy/css_optimiser.php`. Access to the minifier is unrestricted and access may lead to Server-Side Request Forgery (SSRF). It is recommendet to upgrade to Mail 1.12.7 or Mail 1.13.6. Users unable to upgrade may manually delete the file located at `./vendor/cerdic/css-tidy/css_optimiser.php`
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 1, 2022Pharmacy Management System v1.0 was discovered to contain multiple SQL injection vulnerabilities via the email or password parameter at login.php.CVE-2022-34949 · Other software · Pharmacy Management System Project · reported by MITRECritical 9.8
Pharmacy Management System v1.0 was discovered to contain multiple SQL injection vulnerabilities via the email or password parameter at login.php.
- Product
- Pharmacy Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2022Improperly Implemented Security Check vulnerability in the SonicWall Hosted Email Security leads to bypass of Capture ATP security service in the appliance.CVE-2022-2324 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comHigh 7.5
Improperly Implemented Security Check vulnerability in the SonicWall Hosted Email Security leads to bypass of Capture ATP security service in the appliance. This vulnerability impacts 10.0.17.7319 and earlier versions
- Product
- SonicWall Email Security
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.global.sonicwall.compsirt.global.sonicwall.com
Jul 28, 2022The Email Viewer in RainLoop through 1.6.0 allows XSS via a crafted email message.CVE-2022-29360 · Other software · Rainloop · reported by MITREMedium 5.4
The Email Viewer in RainLoop through 1.6.0 allows XSS via a crafted email message.
- Product
- Webmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.sonarsource.comlists.debian.org
Jul 28, 2022In JetBrains IntelliJ IDEA before 2022.2 email address validation in the "Git User Name Is Not Defined" dialog was missedCVE-2022-37010 · Other software · JetBrains · reported by cve@jetbrains.comLow 3.6
In JetBrains IntelliJ IDEA before 2022.2 email address validation in the "Git User Name Is Not Defined" dialog was missed
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
Jul 27, 2022OX App Suite through 7.10.6 allows OS Command Injection via Documentconverter (e.g., through an email attachment).CVE-2022-23100 · Other software · Open-xchange · reported by MITRECritical 9.8
OX App Suite through 7.10.6 allows OS Command Injection via Documentconverter (e.g., through an email attachment).
- Product
- OX App Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopen-xchange.comseclists.org
Jul 26, 2022Fruits Bazar v1.0 was discovered to contain a SQL injection vulnerability via the recover_email parameter at user_password_recover.php.CVE-2022-34989 · Other software · Fruits Bazar Project · reported by MITRECritical 9.8
Fruits Bazar v1.0 was discovered to contain a SQL injection vulnerability via the recover_email parameter at user_password_recover.php.
- Product
- Fruits Bazar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 19, 2022BigFix Web Reports authorized users may perform HTML injection for the email administrative configuration page.CVE-2022-27545 · Other software · HCL Software · reported by psirt@hcl.comMedium 4.6
BigFix Web Reports authorized users may perform HTML injection for the email administrative configuration page.
- Product
- HCL BigFix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Jul 5, 2022Newsletter Module v3.x was discovered to contain a SQL injection vulnerability via the zemez_newsletter_email parameter at /index.php.CVE-2022-31856 · Other software · Newsletter Module Project · reported by MITRECritical 9.8
Newsletter Module v3.x was discovered to contain a SQL injection vulnerability via the zemez_newsletter_email parameter at /index.php.
- Product
- Newsletter Module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Jul 5, 2022SQL Injection vulnerability in admin interface (/vicidial/admin.php) of VICIdial via modify_email_accounts, access_recordings, and agentcall_email parameters alCVE-2022-34876 · Other software · VICIdial · reported by cve@rapid7.comMedium 5.5
SQL Injection vulnerability in admin interface (/vicidial/admin.php) of VICIdial via modify_email_accounts, access_recordings, and agentcall_email parameters allows attacker to spoof identity, tamper with existing data, allow the complete disclosure of all data on the system, destroy the data or make it otherwise unavailable, and become administrators of the database server. This issue affects: VICIdial 2.14b0.5 versions prior to 3555.
- Product
- VICIdial
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvicidial.org
Jun 30, 2022Jenkins Validating Email Parameter Plugin 1.10 and earlier does not escape the name and description of its parameter type, resulting in a stored cross-site scriCVE-2022-34791 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Validating Email Parameter Plugin 1.10 and earlier does not escape the name and description of its parameter type, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- Product
- Jenkins Validating Email Parameter Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2022In ILIAS through 7.10, lack of verification when changing an email address (on the Profile Page) allows remote attackers to take over accounts.CVE-2022-31266 · Other software · Ilias · reported by MITREMedium 4.3
In ILIAS through 7.10, lack of verification when changing an email address (on the Profile Page) allows remote attackers to take over accounts.
- Product
- Ilias
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2022lettersanitizer is a DOM-based HTML email sanitizer for in-browser email rendering.CVE-2022-31103 · Other software · mat-sz · reported by GitHubHigh 7.5
lettersanitizer is a DOM-based HTML email sanitizer for in-browser email rendering. All versions of lettersanitizer below 1.0.2 are affected by a denial of service issue when processing a CSS at-rule `@keyframes`. This package is depended on by [react-letter](https://github.com/mat-sz/react-letter), therefore everyone using react-letter is also at risk. The problem has been patched in version 1.0.2.
- Product
- lettersanitizer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2022A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in scniro-validator v1.0.1 when validating crafted invalid emails.CVE-2021-40901 · Other software · Scniro-validator Project · reported by MITREHigh 7.5
A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in scniro-validator v1.0.1 when validating crafted invalid emails.
- Product
- Scniro-validator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2022A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in regexfn v1.0.5 when validating crafted invalid emails.CVE-2021-40900 · Other software · Regexfn Project · reported by MITREHigh 7.5
A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in regexfn v1.0.5 when validating crafted invalid emails.
- Product
- Regexfn
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.