Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,383 results · page 36 of 68
May 18, 2023Cross-Site Request Forgery (CSRF) vulnerability in Studio Wombat Shoppable Images plugin <= 1.2.3 versions.CVE-2023-25698 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Studio Wombat Shoppable Images plugin <= 1.2.3 versions.
- Fixed in
- 1.2.4
- What to do
- Update the plugin to 1.2.4 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 12, 2023Out of bounds write in ChromeOS Audio Server in Google Chrome on ChromeOS prior to 113.0.5672.114 allowed a remote attacker to potentially exploit heap corruptiCVE-2023-2457 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
Out of bounds write in ChromeOS Audio Server in Google Chrome on ChromeOS prior to 113.0.5672.114 allowed a remote attacker to potentially exploit heap corruption via crafted audio file. (Chromium security severity: High)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comcrbug.com
May 10, 2023Incorrect default permissions in the Audio Service for some Intel(R) NUC P14E Laptop Element software for Windows 10 before version 1.0.0.156 may allow an autheCVE-2023-27382 · Other software · Intel · reported by secure@intel.comMedium 6.7
Incorrect default permissions in the Audio Service for some Intel(R) NUC P14E Laptop Element software for Windows 10 before version 1.0.0.156 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- NUC P14e Laptop Element
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2023Insecure inherited permissions in the Intel(R) NUC Software Studio Service installer before version 1.17.38.0 may allow an authenticated user to potentially enaCVE-2022-38103 · Other software · Intel · reported by secure@intel.comMedium 6.7
Insecure inherited permissions in the Intel(R) NUC Software Studio Service installer before version 1.17.38.0 may allow an authenticated user to potentially enable escalation of privilege via local access
- Product
- NUC Software Studio Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2023Visual Studio Code Spoofing VulnerabilityCVE-2023-29338 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.6
Visual Studio Code Spoofing Vulnerability
- Product
- Visual Studio Code
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
May 8, 2023In audio service, there is a possible missing permission check.CVE-2022-48369 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comHigh 7.8
In audio service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.
- Product
- SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2023In audio service, there is a possible missing permission check.CVE-2022-48368 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comHigh 7.8
In audio service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.
- Product
- SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2023In audio service, there is a possible missing permission check.CVE-2022-48250 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comHigh 7.8
In audio service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.
- Product
- SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2023In audio service, there is a possible missing permission check.CVE-2022-48249 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comHigh 7.8
In audio service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.
- Product
- SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2023In audio service, there is a possible missing permission check.CVE-2022-48248 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comHigh 7.8
In audio service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.
- Product
- SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2023In audio service, there is a possible missing permission check.CVE-2022-48247 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comHigh 7.8
In audio service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.
- Product
- SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2023In audio service, there is a possible missing permission check.CVE-2022-48246 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comHigh 7.8
In audio service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.
- Product
- SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2023In audio service, there is a possible missing permission check.CVE-2022-48245 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comHigh 7.8
In audio service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.
- Product
- SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2023In audio service, there is a possible missing permission check.CVE-2022-48244 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comHigh 7.8
In audio service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.
- Product
- SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2023In audio service, there is a possible missing permission check.CVE-2022-48243 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comHigh 7.8
In audio service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.
- Product
- SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2023An issue discovered in Obsidian Canvas 1.1.9 allows remote attackers to send desktop notifications, record user audio and other unspecified impacts via embeddedCVE-2023-27035 · Other software · Obsidian · reported by MITREMedium 6.5
An issue discovered in Obsidian Canvas 1.1.9 allows remote attackers to send desktop notifications, record user audio and other unspecified impacts via embedded website on the canvas page.
- Product
- Obsidian
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforum.obsidian.mdforum.obsidian.md
Apr 28, 2023In Talend Studio before 7.3.1-R2022-10 and 8.x before 8.0.1-R2022-09, microservices allow unauthenticated access to the Jolokia endpoint of the microservice.CVE-2023-31444 · Other software · Talend · reported by MITREHigh 7.5
In Talend Studio before 7.3.1-R2022-10 and 8.x before 8.0.1-R2022-09, microservices allow unauthenticated access to the Jolokia endpoint of the microservice. This allows for remote access to the JVM via the Jolokia JMX-HTTP bridge.
- Product
- Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2023An issue found in Ego Studio SuperClean v.1.1.9 and v.1.1.5 allows an attacker to gain privileges cause a denial of service via the update_info field of the _deCVE-2023-27652 · Other software · Egostudiogroup · reported by MITREMedium 5.5
An issue found in Ego Studio SuperClean v.1.1.9 and v.1.1.5 allows an attacker to gain privileges cause a denial of service via the update_info field of the _default_.xml file.
- Product
- Super Clean
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordegostudiogroup.comapkpure.com
Apr 19, 2023In onNullBinding of CallScreeningServiceHelper.java, there is a possible way to record audio without showing a privacy indicator due to a permissions bypass.CVE-2023-21083 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In onNullBinding of CallScreeningServiceHelper.java, there is a possible way to record audio without showing a privacy indicator due to a permissions bypass. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-252762941
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Apr 17, 2023Nextcloud Talk is a chat, video & audio call extension for Nextcloud.CVE-2023-30540 · Other software · nextcloud · reported by GitHubLow 3.5
Nextcloud Talk is a chat, video & audio call extension for Nextcloud. In affected versions a user that was added later to a conversation can use this information to get access to data that was deleted before they were added to the conversation. This issue has been patched in version 15.0.5 and it is recommended that users upgrad to 15.0.5. There are no known workarounds for this issue.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2023An issue found in Ego Studio SuperClean v.1.1.9 and v.1.1.5 allows an attacker to gain privileges via the update_info field of the _default_.xml file.CVE-2023-27651 · Other software · Egostudiogroup · reported by MITREHigh 7.8
An issue found in Ego Studio SuperClean v.1.1.9 and v.1.1.5 allows an attacker to gain privileges via the update_info field of the _default_.xml file.
- Product
- Super Clean
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordegostudiogroup.comapkpure.com
Apr 14, 2023Directory Traversal vulnerability found in T-ME Studios Change Color of Keypad v.1.275.1.277 allows a remote attacker to execute arbitrary code via the dex fileCVE-2023-27648 · Other software · Timmystudios · reported by MITRECritical 9.8
Directory Traversal vulnerability found in T-ME Studios Change Color of Keypad v.1.275.1.277 allows a remote attacker to execute arbitrary code via the dex file in the internal storage.
- Product
- Change Color Of Keypad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcorporate.timmystudios.comgithub.com
Apr 14, 2023Timmystudios Fast Typing Keyboard v1.275.1.162 allows unauthorized apps to overwrite arbitrary files in its internal storage via a dictionary traversal vulnerabCVE-2022-47027 · Other software · Timmystudios · reported by MITRECritical 9.8
Timmystudios Fast Typing Keyboard v1.275.1.162 allows unauthorized apps to overwrite arbitrary files in its internal storage via a dictionary traversal vulnerability and achieve arbitrary code execution.
- Product
- Fast Typing Keyboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcorporate.timmystudios.comgithub.com
Apr 13, 2023Memory corruption due to incorrect type conversion or cast in audio while using audio playback/capture when crafted address is sent from AGM IPC to AGM.CVE-2022-33301 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 6.7
Memory corruption due to incorrect type conversion or cast in audio while using audio playback/capture when crafted address is sent from AGM IPC to AGM.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Apr 11, 2023Visual Studio Spoofing VulnerabilityCVE-2023-28299 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Visual Studio Spoofing Vulnerability
- Product
- Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 11, 2023Visual Studio Remote Code Execution VulnerabilityCVE-2023-28296 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Visual Studio Remote Code Execution Vulnerability
- Product
- Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 11, 2023Visual Studio Information Disclosure VulnerabilityCVE-2023-28263 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Visual Studio Information Disclosure Vulnerability
- Product
- Microsoft Visual Studio 2022 version 17.2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 11, 2023Visual Studio Elevation of Privilege VulnerabilityCVE-2023-28262 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Visual Studio Elevation of Privilege Vulnerability
- Product
- Microsoft Visual Studio 2022 version 17.2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 11, 2023Visual Studio Code Remote Code Execution VulnerabilityCVE-2023-24893 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Visual Studio Code Remote Code Execution Vulnerability
- Product
- Visual Studio Code
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 11, 2023A use-after-free flaw was found in btsdio_remove in drivers\bluetooth\btsdio.c in the Linux Kernel.CVE-2023-1989 · Other software · Red Hat · reported by Red HatHigh 7
A use-after-free flaw was found in btsdio_remove in drivers\bluetooth\btsdio.c in the Linux Kernel. A call to btsdio_remove with an unfinished job may cause a race problem which leads to a UAF on hdev devices.
- Product
- Red Hat Enterprise Linux 8
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Apr 11, 2023An issue found in POWERAMP audioplayer build 925 bundle play and build 954 allows a remote attacker to gain privileges via the reverb and EQ preset parameters.CVE-2023-27645 · Other software · Powerampapp · reported by MITRECritical 9.8
An issue found in POWERAMP audioplayer build 925 bundle play and build 954 allows a remote attacker to gain privileges via the reverb and EQ preset parameters.
- Product
- Poweramp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.complay.google.com
Apr 6, 2023In audio, there is a possible out of bounds write due to a missing bounds check.CVE-2023-20670 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comMedium 6.7
In audio, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07648710; Issue ID: ALPS07648710.
- Product
- MT2715, MT6580, MT6739, MT6761, MT6765, MT6768, MT6779, MT6781, MT6785, MT6789, MT6833, MT6853, MT6853T, MT6855, MT6873, MT6877, MT6879, MT6883, MT6885, MT6889,
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcorp.mediatek.comcorp.mediatek.com
Apr 2, 2023Jenkins Visual Studio Code Metrics Plugin 1.7 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.CVE-2023-28681 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comHigh 8.2
Jenkins Visual Studio Code Metrics Plugin 1.7 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
- Product
- Jenkins Visual Studio Code Metrics Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2023Nextcloud talk is a video & audio conferencing app for Nextcloud.CVE-2023-28845 · Other software · nextcloud · reported by GitHubLow 3.5
Nextcloud talk is a video & audio conferencing app for Nextcloud. In affected versions the talk app does not properly filter access to a conversations member list. As a result an attacker could use this vulnerability to gain information about the members of a Talk conversation, even if they themselves are not members. It is recommended that the Nextcloud Talk is upgraded to 14.0.9 or 15.0.4. There are no known workarounds for this vulnerability.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2023WP Film Studio: Does not have CSRF checkCVE-2023-0500 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP Film Studio WordPress plugin before 1.3.5 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
- Product
- WP Film Studio
- Fixed in
- 1.3.5
- What to do
- Update WP Film Studio to 1.3.5 or newer.
Mar 10, 2023Memory corruption due to improper authentication in Qualcomm IPC while loading unsigned lib in audio PD.CVE-2022-33242 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory corruption due to improper authentication in Qualcomm IPC while loading unsigned lib in audio PD.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Mar 7, 2023Heap buffer overflow in Web Audio API in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to potentially exploit heap corruption via a crafted HTMCVE-2023-1222 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
Heap buffer overflow in Web Audio API in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comcrbug.com
Mar 6, 2023WPaudio MP3 Player: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0069 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WPaudio MP3 Player WordPress plugin through 4.0.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- WPaudio MP3 Player
- Affected
- up to 4.0.2
- What to do
- Affects up to 4.0.2. Update WPaudio MP3 Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 28, 2023In Dataiku DSS 11.2.1, an attacker can download other Dataiku files that were uploaded to the myfiles section by specifying the target username in a download reCVE-2023-24045 · Other software · Dataiku · reported by MITREMedium 6.5
In Dataiku DSS 11.2.1, an attacker can download other Dataiku files that were uploaded to the myfiles section by specifying the target username in a download request.
- Product
- Data Science Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddataiku.comgist.github.com
Feb 28, 2023In createTrack of AudioFlinger.cpp, there is a possible way to record audio without a privacy indicator due to a logic error in the code.CVE-2022-20551 · Computers, phones & browsers · Google · reported by security@android.comMedium 6.7
In createTrack of AudioFlinger.cpp, there is a possible way to record audio without a privacy indicator due to a logic error in the code. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12 Android-12L Android-13Android ID: A-243376549
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Feb 27, 2023Nextcloud Talk is a fully on-premises audio/video and chat communication service.CVE-2023-26041 · Other software · nextcloud · reported by GitHubLow 2.6
Nextcloud Talk is a fully on-premises audio/video and chat communication service. When cron jobs were misconfigured and therefore messages are not expired, the API would still return them while they were then hidden by the frontend code. It is recommended that the Nextcloud Talk is upgraded to 15.0.3. There are no workaround available.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2023Gradio is an open-source Python library to build machine learning and data science demos and web applications.CVE-2023-25823 · Other software · gradio-app · reported by GitHubMedium 5.4
Gradio is an open-source Python library to build machine learning and data science demos and web applications. Versions prior to 3.13.1 contain Use of Hard-coded Credentials. When using Gradio's share links (i.e. creating a Gradio app and then setting `share=True`), a private SSH key is sent to any user that connects to the Gradio machine, which means that a user could access other users' shared Gradio demos. From there, other exploits are possible depending on the level of access/exposure the Gradio app provides. This issue is patched in version 3.13.1, however, users are recommended to update to 3.19.1 or later where the FRP solution has been properly tested.
- Product
- gradio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 17, 2023Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crafter Studio on Linux, MacOS, Windows, x86, ARM, 64 bit CVE-2023-26020 · Other software · CrafterCMS · reported by security@craftersoftware.comMedium 5.7
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crafter Studio on Linux, MacOS, Windows, x86, ARM, 64 bit allows SQL Injection.This issue affects CrafterCMS v4.0 from 4.0.0 through 4.0.1, and v3.1 from 3.1.0 through 3.1.26.
- Product
- CrafterCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.craftercms.orgdocs.craftercms.org
Feb 14, 2023Visual Studio Remote Code Execution VulnerabilityCVE-2023-23381 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Visual Studio Remote Code Execution Vulnerability
- Product
- Microsoft Visual Studio 2013 Update 5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Feb 14, 2023Visual Studio Remote Code Execution VulnerabilityCVE-2023-21815 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Visual Studio Remote Code Execution Vulnerability
- Product
- Microsoft Visual Studio 2013 Update 5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Feb 14, 2023.NET and Visual Studio Remote Code Execution VulnerabilityCVE-2023-21808 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
.NET and Visual Studio Remote Code Execution Vulnerability
- Product
- .NET 6.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Feb 14, 2023Visual Studio Denial of Service VulnerabilityCVE-2023-21567 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.6
Visual Studio Denial of Service Vulnerability
- Product
- Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Feb 14, 2023Visual Studio Elevation of Privilege VulnerabilityCVE-2023-21566 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Visual Studio Elevation of Privilege Vulnerability
- Product
- Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Feb 14, 2023Microsoft SQL Server Integration Service (VS extension) Remote Code Execution VulnerabilityCVE-2023-21568 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.3
Microsoft SQL Server Integration Service (VS extension) Remote Code Execution Vulnerability
- Product
- SQL Server Integration Services for Visual Studio 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Feb 13, 2023Lightweight Accordion: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0373 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Lightweight Accordion WordPress plugin before 1.5.15 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Lightweight Accordion
- Fixed in
- 1.5.15
- What to do
- Update Lightweight Accordion to 1.5.15 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.