Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
207 results · page 3 of 5
Aug 9, 2022Storage Spaces Direct Elevation of Privilege VulnerabilityCVE-2022-35792 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Storage Spaces Direct Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Aug 9, 2022Storage Spaces Direct Elevation of Privilege VulnerabilityCVE-2022-35765 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Storage Spaces Direct Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Aug 9, 2022Storage Spaces Direct Elevation of Privilege VulnerabilityCVE-2022-35764 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Storage Spaces Direct Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Aug 9, 2022Storage Spaces Direct Elevation of Privilege VulnerabilityCVE-2022-35763 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Storage Spaces Direct Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Aug 9, 2022Storage Spaces Direct Elevation of Privilege VulnerabilityCVE-2022-35762 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Storage Spaces Direct Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jul 28, 2022When connecting to Amazon Workspaces, the SHA256 presented by AWS connection provisioner is not fully verified by Zero Clients.CVE-2022-1805 · Other software · Teradici · reported by hp-security-alert@hp.comHigh 8.1
When connecting to Amazon Workspaces, the SHA256 presented by AWS connection provisioner is not fully verified by Zero Clients. The issue could be exploited by an adversary that places a MITM (Man in the Middle) between a zero client and AWS session provisioner in the network. This issue is only applicable when connecting to an Amazon Workspace from a PCoIP Zero Client.
- Product
- Tera2 Pcoip Zero Client Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hp.comsupport.hp.com
Jun 12, 2022In Octopus Server after version 2022.1.1495 and before 2022.1.2647 if private spaces were enabled via the experimental feature flag all new users would have accCVE-2022-2013 · Other software · Octopus Deploy · reported by security@octopus.comHigh 7.5
In Octopus Server after version 2022.1.1495 and before 2022.1.2647 if private spaces were enabled via the experimental feature flag all new users would have access to the Script Console within their private space.
- Product
- Octopus Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.octopus.comadvisories.octopus.com
Jun 2, 2022net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create user/net namespaces) to escalate privileges to root becauseCVE-2022-32250 · Other software · Siemens · reported by MITREHigh 7.8
net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create user/net namespaces) to escalate privileges to root because an incorrect NFT_STATEFUL_EXPR check leads to a use-after-free.
- Product
- SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
May 10, 2022Storage Spaces Direct Elevation of Privilege VulnerabilityCVE-2022-26939 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Storage Spaces Direct Elevation of Privilege Vulnerability
- Product
- Windows Server 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
May 10, 2022Storage Spaces Direct Elevation of Privilege VulnerabilityCVE-2022-26938 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Storage Spaces Direct Elevation of Privilege Vulnerability
- Product
- Windows Server 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
May 10, 2022Storage Spaces Direct Elevation of Privilege VulnerabilityCVE-2022-26932 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.2
Storage Spaces Direct Elevation of Privilege Vulnerability
- Product
- Windows Server 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Mar 27, 2022Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled.CVE-2022-24303 · Other software · Python · reported by MITRECritical 9.1
Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled.
- Product
- Pillow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.fedoraproject.org
Mar 23, 2022An unprivileged write to the file handler flaw in the Linux kernel's control groups and namespaces subsystem was found in the way users have access to some lessCVE-2021-4197 · Computers, phones & browsers · Linux · reported by Red HatHigh 7.8
An unprivileged write to the file handler flaw in the Linux kernel's control groups and namespaces subsystem was found in the way users have access to some less privileged process that are controlled by cgroups and have higher privileged parent process. It is actually both for cgroup2 and cgroup1 versions of control groups. A local user could use this flaw to crash the system or escalate their privileges on the system.
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comlore.kernel.org
Jan 29, 2022kernel/ucount.c in the Linux kernel 5.14 through 5.16.4, when unprivileged user namespaces are enabled, allows a use-after-free and privilege escalation becauseCVE-2022-24122 · Computers, phones & browsers · Linux · reported by MITREHigh 7.8
kernel/ucount.c in the Linux kernel 5.14 through 5.16.4, when unprivileged user namespaces are enabled, allows a use-after-free and privilege escalation because a ucounts object can outlive its namespace.
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggithub.com
Jan 11, 2022Storage Spaces Controller Information Disclosure VulnerabilityCVE-2022-21877 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Storage Spaces Controller Information Disclosure Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Dec 15, 2021Storage Spaces Controller Information Disclosure VulnerabilityCVE-2021-43235 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Storage Spaces Controller Information Disclosure Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Dec 15, 2021Storage Spaces Controller Information Disclosure VulnerabilityCVE-2021-43227 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Storage Spaces Controller Information Disclosure Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Dec 8, 2021When invoking protocol handlers for external protocols, a supplied parameter URL containing spaces was not properly escaped.CVE-2021-43541 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.5
When invoking protocol handlers for external protocols, a supplied parameter URL containing spaces was not properly escaped. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95.
- Product
- Thunderbird
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orglists.debian.org
Dec 7, 2021Amazon Amazon WorkSpaces agent is affected by Integer Overflow.CVE-2021-43638 · Other software · Amazon · reported by MITREHigh 8.8
Amazon Amazon WorkSpaces agent is affected by Integer Overflow. IOCTL Handler 0x22001B in the Amazon WorkSpaces agent below v1.0.1.1537 allow local attackers to execute arbitrary code in kernel mode or cause a denial of service (memory corruption and OS crash) via specially crafted I/O Request Packet.
- Product
- Workspaces
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsentinelone.comsentinelone.com
Dec 7, 2021Amazon WorkSpaces agent is affected by Buffer Overflow.CVE-2021-43637 · Other software · Amazon · reported by MITREHigh 8.8
Amazon WorkSpaces agent is affected by Buffer Overflow. IOCTL Handler 0x22001B in the Amazon WorkSpaces agent below v1.0.1.1537 allow local attackers to execute arbitrary code in kernel mode or cause a denial of service (memory corruption and OS crash) via specially crafted I/O Request Packet.
- Product
- Workspaces
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsentinelone.comsentinelone.com
Oct 12, 2021Storage Spaces Controller Elevation of Privilege VulnerabilityCVE-2021-41345 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Storage Spaces Controller Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comzerodayinitiative.com
Oct 12, 2021Storage Spaces Controller Elevation of Privilege VulnerabilityCVE-2021-40489 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Storage Spaces Controller Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comzerodayinitiative.com
Oct 12, 2021Storage Spaces Controller Elevation of Privilege VulnerabilityCVE-2021-40488 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Storage Spaces Controller Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comzerodayinitiative.com
Oct 12, 2021Storage Spaces Controller Elevation of Privilege VulnerabilityCVE-2021-40478 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Storage Spaces Controller Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comzerodayinitiative.com
Oct 12, 2021Storage Spaces Controller Elevation of Privilege VulnerabilityCVE-2021-26441 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Storage Spaces Controller Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comzerodayinitiative.com
Oct 5, 2021The FTL Server (tibftlserver) and Docker images containing tibftlserver components of TIBCO Software Inc.'s TIBCO ActiveSpaces - Community Edition, TIBCO ActiveCVE-2021-35497 · Other software · TIBCO Software Inc. · reported by security@tibco.comHigh 7.5
The FTL Server (tibftlserver) and Docker images containing tibftlserver components of TIBCO Software Inc.'s TIBCO ActiveSpaces - Community Edition, TIBCO ActiveSpaces - Developer Edition, TIBCO ActiveSpaces - Enterprise Edition, TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, TIBCO FTL - Enterprise Edition, TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, and TIBCO eFTL - Enterprise Edition contain a vulnerability that theoretically allows a non-administrative, authenticated FTL user to trick the affected components into creating illegitimate certificates. These maliciously generated certificates can be used to enable man-in-the-middle attacks or to escalate privileges so that the malicious user has administrative privileges. Affected releases are TIBCO Software Inc.'s TIBCO ActiveSpaces - Community Edition: versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.6.1, and 4.6.2, TIBCO ActiveSpaces - Developer Edition: versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.6.1, and 4.6.2, TIBCO ActiveSpaces - Enterprise Edition: versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.6.1, and 4.6.2, TIBCO FTL - Community Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, TIBCO
- Product
- TIBCO ActiveSpaces - Community Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2021In the Amazon AWS WorkSpaces client 3.0.10 through 3.1.8 on Windows, argument injection in the workspaces:// URI handler can lead to remote code execution becauCVE-2021-38112 · Other software · Amazon · reported by MITREHigh 8.8
In the Amazon AWS WorkSpaces client 3.0.10 through 3.1.8 on Windows, argument injection in the workspaces:// URI handler can lead to remote code execution because of the Chromium Embedded Framework (CEF) --gpu-launcher argument. This is fixed in 3.1.9.
- Product
- AWS Workspaces
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.aws.amazon.comrhinosecuritylabs.com
Aug 12, 2021Windows Storage Spaces Controller Elevation of Privilege VulnerabilityCVE-2021-34536 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Windows Storage Spaces Controller Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1507
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jul 26, 2021isula-build before 0.9.5-6 can cause a program crash, when building container images, some functions for processing external data do not remove spaces when procCVE-2021-33629 · Other software · Openeuler · reported by securities@openeuler.orgHigh 7.5
isula-build before 0.9.5-6 can cause a program crash, when building container images, some functions for processing external data do not remove spaces when processing data.
- Product
- Isula-build
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopeneuler.orgopeneuler.org
Jul 16, 2021Windows Storage Spaces Controller Elevation of Privilege VulnerabilityCVE-2021-34460 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Windows Storage Spaces Controller Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1507
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jul 14, 2021Windows Storage Spaces Controller Elevation of Privilege VulnerabilityCVE-2021-34513 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Windows Storage Spaces Controller Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1909
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jul 14, 2021Windows Storage Spaces Controller Elevation of Privilege VulnerabilityCVE-2021-34512 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Windows Storage Spaces Controller Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1507
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jul 14, 2021Windows Storage Spaces Controller Elevation of Privilege VulnerabilityCVE-2021-34510 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Windows Storage Spaces Controller Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jul 14, 2021Storage Spaces Controller Information Disclosure VulnerabilityCVE-2021-34509 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Storage Spaces Controller Information Disclosure Vulnerability
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jul 14, 2021Windows Storage Spaces Controller Elevation of Privilege VulnerabilityCVE-2021-33751 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Windows Storage Spaces Controller Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
May 22, 2021Multiple vulnerabilities in Cisco DNA Spaces Connector could allow an authenticated, remote attacker to perform a command injection attack on an affected deviceCVE-2021-1560 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.5
Multiple vulnerabilities in Cisco DNA Spaces Connector could allow an authenticated, remote attacker to perform a command injection attack on an affected device. These vulnerabilities are due to insufficient input sanitization when executing affected commands. A high-privileged attacker could exploit these vulnerabilities on a Cisco DNA Spaces Connector by injecting crafted input during command execution. A successful exploit could allow the attacker to execute arbitrary commands as root within the Connector docker container.
- Product
- Cisco DNA Spaces Connector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comtools.cisco.com
May 22, 2021Multiple vulnerabilities in Cisco DNA Spaces Connector could allow an authenticated, remote attacker to perform a command injection attack on an affected deviceCVE-2021-1559 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.5
Multiple vulnerabilities in Cisco DNA Spaces Connector could allow an authenticated, remote attacker to perform a command injection attack on an affected device. These vulnerabilities are due to insufficient input sanitization when executing affected commands. A high-privileged attacker could exploit these vulnerabilities on a Cisco DNA Spaces Connector by injecting crafted input during command execution. A successful exploit could allow the attacker to execute arbitrary commands as root within the Connector docker container.
- Product
- Cisco DNA Spaces Connector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comtools.cisco.com
May 22, 2021Multiple vulnerabilities in Cisco DNA Spaces Connector could allow an authenticated, local attacker to elevate privileges and execute arbitrary commands on the CVE-2021-1558 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6
Multiple vulnerabilities in Cisco DNA Spaces Connector could allow an authenticated, local attacker to elevate privileges and execute arbitrary commands on the underlying operating system as root. These vulnerabilities are due to insufficient restrictions during the execution of affected CLI commands. An attacker could exploit these vulnerabilities by leveraging the insufficient restrictions during execution of these commands. A successful exploit could allow the attacker to elevate privileges from dnasadmin and execute arbitrary commands on the underlying operating system as root.
- Product
- Cisco DNA Spaces Connector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comtools.cisco.com
May 22, 2021Multiple vulnerabilities in Cisco DNA Spaces Connector could allow an authenticated, local attacker to elevate privileges and execute arbitrary commands on the CVE-2021-1557 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6
Multiple vulnerabilities in Cisco DNA Spaces Connector could allow an authenticated, local attacker to elevate privileges and execute arbitrary commands on the underlying operating system as root. These vulnerabilities are due to insufficient restrictions during the execution of affected CLI commands. An attacker could exploit these vulnerabilities by leveraging the insufficient restrictions during execution of these commands. A successful exploit could allow the attacker to elevate privileges from dnasadmin and execute arbitrary commands on the underlying operating system as root.
- Product
- Cisco DNA Spaces Connector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comtools.cisco.com
May 17, 2021Access bypass vulnerability in of Drupal Core Workspaces allows an attacker to access data without correct permissions.CVE-2020-13667 · Websites & servers · Drupal · reported by mlhess@drupal.orgMedium 5.3
Access bypass vulnerability in of Drupal Core Workspaces allows an attacker to access data without correct permissions. The Workspaces module doesn't sufficiently check access permissions when switching workspaces, leading to an access bypass vulnerability. An attacker might be able to see content before the site owner intends people to see the content. This vulnerability is mitigated by the fact that sites are only vulnerable if they have installed the experimental Workspaces module. This issue affects Drupal Core8.8.X versions prior to 8.8.10; 8.9.X versions prior to 8.9.6; 9.0.X versions prior to 9.0.6.
- Product
- Drupal Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2021An Authentication Bypass vulnerability in the SAML Authentication component of BlackBerry Workspaces Server (deployed with Appliance-X) version(s) 10.1, 9.1 andCVE-2021-22155 · Other software · Blackberry · reported by secure@blackberry.comHigh 8.8
An Authentication Bypass vulnerability in the SAML Authentication component of BlackBerry Workspaces Server (deployed with Appliance-X) version(s) 10.1, 9.1 and earlier could allow an attacker to potentially gain access to the application in the context of the targeted user’s account.
- Product
- Workspaces Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.blackberry.comsupport.blackberry.com
Apr 28, 2021In Etherpad UeberDB < 0.4.4, due to MySQL omitting trailing spaces on char / varchar columns during comparisons, retrieving database records using UeberDB's MySCVE-2020-22784 · Other software · Etherpad · reported by MITREHigh 7.5
In Etherpad UeberDB < 0.4.4, due to MySQL omitting trailing spaces on char / varchar columns during comparisons, retrieving database records using UeberDB's MySQL connector could allow bypassing access controls enforced on key names.
- Product
- Ueberdb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2021The Windows Installation component of TIBCO Software Inc.'s TIBCO ActiveSpaces - Community Edition, TIBCO ActiveSpaces - Developer Edition, and TIBCO ActiveSpacCVE-2021-28824 · Other software · TIBCO Software Inc. · reported by security@tibco.comHigh 8.8
The Windows Installation component of TIBCO Software Inc.'s TIBCO ActiveSpaces - Community Edition, TIBCO ActiveSpaces - Developer Edition, and TIBCO ActiveSpaces - Enterprise Edition contains a vulnerability that theoretically allows a low privileged attacker with local access on some versions of the Windows operating system to insert malicious software. The affected component can be abused to execute the malicious software inserted by the attacker with the elevated privileges of the component. This vulnerability results from a lack of access restrictions on certain files and/or folders in the installation. Affected releases are TIBCO Software Inc.'s TIBCO ActiveSpaces - Community Edition: versions 4.5.0 and below, TIBCO ActiveSpaces - Developer Edition: versions 4.5.0 and below, and TIBCO ActiveSpaces - Enterprise Edition: versions 4.5.0 and below.
- Product
- TIBCO ActiveSpaces - Community Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2021Windows Storage Spaces Controller Elevation of Privilege VulnerabilityCVE-2021-26880 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Windows Storage Spaces Controller Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jan 26, 2021Jenkins 2.275 and LTS 2.263.2 allows reading arbitrary files using the file browser for workspaces and archived artifacts due to a time-of-check to time-of-use CVE-2021-21615 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.3
Jenkins 2.275 and LTS 2.263.2 allows reading arbitrary files using the file browser for workspaces and archived artifacts due to a time-of-check to time-of-use (TOCTOU) race condition.
- Product
- Jenkins
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Jan 13, 2021Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows reading arbitrary files using the file browser for workspaces and archived artifacts by following symlCVE-2021-21602 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 6.5
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows reading arbitrary files using the file browser for workspaces and archived artifacts by following symlinks.
- Product
- Jenkins
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2020HashiCorp Vault Enterprise’s Sentinel EGP policy feature incorrectly allowed requests to be processed in parent and sibling namespaces.CVE-2020-35453 · Other software · Hashicorp · reported by MITREMedium 5.3
HashiCorp Vault Enterprise’s Sentinel EGP policy feature incorrectly allowed requests to be processed in parent and sibling namespaces. Fixed in 1.5.6 and 1.6.1.
- Product
- Vault
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.hashicorp.comgithub.com
Dec 14, 2020A flaw was found in Eclipse Che in versions prior to 7.14.0 that impacts CodeReady Workspaces.CVE-2020-14368 · Other software · Eclipse · reported by Red HatHigh 7.1
A flaw was found in Eclipse Che in versions prior to 7.14.0 that impacts CodeReady Workspaces. When configured with cookies authentication, Theia IDE doesn't properly set the SameSite value, allowing a Cross-Site Request Forgery (CSRF) and consequently allowing a cross-site WebSocket hijack on Theia IDE. This flaw allows an attacker to gain full access to the victim's workspace through the /services endpoint. To perform a successful attack, the attacker conducts a Man-in-the-middle attack (MITM) and tricks the victim into executing a request via an untrusted link, which performs the CSRF and the Socket hijack. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
- Product
- CHE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.redhat.com
Nov 18, 2020A vulnerability in the web-based management interface of Cisco DNA Spaces Connector could allow an unauthenticated, remote attacker to execute arbitrary commandCVE-2020-3586 · Network & remote access · Cisco · reported by psirt@cisco.comCritical 9.4
A vulnerability in the web-based management interface of Cisco DNA Spaces Connector could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected device. The vulnerability is due to insufficient validation of user-supplied input in the web-based management interface. An attacker could exploit this vulnerability by sending crafted HTTP requests to the web-based management interface. A successful exploit could allow the attacker to execute arbitrary commands on the underling operating system with privileges of the web-based management application, which is running as a restricted user. This could result in changes being made to pages served by the web-based management application impacting the integrity or availability of the web-based management application.
- Product
- Cisco DNA Spaces Connector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comtools.cisco.com
Sep 16, 2020Jenkins Copy data to workspace Plugin 1.0 and earlier does not limit which directories can be copied from the Jenkins controller to job workspaces, allowing attCVE-2020-2275 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 6.5
Jenkins Copy data to workspace Plugin 1.0 and earlier does not limit which directories can be copied from the Jenkins controller to job workspaces, allowing attackers with Job/Configure permission to read arbitrary files on the Jenkins controller.
- Product
- Jenkins Copy data to workspace Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.