Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
204 results · page 3 of 5
Feb 22, 2025Vitepos: Missing AuthorizationCVE-2025-26750 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in appsbd Vitepos vitepos-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Vitepos: from n/a through <= 3.1.3.
- Product
- Vitepos
- Affected
- up to 3.1.3
- What to do
- Affects up to 3.1.3. Update Vitepos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 4, 2025Vitest is a testing framework powered by Vite.CVE-2025-24964 · Other software · vitest-dev · reported by GitHubCritical 9.6
Vitest is a testing framework powered by Vite. Affected versions are subject to arbitrary remote Code Execution when accessing a malicious website while Vitest API server is listening by Cross-site WebSocket hijacking (CSWSH) attacks. When `api` option is enabled (Vitest UI enables it), Vitest starts a WebSocket server. This WebSocket server did not check Origin header and did not have any authorization mechanism and was vulnerable to CSWSH attacks. This WebSocket server has `saveTestFile` API that can edit a test file and `rerun` API that can rerun the tests. An attacker can execute arbitrary code by injecting a code in a test file by the `saveTestFile` API and then running that file by calling the `rerun` API. This vulnerability can result in remote code execution for users that are using Vitest serve API. This issue has been patched in versions 1.6.1, 2.1.9 and 3.0.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- vitest
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2025Vitest is a testing framework powered by Vite.CVE-2025-24963 · Other software · vitest-dev · reported by GitHubMedium 5.9
Vitest is a testing framework powered by Vite. The `__screenshot-error` handler on the browser mode HTTP server that responds any file on the file system. Especially if the server is exposed on the network by `browser.api.host: true`, an attacker can send a request to that handler from remote to get the content of arbitrary files.This `__screenshot-error` handler on the browser mode HTTP server responds any file on the file system. This code was added by commit `2d62051`. Users explicitly exposing the browser mode server to the network by `browser.api.host: true` may get any files exposed. This issue has been addressed in versions 2.1.9 and 3.0.4. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- vitest
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2025Vite is a frontend tooling framework for javascript.CVE-2025-24010 · Other software · vitejs · reported by GitHubMedium 6.5
Vite is a frontend tooling framework for javascript. Vite allowed any websites to send any requests to the development server and read the response due to default CORS settings and lack of validation on the Origin header for WebSocket connections. This vulnerability is fixed in 6.0.9, 5.4.12, and 4.5.6.
- Product
- vite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2025Mattermost versions 9.11.x <= 9.11.5 fail to enforce invite permissions, which allows team admins, with no permission to invite users to their team, to invite uCVE-2025-22449 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comLow 3.8
Mattermost versions 9.11.x <= 9.11.5 fail to enforce invite permissions, which allows team admins, with no permission to invite users to their team, to invite users by updating the "allow_open_invite" field via making their team public.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2024Vitess is a database clustering system for horizontal scaling of MySQL.CVE-2024-53257 · Other software · vitessio · reported by GitHubMedium 4.9
Vitess is a database clustering system for horizontal scaling of MySQL. The /debug/querylogz and /debug/env pages for vtgate and vttablet do not properly escape user input. The result is that queries executed by Vitess can write HTML into the monitoring page at will. These pages are rendered using text/template instead of rendering with a proper HTML templating engine. This vulnerability is fixed in 21.0.1, 20.0.4, and 19.0.8.
- Product
- vitess
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2024The 'Project Manager' WordPress Plugin is affected by an authenticated SQL injection vulnerability in the 'orderby' parameter in the '/pm/v2/activites' route.CVE-2024-12015 · WordPress plugins & themes · reported by vulnreport@tenable.comHigh 7.7
The 'Project Manager' WordPress Plugin is affected by an authenticated SQL injection vulnerability in the 'orderby' parameter in the '/pm/v2/activites' route.
- What to do
- Update the plugin to the newest version.
Nov 16, 2024In Flagsmith before 2.134.1, it is possible to bypass the ALLOW_REGISTRATION_WITHOUT_INVITE setting.CVE-2024-52871 · Other software · flagsmith · reported by MITREHigh 7.5
In Flagsmith before 2.134.1, it is possible to bypass the ALLOW_REGISTRATION_WITHOUT_INVITE setting.
- Product
- flagsmith
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2024Organization admins can delete pending invites created in an organization they are not part of.CVE-2024-10452 · Other software · Grafana · reported by security@grafana.comLow 2.2
Organization admins can delete pending invites created in an organization they are not part of.
- Product
- Grafana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2024Netgear R7000 1.0.11.136 is vulnerable to Command Injection in RMT_invite.cgi via device_name2 parameter.CVE-2024-35520 · Network & remote access · netgear · reported by MITREHigh 8.4
Netgear R7000 1.0.11.136 is vulnerable to Command Injection in RMT_invite.cgi via device_name2 parameter.
- Product
- r7000_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2024Vite a frontend build tooling framework for javascript.CVE-2024-45812 · Other software · vitejs · reported by GitHubMedium 6.4
Vite a frontend build tooling framework for javascript. Affected versions of vite were discovered to contain a DOM Clobbering vulnerability when building scripts to `cjs`/`iife`/`umd` output format. The DOM Clobbering gadget in the module can lead to cross-site scripting (XSS) in web pages where scriptless attacker-controlled HTML elements (e.g., an img tag with an unsanitized name attribute) are present. DOM Clobbering is a type of code-reuse attack where the attacker first embeds a piece of non-script, seemingly benign HTML markups in the webpage (e.g. through a post or comment) and leverages the gadgets (pieces of js code) living in the existing javascript code to transform it into executable code. We have identified a DOM Clobbering vulnerability in Vite bundled scripts, particularly when the scripts dynamically import other scripts from the assets folder and the developer sets the build output format to `cjs`, `iife`, or `umd`. In such cases, Vite replaces relative paths starting with `__VITE_ASSET__` using the URL retrieved from `document.currentScript`. However, this implementation is vulnerable to a DOM Clobbering attack. The `document.currentScript` lookup can be shadowed
- Product
- vite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2024Vite a frontend build tooling framework for javascript.CVE-2024-45811 · Other software · vitejs · reported by GitHubMedium 4.8
Vite a frontend build tooling framework for javascript. In affected versions the contents of arbitrary files can be returned to the browser. `@fs` denies access to files outside of Vite serving allow list. Adding `?import&raw` to the URL bypasses this limitation and returns the file content if it exists. This issue has been patched in versions 5.4.6, 5.3.6, 5.2.14, 4.5.5, and 3.2.11. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- vite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2024Invite Anyone: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43327 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Boone Gorges Invite Anyone allows Reflected XSS.This issue affects Invite Anyone: from n/a through 1.4.7.
- Product
- Invite Anyone
- Affected
- up to 1.4.7
- What to do
- Affects up to 1.4.7. Update Invite Anyone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 5, 2024The lacks CSRF checks allowing a user to invite any user to any group (including private groups)CVE-2024-2232 · WordPress plugins & themes · reported by WPScanHigh 8.1
The lacks CSRF checks allowing a user to invite any user to any group (including private groups)
- Fixed in
- 2.1.3
- What to do
- Update the plugin to 2.1.3 or newer.
Aug 1, 2024Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5 and 9.8.x <= 9.8.1 fail to disallow unsolicited invites to expose access to local channels, wCVE-2024-39777 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comHigh 8.7
Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5 and 9.8.x <= 9.8.1 fail to disallow unsolicited invites to expose access to local channels, when shared channels are enabled, which allows a malicious remote to send an invite with the ID of an existing local channel, and that local channel will then become shared without the consent of the local admin.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2024In lunary-ai/lunary versions 1.2.2 through 1.2.25, an improper access control vulnerability allows users on the Free plan to invite other members and assign theCVE-2024-5127 · Other software · lunary-ai · reported by security@huntr.devMedium 5.4
In lunary-ai/lunary versions 1.2.2 through 1.2.25, an improper access control vulnerability allows users on the Free plan to invite other members and assign them any role, including those intended for Paid and Enterprise plans only. This issue arises due to insufficient backend validation of roles and permissions, enabling unauthorized users to join a project and potentially exploit roles and permissions not intended for their use. The vulnerability specifically affects the Team feature, where the backend fails to validate whether a user has paid for a plan before allowing them to send invite links with any role assigned. This could lead to unauthorized access and manipulation of project settings or data.
- Product
- lunary-ai/lunary
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2024Insecure Permissions vulnerability in VITEC AvediaServer (Model avsrv-m8105) 8.6.2-1 allows a remote attacker to escalate privileges via a crafted script.CVE-2024-35102 · Other software · vitec · reported by MITREHigh 8.8
Insecure Permissions vulnerability in VITEC AvediaServer (Model avsrv-m8105) 8.6.2-1 allows a remote attacker to escalate privileges via a crafted script.
- Product
- exterity_avediaserver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvuln2you.blogspot.comvuln2you.blogspot.com
May 8, 2024Vitepos: Missing AuthorizationCVE-2024-33574 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in appsbd Vitepos.This issue affects Vitepos: from n/a through 3.0.1.
- Product
- Vitepos
- Affected
- up to 3.0.1
- What to do
- Affects up to 3.0.1. Update Vitepos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 8, 2024Vitess is a database clustering system for horizontal scaling of MySQL.CVE-2024-32886 · Other software · vitessio · reported by GitHubMedium 4.9
Vitess is a database clustering system for horizontal scaling of MySQL. When executing the following simple query, the `vtgate` will go into an endless loop that also keeps consuming memory and eventually will run out of memory. This vulnerability is fixed in 19.0.4, 18.0.5, and 17.0.7.
- Product
- vitess
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2024A race condition vulnerability exists in the mintplex-labs/anything-llm repository, specifically within the user invite acceptance process.CVE-2024-2913 · Other software · mintplex-labs · reported by security@huntr.devMedium 6.5
A race condition vulnerability exists in the mintplex-labs/anything-llm repository, specifically within the user invite acceptance process. Attackers can exploit this vulnerability by sending multiple concurrent requests to accept a single user invite, allowing the creation of multiple user accounts from a single invite link intended for only one user. This bypasses the intended security mechanism that restricts invite acceptance to a single user, leading to unauthorized user creation without detection in the invite tab. The issue is due to the lack of validation for concurrent requests in the backend.
- Product
- mintplex-labs/anything-llm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2024A mass assignment vulnerability exists in the `/api/invite/:code` endpoint of the mintplex-labs/anything-llm repository, allowing unauthorized creation of high-CVE-2024-0404 · Other software · mintplex-labs · reported by security@huntr.devCritical 9.1
A mass assignment vulnerability exists in the `/api/invite/:code` endpoint of the mintplex-labs/anything-llm repository, allowing unauthorized creation of high-privileged accounts. By intercepting and modifying the HTTP request during the account creation process via an invitation link, an attacker can add a `role` property with `admin` value, thereby gaining administrative access. This issue arises due to the lack of property allowlisting and blocklisting, enabling the attacker to exploit the system and perform actions as an administrator.
- Product
- mintplex-labs/anything-llm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2024Vite (French word for "quick", pronounced /vit/, like "veet") is a frontend build tooling to improve the frontend development experience.`server.fs.deny` does nCVE-2024-31207 · Other software · vitejs · reported by GitHubMedium 5.9
Vite (French word for "quick", pronounced /vit/, like "veet") is a frontend build tooling to improve the frontend development experience.`server.fs.deny` does not deny requests for patterns with directories. This vulnerability has been patched in version(s) 5.2.6, 5.1.7, 5.0.13, 4.5.3, 3.2.10 and 2.9.18.
- Product
- vite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 29, 2024Mattermost fails to check the "invite_guest" permission when inviting guests of other teams to a team, allowing a member with permissions to add other members bCVE-2024-1888 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 4.3
Mattermost fails to check the "invite_guest" permission when inviting guests of other teams to a team, allowing a member with permissions to add other members but not to add guests to add a guest to a team as long as the guest was already a guest in another team of the server
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jan 19, 2024Vite is a frontend tooling framework for javascript.CVE-2024-23331 · Other software · vitejs · reported by GitHubHigh 7.5
Vite is a frontend tooling framework for javascript. The Vite dev server option `server.fs.deny` can be bypassed on case-insensitive file systems using case-augmented versions of filenames. Notably this affects servers hosted on Windows. This bypass is similar to CVE-2023-34092 -- with surface area reduced to hosts having case-insensitive filesystems. Since `picomatch` defaults to case-sensitive glob matching, but the file server doesn't discriminate; a blacklist bypass is possible. By requesting raw filesystem paths using augmented casing, the matcher derived from `config.server.fs.deny` fails to block access to sensitive files. This issue has been addressed in vite@5.0.12, vite@4.5.2, vite@3.2.8, and vite@2.9.17. Users are advised to upgrade. Users unable to upgrade should restrict access to dev servers.
- Product
- vite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2024WP Discord Invite: Does not protect some of its actions against CSRF attacksCVE-2023-5006 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP Discord Invite WordPress plugin before 2.5.1 does not protect some of its actions against CSRF attacks, allowing an unauthenticated attacker to perform actions on their behalf by tricking a logged in administrator to submit a crafted request.
- Product
- WP Discord Invite
- Fixed in
- 2.5.1
- What to do
- Update WP Discord Invite to 2.5.1 or newer.
Dec 4, 2023Vite is a website frontend framework.CVE-2023-49293 · Other software · vitejs · reported by GitHubMedium 6.1
Vite is a website frontend framework. When Vite's HTML transformation is invoked manually via `server.transformIndexHtml`, the original request URL is passed in unmodified, and the `html` being transformed contains inline module scripts (`<script type="module">...</script>`), it is possible to inject arbitrary HTML into the transformed output by supplying a malicious URL query string to `server.transformIndexHtml`. Only apps using `appType: 'custom'` and using the default Vite HTML middleware are affected. The HTML entry must also contain an inline script. The attack requires a user to click on a malicious URL while running the dev server. Restricted files aren't exposed to the attacker. This issue has been addressed in vite@5.0.5, vite@4.5.1, and vite@4.4.12. There are no known workarounds for this vulnerability.
- Product
- vite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2023WP Discord Invite: Does not sanitise and escape some of its settingsCVE-2023-5181 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Discord Invite WordPress plugin before 2.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP Discord Invite
- Fixed in
- 2.5.2
- What to do
- Update WP Discord Invite to 2.5.2 or newer.
Aug 7, 2023Netgear R7100LG 1.0.0.78 was discovered to contain a command injection vulnerability via the password parameter at usb_remote_invite.cgi.CVE-2023-38928 · Network & remote access · netgear · reported by MITRECritical 9.8
Netgear R7100LG 1.0.0.78 was discovered to contain a command injection vulnerability via the password parameter at usb_remote_invite.cgi.
- Product
- r7100lg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2023Mattermost WelcomeBot plugin fails to to validate the membership status when inviting or adding users to channels allowing guest accounts to be added or invitedCVE-2023-3613 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comLow 3.5
Mattermost WelcomeBot plugin fails to to validate the membership status when inviting or adding users to channels allowing guest accounts to be added or invited to channels by default.
- Product
- Mattermost Plugins
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jun 28, 2023In inviteInternal of p2p_iface.cpp, there is a possible out of bounds read due to a missing bounds check.CVE-2023-21169 · Computers, phones & browsers · Google · reported by security@android.comMedium 4.4
In inviteInternal of p2p_iface.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-274443441
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Jun 1, 2023Vite provides frontend tooling.CVE-2023-34092 · Other software · vitejs · reported by GitHubHigh 7.5
Vite provides frontend tooling. Prior to versions 2.9.16, 3.2.7, 4.0.5, 4.1.5, 4.2.3, and 4.3.9, Vite Server Options (`server.fs.deny`) can be bypassed using double forward-slash (//) allows any unauthenticated user to read file from the Vite root-path of the application including the default `fs.deny` settings (`['.env', '.env.*', '*.{crt,pem}']`). Only users explicitly exposing the Vite dev server to the network (using `--host` or `server.host` config option) are affected, and only files in the immediate Vite project root folder could be exposed. This issue is fixed in vite@4.3.9, vite@4.2.3, vite@4.1.5, vite@4.0.5, vite@3.2.7, and vite@2.9.16.
- Product
- vite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2023Vitess is a database clustering system for horizontal scaling of MySQL through generalized sharding.CVE-2023-29195 · Other software · vitessio · reported by GitHubMedium 4.1
Vitess is a database clustering system for horizontal scaling of MySQL through generalized sharding. Prior to version 16.0.2, users can either intentionally or inadvertently create a shard containing `/` characters from VTAdmin such that from that point on, anyone who tries to create a new shard from VTAdmin will receive an error. Attempting to view the keyspace(s) will also no longer work. Creating a shard using `vtctldclient` does not have the same problem because the CLI validates the input correctly. Version 16.0.2, corresponding to version 0.16.2 of the `go` module, contains a patch for this issue. Some workarounds are available. Always use `vtctldclient` to create shards, instead of using VTAdmin; disable creating shards from VTAdmin using RBAC; and/or delete the topology record for the offending shard using the client for your topology server.
- Product
- vitess
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2023Vitess is a database clustering system for horizontal scaling of MySQL.CVE-2023-29194 · Other software · vitessio · reported by GitHubMedium 4.1
Vitess is a database clustering system for horizontal scaling of MySQL. Users can either intentionally or inadvertently create a keyspace containing `/` characters such that from that point on, anyone who tries to view keyspaces from VTAdmin will receive an error. Trying to list all the keyspaces using `vtctldclient GetKeyspaces` will also return an error. Note that all other keyspaces can still be administered using the CLI (vtctldclient). This issue is fixed in version 16.0.1. As a workaround, delete the offending keyspace using a CLI client (vtctldclient).
- Product
- vitess
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2023When processing an email invite to a private channel on a team, Mattermost fails to validate the inviter's permission to that channel, allowing an attacker to iCVE-2023-1774 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 4.2
When processing an email invite to a private channel on a team, Mattermost fails to validate the inviter's permission to that channel, allowing an attacker to invite themselves to a private channel.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Mar 15, 2023The Kamailio SIP before 5.5.0 server mishandles INVITE requests with duplicated fields and overlength tag, leading to a buffer overflow that crashes the server CVE-2020-27507 · Other software · Kamailio · reported by MITRECritical 9.8
The Kamailio SIP before 5.5.0 server mishandles INVITE requests with duplicated fields and overlength tag, leading to a buffer overflow that crashes the server or possibly have unspecified other impact.
- Product
- Kamailio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2023Mattermost fails to honor the ShowEmailAddress setting when constructing a response to the "Regenerate Invite Id" API endpoint, allowing an attacker with team aCVE-2023-27265 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comLow 2.7
Mattermost fails to honor the ShowEmailAddress setting when constructing a response to the "Regenerate Invite Id" API endpoint, allowing an attacker with team admin privileges to learn the team owner's email address in the response.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Feb 9, 2023Improper access control vulnerabilities in Smart Things prior to 1.7.93 allows to attacker to invite others without authorization of the owner.CVE-2023-21432 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4.2
Improper access control vulnerabilities in Smart Things prior to 1.7.93 allows to attacker to invite others without authorization of the owner.
- Product
- Smart Things
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Jan 3, 2023Gravitee API Management before 3.15.13 allows path traversal through HTML injection.CVE-2022-38723 · Other software · Gravitee · reported by MITREHigh 8.6
Gravitee API Management before 3.15.13 allows path traversal through HTML injection.
- Product
- API Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.gravitee.iogist.github.com
Dec 9, 2022User invites for Funkwhale v1.2.8 do not permanently expire after being used for signup and can be used again after an account has been deleted.CVE-2022-45292 · Other software · Funkwhale · reported by MITREMedium 5.3
User invites for Funkwhale v1.2.8 do not permanently expire after being used for signup and can be used again after an account has been deleted.
- Product
- Funkwhale
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddev.funkwhale.audiodev.funkwhale.audio
Nov 25, 2022drachtio-server before 0.8.19 has a heap-based buffer over-read via a long Request-URI in an INVITE request.CVE-2022-45909 · Other software · Drachtio · reported by MITRECritical 9.1
drachtio-server before 0.8.19 has a heap-based buffer over-read via a long Request-URI in an INVITE request.
- Product
- Drachtio-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2022HTML injection combined with path traversal in the Email service in Gravitee API Management before 1.25.3 allows anonymous users to read arbitrary files via a /CVE-2019-25075 · Other software · Gravitee · reported by MITREMedium 6.1
HTML injection combined with path traversal in the Email service in Gravitee API Management before 1.25.3 allows anonymous users to read arbitrary files via a /management/users/register request.
- Product
- API Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2022Vitejs Vite before v2.9.13 was discovered to allow attackers to perform a directory traversal via a crafted URL to the victim's service.CVE-2022-35204 · Other software · Vitejs · reported by MITREMedium 4.3
Vitejs Vite before v2.9.13 was discovered to allow attackers to perform a directory traversal via a crafted URL to the victim's service.
- Product
- Vite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2021VITEC Exterity IPTV products through 2021-04-30 allow privilege escalation to root.CVE-2021-42109 · Other software · Vitec · reported by MITRECritical 9.8
VITEC Exterity IPTV products through 2021-04-30 allow privilege escalation to root.
- Product
- Exterity Avediaserver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwhitehoodhacker.netexterity.com
Sep 10, 2021WordPress InviteBox Plugin for viral Refer-a-Friend Promotions: Reflected Cross-Site ScriptingCVE-2021-38359 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WordPress InviteBox Plugin for viral Refer-a-Friend Promotions WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the message parameter found in the ~/admin/admin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.4.1.
- Product
- WordPress InviteBox Plugin for viral Refer-a-Friend Promotions
- Affected
- up to 1.4.1
- What to do
- Affects up to 1.4.1. Update WordPress InviteBox Plugin for viral Refer-a-Friend Promotions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 9, 2021UE assertion is possible due to improper validation of invite message with SDP body in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon CVE-2021-1933 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comCritical 9.8
UE assertion is possible due to improper validation of invite message with SDP body in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Wearables
- Product
- Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Wearables
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Aug 25, 2021Under specialized conditions, GitLab CE/EE versions starting 7.10 may allow existing GitLab users to use an invite URL meant for another email address to gain aCVE-2021-22243 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5
Under specialized conditions, GitLab CE/EE versions starting 7.10 may allow existing GitLab users to use an invite URL meant for another email address to gain access into a group.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 23, 2021Improper validation of invited users' email address in GitLab EE affecting all versions since 12.2 allowed projects to add members with email address domain thaCVE-2021-22251 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 4.3
Improper validation of invited users' email address in GitLab EE affecting all versions since 12.2 allowed projects to add members with email address domain that should be blocked by group settings
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 23, 2021A verbose error message in GitLab EE affecting all versions since 12.2 could disclose the private email address of a user invited to a groupCVE-2021-22249 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 4.3
A verbose error message in GitLab EE affecting all versions since 12.2 could disclose the private email address of a user invited to a group
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2021An issue was discovered in ZmMailMsgView.js in the Calendar Invite component in Zimbra Collaboration Suite 8.8.x before 8.8.15 Patch 23.CVE-2021-35208 · Email & office · Zimbra · reported by MITREMedium 5.4
An issue was discovered in ZmMailMsgView.js in the Calendar Invite component in Zimbra Collaboration Suite 8.8.x before 8.8.15 Patch 23. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected into the document.
- Product
- Collaboration
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.sonarsource.comwiki.zimbra.com
Aug 21, 2020Zulip Server before 2.1.5 has Incorrect Access Control because 0198_preregistrationuser_invited_as adds the administrator role to invitations.CVE-2020-14215 · Other software · Zulip · reported by MITREHigh 7.5
Zulip Server before 2.1.5 has Incorrect Access Control because 0198_preregistrationuser_invited_as adds the administrator role to invitations.
- Product
- Zulip Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.zulip.comblog.zulip.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.