Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,792 results · page 33 of 76
Dec 11, 2023SAP Cloud Connector - version 2.0, allows an authenticated user with low privilege to perform Denial of service attack from adjacent UI by sending a malicious rCVE-2023-49578 · Network & remote access · SAP_SE · reported by cna@sap.comLow 3.5
SAP Cloud Connector - version 2.0, allows an authenticated user with low privilege to perform Denial of service attack from adjacent UI by sending a malicious request which leads to low impact on the availability and no impact on confidentiality or Integrity of the application.
- Product
- SAP Cloud Connector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2023An issue in studio kent mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.CVE-2023-43305 · Other software · Linecorp · reported by MITREHigh 8.2
An issue in studio kent mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.
- Product
- Line
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2023A lack of rate limiting in pjActionAjaxSend in Appointment Scheduler 3.0 allows attackers to cause resource exhaustion.CVE-2023-48840 · Websites & servers · Phpjabbers · reported by MITREHigh 7.5
A lack of rate limiting in pjActionAjaxSend in Appointment Scheduler 3.0 allows attackers to cause resource exhaustion.
- Product
- Appointment Scheduler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comphpjabbers.com
Dec 7, 2023A lack of rate limiting in pjActionAjaxSend in Car Rental v3.0 allows attackers to cause resource exhaustion.CVE-2023-48834 · Websites & servers · Phpjabbers · reported by MITREHigh 7.5
A lack of rate limiting in pjActionAjaxSend in Car Rental v3.0 allows attackers to cause resource exhaustion.
- Product
- CAR Rental Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comphpjabbers.com
Dec 7, 2023A lack of rate limiting in pjActionAJaxSend in Time Slots Booking Calendar 4.0 allows attackers to cause resource exhaustion.CVE-2023-48833 · Websites & servers · Phpjabbers · reported by MITREHigh 7.5
A lack of rate limiting in pjActionAJaxSend in Time Slots Booking Calendar 4.0 allows attackers to cause resource exhaustion.
- Product
- Time Slots Booking Calendar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comphpjabbers.com
Dec 7, 2023A lack of rate limiting in pjActionAJaxSend in Availability Booking Calendar 5.0 allows attackers to cause resource exhaustion.CVE-2023-48831 · Websites & servers · Phpjabbers · reported by MITREHigh 7.5
A lack of rate limiting in pjActionAJaxSend in Availability Booking Calendar 5.0 allows attackers to cause resource exhaustion.
- Product
- Availability Booking Calendar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comphpjabbers.com
Dec 7, 2023An issue in PARK DANDAN mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.CVE-2023-43304 · Other software · Linecorp · reported by MITREHigh 8.2
An issue in PARK DANDAN mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.
- Product
- Line
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2023An issue in craftbeer bar canvas mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token (via CVE-2023-43303 · Other software · Linecorp · reported by MITREHigh 8.2
An issue in craftbeer bar canvas mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token (via captured network traffic).
- Product
- Line
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2023An issue in sanTas mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.CVE-2023-43302 · Other software · Linecorp · reported by MITREHigh 8.2
An issue in sanTas mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.
- Product
- Line
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2023An issue in DARTS SHOP MAXIM mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.CVE-2023-43301 · Other software · Linecorp · reported by MITREHigh 8.2
An issue in DARTS SHOP MAXIM mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.
- Product
- Line
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2023An issue in urban_project mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.CVE-2023-43300 · Other software · Linecorp · reported by MITREHigh 8.2
An issue in urban_project mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.
- Product
- Line
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2023An issue in DA BUTCHERS mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.CVE-2023-43299 · Other software · Linecorp · reported by MITREMedium 5.3
An issue in DA BUTCHERS mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.
- Product
- Line
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2023An issue in SCOL Members Card mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.CVE-2023-43298 · Other software · Linecorp · reported by MITREMedium 5.3
An issue in SCOL Members Card mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.
- Product
- Line
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 6, 2023A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are iCVE-2023-39326 · Other software · Go standard library · reported by security@golang.orgMedium 5.3
A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of data (up to about 1GiB) when a handler fails to read the entire body of a request. Chunk extensions are a little-used HTTP feature which permit including additional metadata in a request or response body sent using the chunked encoding. The net/http chunked encoding reader discards this metadata. A sender can exploit this by inserting a large metadata segment with each byte transferred. The chunk reader now produces an error if the ratio of real body to encoded bytes grows too small.
- Product
- net/http/internal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2023Improper access control in knoxcustom service prior to SMR Dec-2023 Release 1 allows attacker to send broadcast with system privilege.CVE-2023-42564 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 6.6
Improper access control in knoxcustom service prior to SMR Dec-2023 Release 1 allows attacker to send broadcast with system privilege.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Dec 4, 2023Memory corruption while sending an Assoc Request having BTM Query or BTM Response containing MBO IE.CVE-2023-33082 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comCritical 9.8
Memory corruption while sending an Assoc Request having BTM Query or BTM Response containing MBO IE.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Dec 4, 2023Memory corruption while sending SMS from AP firmware.CVE-2023-33024 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 6.7
Memory corruption while sending SMS from AP firmware.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Dec 4, 2023Memory Corruption in Radio Interface Layer while sending an SMS or writing an SMS to SIM.CVE-2023-21634 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 6.7
Memory Corruption in Radio Interface Layer while sending an SMS or writing an SMS to SIM.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Dec 4, 2023In createDontSendToRestrictedAppsBundle of PendingIntentUtils.java, there is a possible background activity launch due to a missing check.CVE-2023-40095 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In createDontSendToRestrictedAppsBundle of PendingIntentUtils.java, there is a possible background activity launch due to a missing check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comsource.android.com
Dec 4, 2023In injectSendIntentSender of ShortcutService.java, there is a possible background activity launch due to a permissions bypass.CVE-2023-40079 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In injectSendIntentSender of ShortcutService.java, there is a possible background activity launch due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comsource.android.com
Dec 1, 2023A deserialization vulnerability in Jupiter v1.3.1 allows attackers to execute arbitrary commands via sending a crafted RPC request.CVE-2023-48887 · Other software · Fengjiachun · reported by MITRECritical 9.8
A deserialization vulnerability in Jupiter v1.3.1 allows attackers to execute arbitrary commands via sending a crafted RPC request.
- Product
- Jupiter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2023A deserialization vulnerability in NettyRpc v1.2 allows attackers to execute arbitrary commands via sending a crafted RPC request.CVE-2023-48886 · Other software · Luxiaoxun · reported by MITRECritical 9.8
A deserialization vulnerability in NettyRpc v1.2 allows attackers to execute arbitrary commands via sending a crafted RPC request.
- Product
- Nettyrpc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 29, 2023A serialization vulnerability in logback receiver component part of logback version 1.4.11 allows an attacker to mount a Denial-Of-Service attack by sending pCVE-2023-6378 · Other software · QOS.CH Sarl · reported by vulnerability@ncsc.chHigh 7.1
A serialization vulnerability in logback receiver component part of logback version 1.4.11 allows an attacker to mount a Denial-Of-Service attack by sending poisoned data.
- Product
- logback
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlogback.qos.chlogback.qos.ch
Nov 27, 2023A Vulnerability in OTRS AgentInterface and ExternalInterface allows the reading of plain text passwords which are send back to the client in the server responseCVE-2023-6254 · Other software · OTRS AG · reported by security@otrs.comHigh 8.1
A Vulnerability in OTRS AgentInterface and ExternalInterface allows the reading of plain text passwords which are send back to the client in the server response- This issue affects OTRS: from 8.0.X through 8.0.37.
- Product
- OTRS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 27, 2023Mattermost fails to limit the log size of server logs allowing an attacker sending specially crafted requests to different endpoints to potentially overflow theCVE-2023-48369 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 4.3
Mattermost fails to limit the log size of server logs allowing an attacker sending specially crafted requests to different endpoints to potentially overflow the log.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Nov 23, 2023Email Marketing for WooCommerce by Omnisend: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-47244 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Omnisend Email Marketing for WooCommerce by Omnisend.This issue affects Email Marketing for WooCommerce by Omnisend: from n/a through 1.13.8.
- Product
- Email Marketing for WooCommerce by Omnisend
- Affected
- up to 1.13.8
- What to do
- Affects up to 1.13.8. Update Email Marketing for WooCommerce by Omnisend to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 23, 2023An attacker could exploit a vulnerability by sending crafted messages to computers installed with this plug-in to modify plug-in parameters, which could cause aCVE-2023-28813 · Network & remote access · Hikvision · reported by hsrc@hikvision.comHigh 8.1
An attacker could exploit a vulnerability by sending crafted messages to computers installed with this plug-in to modify plug-in parameters, which could cause affected computers to download malicious files.
- Product
- LocalServiceComponents
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhikvision.comhikvision.com
Nov 23, 2023There is a buffer overflow vulnerability in a web browser plug-in could allow an attacker to exploit the vulnerability by sending crafted messages to computers CVE-2023-28812 · Network & remote access · Hikvision · reported by hsrc@hikvision.comCritical 9.1
There is a buffer overflow vulnerability in a web browser plug-in could allow an attacker to exploit the vulnerability by sending crafted messages to computers installed with this plug-in, which could lead to arbitrary code execution or cause process exception of the plug-in.
- Product
- LocalServiceComponents
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhikvision.comhikvision.com
Nov 22, 2023An access control issue in Mercedes me IOS APP v1.34.0 and below allows attackers to view the carts of other users via sending a crafted add order request.CVE-2023-47392 · Other software · Mercedes-benz · reported by MITREMedium 5.3
An access control issue in Mercedes me IOS APP v1.34.0 and below allows attackers to view the carts of other users via sending a crafted add order request.
- Product
- Mercedes ME
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Nov 21, 2023An malicious BLE device can cause buffer overflow by sending malformed advertising packet BLE device using Zephyr OS, leading to DoS or potential RCE on the vicCVE-2023-4424 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgHigh 8.3
An malicious BLE device can cause buffer overflow by sending malformed advertising packet BLE device using Zephyr OS, leading to DoS or potential RCE on the victim BLE device.
- Product
- Zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2023The BGP daemon (bgpd) in IP Infusion ZebOS through 7.10.6 allow remote attackers to cause a denial of service by sending crafted BGP update messages containing CVE-2023-45886 · Network & remote access · F5 · reported by MITREHigh 7.5
The BGP daemon (bgpd) in IP Infusion ZebOS through 7.10.6 allow remote attackers to cause a denial of service by sending crafted BGP update messages containing a malformed attribute.
- Product
- Big-ip Next
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.benjojo.co.ukmy.f5.com
Nov 20, 2023An issue in Yamcs 5.8.6 allows attackers to send aribitrary telelcommands in a Command Stack via Clickjacking.CVE-2023-47311 · Other software · Spaceapplications · reported by MITREMedium 6.1
An issue in Yamcs 5.8.6 allows attackers to send aribitrary telelcommands in a Command Stack via Clickjacking.
- Product
- Yacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlinkedin.comlinkedin.com
Nov 15, 2023In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, a malicious user can send a request using a specially crafted UCVE-2023-34062 · Other software · reactor_netty · reported by security@vmware.comHigh 7.5
In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack. Specifically, an application is vulnerable if Reactor Netty HTTP Server is configured to serve static resources.
- Product
- reactor_netty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2023MyPrestaModules ordersexport before v5.0 was discovered to contain multiple SQL injection vulnerabilities at send.php via the key and save_setting parameters.CVE-2023-40923 · Other software · Myprestamodules · reported by MITREHigh 8.8
MyPrestaModules ordersexport before v5.0 was discovered to contain multiple SQL injection vulnerabilities at send.php via the key and save_setting parameters.
- Product
- Orders (csv, Excel) Export Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.friendsofpresta.orgsecurity.friendsofpresta.org
Nov 14, 2023There is a buffer overflow vulnerability in the underlying AirWave client service that could lead to unauthenticated remote code execution by sending specially CVE-2023-45616 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.8
There is a buffer overflow vulnerability in the underlying AirWave client service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.
- Product
- Aruba Access Points: 100 Series; 103 Series; 110 Series; 120 Series; 130 Series; 200 Series; 207 Series; 210 Series; 220 Series; 260 Series; 300 Series; 303 Ser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
Nov 14, 2023There are buffer overflow vulnerabilities in the underlying CLI service that could lead to unauthenticated remote code execution by sending specially crafted paCVE-2023-45615 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.8
There are buffer overflow vulnerabilities in the underlying CLI service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.
- Product
- Aruba Access Points: 100 Series; 103 Series; 110 Series; 120 Series; 130 Series; 200 Series; 207 Series; 210 Series; 220 Series; 260 Series; 300 Series; 303 Ser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
Nov 14, 2023There are buffer overflow vulnerabilities in the underlying CLI service that could lead to unauthenticated remote code execution by sending specially crafted paCVE-2023-45614 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.8
There are buffer overflow vulnerabilities in the underlying CLI service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.
- Product
- Aruba Access Points: 100 Series; 103 Series; 110 Series; 120 Series; 130 Series; 200 Series; 207 Series; 210 Series; 220 Series; 260 Series; 300 Series; 303 Ser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
Nov 14, 2023Microsoft Send Customer Voice survey from Dynamics 365 Spoofing VulnerabilityCVE-2023-36007 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.6
Microsoft Send Customer Voice survey from Dynamics 365 Spoofing Vulnerability
- Product
- Send Customer Voice survey from Dynamics 365 app
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Nov 14, 2023A cross-site scripting (XSS) vulnerability in CesiumJS v1.111 allows attackers to execute arbitrary code in the context of the victim's browser via sending a crCVE-2023-48094 · Other software · Cesium · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in CesiumJS v1.111 allows attackers to execute arbitrary code in the context of the victim's browser via sending a crafted payload to /container_files/public_html/doc/index.html. NOTE: the vendor’s position is that Apps/Sandcastle/standalone.html is part of the CesiumGS/cesium GitHub repository, but is demo code that is not part of the CesiumJS JavaScript library product.
- Product
- Cesiumjs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Nov 13, 2023An issue in Yasukawa memberscard v.13.6.1 allows attackers to send crafted notifications via leakage of the channel access token.CVE-2023-45560 · Other software · Memberscard Project · reported by MITREHigh 7.5
An issue in Yasukawa memberscard v.13.6.1 allows attackers to send crafted notifications via leakage of the channel access token.
- Product
- Memberscard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2023An issue in Golden v.13.6.1 allows attackers to send crafted notifications via leakage of the channel access token.CVE-2023-45558 · Other software · golden_project · reported by MITREHigh 7.5
An issue in Golden v.13.6.1 allows attackers to send crafted notifications via leakage of the channel access token.
- Product
- golden
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2023Use after free in OpenVPN version 2.6.0 to 2.6.6 may lead to undefined behavoir, leaking memory buffers or remote execution when sending network buffers to a reCVE-2023-46850 · Other software · OpenVPN · reported by security@openvpn.netCritical 9.8
Use after free in OpenVPN version 2.6.0 to 2.6.6 may lead to undefined behavoir, leaking memory buffers or remote execution when sending network buffers to a remote peer.
- Product
- OpenVPN 2 (Community)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.openvpn.netopenvpn.net
Nov 9, 2023The leakage of channel access token in DRAGON FAMILY Line 13.6.1 allows remote attackers to send malicious notifications to victims.CVE-2023-47373 · Other software · Linecorp · reported by MITREMedium 6.5
The leakage of channel access token in DRAGON FAMILY Line 13.6.1 allows remote attackers to send malicious notifications to victims.
- Product
- Line
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2023The leakage of channel access token in UPDATESALON C-LOUNGE Line 13.6.1 allows remote attackers to send malicious notifications to victims.CVE-2023-47372 · Other software · Linecorp · reported by MITREMedium 6.5
The leakage of channel access token in UPDATESALON C-LOUNGE Line 13.6.1 allows remote attackers to send malicious notifications to victims.
- Product
- Line
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2023The leakage of channel access token in bluetrick Line 13.6.1 allows remote attackers to send malicious notifications to victims.CVE-2023-47370 · Other software · Linecorp · reported by MITREMedium 6.5
The leakage of channel access token in bluetrick Line 13.6.1 allows remote attackers to send malicious notifications to victims.
- Product
- Line
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2023The leakage of channel access token in taketorinoyu Line 13.6.1 allows remote attackers to send malicious notifications to victims.CVE-2023-47368 · Other software · Linecorp · reported by MITREMedium 6.5
The leakage of channel access token in taketorinoyu Line 13.6.1 allows remote attackers to send malicious notifications to victims.
- Product
- Line
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2023The leakage of channel access token in best_training_member Line 13.6.1 allows remote attackers to send malicious notifications.CVE-2023-47369 · Other software · Linecorp · reported by MITREMedium 6.5
The leakage of channel access token in best_training_member Line 13.6.1 allows remote attackers to send malicious notifications.
- Product
- Line
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2023The leakage of channel access token in platinum clinic Line 13.6.1 allows remote attackers to send malicious notifications to victims.CVE-2023-47367 · Other software · Linecorp · reported by MITREMedium 6.5
The leakage of channel access token in platinum clinic Line 13.6.1 allows remote attackers to send malicious notifications to victims.
- Product
- Line
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2023The leakage of channel access token in craft_members Line 13.6.1 allows remote attackers to send malicious notifications to victims.CVE-2023-47366 · Other software · Linecorp · reported by MITREMedium 6.5
The leakage of channel access token in craft_members Line 13.6.1 allows remote attackers to send malicious notifications to victims.
- Product
- Line
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2023The leakage of channel access token in Lil.OFF-PRICE STORE Line 13.6.1 allows remote attackers to send malicious notifications to victims.CVE-2023-47365 · Other software · Linecorp · reported by MITREMedium 6.5
The leakage of channel access token in Lil.OFF-PRICE STORE Line 13.6.1 allows remote attackers to send malicious notifications to victims.
- Product
- Line
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.