Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,802 results · page 28 of 57
Jul 19, 2023A type confusion vulnerability exists in the Javascript checkThisBox method as implemented in Foxit Reader 12.1.2.15332.CVE-2023-32664 · Other software · Foxit · reported by talos-cna@cisco.comHigh 8.8
A type confusion vulnerability exists in the Javascript checkThisBox method as implemented in Foxit Reader 12.1.2.15332. Specially crafted Javascript code inside a malicious PDF document can cause memory corruption and lead to remote code execution. User would need to open a malicious file to trigger the vulnerability.
- Product
- Foxit Reader
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Jul 19, 2023A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 12.1.1.15289.CVE-2023-28744 · Other software · Foxit · reported by talos-cna@cisco.comHigh 8.8
A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 12.1.1.15289. A specially crafted PDF document can trigger the reuse of previously freed memory by manipulating form fields of a specific type. This can lead to memory corruption and arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled.
- Product
- Foxit Reader
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Jul 19, 2023A use-after-free vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version 12.1.2.15332.CVE-2023-27379 · Other software · Foxit · reported by talos-cna@cisco.comHigh 8.8
A use-after-free vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version 12.1.2.15332. By prematurely deleting objects associated with pages, a specially crafted PDF document can trigger the reuse of previously freed memory, which can lead to arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled.
- Product
- Foxit Reader
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Jul 15, 2023CleverTap Cordova Plugin version 2.6.2 allows a remote attacker to execute JavaScript code in any application that is opened via a specially constructed deeplinCVE-2023-2507 · Other software · CleverTap · reported by help@fluidattacks.comCritical 9.3
CleverTap Cordova Plugin version 2.6.2 allows a remote attacker to execute JavaScript code in any application that is opened via a specially constructed deeplink by an attacker. This is possible because the plugin does not correctly validate the data coming from the deeplinks before using them.
- Product
- Cordova Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comgithub.com
Jul 14, 2023OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE).CVE-2023-37464 · Other software · OpenIDC · reported by GitHubHigh 8.6
OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). The AES GCM decryption routine incorrectly uses the Tag length from the actual Authentication Tag provided in the JWE. The spec says that a fixed length of 16 octets must be applied. Therefore this bug allows an attacker to provide a truncated Authentication Tag and to modify the JWE accordingly. Users should upgrade to a version >= 0.6.2.2. Users unable to upgrade should avoid using AES GCM encryption and replace it with another encryption algorithm (e.g. AES CBC).
- Product
- cjose
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddatatracker.ietf.orggithub.com
Jul 13, 2023Duktape is an 3rd-party embeddable JavaScript engine, with a focus on portability and compact footprint.CVE-2023-29458 · Other software · Zabbix · reported by security@zabbix.comMedium 5.9
Duktape is an 3rd-party embeddable JavaScript engine, with a focus on portability and compact footprint. When adding too many values in valstack JavaScript will crash. This issue occurs due to bug in Duktape 2.6 which is an 3rd-party solution that we use.
- Product
- Zabbix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.zabbix.comlists.debian.org
Jul 13, 2023JavaScript pre-processing can be used by the attacker to gain access to the file system (read-only access on behalf of user "zabbix") on the Zabbix Server or ZaCVE-2023-29450 · Other software · Zabbix · reported by security@zabbix.comHigh 8.5
JavaScript pre-processing can be used by the attacker to gain access to the file system (read-only access on behalf of user "zabbix") on the Zabbix Server or Zabbix Proxy, potentially leading to unauthorized access to sensitive data.
- Product
- Zabbix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orgsupport.zabbix.com
Jul 13, 2023JavaScript preprocessing, webhooks and global scripts can cause uncontrolled CPU, memory, and disk I/O utilization.CVE-2023-29449 · Other software · Zabbix · reported by security@zabbix.comMedium 5.9
JavaScript preprocessing, webhooks and global scripts can cause uncontrolled CPU, memory, and disk I/O utilization. Preprocessing/webhook/global script configuration and testing are only available to Administrative roles (Admin and Superadmin). Administrative privileges should be typically granted to users who need to perform tasks that require more control over the system. The security risk is limited because not all users have this level of access.
- Product
- Zabbix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.zabbix.comlists.debian.org
Jun 30, 2023pacparser_find_proxy in Pacparser before 1.4.2 allows JavaScript injection, and possibly privilege escalation, when the attacker controls the URL (which may be CVE-2023-37360 · Other software · Pacparser Project · reported by MITREMedium 5.9
pacparser_find_proxy in Pacparser before 1.4.2 allows JavaScript injection, and possibly privilege escalation, when the attacker controls the URL (which may be realistic within enterprise security products).
- Product
- Pacparser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 29, 2023Multiple Cross-Site Scripting (XSS) vulnerabilities have been identified in Gibbon v25.0.0, which enable attackers to execute arbitrary Javascript code.CVE-2023-34599 · Other software · Gibbonedu · reported by MITREMedium 6.1
Multiple Cross-Site Scripting (XSS) vulnerabilities have been identified in Gibbon v25.0.0, which enable attackers to execute arbitrary Javascript code.
- Product
- Gibbon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2023Shescape is a simple shell escape library for JavaScript.CVE-2023-35931 · Other software · ericcornelissen · reported by GitHubLow 3.1
Shescape is a simple shell escape library for JavaScript. An attacker may be able to get read-only access to environment variables. This bug has been patched in version 1.7.1.
- Product
- shescape
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2023A reflected cross-site scripting (XSS) vulnerability in the Captive Portal feature of Palo Alto Networks PAN-OS software can allow a JavaScript payload to be exCVE-2023-0010 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comMedium 5.4
A reflected cross-site scripting (XSS) vulnerability in the Captive Portal feature of Palo Alto Networks PAN-OS software can allow a JavaScript payload to be executed in the context of an authenticated Captive Portal user’s browser when they click on a specifically crafted link.
- Product
- PAN-OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.paloaltonetworks.comsecurity.paloaltonetworks.com
Jun 6, 2023fast-xml-parser is an open source, pure javascript xml parser.CVE-2023-34104 · Other software · NaturalIntelligence · reported by GitHubHigh 7.5
fast-xml-parser is an open source, pure javascript xml parser. fast-xml-parser allows special characters in entity names, which are not escaped or sanitized. Since the entity name is used for creating a regex for searching and replacing entities in the XML body, an attacker can abuse it for denial of service (DoS) attacks. By crafting an entity name that results in an intentionally bad performing regex and utilizing it in the entity replacement step of the parser, this can cause the parser to stall for an indefinite amount of time. This problem has been resolved in v4.2.4. Users are advised to upgrade. Users unable to upgrade should avoid using DOCTYPE parsing by setting the `processEntities: false` option.
- Product
- fast-xml-parser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2023In the Splunk App for Lookup File Editing versions below 4.0.1, a user can insert potentially malicious JavaScript code into the app, which causes that code to CVE-2023-32715 · Other software · Splunk · reported by prodsec@splunk.comMedium 4.7
In the Splunk App for Lookup File Editing versions below 4.0.1, a user can insert potentially malicious JavaScript code into the app, which causes that code to run on the user’s machine. The app itself does not contain the potentially malicious JavaScript code. The vulnerability requires the attacker to phish the victim by tricking them into initiating a request within their browser, and requires additional user interaction to trigger. The attacker cannot exploit the vulnerability at will.
- Product
- Splunk App for Lookup File Editing
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisory.splunk.comadvisory.splunk.com
May 31, 2023Deno is a runtime for JavaScript and TypeScript.CVE-2023-33966 · Other software · denoland · reported by GitHubHigh 8.6
Deno is a runtime for JavaScript and TypeScript. In deno 1.34.0 and deno_runtime 0.114.0, outbound HTTP requests made using the built-in `node:http` or `node:https` modules are incorrectly not checked against the network permission allow list (`--allow-net`). Dependencies relying on these built-in modules are subject to the vulnerability too. Users of Deno versions prior to 1.34.0 are unaffected. Deno Deploy users are unaffected. This problem has been patched in Deno v1.34.1 and deno_runtime 0.114.1 and all users are recommended to update to this version. No workaround is available for this issue.
- Product
- deno
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2023A user can supply malicious HTML and JavaScript code that will be executed in the client browserCVE-2023-23956 · Other software · Broadcom · reported by secure@symantec.comMedium 5.4
A user can supply malicious HTML and JavaScript code that will be executed in the client browser
- Product
- Symantec Siteminder Webagent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comsupport.broadcom.com
May 27, 2023socket.io parser is a socket.io encoder and decoder written in JavaScript complying with version 5 of socket.io-protocol.CVE-2023-32695 · Other software · socketio · reported by GitHubHigh 7.3
socket.io parser is a socket.io encoder and decoder written in JavaScript complying with version 5 of socket.io-protocol. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. A patch has been released in version 4.2.3.
- Product
- socket.io-parser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2023XSS vulnerability from InstantPlay in Galaxy Store prior to version 4.5.49.8 allows attackers to execute javascript API to install APK from Galaxy Store.CVE-2023-21516 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comHigh 7.5
XSS vulnerability from InstantPlay in Galaxy Store prior to version 4.5.49.8 allows attackers to execute javascript API to install APK from Galaxy Store.
- Product
- Galaxy Store
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
May 26, 2023InstantPlay which included vulnerable script which could execute javascript in Galaxy Store prior to version 4.5.49.8 allows attackers to execute javascript APICVE-2023-21515 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comHigh 7.5
InstantPlay which included vulnerable script which could execute javascript in Galaxy Store prior to version 4.5.49.8 allows attackers to execute javascript API to install APK from Galaxy Store.
- Product
- Galaxy Store
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
May 26, 2023Improper scheme validation from InstantPlay Deeplink in Galaxy Store prior to version 4.5.49.8 allows attackers to execute javascript API to install APK from GaCVE-2023-21514 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comHigh 7.5
Improper scheme validation from InstantPlay Deeplink in Galaxy Store prior to version 4.5.49.8 allows attackers to execute javascript API to install APK from Galaxy Store.
- Product
- Galaxy Store
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
May 22, 2023Beekeeper Studio versions prior to 3.9.9 allows a remote authenticated attacker to execute arbitrary JavaScript code with the privilege of the application on thCVE-2023-28394 · Other software · Beekeeper Studio, Inc. · reported by vultures@jpcert.or.jpHigh 8.8
Beekeeper Studio versions prior to 3.9.9 allows a remote authenticated attacker to execute arbitrary JavaScript code with the privilege of the application on the PC where the affected product is installed. As a result, an arbitrary OS command may be executed as well.
- Product
- Beekeeper Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2023An arbitrary file upload vulnerability in Serendipity 2.4-beta1 allows attackers to execute arbitrary code via a crafted HTML or Javascript file.CVE-2023-31576 · Other software · S9y · reported by MITREHigh 8.8
An arbitrary file upload vulnerability in Serendipity 2.4-beta1 allows attackers to execute arbitrary code via a crafted HTML or Javascript file.
- Product
- Serendipity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2023Not all valid JavaScript whitespace characters are considered to be whitespace.CVE-2023-24540 · Other software · Go standard library · reported by security@golang.orgCritical 9.8
Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the character set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain actions may not be properly sanitized during execution.
- Product
- html/template
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 3, 2023The setMediaSource function on the amzn.thin.pl service does not sanitize the "source" parameter allowing for arbitrary javascript code to be run This issue afCVE-2023-1384 · Other software · Amazon · reported by cve-requests@bitdefender.comMedium 4.3
The setMediaSource function on the amzn.thin.pl service does not sanitize the "source" parameter allowing for arbitrary javascript code to be run This issue affects: Amazon Fire TV Stick 3rd gen versions prior to 6.2.9.5. Insignia TV with FireOS versions prior to 7.6.3.3.
- Product
- Fire TV Stick 3rd gen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbitdefender.combitdefender.com
May 2, 2023Design documents with matching document IDs, from databases on the same cluster, may share a mutable Javascript environment when using these design document funCVE-2023-26268 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 4.4
Design documents with matching document IDs, from databases on the same cluster, may share a mutable Javascript environment when using these design document functions: * validate_doc_update * list * filter * filter views (using view functions as filters) * rewrite * update This doesn't affect map/reduce or search (Dreyfus) index functions. Users are recommended to upgrade to a version that is no longer affected by this issue (Apache CouchDB 3.3.2 or 3.2.3). Workaround: Avoid using design documents from untrusted sources which may attempt to cache or store data in the Javascript environment.
- Product
- Apache CouchDB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.couchdb.orglists.apache.org
Apr 28, 2023Anchor tag hrefs in Lexical prior to v0.10.0 would render javascript: URLs, allowing for cross-site scripting on link clicks in cases where input was being parsCVE-2023-30792 · Other software · Meta Platforms, Inc · reported by cve-assign@fb.comMedium 6.1
Anchor tag hrefs in Lexical prior to v0.10.0 would render javascript: URLs, allowing for cross-site scripting on link clicks in cases where input was being parsed from untrusted sources.
- Product
- Lexical
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2023@aedart/support is the support package for Ion, a monorepo for JavaScript/TypeScript packages.CVE-2023-30857 · Other software · aedart · reported by GitHubLow 3.7
@aedart/support is the support package for Ion, a monorepo for JavaScript/TypeScript packages. Prior to version `0.6.1`, there is a possible prototype pollution issue for the `MetadataRecord`, when merged with a base class' metadata object, in `meta` decorator from the `@aedart/support` package. The likelihood of exploitation is questionable, given that a class's metadata can only be set or altered when the class is decorated via `meta()`. Furthermore, object(s) of sensitive nature would have to be stored as metadata, before this can lead to a security impact. The issue has been patched in version `0.6.1`.
- Product
- ion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2023matrix-js-sdk is the Matrix Client-Server SDK for JavaScript and TypeScript.CVE-2023-29529 · Other software · matrix-org · reported by GitHubMedium 5
matrix-js-sdk is the Matrix Client-Server SDK for JavaScript and TypeScript. An attacker present in a room where an MSC3401 group call is taking place can eavesdrop on the video and audio of participants using matrix-js-sdk, without their knowledge. To affected matrix-js-sdk users, the attacker will not appear to be participating in the call. This attack is possible because matrix-js-sdk's group call implementation accepts incoming direct calls from other users, even if they have not yet declared intent to participate in the group call, as a means of resolving a race condition in call setup. Affected versions do not restrict access to the user's outbound media in this case. Legacy 1:1 calls are unaffected. This is fixed in matrix-js-sdk 24.1.0. As a workaround, users may hold group calls in private rooms where only the exact users who are expected to participate in the call are present.
- Product
- matrix-js-sdk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2023Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected.CVE-2023-24538 · Other software · Go standard library · reported by security@golang.orgCritical 9.8
Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected. Backticks are used, since ES6, for JS template literals. If a template contains a Go template action within a Javascript template literal, the contents of the action can be used to terminate the literal, injecting arbitrary Javascript code into the Go template. As ES6 template literals are rather complex, and themselves can do string interpolation, the decision was made to simply disallow Go template actions from being used inside of them (e.g. "var a = {{.}}"), since there is no obviously safe way to allow this behavior. This takes the same approach as github.com/google/safehtml. With fix, Template.Parse returns an Error when it encounters templates like this, with an ErrorCode of value 12. This ErrorCode is currently unexported, but will be exported in the release of Go 1.21. Users who rely on the previous behavior can re-enable it using the GODEBUG flag jstmpllitinterp=1, with the caveat that backticks will now be escaped. This should be used with caution.
- Product
- html/template
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2023Yellobrik PEC-1864 implements authentication checks via javascript in the frontend interface.CVE-2023-0750 · Other software · Lynx Technik AG · reported by vulnerability@ncsc.chCritical 9.8
Yellobrik PEC-1864 implements authentication checks via javascript in the frontend interface. When the device can be accessed over the network an attacker could bypass authentication. This would allow an attacker to : - Change the password, resulting in a DOS of the users - Change the streaming source, compromising the integrity of the stream - Change the streaming destination, compromising the confidentiality of the stream This issue affects Yellowbrik: PEC 1864. No patch has been issued by the manufacturer as this model was discontinued.
- Product
- Yellowbrik
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lynx-technik.comsupport.lynx-technik.com
Apr 4, 2023Cross Site Scripting vulnerability found in Phachon mm-wiki v.0.1.2 allows a remote attacker to execute arbitrary code via javascript code in the markdown editoCVE-2020-19277 · Other software · Mm-wiki Project · reported by MITREMedium 5.4
Cross Site Scripting vulnerability found in Phachon mm-wiki v.0.1.2 allows a remote attacker to execute arbitrary code via javascript code in the markdown editor.
- Product
- Mm-wiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2023A reflected XSS via POST vulnerability in report scheduler of Sophos Web Appliance versions older than 4.3.10.4 allows execution of JavaScript code in the victiCVE-2020-36692 · Network & remote access · Sophos · reported by security-alert@sophos.comMedium 6.5
A reflected XSS via POST vulnerability in report scheduler of Sophos Web Appliance versions older than 4.3.10.4 allows execution of JavaScript code in the victim browser via a malicious form that must be manually submitted by the victim while logged in to SWA.
- Product
- Sophos Web Appliance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2023Jenkins Mashup Portlets Plugin 1.1.2 and earlier provides the "Generic JS Portlet" feature that lets a user populate a portlet using a custom JavaScript expressCVE-2023-28679 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Mashup Portlets Plugin 1.1.2 and earlier provides the "Generic JS Portlet" feature that lets a user populate a portlet using a custom JavaScript expression, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by authenticated attackers with Overall/Read permission.
- Product
- Jenkins Mashup Portlets Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2023Jenkins Pipeline Aggregator View Plugin 1.13 and earlier does not escape a variable representing the current view's URL in inline JavaScript, resulting in a stoCVE-2023-28670 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Pipeline Aggregator View Plugin 1.13 and earlier does not escape a variable representing the current view's URL in inline JavaScript, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by authenticated attackers with Overall/Read permission.
- Product
- Jenkins Pipeline Aggregator View Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2023Unpoly is a JavaScript framework for server-side web applications.CVE-2023-28846 · Other software · unpoly · reported by GitHubMedium 5.9
Unpoly is a JavaScript framework for server-side web applications. There is a possible Denial of Service (DoS) vulnerability in the `unpoly-rails` gem that implements the Unpoly server protocol for Rails applications. This issues affects Rails applications that operate as an upstream of a load balancer's that uses passive health checks. The `unpoly-rails` gem echoes the request URL as an `X-Up-Location` response header. By making a request with exceedingly long URLs (paths or query string), an attacker can cause unpoly-rails to write a exceedingly large response header. If the response header is too large to be parsed by a load balancer downstream of the Rails application, it may cause the load balancer to remove the upstream from a load balancing group. This causes that application instance to become unavailable until a configured timeout is reached or until an active healthcheck succeeds. This issue has been fixed and released as version 2.7.2.2 which is available via RubyGems and GitHub. Users unable to upgrade may: Configure your load balancer to use active health checks, e.g. by periodically requesting a route with a known response that indicates healthiness; Configure your l
- Product
- unpoly-rails
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.nginx.comgithub.com
Mar 28, 2023matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript.CVE-2023-28427 · Other software · matrix-org · reported by GitHubHigh 8.2
matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. In versions prior to 24.0.0 events sent with special strings in key places can temporarily disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer's ability to process data safely. Note that the matrix-js-sdk can appear to be operating normally but be excluding or corrupting runtime data presented to the consumer. This vulnerability is distinct from GHSA-rfv9-x7hh-xc32 which covers a similar issue. The issue has been patched in matrix-js-sdk 24.0.0 and users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- matrix-js-sdk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Mar 28, 2023matrix-react-sdk is a Matrix chat protocol SDK for React Javascript.CVE-2023-28103 · Other software · matrix-org · reported by GitHubHigh 8.2
matrix-react-sdk is a Matrix chat protocol SDK for React Javascript. In certain configurations, data sent by remote servers containing special strings in key locations could cause modifications of the `Object.prototype`, disrupting matrix-react-sdk functionality, causing denial of service and potentially affecting program logic. This is fixed in matrix-react-sdk 3.69.0 and users are advised to upgrade. There are no known workarounds for this vulnerability. Note this advisory is distinct from GHSA-2x9c-qwgf-94xr which refers to a similar issue.
- Product
- matrix-react-sdk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2023matrix-react-sdk is a Matrix chat protocol SDK for React Javascript.CVE-2022-36060 · Other software · matrix-org · reported by GitHubHigh 8.2
matrix-react-sdk is a Matrix chat protocol SDK for React Javascript. Events sent with special strings in key places can temporarily disrupt or impede the matrix-react-sdk from functioning properly, such as by causing room or event tile crashes. The remainder of the application can appear functional, though certain rooms/events will not be rendered. This issue has been fixed in matrix-react-sdk 3.53.0 and users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- matrix-react-sdk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2023matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript.CVE-2022-36059 · Other software · matrix-org · reported by GitHubHigh 8.2
matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. In versions prior to 19.4.0 events sent with special strings in key places can temporarily disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer's ability to process data safely. Note that the matrix-js-sdk can appear to be operating normally but be excluding or corrupting runtime data presented to the consumer. This issue has been fixed in matrix-js-sdk 19.4.0 and users are advised to upgrade. Users unable to upgrade may mitigate this issue by redacting applicable events, waiting for the sync processor to store data, and restarting the client. Alternatively, redacting the applicable events and clearing all storage will often fix most perceived issues. In some cases, no workarounds are possible.
- Product
- matrix-js-sdk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2023Deno is a simple, modern and secure runtime for JavaScript and TypeScript that uses V8 and is built in Rust.CVE-2023-28446 · Other software · denoland · reported by GitHubHigh 8.8
Deno is a simple, modern and secure runtime for JavaScript and TypeScript that uses V8 and is built in Rust. Arbitrary program names without any ANSI filtering allows any malicious program to clear the first 2 lines of a `op_spawn_child` or `op_kill` prompt and replace it with any desired text. This works with any command on the respective platform, giving the program the full ability to choose what program they wanted to run. This problem can not be exploited on systems that do not attach an interactive prompt (for example headless servers). This issue has been patched in version 1.31.2.
- Product
- deno
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2023Deno is a runtime for JavaScript and TypeScript that uses V8 and is built in Rust.CVE-2023-28445 · Other software · denoland · reported by GitHubCritical 9.9
Deno is a runtime for JavaScript and TypeScript that uses V8 and is built in Rust. Resizable ArrayBuffers passed to asynchronous functions that are shrunk during the asynchronous operation could result in an out-of-bound read/write. It is unlikely that this has been exploited in the wild, as the only version affected is Deno 1.32.0. Deno Deploy users are not affected. The problem has been resolved by disabling resizable ArrayBuffers temporarily in Deno 1.32.1. Deno 1.32.2 will re-enable resizable ArrayBuffers with a proper fix. As a workaround, run with `--v8-flags=--no-harmony-rab-gsab` to disable resizable ArrayBuffers.
- Product
- deno
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 14, 2023Cross-Site Request Forgery (CSRF) vulnerability in Pi Websolution CSS JS Manager, Async JavaScript, Defer Render Blocking CSS supports WooCommerce plugin <= 2.4CVE-2022-47154 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Pi Websolution CSS JS Manager, Async JavaScript, Defer Render Blocking CSS supports WooCommerce plugin <= 2.4.49 versions.
- Affected
- up to 2.4.49
- What to do
- Affects up to 2.4.49. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 6, 2023A stored Cross-site Scripting (XSS) vulnerability in BlogEngine.NET 3.3.8.0, allows injection of arbitrary JavaScript in the security context of a blog visitor CVE-2023-22857 · Other software · BlogEngine.NET · reported by vdp@themissinglink.com.auHigh 8.5
A stored Cross-site Scripting (XSS) vulnerability in BlogEngine.NET 3.3.8.0, allows injection of arbitrary JavaScript in the security context of a blog visitor through an injection of a malicious payload into a blog post.
- Product
- BlogEngine.NET
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordthemissinglink.com.authemissinglink.com.au
Mar 6, 2023A stored Cross-site Scripting (XSS) vulnerability in BlogEngine.NET 3.3.8.0, allows injection of arbitrary JavaScript in the security context of a blog visitor CVE-2023-22856 · Other software · BlogEngine.NET · reported by vdp@themissinglink.com.auHigh 8.5
A stored Cross-site Scripting (XSS) vulnerability in BlogEngine.NET 3.3.8.0, allows injection of arbitrary JavaScript in the security context of a blog visitor through an upload of a specially crafted file.
- Product
- BlogEngine.NET
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordthemissinglink.com.authemissinglink.com.au
Mar 1, 2023Multiple stored XSS vulnerabilities in Sophos Connect versions older than 2.2.90 allow Javascript code to run in the local UI via a malicious VPN configuration CVE-2022-4901 · Network & remote access · Sophos · reported by security-alert@sophos.comLow 3.3
Multiple stored XSS vulnerabilities in Sophos Connect versions older than 2.2.90 allow Javascript code to run in the local UI via a malicious VPN configuration that must be manually loaded by the victim.
- Product
- Sophos Connect Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2023Improper neutralization of input during web page generation allows an authenticated attacker with access to a restricted account to submit malicious Javascript CVE-2023-27294 · Other software · Opencats · reported by vulnreport@tenable.comMedium 5.4
Improper neutralization of input during web page generation allows an authenticated attacker with access to a restricted account to submit malicious Javascript as the description for a calendar event, which would then be executed in other users' browsers if they browse to that event. This could result in stealing session tokens from users with higher permission levels or forcing users to make actions without their knowledge.
- Product
- Opencats
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Feb 28, 2023Improper neutralization of input during web page generation allows an unauthenticated attacker to submit malicious Javascript as the answer to a questionnaire wCVE-2023-27293 · Other software · Opencats · reported by vulnreport@tenable.comMedium 6.1
Improper neutralization of input during web page generation allows an unauthenticated attacker to submit malicious Javascript as the answer to a questionnaire which would then be executed when an authenticated user reviews the candidate's submission. This could be used to steal other users’ cookies and force users to make actions without their knowledge.
- Product
- Opencats
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Feb 16, 2023Scanning a QR code that contained a javascript: URL would have resulted in the Javascript being executed.CVE-2019-17003 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.1
Scanning a QR code that contained a javascript: URL would have resulted in the Javascript being executed.
- Product
- Firefox for iOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgbugzilla.mozilla.org
Feb 16, 2023node-jose is a JavaScript implementation of the JSON Object Signing and Encryption (JOSE) for web browsers and node.js-based servers.CVE-2023-25653 · Network & remote access · cisco · reported by GitHubHigh 7.5
node-jose is a JavaScript implementation of the JSON Object Signing and Encryption (JOSE) for web browsers and node.js-based servers. Prior to version 2.2.0, when using the non-default "fallback" crypto back-end, ECC operations in `node-jose` can trigger a Denial-of-Service (DoS) condition, due to a possible infinite loop in an internal calculation. For some ECC operations, this condition is triggered randomly; for others, it can be triggered by malicious input. The issue has been patched in version 2.2.0. Since this issue is only present in the "fallback" crypto implementation, it can be avoided by ensuring that either WebCrypto or the Node `crypto` module is available in the JS environment where `node-jose` is being run.
- Product
- node-jose
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2023Jenkins Pipeline: Build Step Plugin 2.18 and earlier does not escape job names in a JavaScript expression used in the Pipeline Snippet Generator, resulting in aCVE-2023-25762 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Pipeline: Build Step Plugin 2.18 and earlier does not escape job names in a JavaScript expression used in the Pipeline Snippet Generator, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control job names.
- Product
- Jenkins Pipeline: Build Step Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.