Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,898 results · page 30 of 58
Jul 25, 2022LibreOffice supports the storage of passwords for web connections in the user’s configuration database.CVE-2022-26307 · Other software · The Document Foundation · reported by security@documentfoundation.orgHigh 8.8
LibreOffice supports the storage of passwords for web connections in the user’s configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in LibreOffice existed where master key was poorly encoded resulting in weakening its entropy from 128 to 43 bits making the stored passwords vulerable to a brute force attack if an attacker has access to the users stored config. This issue affects: The Document Foundation LibreOffice 7.2 versions prior to 7.2.7; 7.3 versions prior to 7.3.3.
- Product
- LibreOffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comlists.debian.org
Jul 25, 2022LibreOffice supports the storage of passwords for web connections in the user’s configuration database.CVE-2022-26306 · Other software · The Document Foundation · reported by security@documentfoundation.orgHigh 7.5
LibreOffice supports the storage of passwords for web connections in the user’s configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in LibreOffice existed where the required initialization vector for encryption was always the same which weakens the security of the encryption making them vulnerable if an attacker has access to the user's configuration data. This issue affects: The Document Foundation LibreOffice 7.2 versions prior to 7.2.7; 7.3 versions prior to 7.3.1.
- Product
- LibreOffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comlists.debian.org
Jul 25, 2022An Improper Certificate Validation vulnerability in LibreOffice existed where determining if a macro was signed by a trusted author was done by only matching thCVE-2022-26305 · Other software · The Document Foundation · reported by security@documentfoundation.orgHigh 7.5
An Improper Certificate Validation vulnerability in LibreOffice existed where determining if a macro was signed by a trusted author was done by only matching the serial number and issuer string of the used certificate with that of a trusted certificate. This is not sufficient to verify that the macro was actually signed with the certificate. An adversary could therefore create an arbitrary certificate with a serial number and an issuer string identical to a trusted certificate which LibreOffice would present as belonging to the trusted author, potentially leading to the user to execute arbitrary code contained in macros improperly trusted. This issue affects: The Document Foundation LibreOffice 7.2 versions prior to 7.2.7; 7.3 versions prior to 7.3.1.
- Product
- LibreOffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orglibreoffice.org
Jul 25, 2022CommuniLink Internet Limited CLink Office v2.0 was discovered to contain multiple SQL injection vulnerabilities via the username and password parameters.CVE-2022-29709 · Other software · Communilink · reported by MITREHigh 7.5
CommuniLink Internet Limited CLink Office v2.0 was discovered to contain multiple SQL injection vulnerabilities via the username and password parameters.
- Product
- Clink Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Jul 15, 2022Arox School ERP Pro v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the dispatchcategory parameter in backoffice.inc.php.CVE-2022-32118 · Other software · Arox · reported by MITREMedium 6.1
Arox School ERP Pro v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the dispatchcategory parameter in backoffice.inc.php.
- Product
- School ERP Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2022Microsoft Office Security Feature Bypass VulnerabilityCVE-2022-33632 · Email & office · Microsoft · reported by secure@microsoft.comMedium 4.7
Microsoft Office Security Feature Bypass Vulnerability
- Product
- Microsoft Office LTSC 2021
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jun 15, 2022Microsoft Office Remote Code Execution VulnerabilityCVE-2022-30174 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Office Remote Code Execution Vulnerability
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jun 15, 2022Microsoft Office Information Disclosure VulnerabilityCVE-2022-30172 · Email & office · Microsoft · reported by secure@microsoft.comMedium 5.5
Microsoft Office Information Disclosure Vulnerability
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jun 15, 2022Microsoft Office Information Disclosure VulnerabilityCVE-2022-30171 · Email & office · Microsoft · reported by secure@microsoft.comMedium 5.5
Microsoft Office Information Disclosure Vulnerability
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jun 15, 2022Microsoft Office Information Disclosure VulnerabilityCVE-2022-30159 · Email & office · Microsoft · reported by secure@microsoft.comMedium 5.5
Microsoft Office Information Disclosure Vulnerability
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jun 2, 2022richdocuments is the repository for NextCloud Collabra, the app for Nextcloud Office collaboration.CVE-2022-31024 · Other software · nextcloud · reported by GitHubMedium 6.5
richdocuments is the repository for NextCloud Collabra, the app for Nextcloud Office collaboration. Prior to versions 6.0.0, 5.0.4, and 4.2.6, a user could be tricked into working against a remote Office by sending them a federated share. richdocuments versions 6.0.0, 5.0.4 and 4.2.6 contain a fix for this issue. There are currently no known workarounds available.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022Onlyoffice Document Server v6.0.0 and below and Core 6.1.0.26 and below were discovered to contain a heap overflow via the component DesktopEditor/fontengine/foCVE-2022-29777 · Other software · Onlyoffice · reported by MITRECritical 9.8
Onlyoffice Document Server v6.0.0 and below and Core 6.1.0.26 and below were discovered to contain a heap overflow via the component DesktopEditor/fontengine/fontconverter/FontFileBase.h.
- Product
- Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022Onlyoffice Document Server v6.0.0 and below and Core 6.1.0.26 and below were discovered to contain a stack overflow via the component DesktopEditor/common/File.CVE-2022-29776 · Other software · Onlyoffice · reported by MITRECritical 9.8
Onlyoffice Document Server v6.0.0 and below and Core 6.1.0.26 and below were discovered to contain a stack overflow via the component DesktopEditor/common/File.cpp.
- Product
- Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2022An exploitable use-after-free vulnerability exists in WPS Spreadsheets ( ET ) as part of WPS Office, version 11.2.0.10351.CVE-2021-40399 · Other software · WPS · reported by talos-cna@cisco.comHigh 7.8
An exploitable use-after-free vulnerability exists in WPS Spreadsheets ( ET ) as part of WPS Office, version 11.2.0.10351. A specially-crafted XLS file can cause a use-after-free condition, resulting in remote code execution. An attacker needs to provide a malformed file to the victim to trigger the vulnerability.
- Product
- WPS Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.wps.cntalosintelligence.com
May 10, 2022Microsoft Excel Remote Code Execution VulnerabilityCVE-2022-29109 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Excel Remote Code Execution Vulnerability
- Product
- Microsoft Office 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
May 10, 2022Microsoft Office Security Feature Bypass VulnerabilityCVE-2022-29107 · Email & office · Microsoft · reported by secure@microsoft.comMedium 5.5
Microsoft Office Security Feature Bypass Vulnerability
- Product
- Microsoft Office LTSC 2021
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Apr 15, 2022Microsoft Excel Remote Code Execution VulnerabilityCVE-2022-26901 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Excel Remote Code Execution Vulnerability
- Product
- Microsoft Office 2019 for Mac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 15, 2022Microsoft Excel Remote Code Execution VulnerabilityCVE-2022-24473 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Excel Remote Code Execution Vulnerability
- Product
- Microsoft Office 2019 for Mac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 8, 2022A cross-site scripting (XSS) vulnerability in ONLYOFFICE Document Server Example before v7.0.0 allows remote attackers inject arbitrary HTML or JavaScript throuCVE-2022-24229 · Other software · Onlyoffice · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in ONLYOFFICE Document Server Example before v7.0.0 allows remote attackers inject arbitrary HTML or JavaScript through /example/editor.
- Product
- Document Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2022An Access Control vulnerability exists in BigAntSoft BigAnt office messenger 5.6 via im_webserver, which could let a malicious user upload PHP Trojan files.CVE-2021-43430 · Other software · Bigantsoft · reported by MITREHigh 8.8
An Access Control vulnerability exists in BigAntSoft BigAnt office messenger 5.6 via im_webserver, which could let a malicious user upload PHP Trojan files.
- Product
- Bigant Office Messenger 5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2022An Unquoted Service Path vulnerability exits in Vembu BDR 4.2.0.1 via a specially crafted file in the (1) hsflowd, (2) VembuBDR360Agent, or (3) VembuOffice365AgCVE-2021-43458 · Other software · Vembu · reported by MITREHigh 7.8
An Unquoted Service Path vulnerability exits in Vembu BDR 4.2.0.1 via a specially crafted file in the (1) hsflowd, (2) VembuBDR360Agent, or (3) VembuOffice365Agent service paths.
- Product
- BDR Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comgithub.com
Mar 23, 2022wpsupdater.exe in Kingsoft WPS Office through 11.2.0.10382 allows remote code execution by modifying HKEY_CURRENT_USER in the registry.CVE-2022-24934 · Other software · WPS · reported by MITRECritical 9.8
wpsupdater.exe in Kingsoft WPS Office through 11.2.0.10382 allows remote code execution by modifying HKEY_CURRENT_USER in the registry.
- Product
- WPS Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddecoded.avast.iowps.com
Mar 17, 2022The installer of WPS Office Version 10.8.0.5745 insecurely load shcore.dll, allowing an attacker to execute arbitrary code with the privilege of the user invokiCVE-2022-26081 · Other software · KINGSOFT JAPAN, INC. · reported by vultures@jpcert.or.jpHigh 7.8
The installer of WPS Office Version 10.8.0.5745 insecurely load shcore.dll, allowing an attacker to execute arbitrary code with the privilege of the user invoking the installer.
- Product
- The installer of WPS Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpsupport.kingsoft.jp
Mar 17, 2022The installer of WPS Office Version 10.8.0.6186 insecurely load VERSION.DLL (or some other DLLs), allowing an attacker to execute arbitrary code with the privilCVE-2022-25969 · Other software · KINGSOFT JAPAN, INC. · reported by vultures@jpcert.or.jpHigh 7.8
The installer of WPS Office Version 10.8.0.6186 insecurely load VERSION.DLL (or some other DLLs), allowing an attacker to execute arbitrary code with the privilege of the user invoking the installer.
- Product
- The installer of WPS Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpsupport.kingsoft.jp
Mar 11, 2022lib/Horde/Mime/Viewer/Ooo.php in Horde Mime_Viewer before 2.2.4 allows XSS via an OpenOffice document, leading to account takeover in Horde Groupware Webmail EdCVE-2022-26874 · Other software · Horde · reported by MITREMedium 5.4
lib/Horde/Mime/Viewer/Ooo.php in Horde Mime_Viewer before 2.2.4 allows XSS via an OpenOffice document, leading to account takeover in Horde Groupware Webmail Edition. This occurs after XSLT rendering.
- Product
- Horde Mime Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.sonarsource.comgithub.com
Mar 9, 2022Microsoft Office Word Tampering VulnerabilityCVE-2022-24511 · Email & office · Microsoft · reported by secure@microsoft.comMedium 5.5
Microsoft Office Word Tampering Vulnerability
- Product
- Microsoft Office 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 9, 2022Microsoft Office Visio Remote Code Execution VulnerabilityCVE-2022-24510 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Office Visio Remote Code Execution Vulnerability
- Product
- Microsoft Office 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 9, 2022Microsoft Office Visio Remote Code Execution VulnerabilityCVE-2022-24509 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Office Visio Remote Code Execution Vulnerability
- Product
- Microsoft Office 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 9, 2022Microsoft Word Security Feature Bypass VulnerabilityCVE-2022-24462 · Email & office · Microsoft · reported by secure@microsoft.comMedium 5.5
Microsoft Word Security Feature Bypass Vulnerability
- Product
- Microsoft Office 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 9, 2022Microsoft Office Visio Remote Code Execution VulnerabilityCVE-2022-24461 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Office Visio Remote Code Execution Vulnerability
- Product
- Microsoft Office 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 9, 2022The installer of WPS Office for Windows versions prior to v11.2.0.10258 fails to configure properly the ACL for the directory where the service program is instaCVE-2022-25943 · Other software · WPS Office Software · reported by vultures@jpcert.or.jpHigh 7.8
The installer of WPS Office for Windows versions prior to v11.2.0.10258 fails to configure properly the ACL for the directory where the service program is installed.
- Product
- WPS Office for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2022LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurred since tCVE-2021-25636 · Other software · The Document Foundation · reported by security@documentfoundation.orgHigh 7.5
LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurred since the last signing and that the signature is valid. An Improper Certificate Validation vulnerability in LibreOffice allowed an attacker to create a digitally signed ODF document, by manipulating the documentsignatures.xml or macrosignatures.xml stream within the document to contain both "X509Data" and "KeyValue" children of the "KeyInfo" tag, which when opened caused LibreOffice to verify using the "KeyValue" but to report verification with the unrelated "X509Data" value. This issue affects: The Document Foundation LibreOffice 7.2 versions prior to 7.2.5.
- Product
- LibreOffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orglists.fedoraproject.org
Feb 18, 2022An improper input validation leading to arbitrary file creation was discovered in ToWord of ToOffice.CVE-2021-26618 · Other software · TmaxSoft Co., Ltd · reported by vuln@krcert.or.krHigh 7.1
An improper input validation leading to arbitrary file creation was discovered in ToWord of ToOffice. Remote attackers use this vulnerability to execute arbitrary file included malicious code.
- Product
- ToOffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkrcert.or.krkrcert.or.kr
Feb 16, 2022A heap-based buffer overflow vulnerability exists in the Hword HwordApp.dll functionality of Hancom Office 2020 11.0.0.2353.CVE-2021-21958 · Other software · Hancom · reported by talos-cna@cisco.comHigh 7.8
A heap-based buffer overflow vulnerability exists in the Hword HwordApp.dll functionality of Hancom Office 2020 11.0.0.2353. A specially-crafted malformed file can lead to memory corruption and potential arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
- Product
- Hancom Office 2020
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comblog.talosintelligence.com
Feb 14, 2022Tongda2000 v11.10 was discovered to contain a SQL injection vulnerability in /mobile_seal/get_seal.php via the DEVICE_LIST parameter.CVE-2022-24206 · Other software · Tongda2000 · reported by MITRECritical 9.8
Tongda2000 v11.10 was discovered to contain a SQL injection vulnerability in /mobile_seal/get_seal.php via the DEVICE_LIST parameter.
- Product
- Tongda Office Anywhere
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.youdao.comnote.youdao.com
Feb 14, 2022Tongda2000 v11.10 was discovered to contain a SQL injection vulnerability in export_data.php via the d_name parameter.CVE-2022-23902 · Other software · Tongda2000 · reported by MITRECritical 9.8
Tongda2000 v11.10 was discovered to contain a SQL injection vulnerability in export_data.php via the d_name parameter.
- Product
- Tongda Office Anywhere
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.youdao.comnote.youdao.com
Feb 9, 2022Microsoft Office Information Disclosure VulnerabilityCVE-2022-23252 · Email & office · Microsoft · reported by secure@microsoft.comMedium 5.5
Microsoft Office Information Disclosure Vulnerability
- Product
- Microsoft Office 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Feb 9, 2022Microsoft Office ClickToRun Remote Code Execution VulnerabilityCVE-2022-22004 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Office ClickToRun Remote Code Execution Vulnerability
- Product
- Microsoft Office 2013 Click-to-Run (C2R)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Feb 9, 2022Microsoft Office Graphics Remote Code Execution VulnerabilityCVE-2022-22003 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Office Graphics Remote Code Execution Vulnerability
- Product
- Microsoft Office 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Feb 9, 2022Microsoft Office Visio Remote Code Execution VulnerabilityCVE-2022-21988 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Office Visio Remote Code Execution Vulnerability
- Product
- Microsoft Office 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Feb 8, 2022Cross-site scripting vulnerability in Canon laser printers and small office multifunctional printers (LBP162L/LBP162, MF4890dw, MF269dw/MF265dw/MF264dw/MF262dw,CVE-2021-20877 · Other software · Canon · reported by vultures@jpcert.or.jpMedium 4.8
Cross-site scripting vulnerability in Canon laser printers and small office multifunctional printers (LBP162L/LBP162, MF4890dw, MF269dw/MF265dw/MF264dw/MF262dw, MF249dw/MF245dw/MF244dw/MF242dw/MF232w, and MF229dw/MF224dw/MF222dw sold in Japan, imageCLASS MF Series (MF113W/MF212W/MF217W/MF227DW/MF229DW, MF232W/MF244DW/MF247DW/MF249DW, MF264DW/MF267DW/MF269DW/MF269DW VP, and MF4570DN/MF4570DW/MF4770N/MF4880DW/MF4890DW) and imageCLASS LBP Series (LBP113W/LBP151DW/LBP162DW ) sold in the US, and iSENSYS (LBP162DW, LBP113W, LBP151DW, MF269dw, MF267dw, MF264dw, MF113w, MF249dw, MF247dw, MF244dw, MF237w, MF232w, MF229dw, MF217w, MF212w, MF4780w, and MF4890dw) and imageRUNNER (2206IF, 2204N, and 2204F) sold in Europe) allows remote attackers to inject an arbitrary script via unspecified vectors.
- Product
- Canon laser printers and small office multifunctional printers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2022Local privilege escalation due to unrestricted loading of unsigned libraries.CVE-2022-24115 · Other software · Acronis · reported by security@acronis.comHigh 7.8
Local privilege escalation due to unrestricted loading of unsigned libraries. The following products are affected: Acronis Cyber Protect Home Office (macOS) before build 39605, Acronis True Image 2021 (macOS) before build 39287
- Product
- Acronis Cyber Protect Home Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity-advisory.acronis.comsecurity-advisory.acronis.com
Feb 4, 2022Local privilege escalation due to race condition on application startup.CVE-2022-24114 · Other software · Acronis · reported by security@acronis.comHigh 7
Local privilege escalation due to race condition on application startup. The following products are affected: Acronis Cyber Protect Home Office (macOS) before build 39605, Acronis True Image 2021 (macOS) before build 39287
- Product
- Acronis Cyber Protect Home Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity-advisory.acronis.comsecurity-advisory.acronis.com
Feb 4, 2022Local privilege escalation due to DLL hijacking vulnerability in Acronis Media Builder service.CVE-2021-44206 · Other software · Acronis · reported by security@acronis.comHigh 7.3
Local privilege escalation due to DLL hijacking vulnerability in Acronis Media Builder service. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 39612, Acronis True Image 2021 (Windows) before build 39287
- Product
- Acronis Cyber Protect Home Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity-advisory.acronis.comsecurity-advisory.acronis.com
Feb 4, 2022Local privilege escalation due to DLL hijacking vulnerability.CVE-2021-44205 · Other software · Acronis · reported by security@acronis.comHigh 7.3
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 39612, Acronis True Image 2021 (Windows) before build 39287
- Product
- Acronis Cyber Protect Home Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity-advisory.acronis.comsecurity-advisory.acronis.com
Feb 4, 2022In Zammad 5.0.2, agents can configure "out of office" periods and substitute persons.CVE-2021-44886 · Other software · Zammad · reported by MITREMedium 5.3
In Zammad 5.0.2, agents can configure "out of office" periods and substitute persons. If the substitute persons didn't have the same permissions as the original agent, they could receive ticket notifications for tickets that they have no access to.
- Product
- Zammad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2022SQL Injection vulnerability discovered in Unified Office Total Connect Now that would allow an attacker to extract sensitive information through a cookie parameCVE-2022-24121 · Other software · Unifiedoffice · reported by MITREHigh 7.5
SQL Injection vulnerability discovered in Unified Office Total Connect Now that would allow an attacker to extract sensitive information through a cookie parameter.
- Product
- Total Connect NOW
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordunifiedoffice.comcoresecurity.com
Jan 11, 2022Microsoft Excel Remote Code Execution VulnerabilityCVE-2022-21841 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Excel Remote Code Execution Vulnerability
- Product
- Microsoft Office 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jan 11, 2022Microsoft Office Remote Code Execution VulnerabilityCVE-2022-21840 · Email & office · Microsoft · reported by secure@microsoft.comHigh 8.8
Microsoft Office Remote Code Execution Vulnerability
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Dec 28, 2021An arbitrary file download and execution vulnerability was found in the VideoOffice X2.9 and earlier versions (CVE-2020-7878).CVE-2020-7878 · Other software · 4NB · reported by vuln@krcert.or.krCritical 9.8
An arbitrary file download and execution vulnerability was found in the VideoOffice X2.9 and earlier versions (CVE-2020-7878). This issue is due to missing support for integrity check.
- Product
- VideoOffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkrcert.or.krkrcert.or.kr
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.