Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,898 results · page 27 of 58
Aug 8, 2023Microsoft Office Visio Remote Code Execution VulnerabilityCVE-2023-36866 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Office Visio Remote Code Execution Vulnerability
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Aug 8, 2023Microsoft Office Visio Remote Code Execution VulnerabilityCVE-2023-36865 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Office Visio Remote Code Execution Vulnerability
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Aug 8, 2023Microsoft Office Visio Remote Code Execution VulnerabilityCVE-2023-35372 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Office Visio Remote Code Execution Vulnerability
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Aug 8, 2023Microsoft Office Remote Code Execution VulnerabilityCVE-2023-35371 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Office Remote Code Execution Vulnerability
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jul 25, 2023An arbitrary file upload vulnerability in eoffice before v9.5 allows attackers to execute arbitrary code via uploading a crafted file.CVE-2023-34798 · Other software · Weaver · reported by MITRECritical 9.8
An arbitrary file upload vulnerability in eoffice before v9.5 allows attackers to execute arbitrary code via uploading a crafted file.
- Product
- E-office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jul 20, 2023Office Suite Premium Version v10.9.1.42602 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the filter parameter at /api?path=CVE-2023-38617 · Other software · Mobisystems · reported by MITREMedium 6.1
Office Suite Premium Version v10.9.1.42602 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the filter parameter at /api?path=files.
- Product
- Office Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Jul 20, 2023Office Suite Premium v10.9.1.42602 was discovered to contain a local file inclusion (LFI) vulnerability via the component /etc/hosts.CVE-2023-37601 · Other software · Mobisystems · reported by MITREHigh 7.5
Office Suite Premium v10.9.1.42602 was discovered to contain a local file inclusion (LFI) vulnerability via the component /etc/hosts.
- Product
- Office Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Jul 20, 2023Office Suite Premium Version v10.9.1.42602 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the id parameter at /api?path=profCVE-2023-37600 · Other software · Mobisystems · reported by MITREMedium 6.1
Office Suite Premium Version v10.9.1.42602 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the id parameter at /api?path=profile.
- Product
- Office Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Jul 11, 2023Orchid is a Laravel package that allows application development of back-office applications, admin/user panels, and dashboards.CVE-2023-36825 · Other software · orchidsoftware · reported by GitHubCritical 9.6
Orchid is a Laravel package that allows application development of back-office applications, admin/user panels, and dashboards. A vulnerability present starting in version 14.0.0-alpha4 and prior to version 14.5.0 is related to the deserialization of untrusted data from the `_state` query parameter, which can result in remote code execution. The issue has been addressed in version 14.5.0. Users are advised to upgrade their software to this version or any subsequent versions that include the patch. There are no known workarounds.
- Product
- platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 11, 2023Microsoft Excel Information Disclosure VulnerabilityCVE-2023-33162 · Email & office · Microsoft · reported by secure@microsoft.comMedium 5.5
Microsoft Excel Information Disclosure Vulnerability
- Product
- Microsoft Office 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jul 11, 2023Microsoft Excel Remote Code Execution VulnerabilityCVE-2023-33161 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Excel Remote Code Execution Vulnerability
- Product
- Microsoft Office 2019 for Mac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jul 11, 2023Microsoft Excel Remote Code Execution VulnerabilityCVE-2023-33158 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Excel Remote Code Execution Vulnerability
- Product
- Microsoft Office 2019 for Mac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jul 11, 2023Microsoft Outlook Remote Code Execution VulnerabilityCVE-2023-33153 · Email & office · Microsoft · reported by secure@microsoft.comMedium 6.8
Microsoft Outlook Remote Code Execution Vulnerability
- Product
- Microsoft Office 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jul 11, 2023Microsoft ActiveX Remote Code Execution VulnerabilityCVE-2023-33152 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7
Microsoft ActiveX Remote Code Execution Vulnerability
- Product
- Microsoft Office 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jul 11, 2023Microsoft Outlook Spoofing VulnerabilityCVE-2023-33151 · Email & office · Microsoft · reported by secure@microsoft.comMedium 6.5
Microsoft Outlook Spoofing Vulnerability
- Product
- Microsoft Office LTSC 2021
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jul 11, 2023Microsoft Office Security Feature Bypass VulnerabilityCVE-2023-33150 · Email & office · Microsoft · reported by secure@microsoft.comCritical 9.6
Microsoft Office Security Feature Bypass Vulnerability
- Product
- Microsoft Office 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jul 11, 2023Microsoft Office Graphics Remote Code Execution VulnerabilityCVE-2023-33149 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Office Graphics Remote Code Execution Vulnerability
- Product
- Microsoft Office 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jul 11, 2023Microsoft Office Elevation of Privilege VulnerabilityCVE-2023-33148 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Office Elevation of Privilege Vulnerability
- Product
- Microsoft Office 2013 Click-to-Run (C2R)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.compacketstormsecurity.com
Jul 10, 2023A flaw was found in the Libreoffice package.CVE-2023-1183 · Other software · Red Hat · reported by Red HatMedium 5
A flaw was found in the Libreoffice package. An attacker can craft an odb containing a "database/script" file with a SCRIPT command where the contents of the file could be written to a new file whose location was determined by the attacker.
- Product
- Red Hat Enterprise Linux 6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Jun 27, 2023Incorrect access control in the component /index.php?mod=system&op=orgtree of dzzoffice 2.02.1_SC_UTF8 allows unauthenticated attackers to browse departments anCVE-2021-30205 · Other software · Dzzoffice · reported by MITREMedium 5.3
Incorrect access control in the component /index.php?mod=system&op=orgtree of dzzoffice 2.02.1_SC_UTF8 allows unauthenticated attackers to browse departments and usernames.
- Product
- Dzzoffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2023A reflected cross-site scripting (XSS) vulnerability in the zero parameter of dzzoffice 2.02.1_SC_UTF8 allows attackers to execute arbitrary web scripts or HTMLCVE-2021-30203 · Other software · Dzzoffice · reported by MITREMedium 6.1
A reflected cross-site scripting (XSS) vulnerability in the zero parameter of dzzoffice 2.02.1_SC_UTF8 allows attackers to execute arbitrary web scripts or HTML.
- Product
- Dzzoffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2023Onlyoffice Community Server before v12.5.2 was discovered to contain a remote code execution (RCE) vulnerability via the component UploadProgress.ashx.CVE-2023-34939 · Other software · Onlyoffice · reported by MITRECritical 9.8
Onlyoffice Community Server before v12.5.2 was discovered to contain a remote code execution (RCE) vulnerability via the component UploadProgress.ashx.
- Product
- Onlyoffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2023It was possible to call filesystem and network references using the local LibreOffice instance using manipulated ODT documents.CVE-2023-26435 · Other software · OX Software GmbH · reported by security@open-xchange.comMedium 5
It was possible to call filesystem and network references using the local LibreOffice instance using manipulated ODT documents. Attackers could discover restricted network topology and services as well as including local files with read permissions of the open-xchange system user. This was limited to specific file-types, like images. We have improved existing content filters and validators to avoid including any local resources. No publicly available exploits are known.
- Product
- OX App Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jun 16, 2023Microsoft Publisher Remote Code Execution VulnerabilityCVE-2023-28295 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Publisher Remote Code Execution Vulnerability
- Product
- Microsoft Office 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jun 13, 2023Microsoft Office Remote Code Execution VulnerabilityCVE-2023-33146 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Office Remote Code Execution Vulnerability
- Product
- Microsoft Office 2019 for Mac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jun 13, 2023Microsoft Excel Remote Code Execution VulnerabilityCVE-2023-33137 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Excel Remote Code Execution Vulnerability
- Product
- Microsoft Office 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jun 13, 2023Microsoft Excel Remote Code Execution VulnerabilityCVE-2023-33133 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Excel Remote Code Execution Vulnerability
- Product
- Microsoft Office 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jun 13, 2023Microsoft Outlook Remote Code Execution VulnerabilityCVE-2023-33131 · Email & office · Microsoft · reported by secure@microsoft.comHigh 8.8
Microsoft Outlook Remote Code Execution Vulnerability
- Product
- Microsoft Office 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.compacketstormsecurity.com
Jun 13, 2023Microsoft Excel Remote Code Execution VulnerabilityCVE-2023-32029 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Excel Remote Code Execution Vulnerability
- Product
- Microsoft Office 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jun 13, 2023OS command injection vulnerability exists in WPS Office version 10.8.0.6186.CVE-2023-32548 · Other software · KINGSOFT JAPAN, INC. · reported by vultures@jpcert.or.jpHigh 8.1
OS command injection vulnerability exists in WPS Office version 10.8.0.6186. If a remote attacker who can conduct a man-in-the-middle attack connects the product to a malicious server and sends a specially crafted data, an arbitrary OS command may be executed on the system where the product is installed.
- Product
- WPS Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpsupport.kingsoft.jp
Jun 5, 2023Microsoft Office Remote Code Execution VulnerabilityCVE-2023-29344 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Office Remote Code Execution Vulnerability
- Product
- Microsoft Office 2019 for Mac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jun 4, 2023OfflinePlayerService.exe in Harbinger Offline Player 4.0.6.0.2 allows directory traversal as LocalSystem via ..\ in a URL.CVE-2023-34407 · Other software · Harbingergroup · reported by MITREHigh 7.5
OfflinePlayerService.exe in Harbinger Offline Player 4.0.6.0.2 allows directory traversal as LocalSystem via ..\ in a URL.
- Product
- Office Player
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2023A vulnerability has been found in Guangdong Pythagorean OA Office System up to 4.50.31 and classified as problematic.CVE-2023-3035 · Other software · Guangdong · reported by VulDBLow 3.5
A vulnerability has been found in Guangdong Pythagorean OA Office System up to 4.50.31 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Schedule Handler. The manipulation of the argument description leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-230467.
- Product
- Pythagorean OA Office System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2023A vulnerability has been found in Guangdong Pythagorean OA Office System up to 4.50.31 and classified as problematic.CVE-2023-3029 · Other software · Guangdong · reported by VulDBMedium 4.3
A vulnerability has been found in Guangdong Pythagorean OA Office System up to 4.50.31 and classified as problematic. This vulnerability affects unknown code of the file /note/index/delete. The manipulation of the argument id leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-230458 is the identifier assigned to this vulnerability.
- Product
- Pythagorean OA Office System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 31, 2023Microsoft Outlook Denial of Service VulnerabilityCVE-2022-35742 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.5
Microsoft Outlook Denial of Service Vulnerability
- Product
- Microsoft Office 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
May 31, 2023Collabora Online is a collaborative online office suite.CVE-2023-34088 · Other software · CollaboraOnline · reported by GitHubHigh 8.7
Collabora Online is a collaborative online office suite. A stored cross-site scripting (XSS) vulnerability was found in Collabora Online prior to versions 22.05.13, 21.11.9.1, and 6.4.27. An attacker could create a document with an XSS payload as a document name. Later, if an administrator opened the admin console and navigated to the history page, the document name was injected as unescaped HTML and executed as a script inside the context of the admin console. The administrator JSON web token (JWT) used for the websocket connection could be leaked through this flaw. Users should upgrade to Collabora Online 22.05.13 or higher; Collabora Online 21.11.9.1 or higher; Collabora Online 6.4.27 or higher to receive a patch.
- Product
- online
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2023Improper access control in editor components of The Document Foundation LibreOffice allowed an attacker to craft a document that would cause external links to bCVE-2023-2255 · Other software · The Document Foundation · reported by security@documentfoundation.orgMedium 5.3
Improper access control in editor components of The Document Foundation LibreOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt. In the affected versions of LibreOffice documents that used "floating frames" linked to external files, would load the contents of those frames without prompting the user for permission to do so. This was inconsistent with the treatment of other linked content in LibreOffice. This issue affects: The Document Foundation LibreOffice 7.4 versions prior to 7.4.7; 7.5 versions prior to 7.5.3.
- Product
- LibreOffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orgsecurity.gentoo.org
May 25, 2023Improper Validation of Array Index vulnerability in the spreadsheet component of The Document Foundation LibreOffice allows an attacker to craft a spreadsheet dCVE-2023-0950 · Other software · The Document Foundation · reported by security@documentfoundation.orgHigh 7.8
Improper Validation of Array Index vulnerability in the spreadsheet component of The Document Foundation LibreOffice allows an attacker to craft a spreadsheet document that will cause an array index underflow when loaded. In the affected versions of LibreOffice certain malformed spreadsheet formulas, such as AGGREGATE, could be created with less parameters passed to the formula interpreter than it expected, leading to an array index underflow, in which case there is a risk that arbitrary code could be executed. This issue affects: The Document Foundation LibreOffice 7.4 versions prior to 7.4.6; 7.5 versions prior to 7.5.1.
- Product
- LibreOffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orgsecurity.gentoo.org
May 18, 2023Local privilege escalation due to unrestricted loading of unsigned libraries.CVE-2022-4418 · Other software · Acronis · reported by security@acronis.comHigh 7.8
Local privilege escalation due to unrestricted loading of unsigned libraries. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40208.
- Product
- Acronis Cyber Protect Home Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity-advisory.acronis.comsecurity-advisory.acronis.com
May 15, 2023Collabora Online is a collaborative online office suite based on LibreOffice technology.CVE-2023-31145 · Other software · CollaboraOnline · reported by GitHubMedium 4.3
Collabora Online is a collaborative online office suite based on LibreOffice technology. This vulnerability report describes a reflected XSS vulnerability with full CSP bypass in Nextcloud installations using the recommended bundle. The vulnerability can be exploited to perform a trivial account takeover attack. The vulnerability allows attackers to inject malicious code into web pages, which can be executed in the context of the victim's browser session. This means that an attacker can steal sensitive data, such as login credentials or personal information, or perform unauthorized actions on behalf of the victim, such as modifying or deleting data. In this specific case, the vulnerability allows for a trivial account takeover attack. An attacker can exploit the vulnerability to inject code into the victim's browser session, allowing the attacker to take over the victim's account without their knowledge or consent. This can lead to unauthorized access to sensitive information and data, as well as the ability to perform actions on behalf of the victim. Furthermore, the fact that the vulnerability bypasses the Content Security Policy (CSP) makes it more dangerous, as CSP is an import
- Product
- online
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2023Arbitrary Files can be installed in the Setting Data Import function of Office / Small Office Multifunction Printers and Laser Printers(*).CVE-2023-0859 · Other software · Canon Inc. · reported by f98c90f0-e9bd-4fa7-911b-51993f3571fdLow 2.2
Arbitrary Files can be installed in the Setting Data Import function of Office / Small Office Multifunction Printers and Laser Printers(*). *:Satera LBP660C Series/LBP620C Series/MF740C Series/MF640C Series firmware Ver.11.04 and earlier sold in Japan. Color imageCLASS LBP660C Series/LBP 620C Series/X LBP1127C/MF740C Series/MF640C Series/X MF1127C firmware Ver.11.04 and earlier sold in US. i-SENSYS LBP660C Series/LBP620C Series/MF740C Series/MF640C Series, C1127P, C1127iF, C1127i firmware Ver.11.04 and earlier sold in Europe.
- Product
- Canon Office/Small Office Multifunction Printers and Laser Printers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2023Improper Authentication of RemoteUI of Office / Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to CVE-2023-0858 · Other software · Canon Inc. · reported by f98c90f0-e9bd-4fa7-911b-51993f3571fdLow 3.1
Improper Authentication of RemoteUI of Office / Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger unauthorized access to the product. *:Satera LBP660C Series/LBP620C Series/MF740C Series/MF640C Series firmware Ver.11.04 and earlier sold in Japan. Color imageCLASS LBP660C Series/LBP 620C Series/X LBP1127C/MF740C Series/MF640C Series/X MF1127C firmware Ver.11.04 and earlier sold in US. i-SENSYS LBP660C Series/LBP620C Series/MF740C Series/MF640C Series, C1127P, C1127iF, C1127i firmware Ver.11.04 and earlier sold in Europe.
- Product
- Canon Office/Small Office Multifunction Printers and Laser Printers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2023Unintentional change of settings during initial registration of system administrators which uses control protocols.CVE-2023-0857 · Other software · Canon Inc. · reported by f98c90f0-e9bd-4fa7-911b-51993f3571fdMedium 5.9
Unintentional change of settings during initial registration of system administrators which uses control protocols. The affected Office / Small Office Multifunction Printers and Laser Printers(*) may allow an attacker on the network segment to trigger unauthorized access to the product. *:Satera LBP660C Series/LBP620C Series/MF740C Series/MF640C Series firmware Ver.11.04 and earlier sold in Japan. Color imageCLASS LBP660C Series/LBP 620C Series/X LBP1127C/MF740C Series/MF640C Series/X MF1127C firmware Ver.11.04 and earlier sold in US. i-SENSYS LBP660C Series/LBP620C Series/MF740C Series/MF640C Series, C1127P, C1127iF, C1127i firmware Ver.11.04 and earlier sold in Europe.
- Product
- Canon Office/Small Office Multifunction Printers and Laser Printers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2023Buffer overflow in IPP sides attribute process of Office / Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network CVE-2023-0856 · Other software · Canon Inc. · reported by f98c90f0-e9bd-4fa7-911b-51993f3571fdCritical 9.8
Buffer overflow in IPP sides attribute process of Office / Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *:Satera LBP660C Series/LBP620C Series/MF740C Series/MF640C Series firmware Ver.11.04 and earlier sold in Japan. Color imageCLASS LBP660C Series/LBP 620C Series/X LBP1127C/MF740C Series/MF640C Series/X MF1127C firmware Ver.11.04 and earlier sold in US. i-SENSYS LBP660C Series/LBP620C Series/MF740C Series/MF640C Series, C1127P, C1127iF, C1127i firmware Ver.11.04 and earlier sold in Europe.
- Product
- Canon Office/Small Office Multifunction Printers and Laser Printers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2023Buffer overflow in IPP number-up attribute process of Office / Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the netwCVE-2023-0855 · Other software · Canon Inc. · reported by f98c90f0-e9bd-4fa7-911b-51993f3571fdCritical 9.8
Buffer overflow in IPP number-up attribute process of Office / Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *:Satera LBP660C Series/LBP620C Series/MF740C Series/MF640C Series firmware Ver.11.04 and earlier sold in Japan. Color imageCLASS LBP660C Series/LBP 620C Series/X LBP1127C/MF740C Series/MF640C Series/X MF1127C firmware Ver.11.04 and earlier sold in US. i-SENSYS LBP660C Series/LBP620C Series/MF740C Series/MF640C Series, C1127P, C1127iF, C1127i firmware Ver.11.04 and earlier sold in Europe.
- Product
- Canon Office/Small Office Multifunction Printers and Laser Printers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2023Buffer overflow in NetBIOS QNAME registering and communication process of Office / Small Office Multifunction Printers and Laser Printers(*) which may allow an CVE-2023-0854 · Other software · Canon Inc. · reported by f98c90f0-e9bd-4fa7-911b-51993f3571fdCritical 9.8
Buffer overflow in NetBIOS QNAME registering and communication process of Office / Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *:Satera LBP660C Series/LBP620C Series/MF740C Series/MF640C Series firmware Ver.11.04 and earlier sold in Japan. Color imageCLASS LBP660C Series/LBP 620C Series/X LBP1127C/MF740C Series/MF640C Series/X MF1127C firmware Ver.11.04 and earlier sold in US. i-SENSYS LBP660C Series/LBP620C Series/MF740C Series/MF640C Series, C1127P, C1127iF, C1127i firmware Ver.11.04 and earlier sold in Europe.
- Product
- Canon Office/Small Office Multifunction Printers and Laser Printers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2023Buffer overflow in mDNS NSEC record registering process of Office / Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on theCVE-2023-0853 · Other software · Canon Inc. · reported by f98c90f0-e9bd-4fa7-911b-51993f3571fdCritical 9.8
Buffer overflow in mDNS NSEC record registering process of Office / Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *:Satera LBP660C Series/LBP620C Series/MF740C Series/MF640C Series firmware Ver.11.04 and earlier sold in Japan. Color imageCLASS LBP660C Series/LBP 620C Series/X LBP1127C/MF740C Series/MF640C Series/X MF1127C firmware Ver.11.04 and earlier sold in US. i-SENSYS LBP660C Series/LBP620C Series/MF740C Series/MF640C Series, C1127P, C1127iF, C1127i firmware Ver.11.04 and earlier sold in Europe.
- Product
- Canon Office/Small Office Multifunction Printers and Laser Printers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2023Buffer overflow in the Address Book of Mobile Device function of Office / Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker CVE-2023-0852 · Other software · Canon Inc. · reported by f98c90f0-e9bd-4fa7-911b-51993f3571fdCritical 9.8
Buffer overflow in the Address Book of Mobile Device function of Office / Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *:Satera LBP660C Series/LBP620C Series/MF740C Series/MF640C Series firmware Ver.11.04 and earlier sold in Japan. Color imageCLASS LBP660C Series/LBP 620C Series/X LBP1127C/MF740C Series/MF640C Series/X MF1127C firmware Ver.11.04 and earlier sold in US. i-SENSYS LBP660C Series/LBP620C Series/MF740C Series/MF640C Series, C1127P, C1127iF, C1127i firmware Ver.11.04 and earlier sold in Europe.
- Product
- Canon Office/Small Office Multifunction Printers and Laser Printers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2023Buffer overflow in CPCA Resource Download process of Office / Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the netwoCVE-2023-0851 · Other software · Canon Inc. · reported by f98c90f0-e9bd-4fa7-911b-51993f3571fdCritical 9.8
Buffer overflow in CPCA Resource Download process of Office / Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *:Satera LBP660C Series/LBP620C Series/MF740C Series/MF640C Series firmware Ver.11.04 and earlier sold in Japan. Color imageCLASS LBP660C Series/LBP 620C Series/X LBP1127C/MF740C Series/MF640C Series/X MF1127C firmware Ver.11.04 and earlier sold in US. i-SENSYS LBP660C Series/LBP620C Series/MF740C Series/MF640C Series, C1127P, C1127iF, C1127i firmware Ver.11.04 and earlier sold in Europe.
- Product
- Canon Office/Small Office Multifunction Printers and Laser Printers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2023A vulnerability was found in Weaver E-Office 9.5.CVE-2023-2648 · Other software · Weaver · reported by VulDBMedium 6.3
A vulnerability was found in Weaver E-Office 9.5. It has been classified as critical. This affects an unknown part of the file /inc/jquery/uploadify/uploadify.php. The manipulation of the argument Filedata leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-228777 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- E-Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.