Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,533 results · page 39 of 71
Jun 28, 2022Mermaid is a JavaScript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams.CVE-2022-31108 · Other software · mermaid-js · reported by GitHubMedium 4.1
Mermaid is a JavaScript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams. An attacker is able to inject arbitrary `CSS` into the generated graph allowing them to change the styling of elements outside of the generated graph, and potentially exfiltrate sensitive information by using specially crafted `CSS` selectors. The following example shows how an attacker can exfiltrate the contents of an input field by bruteforcing the `value` attribute one character at a time. Whenever there is an actual match, an `http` request will be made by the browser in order to "load" a background image that will let an attacker know what's the value of the character. This issue may lead to `Information Disclosure` via CSS selectors and functions able to generate HTTP requests. This also allows an attacker to change the document in ways which may lead a user to perform unintended actions, such as clicking on a link, etc. This issue has been resolved in version 9.1.3. Users are advised to upgrade. Users unable to upgrade should ensure that user input is adequately escaped before embedding it in CSS blocks.
- Product
- mermaid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2022Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in Nicdark's Hotel Booking plugin <= 3.0 at WordPressCVE-2022-29443 · WordPress plugins & themes · reported by PatchstackMedium 4.1
Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in Nicdark's Hotel Booking plugin <= 3.0 at WordPress.
- Affected
- up to 3.0
- What to do
- Affects up to 3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Jun 15, 2022Theme Park Ticketing System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at edit_ticket.php.CVE-2022-32302 · Other software · Theme Park Ticketing System Project · reported by MITREHigh 8.8
Theme Park Ticketing System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at edit_ticket.php.
- Product
- Theme Park Ticketing System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2022Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in Nicdark d.o.o.CVE-2022-27859 · WordPress plugins & themes · reported by PatchstackMedium 4.1
Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in Nicdark d.o.o. Travel Management plugin <= 2.0 at WordPress.
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Jun 14, 2022'Mobaoku-Auction&Flea Market' App for iOS versions prior to 5.5.16 improperly verifies server certificates, which may allow an attacker to eavesdrop on an encryCVE-2022-29482 · Other software · DeNA Co., Ltd. · reported by vultures@jpcert.or.jpLow 3.7
'Mobaoku-Auction&Flea Market' App for iOS versions prior to 5.5.16 improperly verifies server certificates, which may allow an attacker to eavesdrop on an encrypted communication via a man-in-the-middle attack.
- Product
- Mobaoku-Auction & Flea Market App for iOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2022dynamicMarkt <= 3.10 is affected by SQL injection in the kat parameter of index.php.CVE-2021-41756 · Other software · Dynamicvision · reported by MITRECritical 9.8
dynamicMarkt <= 3.10 is affected by SQL injection in the kat parameter of index.php.
- Product
- Dynamicmarkt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2022dynamicMarkt <= 3.10 is affected by SQL injection in the kat1 parameter of index.php.CVE-2021-41755 · Other software · Dynamicvision · reported by MITRECritical 9.8
dynamicMarkt <= 3.10 is affected by SQL injection in the kat1 parameter of index.php.
- Product
- Dynamicmarkt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2022dynamicMarkt <= 3.10 is affected by SQL injection in the parent parameter of index.php.CVE-2021-41754 · Other software · Dynamicvision · reported by MITRECritical 9.8
dynamicMarkt <= 3.10 is affected by SQL injection in the parent parameter of index.php.
- Product
- Dynamicmarkt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2022The Mechanize library is used for automating interaction with websites.CVE-2022-31033 · Other software · sparklemotion · reported by GitHubMedium 5.9
The Mechanize library is used for automating interaction with websites. Mechanize automatically stores and sends cookies, follows redirects, and can follow links and submit forms. In versions prior to 2.8.5 the Authorization header is leaked after a redirect to a different port on the same site. Users are advised to upgrade to Mechanize v2.8.5 or later. There are no known workarounds for this issue.
- Product
- mechanize
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022A cross-site scripting (XSS) vulnerability in /omps/seller of Online Market Place Site v1.0 allows attackers to execute arbitrary web cripts or HTML via a craftCVE-2022-29628 · Other software · Online Market Place Site Project · reported by MITREMedium 5.4
A cross-site scripting (XSS) vulnerability in /omps/seller of Online Market Place Site v1.0 allows attackers to execute arbitrary web cripts or HTML via a crafted payload injected into the Page parameter.
- Product
- Online Market Place Site
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022An insecure direct object reference (IDOR) in Online Market Place Site v1.0 allows attackers to modify products that are owned by other sellers.CVE-2022-29627 · Other software · Online Market Place Site Project · reported by MITREMedium 4.3
An insecure direct object reference (IDOR) in Online Market Place Site v1.0 allows attackers to modify products that are owned by other sellers.
- Product
- Online Market Place Site
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the markdown-link-extractor npm package, when an attacker is able to supply arbiCVE-2021-43308 · Other software · markdown-link-extractor · reported by reefs@jfrog.comMedium 5.9
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the markdown-link-extractor npm package, when an attacker is able to supply arbitrary input to the module's exported function
- Product
- markdown-link-extractor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordresearch.jfrog.comresearch.jfrog.com
Jun 2, 2022In the code that verifies the file size in the ark library, it is possible to manipulate the offset read from the target file due to the wrong use of the data tCVE-2021-26635 · Other software · Bandisoft International Inc. · reported by vuln@krcert.or.krHigh 7.8
In the code that verifies the file size in the ark library, it is possible to manipulate the offset read from the target file due to the wrong use of the data type. An attacker could use this vulnerability to cause a stack buffer overflow and as a result, perform an attack such as remote code execution.
- Product
- ark library
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkrcert.or.krkrcert.or.kr
May 23, 2022Inout Blockchain AltExchanger 1.2.1 allows index.php/coins/update_marketboxslider marketcurrency SQL injection.CVE-2022-31488 · Other software · Inoutscripts · reported by MITREHigh 7.5
Inout Blockchain AltExchanger 1.2.1 allows index.php/coins/update_marketboxslider marketcurrency SQL injection.
- Product
- Blockchain Altexchanger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2022Nokogiri is an open source XML and HTML library for Ruby.CVE-2022-29181 · Other software · sparklemotion · reported by GitHubHigh 8.2
Nokogiri is an open source XML and HTML library for Ruby. Nokogiri prior to version 1.13.6 does not type-check all inputs into the XML and HTML4 SAX parsers, allowing specially crafted untrusted inputs to cause illegal memory access errors (segfault) or reads from unrelated memory. Version 1.13.6 contains a patch for this issue. As a workaround, ensure the untrusted input is a `String` by calling `#to_s` or equivalent.
- Product
- nokogiri
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2022Proton v0.2.0 allows an attacker to create a malicious link inside a markdown file.CVE-2022-25224 · Other software · Proton Project · reported by help@fluidattacks.comMedium 5.4
Proton v0.2.0 allows an attacker to create a malicious link inside a markdown file. When the victim clicks the link, the application opens the site in the current frame allowing an attacker to host JavaScript code in the malicious link in order to trigger an XSS attack. The 'nodeIntegration' configuration is set to on which allows the 'webpage' to use 'NodeJs' features, an attacker can leverage this to run OS commands.
- Product
- Proton
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comfluidattacks.com
May 18, 2022A flaw was found in moodle where ID numbers displayed when bulk allocating markers to assignments required additional sanitizing to prevent a stored XSS risk.CVE-2022-30596 · Other software · Moodle · reported by patrick@puiterwijk.orgMedium 5.4
A flaw was found in moodle where ID numbers displayed when bulk allocating markers to assignments required additional sanitizing to prevent a stored XSS risk.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.moodle.orgbugzilla.redhat.com
May 12, 2022Authentication Bypass Using an Alternate Path or Channel in GitHub repository requarks/wiki prior to 2.5.281.CVE-2022-1681 · Other software · requarks · reported by security@huntr.devHigh 7.2
Authentication Bypass Using an Alternate Path or Channel in GitHub repository requarks/wiki prior to 2.5.281. User can get root user permissions
- Product
- requarks/wiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2022Turtlapp Turtle Note v0.7.2.6 does not filter the <meta> tag during markdown parsing, allowing attackers to execute HTML injection.CVE-2022-28101 · Other software · Lyonbros · reported by MITRECritical 9
Turtlapp Turtle Note v0.7.2.6 does not filter the <meta> tag during markdown parsing, allowing attackers to execute HTML injection.
- Product
- Turtl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comcybercitadel.com
Apr 28, 2022Lexmark products through 2022-02-10 have Incorrect Access Control.CVE-2022-24935 · Other software · Lexmark · reported by MITREHigh 7.5
Lexmark products through 2022-02-10 have Incorrect Access Control.
- Product
- Lexmark Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlexmark.compublications.lexmark.com
Apr 27, 2022In Miele Benchmark Programming Tool with versions Prior to 1.2.71, executable files manipulated by attackers are unknowingly executed with users privileges.CVE-2022-22521 · Other software · Miele · reported by info@cert.vde.comHigh 7.3
In Miele Benchmark Programming Tool with versions Prior to 1.2.71, executable files manipulated by attackers are unknowingly executed with users privileges. An attacker with low privileges may trick a user with administrative privileges to execute these binaries as admin.
- Product
- Benchmark Programming Tool
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Apr 25, 2022Authenticated (admin user role) Persistent Cross-Site Scripting (XSS) in Mark Daniels Night Mode plugin <= 1.0.0 on WordPress via vulnerable parameters: &ntmodeCVE-2022-29418 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (admin user role) Persistent Cross-Site Scripting (XSS) in Mark Daniels Night Mode plugin <= 1.0.0 on WordPress via vulnerable parameters: &ntmode_page_setting[enable-me], &ntmode_page_setting[bg-color], &ntmode_page_setting[txt-color], &ntmode_page_setting[anc_color].
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Apr 22, 2022Command Injection vulnerability in git-interface@2.1.1 in GitHub repository yarkeev/git-interface prior to 2.1.2.CVE-2022-1440 · Other software · yarkeev · reported by security@huntr.devCritical 9.8
Command Injection vulnerability in git-interface@2.1.1 in GitHub repository yarkeev/git-interface prior to 2.1.2. If both are provided by user input, then the use of a `--upload-pack` command-line argument feature of git is also supported for `git clone`, which would then allow for any operating system command to be spawned by the attacker.
- Product
- yarkeev/git-interface
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 19, 2022Mattermost version 6.4.x and earlier fails to properly check the plugin version when a plugin is installed from the Marketplace, which allows an authenticated aCVE-2022-1384 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 4.7
Mattermost version 6.4.x and earlier fails to properly check the plugin version when a plugin is installed from the Marketplace, which allows an authenticated and an authorized user to install and exploit an old plugin version from the Marketplace which might have known vulnerabilities.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Apr 11, 2022org.cyberneko.html is an html parser written in Java.CVE-2022-24839 · Other software · sparklemotion · reported by GitHubHigh 7.5
org.cyberneko.html is an html parser written in Java. The fork of `org.cyberneko.html` used by Nokogiri (Rubygem) raises a `java.lang.OutOfMemoryError` exception when parsing ill-formed HTML markup. Users are advised to upgrade to `>= 1.9.22.noko2`. Note: The upstream library `org.cyberneko.html` is no longer maintained. Nokogiri uses its own fork of this library located at https://github.com/sparklemotion/nekohtml and this CVE applies only to that fork. Other forks of nekohtml may have a similar vulnerability.
- Product
- nekohtml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 11, 2022Nokogiri is an open source XML and HTML library for Ruby.CVE-2022-24836 · Other software · sparklemotion · reported by GitHubHigh 7.5
Nokogiri is an open source XML and HTML library for Ruby. Nokogiri `< v1.13.4` contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to detect encoding in HTML documents. Users are advised to upgrade to Nokogiri `>= 1.13.4`. There are no known workarounds for this issue.
- Product
- nokogiri
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orggithub.com
Apr 11, 2022HedgeDoc is an open-source, web-based, self-hosted, collaborative markdown editor.CVE-2022-24837 · Other software · hedgedoc · reported by GitHubMedium 5.3
HedgeDoc is an open-source, web-based, self-hosted, collaborative markdown editor. Images uploaded with HedgeDoc version 1.9.1 and later have an enumerable filename after the upload, resulting in potential information leakage of uploaded documents. This is especially relevant for private notes and affects all upload backends, except Lutim and imgur. This issue is patched in version 1.9.3 by replacing the filename generation with UUIDv4. If you cannot upgrade to HedgeDoc 1.9.3, it is possible to block POST requests to `/uploadimage`, which will disable future uploads.
- Product
- hedgedoc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 11, 2022Improper authentication vulnerability in SecretMode in Samsung Internet prior to version 16.2.1 allows attackers to access bookmark tab without proper credentiaCVE-2022-27839 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comLow 3.3
Improper authentication vulnerability in SecretMode in Samsung Internet prior to version 16.2.1 allows attackers to access bookmark tab without proper credentials.
- Product
- Samsung Internet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Apr 11, 2022An unprivileged user could use the functionality of the NS WooCommerce Watermark WordPress plugin through 2.11.3 to load images that hide malware for example frCVE-2022-0989 · WordPress plugins & themes · reported by WPScanHigh 7.5
An unprivileged user could use the functionality of the NS WooCommerce Watermark WordPress plugin through 2.11.3 to load images that hide malware for example from passing malicious domains to hide their trace, by making them pass through the vulnerable domain.
- Product
- NS WooCommerce Watermark
- Affected
- up to 2.11.3
- What to do
- Affects up to 2.11.3. Update NS WooCommerce Watermark to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 7, 2022Microprogram’s parking lot management system is vulnerable to sensitive information exposure.CVE-2022-25594 · Other software · Microprogram · reported by twcert@cert.org.twMedium 5.3
Microprogram’s parking lot management system is vulnerable to sensitive information exposure. An unauthorized remote attacker can input specific URLs to acquire partial system configuration information.
- Product
- parking lot management system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Apr 5, 2022In JetBrains YouTrack before 2022.1.43700 it was possible to inject JavaScript into Markdown in the YouTrack Classic UICVE-2022-28650 · Other software · JetBrains · reported by cve@jetbrains.comHigh 7.3
In JetBrains YouTrack before 2022.1.43700 it was possible to inject JavaScript into Markdown in the YouTrack Classic UI
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
Apr 4, 2022Mark Posts: Does not escape new markersCVE-2022-0958 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Mark Posts WordPress plugin before 2.0.1 does not escape new markers, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Mark Posts
- Fixed in
- 2.0.1
- What to do
- Update Mark Posts to 2.0.1 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Apr 1, 2022A remote code execution vulnerability due to incomplete check for 'xheader_decode_path_record' function's parameter length value in the ark library.CVE-2021-26623 · Other software · Bandisoft International Inc. · reported by vuln@krcert.or.krHigh 7.8
A remote code execution vulnerability due to incomplete check for 'xheader_decode_path_record' function's parameter length value in the ark library. Remote attackers can induce exploit malicious code using this function.
- Product
- Bandizip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkrcert.or.krkrcert.or.kr
Apr 1, 2022A flaw was found in darkhttpd.CVE-2020-25691 · Other software · Unix4lyfe · reported by Red HatHigh 7.5
A flaw was found in darkhttpd. Invalid error handling allows remote attackers to cause denial-of-service by accessing a file with a large modification date. The highest threat from this vulnerability is to system availability.
- Product
- Darkhttpd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.redhat.com
Mar 28, 2022Leanote 2.7.0 is vulnerable to Cross Site Scripting (XSS) in the markdown type note.CVE-2021-43721 · Other software · Leanote · reported by MITREMedium 6.1
Leanote 2.7.0 is vulnerable to Cross Site Scripting (XSS) in the markdown type note. This leads to remote code execution with payload : <video src=x onerror=(function(){require('child_process').exec('calc');})();>
- Product
- Leanote
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2022Marky commit 3686565726c65756e was discovered to contain a remote code execution (RCE) vulnerability via the Display text fields.CVE-2022-26205 · Other software · Marky Project · reported by MITRECritical 9.8
Marky commit 3686565726c65756e was discovered to contain a remote code execution (RCE) vulnerability via the Display text fields. This vulnerability allows attackers to execute arbitrary code via injection of a crafted payload.
- Product
- Marky
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2022SQL injection through marking blog comments on bulk as spam in GitHub repository forkcms/forkcms prior to 5.11.1.CVE-2022-1064 · Other software · forkcms · reported by security@huntr.devHigh 8.8
SQL injection through marking blog comments on bulk as spam in GitHub repository forkcms/forkcms prior to 5.11.1.
- Product
- forkcms/forkcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2022Multiple cross-site scripting (XSS) vulnerabilities in Parking Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via crafted paylCVE-2022-25575 · Other software · Hongmen · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in Parking Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via crafted payloads injected into the user name, password, and verification code text boxes.
- Product
- Parking Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2022A flaw was found in Quarkus.CVE-2022-0981 · Other software · Quarkus · reported by Red HatHigh 8.8
A flaw was found in Quarkus. The state and potentially associated permissions can leak from one web request to another in RestEasy Reactive. This flaw allows a low-privileged user to perform operations on the database with a different set of privileges than intended.
- Product
- Quarkus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comgithub.com
Mar 19, 2022The matchmaking servers of Bandai Namco FromSoftware Dark Souls III through 2022-03-19 allow remote attackers to send arbitrary push requests to clients via a RCVE-2022-24125 · Other software · Fromsoftware · reported by MITREHigh 8.8
The matchmaking servers of Bandai Namco FromSoftware Dark Souls III through 2022-03-19 allow remote attackers to send arbitrary push requests to clients via a RequestSendMessageToPlayers request. For example, ability to send a push message to hundreds of thousands of machines is only restricted on the client side, and can thus be bypassed with a modified client.
- Product
- Dark Souls III
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfromsoftware.jpgithub.com
Mar 19, 2022A buffer overflow in the NRSessionSearchResult parser in Bandai Namco FromSoftware Dark Souls III through 2022-03-19 allows remote attackers to execute arbitrarCVE-2022-24126 · Other software · Fromsoftware · reported by MITRECritical 9.8
A buffer overflow in the NRSessionSearchResult parser in Bandai Namco FromSoftware Dark Souls III through 2022-03-19 allows remote attackers to execute arbitrary code via matchmaking servers, a different vulnerability than CVE-2021-34170.
- Product
- Dark Souls III
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfromsoftware.jpgithub.com
Mar 17, 2022The package post-loader from 0.0.0 are vulnerable to Arbitrary Code Execution which uses a markdown parser in an unsafe way so that any javascript code inside tCVE-2022-0748 · Other software · Post-loader Project · reported by report@snyk.ioCritical 9.8
The package post-loader from 0.0.0 are vulnerable to Arbitrary Code Execution which uses a markdown parser in an unsafe way so that any javascript code inside the markdown input files gets evaluated and executed.
- Product
- Post-loader
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2022Cross-Site Request Forgery (CSRF) vulnerability affecting Delete Marker Category, Delete Map, and Copy Map functions in WP Google Map plugin (versions <= 4.2.3)CVE-2022-25600 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability affecting Delete Marker Category, Delete Map, and Copy Map functions in WP Google Map plugin (versions <= 4.2.3).
- Affected
- up to 4.2.3
- What to do
- Affects up to 4.2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordlists.fedoraproject.orglists.fedoraproject.org
Mar 10, 2022Nextcloud text is a collaborative document editing using Markdown built for the nextcloud server.CVE-2021-41233 · Other software · nextcloud · reported by GitHubMedium 6.5
Nextcloud text is a collaborative document editing using Markdown built for the nextcloud server. Due to an issue with the Nextcloud Text application, which is by default shipped with Nextcloud Server, an attacker is able to access the folder names of "File Drop". For successful exploitation an attacker requires knowledge of the sharing link. It is recommended that users upgrade their Nextcloud Server to 20.0.14, 21.0.6 or 22.2.1. Users unable to upgrade should disable the Nextcloud Text application in the application settings.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2022A stored cross-site scripting vulnerability in marktext versions prior to v0.17.0 due to improper handling of the link (with javascript: scheme) inside the docuCVE-2022-21158 · Other software · MarkText · reported by vultures@jpcert.or.jpMedium 5.4
A stored cross-site scripting vulnerability in marktext versions prior to v0.17.0 due to improper handling of the link (with javascript: scheme) inside the document may allow an attacker to execute an arbitrary script on the PC of the user using marktext.
- Product
- MarkText
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2022Apache Spark supports end-to-end encryption of RPC connections via "spark.authenticate" and "spark.network.crypto.enabled".CVE-2021-38296 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
Apache Spark supports end-to-end encryption of RPC connections via "spark.authenticate" and "spark.network.crypto.enabled". In versions 3.1.2 and earlier, it uses a bespoke mutual authentication protocol that allows for full encryption key recovery. After an initial interactive attack, this would allow someone to decrypt plaintext traffic offline. Note that this does not affect security mechanisms controlled by "spark.authenticate.enableSaslEncryption", "spark.io.encryption.enabled", "spark.ssl", "spark.ui.strictTransportSecurity". Update to Apache Spark 3.1.3 or later
- Product
- Apache Spark
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgoracle.com
Mar 4, 2022Mark Text v0.16.3 was discovered to contain a DOM-based cross-site scripting (XSS) vulnerability which allows attackers to perform remote code execution (RCE) vCVE-2022-25069 · Other software · Marktext · reported by MITRECritical 9.6
Mark Text v0.16.3 was discovered to contain a DOM-based cross-site scripting (XSS) vulnerability which allows attackers to perform remote code execution (RCE) via injecting a crafted payload into /lib/contentState/pasteCtrl.js.
- Product
- Marktext
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2022PeteReport Version 0.5 allows an authenticated admin user to inject persistent JavaScript code inside the markdown descriptions while creating a product, reportCVE-2022-25220 · Other software · Petereport Project · reported by help@fluidattacks.comMedium 4.8
PeteReport Version 0.5 allows an authenticated admin user to inject persistent JavaScript code inside the markdown descriptions while creating a product, report or finding.
- Product
- Petereport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comgithub.com
Mar 3, 2022cmark-gfm is GitHub's extended version of the C reference implementation of CommonMark.CVE-2022-24724 · Other software · github · reported by GitHubHigh 8.8
cmark-gfm is GitHub's extended version of the C reference implementation of CommonMark. Prior to versions 0.29.0.gfm.3 and 0.28.3.gfm.21, an integer overflow in cmark-gfm's table row parsing `table.c:row_from_string` may lead to heap memory corruption when parsing tables who's marker rows contain more than UINT16_MAX columns. The impact of this heap corruption ranges from Information Leak to Arbitrary Code Execution depending on how and where `cmark-gfm` is used. If `cmark-gfm` is used for rendering remote user controlled markdown, this vulnerability may lead to Remote Code Execution (RCE) in applications employing affected versions of the `cmark-gfm` library. This vulnerability has been patched in the following cmark-gfm versions 0.29.0.gfm.3 and 0.28.3.gfm.21. A workaround is available. The vulnerability exists in the table markdown extensions of cmark-gfm. Disabling the table extension will prevent this vulnerability from being triggered.
- Product
- cmark-gfm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Mar 3, 2022CyberArk Identity versions up to and including 22.1 in the 'StartAuthentication' resource, exposes the response header 'X-CFY-TX-TM'.CVE-2022-22700 · Other software · Cyberark · reported by help@fluidattacks.comMedium 5.3
CyberArk Identity versions up to and including 22.1 in the 'StartAuthentication' resource, exposes the response header 'X-CFY-TX-TM'. In certain configurations, that response header contains different, predictable value ranges which can be used to determine whether a user exists in the tenant.
- Product
- Identity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.cyberark.comfluidattacks.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.