Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,792 results · page 35 of 76
Sep 27, 2023 BIG-IP APM clients may send IP traffic outside of the VPN tunnel.CVE-2023-43125 · Network & remote access · F5 · reported by f5sirt@f5.comMedium 6.8
BIG-IP APM clients may send IP traffic outside of the VPN tunnel. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
- Product
- BIG-IP Edge Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2023 BIG-IP APM clients may send IP traffic outside of the VPN tunnel.CVE-2023-43124 · Network & remote access · F5 · reported by f5sirt@f5.comMedium 5.3
BIG-IP APM clients may send IP traffic outside of the VPN tunnel. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
- Product
- BIG-IP Edge Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2023The vulnerability is that the Call management ("com.android.server.telecom") app patched by LG sends a lot of LG-owned implicit broadcasts that disclose sensitiCVE-2023-44126 · Other software · LG Electronics · reported by product.security@lge.comLow 3.6
The vulnerability is that the Call management ("com.android.server.telecom") app patched by LG sends a lot of LG-owned implicit broadcasts that disclose sensitive data to all third-party apps installed on the same device. Those intents include data such as call states, durations, called numbers, contacts info, etc.
- Product
- LG V60 Thin Q 5G(LMV600VM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlgsecurity.lge.comlgsecurity.lge.com
Sep 25, 2023MultiBit HD before 0.1.2 allows attackers to conduct bit-flipping attacks that insert unspendable Bitcoin addresses into the list that MultiBit uses to send feeCVE-2015-6964 · Other software · multibit · reported by MITREMedium 5.3
MultiBit HD before 0.1.2 allows attackers to conduct bit-flipping attacks that insert unspendable Bitcoin addresses into the list that MultiBit uses to send fees to the developers. (Attackers cannot realistically steal these fees for themselves.) This occurs because there is no message authentication code (MAC).
- Product
- multibit_hd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordweb.archive.orgweb.archive.org
Sep 20, 2023SimpleImportProduct Prestashop Module v6.2.9 was discovered to contain a SQL injection vulnerability via the key parameter at send.php.CVE-2023-39675 · Other software · Myprestamodules · reported by MITRECritical 9.8
SimpleImportProduct Prestashop Module v6.2.9 was discovered to contain a SQL injection vulnerability via the key parameter at send.php.
- Product
- Product Catalog (csv, Excel) Import
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.sorcery.iesorcery.ie
Sep 20, 2023An information leak in Earthgarden_waiting 13.6.1 allows attackers to obtain the channel access token and send crafted messages.CVE-2023-39052 · Other software · Earthgarden Waiting Project · reported by MITREMedium 6.5
An information leak in Earthgarden_waiting 13.6.1 allows attackers to obtain the channel access token and send crafted messages.
- Product
- Earthgarden Waiting
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2023An information leak in kokoroe_members card Line 13.6.1 allows attackers to obtain the channel access token and send crafted messages.CVE-2023-39045 · Other software · Kokoroe Members Card Project · reported by MITREMedium 6.5
An information leak in kokoroe_members card Line 13.6.1 allows attackers to obtain the channel access token and send crafted messages.
- Product
- Kokoroe Members Card
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2023An information leak in KUKURUDELI Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages.CVE-2023-39041 · Other software · Kukurudeli Project · reported by MITREMedium 6.5
An information leak in KUKURUDELI Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
- Product
- Kukurudeli
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2023An information leak in ajino-Shiretoko Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages.CVE-2023-39044 · Other software · Ajino-shiretoko Project · reported by MITREMedium 6.5
An information leak in ajino-Shiretoko Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
- Product
- Ajino-shiretoko
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2023Uncontrolled resource consumption in ekorRCI, allowing an attacker with low-privileged access to the web server to send continuous legitimate web requests to a CVE-2022-47556 · Other software · Ormazabal · reported by cve-coordination@incibe.esMedium 6.5
Uncontrolled resource consumption in ekorRCI, allowing an attacker with low-privileged access to the web server to send continuous legitimate web requests to a functionality that is not properly validated, in order to cause a denial of service (DoS) on the device.
- Product
- ekorRCI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2023An information leak in Coffee-jumbo v13.6.1 allows attackers to obtain the channel access token and send crafted messages.CVE-2023-39056 · Other software · Coffee-jumbo Project · reported by MITREMedium 6.5
An information leak in Coffee-jumbo v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
- Product
- Coffee-jumbo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2023An information leak in youmart-tokunaga v13.6.1 allows attackers to obtain the channel access token and send crafted messages.CVE-2023-39049 · Other software · Youmart-tokunaga Project · reported by MITREMedium 6.5
An information leak in youmart-tokunaga v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
- Product
- Youmart-tokunaga
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2023An information leak in TonTon-Tei_waiting Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages.CVE-2023-39046 · Other software · Tonton-tei Waiting Project · reported by MITREMedium 6.5
An information leak in TonTon-Tei_waiting Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
- Product
- Tonton-tei Waiting
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2023An information leak in THE_B_members card v13.6.1 allows attackers to obtain the channel access token and send crafted messages.CVE-2023-39058 · Other software · The B Members Card Project · reported by MITREMedium 6.5
An information leak in THE_B_members card v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
- Product
- The B Members Card
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2023An information leak in YKC Tokushima_awayokocho Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages.CVE-2023-39043 · Other software · YKC · reported by MITREMedium 6.5
An information leak in YKC Tokushima_awayokocho Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
- Product
- Tokushima Awayokocho
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2023An information leak in Cheese Cafe Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages.CVE-2023-39040 · Other software · Cheese Cafe Line Project · reported by MITREMedium 6.5
An information leak in Cheese Cafe Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
- Product
- Cheese Cafe Line
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2023An information leak in Camp Style Project Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages.CVE-2023-39039 · Other software · Camp Style Project Line Project · reported by MITREMedium 6.5
An information leak in Camp Style Project Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
- Product
- Camp Style Project Line
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2023Sending some requests in the web application of the vulnerable device allows information to be obtained due to the lack of security in the authentication procesCVE-2023-41965 · Other software · Socomec · reported by ics-cert@hq.dhs.govHigh 7.5
Sending some requests in the web application of the vulnerable device allows information to be obtained due to the lack of security in the authentication process.
- Product
- MODULYS GP (MOD3GP-SY-120K)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2023Shenzhen Hichip Vision Technology IP Camera Firmware V11.4.8.1.1-20170926 has a denial of service vulnerability through sending a crafted multicast message in aCVE-2022-23382 · Other software · Hichip · reported by MITREHigh 8.1
Shenzhen Hichip Vision Technology IP Camera Firmware V11.4.8.1.1-20170926 has a denial of service vulnerability through sending a crafted multicast message in a local network.
- Product
- Shenzhen Hichip Vision Technology Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlackylab.pllackylab.pl
Sep 5, 2023 Due to an out-of-date dependency in the “Fusion File Manager” component accessible through the admin panel, an attacker can send a crafted request that allows CVE-2023-4480 · Websites & servers · PHPFusion · reported by disclosure@synopsys.comMedium 5.5
Due to an out-of-date dependency in the “Fusion File Manager” component accessible through the admin panel, an attacker can send a crafted request that allows them to read the contents of files on the system accessible within the privileges of the running process. Additionally, they may write files to arbitrary locations, provided the files pass the application’s mime-type and file extension validation.
- Product
- PHPFusion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsynopsys.comsynopsys.com
Sep 5, 2023Memory corruption in WLAN while sending transmit command from HLOS to UTF handlers.CVE-2023-28544 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory corruption in WLAN while sending transmit command from HLOS to UTF handlers.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Sep 1, 2023In Ubuntu's accountsservice an unprivileged local attacker can trigger a use-after-free vulnerability in accountsservice by sending a D-Bus message to the accouCVE-2023-3297 · Other software · Canonical Ltd. · reported by security@ubuntu.comHigh 8.1
In Ubuntu's accountsservice an unprivileged local attacker can trigger a use-after-free vulnerability in accountsservice by sending a D-Bus message to the accounts-daemon process.
- Product
- AccountService
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.launchpad.netcve.mitre.org
Sep 1, 2023O-RAN Software Community ric-plt-lib-rmr v4.9.0 does not validate the source of the routing tables it receives, potentially allowing attackers to send forged roCVE-2023-41627 · Other software · O-ran-sc · reported by MITREHigh 7.5
O-RAN Software Community ric-plt-lib-rmr v4.9.0 does not validate the source of the routing tables it receives, potentially allowing attackers to send forged routing tables to the device.
- Product
- RIC Message Router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjira.o-ran-sc.orgtrendmicro.com
Sep 1, 2023The broker in Eclipse Mosquitto 1.3.2 through 2.x before 2.0.16 has a memory leak that can be abused remotely when a client sends many QoS 2 messages with dupliCVE-2023-28366 · Other software · Eclipse · reported by MITREHigh 7.5
The broker in Eclipse Mosquitto 1.3.2 through 2.x before 2.0.16 has a memory leak that can be abused remotely when a client sends many QoS 2 messages with duplicate message IDs, and fails to respond to PUBREC commands. This occurs because of mishandling of EAGAIN from the libc send function.
- Product
- Mosquitto
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2023In Splunk Enterprise versions lower than 9.0.6 and 8.2.12, a malicious actor can send a malformed security assertion markup language (SAML) request to the `/samCVE-2023-40593 · Other software · Splunk · reported by prodsec@splunk.comMedium 6.3
In Splunk Enterprise versions lower than 9.0.6 and 8.2.12, a malicious actor can send a malformed security assertion markup language (SAML) request to the `/saml/acs` REST endpoint which can cause a denial of service through a crash or hang of the Splunk daemon.
- Product
- Splunk Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisory.splunk.comresearch.splunk.com
Aug 27, 2023IBM Security Guardium 11.3, 11.4, and 11.5 could allow an unauthorized user to enumerate usernames by sending a specially crafted HTTP request.CVE-2023-30437 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM Security Guardium 11.3, 11.4, and 11.5 could allow an unauthorized user to enumerate usernames by sending a specially crafted HTTP request. IBM X-Force ID: 252293.
- Product
- Security Guardium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Aug 27, 2023IBM Security Guardium 11.4 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request.CVE-2022-43907 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.2
IBM Security Guardium 11.4 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 240901.
- Product
- Security Guardium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Aug 24, 2023An adversary could cause a continuous restart loop to the entire device by sending a large quantity of HTTP GET requests if the controller has the built-in web CVE-2023-40710 · Other software · OPTO 22 · reported by ot-cert@dragos.comMedium 6.8
An adversary could cause a continuous restart loop to the entire device by sending a large quantity of HTTP GET requests if the controller has the built-in web server enabled but does not have the built-in web server completely set up and configured for the SNAP PAC S1 Firmware version R10.3b
- Product
- SNAP PAC S1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 24, 2023An adversary could crash the entire device by sending a large quantity of ICMP requests if the controller has the built-in web server enabled but does not have CVE-2023-40709 · Other software · OPTO 22 · reported by ot-cert@dragos.comMedium 6.8
An adversary could crash the entire device by sending a large quantity of ICMP requests if the controller has the built-in web server enabled but does not have the built-in web server completely set up and configured for the SNAP PAC S1 Firmware version R10.3b
- Product
- SNAP PAC S1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2023An issue was discovered in function nl80211_send_chandef in rtl8812au v5.6.4.2 allows attackers to cause a denial of service.CVE-2020-26652 · Other software · aircrack-ng · reported by MITREHigh 7.5
An issue was discovered in function nl80211_send_chandef in rtl8812au v5.6.4.2 allows attackers to cause a denial of service.
- Product
- aircrack-ng
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2023An issue was discovered in PostgreSQL 12.2 allows attackers to cause a denial of service via repeatedly sending SIGHUP signals.CVE-2020-21469 · Other software · Postgresql · reported by MITREMedium 4.4
An issue was discovered in PostgreSQL 12.2 allows attackers to cause a denial of service via repeatedly sending SIGHUP signals. NOTE: this is disputed by the vendor because untrusted users cannot send SIGHUP signals; they can only be sent by a PostgreSQL superuser, a user with pg_reload_conf access, or a user with sufficient privileges at the OS level (the postgres account or the root account).
- Product
- Postgresql
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpostgresql.orgpostgresql.org
Aug 21, 2023user_login.cgi on Draytek Vigor2620 devices before 3.9.8.4 (and on all versions of Vigor2925 devices) allows attackers to send a crafted payload to modify the cCVE-2023-31447 · Network & remote access · draytek · reported by MITRECritical 9.8
user_login.cgi on Draytek Vigor2620 devices before 3.9.8.4 (and on all versions of Vigor2925 devices) allows attackers to send a crafted payload to modify the content of the code segment, insert shellcode, and execute arbitrary code.
- Product
- vigor2620
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddraytek.comgist.github.com
Aug 18, 2023OS command injection vulnerability in ELECOM wireless LAN access point devices allows an authenticated user to execute an arbitrary OS command by sending a specCVE-2023-40072 · Other software · ELECOM CO.,LTD. · reported by vultures@jpcert.or.jpHigh 8.8
OS command injection vulnerability in ELECOM wireless LAN access point devices allows an authenticated user to execute an arbitrary OS command by sending a specially crafted request.
- Product
- WAB-S600-PS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2023OS command injection vulnerability in ELECOM wireless LAN routers allows an attacker who can access the product to execute an arbitrary OS command by sending a CVE-2023-40069 · Other software · ELECOM CO.,LTD. · reported by vultures@jpcert.or.jpCritical 9.8
OS command injection vulnerability in ELECOM wireless LAN routers allows an attacker who can access the product to execute an arbitrary OS command by sending a specially crafted request. Affected products and versions are as follows: WRC-F1167ACF all versions, WRC-1750GHBK all versions, WRC-1167GHBK2 all versions, WRC-1750GHBK2-I all versions, and WRC-1750GHBK-E all versions.
- Product
- WRC-F1167ACF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2023OS command injection vulnerability in ELECOM wireless LAN routers allows an authenticated user to execute an arbitrary OS command by sending a specially craftedCVE-2023-39455 · Other software · ELECOM CO.,LTD. · reported by vultures@jpcert.or.jpHigh 8.8
OS command injection vulnerability in ELECOM wireless LAN routers allows an authenticated user to execute an arbitrary OS command by sending a specially crafted request. Affected products and versions are as follows: WRC-600GHBK-A all versions, WRC-1467GHBK-A all versions, WRC-1900GHBK-A all versions, WRC-733FEBK2-A all versions, WRC-F1167ACF2 all versions, WRC-1467GHBK-S all versions, and WRC-1900GHBK-S all versions.
- Product
- WRC-600GHBK-A
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 16, 2023IBM Security Guardium 10.6, 11.3, 11.4, and 11.5 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially CVE-2023-35893 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.9
IBM Security Guardium 10.6, 11.3, 11.4, and 11.5 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 258824.
- Product
- Security Guardium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Aug 16, 2023IBM WebSphere Application Server Liberty 22.0.0.13 through 23.0.0.7 is vulnerable to a denial of service, caused by sending a specially-crafted request.CVE-2023-38737 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.9
IBM WebSphere Application Server Liberty 22.0.0.13 through 23.0.0.7 is vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources. IBM X-Force ID: 262567.
- Product
- WebSphere Application Server Liberty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Aug 11, 2023SQL Injection vulnerability in cskaza cszcms version 1.2.9, allows attackers to gain sensitive information via pm_sendmail parameter in csz_model.php.CVE-2020-36136 · Other software · Cskaza · reported by MITREHigh 7.5
SQL Injection vulnerability in cskaza cszcms version 1.2.9, allows attackers to gain sensitive information via pm_sendmail parameter in csz_model.php.
- Product
- Cszcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2023An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack.CVE-2023-32565 · Network & remote access · Ivanti · reported by support@hackerone.comCritical 9.1
An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack. Fixed in version 6.4.1.
- Product
- Avalanche
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforums.ivanti.comforums.ivanti.com
Aug 10, 2023An attacker can send a specially crafted message to the Wavelink Avalanche Manager, which could result in service disruption or arbitrary code execution.CVE-2023-32560 · Network & remote access · Ivanti · reported by support@hackerone.comCritical 9.8
An attacker can send a specially crafted message to the Wavelink Avalanche Manager, which could result in service disruption or arbitrary code execution. Thanks to a Researcher at Tenable for finding and reporting. Fixed in version 6.4.1.
- Product
- Avalanche
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Aug 10, 2023An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack.CVE-2023-32566 · Network & remote access · Ivanti · reported by support@hackerone.comCritical 9.1
An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack. Fixed in version 6.4.1.
- Product
- Avalanche
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforums.ivanti.comforums.ivanti.com
Aug 9, 2023Out-of-bounds Write in DoOemFactorySendFactoryBypassCommand of libsec-ril prior to SMR Aug-2023 Release 1 allows local attacker to execute arbitrary code.CVE-2023-30693 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 6.7
Out-of-bounds Write in DoOemFactorySendFactoryBypassCommand of libsec-ril prior to SMR Aug-2023 Release 1 allows local attacker to execute arbitrary code.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Aug 8, 2023 Insufficient validation of the IOCTL (Input Output Control) input buffer in AMD μProf may allow an authenticated user to send an arbitrary address potentCVE-2023-20561 · Other software · AMD · reported by psirt@amd.comMedium 5.5
Insufficient validation of the IOCTL (Input Output Control) input buffer in AMD μProf may allow an authenticated user to send an arbitrary address potentially resulting in a Windows crash leading to denial of service.
- Product
- μProf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 8, 2023 Insufficient validation of the IOCTL (Input Output Control) input buffer in AMD μProf may allow an authenticated user to send an arbitrary buffer potentialCVE-2023-20556 · Other software · AMD · reported by psirt@amd.comMedium 5.5
Insufficient validation of the IOCTL (Input Output Control) input buffer in AMD μProf may allow an authenticated user to send an arbitrary buffer potentially resulting in a Windows crash leading to denial of service.
- Product
- μProf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 8, 2023 A vulnerability was discovered in the Rockwell Automation Armor PowerFlex device when the product sends communications to the local event log.CVE-2023-2423 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comHigh 8.6
A vulnerability was discovered in the Rockwell Automation Armor PowerFlex device when the product sends communications to the local event log. Threat actors could exploit this vulnerability by sending an influx of network commands, causing the product to generate an influx of event log traffic at a high rate. If exploited, the product would stop normal operations and self-reset creating a denial-of-service condition. The error code would need to be cleared prior to resuming normal operations.
- Product
- Armor PowerFlex
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.custhelp.comrockwellautomation.custhelp.com
Aug 8, 2023Memory corruption in RIL while trying to send apdu packet.CVE-2023-21648 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 6.7
Memory corruption in RIL while trying to send apdu packet.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Aug 7, 2023B1i module of SAP Business One - version 10.0, application allows an authenticated user with deep knowledge to send crafted queries over the network to read or CVE-2023-33993 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 7.1
B1i module of SAP Business One - version 10.0, application allows an authenticated user with deep knowledge to send crafted queries over the network to read or modify the SQL data. On successful exploitation, the attacker can cause high impact on confidentiality, integrity and availability of the application.
- Product
- SAP Business One (B1i Layer)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2023Qubely: Allows unauthenticated user to send arbitrary e-mails to arbitrary addresses via the qubely_send_form_data AJAX actionCVE-2021-24916 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Qubely WordPress plugin before 1.8.6 allows unauthenticated user to send arbitrary e-mails to arbitrary addresses via the qubely_send_form_data AJAX action.
- Product
- Qubely
- Fixed in
- 1.8.6
- What to do
- Update Qubely to 1.8.6 or newer.
Aug 2, 2023An authenticated attacker with guest privileges or higher can cause the iControl SOAP process to terminate by sending undisclosed requests.CVE-2023-38419 · Network & remote access · F5 · reported by f5sirt@f5.comMedium 4.3
An authenticated attacker with guest privileges or higher can cause the iControl SOAP process to terminate by sending undisclosed requests. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- Product
- BIG-IP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2023IBM Security Verify Governance, Identity Manager 10.0 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a speciCVE-2023-35019 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.2
IBM Security Verify Governance, Identity Manager 10.0 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 257873.
- Product
- Security Verify Governance, Identity Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.