Updated 10 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

570new WordPress flaws this week

391,310entries in the database

4,359 results · page 37 of 88

Dec 14, 2023Business Logic Errors in GitHub repository microweber/microweber prior to 2.0.CVE-2023-6832 · Other software · microweber · reported by security@huntr.devMedium 4.3
Business Logic Errors in GitHub repository microweber/microweber prior to 2.0.
Product
microweber/microweber
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com huntr.com
Dec 14, 2023Innovs HR – Complete Human Resource Management System for Your Business: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49171 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TheInnovs Innovs HR – Complete Human Resource Management System for Your Business allows Reflected XSS.This issue affects Innovs HR – Complete Human Resource Management System for Your Business: from n/a through 1.0.3.4.
Product
Innovs HR – Complete Human Resource Management System for Your Business
Affected
up to 1.0.3.4
What to do
Affects up to 1.0.3.4. Update Innovs HR – Complete Human Resource Management System for Your Business to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 11, 2023SAP Business Objects Business Intelligence Platform is vulnerable to stored XSS allowing an attacker to upload agnostic documents in the system which when openeCVE-2023-42478 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 7.5
SAP Business Objects Business Intelligence Platform is vulnerable to stored XSS allowing an attacker to upload agnostic documents in the system which when opened by any other user could lead to high impact on integrity of the application.
Product
Business Objects BI Platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record me.sap.com sap.com
Dec 11, 2023SAP Business Objects Web Intelligence - version 420, allows an authenticated attacker to inject JavaScript code into Web Intelligence documents which is then eCVE-2023-42476 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.8
SAP Business Objects Web Intelligence - version 420, allows an authenticated attacker to inject JavaScript code into Web Intelligence documents which is then executed in the victim’s browser each time the vulnerable page is visited. Successful exploitation can lead to exposure of the data that the user has access to. In the worst case, attacker could access data from reporting databases.
Product
SAP BusinessObjects Web Intelligence
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record me.sap.com sap.com
Dec 6, 2023Business Logic Errors in GitHub repository microweber/microweber prior to 2.0.CVE-2023-6566 · Other software · microweber · reported by security@huntr.devMedium 6.5
Business Logic Errors in GitHub repository microweber/microweber prior to 2.0.
Product
microweber/microweber
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com huntr.com
Nov 30, 2023Business Directory Plugin – Easy Listing Directories for: Cross-Site Request Forgery (CSRF)CVE-2023-5803 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Business Directory Team Business Directory Plugin – Easy Listing Directories for WordPress allows Cross-Site Request Forgery.This issue affects Business Directory Plugin – Easy Listing Directories for WordPress: from n/a through 6.3.10.
Product
Business Directory Plugin – Easy Listing Directories for
Affected
up to 6.3.10
What to do
Affects up to 6.3.10. Update Business Directory Plugin – Easy Listing Directories for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 27, 2023OroCommerce is an open-source Business to Business Commerce application built with flexibility in mind.CVE-2023-32065 · Websites & servers · oroinc · reported by GitHubMedium 5.8
OroCommerce is an open-source Business to Business Commerce application built with flexibility in mind. Detailed Order totals information may be received by Order ID. This issue is patched in version 5.0.11 and 5.1.1.
Product
orocommerce
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 27, 2023OroPlatform is a PHP Business Application Platform (BAP) designed to make development of custom business applications easier and faster.CVE-2022-41951 · Other software · oroinc · reported by GitHubHigh 8.5
OroPlatform is a PHP Business Application Platform (BAP) designed to make development of custom business applications easier and faster. Path Traversal is possible in `Oro\Bundle\GaufretteBundle\FileManager::getTemporaryFileName`. With this method, an attacker can pass the path to a non-existent file, which will allow writing the content to a new file that will be available during script execution. This vulnerability has been fixed in version 5.0.9.
Product
platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 13, 2023SAP Business One installation - version 10.0, does not perform proper authentication and authorization checks for SMB shared folder.CVE-2023-31403 · Network & remote access · SAP_SE · reported by cna@sap.comCritical 9.6
SAP Business One installation - version 10.0, does not perform proper authentication and authorization checks for SMB shared folder. As a result, any malicious user can read and write to the SMB shared folder. Additionally, the files in the folder can be executed or be used by the installation process leading to considerable impact on confidentiality, integrity and availability.
Product
SAP Business One
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record me.sap.com sap.com
Nov 13, 2023An XSS vulnerability has been discovered in ICS Business Manager affecting version 7.06.0028.7066.CVE-2023-6098 · Other software · ICSSolution · reported by cve-coordination@incibe.esMedium 6.3
An XSS vulnerability has been discovered in ICS Business Manager affecting version 7.06.0028.7066. A remote attacker could send a specially crafted string exploiting the obdd_act parameter, allowing the attacker to steal an authenticated user's session, and perform actions within the application.
Product
ICS Business Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record incibe.es incibe.es
Nov 13, 2023A SQL injection vulnerability has been found in ICS Business Manager, affecting version 7.06.0028.7089.CVE-2023-6097 · Other software · ICSSolution · reported by cve-coordination@incibe.esCritical 9.4
A SQL injection vulnerability has been found in ICS Business Manager, affecting version 7.06.0028.7089. This vulnerability could allow a remote user to send a specially crafted SQL query and retrieve all the information stored in the database. The data could also be modified or deleted, causing the application to malfunction.
Product
ICS Business Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record incibe.es incibe.es
Nov 9, 2023Cross-Site Request Forgery (CSRF) vulnerability in Igor Benic Simple Giveaways – Grow your business, email lists and traffic with contests plugin <= 2.46.0 versCVE-2023-31086 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Igor Benic Simple Giveaways – Grow your business, email lists and traffic with contests plugin <= 2.46.0 versions.
Fixed in
2.46.1
What to do
Update the plugin to 2.46.1 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 9, 2023Cross-Site Request Forgery (CSRF) vulnerability in Martin Gibson Auto Publish for Google My Business plugin <= 3.7 versions.CVE-2023-47237 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Martin Gibson Auto Publish for Google My Business plugin <= 3.7 versions.
Fixed in
3.8
What to do
Update the plugin to 3.8 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023Directorist – WordPress Business Directory Plugin with Classified Ads Listings: Improper Neutralization of Formula Elements in a CSV FileCVE-2023-41798 · WordPress plugins & themes · reported by PatchstackMedium 5.1
Improper Neutralization of Formula Elements in a CSV File vulnerability in wpWax Directorist – WordPress Business Directory Plugin with Classified Ads Listing.This issue affects Directorist – WordPress Business Directory Plugin with Classified Ads Listings: from n/a through 7.7.1.
Product
Directorist – WordPress Business Directory Plugin with Classified Ads Listings
Affected
up to 7.7.1
What to do
Affects up to 7.7.1. Update Directorist – WordPress Business Directory Plugin with Classified Ads Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 1, 2023Multiple MFPs (multifunction printers) provided by FUJIFILM Business Innovation Corp.CVE-2023-46327 · Other software · FUJIFILM Business Inovation Corp. · reported by vultures@jpcert.or.jpMedium 5.9
Multiple MFPs (multifunction printers) provided by FUJIFILM Business Innovation Corp. and Xerox Corporation provide a facility to export the contents of their Address Book with encrypted form, but the encryption strength is insufficient. With the knowledge of the encryption process and the encryption key, the information such as the server credentials may be obtained from the exported Address Book data. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].
Product
Apeos C3070 Asia Pacific Model
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp security.business.xerox.com
Oct 17, 2023Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Web Dashboards).CVE-2023-22109 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 4.6
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Web Dashboards). Supported versions that are affected are 6.4.0.0.0, 7.0.0.0.0 and 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Business Intelligence Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 4.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N).
Product
Business Intelligence Enterprise Edition
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com oracle.com
Oct 17, 2023Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: UI Components).CVE-2023-22107 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.1
Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: UI Components). Supported versions that are affected are ECC: 8, 9 and 10. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Enterprise Command Center Framework. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Enterprise Command Center Framework, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Enterprise Command Center Framework accessible data as well as unauthorized read access to a subset of Oracle Enterprise Command Center Framework accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
Product
Enterprise Command Center Framework
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com oracle.com
Oct 17, 2023Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: API).CVE-2023-22106 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.5
Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: API). Supported versions that are affected are ECC: 8, 9 and 10. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Command Center Framework. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Enterprise Command Center Framework accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Product
Enterprise Command Center Framework
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com oracle.com
Oct 17, 2023Vulnerability in the Oracle iRecruitment product of Oracle E-Business Suite (component: Requisition and Vacancy).CVE-2023-22093 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.5
Vulnerability in the Oracle iRecruitment product of Oracle E-Business Suite (component: Requisition and Vacancy). Supported versions that are affected are 12.2.3-12.2.12. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle iRecruitment. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle iRecruitment accessible data as well as unauthorized read access to a subset of Oracle iRecruitment accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).
Product
iRecruitment
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com oracle.com
Oct 17, 2023Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Pod Admin).CVE-2023-22082 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 5.4
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Pod Admin). Supported versions that are affected are 6.4.0.0.0 and 7.0.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Business Intelligence Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Business Intelligence Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
Product
Business Intelligence Enterprise Edition
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com oracle.com
Oct 17, 2023Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Personalization).CVE-2023-22076 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.1
Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Personalization). Supported versions that are affected are 12.2.3-12.2.12. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Applications Framework. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Applications Framework, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Applications Framework accessible data as well as unauthorized read access to a subset of Oracle Applications Framework accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
Product
Applications Framework
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com oracle.com
Oct 14, 2023IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is vulnCVE-2023-35024 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.6
IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 258349.
Product
Cloud Pak for Business Automation
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com
Oct 10, 2023Microsoft Skype for Business Privilege Escalation VulnerabilityCVE-2023-41763 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedMedium 5.3
Microsoft Skype for Business contains an unspecified vulnerability that allows for privilege escalation.
Product
Skype for Business
On CISA’s list since
Oct 10, 2023 (federal fix deadline Oct 31, 2023)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
Oct 10, 2023Skype for Business Remote Code Execution VulnerabilityCVE-2023-36789 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.2
Skype for Business Remote Code Execution Vulnerability
Product
Skype for Business Server 2019 CU7
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com msrc.microsoft.com
Oct 10, 2023Skype for Business Remote Code Execution VulnerabilityCVE-2023-36786 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.2
Skype for Business Remote Code Execution Vulnerability
Product
Skype for Business Server 2015 CU13
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com msrc.microsoft.com
Oct 10, 2023Skype for Business Remote Code Execution VulnerabilityCVE-2023-36780 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.2
Skype for Business Remote Code Execution Vulnerability
Product
Skype for Business Server 2019 CU7
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com msrc.microsoft.com
Oct 9, 2023SAP BusinessObjects Web Intelligence - version 420, has a URL with parameter that could be vulnerable to XSS attack.CVE-2023-42474 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.8
SAP BusinessObjects Web Intelligence - version 420, has a URL with parameter that could be vulnerable to XSS attack. The attacker could send a malicious link to a user that would possibly allow an attacker to retrieve the sensitive information.
Product
SAP BusinessObjects Web Intelligence
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record me.sap.com sap.com
Oct 9, 2023SAP Business One (B1i) - version 10.0, allows an authorized attacker to retrieve the details stack trace of the fault message to conduct the XXE injection, whicCVE-2023-41365 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
SAP Business One (B1i) - version 10.0, allows an authorized attacker to retrieve the details stack trace of the fault message to conduct the XXE injection, which will lead to information disclosure. After successful exploitation, an attacker can cause limited impact on the confidentiality and no impact to the integrity and availability.
Product
SAP Business One (B1i)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record me.sap.com sap.com
Oct 9, 2023OroCommerce is an open-source Business to Business Commerce application.CVE-2022-35950 · Websites & servers · oroinc · reported by GitHubMedium 6.9
OroCommerce is an open-source Business to Business Commerce application. In versions 4.1.0 through 4.1.13, 4.2.0 through 4.2.10, 5.0.0 prior to 5.0.11, and 5.1.0 prior to 5.1.1, the JS payload added to the product name may be executed at the storefront when adding a note to the shopping list line item containing a vulnerable product. An attacker should be able to edit a product in the admin area and force a user to add this product to Shopping List and click add a note for it. Versions 5.0.11 and 5.1.1 contain a fix for this issue.
Product
orocommerce
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 9, 2023A Cross-Site Request Forgery (CSRF) vulnerability affecting Teamwork Cloud from No Magic Release 2021x through No Magic Release 2022x could allow with some veryCVE-2023-3589 · Other software · Dassault Systèmes · reported by 3DS.Information-Security@3ds.comMedium 6.8
A Cross-Site Request Forgery (CSRF) vulnerability affecting Teamwork Cloud from No Magic Release 2021x through No Magic Release 2022x could allow with some very specific conditions an attacker to send a specifically crafted query to the server.
Product
Teamwork Cloud - Business Edition
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record 3ds.com 3ds.com
Sep 29, 2023A business logic error in GitLab EE affecting all versions prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1 allows access to internal projects.CVE-2023-3914 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5.4
A business logic error in GitLab EE affecting all versions prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1 allows access to internal projects. A service account is not deleted when a namespace is deleted, allowing access to internal projects.
Product
GitLab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gitlab.com hackerone.com
Sep 27, 2023Staff / Employee Business Directory for Active Directory: LDAP PassbackCVE-2023-4505 · WordPress plugins & themes · reported by WordfenceLow 2.2
The Staff / Employee Business Directory for Active Directory plugin for WordPress is vulnerable to LDAP Passback in versions up to, and including, 1.2.3. This is due to insufficient validation when changing the LDAP server. This makes it possible for authenticated attackers, with administrative access and above, to change the LDAP server and retrieve the credentials for the original LDAP server.
Product
Staff / Employee Business Directory for Active Directory
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update Staff / Employee Business Directory for Active Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record medium.com plugins.trac.wordpress.org
Sep 27, 2023 Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.5.0.0 and 9.3.0.4, including 8.3.x.x, saves passwords of the Hadoop Copy Files step in plCVE-2023-2358 · Other software · Hitachi Vantara · reported by security.vulnerabilities@hitachivantara.comMedium 4.3
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.5.0.0 and 9.3.0.4, including 8.3.x.x, saves passwords of the Hadoop Copy Files step in plaintext.
Product
Pentaho Business Analytics Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.pentaho.com support.pentaho.com
Sep 19, 2023Trend Micro Apex One and Worry-Free Business Security Remote Code Execution VulnerabilityCVE-2023-41179 · Other software · Trend Micro · reported by security@trendmicro.comExploitedHigh 7.2
Trend Micro Apex One and Worry-Free Business Security contain an unspecified vulnerability in the third-party anti-virus uninstaller that could allow an attacker to manipulate the module to conduct remote code execution. An attacker must first obtain administrative console access on the target system in order to exploit this vulnerability.
Product
Apex One and Worry-Free Business Security
On CISA’s list since
Sep 21, 2023 (federal fix deadline Oct 12, 2023)
What to do
Attackers are using this now. Install Trend Micro’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog jvn.jp success.trendmicro.com
Sep 13, 2023A stored Cross-site Scripting (XSS) vulnerability affecting Teamwork Cloud from No Magic Release 2021x through No Magic Release 2022x allows an attacker to execCVE-2023-3588 · Other software · Dassault Systèmes · reported by 3DS.Information-Security@3ds.comMedium 5.4
A stored Cross-site Scripting (XSS) vulnerability affecting Teamwork Cloud from No Magic Release 2021x through No Magic Release 2022x allows an attacker to execute arbitrary script code.
Product
Teamwork Cloud - Business Edition
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record 3ds.com 3ds.com
Sep 11, 2023SAP BusinessObjects Suite Installer - version 420, 430, allows an attacker within the network to create a directory under temporary directory and link it to a dCVE-2023-40623 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.2
SAP BusinessObjects Suite Installer - version 420, 430, allows an attacker within the network to create a directory under temporary directory and link it to a directory with operating system files. On successful exploitation the attacker can delete all the operating system files causing a limited impact on integrity and completely compromising the availability of the system.
Product
SAP BusinessObjects Suite (Installer)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record me.sap.com sap.com
Sep 11, 2023SAP BusinessObjects Business Intelligence Platform (Promotion Management) - versions 420, 430, under certain condition allows an authenticated attacker to view CVE-2023-40622 · Network & remote access · SAP_SE · reported by cna@sap.comCritical 9.9
SAP BusinessObjects Business Intelligence Platform (Promotion Management) - versions 420, 430, under certain condition allows an authenticated attacker to view sensitive information which is otherwise restricted. On successful exploitation, the attacker can completely compromise the application causing high impact on confidentiality, integrity, and availability.
Product
SAP BusinessObjects Business Intelligence Platform (Promotion Management)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record me.sap.com sap.com
Sep 11, 2023Due to insufficient file type validation, SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface) - version 420, allows a report crCVE-2023-42472 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 8.7
Due to insufficient file type validation, SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface) - version 420, allows a report creator to upload files from local system into the report over the network. When uploading the image file, an authenticated attacker could intercept the request, modify the content type and the extension to read and modify sensitive data causing a high impact on confidentiality and integrity of the application.
Product
SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record me.sap.com sap.com
Sep 11, 2023Due to the lack of validation, SAP BusinessObjects Business Intelligence Platform (Version Management System) - version 403, permits an unauthenticated user to CVE-2023-37489 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.3
Due to the lack of validation, SAP BusinessObjects Business Intelligence Platform (Version Management System) - version 403, permits an unauthenticated user to read the code snippet through the UI, which leads to low impact on confidentiality and no impact on the application's availability or integrity.
Product
SAP BusinessObjects Business Intelligence Platform (Version Management System)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record me.sap.com sap.com
Sep 11, 2023In PHPJabbers Cleaning Business Software 1.0, there is no encryption on user passwords allowing an attacker to gain access to all user accounts.CVE-2023-36140 · Websites & servers · Phpjabbers · reported by MITRECritical 9.8
In PHPJabbers Cleaning Business Software 1.0, there is no encryption on user passwords allowing an attacker to gain access to all user accounts.
Product
Cleaning Business Software
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record medium.com phpjabbers.com
Sep 8, 2023Pega Platform versions 7.1 to 8.8.3 are affected by an HTML Injection issue with a name field utilized in Visual Business Director, however this field can only CVE-2023-4843 · Other software · Pegasystems · reported by security@pega.comMedium 4.3
Pega Platform versions 7.1 to 8.8.3 are affected by an HTML Injection issue with a name field utilized in Visual Business Director, however this field can only be modified by an authenticated administrative user.
Product
Pega Platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.pega.com support.pega.com
Sep 6, 2023SearchBlox before Version 9.1 is vulnerable to business logic bypass where the user is able to create multiple super admin users in the system.CVE-2020-10130 · Other software · SearchBlox · reported by cret@cert.orgHigh 8.8
SearchBlox before Version 9.1 is vulnerable to business logic bypass where the user is able to create multiple super admin users in the system.
Product
SearchBlox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record developer.searchblox.com developer.searchblox.com
Sep 6, 2023A vulnerability in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated, remote attCVE-2023-20250 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.5
A vulnerability in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to improper validation of requests that are sent to the web-based management interface. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface. A successful exploit could allow the attacker to execute arbitrary code with root privileges on an affected device. To exploit this vulnerability, the attacker must have valid Administrator credentials on the affected device.
Product
Cisco Small Business RV Series Router Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sec.cloudapps.cisco.com sec.cloudapps.cisco.com
Aug 30, 2023phpjabbers Business Directory Script 3.2 is vulnerable to SQL Injection via the column parameter.CVE-2023-41539 · Websites & servers · Phpjabbers · reported by MITREHigh 7.5
phpjabbers Business Directory Script 3.2 is vulnerable to SQL Injection via the column parameter.
Product
Business Directory Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 30, 2023phpjabbers Business Directory Script 3.2 is vulnerable to Cross Site Scripting (XSS) via the keyword parameter.CVE-2023-41537 · Websites & servers · Phpjabbers · reported by MITREMedium 6.1
phpjabbers Business Directory Script 3.2 is vulnerable to Cross Site Scripting (XSS) via the keyword parameter.
Product
Business Directory Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 13, 2023Genesys Administrator Extension (GAX) before 9.0.105.15 is vulnerable to Cross Site Scripting (XSS) via the Business Structure page of the iWD plugin, aka GAX-1CVE-2023-23208 · Other software · Genesys · reported by MITREMedium 6.1
Genesys Administrator Extension (GAX) before 9.0.105.15 is vulnerable to Cross Site Scripting (XSS) via the Business Structure page of the iWD plugin, aka GAX-11261.
Product
Administrator Extension
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.genesys.com docs.genesys.com
Aug 10, 2023Business Logic Errors in GitHub repository froxlor/froxlor prior to 2.0.22,2.1.0.CVE-2023-4304 · Other software · froxlor · reported by security@huntr.devLow 3.8
Business Logic Errors in GitHub repository froxlor/froxlor prior to 2.0.22,2.1.0.
Product
froxlor/froxlor
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com huntr.dev
Aug 9, 2023A command injection vulnerability in the component /api/cron/settings/setJob/ of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allowCVE-2023-39008 · Other software · Opnsense · reported by MITRECritical 9.8
A command injection vulnerability in the component /api/cron/settings/setJob/ of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute arbitrary system commands.
Product
Opnsense
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com logicaltrust.net
Aug 9, 2023/ui/cron/item/open in the Cron component of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows XSS via openAction in app/controlleCVE-2023-39007 · Other software · Opnsense · reported by MITRECritical 9.6
/ui/cron/item/open in the Cron component of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows XSS via openAction in app/controllers/OPNsense/Cron/ItemController.php.
Product
Opnsense
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 9, 2023The Crash Reporter (crash_reporter.php) component of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 mishandles input sanitization.CVE-2023-39006 · Other software · Opnsense · reported by MITREMedium 5.4
The Crash Reporter (crash_reporter.php) component of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 mishandles input sanitization.
Product
Opnsense
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com logicaltrust.net

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.