Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,323 results · page 25 of 47
Jul 18, 2023 IBM Security Guardium 11.3 could allow an authenticated user to cause a denial of service due to improper input validation.CVE-2022-43908 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM Security Guardium 11.3 could allow an authenticated user to cause a denial of service due to improper input validation. IBM X-Force ID: 240903.
- Product
- Security Guardium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jul 14, 2023Microsoft Edge for Android (Chromium-based) Tampering VulnerabilityCVE-2023-36888 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.3
Microsoft Edge for Android (Chromium-based) Tampering Vulnerability
- Product
- Microsoft Edge for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jul 14, 2023Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityCVE-2023-36887 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jul 12, 2023A missing permission check in Jenkins Orka by MacStadium Plugin 1.33 and earlier allows attackers with Overall/Read permission to connect to an attacker-specifiCVE-2023-37949 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comHigh 7.1
A missing permission check in Jenkins Orka by MacStadium Plugin 1.33 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
- Product
- Jenkins Orka by MacStadium Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Jul 5, 2023A cross-site scripting (XSS) vulnerability in Selenium Grid v3.141.59 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected iCVE-2020-23452 · Other software · Selenium · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in Selenium Grid v3.141.59 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the hub parameter under the /grid/console page.
- Product
- Selenium Grid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2023Microsoft Edge (Chromium-based) Information Disclosure VulnerabilityCVE-2021-42307 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.3
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jun 30, 2023Microsoft Edge (Chromium-based) Security Feature Bypass VulnerabilityCVE-2021-34506 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.1
Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jun 30, 2023Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityCVE-2021-34475 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.4
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jun 30, 2023Microsoft Edge (Chromium-based) Security Feature Bypass VulnerabilityCVE-2021-31982 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jun 29, 2023Microsoft Edge (Chromium-based) Spoofing VulnerabilityCVE-2022-23264 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.7
Microsoft Edge (Chromium-based) Spoofing Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jun 28, 2023Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityCVE-2022-26899 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.3
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jun 28, 2023Microsoft Edge (Chromium-based) Spoofing VulnerabilityCVE-2022-29147 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comLow 3.1
Microsoft Edge (Chromium-based) Spoofing Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jun 28, 2023Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityCVE-2022-29146 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.3
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jun 28, 2023Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityCVE-2022-29144 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jun 28, 2023Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityCVE-2021-31937 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.2
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jun 27, 2023USM-Premium: Does not sanitize and escape some of its settingsCVE-2023-1166 · WordPress plugins & themes · reported by WPScanMedium 4.8
The USM-Premium WordPress plugin before 16.3 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).
- Product
- USM-Premium
- Fixed in
- 16.3
- What to do
- Update USM-Premium to 16.3 or newer.
Jun 20, 2023There exists a use after free/double free in libwebp.CVE-2023-1999 · Computers, phones & browsers · Chromium · reported by cve-coordination@google.comMedium 5.3
There exists a use after free/double free in libwebp. An attacker can use the ApplyFiltersAndEncode() function and loop through to free best.bw and assign best = trial pointer. The second loop will then return 0 because of an Out of memory error in VP8 encoder, the pointer is still assigned to trial and the AddressSanitizer will attempt a double free.
- Product
- libwebp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromium.googlesource.comsecurity.gentoo.org
Jun 15, 2023Cilium is a networking, observability, and security solution with an eBPF-based dataplane.CVE-2023-34242 · Other software · cilium · reported by GitHubLow 3.4
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to version 1.13.4, when Gateway API is enabled in Cilium, the absence of a check on the namespace in which a ReferenceGrant is created could result in Cilium unintentionally gaining visibility of secrets (including certificates) and services across namespaces. An attacker on an affected cluster can leverage this issue to use cluster secrets that should not be visible to them, or communicate with services that they should not have access to. Gateway API functionality is disabled by default. This vulnerability is fixed in Cilium release 1.13.4. As a workaround, restrict the creation of `ReferenceGrant` resources to admin users by using Kubernetes RBAC.
- Product
- cilium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2023Buffer overflow in Wi-Fi Commissioning MicriumOS example in Silicon Labs Gecko SDK v4.2.3 or earlier allows connected device to write payload onto the stack.CVE-2023-2686 · Other software · silabs.com · reported by product-security@silabs.comCritical 9.8
Buffer overflow in Wi-Fi Commissioning MicriumOS example in Silicon Labs Gecko SDK v4.2.3 or earlier allows connected device to write payload onto the stack.
- Product
- Gecko Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.silabs.comgithub.com
Jun 14, 2023IBM Security Guardium 11.3, 11.4, and 11.5 could allow a local user to obtain elevated privileges due to incorrect authorization checks.CVE-2022-22307 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.4
IBM Security Guardium 11.3, 11.4, and 11.5 could allow a local user to obtain elevated privileges due to incorrect authorization checks. IBM X-Force ID: 216753.
- Product
- Security Guardium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jun 13, 2023Microsoft Edge (Chromium-based) Information Disclosure VulnerabilityCVE-2023-33145 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jun 9, 2023WP Activity Log Premium: Cross-Site Request ForgeryCVE-2023-2285 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Activity Log Premium plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.5.0. This is due to missing or incorrect nonce validation on the ajax_switch_db function. This makes it possible for unauthenticated attackers to make changes to the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- WP Activity Log Premium
- Affected
- up to 4.5.0
- What to do
- Affects up to 4.5.0. Update WP Activity Log Premium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jun 9, 2023WP Activity Log Premium: Unauthorized modification of dataCVE-2023-2284 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Activity Log Premium plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_switch_db function in versions up to, and including, 4.5.0. This makes it possible for authenticated attackers with subscriber-level or higher to make changes to the plugin's settings.
- Product
- WP Activity Log Premium
- Affected
- up to 4.5.0
- What to do
- Affects up to 4.5.0. Update WP Activity Log Premium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jun 7, 2023Microsoft Edge (Chromium-based) Security Feature Bypass VulnerabilityCVE-2023-29345 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.1
Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jun 5, 2023Google Chromium V8 Type Confusion VulnerabilityCVE-2023-3079 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedHigh 8.8
Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
- Product
- Chromium V8
- On CISA’s list since
- Jun 7, 2023 (federal fix deadline Jun 28, 2023)
- What to do
- Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogpacketstormsecurity.compacketstormsecurity.com
Jun 4, 2023IBM Security Guardium 11.5 could allow a user to take over another user's session due to insufficient session expiration.CVE-2023-0041 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.3
IBM Security Guardium 11.5 could allow a user to take over another user's session due to insufficient session expiration. IBM X-Force ID: 243657.
- Product
- Security Guardium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jun 2, 2023Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityCVE-2023-33143 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jun 2, 2023Cross-site Scripting (XSS) - Stored in GitHub repository zadam/trilium prior to 0.59.4.CVE-2023-3067 · Other software · zadam · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository zadam/trilium prior to 0.59.4.
- Product
- zadam/trilium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2023A vulnerability, which was classified as problematic, has been found in Abstrium Pydio Cells 4.2.0.CVE-2023-2981 · Other software · Abstrium · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in Abstrium Pydio Cells 4.2.0. This issue affects some unknown processing of the component Chat. The manipulation leads to basic cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.2.1 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-230213 was assigned to this vulnerability.
- Product
- Pydio Cells
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpopalltheshells.medium.compydio.com
May 30, 2023A vulnerability classified as critical was found in Abstrium Pydio Cells 4.2.0.CVE-2023-2980 · Other software · Abstrium · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in Abstrium Pydio Cells 4.2.0. This vulnerability affects unknown code of the component User Creation Handler. The manipulation leads to improper control of resource identifiers. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.2.1 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-230212.
- Product
- Pydio Cells
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpopalltheshells.medium.compydio.com
May 30, 2023A vulnerability classified as critical has been found in Abstrium Pydio Cells 4.2.0.CVE-2023-2979 · Other software · Abstrium · reported by VulDBMedium 4.7
A vulnerability classified as critical has been found in Abstrium Pydio Cells 4.2.0. This affects an unknown part of the component User Creation Handler. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.2.1 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-230211.
- Product
- Pydio Cells
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpopalltheshells.medium.compydio.com
May 30, 2023A vulnerability was found in Abstrium Pydio Cells 4.2.0.CVE-2023-2978 · Other software · Abstrium · reported by VulDBMedium 4.6
A vulnerability was found in Abstrium Pydio Cells 4.2.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Change Subscription Handler. The manipulation leads to authorization bypass. The exploit has been disclosed to the public and may be used. Upgrading to version 4.2.1 is able to address this issue. It is recommended to upgrade the affected component. VDB-230210 is the identifier assigned to this vulnerability.
- Product
- Pydio Cells
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpopalltheshells.medium.compydio.com
May 30, 2023Pomerium is an identity and context-aware access proxy.CVE-2023-33189 · Other software · pomerium · reported by GitHubCritical 10
Pomerium is an identity and context-aware access proxy. With specially crafted requests, incorrect authorization decisions may be made by Pomerium. This issue has been patched in versions 0.17.4, 0.18.1, 0.19.2, 0.20.1, 0.21.4 and 0.22.2.
- Product
- pomerium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2023Cilium is a networking, observability, and security solution with an eBPF-based dataplane.CVE-2023-30851 · Other software · cilium · reported by GitHubLow 2.6
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. This issue only impacts users who have a HTTP policy that applies to multiple `toEndpoints` AND have an allow-all rule in place that affects only one of those endpoints. In such cases, a wildcard rule will be appended to the set of HTTP rules, which could cause bypass of HTTP policies. This issue has been patched in Cilium 1.11.16, 1.12.9, and 1.13.2.
- Product
- cilium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2023 Rockwell Automation ThinManager product allows the use of medium strength ciphers.CVE-2023-2443 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comHigh 7.5
Rockwell Automation ThinManager product allows the use of medium strength ciphers. If the client requests an insecure cipher, a malicious actor could potentially decrypt traffic sent between the client and server API.
- Product
- ThinManager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.custhelp.comrockwellautomation.custhelp.com
May 5, 2023Microsoft Edge (Chromium-based) Security Feature Bypass VulnerabilityCVE-2023-29354 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.7
Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
May 5, 2023Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityCVE-2023-29350 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
May 2, 2023OS Command Injection in GitHub repository appium/appium-desktop prior to v1.22.3-4.CVE-2023-2479 · Other software · appium · reported by security@huntr.devCritical 9.8
OS Command Injection in GitHub repository appium/appium-desktop prior to v1.22.3-4.
- Product
- appium/appium-desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2023Microsoft Edge (Chromium-based) Spoofing VulnerabilityCVE-2023-29334 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.3
Microsoft Edge (Chromium-based) Spoofing Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 27, 2023Microsoft Edge (Chromium-based) Security Feature Bypass VulnerabilityCVE-2023-28286 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.1
Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 27, 2023Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityCVE-2023-28261 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.7
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
- Product
- Microsoft Edge (Chromium-based) Extended Stable
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 19, 2023Google Chrome Skia Integer Overflow VulnerabilityCVE-2023-2136 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedCritical 9.6
Google Chromium Skia contains an integer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products.
- Product
- Chromium Skia
- On CISA’s list since
- Apr 21, 2023 (federal fix deadline May 12, 2023)
- What to do
- Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogchromereleases.googleblog.comcrbug.com
Apr 18, 2023Cilium is a networking, observability, and security solution with an eBPF-based dataplane.CVE-2023-29002 · Other software · cilium · reported by GitHubHigh 7.2
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. When run in debug mode, Cilium will log the contents of the `cilium-secrets` namespace. This could include data such as TLS private keys for Ingress and GatewayAPI resources. An attacker with access to debug output from the Cilium containers could use the resulting output to intercept and modify traffic to and from the affected cluster. Output of the sensitive information would occur at Cilium agent restart, when secrets in the namespace are modified, and on creation of Ingress or GatewayAPI resources. This vulnerability is fixed in Cilium releases 1.11.16, 1.12.9, and 1.13.2. Users unable to upgrade should disable debug mode.
- Product
- cilium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2023Google Chromium V8 Type Confusion VulnerabilityCVE-2023-2033 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedHigh 8.8
Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
- Product
- Chromium V8
- On CISA’s list since
- Apr 17, 2023 (federal fix deadline May 8, 2023)
- What to do
- Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogchromereleases.googleblog.comcrbug.com
Apr 13, 2023KYOCERA Mobile Print' v3.2.0.230119 and earlier, 'UTAX/TA MobilePrint' v3.2.0.230119 and earlier, and 'Olivetti Mobile Print' v3.2.0.230119 and earlier are vulnCVE-2023-25954 · Other software · Kyocera Document Solutions, TA Triumph-Adler GmbH, and Olivetti SpA · reported by vultures@jpcert.or.jpMedium 5.5
KYOCERA Mobile Print' v3.2.0.230119 and earlier, 'UTAX/TA MobilePrint' v3.2.0.230119 and earlier, and 'Olivetti Mobile Print' v3.2.0.230119 and earlier are vulnerable to improper intent handling. When a malicious app is installed on the victim user's Android device, the app may send an intent and direct the affected app to download malicious files or apps to the device without notification.
- Product
- KYOCERA Mobile Print, UTAX/TA MobilePrint, and Olivetti Mobile Print
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 11, 2023Microsoft Edge (Chromium-based) Tampering VulnerabilityCVE-2023-28301 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comLow 3.7
Microsoft Edge (Chromium-based) Tampering Vulnerability
- Product
- Microsoft Edge for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 11, 2023Microsoft Edge (Chromium-based) Security Feature Bypass VulnerabilityCVE-2023-28284 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.3
Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
- Product
- Microsoft Edge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 11, 2023Microsoft Edge (Chromium-based) Spoofing VulnerabilityCVE-2023-24935 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.1
Microsoft Edge (Chromium-based) Spoofing Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 10, 2023stylish-cost-calculator-premium: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-0983 · WordPress plugins & themes · reported by WPScanMedium 6.1
The stylish-cost-calculator-premium WordPress plugin before 7.9.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Stored Cross-Site Scripting which could be used against admins when viewing submissions submitted through the Email Quote Form.
- Product
- stylish-cost-calculator-premium
- Fixed in
- 7.9.0
- What to do
- Update stylish-cost-calculator-premium to 7.9.0 or newer.
Apr 5, 2023An arbitrary file upload vulnerability in readium-js v0.32.0 allows attackers to execute arbitrary code via uploading a crafted EPUB file.CVE-2023-24720 · Other software · Readium · reported by MITRECritical 9.8
An arbitrary file upload vulnerability in readium-js v0.32.0 allows attackers to execute arbitrary code via uploading a crafted EPUB file.
- Product
- Readium-js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordinfosec.zeyu2001.cominfosec.zeyu2001.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.