Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,318 results · page 39 of 67
Mar 24, 2023In registerSignalHandlers of main.c, there is a possible local arbitrary code execution due to a use after free.CVE-2023-21020 · Computers, phones & browsers · Google · reported by security@android.comMedium 6.7
In registerSignalHandlers of main.c, there is a possible local arbitrary code execution due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-256591441
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Mar 16, 2023School Registration and Fee System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at/bilal final/edit_user.php.CVE-2023-27041 · Other software · School Registration And FEE System Project · reported by MITRECritical 9.8
School Registration and Fee System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at/bilal final/edit_user.php.
- Product
- School Registration And FEE System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2023Stored Cross-Site Scripting (XSS) vulnerability in ThemeKraft Post Form – Registration Form – Profile Form for User Profiles and Content Forms for User SubmissiCVE-2022-38971 · WordPress plugins & themes · reported by PatchstackMedium 4.7
Stored Cross-Site Scripting (XSS) vulnerability in ThemeKraft Post Form – Registration Form – Profile Form for User Profiles and Content Forms for User Submissions plugin <= 2.7.5 versions.
- Affected
- up to 2.7.5
- What to do
- Affects up to 2.7.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 13, 2023Cross-Site Request Forgery (CSRF) vulnerability in RegistrationMagic plugin <= 5.1.9.2 versions.CVE-2023-25991 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in RegistrationMagic plugin <= 5.1.9.2 versions.
- Affected
- up to 5.1.9.2
- What to do
- Affects up to 5.1.9.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 13, 2023McAfee Total Protection prior to 16.0.50 allows attackers to elevate user privileges due to Improper Link Resolution via registry keys.CVE-2023-24577 · Other software · Mcafee · reported by MITREMedium 5.5
McAfee Total Protection prior to 16.0.50 allows attackers to elevate user privileges due to Improper Link Resolution via registry keys. This could enable a user with lower privileges to execute unauthorized tasks.
- Product
- Total Protection
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2023In Moodle, Users' names required additional sanitizing in the account confirmation email, to prevent a self-registration phishing risk.CVE-2021-36402 · Other software · Moodle · reported by patrick@puiterwijk.orgMedium 5.3
In Moodle, Users' names required additional sanitizing in the account confirmation email, to prevent a self-registration phishing risk.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2023A vulnerability was found in Email Registration 5.x-2.1 on Drupal.CVE-2008-10004 · Other software · Email Registration Project · reported by VulDBMedium 6.3
A vulnerability was found in Email Registration 5.x-2.1 on Drupal. It has been declared as critical. This vulnerability affects the function email_registration_user of the file email_registration.module. The manipulation of the argument namenew leads to sql injection. The attack can be initiated remotely. Upgrading to version 6.x-1.0 is able to address this issue. The patch is identified as 126c141b7db038c778a2dc931d38766aad8d1112. It is recommended to upgrade the affected component. VDB-222334 is the identifier assigned to this vulnerability.
- Product
- Email Registration
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2023Fullworks Quick Event Manager plugin <= 9.7.4 affecting all registration actions: Cross-Site Request Forgery (CSRF)CVE-2023-23974 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Fullworks Quick Event Manager plugin <= 9.7.4 affecting all registration actions (delete, delete all, edit, update).
- Product
- Fullworks Quick Event Manager plugin <= 9.7.4 affecting all registration actions
- Fixed in
- 9.7.5
- What to do
- Update Fullworks Quick Event Manager plugin <= 9.7.4 affecting all registration actions to 9.7.5 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Feb 28, 2023In the Linux kernel before 5.17, an error path in dwc3_qcom_acpi_register_core in drivers/usb/dwc3/dwc3-qcom.c lacks certain platform_device_put and kfree callsCVE-2023-22995 · Computers, phones & browsers · Linux · reported by MITREHigh 7.8
In the Linux kernel before 5.17, an error path in dwc3_qcom_acpi_register_core in drivers/usb/dwc3/dwc3-qcom.c lacks certain platform_device_put and kfree calls.
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcdn.kernel.orggithub.com
Feb 27, 2023Simple Customer Relationship Management System v1.0 was discovered to contain a SQL injection vulnerability via the name parameter on the registration page.CVE-2023-24651 · Other software · Oretnom23 · reported by MITREMedium 5.4
Simple Customer Relationship Management System v1.0 was discovered to contain a SQL injection vulnerability via the name parameter on the registration page.
- Product
- Simple Customer Relationship Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsourcecodester.com
Feb 27, 2023Registration Forms: Does not properly validate the redirection URLCVE-2023-0552 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Registration Forms WordPress plugin before 3.8.2.3 does not properly validate the redirection URL when logging in and login out, leading to an Open Redirect vulnerability
- Product
- Registration Forms
- Fixed in
- 3.8.2.3
- What to do
- Update Registration Forms to 3.8.2.3 or newer.
Feb 24, 2023In the Linux kernel before 6.1.13, there is a double free in net/mpls/af_mpls.c upon an allocation failure (for registering the sysctl table under a new locatioCVE-2023-26545 · Other software · Debian · reported by MITREMedium 4.7
In the Linux kernel before 6.1.13, there is a double free in net/mpls/af_mpls.c upon an allocation failure (for registering the sysctl table under a new location) during the renaming of a device.
- Product
- Debian Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcdn.kernel.orggit.kernel.org
Feb 14, 2023PC settings tool Ver10.1.26.0 and earlier, PC settings tool Ver11.0.22.0 and earlier allows a attacker to write to the registry as administrator privileges withCVE-2023-25011 · Other software · NEC Corporation · reported by psirt-info@cyber.jp.nec.comHigh 7.8
PC settings tool Ver10.1.26.0 and earlier, PC settings tool Ver11.0.22.0 and earlier allows a attacker to write to the registry as administrator privileges with standard user privileges.
- Product
- PC settings tool
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjpn.nec.comjpn.nec.com
Feb 13, 2023Profile Builder – User Profile & User Registration Forms: Sensitive information disclosureCVE-2023-0814 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Profile Builder – User Profile & User Registration Forms plugin for WordPress is vulnerable to sensitive information disclosure via the [user_meta] shortcode in versions up to, and including 3.9.0. This is due to insufficient restriction on sensitive user meta values that can be called via that shortcode. This makes it possible for authenticated attackers, with subscriber-level permissions, and above to retrieve sensitive user meta that can be used to gain access to a high privileged user account. This does require the Usermeta shortcode be enabled to be exploited.
- Product
- Profile Builder – User Profile & User Registration Forms
- Affected
- up to 3.9.0
- What to do
- Affects up to 3.9.0. Update Profile Builder – User Profile & User Registration Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordlana.codesplugins.trac.wordpress.org
Feb 9, 2023ChurchCRM 4.5.3 and below was discovered to contain a stored cross-site scripting (XSS) vulnerability at /api/public/register/family.CVE-2023-24690 · Other software · Churchcrm · reported by MITREMedium 5.4
ChurchCRM 4.5.3 and below was discovered to contain a stored cross-site scripting (XSS) vulnerability at /api/public/register/family.
- Product
- Churchcrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchurchcrm.iogithub.com
Feb 9, 2023An issue in Mojoportal v2.7.0.0 allows an unauthenticated attacker to register a new user even if the Allow User Registrations feature is disabled.CVE-2023-24688 · Other software · Mojoportal · reported by MITREMedium 5.3
An issue in Mojoportal v2.7.0.0 allows an unauthenticated attacker to register a new user even if the Allow User Registrations feature is disabled.
- Product
- Mojoportal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commojoportal.com
Jan 30, 2023Custom User Profile Fields for User Registration: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4831 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Custom User Profile Fields for User Registration WordPress plugin before 1.8.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Custom User Profile Fields for User Registration
- Fixed in
- 1.8.1
- What to do
- Update Custom User Profile Fields for User Registration to 1.8.1 or newer.
Jan 26, 2023In addOrReplacePhoneAccount of PhoneAccountRegistrar.java, there is a possible way to enable a phone account without user interaction due to a logic error in thCVE-2023-20915 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In addOrReplacePhoneAccount of PhoneAccountRegistrar.java, there is a possible way to enable a phone account without user interaction due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-246930197
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Jan 15, 2023A vulnerability was found in KYUUBl school-register.CVE-2015-10047 · Other software · KYUUBl · reported by VulDBMedium 5.5
A vulnerability was found in KYUUBl school-register. It has been classified as critical. This affects an unknown part of the file src/DBManager.java. The manipulation leads to sql injection. The patch is named 1cf7e01b878aee923f2b22cc2535c71a680e4c30. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218355.
- Product
- school-register
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2023BlueCat Device Registration Portal 2.2 allows XXE attacks that exfiltrate single-line files.CVE-2023-23595 · Other software · Bluecatnetworks · reported by MITREHigh 7.5
BlueCat Device Registration Portal 2.2 allows XXE attacks that exfiltrate single-line files. A single-line file might contain credentials, such as "machine example.com login daniel password qwerty" in the documentation example for the .netrc file format. NOTE: 2.x versions are no longer supported. There is no available information about whether any later version is affected.
- Product
- Device Registration Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbluecatnetworks.comeverything.curl.dev
Jan 12, 2023A cross-site scripting (XSS) vulnerability in the component /admin/register.php of Online Student Enrollment System v1.0 allows attackers to execute arbitrary wCVE-2022-46503 · Other software · Online Student Enrollment System Project · reported by MITREMedium 5.4
A cross-site scripting (XSS) vulnerability in the component /admin/register.php of Online Student Enrollment System v1.0 allows attackers to execute arbitrary web scripts via a crafted payload injected into the name parameter.
- Product
- Online Student Enrollment System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2023Insufficient syscall input validation in the ASP Bootloader may allow a privileged attacker to read memory outside the bounds of a mapped register potentially lCVE-2023-20525 · Other software · AMD · reported by psirt@amd.comMedium 6.5
Insufficient syscall input validation in the ASP Bootloader may allow a privileged attacker to read memory outside the bounds of a mapped register potentially leading to a denial of service.
- Product
- 2nd Gen EPYC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2023Insufficient fencing and checks in System Management Unit (SMU) may result in access to invalid message port registers that could result in a potential denial-oCVE-2021-26355 · Other software · AMD · reported by psirt@amd.comMedium 5.5
Insufficient fencing and checks in System Management Unit (SMU) may result in access to invalid message port registers that could result in a potential denial-of-service.
- Product
- 3rd Gen EPYC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2023Memory corruption in Automotive due to integer overflow to buffer overflow while registering a new listener with shared buffer.CVE-2022-33219 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comCritical 9.3
Memory corruption in Automotive due to integer overflow to buffer overflow while registering a new listener with shared buffer.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Dec 26, 2022Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro: Do not escape the cg_Fields POST parameter before concatenating it to an SQL query in users-registry-check-registering-and-loginCVE-2022-4158 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_Fields POST parameter before concatenating it to an SQL query in users-registry-check-registering-and-login.php. This may allow malicious visitors to leak sensitive information from the site's database.
- Product
- Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro
- Fixed in
- 19.1.5.1
- What to do
- Update Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro to 19.1.5.1 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Dec 26, 2022In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, an unauthenticated attacker can use %00 bytes to cause /user/loader.php to register an arbCVE-2021-45467 · Other software · Control-webpanel · reported by MITRECritical 9.8
In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, an unauthenticated attacker can use %00 bytes to cause /user/loader.php to register an arbitrary API key, as demonstrated by a /user/loader.php?api=1&scripts= .%00./.%00./api/account_new_create&acc=guadaapi URI. Any number of %00 instances can be used, e.g., .%00%00%00./.%00%00%00./api/account_new_create could also be used for the scripts parameter.
- Product
- Webpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcontrol-webpanel.comoctagon.net
Dec 23, 2022An image signature validation bypass vulnerability in Kyverno 1.8.3 and 1.8.4 allows a malicious image registry (or a man-in-the-middle attacker) to inject unsiCVE-2022-47633 · Other software · Kyverno · reported by MITREHigh 8.1
An image signature validation bypass vulnerability in Kyverno 1.8.3 and 1.8.4 allows a malicious image registry (or a man-in-the-middle attacker) to inject unsigned arbitrary container images into a protected Kubernetes cluster. This is fixed in 1.8.5. This has been fixed in 1.8.5 and mitigations are available for impacted releases.
- Product
- Kyverno
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2022On arm64, WASM code could have resulted in incorrect assembly generation leading to a register allocation problem, and a potentially exploitable crash.CVE-2022-31740 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.8
On arm64, WASM code could have resulted in incorrect assembly generation leading to a register allocation problem, and a potentially exploitable crash. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10.
- Product
- Thunderbird
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Dec 22, 2022If a compromised content process sent an unexpected number of WebAuthN Extensions in a Register command to the parent process, an out of bounds write would haveCVE-2022-28281 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.8
If a compromised content process sent an unexpected number of WebAuthN Extensions in a Register command to the parent process, an out of bounds write would have occurred leading to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 91.8, Firefox < 99, and Firefox ESR < 91.8.
- Product
- Thunderbird
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Dec 19, 2022Registration Forms: Does not have authorisation and CSRFCVE-2022-4024 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Registration Forms WordPress plugin before 3.8.1.3 does not have authorisation and CSRF when deleting users via an init action handler, allowing unauthenticated attackers to delete arbitrary users (along with their posts)
- Product
- Registration Forms
- Fixed in
- 3.8.1.3
- What to do
- Update Registration Forms to 3.8.1.3 or newer.
Dec 16, 2022In registerReceivers of DeviceCapabilityListener.java, there is a possible way to change preferred TTY mode due to a permissions bypass.CVE-2022-20558 · Computers, phones & browsers · Google · reported by security@android.comLow 3.3
In registerReceivers of DeviceCapabilityListener.java, there is a possible way to change preferred TTY mode due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-236264289
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Dec 16, 2022In registerBroadcastReceiver of RcsService.java, there is a possible way to change preferred TTY mode due to a missing permission check.CVE-2022-20536 · Computers, phones & browsers · Google · reported by security@android.comLow 3.3
In registerBroadcastReceiver of RcsService.java, there is a possible way to change preferred TTY mode due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-235100180
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Dec 16, 2022In registerLocalOnlyHotspotSoftApCallback of WifiManager.java, there is a possible way to determine whether an app is installed, without query permissions, due CVE-2022-20535 · Computers, phones & browsers · Google · reported by security@android.comLow 3.3
In registerLocalOnlyHotspotSoftApCallback of WifiManager.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-233605242
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Dec 15, 2022A vulnerability classified as problematic has been found in WSO2 carbon-registry up to 4.8.6.CVE-2022-4521 · Other software · WSO2 · reported by VulDBLow 3.5
A vulnerability classified as problematic has been found in WSO2 carbon-registry up to 4.8.6. This affects an unknown part of the component Request Parameter Handler. The manipulation of the argument parentPath/path/username/path/profile_menu leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 4.8.7 is able to address this issue. The name of the patch is 9f967abfde9317bee2cda469dbc09b57d539f2cc. It is recommended to upgrade the affected component. The identifier VDB-215901 was assigned to this vulnerability.
- Product
- carbon-registry
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2022A vulnerability was found in WSO2 carbon-registry up to 4.8.11.CVE-2022-4520 · Other software · WSO2 · reported by VulDBLow 3.5
A vulnerability was found in WSO2 carbon-registry up to 4.8.11. It has been rated as problematic. Affected by this issue is some unknown functionality of the file components/registry/org.wso2.carbon.registry.search.ui/src/main/resources/web/search/advancedSearchForm-ajaxprocessor.jsp of the component Advanced Search. The manipulation of the argument mediaType/rightOp/leftOp/rightPropertyValue/leftPropertyValue leads to cross site scripting. The attack may be launched remotely. Upgrading to version 4.8.12 is able to address this issue. The name of the patch is 0c827cc1b14b82d8eb86117ab2e43c34bb91ddb4. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-215900.
- Product
- carbon-registry
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 14, 2022logrocket-oauth2-example through 2020-05-27 allows SQL injection via the /auth/register username parameter.CVE-2022-38488 · Other software · Logrocket-oauth2-example Project · reported by MITRECritical 9.8
logrocket-oauth2-example through 2020-05-27 allows SQL injection via the /auth/register username parameter.
- Product
- Logrocket-oauth2-example
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2022User Registration: Does not properly restrict the files to be uploaded via an AJAX action available to both unauthenticated and authenticated usersCVE-2022-3912 · WordPress plugins & themes · reported by WPScanHigh 7.5
The User Registration WordPress plugin before 2.2.4.1 does not properly restrict the files to be uploaded via an AJAX action available to both unauthenticated and authenticated users, which could allow unauthenticated users to upload PHP files for example.
- Product
- User Registration
- Fixed in
- 2.2.4.1
- What to do
- Update User Registration to 2.2.4.1 or newer.
Dec 11, 2022SENS v1.0 is vulnerable to Cross Site Scripting (XSS) via com.liuyanzhao.sens.web.controller.admin, getRegister.CVE-2022-45758 · Other software · Sens Project · reported by MITREMedium 5.4
SENS v1.0 is vulnerable to Cross Site Scripting (XSS) via com.liuyanzhao.sens.web.controller.admin, getRegister.
- Product
- Sens
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2022WP User Frontend: Uses a user supplied argument called urhidden in its registration formCVE-2021-24649 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WP User Frontend WordPress plugin before 3.5.29 uses a user supplied argument called urhidden in its registration form, which contains the role for the account to be created with, encrypted via wpuf_encryption(). This could allow an attacker having access to the AUTH_KEY and AUTH_SALT constant (via an arbitrary file access issue for example, or if the blog is using the default keys) to create an account with any role they want, such as admin
- Product
- WP User Frontend
- Fixed in
- 3.5.29
- What to do
- Update WP User Frontend to 3.5.29 or newer.
Nov 15, 2022A missing permission check in Jenkins CloudBees Docker Hub/Registry Notification Plugin 2.6.2 and earlier allows unauthenticated attackers to trigger builds of CVE-2022-45385 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comHigh 7.5
A missing permission check in Jenkins CloudBees Docker Hub/Registry Notification Plugin 2.6.2 and earlier allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified repository.
- Product
- Jenkins CloudBees Docker Hub/Registry Notification Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Nov 9, 2022An attacker with local access to the system can make unauthorized modifications of the security configuration of the SOC registers.CVE-2021-26360 · Other software · AMD · reported by psirt@amd.comHigh 7.8
An attacker with local access to the system can make unauthorized modifications of the security configuration of the SOC registers. This could allow potential corruption of AMD secure processor’s encrypted memory contents which may lead to arbitrary code execution in ASP.
- Product
- AMD Radeon RX 6000 Series & PRO W6000 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 24, 2022Observable discrepancies in the login process allow an attacker to guess legitimate user names registered in the BMC.CVE-2021-45925 · Other software · Lanner Inc · reported by prodsec@nozominetworks.comMedium 5.3
Observable discrepancies in the login process allow an attacker to guess legitimate user names registered in the BMC. This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.10.0.
- Product
- IAC-AST2500A
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnozominetworks.comnozominetworks.com
Oct 21, 2022Biplob Adhikari's Accordions – Multiple Accordions or FAQs Builder: Auth. WordPress Options Change (siteurl, users_can_register, default_role, admin_email and new_admin_email)CVE-2022-38104 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Auth. WordPress Options Change (siteurl, users_can_register, default_role, admin_email and new_admin_email) vulnerability in Biplob Adhikari's Accordions – Multiple Accordions or FAQs Builder plugin (versions <= 2.0.3 on WordPress.
- Product
- Biplob Adhikari's Accordions – Multiple Accordions or FAQs Builder
- Affected
- up to 2.0.3
- What to do
- Affects up to 2.0.3. Update Biplob Adhikari's Accordions – Multiple Accordions or FAQs Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Oct 19, 2022Memory corruption in multimedia due to use after free during callback registration failure in Snapdragon MobileCVE-2022-25723 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 8.4
Memory corruption in multimedia due to use after free during callback registration failure in Snapdragon Mobile
- Product
- Snapdragon Mobile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Oct 17, 2022MITRE CALDERA 4.1.0 allows stored XSS via app.contact.gist (aka the gist contact configuration field), leading to execution of arbitrary commands on agents.CVE-2022-41139 · Other software · Mitre · reported by MITREMedium 5.4
MITRE CALDERA 4.1.0 allows stored XSS via app.contact.gist (aka the gist contact configuration field), leading to execution of arbitrary commands on agents.
- Product
- Caldera
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2022Windows Server Remotely Accessible Registry Keys Information Disclosure VulnerabilityCVE-2022-38033 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Windows Server Remotely Accessible Registry Keys Information Disclosure Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Oct 11, 2022A Stored XSS issue in Student Clearance System v.1.0 allows the injection of arbitrary JavaScript in the Student registration form.CVE-2022-42235 · Other software · Student Clearance System Project · reported by MITREMedium 5.4
A Stored XSS issue in Student Clearance System v.1.0 allows the injection of arbitrary JavaScript in the Student registration form.
- Product
- Student Clearance System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2022mfa/FIDO2.py in django-mfa2 before 2.5.1 and 2.6.x before 2.6.1 allows a replay attack that could be used to register another device for a user.CVE-2022-42731 · Other software · Django-mfa2 Project · reported by MITREHigh 7.5
mfa/FIDO2.py in django-mfa2 before 2.5.1 and 2.6.x before 2.6.1 allows a replay attack that could be used to register another device for a user. The device registration challenge is not invalidated after usage.
- Product
- Django-mfa2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2022A registry permissions vulnerability in the Trend Micro Apex One Data Loss Prevention (DLP) module could allow a local attacker with administrative credentials CVE-2022-41748 · Other software · Trend Micro · reported by security@trendmicro.comMedium 6.7
A registry permissions vulnerability in the Trend Micro Apex One Data Loss Prevention (DLP) module could allow a local attacker with administrative credentials to bypass certain elements of the product's anti-tampering mechanisms on affected installations. Please note: an attacker must first obtain administrative credentials on the target system in order to exploit this vulnerability.
- Product
- Trend Micro Apex One
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsuccess.trendmicro.comsuccess.trendmicro.com
Oct 7, 2022Improper access control vulnerability in RegisteredEventMediator.kt SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information via iCVE-2022-39866 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4
Improper access control vulnerability in RegisteredEventMediator.kt SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information via implicit broadcast.
- Product
- SmartThings
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.