Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,839 results · page 26 of 37
Nov 21, 2023TorchServe is a tool for serving and scaling PyTorch models in production.CVE-2023-48299 · Other software · pytorch · reported by GitHubMedium 5.3
TorchServe is a tool for serving and scaling PyTorch models in production. Starting in version 0.1.0 and prior to version 0.9.0, using the model/workflow management API, there is a chance of uploading potentially harmful archives that contain files that are extracted to any location on the filesystem that is within the process permissions. Leveraging this issue could aid third-party actors in hiding harmful code in open-source/public models, which can be downloaded from the internet, and take advantage of machines running Torchserve. The ZipSlip issue in TorchServe has been fixed by validating the paths of files contained within a zip archive before extracting them. TorchServe release 0.9.0 includes fixes to address the ZipSlip vulnerability.
- Product
- serve
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2023During internal Axis Security Development Model (ASDM) threat-modelling, a flaw was found in the protection for device tampering (commonly known as Secure Boot)CVE-2023-5553 · Other software · Axis Communications AB · reported by product-security@axis.comHigh 7.6
During internal Axis Security Development Model (ASDM) threat-modelling, a flaw was found in the protection for device tampering (commonly known as Secure Boot) in AXIS OS making it vulnerable to a sophisticated attack to bypass this protection. To Axis' knowledge, there are no known exploits of the vulnerability at this time. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.
- Product
- AXIS OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2023An attacker can read any file on the filesystem on the server hosting ModelDB through an LFI in the artifact_path URL parameter.CVE-2023-6023 · Other software · vertaai · reported by security@huntr.devHigh 7.5
An attacker can read any file on the filesystem on the server hosting ModelDB through an LFI in the artifact_path URL parameter.
- Product
- vertaai/modeldb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2023An attacker is able to gain remote code execution on a server hosting the H2O dashboard through it's POJO model import feature.CVE-2023-6016 · Other software · h2oai · reported by security@huntr.devCritical 9.8
An attacker is able to gain remote code execution on a server hosting the H2O dashboard through it's POJO model import feature.
- Product
- h2oai/h2o-3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2023Improper input validation in some OpenVINO Model Server software before version 2022.3 for Intel Distribution of OpenVINO toolkit may allow an unauthenticated uCVE-2023-31203 · Other software · Intel · reported by secure@intel.comMedium 4.3
Improper input validation in some OpenVINO Model Server software before version 2022.3 for Intel Distribution of OpenVINO toolkit may allow an unauthenticated user to potentially enable denial of service via network access.
- Product
- Openvino Model Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2023A vulnerability has been identified in Siemens OPC UA Modelling Editor (SiOME) (All versions < V2.8).CVE-2023-46590 · Other software · Siemens · reported by productcert@siemens.comHigh 7.5
A vulnerability has been identified in Siemens OPC UA Modelling Editor (SiOME) (All versions < V2.8). Affected products suffer from a XML external entity (XXE) injection vulnerability. This vulnerability could allow an attacker to interfere with an application's processing of XML data and read arbitrary files in the system.
- Product
- Siemens OPC UA Modelling Editor (SiOME)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comcert-portal.siemens.com
Nov 1, 2023Multiple MFPs (multifunction printers) provided by FUJIFILM Business Innovation Corp.CVE-2023-46327 · Other software · FUJIFILM Business Inovation Corp. · reported by vultures@jpcert.or.jpMedium 5.9
Multiple MFPs (multifunction printers) provided by FUJIFILM Business Innovation Corp. and Xerox Corporation provide a facility to export the contents of their Address Book with encrypted form, but the encryption strength is insufficient. With the knowledge of the encryption process and the encryption key, the information such as the server credentials may be obtained from the exported Address Book data. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].
- Product
- Apeos C3070 Asia Pacific Model
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpsecurity.business.xerox.com
Oct 30, 2023 A vulnerability due to improper write protection of UEFI variables was reported in the BIOS of some ThinkPad models could allow an attacker with physical or loCVE-2022-4575 · Other software · Lenovo · reported by psirt@lenovo.comMedium 6.7
A vulnerability due to improper write protection of UEFI variables was reported in the BIOS of some ThinkPad models could allow an attacker with physical or local access and elevated privileges the ability to bypass Secure Boot.
- Product
- ThinkPad BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lenovo.comsupport.lenovo.com
Oct 30, 2023 An SMI handler input validation vulnerability in the BIOS of some ThinkPad models could allow an attacker with local access and elevated privileges to execute CVE-2022-4574 · Other software · Lenovo · reported by psirt@lenovo.comMedium 6.7
An SMI handler input validation vulnerability in the BIOS of some ThinkPad models could allow an attacker with local access and elevated privileges to execute arbitrary code.
- Product
- ThinkPad BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lenovo.comsupport.lenovo.com
Oct 30, 2023An SMM driver input validation vulnerability in the BIOS of some ThinkPad models could allow an attacker with local access and elevated privileges to execute arCVE-2022-48189 · Other software · Lenovo · reported by psirt@lenovo.comMedium 6.7
An SMM driver input validation vulnerability in the BIOS of some ThinkPad models could allow an attacker with local access and elevated privileges to execute arbitrary code.
- Product
- ThinkPad BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lenovo.comsupport.lenovo.com
Oct 16, 2023Vrm 360 3D Model Viewer: Exposes the full path of a fileCVE-2023-5177 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Vrm 360 3D Model Viewer WordPress plugin through 1.2.1 exposes the full path of a file when putting in a non-existent file in a parameter of the shortcode.
- Product
- Vrm 360 3D Model Viewer
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update Vrm 360 3D Model Viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2023Microsoft Common Data Model SDK Denial of Service VulnerabilityCVE-2023-36566 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Microsoft Common Data Model SDK Denial of Service Vulnerability
- Product
- Microsoft Common Data Model SDK for Java
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Sep 28, 2023TorchServe is a tool for serving and scaling PyTorch models in production.CVE-2023-43654 · Other software · pytorch · reported by GitHubCritical 10
TorchServe is a tool for serving and scaling PyTorch models in production. TorchServe default configuration lacks proper input validation, enabling third parties to invoke remote HTTP download requests and write files to the disk. This issue could be taken advantage of to compromise the integrity of the system and sensitive data. This issue is present in versions 0.1.0 to 0.8.1. A user is able to load the model of their choice from any URL that they would like to use. The user of TorchServe is responsible for configuring both the allowed_urls and specifying the model URL to be used. A pull request to warn the user when the default value for allowed_urls is used has been merged in PR #2534. TorchServe release 0.8.2 includes this change. Users are advised to upgrade. There are no known workarounds for this issue.
- Product
- serve
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Sep 21, 2023Dreamer CMS v4.1.3 was discovered to contain a SQL injection vulnerability via the model-form-management-field form.CVE-2023-42279 · Other software · Iteachyou · reported by MITRECritical 9.8
Dreamer CMS v4.1.3 was discovered to contain a SQL injection vulnerability via the model-form-management-field form.
- Product
- Dreamer CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comredpacketsecurity.com
Sep 11, 2023The use of the deprecated API `process.binding()` can bypass the permission model through path traversal.CVE-2023-32558 · Other software · NodeJS · reported by support@hackerone.comHigh 7.5
The use of the deprecated API `process.binding()` can bypass the permission model through path traversal. This vulnerability affects all users using the experimental permission model in Node.js 20.x. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
- Product
- Node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comhackerone.com
Sep 11, 2023A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read flag is used with a nonCVE-2023-32005 · Other software · NodeJS · reported by support@hackerone.comMedium 5.3
A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read flag is used with a non-* argument. This flaw arises from an inadequate permission model that fails to restrict file stats through the `fs.statfs` API. As a result, malicious actors can retrieve stats from files that they do not have explicit read access to. This vulnerability affects all users using the experimental permission model in Node.js 20. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
- Product
- Node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comsecurity.netapp.com
Sep 7, 2023GIGAPOD file servers (Appliance model and Software model) provide two web interfaces, 80/tcp and 443/tcp for user operation, and 8001/tcp for administrative opeCVE-2014-5329 · Other software · TripodWorks CO.,LTD. · reported by vultures@jpcert.or.jpHigh 7.5
GIGAPOD file servers (Appliance model and Software model) provide two web interfaces, 80/tcp and 443/tcp for user operation, and 8001/tcp for administrative operation. 8001/tcp is served by a version of Apache HTTP server containing a flaw in handling HTTP requests (CVE-2011-3192), which may lead to a denial-of-service (DoS) condition.
- Product
- GIGAPOD OFFICEHARD Appliance model
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2023A malformed DLC can trigger Memory Corruption in SNPE library due to out of bounds read, such as by loading an untrusted model (e.g.CVE-2023-28543 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 8.1
A malformed DLC can trigger Memory Corruption in SNPE library due to out of bounds read, such as by loading an untrusted model (e.g. from a remote source).
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Sep 3, 2023 A Hyundai model (2017) - CWE-294: Authentication Bypass by Capture-replay.CVE-2023-39373 · Other software · Hyundai · reported by cna@cyber.gov.ilHigh 7.4
A Hyundai model (2017) - CWE-294: Authentication Bypass by Capture-replay.
- Product
- model (2017)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 23, 2023A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevated privileges to cauCVE-2022-3746 · Other software · Lenovo · reported by psirt@lenovo.comMedium 6.7
A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevated privileges to cause some peripherals to work abnormally due to an exposed Embedded Controller (EC) interface.
- Product
- Notebook
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lenovo.comsupport.lenovo.com
Aug 23, 2023A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevated privileges to vieCVE-2022-3745 · Other software · Lenovo · reported by psirt@lenovo.comMedium 4.4
A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevated privileges to view incoming and returned data from SMI.
- Product
- Notebook
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lenovo.comsupport.lenovo.com
Aug 23, 2023A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevated privileges to unlCVE-2022-3744 · Other software · Lenovo · reported by psirt@lenovo.comMedium 6.7
A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevated privileges to unlock UEFI variables due to a hard-coded SMI handler credential.
- Product
- Notebook
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lenovo.comsupport.lenovo.com
Aug 23, 2023A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevated privileges under CVE-2022-3743 · Other software · Lenovo · reported by psirt@lenovo.comMedium 4.4
A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevated privileges under certain conditions the ability to enumerate Embedded Controller (EC) commands.
- Product
- Notebook
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lenovo.comsupport.lenovo.com
Aug 23, 2023A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevated privileges to exeCVE-2022-3742 · Other software · Lenovo · reported by psirt@lenovo.comMedium 6.7
A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevated privileges to execute arbitrary code due to improper buffer validation.
- Product
- Notebook
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lenovo.comsupport.lenovo.com
Aug 22, 2023The hardware emulation in the of_dpa_cmd_add_l2_flood of rocker device model in QEMU, as used in 7.0.0 and earlier, allows remote attackers to crash the host qeCVE-2022-36648 · Other software · Qemu · reported by MITRECritical 10
The hardware emulation in the of_dpa_cmd_add_l2_flood of rocker device model in QEMU, as used in 7.0.0 and earlier, allows remote attackers to crash the host qemu and potentially execute code on the host via execute a malformed program in the guest OS. Note: This has been disputed by multiple third parties as not a valid vulnerability due to the rocker device not falling within the virtualization use case.
- Product
- Qemu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.nongnu.orgsecurity.netapp.com
Aug 15, 2023A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model.CVE-2023-32004 · Other software · NodeJS · reported by support@hackerone.comHigh 8.8
A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handling of Buffers in file system APIs causing a traversal path to bypass when verifying file permissions. This vulnerability affects all users using the experimental permission model in Node.js 20. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
- Product
- Node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comlists.fedoraproject.org
Aug 15, 2023`fs.mkdtemp()` and `fs.mkdtempSync()` can be used to bypass the permission model check using a path traversal attack.CVE-2023-32003 · Other software · NodeJS · reported by support@hackerone.comMedium 5.3
`fs.mkdtemp()` and `fs.mkdtempSync()` can be used to bypass the permission model check using a path traversal attack. This flaw arises from a missing check in the fs.mkdtemp() API and the impact is a malicious actor could create an arbitrary directory. This vulnerability affects all users using the experimental permission model in Node.js 20. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
- Product
- Node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comlists.fedoraproject.org
Aug 14, 2023In parseInputs of ShimPreparedModel.cpp, there is a possible out of bounds read due to improper input validation.CVE-2023-21271 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In parseInputs of ShimPreparedModel.cpp, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comsource.android.com
Aug 11, 2023SQL Injection vulnerability in cskaza cszcms version 1.2.9, allows attackers to gain sensitive information via pm_sendmail parameter in csz_model.php.CVE-2020-36136 · Other software · Cskaza · reported by MITREHigh 7.5
SQL Injection vulnerability in cskaza cszcms version 1.2.9, allows attackers to gain sensitive information via pm_sendmail parameter in csz_model.php.
- Product
- Cszcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2023SQL Injection vulnerability in file Base_module_model.php in Daylight Studio FUEL-CMS version 1.4.9, allows remote attackers to execute arbitrary code via the cCVE-2020-24950 · Other software · Thedaylightstudio · reported by MITREHigh 8.8
SQL Injection vulnerability in file Base_module_model.php in Daylight Studio FUEL-CMS version 1.4.9, allows remote attackers to execute arbitrary code via the col parameter to function list_items.
- Product
- Fuel CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2023Cross Site Request Forgery (CSRF) vulnerability in yzmcms version 5.6, allows remote attackers to escalate privileges and gain sensitive information sitemodel/aCVE-2020-23595 · Other software · Yzmcms · reported by MITREHigh 8.8
Cross Site Request Forgery (CSRF) vulnerability in yzmcms version 5.6, allows remote attackers to escalate privileges and gain sensitive information sitemodel/add.html endpoint.
- Product
- Yzmcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2023MindsDB's AI Virtual Database allows developers to connect any AI/ML model to any datasource.CVE-2023-38699 · Other software · mindsdb · reported by GitHubCritical 9.1
MindsDB's AI Virtual Database allows developers to connect any AI/ML model to any datasource. Prior to version 23.7.4.0, a call to requests with `verify=False` disables SSL certificate checks. This rule enforces always verifying SSL certificates for methods in the Requests library. In version 23.7.4.0, certificates are validated by default, which is the desired behavior.
- Product
- mindsdb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2023Predictable Exact Value from Previous Values vulnerability in Mitsubishi Electric Corporation GOT2000 Series GT21 model versions 01.49.000 and prior and GOT SIMCVE-2023-3373 · Other software · Mitsubishi Electric Corporation · reported by Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jpMedium 5.9
Predictable Exact Value from Previous Values vulnerability in Mitsubishi Electric Corporation GOT2000 Series GT21 model versions 01.49.000 and prior and GOT SIMPLE Series GS21 model versions 01.49.000 and prior allows a remote unauthenticated attacker to hijack data connections (session hijacking) or prevent legitimate users from establishing data connections (to cause DoS condition) by guessing the listening port of the data connection on FTP server and connecting to it.
- Product
- GOT2000 Series GT21 model
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2023An issue in the delete function in the ActModelController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete models created by the AdmCVE-2023-38991 · Other software · Jeesite · reported by MITREMedium 5.4
An issue in the delete function in the ActModelController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete models created by the Administrator.
- Product
- Jeesite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2023Weak Encoding for Password vulnerability in Mitsubishi Electric Corporation GOT2000 Series GT27 model versions 01.49.000 and prior, GT25 model versions 01.49.00CVE-2023-0525 · Other software · Mitsubishi Electric Corporation · reported by Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jpHigh 7.5
Weak Encoding for Password vulnerability in Mitsubishi Electric Corporation GOT2000 Series GT27 model versions 01.49.000 and prior, GT25 model versions 01.49.000 and prior, GT23 model versions 01.49.000 and prior, GT21 model versions 01.49.000 and prior, GOT SIMPLE Series GS25 model versions 01.49.000 and prior, GS21 model versions 01.49.000 and prior, GT Designer3 Version1 (GOT2000) versions 1.295H and prior and GT SoftGOT2000 versions 1.295H and prior allows a remote unauthenticated attacker to obtain plaintext passwords by sniffing packets containing encrypted passwords and decrypting the encrypted passwords, in the case of transferring data with GT Designer3 Version1(GOT2000) and GOT2000 Series or GOT SIMPLE Series with the Data Transfer Security function enabled, or in the case of transferring data by the SoftGOT-GOT link function with GT SoftGOT2000 and GOT2000 series with the Data Transfer Security function enabled.
- Product
- GOT2000 Series GT27 model
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 27, 2023An installer that loads or executes files using an unconstrained search path may be vulnerable to substitute files under control of an attacker being loaded or CVE-2022-43703 · Computers, phones & browsers · Arm Ltd · reported by arm-security@arm.comHigh 7.8
An installer that loads or executes files using an unconstrained search path may be vulnerable to substitute files under control of an attacker being loaded or executed instead of the intended files.
- Product
- Arm Compiler 5 (AC5), Arm Compiler for Embedded 6 (AC6), Fast Models (FM), Arm Compiler for Embedded FuSA (ACEF), Arm Development Studio (ADS), Arm Forge (AF),
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.arm.comintel.com
Jul 27, 2023When the directory containing the installer does not have sufficiently restrictive file permissions, an attacker can modify (or replace) the installer to executCVE-2022-43702 · Computers, phones & browsers · Arm Ltd · reported by arm-security@arm.comHigh 7.8
When the directory containing the installer does not have sufficiently restrictive file permissions, an attacker can modify (or replace) the installer to execute malicious code.
- Product
- Arm Compiler 5 (AC5), Arm Compiler for Embedded 6 (AC6), Fast Models (FM), Arm Compiler for Embedded FuSA (ACEF), Arm Development Studio (ADS), Arm Forge (AF),
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.arm.comintel.com
Jul 27, 2023When the installation directory does not have sufficiently restrictive file permissions, an attacker can modify files in the installation directory to cause exeCVE-2022-43701 · Computers, phones & browsers · Arm Ltd · reported by arm-security@arm.comHigh 7.8
When the installation directory does not have sufficiently restrictive file permissions, an attacker can modify files in the installation directory to cause execution of malicious code.
- Product
- Arm Compiler 5 (AC5), Arm Compiler for Embedded 6 (AC6), Fast Models (FM), Arm Compiler for Embedded FuSA (ACEF), Arm Development Studio (ADS), Arm Forge (AF),
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.arm.comintel.com
Jul 25, 2023GBrowse accepts files with any formats uploaded and places them in the area accessible through unauthenticated web requests.CVE-2023-32637 · Other software · Generic Model Organism Database Project · reported by vultures@jpcert.or.jpCritical 9.8
GBrowse accepts files with any formats uploaded and places them in the area accessible through unauthenticated web requests. Therefore, anyone who can upload files through the product may execute arbitrary code on the server.
- Product
- GBrowse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2023eyoucms v1.6.3 was discovered to contain an information disclosure vulnerability via the component /custom_model_path/recruit.filelist.txt.CVE-2023-37645 · Other software · Eyoucms · reported by MITREMedium 5.3
eyoucms v1.6.3 was discovered to contain an information disclosure vulnerability via the component /custom_model_path/recruit.filelist.txt.
- Product
- Eyoucms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2023Incorrect access control in the component /models/Content of Cockpit CMS v2.5.2 allows unauthorized attackers to access sensitive data.CVE-2023-37649 · Other software · Agentejo · reported by MITREHigh 7.5
Incorrect access control in the component /models/Content of Cockpit CMS v2.5.2 allows unauthorized attackers to access sensitive data.
- Product
- Cockpit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comghostccamm.com
Jul 17, 2023RCE (Remote Code Execution) vulnerability was found in some Furukawa ONU models, this vulnerability allows remote unauthenticated users to send arbitrary commanCVE-2021-37384 · Other software · furukawa · reported by MITRECritical 9.8
RCE (Remote Code Execution) vulnerability was found in some Furukawa ONU models, this vulnerability allows remote unauthenticated users to send arbitrary commands to the device via web interface.
- Product
- ld420-10r_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcwe.mitre.orggist.githubusercontent.com
Jul 13, 2023Auto-GPT is an experimental open-source application showcasing the capabilities of the GPT-4 language model.CVE-2023-37275 · Other software · Significant-Gravitas · reported by GitHubLow 3.1
Auto-GPT is an experimental open-source application showcasing the capabilities of the GPT-4 language model. The Auto-GPT command line UI makes heavy use of color-coded print statements to signify different types of system messages to the user, including messages that are crucial for the user to review and control which commands should be executed. Before v0.4.3, it was possible for a malicious external resource (such as a website browsed by Auto-GPT) to cause misleading messages to be printed to the console by getting the LLM to regurgitate JSON encoded ANSI escape sequences (`\u001b[`). These escape sequences were JSON decoded and printed to the console as part of the model's "thinking process". The issue has been patched in release version 0.4.3.
- Product
- Auto-GPT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2023Auto-GPT is an experimental open-source application showcasing the capabilities of the GPT-4 language model.CVE-2023-37274 · Other software · Significant-Gravitas · reported by GitHubHigh 7.5
Auto-GPT is an experimental open-source application showcasing the capabilities of the GPT-4 language model. When Auto-GPT is executed directly on the host system via the provided run.sh or run.bat files, custom Python code execution is sandboxed using a temporary dedicated docker container which should not have access to any files outside of the Auto-GPT workspace directory. Before v0.4.3, the `execute_python_code` command (introduced in v0.4.1) does not sanitize the `basename` arg before writing LLM-supplied code to a file with an LLM-supplied name. This allows for a path traversal attack that can overwrite any .py file outside the workspace directory by specifying a `basename` such as `../../../main.py`. This can further be abused to achieve arbitrary code execution on the host running Auto-GPT by e.g. overwriting autogpt/main.py which will be executed outside of the docker environment meant to sandbox custom python code execution the next time Auto-GPT is started. The issue has been patched in version 0.4.3. As a workaround, the risk introduced by this vulnerability can be remediated by running Auto-GPT in a virtual machine, or another environment in which damage to files or co
- Product
- Auto-GPT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2023Auto-GPT is an experimental open-source application showcasing the capabilities of the GPT-4 language model.CVE-2023-37273 · Other software · Significant-Gravitas · reported by GitHubHigh 8.1
Auto-GPT is an experimental open-source application showcasing the capabilities of the GPT-4 language model. Running Auto-GPT version prior to 0.4.3 by cloning the git repo and executing `docker compose run auto-gpt` in the repo root uses a different docker-compose.yml file from the one suggested in the official docker set up instructions. The docker-compose.yml file located in the repo root mounts itself into the docker container without write protection. This means that if malicious custom python code is executed via the `execute_python_file` and `execute_python_code` commands, it can overwrite the docker-compose.yml file and abuse it to gain control of the host system the next time Auto-GPT is started. The issue has been patched in version 0.4.3.
- Product
- Auto-GPT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2023The data flowing between the PCU and its modules is insecure.CVE-2023-30561 · Other software · Becton Dickinson & Co · reported by cybersecurity@bd.comMedium 6.1
The data flowing between the PCU and its modules is insecure. A threat actor with physical access could potentially read or modify data by attaching a specially crafted device while an infusion is running.
- Product
- BD Alarisâ„¢ Point-of-Care Unit (PCU) Model 8015
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2023The configuration from the PCU can be modified without authentication using physical connection to the PCU.CVE-2023-30560 · Other software · Becton Dickinson & Co · reported by cybersecurity@bd.comMedium 6.8
The configuration from the PCU can be modified without authentication using physical connection to the PCU.
- Product
- BD Alarisâ„¢ Point-of-Care Unit (PCU) Model 8015
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2023The firmware update package for the wireless card is not properly signed and can be modified.CVE-2023-30559 · Other software · Becton Dickinson & Co · reported by cybersecurity@bd.comMedium 5.2
The firmware update package for the wireless card is not properly signed and can be modified.
- Product
- BD Alaris™ Point-of-Care Unit (PCU) Model 8015
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2023The Syncfusion EJ2 ASPCore File Provider 3ac357f is vulnerable to Models/PhysicalFileProvider.cs directory traversal.CVE-2023-26564 · Other software · Syncfusion · reported by MITRECritical 9.8
The Syncfusion EJ2 ASPCore File Provider 3ac357f is vulnerable to Models/PhysicalFileProvider.cs directory traversal. As a result, an unauthenticated attacker can list files within a directory, download any file, or upload any file to any directory accessible by the web server.
- Product
- Ej2 Aspcore File Provider
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordej2.syncfusion.comgithub.com
Jul 4, 2023Memory corruption in Audio while processing sva_model_serializer using memory size passed by HIDL client.CVE-2023-21639 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 6.7
Memory corruption in Audio while processing sva_model_serializer using memory size passed by HIDL client.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.